1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
7 #include "src/disasm.h"
8 #include "src/disassembler.h"
9 #include "src/heap/objects-visiting.h"
10 #include "src/jsregexp.h"
11 #include "src/macro-assembler.h"
12 #include "src/ostreams.h"
19 void Object::ObjectVerify() {
21 Smi::cast(this)->SmiVerify();
23 HeapObject::cast(this)->HeapObjectVerify();
28 void Object::VerifyPointer(Object* p) {
29 if (p->IsHeapObject()) {
30 HeapObject::VerifyHeapPointer(p);
37 void Smi::SmiVerify() {
42 void HeapObject::HeapObjectVerify() {
43 InstanceType instance_type = map()->instance_type();
45 if (instance_type < FIRST_NONSTRING_TYPE) {
46 String::cast(this)->StringVerify();
50 // TODO(yangguo): Use this check once crbug/436911 has been fixed.
51 // DCHECK(!NeedsToEnsureDoubleAlignment() ||
52 // IsAligned(OffsetFrom(address()), kDoubleAlignment));
54 switch (instance_type) {
56 Symbol::cast(this)->SymbolVerify();
59 Map::cast(this)->MapVerify();
61 case HEAP_NUMBER_TYPE:
62 case MUTABLE_HEAP_NUMBER_TYPE:
63 HeapNumber::cast(this)->HeapNumberVerify();
65 case FIXED_ARRAY_TYPE:
66 FixedArray::cast(this)->FixedArrayVerify();
68 case FIXED_DOUBLE_ARRAY_TYPE:
69 FixedDoubleArray::cast(this)->FixedDoubleArrayVerify();
71 case CONSTANT_POOL_ARRAY_TYPE:
72 ConstantPoolArray::cast(this)->ConstantPoolArrayVerify();
75 ByteArray::cast(this)->ByteArrayVerify();
78 FreeSpace::cast(this)->FreeSpaceVerify();
81 #define VERIFY_TYPED_ARRAY(Type, type, TYPE, ctype, size) \
82 case EXTERNAL_##TYPE##_ARRAY_TYPE: \
83 External##Type##Array::cast(this)->External##Type##ArrayVerify(); \
85 case FIXED_##TYPE##_ARRAY_TYPE: \
86 Fixed##Type##Array::cast(this)->FixedTypedArrayVerify(); \
89 TYPED_ARRAYS(VERIFY_TYPED_ARRAY)
90 #undef VERIFY_TYPED_ARRAY
93 Code::cast(this)->CodeVerify();
96 Oddball::cast(this)->OddballVerify();
99 case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
100 JSObject::cast(this)->JSObjectVerify();
102 case JS_GENERATOR_OBJECT_TYPE:
103 JSGeneratorObject::cast(this)->JSGeneratorObjectVerify();
106 JSModule::cast(this)->JSModuleVerify();
109 JSValue::cast(this)->JSValueVerify();
112 JSDate::cast(this)->JSDateVerify();
114 case JS_FUNCTION_TYPE:
115 JSFunction::cast(this)->JSFunctionVerify();
117 case JS_GLOBAL_PROXY_TYPE:
118 JSGlobalProxy::cast(this)->JSGlobalProxyVerify();
120 case JS_GLOBAL_OBJECT_TYPE:
121 JSGlobalObject::cast(this)->JSGlobalObjectVerify();
123 case JS_BUILTINS_OBJECT_TYPE:
124 JSBuiltinsObject::cast(this)->JSBuiltinsObjectVerify();
127 Cell::cast(this)->CellVerify();
129 case PROPERTY_CELL_TYPE:
130 PropertyCell::cast(this)->PropertyCellVerify();
133 WeakCell::cast(this)->WeakCellVerify();
136 JSArray::cast(this)->JSArrayVerify();
139 JSSet::cast(this)->JSSetVerify();
142 JSMap::cast(this)->JSMapVerify();
144 case JS_SET_ITERATOR_TYPE:
145 JSSetIterator::cast(this)->JSSetIteratorVerify();
147 case JS_MAP_ITERATOR_TYPE:
148 JSMapIterator::cast(this)->JSMapIteratorVerify();
150 case JS_WEAK_MAP_TYPE:
151 JSWeakMap::cast(this)->JSWeakMapVerify();
153 case JS_WEAK_SET_TYPE:
154 JSWeakSet::cast(this)->JSWeakSetVerify();
157 JSRegExp::cast(this)->JSRegExpVerify();
162 JSProxy::cast(this)->JSProxyVerify();
164 case JS_FUNCTION_PROXY_TYPE:
165 JSFunctionProxy::cast(this)->JSFunctionProxyVerify();
168 Foreign::cast(this)->ForeignVerify();
170 case SHARED_FUNCTION_INFO_TYPE:
171 SharedFunctionInfo::cast(this)->SharedFunctionInfoVerify();
173 case JS_MESSAGE_OBJECT_TYPE:
174 JSMessageObject::cast(this)->JSMessageObjectVerify();
