V8 API Reference, 7.2.502.16 (for Deno 0.2.4)
objects-debug.cc
1 // Copyright 2012 the V8 project authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4 
5 #include "src/objects.h"
6 
7 #include "src/assembler-inl.h"
8 #include "src/bootstrapper.h"
9 #include "src/date.h"
10 #include "src/disasm.h"
11 #include "src/disassembler.h"
12 #include "src/elements.h"
13 #include "src/field-type.h"
14 #include "src/layout-descriptor.h"
15 #include "src/macro-assembler.h"
16 #include "src/objects-inl.h"
17 #include "src/objects/arguments-inl.h"
18 #include "src/objects/bigint.h"
19 #include "src/objects/data-handler-inl.h"
20 #include "src/objects/debug-objects-inl.h"
21 #include "src/objects/embedder-data-array-inl.h"
22 #include "src/objects/embedder-data-slot-inl.h"
23 #include "src/objects/hash-table-inl.h"
24 #include "src/objects/js-array-inl.h"
25 #ifdef V8_INTL_SUPPORT
26 #include "src/objects/js-break-iterator-inl.h"
27 #include "src/objects/js-collator-inl.h"
28 #endif // V8_INTL_SUPPORT
29 #include "src/objects/js-collection-inl.h"
30 #ifdef V8_INTL_SUPPORT
31 #include "src/objects/js-date-time-format-inl.h"
32 #endif // V8_INTL_SUPPORT
33 #include "src/objects/js-generator-inl.h"
34 #ifdef V8_INTL_SUPPORT
35 #include "src/objects/js-list-format-inl.h"
36 #include "src/objects/js-locale-inl.h"
37 #include "src/objects/js-number-format-inl.h"
38 #include "src/objects/js-plural-rules-inl.h"
39 #endif // V8_INTL_SUPPORT
40 #include "src/objects/js-regexp-inl.h"
41 #include "src/objects/js-regexp-string-iterator-inl.h"
42 #ifdef V8_INTL_SUPPORT
43 #include "src/objects/js-relative-time-format-inl.h"
44 #include "src/objects/js-segment-iterator-inl.h"
45 #include "src/objects/js-segmenter-inl.h"
46 #endif // V8_INTL_SUPPORT
47 #include "src/objects/js-weak-refs-inl.h"
48 #include "src/objects/literal-objects-inl.h"
49 #include "src/objects/maybe-object.h"
50 #include "src/objects/microtask-inl.h"
51 #include "src/objects/module-inl.h"
52 #include "src/objects/promise-inl.h"
53 #include "src/objects/stack-frame-info-inl.h"
54 #include "src/ostreams.h"
55 #include "src/regexp/jsregexp.h"
56 #include "src/transitions.h"
57 #include "src/wasm/wasm-objects-inl.h"
58 
59 namespace v8 {
60 namespace internal {
61 
62 // Heap Verification Overview
63 // --------------------------
64 // - Each InstanceType has a separate XXXVerify method which checks an object's
65 // integrity in isolation.
66 // - --verify-heap will iterate over all gc spaces and call ObjectVerify() on
67 // every encountered tagged pointer.
68 // - Verification should be pushed down to the specific instance type if its
69 // integrity is independent of an outer object.
70 // - In cases where the InstanceType is too genernic (e.g. FixedArray) the
71 // XXXVerify of the outer method has to do recursive verification.
72 // - If the corresponding objects have inheritence the parent's Verify method
73 // is called as well.
74 // - For any field containing pointes VerifyPointer(...) should be called.
75 //
76 // Caveats
77 // -------
78 // - Assume that any of the verify methods is incomplete!
79 // - Some integrity checks are only partially done due to objects being in
80 // partially initialized states when a gc happens, for instance when outer
81 // objects are allocted before inner ones.
82 //
83 
84 #ifdef VERIFY_HEAP
85 
86 void Object::ObjectVerify(Isolate* isolate) {
87  if (IsSmi()) {
88  Smi::cast(this)->SmiVerify(isolate);
89  } else {
90  HeapObject::cast(this)->HeapObjectVerify(isolate);
91  }
92  CHECK(!IsConstructor() || IsCallable());
93 }
94 
95 void Object::VerifyPointer(Isolate* isolate, Object* p) {
96  if (p->IsHeapObject()) {
97  HeapObject::VerifyHeapPointer(isolate, p);
98  } else {
99  CHECK(p->IsSmi());
100  }
101 }
102 
103 void ObjectPtr::VerifyPointer(Isolate* isolate, Object* p) {
104  Object::VerifyPointer(isolate, p);
105 }
106 
107 void MaybeObject::VerifyMaybeObjectPointer(Isolate* isolate, MaybeObject p) {
108  HeapObject* heap_object;
109  if (p->GetHeapObject(&heap_object)) {
110  HeapObject::VerifyHeapPointer(isolate, heap_object);
111  } else {
112  CHECK(p->IsSmi() || p->IsCleared());
