runtime/JSObject.h

   1 /*
   2  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
   3  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
   4  *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
   5  *
   6  *  This library is free software; you can redistribute it and/or
   7  *  modify it under the terms of the GNU Library General Public
   8  *  License as published by the Free Software Foundation; either
   9  *  version 2 of the License, or (at your option) any later version.
  10  *
  11  *  This library is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  *  Library General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU Library General Public License
  17  *  along with this library; see the file COPYING.LIB.  If not, write to
  18  *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  19  *  Boston, MA 02110-1301, USA.
  20  *
  21  */
  22
  23 #ifndef JSObject_h
  24 #define JSObject_h
  25
  26 #include "ArgList.h"
  27 #include "ClassInfo.h"
  28 #include "CommonIdentifiers.h"
  29 #include "CallFrame.h"
  30 #include "JSCell.h"
  31 #include "PropertySlot.h"
  32 #include "PutPropertySlot.h"
  33 #include "ScopeChain.h"
  34 #include "StorageBarrier.h"
  35 #include "Structure.h"
  36 #include "JSGlobalData.h"
  37 #include "JSString.h"
  38 #include <wtf/StdLibExtras.h>
  39
  40 namespace JSC {
  41
  42     inline JSCell* getJSFunction(JSValue value)
  43     {
  44         if (value.isCell() && (value.asCell()->structure()->typeInfo().type() == JSFunctionType))
  45             return value.asCell();
  46         return 0;
  47     }
  48
  49     class GetterSetter;
  50     class HashEntry;
  51     class InternalFunction;
  52     class LLIntOffsetsExtractor;
  53     class MarkedBlock;
  54     class PropertyDescriptor;
  55     class PropertyNameArray;
  56     class Structure;
  57     struct HashTable;
  58
  59     JS_EXPORT_PRIVATE JSObject* throwTypeError(ExecState*, const UString&);
  60     extern JS_EXPORTDATA const char* StrictModeReadonlyPropertyWriteError;
  61
  62     // ECMA 262-3 8.6.1
  63     // Property attributes
  64     enum Attribute {
  65         None         = 0,
  66         ReadOnly     = 1 << 1,  // property can be only read, not written
  67         DontEnum     = 1 << 2,  // property doesn't appear in (for .. in ..)
  68         DontDelete   = 1 << 3,  // property can't be deleted
  69         Function     = 1 << 4,  // property is a function - only used by static hashtables
  70         Accessor     = 1 << 5,  // property is a getter/setter
  71     };
  72
  73     class JSObject : public JSCell {
  74         friend class BatchedTransitionOptimizer;
  75         friend class JIT;
  76         friend class JSCell;
  77         friend class MarkedBlock;
  78         JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject* thisObj, const Identifier& propertyName, PropertySlot& slot);
  79
  80         enum PutMode {
  81             PutModePut,
  82             PutModeDefineOwnProperty,
  83         };
  84
  85     public:
  86         typedef JSCell Base;
  87
  88         JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
  89
  90         JS_EXPORT_PRIVATE static UString className(const JSObject*);
  91
  92         JSValue prototype() const;
  93         void setPrototype(JSGlobalData&, JSValue prototype);
  94         bool setPrototypeWithCycleCheck(JSGlobalData&, JSValue prototype);
  95
  96         Structure* inheritorID(JSGlobalData&);
  97
  98         JSValue get(ExecState*, const Identifier& propertyName) const;
  99         JSValue get(ExecState*, unsigned propertyName) const;
 100
 101         bool getPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 102         bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 103         JS_EXPORT_PRIVATE bool getPropertyDescriptor(ExecState*, const Identifier& propertyName, PropertyDescriptor&);
 104
 105         static bool getOwnPropertySlot(JSCell*, ExecState*, const Identifier& propertyName, PropertySlot&);
 106         JS_EXPORT_PRIVATE static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned propertyName, PropertySlot&);
 107         JS_EXPORT_PRIVATE static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
 108
 109         bool allowsAccessFrom(ExecState*);
 110
 111         JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
 112         JS_EXPORT_PRIVATE static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
 113
 114         // putDirect is effectively an unchecked vesion of 'defineOwnProperty':
 115         //  - the prototype chain is not consulted
 116         //  - accessors are not called.
