WTF_MAKE_FAST_ALLOCATED_WITH_HEAP_IDENTIFIER(AccessCase);

enum AccessType : uint8_t {

Load,

Transition,

Delete,

DeleteNonConfigurable,

DeleteMiss,

Replace,

Miss,

GetGetter,

Getter,

Setter,

CustomValueGetter,

CustomAccessorGetter,

CustomValueSetter,

CustomAccessorSetter,

IntrinsicGetter,

InHit,

InMiss,

ArrayLength,

StringLength,

DirectArgumentsLength,

ScopedArgumentsLength,

ModuleNamespaceLoad,

InstanceOfHit,

InstanceOfMiss,

InstanceOfGeneric,

IndexedInt32Load,

IndexedDoubleLoad,

IndexedContiguousLoad,

IndexedArrayStorageLoad,

IndexedScopedArgumentsLoad,

IndexedDirectArgumentsLoad,

IndexedTypedArrayInt8Load,

IndexedTypedArrayUint8Load,

IndexedTypedArrayUint8ClampedLoad,

IndexedTypedArrayInt16Load,

IndexedTypedArrayUint16Load,

IndexedTypedArrayInt32Load,

IndexedTypedArrayUint32Load,

IndexedTypedArrayFloat32Load,

IndexedTypedArrayFloat64Load,

IndexedStringLoad

};

enum State : uint8_t {

Primordial,

Committed,

Generated

};

template<typename T>

T& as() { return *static_cast<T*>(this); }

template<typename T>

const T& as() const { return *static_cast<const T*>(this); }

template<typename AccessCaseType, typename... Arguments>

static std::unique_ptr<AccessCaseType> create(Arguments... arguments)

{

return std::unique_ptr<AccessCaseType>(new AccessCaseType(arguments...));

}

static std::unique_ptr<AccessCase> create(VM&, JSCell* owner, AccessType, CacheableIdentifier, PropertyOffset = invalidOffset,

Structure* = nullptr, const ObjectPropertyConditionSet& = ObjectPropertyConditionSet(), std::unique_ptr<PolyProtoAccessChain> = nullptr);

static std::unique_ptr<AccessCase> createTransition(VM&, JSCell* owner, CacheableIdentifier, PropertyOffset, Structure* oldStructure,

Structure* newStructure, const ObjectPropertyConditionSet&, std::unique_ptr<PolyProtoAccessChain>);

static std::unique_ptr<AccessCase> createDelete(VM&, JSCell* owner, CacheableIdentifier, PropertyOffset, Structure* oldStructure,

Structure* newStructure);

static std::unique_ptr<AccessCase> fromStructureStubInfo(VM&, JSCell* owner, CacheableIdentifier, StructureStubInfo&);

AccessType type() const { return m_type; }

State state() const { return m_state; }

PropertyOffset offset() const { return m_offset; }

Structure* structure() const

{

if (m_type == Transition || m_type == Delete)

return m_structure->previousID();

return m_structure.get();

}

bool guardedByStructureCheck(const StructureStubInfo&) const;

Structure* newStructure() const

{

ASSERT(m_type == Transition || m_type == Delete);

return m_structure.get();

}

ObjectPropertyConditionSet conditionSet() const { return m_conditionSet; }

virtual bool hasAlternateBase() const;

virtual JSObject* alternateBase() const;

virtual WatchpointSet* additionalSet() const { return nullptr; }

bool viaProxy() const { return m_viaProxy; }

// If you supply the optional vector, this will append the set of cells that this will need to keep alive

// past the call.

bool doesCalls(VM&, Vector<JSCell*>* cellsToMark = nullptr) const;

bool isCustom() const

{

switch (type()) {

case CustomValueGetter:

case CustomAccessorGetter:

case CustomValueSetter:

case CustomAccessorSetter:

return true;

default:

return false;

}

}

bool isGetter() const

{

switch (type()) {

case Getter:

case CustomValueGetter:

case CustomAccessorGetter:

return true;

default:

return false;