176 case JS_ARRAY_BUFFER_TYPE:
177 JSArrayBuffer::cast(this)->JSArrayBufferVerify();
179 case JS_TYPED_ARRAY_TYPE:
180 JSTypedArray::cast(this)->JSTypedArrayVerify();
182 case JS_DATA_VIEW_TYPE:
183 JSDataView::cast(this)->JSDataViewVerify();
186 #define MAKE_STRUCT_CASE(NAME, Name, name) \
188 Name::cast(this)->Name##Verify(); \
190 STRUCT_LIST(MAKE_STRUCT_CASE)
191 #undef MAKE_STRUCT_CASE
200 void HeapObject::VerifyHeapPointer(Object* p) {
201 CHECK(p->IsHeapObject());
202 HeapObject* ho = HeapObject::cast(p);
203 CHECK(ho->GetHeap()->Contains(ho));
207 void Symbol::SymbolVerify() {
209 CHECK(HasHashCode());
211 CHECK(name()->IsUndefined() || name()->IsString());
212 CHECK(flags()->IsSmi());
216 void HeapNumber::HeapNumberVerify() {
217 CHECK(IsHeapNumber() || IsMutableHeapNumber());
221 void ByteArray::ByteArrayVerify() {
222 CHECK(IsByteArray());
226 void FreeSpace::FreeSpaceVerify() {
227 CHECK(IsFreeSpace());
231 #define EXTERNAL_ARRAY_VERIFY(Type, type, TYPE, ctype, size) \
232 void External##Type##Array::External##Type##ArrayVerify() { \
233 CHECK(IsExternal##Type##Array()); \
236 TYPED_ARRAYS(EXTERNAL_ARRAY_VERIFY)
237 #undef EXTERNAL_ARRAY_VERIFY
240 template <class Traits>
241 void FixedTypedArray<Traits>::FixedTypedArrayVerify() {
242 CHECK(IsHeapObject() &&
243 HeapObject::cast(this)->map()->instance_type() ==
244 Traits::kInstanceType);
248 bool JSObject::ElementsAreSafeToExamine() {
249 // If a GC was caused while constructing this object, the elements
250 // pointer may point to a one pointer filler map.
251 return reinterpret_cast<Map*>(elements()) !=
252 GetHeap()->one_pointer_filler_map();
256 void JSObject::JSObjectVerify() {
257 VerifyHeapPointer(properties());
258 VerifyHeapPointer(elements());
260 if (GetElementsKind() == SLOPPY_ARGUMENTS_ELEMENTS) {
261 CHECK(this->elements()->IsFixedArray());
262 CHECK_GE(this->elements()->length(), 2);
265 if (HasFastProperties()) {
266 int actual_unused_property_fields = map()->inobject_properties() +
267 properties()->length() -
268 map()->NextFreePropertyIndex();
269 if (map()->unused_property_fields() != actual_unused_property_fields) {
270 // This could actually happen in the middle of StoreTransitionStub
271 // when the new extended backing store is already set into the object and
272 // the allocation of the MutableHeapNumber triggers GC (in this case map
273 // is not updated yet).
274 CHECK_EQ(map()->unused_property_fields(),
275 actual_unused_property_fields - JSObject::kFieldsAdded);
277 DescriptorArray* descriptors = map()->instance_descriptors();
278 for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
279 if (descriptors->GetDetails(i).type() == FIELD) {
280 Representation r = descriptors->GetDetails(i).representation();
281 FieldIndex index = FieldIndex::ForDescriptor(map(), i);
282 if (IsUnboxedDoubleField(index)) {
283 DCHECK(r.IsDouble());
286 Object* value = RawFastPropertyAt(index);
287 if (r.IsDouble()) DCHECK(value->IsMutableHeapNumber());
288 if (value->IsUninitialized()) continue;
289 if (r.IsSmi()) DCHECK(value->IsSmi());
290 if (r.IsHeapObject()) DCHECK(value->IsHeapObject());
291 HeapType* field_type = descriptors->GetFieldType(i);
293 CHECK(field_type->Is(HeapType::None()));
294 } else if (!HeapType::Any()->Is(field_type)) {
295 CHECK(!field_type->NowStable() || field_type->NowContains(value));
301 // If a GC was caused while constructing this object, the elements
302 // pointer may point to a one pointer filler map.