 117         //  - attributes will be respected (after the call the property will exist with the given attributes)
 118         JS_EXPORT_PRIVATE static void putDirectVirtual(JSObject*, ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
 119         void putDirect(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attributes = 0);
 120         void putDirect(JSGlobalData&, const Identifier& propertyName, JSValue, PutPropertySlot&);
 121         void putDirectWithoutTransition(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attributes = 0);
 122         void putDirectAccessor(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attributes);
 123
 124         bool propertyIsEnumerable(ExecState*, const Identifier& propertyName) const;
 125
 126         JS_EXPORT_PRIVATE bool hasProperty(ExecState*, const Identifier& propertyName) const;
 127         JS_EXPORT_PRIVATE bool hasProperty(ExecState*, unsigned propertyName) const;
 128         bool hasOwnProperty(ExecState*, const Identifier& propertyName) const;
 129
 130         JS_EXPORT_PRIVATE static bool deleteProperty(JSCell*, ExecState*, const Identifier& propertyName);
 131         JS_EXPORT_PRIVATE static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
 132
 133         JS_EXPORT_PRIVATE static JSValue defaultValue(const JSObject*, ExecState*, PreferredPrimitiveType);
 134
 135         JS_EXPORT_PRIVATE static bool hasInstance(JSObject*, ExecState*, JSValue, JSValue prototypeProperty);
 136
 137         JS_EXPORT_PRIVATE static void getOwnPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
 138         JS_EXPORT_PRIVATE static void getPropertyNames(JSObject*, ExecState*, PropertyNameArray&, EnumerationMode);
 139
 140         JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
 141         JS_EXPORT_PRIVATE bool toBoolean(ExecState*) const;
 142         bool getPrimitiveNumber(ExecState*, double& number, JSValue&) const;
 143         JS_EXPORT_PRIVATE double toNumber(ExecState*) const;
 144         JS_EXPORT_PRIVATE JSString* toString(ExecState*) const;
 145
 146         // NOTE: JSObject and its subclasses must be able to gracefully handle ExecState* = 0,
 147         // because this call may come from inside the compiler.
 148         JS_EXPORT_PRIVATE static JSObject* toThisObject(JSCell*, ExecState*);
 149         JSObject* unwrappedObject();
 150
 151         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 152
 153         // This get function only looks at the property map.
 154         JSValue getDirect(JSGlobalData& globalData, const Identifier& propertyName) const
 155         {
 156             size_t offset = structure()->get(globalData, propertyName);
 157             return offset != WTF::notFound ? getDirectOffset(offset) : JSValue();
 158         }
 159
 160         WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, const Identifier& propertyName)
 161         {
 162             size_t offset = structure()->get(globalData, propertyName);
 163             return offset != WTF::notFound ? locationForOffset(offset) : 0;
 164         }
 165
 166         WriteBarrierBase<Unknown>* getDirectLocation(JSGlobalData& globalData, const Identifier& propertyName, unsigned& attributes)
 167         {
 168             JSCell* specificFunction;
 169             size_t offset = structure()->get(globalData, propertyName, attributes, specificFunction);
 170             return offset != WTF::notFound ? locationForOffset(offset) : 0;
 171         }
 172
 173         size_t offsetForLocation(WriteBarrierBase<Unknown>* location) const
 174         {
 175             return location - propertyStorage();
 176         }
 177
 178         void transitionTo(JSGlobalData&, Structure*);
 179
 180         void removeDirect(JSGlobalData&, const Identifier& propertyName);
 181         bool hasCustomProperties() { return structure()->didTransition(); }
 182         bool hasGetterSetterProperties() { return structure()->hasGetterSetterProperties(); }
 183
 184         // putOwnDataProperty has 'put' like semantics, however this method:
 185         //  - assumes the object contains no own getter/setter properties.
 186         //  - provides no special handling for __proto__
 187         //  - does not walk the prototype chain (to check for accessors or non-writable properties).
 188         // This is used by JSActivation.
 189         bool putOwnDataProperty(JSGlobalData&, const Identifier& propertyName, JSValue, PutPropertySlot&);
 190
 191         // Fast access to known property offsets.