113  }
114 }
115 
116 namespace {
117 void VerifyForeignPointer(Isolate* isolate, HeapObject* host, Object* foreign) {
118  host->VerifyPointer(isolate, foreign);
119  CHECK(foreign->IsUndefined(isolate) || Foreign::IsNormalized(foreign));
120 }
121 } // namespace
122 
123 void Smi::SmiVerify(Isolate* isolate) {
124  CHECK(IsSmi());
125  CHECK(!IsCallable());
126  CHECK(!IsConstructor());
127 }
128 
129 void HeapObject::HeapObjectVerify(Isolate* isolate) {
130  VerifyHeapPointer(isolate, map());
131  CHECK(map()->IsMap());
132 
133  switch (map()->instance_type()) {
134 #define STRING_TYPE_CASE(TYPE, size, name, CamelName) case TYPE:
135  STRING_TYPE_LIST(STRING_TYPE_CASE)
136 #undef STRING_TYPE_CASE
137  String::cast(this)->StringVerify(isolate);
138  break;
139  case SYMBOL_TYPE:
140  Symbol::cast(this)->SymbolVerify(isolate);
141  break;
142  case MAP_TYPE:
143  Map::cast(this)->MapVerify(isolate);
144  break;
145  case HEAP_NUMBER_TYPE:
146  CHECK(IsHeapNumber());
147  break;
148  case MUTABLE_HEAP_NUMBER_TYPE:
149  CHECK(IsMutableHeapNumber());
150  break;
151  case BIGINT_TYPE:
152  BigInt::cast(this)->BigIntVerify(isolate);
153  break;
154  case CALL_HANDLER_INFO_TYPE:
155  CallHandlerInfo::cast(this)->CallHandlerInfoVerify(isolate);
156  break;
157  case OBJECT_BOILERPLATE_DESCRIPTION_TYPE:
158  ObjectBoilerplateDescription::cast(this)
159  ->ObjectBoilerplateDescriptionVerify(isolate);
160  break;
161  case EMBEDDER_DATA_ARRAY_TYPE:
162  EmbedderDataArray::cast(this)->EmbedderDataArrayVerify(isolate);
163  break;
164  // FixedArray types
165  case HASH_TABLE_TYPE:
166  case ORDERED_HASH_MAP_TYPE:
167  case ORDERED_HASH_SET_TYPE:
168  case ORDERED_NAME_DICTIONARY_TYPE:
169  case NAME_DICTIONARY_TYPE:
170  case GLOBAL_DICTIONARY_TYPE:
171  case NUMBER_DICTIONARY_TYPE:
172  case SIMPLE_NUMBER_DICTIONARY_TYPE:
173  case STRING_TABLE_TYPE:
174  case EPHEMERON_HASH_TABLE_TYPE:
175  case FIXED_ARRAY_TYPE:
176  case SCOPE_INFO_TYPE:
177  case SCRIPT_CONTEXT_TABLE_TYPE:
178  FixedArray::cast(this)->FixedArrayVerify(isolate);
179  break;
180  case AWAIT_CONTEXT_TYPE:
181  case BLOCK_CONTEXT_TYPE:
182  case CATCH_CONTEXT_TYPE:
183  case DEBUG_EVALUATE_CONTEXT_TYPE:
184  case EVAL_CONTEXT_TYPE:
185  case FUNCTION_CONTEXT_TYPE:
186  case MODULE_CONTEXT_TYPE:
187  case SCRIPT_CONTEXT_TYPE:
188  case WITH_CONTEXT_TYPE:
189  Context::cast(this)->ContextVerify(isolate);
190  break;
191  case NATIVE_CONTEXT_TYPE:
192  NativeContext::cast(this)->NativeContextVerify(isolate);
193  break;
194  case WEAK_FIXED_ARRAY_TYPE:
195  WeakFixedArray::cast(this)->WeakFixedArrayVerify(isolate);
196  break;
197  case WEAK_ARRAY_LIST_TYPE:
198  WeakArrayList::cast(this)->WeakArrayListVerify(isolate);
199  break;
200  case FIXED_DOUBLE_ARRAY_TYPE:
201  FixedDoubleArray::cast(this)->FixedDoubleArrayVerify(isolate);
202  break;
203  case FEEDBACK_METADATA_TYPE:
204  FeedbackMetadata::cast(this)->FeedbackMetadataVerify(isolate);
205  break;
206  case BYTE_ARRAY_TYPE:
207  ByteArray::cast(this)->ByteArrayVerify(isolate);
208  break;
209  case BYTECODE_ARRAY_TYPE:
210  BytecodeArray::cast(this)->BytecodeArrayVerify(isolate);
211  break;
212  case DESCRIPTOR_ARRAY_TYPE:
213  DescriptorArray::cast(this)->DescriptorArrayVerify(isolate);
214  break;
215  case TRANSITION_ARRAY_TYPE:
216  TransitionArray::cast(this)->TransitionArrayVerify(isolate);
217  break;
218  case PROPERTY_ARRAY_TYPE:
219  PropertyArray::cast(this)->PropertyArrayVerify(isolate);
220  break;
221  case FREE_SPACE_TYPE:
222  FreeSpace::cast(this)->FreeSpaceVerify(isolate);
223  break;
224  case FEEDBACK_CELL_TYPE:
225  FeedbackCell::cast(this)->FeedbackCellVerify(isolate);
226  break;
227  case FEEDBACK_VECTOR_TYPE:
228  FeedbackVector::cast(this)->FeedbackVectorVerify(isolate);
229  break;
230 
231 #define VERIFY_TYPED_ARRAY(Type, type, TYPE, ctype) \
232  case FIXED_##TYPE##_ARRAY_TYPE: \
233  Fixed##Type##Array::cast(this)->FixedTypedArrayVerify(isolate); \
234  break;
235 
236  TYPED_ARRAYS(VERIFY_TYPED_ARRAY)
237 #undef VERIFY_TYPED_ARRAY
238 
239  case CODE_TYPE:
240  Code::cast(this)->CodeVerify(isolate);
241  break;
242  case ODDBALL_TYPE:
243  Oddball::cast(this)->OddballVerify(isolate);
244  break;
245  case JS_OBJECT_TYPE:
246  case JS_ERROR_TYPE:
247  case JS_API_OBJECT_TYPE:
248  case JS_SPECIAL_API_OBJECT_TYPE:
249  case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
250  case WASM_EXCEPTION_TYPE:
251  case WASM_GLOBAL_TYPE:
252  case WASM_MEMORY_TYPE:
253  case WASM_TABLE_TYPE:
254  JSObject::cast(this)->JSObjectVerify(isolate);
255  break;
256  case WASM_MODULE_TYPE:
257  WasmModuleObject::cast(this)->WasmModuleObjectVerify(isolate);
258  break;
259  case WASM_INSTANCE_TYPE:
260  WasmInstanceObject::cast(this)->WasmInstanceObjectVerify(isolate);
261  break;
262  case JS_ARGUMENTS_TYPE:
263  JSArgumentsObject::cast(this)->JSArgumentsObjectVerify(isolate);
264  break;
265  case JS_GENERATOR_OBJECT_TYPE:
266  JSGeneratorObject::cast(this)->JSGeneratorObjectVerify(isolate);
267  break;
268  case JS_ASYNC_FUNCTION_OBJECT_TYPE:
269  JSAsyncFunctionObject::cast(this)->JSAsyncFunctionObjectVerify(isolate);
270  break;
271  case JS_ASYNC_GENERATOR_OBJECT_TYPE:
272  JSAsyncGeneratorObject::cast(this)->JSAsyncGeneratorObjectVerify(isolate);
273  break;
274  case JS_VALUE_TYPE:
275  JSValue::cast(this)->JSValueVerify(isolate);
276  break;
277  case JS_DATE_TYPE:
278  JSDate::cast(this)->JSDateVerify(isolate);
279  break;
280  case JS_BOUND_FUNCTION_TYPE:
281  JSBoundFunction::cast(this)->JSBoundFunctionVerify(isolate);
282  break;
283  case JS_FUNCTION_TYPE:
284  JSFunction::cast(this)->JSFunctionVerify(isolate);
285  break;
286  case JS_GLOBAL_PROXY_TYPE:
287  JSGlobalProxy::cast(this)->JSGlobalProxyVerify(isolate);
288  break;
289  case JS_GLOBAL_OBJECT_TYPE:
290  JSGlobalObject::cast(this)->JSGlobalObjectVerify(isolate);
291  break;
292  case CELL_TYPE:
293  Cell::cast(this)->CellVerify(isolate);
294  break;
295  case PROPERTY_CELL_TYPE:
296  PropertyCell::cast(this)->PropertyCellVerify(isolate);
297  break;
298  case JS_ARRAY_TYPE:
299  JSArray::cast(this)->JSArrayVerify(isolate);
300  break;
301  case JS_MODULE_NAMESPACE_TYPE:
302  JSModuleNamespace::cast(this)->JSModuleNamespaceVerify(isolate);
303  break;
304  case JS_SET_TYPE:
305  JSSet::cast(this)->JSSetVerify(isolate);
306  break;
307  case JS_MAP_TYPE:
308  JSMap::cast(this)->JSMapVerify(isolate);
309  break;
310  case JS_SET_KEY_VALUE_ITERATOR_TYPE:
311  case JS_SET_VALUE_ITERATOR_TYPE:
312  JSSetIterator::cast(this)->JSSetIteratorVerify(isolate);
313  break;
314  case JS_MAP_KEY_ITERATOR_TYPE:
315  case JS_MAP_KEY_VALUE_ITERATOR_TYPE:
316  case JS_MAP_VALUE_ITERATOR_TYPE:
317  JSMapIterator::cast(this)->JSMapIteratorVerify(isolate);
318  break;
319  case JS_ARRAY_ITERATOR_TYPE:
320  JSArrayIterator::cast(this)->JSArrayIteratorVerify(isolate);
321  break;
322  case JS_STRING_ITERATOR_TYPE:
323  JSStringIterator::cast(this)->JSStringIteratorVerify(isolate);
324  break;
325  case JS_ASYNC_FROM_SYNC_ITERATOR_TYPE:
326  JSAsyncFromSyncIterator::cast(this)->JSAsyncFromSyncIteratorVerify(
327  isolate);
328  break;
329  case JS_WEAK_CELL_TYPE:
330  case JS_WEAK_REF_TYPE:
331  JSWeakCell::cast(this)->JSWeakCellVerify(isolate);
332  break;
333  case JS_WEAK_FACTORY_TYPE:
334  JSWeakFactory::cast(this)->JSWeakFactoryVerify(isolate);
335  break;
336  case JS_WEAK_FACTORY_CLEANUP_ITERATOR_TYPE:
337  JSWeakFactoryCleanupIterator::cast(this)
338  ->JSWeakFactoryCleanupIteratorVerify(isolate);
339  break;
340  case JS_WEAK_MAP_TYPE:
341  JSWeakMap::cast(this)->JSWeakMapVerify(isolate);
342  break;
343  case JS_WEAK_SET_TYPE:
344  JSWeakSet::cast(this)->JSWeakSetVerify(isolate);
345  break;
346  case JS_PROMISE_TYPE:
347  JSPromise::cast(this)->JSPromiseVerify(isolate);
348  break;
349  case JS_REGEXP_TYPE:
350  JSRegExp::cast(this)->JSRegExpVerify(isolate);
351  break;
352  case JS_REGEXP_STRING_ITERATOR_TYPE:
353  JSRegExpStringIterator::cast(this)->JSRegExpStringIteratorVerify(isolate);
354  break;
355  case FILLER_TYPE:
356  break;
357  case JS_PROXY_TYPE:
358  JSProxy::cast(this)->JSProxyVerify(isolate);
359  break;
360  case FOREIGN_TYPE:
361  Foreign::cast(this)->ForeignVerify(isolate);
362  break;
363  case PRE_PARSED_SCOPE_DATA_TYPE:
364  PreParsedScopeData::cast(this)->PreParsedScopeDataVerify(isolate);
365  break;
366  case UNCOMPILED_DATA_WITHOUT_PRE_PARSED_SCOPE_TYPE:
367  UncompiledDataWithoutPreParsedScope::cast(this)
368  ->UncompiledDataWithoutPreParsedScopeVerify(isolate);
369  break;
370  case UNCOMPILED_DATA_WITH_PRE_PARSED_SCOPE_TYPE:
371  UncompiledDataWithPreParsedScope::cast(this)
372  ->UncompiledDataWithPreParsedScopeVerify(isolate);
373  break;
374  case SHARED_FUNCTION_INFO_TYPE:
375  SharedFunctionInfo::cast(this)->SharedFunctionInfoVerify(isolate);
376  break;
377  case JS_MESSAGE_OBJECT_TYPE:
378  JSMessageObject::cast(this)->JSMessageObjectVerify(isolate);
379  break;
380  case JS_ARRAY_BUFFER_TYPE:
381  JSArrayBuffer::cast(this)->JSArrayBufferVerify(isolate);
382  break;
383  case JS_TYPED_ARRAY_TYPE:
384  JSTypedArray::cast(this)->JSTypedArrayVerify(isolate);
385  break;
386  case JS_DATA_VIEW_TYPE:
387  JSDataView::cast(this)->JSDataViewVerify(isolate);
388  break;
389  case SMALL_ORDERED_HASH_SET_TYPE:
390  SmallOrderedHashSet::cast(this)->SmallOrderedHashTableVerify(isolate);
391  break;
392  case SMALL_ORDERED_HASH_MAP_TYPE:
393  SmallOrderedHashMap::cast(this)->SmallOrderedHashTableVerify(isolate);
394  break;
395  case SMALL_ORDERED_NAME_DICTIONARY_TYPE:
396  SmallOrderedNameDictionary::cast(this)->SmallOrderedHashTableVerify(
397  isolate);
398  break;
399  case CODE_DATA_CONTAINER_TYPE:
400  CodeDataContainer::cast(this)->CodeDataContainerVerify(isolate);
401  break;
402 #ifdef V8_INTL_SUPPORT
403  case JS_INTL_V8_BREAK_ITERATOR_TYPE:
404  JSV8BreakIterator::cast(this)->JSV8BreakIteratorVerify(isolate);
405  break;
406  case JS_INTL_COLLATOR_TYPE:
407  JSCollator::cast(this)->JSCollatorVerify(isolate);
408  break;
409  case JS_INTL_DATE_TIME_FORMAT_TYPE:
410  JSDateTimeFormat::cast(this)->JSDateTimeFormatVerify(isolate);
411  break;
412  case JS_INTL_LIST_FORMAT_TYPE:
413  JSListFormat::cast(this)->JSListFormatVerify(isolate);
414  break;
415  case JS_INTL_LOCALE_TYPE:
416  JSLocale::cast(this)->JSLocaleVerify(isolate);
417  break;
418  case JS_INTL_NUMBER_FORMAT_TYPE:
419  JSNumberFormat::cast(this)->JSNumberFormatVerify(isolate);
420  break;
421  case JS_INTL_PLURAL_RULES_TYPE:
422  JSPluralRules::cast(this)->JSPluralRulesVerify(isolate);
423  break;
424  case JS_INTL_RELATIVE_TIME_FORMAT_TYPE:
425  JSRelativeTimeFormat::cast(this)->JSRelativeTimeFormatVerify(isolate);
426  break;
427  case JS_INTL_SEGMENT_ITERATOR_TYPE:
428  JSSegmentIterator::cast(this)->JSSegmentIteratorVerify(isolate);
429  break;
430  case JS_INTL_SEGMENTER_TYPE:
431  JSSegmenter::cast(this)->JSSegmenterVerify(isolate);
432  break;
433 #endif // V8_INTL_SUPPORT
434 
435 #define MAKE_STRUCT_CASE(TYPE, Name, name) \
436  case TYPE: \
437  Name::cast(this)->Name##Verify(isolate); \
438  break;
439  STRUCT_LIST(MAKE_STRUCT_CASE)
440 #undef MAKE_STRUCT_CASE
441 
442  case ALLOCATION_SITE_TYPE:
443  AllocationSite::cast(this)->AllocationSiteVerify(isolate);
444  break;
445 
446  case LOAD_HANDLER_TYPE:
447  LoadHandler::cast(this)->LoadHandlerVerify(isolate);
448  break;
449 
450  case STORE_HANDLER_TYPE:
451  StoreHandler::cast(this)->StoreHandlerVerify(isolate);
452  break;
453  }
454 }
455 
456 void HeapObjectPtr::HeapObjectVerify(Isolate* isolate) {
457  reinterpret_cast<HeapObject*>(ptr())->HeapObjectVerify(isolate);
458 }
459 
460 void HeapObject::VerifyHeapPointer(Isolate* isolate, Object* p) {
461  CHECK(p->IsHeapObject());
462  HeapObject* ho = HeapObject::cast(p);
463  CHECK(isolate->heap()->Contains(ho));
464 }
465 
466 void HeapObjectPtr::VerifyHeapPointer(Isolate* isolate, Object* p) {
467  HeapObject::VerifyHeapPointer(isolate, p);
468 }
469 
470 void Symbol::SymbolVerify(Isolate* isolate) {
471  CHECK(IsSymbol());
472  CHECK(HasHashCode());
473  CHECK_GT(Hash(), 0);
474  CHECK(name()->IsUndefined(isolate) || name()->IsString());
475  CHECK_IMPLIES(IsPrivateName(), IsPrivate());
476 }
477 
478 void ByteArray::ByteArrayVerify(Isolate* isolate) { CHECK(IsByteArray()); }
479 
480 void BytecodeArray::BytecodeArrayVerify(Isolate* isolate) {
481  // TODO(oth): Walk bytecodes and immediate values to validate sanity.