303 if (ElementsAreSafeToExamine()) {
304 CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
305 (elements() == GetHeap()->empty_fixed_array())),
306 (elements()->map() == GetHeap()->fixed_array_map() ||
307 elements()->map() == GetHeap()->fixed_cow_array_map()));
308 CHECK(map()->has_fast_object_elements() == HasFastObjectElements());
313 void Map::MapVerify() {
314 Heap* heap = GetHeap();
315 CHECK(!heap->InNewSpace(this));
316 CHECK(FIRST_TYPE <= instance_type() && instance_type() <= LAST_TYPE);
317 CHECK(instance_size() == kVariableSizeSentinel ||
318 (kPointerSize <= instance_size() &&
319 instance_size() < heap->Capacity()));
320 VerifyHeapPointer(prototype());
321 VerifyHeapPointer(instance_descriptors());
322 SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates());
323 if (HasTransitionArray()) {
324 SLOW_DCHECK(transitions()->IsSortedNoDuplicates());
325 SLOW_DCHECK(transitions()->IsConsistentWithBackPointers(this));
327 SLOW_DCHECK(!FLAG_unbox_double_fields ||
328 layout_descriptor()->IsConsistentWithMap(this));
332 void Map::DictionaryMapVerify() {
334 CHECK(is_dictionary_map());
335 CHECK(instance_descriptors()->IsEmpty());
336 CHECK_EQ(0, pre_allocated_property_fields());
337 CHECK_EQ(0, unused_property_fields());
338 CHECK_EQ(StaticVisitorBase::GetVisitorId(this), visitor_id());
342 void Map::VerifyOmittedMapChecks() {
343 if (!FLAG_omit_map_checks_for_leaf_maps) return;
346 HasTransitionArray() ||
347 is_dictionary_map()) {
348 CHECK_EQ(0, dependent_code()->number_of_entries(
349 DependentCode::kPrototypeCheckGroup));
354 void CodeCache::CodeCacheVerify() {
355 VerifyHeapPointer(default_cache());
356 VerifyHeapPointer(normal_type_cache());
357 CHECK(default_cache()->IsFixedArray());
358 CHECK(normal_type_cache()->IsUndefined()
359 || normal_type_cache()->IsCodeCacheHashTable());
363 void PolymorphicCodeCache::PolymorphicCodeCacheVerify() {
364 VerifyHeapPointer(cache());
365 CHECK(cache()->IsUndefined() || cache()->IsPolymorphicCodeCacheHashTable());
369 void TypeFeedbackInfo::TypeFeedbackInfoVerify() {
370 VerifyObjectField(kStorage1Offset);
371 VerifyObjectField(kStorage2Offset);
372 VerifyObjectField(kStorage3Offset);
376 void AliasedArgumentsEntry::AliasedArgumentsEntryVerify() {
377 VerifySmiField(kAliasedContextSlot);
381 void FixedArray::FixedArrayVerify() {
382 for (int i = 0; i < length(); i++) {
389 void FixedDoubleArray::FixedDoubleArrayVerify() {
390 for (int i = 0; i < length(); i++) {
391 if (!is_the_hole(i)) {
392 double value = get_scalar(i);
393 CHECK(!std::isnan(value) ||
394 (bit_cast<uint64_t>(value) ==
395 bit_cast<uint64_t>(canonical_not_the_hole_nan_as_double())) ||
396 ((bit_cast<uint64_t>(value) & Double::kSignMask) != 0));
402 void ConstantPoolArray::ConstantPoolArrayVerify() {
403 CHECK(IsConstantPoolArray());
404 ConstantPoolArray::Iterator code_iter(this, ConstantPoolArray::CODE_PTR);
405 while (!code_iter.is_finished()) {
406 Address code_entry = get_code_ptr_entry(code_iter.next_index());
407 VerifyPointer(Code::GetCodeFromTargetAddress(code_entry));
409 ConstantPoolArray::Iterator heap_iter(this, ConstantPoolArray::HEAP_PTR);
410 while (!heap_iter.is_finished()) {
411 VerifyObjectField(OffsetOfElementAt(heap_iter.next_index()));
416 void JSGeneratorObject::JSGeneratorObjectVerify() {
417 // In an expression like "new g()", there can be a point where a generator
418 // object is allocated but its fields are all undefined, as it hasn't yet been
419 // initialized by the generator. Hence these weak checks.
420 VerifyObjectField(kFunctionOffset);
421 VerifyObjectField(kContextOffset);
422 VerifyObjectField(kReceiverOffset);
423 VerifyObjectField(kOperandStackOffset);
424 VerifyObjectField(kContinuationOffset);
425 VerifyObjectField(kStackHandlerIndexOffset);
429 void JSModule::JSModuleVerify() {
430 VerifyObjectField(kContextOffset);
431 VerifyObjectField(kScopeInfoOffset);
432 CHECK(context()->IsUndefined() ||
433 Context::cast(context())->IsModuleContext());
437 void JSValue::JSValueVerify() {
439 if (v->IsHeapObject()) {
440 VerifyHeapPointer(v);
445 void JSDate::JSDateVerify() {
446 if (value()->IsHeapObject()) {
447 VerifyHeapPointer(value());
449 CHECK(value()->IsUndefined() || value()->IsSmi() || value()->IsHeapNumber());
450 CHECK(year()->IsUndefined() || year()->IsSmi() || year()->IsNaN());
451 CHECK(month()->IsUndefined() || month()->IsSmi() || month()->IsNaN());
452 CHECK(day()->IsUndefined() || day()->IsSmi() || day()->IsNaN());