 192         JSValue getDirectOffset(size_t offset) const { return propertyStorage()[offset].get(); }
 193         void putDirectOffset(JSGlobalData& globalData, size_t offset, JSValue value) { propertyStorage()[offset].set(globalData, this, value); }
 194         void putUndefinedAtDirectOffset(size_t offset) { propertyStorage()[offset].setUndefined(); }
 195
 196         JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, const Identifier& propertyName, PropertyDescriptor&, bool shouldThrow);
 197
 198         bool isGlobalObject() const;
 199         bool isVariableObject() const;
 200         bool isStaticScopeObject() const;
 201         bool isActivationObject() const;
 202         bool isErrorInstance() const;
 203         bool isGlobalThis() const;
 204
 205         void seal(JSGlobalData&);
 206         void freeze(JSGlobalData&);
 207         JS_EXPORT_PRIVATE void preventExtensions(JSGlobalData&);
 208         bool isSealed(JSGlobalData& globalData) { return structure()->isSealed(globalData); }
 209         bool isFrozen(JSGlobalData& globalData) { return structure()->isFrozen(globalData); }
 210         bool isExtensible() { return structure()->isExtensible(); }
 211
 212         bool staticFunctionsReified() { return structure()->staticFunctionsReified(); }
 213         void reifyStaticFunctionsForDelete(ExecState* exec);
 214
 215         JS_EXPORT_PRIVATE PropertyStorage growPropertyStorage(JSGlobalData&, size_t oldSize, size_t newSize);
 216         bool isUsingInlineStorage() const { return static_cast<const void*>(m_propertyStorage.get()) == static_cast<const void*>(this + 1); }
 217         void setPropertyStorage(JSGlobalData&, PropertyStorage, Structure*);
 218
 219         void* addressOfPropertyStorage()
 220         {
 221             return &m_propertyStorage;
 222         }
 223
 224         static const unsigned baseExternalStorageCapacity = 16;
 225
 226         void flattenDictionaryObject(JSGlobalData& globalData)
 227         {
 228             structure()->flattenDictionaryStructure(globalData, this);
 229         }
 230
 231         JSGlobalObject* globalObject() const
 232         {
 233             ASSERT(structure()->globalObject());
 234             ASSERT(!isGlobalObject() || ((JSObject*)structure()->globalObject()) == this);
 235             return structure()->globalObject();
 236         }
 237
 238         static size_t offsetOfInlineStorage();
 239         static size_t offsetOfPropertyStorage();
 240         static size_t offsetOfInheritorID();
 241
 242         static JS_EXPORTDATA const ClassInfo s_info;
 243
 244     protected:
 245         void finishCreation(JSGlobalData& globalData, PropertyStorage inlineStorage)
 246         {
 247             Base::finishCreation(globalData);
 248             ASSERT(inherits(&s_info));
 249             ASSERT(structure()->propertyStorageCapacity() < baseExternalStorageCapacity);
 250             ASSERT(structure()->isEmpty());
 251             ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
 252             ASSERT_UNUSED(inlineStorage, static_cast<void*>(inlineStorage) == static_cast<void*>(this + 1));
 253             ASSERT(structure()->isObject());
 254             ASSERT(classInfo());
 255         }
 256
 257         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
 258         {
 259             return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
 260         }
 261
 262         static const unsigned StructureFlags = 0;
 263
 264         // To instantiate objects you likely want JSFinalObject, below.
 265         // To create derived types you likely want JSNonFinalObject, below.
 266         JSObject(JSGlobalData&, Structure*, PropertyStorage inlineStorage);
 267
 268         void resetInheritorID()
 269         {
 270             m_inheritorID.clear();
 271         }
 272
 273     private:
 274         friend class LLIntOffsetsExtractor;
 275
 276         // Nobody should ever ask any of these questions on something already known to be a JSObject.
 277         using JSCell::isAPIValueWrapper;
 278         using JSCell::isGetterSetter;
 279         void getObject();
 280         void getString(ExecState* exec);
 281         void isObject();
 282         void isString();
 283
 284         ConstPropertyStorage propertyStorage() const { return m_propertyStorage.get(); }
 285         PropertyStorage propertyStorage() { return m_propertyStorage.get(); }
 286
 287         const WriteBarrierBase<Unknown>* locationForOffset(size_t offset) const
 288         {
 289             return &propertyStorage()[offset];
 290         }
 291
 292         WriteBarrierBase<Unknown>* locationForOffset(size_t offset)
 293         {
 294             return &propertyStorage()[offset];
 295         }
 296
 297         template<PutMode>
 298         bool putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue, unsigned attr, PutPropertySlot&, JSCell*);
 299
 300         bool inlineGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 301         JS_EXPORT_PRIVATE void fillGetterPropertySlot(PropertySlot&, WriteBarrierBase<Unknown>* location);
 302
 303         const HashEntry* findPropertyHashEntry(ExecState*, const Identifier& propertyName) const;
 304         Structure* createInheritorID(JSGlobalData&);
 305
 306         StorageBarrier m_propertyStorage;
 307         WriteBarrier<Structure> m_inheritorID;
 308     };
 309
 310
 311 #if USE(JSVALUE32_64)
 312 #define JSNonFinalObject_inlineStorageCapacity 4
 313 #define JSFinalObject_inlineStorageCapacity 6
 314 #else
 315 #define JSNonFinalObject_inlineStorageCapacity 2
 316 #define JSFinalObject_inlineStorageCapacity 4
 317 #endif
 318
 319 COMPILE_ASSERT((JSFinalObject_inlineStorageCapacity >= JSNonFinalObject_inlineStorageCapacity), final_storage_is_at_least_as_large_as_non_final);
 320
 321     // JSNonFinalObject is a type of JSObject that has some internal storage,
 322     // but also preserves some space in the collector cell for additional
 323     // data members in derived types.