482  // - All bytecodes are known and well formed.
483  // - Jumps must go to new instructions starts.
484  // - No Illegal bytecodes.
485  // - No consecutive sequences of prefix Wide / ExtraWide.
486  CHECK(IsBytecodeArray());
487  CHECK(constant_pool()->IsFixedArray());
488  VerifyHeapPointer(isolate, constant_pool());
489 }
490 
491 void FreeSpace::FreeSpaceVerify(Isolate* isolate) { CHECK(IsFreeSpace()); }
492 
493 void FeedbackCell::FeedbackCellVerify(Isolate* isolate) {
494  CHECK(IsFeedbackCell());
495 
496  VerifyHeapPointer(isolate, value());
497  CHECK(value()->IsUndefined(isolate) || value()->IsFeedbackVector());
498 }
499 
500 void FeedbackVector::FeedbackVectorVerify(Isolate* isolate) {
501  CHECK(IsFeedbackVector());
502  MaybeObject code = optimized_code_weak_or_smi();
503  MaybeObject::VerifyMaybeObjectPointer(isolate, code);
504  CHECK(code->IsSmi() || code->IsWeakOrCleared());
505 }
506 
507 template <class Traits>
508 void FixedTypedArray<Traits>::FixedTypedArrayVerify(Isolate* isolate) {
509  CHECK(IsHeapObject() && map()->instance_type() == Traits::kInstanceType);
510  if (base_pointer()->ptr() == ptr()) {
511  CHECK(reinterpret_cast<Address>(external_pointer()) ==
512  ExternalReference::fixed_typed_array_base_data_offset().address());
513  } else {
514  CHECK_EQ(base_pointer(), Smi::kZero);
515  }
516 }
517 
518 bool JSObject::ElementsAreSafeToExamine() const {
519  // If a GC was caused while constructing this object, the elements
520  // pointer may point to a one pointer filler map.
521  return elements() != GetReadOnlyRoots().one_pointer_filler_map();
522 }
523 
524 namespace {
525 void VerifyJSObjectElements(Isolate* isolate, JSObject* object) {
526  // Only TypedArrays can have these specialized elements.
527  if (object->IsJSTypedArray()) {
528  // TODO(cbruni): Fix CreateTypedArray to either not instantiate the object
529  // or propertly initialize it on errors during construction.
530  /* CHECK(object->HasFixedTypedArrayElements()); */
531  /* CHECK(object->elements()->IsFixedTypedArrayBase()); */
532  return;
533  }
534  CHECK(!object->HasFixedTypedArrayElements());
535  CHECK(!object->elements()->IsFixedTypedArrayBase());
536 
537  if (object->HasDoubleElements()) {
538  if (object->elements()->length() > 0) {
539  CHECK(object->elements()->IsFixedDoubleArray());
540  }
541  return;
542  }
543 
544  FixedArray elements = FixedArray::cast(object->elements());
545  if (object->HasSmiElements()) {
546  // We might have a partially initialized backing store, in which case we
547  // allow the hole + smi values.
548  for (int i = 0; i < elements->length(); i++) {
549  Object* value = elements->get(i);
550  CHECK(value->IsSmi() || value->IsTheHole(isolate));
551  }
552  } else if (object->HasObjectElements()) {
553  for (int i = 0; i < elements->length(); i++) {
554  Object* element = elements->get(i);
555  CHECK_IMPLIES(!element->IsSmi(), !HasWeakHeapObjectTag(element));
556  }
557  }
558 }
559 } // namespace
560 
561 void JSObject::JSObjectVerify(Isolate* isolate) {
562  VerifyPointer(isolate, raw_properties_or_hash());
563  VerifyHeapPointer(isolate, elements());
564 
565  CHECK_IMPLIES(HasSloppyArgumentsElements(), IsJSArgumentsObject());
566  if (HasFastProperties()) {
567  int actual_unused_property_fields = map()->GetInObjectProperties() +
568  property_array()->length() -
569  map()->NextFreePropertyIndex();
570  if (map()->UnusedPropertyFields() != actual_unused_property_fields) {
571  // There are two reasons why this can happen:
572  // - in the middle of StoreTransitionStub when the new extended backing
573  // store is already set into the object and the allocation of the
574  // MutableHeapNumber triggers GC while the map isn't updated yet.
575  // - deletion of the last property can leave additional backing store
576  // capacity behind.