453 CHECK(weekday()->IsUndefined() || weekday()->IsSmi() || weekday()->IsNaN());
454 CHECK(hour()->IsUndefined() || hour()->IsSmi() || hour()->IsNaN());
455 CHECK(min()->IsUndefined() || min()->IsSmi() || min()->IsNaN());
456 CHECK(sec()->IsUndefined() || sec()->IsSmi() || sec()->IsNaN());
457 CHECK(cache_stamp()->IsUndefined() ||
458 cache_stamp()->IsSmi() ||
459 cache_stamp()->IsNaN());
461 if (month()->IsSmi()) {
462 int month = Smi::cast(this->month())->value();
463 CHECK(0 <= month && month <= 11);
465 if (day()->IsSmi()) {
466 int day = Smi::cast(this->day())->value();
467 CHECK(1 <= day && day <= 31);
469 if (hour()->IsSmi()) {
470 int hour = Smi::cast(this->hour())->value();
471 CHECK(0 <= hour && hour <= 23);
473 if (min()->IsSmi()) {
474 int min = Smi::cast(this->min())->value();
475 CHECK(0 <= min && min <= 59);
477 if (sec()->IsSmi()) {
478 int sec = Smi::cast(this->sec())->value();
479 CHECK(0 <= sec && sec <= 59);
481 if (weekday()->IsSmi()) {
482 int weekday = Smi::cast(this->weekday())->value();
483 CHECK(0 <= weekday && weekday <= 6);
485 if (cache_stamp()->IsSmi()) {
486 CHECK(Smi::cast(cache_stamp())->value() <=
487 Smi::cast(GetIsolate()->date_cache()->stamp())->value());
492 void JSMessageObject::JSMessageObjectVerify() {
493 CHECK(IsJSMessageObject());
494 CHECK(type()->IsString());
495 CHECK(arguments()->IsJSArray());
496 VerifyObjectField(kStartPositionOffset);
497 VerifyObjectField(kEndPositionOffset);
498 VerifyObjectField(kArgumentsOffset);
499 VerifyObjectField(kScriptOffset);
500 VerifyObjectField(kStackFramesOffset);
504 void String::StringVerify() {
506 CHECK(length() >= 0 && length() <= Smi::kMaxValue);
507 if (IsInternalizedString()) {
508 CHECK(!GetHeap()->InNewSpace(this));
510 if (IsConsString()) {
511 ConsString::cast(this)->ConsStringVerify();
512 } else if (IsSlicedString()) {
513 SlicedString::cast(this)->SlicedStringVerify();
518 void ConsString::ConsStringVerify() {
519 CHECK(this->first()->IsString());
520 CHECK(this->second() == GetHeap()->empty_string() ||
521 this->second()->IsString());
522 CHECK(this->length() >= ConsString::kMinLength);
523 CHECK(this->length() == this->first()->length() + this->second()->length());
524 if (this->IsFlat()) {
525 // A flat cons can only be created by String::SlowTryFlatten.
526 // Afterwards, the first part may be externalized.
527 CHECK(this->first()->IsSeqString() || this->first()->IsExternalString());
532 void SlicedString::SlicedStringVerify() {
533 CHECK(!this->parent()->IsConsString());
534 CHECK(!this->parent()->IsSlicedString());
535 CHECK(this->length() >= SlicedString::kMinLength);
539 void JSFunction::JSFunctionVerify() {
540 CHECK(IsJSFunction());
541 VerifyObjectField(kPrototypeOrInitialMapOffset);
542 VerifyObjectField(kNextFunctionLinkOffset);
543 CHECK(code()->IsCode());
544 CHECK(next_function_link() == NULL ||
545 next_function_link()->IsUndefined() ||
546 next_function_link()->IsJSFunction());
550 void SharedFunctionInfo::SharedFunctionInfoVerify() {
551 CHECK(IsSharedFunctionInfo());
552 VerifyObjectField(kNameOffset);
553 VerifyObjectField(kCodeOffset);
554 VerifyObjectField(kOptimizedCodeMapOffset);
555 VerifyObjectField(kFeedbackVectorOffset);
556 VerifyObjectField(kScopeInfoOffset);
557 VerifyObjectField(kInstanceClassNameOffset);
558 VerifyObjectField(kFunctionDataOffset);
559 VerifyObjectField(kScriptOffset);
560 VerifyObjectField(kDebugInfoOffset);
564 void JSGlobalProxy::JSGlobalProxyVerify() {
565 CHECK(IsJSGlobalProxy());
567 VerifyObjectField(JSGlobalProxy::kNativeContextOffset);
568 // Make sure that this object has no properties, elements.
569 CHECK_EQ(0, properties()->length());
570 CHECK_EQ(FAST_HOLEY_SMI_ELEMENTS, GetElementsKind());
571 CHECK_EQ(0, FixedArray::cast(elements())->length());
575 void JSGlobalObject::JSGlobalObjectVerify() {
576 CHECK(IsJSGlobalObject());
578 for (int i = GlobalObject::kBuiltinsOffset;
579 i < JSGlobalObject::kSize;
581 VerifyObjectField(i);
586 void JSBuiltinsObject::JSBuiltinsObjectVerify() {
587 CHECK(IsJSBuiltinsObject());
589 for (int i = GlobalObject::kBuiltinsOffset;
590 i < JSBuiltinsObject::kSize;
592 VerifyObjectField(i);
597 void Oddball::OddballVerify() {
599 Heap* heap = GetHeap();
600 VerifyHeapPointer(to_string());
601 Object* number = to_number();
602 if (number->IsHeapObject()) {
603 CHECK(number == heap->nan_value());
605 CHECK(number->IsSmi());
606 int value = Smi::cast(number)->value();
607 // Hidden oddballs have negative smis.