 324     class JSNonFinalObject : public JSObject {
 325         friend class JSObject;
 326
 327     public:
 328         typedef JSObject Base;
 329
 330         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
 331         {
 332             return Structure::create(globalData, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), &s_info);
 333         }
 334
 335     protected:
 336         explicit JSNonFinalObject(JSGlobalData& globalData, Structure* structure)
 337             : JSObject(globalData, structure, m_inlineStorage)
 338         {
 339         }
 340
 341         void finishCreation(JSGlobalData& globalData)
 342         {
 343             Base::finishCreation(globalData, m_inlineStorage);
 344             ASSERT(!(OBJECT_OFFSETOF(JSNonFinalObject, m_inlineStorage) % sizeof(double)));
 345             ASSERT(this->structure()->propertyStorageCapacity() == JSNonFinalObject_inlineStorageCapacity);
 346             ASSERT(classInfo());
 347         }
 348
 349     private:
 350         WriteBarrier<Unknown> m_inlineStorage[JSNonFinalObject_inlineStorageCapacity];
 351     };
 352
 353     class JSFinalObject;
 354
 355     // JSFinalObject is a type of JSObject that contains sufficent internal
 356     // storage to fully make use of the colloctor cell containing it.
 357     class JSFinalObject : public JSObject {
 358         friend class JSObject;
 359
 360     public:
 361         typedef JSObject Base;
 362
 363         static JSFinalObject* create(ExecState*, Structure*);
 364         static Structure* createStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
 365         {
 366             return Structure::create(globalData, globalObject, prototype, TypeInfo(FinalObjectType, StructureFlags), &s_info);
 367         }
 368
 369         static JS_EXPORTDATA const ClassInfo s_info;
 370
 371     protected:
 372         void finishCreation(JSGlobalData& globalData)
 373         {
 374             Base::finishCreation(globalData, m_inlineStorage);
 375             ASSERT(!(OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage) % sizeof(double)));
 376             ASSERT(this->structure()->propertyStorageCapacity() == JSFinalObject_inlineStorageCapacity);
 377             ASSERT(classInfo());
 378         }
 379
 380     private:
 381         friend class LLIntOffsetsExtractor;
 382
 383         explicit JSFinalObject(JSGlobalData& globalData, Structure* structure)
 384             : JSObject(globalData, structure, m_inlineStorage)
 385         {
 386         }
 387
 388         static const unsigned StructureFlags = JSObject::StructureFlags;
 389
 390         WriteBarrierBase<Unknown> m_inlineStorage[JSFinalObject_inlineStorageCapacity];
 391     };
 392
 393 inline JSFinalObject* JSFinalObject::create(ExecState* exec, Structure* structure)
 394 {
 395     JSFinalObject* finalObject = new (NotNull, allocateCell<JSFinalObject>(*exec->heap())) JSFinalObject(exec->globalData(), structure);
 396     finalObject->finishCreation(exec->globalData());
 397     return finalObject;
 398 }
 399
 400 inline bool isJSFinalObject(JSCell* cell)
 401 {
 402     return cell->classInfo() == &JSFinalObject::s_info;
 403 }
 404
 405 inline bool isJSFinalObject(JSValue value)
 406 {
 407     return value.isCell() && isJSFinalObject(value.asCell());
 408 }
 409
 410 inline size_t JSObject::offsetOfInlineStorage()
 411 {
 412     ASSERT(OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage) == OBJECT_OFFSETOF(JSNonFinalObject, m_inlineStorage));
 413     return OBJECT_OFFSETOF(JSFinalObject, m_inlineStorage);
 414 }
 415
 416 inline size_t JSObject::offsetOfPropertyStorage()
 417 {
 418     return OBJECT_OFFSETOF(JSObject, m_propertyStorage);
 419 }
 420
 421 inline size_t JSObject::offsetOfInheritorID()
 422 {
 423     return OBJECT_OFFSETOF(JSObject, m_inheritorID);
 424 }
 425
 426 inline bool JSObject::isGlobalObject() const
 427 {
 428     return structure()->typeInfo().type() == GlobalObjectType;
 429 }
 430
 431 inline bool JSObject::isVariableObject() const
 432 {
 433     return structure()->typeInfo().type() >= VariableObjectType;
 434 }
 435
 436 inline bool JSObject::isStaticScopeObject() const
 437 {
 438     return structure()->typeInfo().type() == StaticScopeObjectType;
 439 }
 440
 441 inline bool JSObject::isActivationObject() const
 442 {