577  CHECK_GT(actual_unused_property_fields, map()->UnusedPropertyFields());
578  int delta = actual_unused_property_fields - map()->UnusedPropertyFields();
579  CHECK_EQ(0, delta % JSObject::kFieldsAdded);
580  }
581  DescriptorArray* descriptors = map()->instance_descriptors();
582  bool is_transitionable_fast_elements_kind =
583  IsTransitionableFastElementsKind(map()->elements_kind());
584 
585  for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
586  PropertyDetails details = descriptors->GetDetails(i);
587  if (details.location() == kField) {
588  DCHECK_EQ(kData, details.kind());
589  Representation r = details.representation();
590  FieldIndex index = FieldIndex::ForDescriptor(map(), i);
591  if (IsUnboxedDoubleField(index)) {
592  DCHECK(r.IsDouble());
593  continue;
594  }
595  Object* value = RawFastPropertyAt(index);
596  if (r.IsDouble()) DCHECK(value->IsMutableHeapNumber());
597  if (value->IsUninitialized(isolate)) continue;
598  if (r.IsSmi()) DCHECK(value->IsSmi());
599  if (r.IsHeapObject()) DCHECK(value->IsHeapObject());
600  FieldType field_type = descriptors->GetFieldType(i);
601  bool type_is_none = field_type->IsNone();
602  bool type_is_any = field_type->IsAny();
603  if (r.IsNone()) {
604  CHECK(type_is_none);
605  } else if (!type_is_any && !(type_is_none && r.IsHeapObject())) {
606  CHECK(!field_type->NowStable() || field_type->NowContains(value));
607  }
608  CHECK_IMPLIES(is_transitionable_fast_elements_kind,
609  !Map::IsInplaceGeneralizableField(details.constness(), r,
610  field_type));
611  }
612  }
613 
614  if (map()->EnumLength() != kInvalidEnumCacheSentinel) {
615  EnumCache* enum_cache = descriptors->enum_cache();
616  FixedArray keys = enum_cache->keys();
617  FixedArray indices = enum_cache->indices();
618  CHECK_LE(map()->EnumLength(), keys->length());
619  CHECK_IMPLIES(indices != ReadOnlyRoots(isolate).empty_fixed_array(),
620  keys->length() == indices->length());
621  }
622  }
623 
624  // If a GC was caused while constructing this object, the elements
625  // pointer may point to a one pointer filler map.
626  if (ElementsAreSafeToExamine()) {
627  CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
628  (elements() == GetReadOnlyRoots().empty_fixed_array()) ||
629  HasFastStringWrapperElements()),
630  (elements()->map() == GetReadOnlyRoots().fixed_array_map() ||
631  elements()->map() == GetReadOnlyRoots().fixed_cow_array_map()));
632  CHECK_EQ(map()->has_fast_object_elements(), HasObjectElements());
633  VerifyJSObjectElements(isolate, this);
634  }
635 }
636 
637 void Map::MapVerify(Isolate* isolate) {
638  Heap* heap = isolate->heap();
639  CHECK(!Heap::InNewSpace(*this));
640  CHECK(FIRST_TYPE <= instance_type() && instance_type() <= LAST_TYPE);
641  CHECK(instance_size() == kVariableSizeSentinel ||
642  (kPointerSize <= instance_size() &&
643  static_cast<size_t>(instance_size()) < heap->Capacity()));
644  CHECK(GetBackPointer()->IsUndefined(heap->isolate()) ||
645  !Map::cast(GetBackPointer())->is_stable());
646  HeapObject::VerifyHeapPointer(isolate, prototype());
647  HeapObject::VerifyHeapPointer(isolate, instance_descriptors());
648  SLOW_DCHECK(instance_descriptors()->IsSortedNoDuplicates());
649  DisallowHeapAllocation no_gc;
650  SLOW_DCHECK(
651  TransitionsAccessor(isolate, *this, &no_gc).IsSortedNoDuplicates());
652  SLOW_DCHECK(TransitionsAccessor(isolate, *this, &no_gc)
653  .IsConsistentWithBackPointers());
654  SLOW_DCHECK(!FLAG_unbox_double_fields ||
655  layout_descriptor()->IsConsistentWithMap(*this));
656  if (!may_have_interesting_symbols()) {
657  CHECK(!has_named_interceptor());
658  CHECK(!is_dictionary_map());
659  CHECK(!is_access_check_needed());
660  DescriptorArray* const descriptors = instance_descriptors();
661  for (int i = 0; i < NumberOfOwnDescriptors(); ++i) {
662  CHECK(!descriptors->GetKey(i)->IsInterestingSymbol());
663  }
664  }
665  CHECK_IMPLIES(has_named_interceptor(), may_have_interesting_symbols());
666  CHECK_IMPLIES(is_dictionary_map(), may_have_interesting_symbols());
667  CHECK_IMPLIES(is_access_check_needed(), may_have_interesting_symbols());
668  CHECK_IMPLIES(IsJSObjectMap() && !CanHaveFastTransitionableElementsKind(),
669  IsDictionaryElementsKind(elements_kind()) ||
670  IsTerminalElementsKind(elements_kind()));
671  if (is_prototype_map()) {
672  DCHECK(prototype_info() == Smi::kZero ||
673  prototype_info()->IsPrototypeInfo());
674  }
675  CHECK(prototype_validity_cell()->IsSmi() ||
676  prototype_validity_cell()->IsCell());
677 }
678 
679 void Map::DictionaryMapVerify(Isolate* isolate) {
680  MapVerify(isolate);
681  CHECK(is_dictionary_map());
682  CHECK_EQ(kInvalidEnumCacheSentinel, EnumLength());
683  CHECK_EQ(ReadOnlyRoots(isolate).empty_descriptor_array(),
684  instance_descriptors());
685  CHECK_EQ(0, UnusedPropertyFields());
686  CHECK_EQ(Map::GetVisitorId(*this), visitor_id());
687 }
688 
689 void AliasedArgumentsEntry::AliasedArgumentsEntryVerify(Isolate* isolate) {
690  VerifySmiField(kAliasedContextSlot);
691 }
692 
693 void EmbedderDataArray::EmbedderDataArrayVerify(Isolate* isolate) {
694  EmbedderDataSlot start(*this, 0);
695  EmbedderDataSlot end(*this, length());
696  for (EmbedderDataSlot slot = start; slot < end; ++slot) {
697  Object* e = slot.load_tagged();
698  Object::VerifyPointer(isolate, e);
699  }
700 }
701 
702 void FixedArray::FixedArrayVerify(Isolate* isolate) {
703  for (int i = 0; i < length(); i++) {
704  Object* e = get(i);
705  VerifyPointer(isolate, e);
706  }
707 }
708 
709 void WeakFixedArray::WeakFixedArrayVerify(Isolate* isolate) {
710  for (int i = 0; i < length(); i++) {
711  MaybeObject::VerifyMaybeObjectPointer(isolate, Get(i));
712  }
713 }
714 
715 void WeakArrayList::WeakArrayListVerify(Isolate* isolate) {
716  for (int i = 0; i < length(); i++) {
717  MaybeObject::VerifyMaybeObjectPointer(isolate, Get(i));
718  }
719 }
720 
721 void PropertyArray::PropertyArrayVerify(Isolate* isolate) {
722  if (length() == 0) {
723  CHECK_EQ(*this, ReadOnlyRoots(isolate).empty_property_array());
724  return;
725  }
726  // There are no empty PropertyArrays.