608 const int kLeastHiddenOddballNumber = -5;
610 CHECK(value >= kLeastHiddenOddballNumber);
612 if (map() == heap->undefined_map()) {
613 CHECK(this == heap->undefined_value());
614 } else if (map() == heap->the_hole_map()) {
615 CHECK(this == heap->the_hole_value());
616 } else if (map() == heap->null_map()) {
617 CHECK(this == heap->null_value());
618 } else if (map() == heap->boolean_map()) {
619 CHECK(this == heap->true_value() ||
620 this == heap->false_value());
621 } else if (map() == heap->uninitialized_map()) {
622 CHECK(this == heap->uninitialized_value());
623 } else if (map() == heap->no_interceptor_result_sentinel_map()) {
624 CHECK(this == heap->no_interceptor_result_sentinel());
625 } else if (map() == heap->arguments_marker_map()) {
626 CHECK(this == heap->arguments_marker());
627 } else if (map() == heap->termination_exception_map()) {
628 CHECK(this == heap->termination_exception());
629 } else if (map() == heap->exception_map()) {
630 CHECK(this == heap->exception());
637 void Cell::CellVerify() {
639 VerifyObjectField(kValueOffset);
643 void PropertyCell::PropertyCellVerify() {
644 CHECK(IsPropertyCell());
645 VerifyObjectField(kValueOffset);
646 VerifyObjectField(kTypeOffset);
650 void WeakCell::WeakCellVerify() {
652 VerifyObjectField(kValueOffset);
653 VerifyObjectField(kNextOffset);
657 void Code::CodeVerify() {
658 CHECK(IsAligned(reinterpret_cast<intptr_t>(instruction_start()),
660 relocation_info()->ObjectVerify();
661 Address last_gc_pc = NULL;
662 Isolate* isolate = GetIsolate();
663 for (RelocIterator it(this); !it.done(); it.next()) {
664 it.rinfo()->Verify(isolate);
665 // Ensure that GC will not iterate twice over the same pointer.
666 if (RelocInfo::IsGCRelocMode(it.rinfo()->rmode())) {
667 CHECK(it.rinfo()->pc() != last_gc_pc);
668 last_gc_pc = it.rinfo()->pc();
671 CHECK(raw_type_feedback_info() == Smi::FromInt(0) ||
672 raw_type_feedback_info()->IsSmi() == IsCodeStubOrIC());
676 void Code::VerifyEmbeddedObjectsDependency() {
677 if (!CanContainWeakObjects()) return;
678 DisallowHeapAllocation no_gc;
679 Isolate* isolate = GetIsolate();
680 HandleScope scope(isolate);
681 int mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
682 for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
683 Object* obj = it.rinfo()->target_object();
684 if (IsWeakObject(obj)) {
686 Map* map = Map::cast(obj);
687 CHECK(map->dependent_code()->Contains(DependentCode::kWeakCodeGroup,
689 } else if (obj->IsJSObject()) {
690 Object* raw_table = GetIsolate()->heap()->weak_object_to_code_table();
691 WeakHashTable* table = WeakHashTable::cast(raw_table);
692 Handle<Object> key_obj(obj, isolate);
693 CHECK(DependentCode::cast(table->Lookup(key_obj))->Contains(
694 DependentCode::kWeakCodeGroup, this));
701 void JSArray::JSArrayVerify() {
703 CHECK(length()->IsNumber() || length()->IsUndefined());
704 // If a GC was caused while constructing this array, the elements
705 // pointer may point to a one pointer filler map.
706 if (ElementsAreSafeToExamine()) {
707 CHECK(elements()->IsUndefined() ||
708 elements()->IsFixedArray() ||
709 elements()->IsFixedDoubleArray());
714 void JSSet::JSSetVerify() {
717 VerifyHeapPointer(table());
718 CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
719 // TODO(arv): Verify OrderedHashTable too.
723 void JSMap::JSMapVerify() {
726 VerifyHeapPointer(table());
727 CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
728 // TODO(arv): Verify OrderedHashTable too.
732 void JSSetIterator::JSSetIteratorVerify() {
733 CHECK(IsJSSetIterator());
735 VerifyHeapPointer(table());
736 CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
737 CHECK(index()->IsSmi() || index()->IsUndefined());
738 CHECK(kind()->IsSmi() || kind()->IsUndefined());
742 void JSMapIterator::JSMapIteratorVerify() {
743 CHECK(IsJSMapIterator());
745 VerifyHeapPointer(table());
746 CHECK(table()->IsOrderedHashTable() || table()->IsUndefined());
747 CHECK(index()->IsSmi() || index()->IsUndefined());
748 CHECK(kind()->IsSmi() || kind()->IsUndefined());
752 void JSWeakMap::JSWeakMapVerify() {
753 CHECK(IsJSWeakMap());
755 VerifyHeapPointer(table());
756 CHECK(table()->IsHashTable() || table()->IsUndefined());
760 void JSWeakSet::JSWeakSetVerify() {
761 CHECK(IsJSWeakSet());
763 VerifyHeapPointer(table());
764 CHECK(table()->IsHashTable() || table()->IsUndefined());
768 void JSRegExp::JSRegExpVerify() {
770 CHECK(data()->IsUndefined() || data()->IsFixedArray());
772 case JSRegExp::ATOM: {
773 FixedArray* arr = FixedArray::cast(data());
774 CHECK(arr->get(JSRegExp::kAtomPatternIndex)->IsString());
777 case JSRegExp::IRREGEXP: {
778 bool is_native = RegExpImpl::UsesNativeRegExp();
780 FixedArray* arr = FixedArray::cast(data());
781 Object* one_byte_data = arr->get(JSRegExp::kIrregexpLatin1CodeIndex);
782 // Smi : Not compiled yet (-1) or code prepared for flushing.
783 // JSObject: Compilation error.
784 // Code/ByteArray: Compiled code.