 443     return structure()->typeInfo().type() == ActivationObjectType;
 444 }
 445
 446 inline bool JSObject::isErrorInstance() const
 447 {
 448     return structure()->typeInfo().type() == ErrorInstanceType;
 449 }
 450
 451 inline bool JSObject::isGlobalThis() const
 452 {
 453     return structure()->typeInfo().type() == GlobalThisType;
 454 }
 455
 456 inline void JSObject::setPropertyStorage(JSGlobalData& globalData, PropertyStorage storage, Structure* structure)
 457 {
 458     ASSERT(storage);
 459     ASSERT(structure);
 460     setStructure(globalData, structure);
 461     m_propertyStorage.set(globalData, this, storage);
 462 }
 463
 464 inline JSObject* constructEmptyObject(ExecState* exec, Structure* structure)
 465 {
 466     return JSFinalObject::create(exec, structure);
 467 }
 468
 469 inline CallType getCallData(JSValue value, CallData& callData)
 470 {
 471     CallType result = value.isCell() ? value.asCell()->methodTable()->getCallData(value.asCell(), callData) : CallTypeNone;
 472     ASSERT(result == CallTypeNone || value.isValidCallee());
 473     return result;
 474 }
 475
 476 inline ConstructType getConstructData(JSValue value, ConstructData& constructData)
 477 {
 478     ConstructType result = value.isCell() ? value.asCell()->methodTable()->getConstructData(value.asCell(), constructData) : ConstructTypeNone;
 479     ASSERT(result == ConstructTypeNone || value.isValidCallee());
 480     return result;
 481 }
 482
 483 inline Structure* createEmptyObjectStructure(JSGlobalData& globalData, JSGlobalObject* globalObject, JSValue prototype)
 484 {
 485     return JSFinalObject::createStructure(globalData, globalObject, prototype);
 486 }
 487
 488 inline JSObject* asObject(JSCell* cell)
 489 {
 490     ASSERT(cell->isObject());
 491     return jsCast<JSObject*>(cell);
 492 }
 493
 494 inline JSObject* asObject(JSValue value)
 495 {
 496     return asObject(value.asCell());
 497 }
 498
 499 inline JSObject::JSObject(JSGlobalData& globalData, Structure* structure, PropertyStorage inlineStorage)
 500     : JSCell(globalData, structure)
 501     , m_propertyStorage(globalData, this, inlineStorage)
 502 {
 503 }
 504
 505 inline JSValue JSObject::prototype() const
 506 {
 507     return structure()->storedPrototype();
 508 }
 509
 510 inline void JSObject::setPrototype(JSGlobalData& globalData, JSValue prototype)
 511 {
 512     ASSERT(prototype);
 513     setStructure(globalData, Structure::changePrototypeTransition(globalData, structure(), prototype));
 514 }
 515
 516 inline Structure* JSObject::inheritorID(JSGlobalData& globalData)
 517 {
 518     if (m_inheritorID) {
 519         ASSERT(m_inheritorID->isEmpty());
 520         return m_inheritorID.get();
 521     }
 522     return createInheritorID(globalData);
 523 }
 524
 525 inline bool Structure::isUsingInlineStorage() const
 526 {
 527     return propertyStorageCapacity() < JSObject::baseExternalStorageCapacity;
 528 }
 529
 530 inline bool JSCell::inherits(const ClassInfo* info) const
 531 {
 532     return classInfo()->isSubClassOf(info);
 533 }
 534
 535 inline const MethodTable* JSCell::methodTable() const
 536 {
 537     return &classInfo()->methodTable;
 538 }
 539
 540 // this method is here to be after the inline declaration of JSCell::inherits
 541 inline bool JSValue::inherits(const ClassInfo* classInfo) const
 542 {
 543     return isCell() && asCell()->inherits(classInfo);
 544 }
 545
 546 inline JSObject* JSValue::toThisObject(ExecState* exec) const
 547 {
 548     return isCell() ? asCell()->methodTable()->toThisObject(asCell(), exec) : toThisObjectSlowCase(exec);
 549 }
 550
 551 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 552 {
 553     if (WriteBarrierBase<Unknown>* location = getDirectLocation(exec->globalData(), propertyName)) {
 554         if (structure()->hasGetterSetterProperties() && location->isGetterSetter())
 555             fillGetterPropertySlot(slot, location);
 556         else
 557             slot.setValue(this, location->get(), offsetForLocation(location));
 558         return true;
 559     }
 560
 561     return false;
 562 }
 563
 564 // It may seem crazy to inline a function this large, especially a virtual function,
 565 // but it makes a big difference to property lookup that derived classes can inline their
 566 // base class call to this.