727  CHECK_LT(0, length());
728  for (int i = 0; i < length(); i++) {
729  Object* e = get(i);
730  Object::VerifyPointer(isolate, e);
731  }
732 }
733 
734 void FixedDoubleArray::FixedDoubleArrayVerify(Isolate* isolate) {
735  for (int i = 0; i < length(); i++) {
736  if (!is_the_hole(i)) {
737  uint64_t value = get_representation(i);
738  uint64_t unexpected =
739  bit_cast<uint64_t>(std::numeric_limits<double>::quiet_NaN()) &
740  uint64_t{0x7FF8000000000000};
741  // Create implementation specific sNaN by inverting relevant bit.
742  unexpected ^= uint64_t{0x0008000000000000};
743  CHECK((value & uint64_t{0x7FF8000000000000}) != unexpected ||
744  (value & uint64_t{0x0007FFFFFFFFFFFF}) == uint64_t{0});
745  }
746  }
747 }
748 
749 void Context::ContextVerify(Isolate* isolate) {
750  VerifySmiField(kLengthOffset);
751  VerifyObjectField(isolate, kScopeInfoOffset);
752  VerifyObjectField(isolate, kPreviousOffset);
753  VerifyObjectField(isolate, kExtensionOffset);
754  VerifyObjectField(isolate, kNativeContextOffset);
755  for (int i = 0; i < length(); i++) {
756  VerifyObjectField(isolate, OffsetOfElementAt(i));
757  }
758 }
759 
760 void NativeContext::NativeContextVerify(Isolate* isolate) {
761  ContextVerify(isolate);
762  CHECK_EQ(length(), NativeContext::NATIVE_CONTEXT_SLOTS);
763  CHECK_EQ(kSize, map()->instance_size());
764 }
765 
766 void FeedbackMetadata::FeedbackMetadataVerify(Isolate* isolate) {
767  if (slot_count() == 0) {
768  CHECK_EQ(ReadOnlyRoots(isolate).empty_feedback_metadata(), this);
769  } else {
770  FeedbackMetadataIterator iter(this);
771  while (iter.HasNext()) {
772  iter.Next();
773  FeedbackSlotKind kind = iter.kind();
774  CHECK_NE(FeedbackSlotKind::kInvalid, kind);
775  CHECK_GT(FeedbackSlotKind::kKindsNumber, kind);
776  }
777  }
778 }
779 
780 void DescriptorArray::DescriptorArrayVerify(Isolate* isolate) {
781  for (int i = 0; i < number_of_all_descriptors(); i++) {
782  MaybeObject::VerifyMaybeObjectPointer(isolate, get(ToKeyIndex(i)));
783  MaybeObject::VerifyMaybeObjectPointer(isolate, get(ToDetailsIndex(i)));
784  MaybeObject::VerifyMaybeObjectPointer(isolate, get(ToValueIndex(i)));
785  }
786  if (number_of_all_descriptors() == 0) {
787  Heap* heap = isolate->heap();
788  CHECK_EQ(ReadOnlyRoots(heap).empty_descriptor_array(), this);
789  CHECK_EQ(0, number_of_all_descriptors());
790  CHECK_EQ(0, number_of_descriptors());
791  CHECK_EQ(ReadOnlyRoots(heap).empty_enum_cache(), enum_cache());
792  } else {
793  CHECK_LT(0, number_of_all_descriptors());
794  CHECK_LE(number_of_descriptors(), number_of_all_descriptors());
795 
796  // Check that properties with private symbols names are non-enumerable.
797  for (int descriptor = 0; descriptor < number_of_descriptors();
798  descriptor++) {
799  Object* key = get(ToKeyIndex(descriptor))->cast<Object>();
800  // number_of_descriptors() may be out of sync with the actual descriptors
801  // written during descriptor array construction.