786 one_byte_data->IsSmi() ||
787 (is_native ? one_byte_data->IsCode() : one_byte_data->IsByteArray()));
788 Object* uc16_data = arr->get(JSRegExp::kIrregexpUC16CodeIndex);
789 CHECK(uc16_data->IsSmi() ||
790 (is_native ? uc16_data->IsCode() : uc16_data->IsByteArray()));
792 Object* one_byte_saved =
793 arr->get(JSRegExp::kIrregexpLatin1CodeSavedIndex);
794 CHECK(one_byte_saved->IsSmi() || one_byte_saved->IsString() ||
795 one_byte_saved->IsCode());
796 Object* uc16_saved = arr->get(JSRegExp::kIrregexpUC16CodeSavedIndex);
797 CHECK(uc16_saved->IsSmi() || uc16_saved->IsString() ||
798 uc16_saved->IsCode());
800 CHECK(arr->get(JSRegExp::kIrregexpCaptureCountIndex)->IsSmi());
801 CHECK(arr->get(JSRegExp::kIrregexpMaxRegisterCountIndex)->IsSmi());
805 CHECK_EQ(JSRegExp::NOT_COMPILED, TypeTag());
806 CHECK(data()->IsUndefined());
812 void JSProxy::JSProxyVerify() {
814 VerifyPointer(handler());
815 CHECK(hash()->IsSmi() || hash()->IsUndefined());
819 void JSFunctionProxy::JSFunctionProxyVerify() {
820 CHECK(IsJSFunctionProxy());
822 VerifyPointer(call_trap());
823 VerifyPointer(construct_trap());
827 void JSArrayBuffer::JSArrayBufferVerify() {
828 CHECK(IsJSArrayBuffer());
830 VerifyPointer(byte_length());
831 CHECK(byte_length()->IsSmi() || byte_length()->IsHeapNumber()
832 || byte_length()->IsUndefined());
836 void JSArrayBufferView::JSArrayBufferViewVerify() {
837 CHECK(IsJSArrayBufferView());
839 VerifyPointer(buffer());
840 CHECK(buffer()->IsJSArrayBuffer() || buffer()->IsUndefined()
841 || buffer() == Smi::FromInt(0));
843 VerifyPointer(byte_offset());
844 CHECK(byte_offset()->IsSmi() || byte_offset()->IsHeapNumber()
845 || byte_offset()->IsUndefined());
847 VerifyPointer(byte_length());
848 CHECK(byte_length()->IsSmi() || byte_length()->IsHeapNumber()
849 || byte_length()->IsUndefined());
853 void JSTypedArray::JSTypedArrayVerify() {
854 CHECK(IsJSTypedArray());
855 JSArrayBufferViewVerify();
856 VerifyPointer(length());
857 CHECK(length()->IsSmi() || length()->IsHeapNumber()
858 || length()->IsUndefined());
860 VerifyPointer(elements());
864 void JSDataView::JSDataViewVerify() {
865 CHECK(IsJSDataView());
866 JSArrayBufferViewVerify();
870 void Foreign::ForeignVerify() {
875 void Box::BoxVerify() {
877 value()->ObjectVerify();
881 void AccessorInfo::AccessorInfoVerify() {
882 VerifyPointer(name());
883 VerifyPointer(flag());
884 VerifyPointer(expected_receiver_type());
888 void ExecutableAccessorInfo::ExecutableAccessorInfoVerify() {
889 CHECK(IsExecutableAccessorInfo());
890 AccessorInfoVerify();
891 VerifyPointer(getter());
892 VerifyPointer(setter());
893 VerifyPointer(data());
897 void DeclaredAccessorDescriptor::DeclaredAccessorDescriptorVerify() {
898 CHECK(IsDeclaredAccessorDescriptor());
899 VerifyPointer(serialized_data());
903 void DeclaredAccessorInfo::DeclaredAccessorInfoVerify() {
904 CHECK(IsDeclaredAccessorInfo());
905 AccessorInfoVerify();
906 VerifyPointer(descriptor());
910 void AccessorPair::AccessorPairVerify() {
911 CHECK(IsAccessorPair());
912 VerifyPointer(getter());
913 VerifyPointer(setter());
917 void AccessCheckInfo::AccessCheckInfoVerify() {
918 CHECK(IsAccessCheckInfo());
919 VerifyPointer(named_callback());
920 VerifyPointer(indexed_callback());
921 VerifyPointer(data());
925 void InterceptorInfo::InterceptorInfoVerify() {
926 CHECK(IsInterceptorInfo());
927 VerifyPointer(getter());
928 VerifyPointer(setter());
929 VerifyPointer(query());
930 VerifyPointer(deleter());
931 VerifyPointer(enumerator());
932 VerifyPointer(data());
933 VerifySmiField(kFlagsOffset);
937 void CallHandlerInfo::CallHandlerInfoVerify() {
938 CHECK(IsCallHandlerInfo());
939 VerifyPointer(callback());
940 VerifyPointer(data());
944 void TemplateInfo::TemplateInfoVerify() {
945 VerifyPointer(tag());
946 VerifyPointer(property_list());
947 VerifyPointer(property_accessors());
951 void FunctionTemplateInfo::FunctionTemplateInfoVerify() {
952 CHECK(IsFunctionTemplateInfo());
953 TemplateInfoVerify();
954 VerifyPointer(serial_number());
955 VerifyPointer(call_code());
956 VerifyPointer(prototype_template());
957 VerifyPointer(parent_template());
958 VerifyPointer(named_property_handler());
959 VerifyPointer(indexed_property_handler());
960 VerifyPointer(instance_template());
961 VerifyPointer(signature());
962 VerifyPointer(access_check_info());
966 void ObjectTemplateInfo::ObjectTemplateInfoVerify() {