 567 ALWAYS_INLINE bool JSObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 568 {
 569     return jsCast<JSObject*>(cell)->inlineGetOwnPropertySlot(exec, propertyName, slot);
 570 }
 571
 572 ALWAYS_INLINE bool JSCell::fastGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 573 {
 574     if (!structure()->typeInfo().overridesGetOwnPropertySlot())
 575         return asObject(this)->inlineGetOwnPropertySlot(exec, propertyName, slot);
 576     return methodTable()->getOwnPropertySlot(this, exec, propertyName, slot);
 577 }
 578
 579 // Fast call to get a property where we may not yet have converted the string to an
 580 // identifier. The first time we perform a property access with a given string, try
 581 // performing the property map lookup without forming an identifier. We detect this
 582 // case by checking whether the hash has yet been set for this string.
 583 ALWAYS_INLINE JSValue JSCell::fastGetOwnProperty(ExecState* exec, const UString& name)
 584 {
 585     if (!structure()->typeInfo().overridesGetOwnPropertySlot() && !structure()->hasGetterSetterProperties()) {
 586         size_t offset = name.impl()->hasHash()
 587             ? structure()->get(exec->globalData(), Identifier(exec, name))
 588             : structure()->get(exec->globalData(), name);
 589         if (offset != WTF::notFound)
 590             return asObject(this)->locationForOffset(offset)->get();
 591     }
 592     return JSValue();
 593 }
 594
 595 // It may seem crazy to inline a function this large but it makes a big difference
 596 // since this is function very hot in variable lookup
 597 ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 598 {
 599     JSObject* object = this;
 600     while (true) {
 601         if (object->fastGetOwnPropertySlot(exec, propertyName, slot))
 602             return true;
 603         JSValue prototype = object->prototype();
 604         if (!prototype.isObject())
 605             return false;
 606         object = asObject(prototype);
 607     }
 608 }
 609
 610 ALWAYS_INLINE bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 611 {
 612     JSObject* object = this;
 613     while (true) {
 614         if (object->methodTable()->getOwnPropertySlotByIndex(object, exec, propertyName, slot))
 615             return true;
 616         JSValue prototype = object->prototype();
 617         if (!prototype.isObject())
 618             return false;
 619         object = asObject(prototype);
 620     }
 621 }
 622
 623 inline JSValue JSObject::get(ExecState* exec, const Identifier& propertyName) const
 624 {
 625     PropertySlot slot(this);
 626     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
 627         return slot.getValue(exec, propertyName);
 628
 629     return jsUndefined();
 630 }
 631
 632 inline JSValue JSObject::get(ExecState* exec, unsigned propertyName) const
 633 {
 634     PropertySlot slot(this);
 635     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
 636         return slot.getValue(exec, propertyName);
 637
 638     return jsUndefined();
 639 }
 640
 641 template<JSObject::PutMode mode>
 642 inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes, PutPropertySlot& slot, JSCell* specificFunction)
 643 {
 644     ASSERT(value);
 645     ASSERT(value.isGetterSetter() == !!(attributes & Accessor));
 646     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 647
 648     if (structure()->isDictionary()) {
 649         unsigned currentAttributes;
 650         JSCell* currentSpecificFunction;
 651         size_t offset = structure()->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
 652         if (offset != WTF::notFound) {
 653             // If there is currently a specific function, and there now either isn't,
 654             // or the new value is different, then despecify.
 655             if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
 656                 structure()->despecifyDictionaryFunction(globalData, propertyName);
 657             if ((mode == PutModePut) && currentAttributes & ReadOnly)
 658                 return false;
 659
 660             putDirectOffset(globalData, offset, value);
 661             // At this point, the objects structure only has a specific value set if previously there
 662             // had been one set, and if the new value being specified is the same (otherwise we would
 663             // have despecified, above).  So, if currentSpecificFunction is not set, or if the new
 664             // value is different (or there is no new value), then the slot now has no value - and
 665             // as such it is cachable.
 666             // If there was previously a value, and the new value is the same, then we cannot cache.