}

}

bool isAccessor() const { return isGetter() || type() == Setter; }

// Is it still possible for this case to ever be taken? Must call this as a prerequisite for

// calling generate() and friends. If this returns true, then you can call generate(). If

// this returns false, then generate() will crash. You must call generate() in the same epoch

// as when you called couldStillSucceed().

bool couldStillSucceed() const;

// If this method returns true, then it's a good idea to remove 'other' from the access once 'this'

// is added. This method assumes that in case of contradictions, 'this' represents a newer, and so

// more useful, truth. This method can be conservative; it will return false when it doubt.

bool canReplace(const AccessCase& other) const;

void dump(PrintStream& out) const;

virtual void dumpImpl(PrintStream&, CommaPrinter&) const { }

virtual ~AccessCase();

bool usesPolyProto() const

{

return !!m_polyProtoAccessChain;

}

bool requiresIdentifierNameMatch() const;

bool requiresInt32PropertyCheck() const;

bool needsScratchFPR() const;

static TypedArrayType toTypedArrayType(AccessType);

UniquedStringImpl* uid() const { return m_identifier.uid(); }

CacheableIdentifier identifier() const { return m_identifier; }

#if ASSERT_ENABLED

void checkConsistency(StructureStubInfo&);

#else

ALWAYS_INLINE void checkConsistency(StructureStubInfo&) { }

#endif

AccessCase(VM&, JSCell* owner, AccessType, CacheableIdentifier, PropertyOffset, Structure*, const ObjectPropertyConditionSet&, std::unique_ptr<PolyProtoAccessChain>);

AccessCase(AccessCase&&) = default;

AccessCase(const AccessCase& other)

: m_type(other.m_type)

, m_state(other.m_state)

, m_viaProxy(other.m_viaProxy)

, m_offset(other.m_offset)

, m_structure(other.m_structure)

, m_conditionSet(other.m_conditionSet)

, m_identifier(other.m_identifier)

{

if (other.m_polyProtoAccessChain)

m_polyProtoAccessChain = other.m_polyProtoAccessChain->clone();

}

AccessCase& operator=(const AccessCase&) = delete;

void resetState() { m_state = Primordial; }

friend class CodeBlock;

friend class PolymorphicAccess;

template<typename Functor>

void forEachDependentCell(VM&, const Functor&) const;

void visitAggregate(SlotVisitor&) const;

bool visitWeak(VM&) const;

bool propagateTransitions(SlotVisitor&) const;

// FIXME: This only exists because of how AccessCase puts post-generation things into itself.

// https://bugs.webkit.org/show_bug.cgi?id=156456

virtual std::unique_ptr<AccessCase> clone() const;

// Perform any action that must be performed before the end of the epoch in which the case

// was created. Returns a set of watchpoint sets that will need to be watched.

Vector<WatchpointSet*, 2> commit(VM&);

// Fall through on success. Two kinds of failures are supported: fall-through, which means that we

// should try a different case; and failure, which means that this was the right case but it needs

// help from the slow path.

void generateWithGuard(AccessGenerationState&, MacroAssembler::JumpList& fallThrough);

// Fall through on success, add a jump to the failure list on failure.

void generate(AccessGenerationState&);

void generateImpl(AccessGenerationState&);

bool guardedByStructureCheckSkippingConstantIdentifierCheck() const;

AccessType m_type;

State m_state { Primordial };

// m_viaProxy is true only if the instance inherits (or it is) ProxyableAccessCase.

// We put this value here instead of ProxyableAccessCase to reduce the size of ProxyableAccessCase and its

// derived classes, which are super frequently allocated.

bool m_viaProxy { false };

PropertyOffset m_offset;

// Usually this is the structure that we expect the base object to have. But, this is the *new*

// structure for a transition and we rely on the fact that it has a strong reference to the old

// structure. For proxies, this is the structure of the object behind the proxy.

WriteBarrier<Structure> m_structure;

ObjectPropertyConditionSet m_conditionSet;

std::unique_ptr<PolyProtoAccessChain> m_polyProtoAccessChain;

CacheableIdentifier m_identifier;