967 CHECK(IsObjectTemplateInfo());
968 TemplateInfoVerify();
969 VerifyPointer(constructor());
970 VerifyPointer(internal_field_count());
974 void SignatureInfo::SignatureInfoVerify() {
975 CHECK(IsSignatureInfo());
976 VerifyPointer(receiver());
977 VerifyPointer(args());
981 void TypeSwitchInfo::TypeSwitchInfoVerify() {
982 CHECK(IsTypeSwitchInfo());
983 VerifyPointer(types());
987 void AllocationSite::AllocationSiteVerify() {
988 CHECK(IsAllocationSite());
992 void AllocationMemento::AllocationMementoVerify() {
993 CHECK(IsAllocationMemento());
994 VerifyHeapPointer(allocation_site());
995 CHECK(!IsValid() || GetAllocationSite()->IsAllocationSite());
999 void Script::ScriptVerify() {
1001 VerifyPointer(source());
1002 VerifyPointer(name());
1003 line_offset()->SmiVerify();
1004 column_offset()->SmiVerify();
1005 VerifyPointer(wrapper());
1006 type()->SmiVerify();
1007 VerifyPointer(line_ends());
1008 VerifyPointer(id());
1012 void JSFunctionResultCache::JSFunctionResultCacheVerify() {
1013 JSFunction::cast(get(kFactoryIndex))->ObjectVerify();
1015 int size = Smi::cast(get(kCacheSizeIndex))->value();
1016 CHECK(kEntriesIndex <= size);
1017 CHECK(size <= length());
1018 CHECK_EQ(0, size % kEntrySize);
1020 int finger = Smi::cast(get(kFingerIndex))->value();
1021 CHECK(kEntriesIndex <= finger);
1022 CHECK((finger < size) || (finger == kEntriesIndex && finger == size));
1023 CHECK_EQ(0, finger % kEntrySize);
1025 if (FLAG_enable_slow_asserts) {
1026 for (int i = kEntriesIndex; i < size; i++) {
1027 CHECK(!get(i)->IsTheHole());
1028 get(i)->ObjectVerify();
1030 for (int i = size; i < length(); i++) {
1031 CHECK(get(i)->IsTheHole());
1032 get(i)->ObjectVerify();
1038 void NormalizedMapCache::NormalizedMapCacheVerify() {
1039 FixedArray::cast(this)->FixedArrayVerify();
1040 if (FLAG_enable_slow_asserts) {
1041 for (int i = 0; i < length(); i++) {
1042 Object* e = FixedArray::get(i);
1044 Map::cast(e)->DictionaryMapVerify();
1046 CHECK(e->IsUndefined());
1053 void DebugInfo::DebugInfoVerify() {
1054 CHECK(IsDebugInfo());
1055 VerifyPointer(shared());
1056 VerifyPointer(original_code());
1057 VerifyPointer(code());
1058 VerifyPointer(break_points());
1062 void BreakPointInfo::BreakPointInfoVerify() {
1063 CHECK(IsBreakPointInfo());
1064 code_position()->SmiVerify();
1065 source_position()->SmiVerify();
1066 statement_position()->SmiVerify();
1067 VerifyPointer(break_point_objects());
1069 #endif // VERIFY_HEAP
1073 void JSObject::IncrementSpillStatistics(SpillInformation* info) {
1074 info->number_of_objects_++;
1076 if (HasFastProperties()) {
1077 info->number_of_objects_with_fast_properties_++;
1078 info->number_of_fast_used_fields_ += map()->NextFreePropertyIndex();
1079 info->number_of_fast_unused_fields_ += map()->unused_property_fields();
1081 NameDictionary* dict = property_dictionary();
1082 info->number_of_slow_used_properties_ += dict->NumberOfElements();
1083 info->number_of_slow_unused_properties_ +=
1084 dict->Capacity() - dict->NumberOfElements();
1086 // Indexed properties
1087 switch (GetElementsKind()) {
1088 case FAST_HOLEY_SMI_ELEMENTS:
1089 case FAST_SMI_ELEMENTS:
1090 case FAST_HOLEY_DOUBLE_ELEMENTS:
1091 case FAST_DOUBLE_ELEMENTS:
1092 case FAST_HOLEY_ELEMENTS:
1093 case FAST_ELEMENTS: {
1094 info->number_of_objects_with_fast_elements_++;
1096 FixedArray* e = FixedArray::cast(elements());
1097 int len = e->length();
1098 Heap* heap = GetHeap();
1099 for (int i = 0; i < len; i++) {
1100 if (e->get(i) == heap->the_hole_value()) holes++;
1102 info->number_of_fast_used_elements_ += len - holes;
1103 info->number_of_fast_unused_elements_ += holes;
1107 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
1108 case EXTERNAL_##TYPE##_ELEMENTS: \
1109 case TYPE##_ELEMENTS:
1111 TYPED_ARRAYS(TYPED_ARRAY_CASE)
1112 #undef TYPED_ARRAY_CASE
1113 { info->number_of_objects_with_fast_elements_++;
1114 FixedArrayBase* e = FixedArrayBase::cast(elements());
1115 info->number_of_fast_used_elements_ += e->length();
1118 case DICTIONARY_ELEMENTS: {
1119 SeededNumberDictionary* dict = element_dictionary();
1120 info->number_of_slow_used_elements_ += dict->NumberOfElements();
1121 info->number_of_slow_unused_elements_ +=
1122 dict->Capacity() - dict->NumberOfElements();
1125 case SLOPPY_ARGUMENTS_ELEMENTS:
1131 void JSObject::SpillInformation::Clear() {
1132 number_of_objects_ = 0;
1133 number_of_objects_with_fast_properties_ = 0;