 667             if (!currentSpecificFunction || (specificFunction != currentSpecificFunction))
 668                 slot.setExistingProperty(this, offset);
 669             return true;
 670         }
 671
 672         if ((mode == PutModePut) && !isExtensible())
 673             return false;
 674
 675         PropertyStorage newStorage = propertyStorage();
 676         if (structure()->shouldGrowPropertyStorage())
 677             newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), structure()->suggestedNewPropertyStorageSize());
 678         offset = structure()->addPropertyWithoutTransition(globalData, propertyName, attributes, specificFunction);
 679         setPropertyStorage(globalData, newStorage, structure());
 680
 681         ASSERT(offset < structure()->propertyStorageCapacity());
 682         putDirectOffset(globalData, offset, value);
 683         // See comment on setNewProperty call below.
 684         if (!specificFunction)
 685             slot.setNewProperty(this, offset);
 686         return true;
 687     }
 688
 689     size_t offset;
 690     size_t currentCapacity = structure()->propertyStorageCapacity();
 691     if (Structure* structure = Structure::addPropertyTransitionToExistingStructure(this->structure(), propertyName, attributes, specificFunction, offset)) {
 692         PropertyStorage newStorage = propertyStorage();
 693         if (currentCapacity != structure->propertyStorageCapacity())
 694             newStorage = growPropertyStorage(globalData, currentCapacity, structure->propertyStorageCapacity());
 695
 696         ASSERT(offset < structure->propertyStorageCapacity());
 697         setPropertyStorage(globalData, newStorage, structure);
 698         putDirectOffset(globalData, offset, value);
 699         // This is a new property; transitions with specific values are not currently cachable,
 700         // so leave the slot in an uncachable state.
 701         if (!specificFunction)
 702             slot.setNewProperty(this, offset);
 703         return true;
 704     }
 705
 706     unsigned currentAttributes;
 707     JSCell* currentSpecificFunction;
 708     offset = structure()->get(globalData, propertyName, currentAttributes, currentSpecificFunction);
 709     if (offset != WTF::notFound) {
 710         if ((mode == PutModePut) && currentAttributes & ReadOnly)
 711             return false;
 712
 713         // There are three possibilities here:
 714         //  (1) There is an existing specific value set, and we're overwriting with *the same value*.
 715         //       * Do nothing - no need to despecify, but that means we can't cache (a cached
 716         //         put could write a different value). Leave the slot in an uncachable state.
 717         //  (2) There is a specific value currently set, but we're writing a different value.
 718         //       * First, we have to despecify.  Having done so, this is now a regular slot
 719         //         with no specific value, so go ahead & cache like normal.
 720         //  (3) Normal case, there is no specific value set.
 721         //       * Go ahead & cache like normal.
 722         if (currentSpecificFunction) {
 723             // case (1) Do the put, then return leaving the slot uncachable.
 724             if (specificFunction == currentSpecificFunction) {
 725                 putDirectOffset(globalData, offset, value);
 726                 return true;
 727             }
 728             // case (2) Despecify, fall through to (3).
 729             setStructure(globalData, Structure::despecifyFunctionTransition(globalData, structure(), propertyName));
 730         }
 731
 732         // case (3) set the slot, do the put, return.
 733         slot.setExistingProperty(this, offset);
 734         putDirectOffset(globalData, offset, value);
 735         return true;
 736     }
 737
 738     if ((mode == PutModePut) && !isExtensible())
 739         return false;
 740
 741     PropertyStorage newStorage = propertyStorage();
 742     if (structure()->shouldGrowPropertyStorage())
 743         newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), structure()->suggestedNewPropertyStorageSize());
 744
 745     Structure* structure = Structure::addPropertyTransition(globalData, this->structure(), propertyName, attributes, specificFunction, offset);
 746
 747     ASSERT(offset < structure->propertyStorageCapacity());
 748     setPropertyStorage(globalData, newStorage, structure);
 749     putDirectOffset(globalData, offset, value);
 750     // This is a new property; transitions with specific values are not currently cachable,
 751     // so leave the slot in an uncachable state.