1134 number_of_objects_with_fast_elements_ = 0;
1135 number_of_fast_used_fields_ = 0;
1136 number_of_fast_unused_fields_ = 0;
1137 number_of_slow_used_properties_ = 0;
1138 number_of_slow_unused_properties_ = 0;
1139 number_of_fast_used_elements_ = 0;
1140 number_of_fast_unused_elements_ = 0;
1141 number_of_slow_used_elements_ = 0;
1142 number_of_slow_unused_elements_ = 0;
1146 void JSObject::SpillInformation::Print() {
1147 PrintF("\n JSObject Spill Statistics (#%d):\n", number_of_objects_);
1149 PrintF(" - fast properties (#%d): %d (used) %d (unused)\n",
1150 number_of_objects_with_fast_properties_,
1151 number_of_fast_used_fields_, number_of_fast_unused_fields_);
1153 PrintF(" - slow properties (#%d): %d (used) %d (unused)\n",
1154 number_of_objects_ - number_of_objects_with_fast_properties_,
1155 number_of_slow_used_properties_, number_of_slow_unused_properties_);
1157 PrintF(" - fast elements (#%d): %d (used) %d (unused)\n",
1158 number_of_objects_with_fast_elements_,
1159 number_of_fast_used_elements_, number_of_fast_unused_elements_);
1161 PrintF(" - slow elements (#%d): %d (used) %d (unused)\n",
1162 number_of_objects_ - number_of_objects_with_fast_elements_,
1163 number_of_slow_used_elements_, number_of_slow_unused_elements_);
1169 bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
1170 if (valid_entries == -1) valid_entries = number_of_descriptors();
1171 Name* current_key = NULL;
1172 uint32_t current = 0;
1173 for (int i = 0; i < number_of_descriptors(); i++) {
1174 Name* key = GetSortedKey(i);
1175 if (key == current_key) {
1180 uint32_t hash = GetSortedKey(i)->Hash();
1181 if (hash < current) {
1191 bool LayoutDescriptor::IsConsistentWithMap(Map* map) {
1192 if (FLAG_unbox_double_fields) {
1193 DescriptorArray* descriptors = map->instance_descriptors();
1194 int nof_descriptors = map->NumberOfOwnDescriptors();
1195 for (int i = 0; i < nof_descriptors; i++) {
1196 PropertyDetails details = descriptors->GetDetails(i);
1197 if (details.type() != FIELD) continue;
1198 FieldIndex field_index = FieldIndex::ForDescriptor(map, i);
1199 bool tagged_expected =
1200 !field_index.is_inobject() || !details.representation().IsDouble();
1201 for (int bit = 0; bit < details.field_width_in_words(); bit++) {
1202 bool tagged_actual = IsTagged(details.field_index() + bit);
1203 DCHECK_EQ(tagged_expected, tagged_actual);
1204 if (tagged_actual != tagged_expected) return false;
1212 bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
1213 DCHECK(valid_entries == -1);
1214 Name* prev_key = NULL;
1215 PropertyKind prev_kind = DATA;
1216 PropertyAttributes prev_attributes = NONE;
1217 uint32_t prev_hash = 0;
1218 for (int i = 0; i < number_of_transitions(); i++) {
1219 Name* key = GetSortedKey(i);
1220 uint32_t hash = key->Hash();
1221 PropertyKind kind = DATA;
1222 PropertyAttributes attributes = NONE;
1223 if (!IsSpecialTransition(key)) {
1224 Map* target = GetTarget(i);
1225 PropertyDetails details = GetTargetDetails(key, target);
1226 kind = details.kind();
1227 attributes = details.attributes();
1229 // Duplicate entries are not allowed for non-property transitions.
1230 CHECK_NE(prev_key, key);
1233 int cmp = CompareKeys(prev_key, prev_hash, prev_kind, prev_attributes, key,
1234 hash, kind, attributes);
1241 prev_attributes = attributes;
1248 static bool CheckOneBackPointer(Map* current_map, Object* target) {
1249 return !target->IsMap() || Map::cast(target)->GetBackPointer() == current_map;
1253 bool TransitionArray::IsConsistentWithBackPointers(Map* current_map) {
1254 for (int i = 0; i < number_of_transitions(); ++i) {
1255 if (!CheckOneBackPointer(current_map, GetTarget(i))) return false;
1261 void Code::VerifyEmbeddedObjectsInFullCode() {
1262 // Check that no context-specific object has been embedded.
1263 Heap* heap = GetIsolate()->heap();
1264 int mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
1265 for (RelocIterator it(this, mask); !it.done(); it.next()) {
1266 Object* obj = it.rinfo()->target_object();
1267 if (obj->IsCell()) obj = Cell::cast(obj)->value();
1268 if (obj->IsPropertyCell()) obj = PropertyCell::cast(obj)->value();
1269 if (!obj->IsHeapObject()) continue;
1270 Map* map = obj->IsMap() ? Map::cast(obj) : HeapObject::cast(obj)->map();
1272 while (map != heap->roots_array_start()[i++]) {
1273 CHECK_LT(i, Heap::kStrongRootListLength);
1281 } } // namespace v8::internal