 752     if (!specificFunction)
 753         slot.setNewProperty(this, offset);
 754     return true;
 755 }
 756
 757 inline bool JSObject::putOwnDataProperty(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 758 {
 759     ASSERT(value);
 760     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 761     ASSERT(!structure()->hasGetterSetterProperties());
 762
 763     return putDirectInternal<PutModePut>(globalData, propertyName, value, 0, slot, getJSFunction(value));
 764 }
 765
 766 inline void JSObject::putDirect(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 767 {
 768     ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
 769     PutPropertySlot slot;
 770     putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, attributes, slot, getJSFunction(value));
 771 }
 772
 773 inline void JSObject::putDirect(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 774 {
 775     ASSERT(!value.isGetterSetter());
 776     putDirectInternal<PutModeDefineOwnProperty>(globalData, propertyName, value, 0, slot, getJSFunction(value));
 777 }
 778
 779 inline void JSObject::putDirectWithoutTransition(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
 780 {
 781     ASSERT(!value.isGetterSetter() && !(attributes & Accessor));
 782     PropertyStorage newStorage = propertyStorage();
 783     if (structure()->shouldGrowPropertyStorage())
 784         newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), structure()->suggestedNewPropertyStorageSize());
 785     size_t offset = structure()->addPropertyWithoutTransition(globalData, propertyName, attributes, getJSFunction(value));
 786     setPropertyStorage(globalData, newStorage, structure());
 787     putDirectOffset(globalData, offset, value);
 788 }
 789
 790 inline void JSObject::transitionTo(JSGlobalData& globalData, Structure* newStructure)
 791 {
 792     PropertyStorage newStorage = propertyStorage();
 793     if (structure()->propertyStorageCapacity() != newStructure->propertyStorageCapacity())
 794         newStorage = growPropertyStorage(globalData, structure()->propertyStorageCapacity(), newStructure->propertyStorageCapacity());
 795     setPropertyStorage(globalData, newStorage, newStructure);
 796 }
 797
 798 inline JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
 799 {
 800     return methodTable()->defaultValue(this, exec, preferredType);
 801 }
 802
 803 inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName) const
 804 {
 805     PropertySlot slot(asValue());
 806     return get(exec, propertyName, slot);
 807 }
 808
 809 inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) const
 810 {
 811     if (UNLIKELY(!isCell())) {
 812         JSObject* prototype = synthesizePrototype(exec);
 813         if (!prototype->getPropertySlot(exec, propertyName, slot))
 814             return jsUndefined();
 815         return slot.getValue(exec, propertyName);
 816     }
 817     JSCell* cell = asCell();
 818     while (true) {
 819         if (cell->fastGetOwnPropertySlot(exec, propertyName, slot))
 820             return slot.getValue(exec, propertyName);
 821         JSValue prototype = asObject(cell)->prototype();
 822         if (!prototype.isObject())
 823             return jsUndefined();
 824         cell = asObject(prototype);
 825     }
 826 }
 827
 828 inline JSValue JSValue::get(ExecState* exec, unsigned propertyName) const
 829 {
 830     PropertySlot slot(asValue());
 831     return get(exec, propertyName, slot);
 832 }
 833
 834 inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
 835 {
 836     if (UNLIKELY(!isCell())) {
 837         JSObject* prototype = synthesizePrototype(exec);
 838         if (!prototype->getPropertySlot(exec, propertyName, slot))
 839             return jsUndefined();
 840         return slot.getValue(exec, propertyName);
 841     }
 842     JSCell* cell = const_cast<JSCell*>(asCell());
 843     while (true) {
 844         if (cell->methodTable()->getOwnPropertySlotByIndex(cell, exec, propertyName, slot))
 845             return slot.getValue(exec, propertyName);
 846         JSValue prototype = asObject(cell)->prototype();
 847         if (!prototype.isObject())
 848             return jsUndefined();
 849         cell = prototype.asCell();
 850     }
 851 }
 852
 853 inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 854 {
 855     if (UNLIKELY(!isCell())) {
 856         putToPrimitive(exec, propertyName, value, slot);
 857         return;
 858     }
 859     asCell()->methodTable()->put(asCell(), exec, propertyName, value, slot);
 860 }
 861
 862 inline void JSValue::putByIndex(ExecState* exec, unsigned propertyName, JSValue value, bool shouldThrow)
 863 {
 864     if (UNLIKELY(!isCell())) {
 865         PutPropertySlot slot(shouldThrow);
 866         putToPrimitive(exec, Identifier::from(exec, propertyName), value, slot);
 867         return;
 868     }
 869     asCell()->methodTable()->putByIndex(asCell(), exec, propertyName, value, shouldThrow);
 870 }
 871
 872 // --- JSValue inlines ----------------------------
 873
 874 ALWAYS_INLINE JSObject* Register::function() const
 875 {
 876     if (!jsValue())
 877         return 0;
 878     return asObject(jsValue());
 879 }
 880
 881 ALWAYS_INLINE Register Register::withCallee(JSObject* callee)
 882 {
 883     Register r;
 884     r = JSValue(callee);
 885     return r;
 886 }
 887
 888 } // namespace JSC
 889
 890 #endif // JSObject_h