802  if (key->IsUndefined(isolate)) continue;
803  PropertyDetails details = GetDetails(descriptor);
804  if (Name::cast(key)->IsPrivate()) {
805  CHECK_NE(details.attributes() & DONT_ENUM, 0);
806  }
807  MaybeObject value = get(ToValueIndex(descriptor));
808  HeapObject* heap_object;
809  if (details.location() == kField) {
810  CHECK(
811  value == MaybeObject::FromObject(FieldType::None()) ||
812  value == MaybeObject::FromObject(FieldType::Any()) ||
813  value->IsCleared() ||
814  (value->GetHeapObjectIfWeak(&heap_object) && heap_object->IsMap()));
815  } else {
816  CHECK(!value->IsWeakOrCleared());
817  CHECK(!value->cast<Object>()->IsMap());
818  }
819  }
820  }
821 }
822 
823 void TransitionArray::TransitionArrayVerify(Isolate* isolate) {
824  WeakFixedArrayVerify(isolate);
825  CHECK_LE(LengthFor(number_of_transitions()), length());
826 }
827 
828 void JSArgumentsObject::JSArgumentsObjectVerify(Isolate* isolate) {
829  if (IsSloppyArgumentsElementsKind(GetElementsKind())) {
830  SloppyArgumentsElements::cast(elements())
831  ->SloppyArgumentsElementsVerify(isolate, this);
832  }
833  if (isolate->IsInAnyContext(map(), Context::SLOPPY_ARGUMENTS_MAP_INDEX) ||
834  isolate->IsInAnyContext(map(),
835  Context::SLOW_ALIASED_ARGUMENTS_MAP_INDEX) ||
836  isolate->IsInAnyContext(map(),
837  Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX)) {
838  VerifyObjectField(isolate, JSSloppyArgumentsObject::kLengthOffset);
839  VerifyObjectField(isolate, JSSloppyArgumentsObject::kCalleeOffset);
840  } else if (isolate->IsInAnyContext(map(),
841  Context::STRICT_ARGUMENTS_MAP_INDEX)) {
842  VerifyObjectField(isolate, JSStrictArgumentsObject::kLengthOffset);
843  }
844  JSObjectVerify(isolate);
845 }
846 
847 void SloppyArgumentsElements::SloppyArgumentsElementsVerify(Isolate* isolate,
848  JSObject* holder) {
849  FixedArrayVerify(isolate);
850  // Abort verification if only partially initialized (can't use arguments()
851  // getter because it does FixedArray::cast()).
852  if (get(kArgumentsIndex)->IsUndefined(isolate)) return;
853 
854  ElementsKind kind = holder->GetElementsKind();
855  bool is_fast = kind == FAST_SLOPPY_ARGUMENTS_ELEMENTS;
856  CHECK(IsFixedArray());
857  CHECK_GE(length(), 2);
858  CHECK_EQ(map(), ReadOnlyRoots(isolate).sloppy_arguments_elements_map());
859  Context context_object = context();
860  FixedArray arg_elements = FixedArray::cast(arguments());
861  if (arg_elements->length() == 0) {
862  CHECK(arg_elements == ReadOnlyRoots(isolate).empty_fixed_array());
863  return;
864  }
865  ElementsAccessor* accessor;
866  if (is_fast) {
867  accessor = ElementsAccessor::ForKind(HOLEY_ELEMENTS);
868  } else {
869  accessor = ElementsAccessor::ForKind(DICTIONARY_ELEMENTS);
870  }
871  int nofMappedParameters = 0;
872  int maxMappedIndex = 0;
873  for (int i = 0; i < nofMappedParameters; i++) {
874  // Verify that each context-mapped argument is either the hole or a valid
875  // Smi within context length range.
876  Object* mapped = get_mapped_entry(i);
877  if (mapped->IsTheHole(isolate)) {
878  // Slow sloppy arguments can be holey.
879  if (!is_fast) continue;
880  // Fast sloppy arguments elements are never holey. Either the element is
881  // context-mapped or present in the arguments elements.
882  CHECK(accessor->HasElement(holder, i, arg_elements));
883  continue;
884  }
885  int mappedIndex = Smi::ToInt(mapped);
886  nofMappedParameters++;
887  CHECK_LE(maxMappedIndex, mappedIndex);
888  maxMappedIndex = mappedIndex;
889  Object* value = context_object->get(mappedIndex);
890  CHECK(value->IsObject());
891  // None of the context-mapped entries should exist in the arguments
892  // elements.
893  CHECK(!accessor->HasElement(holder, i, arg_elements));
894  }
895  CHECK_LE(nofMappedParameters, context_object->length());
896  CHECK_LE(nofMappedParameters, arg_elements->length());
897  CHECK_LE(maxMappedIndex, context_object->length());
898  CHECK_LE(maxMappedIndex, arg_elements->length());
899 }
900 
901 void JSGeneratorObject::JSGeneratorObjectVerify(Isolate* isolate) {
902  // In an expression like "new g()", there can be a point where a generator
903  // object is allocated but its fields are all undefined, as it hasn't yet been
904  // initialized by the generator. Hence these weak checks.
905  VerifyObjectField(isolate, kFunctionOffset);
906  VerifyObjectField(isolate, kContextOffset);
907  VerifyObjectField(isolate, kReceiverOffset);
908  VerifyObjectField(isolate, kParametersAndRegistersOffset);
909  VerifyObjectField(isolate, kContinuationOffset);
910 }
911 
912 void JSAsyncFunctionObject::JSAsyncFunctionObjectVerify(Isolate* isolate) {
913  // Check inherited fields
914  JSGeneratorObjectVerify(isolate);
915  VerifyObjectField(isolate, kPromiseOffset);
916  promise()->HeapObjectVerify(isolate);
917 }
918 
919 void JSAsyncGeneratorObject::JSAsyncGeneratorObjectVerify(Isolate* isolate) {
920  // Check inherited fields
921  JSGeneratorObjectVerify(isolate);
922  VerifyObjectField(isolate, kQueueOffset);
923  queue()->HeapObjectVerify(isolate);
924 }
925 
926 void JSValue::JSValueVerify(Isolate* isolate) {
927  Object* v = value();
928  if (v->IsHeapObject()) {
929  VerifyHeapPointer(isolate, v);
930  }
931 }
932 
933 void JSDate::JSDateVerify(Isolate* isolate) {
934  if (value()->IsHeapObject()) {
935  VerifyHeapPointer(isolate, value());
936  }
937  CHECK(value()->IsUndefined(isolate) || value()->IsSmi() ||
938  value()->IsHeapNumber());
939  CHECK(year()->IsUndefined(isolate) || year()->IsSmi() || year()->IsNaN());
940  CHECK(month()->IsUndefined(isolate) || month()->IsSmi() || month()->IsNaN());
941  CHECK(day()->IsUndefined(isolate) || day()->IsSmi() || day()->IsNaN());
942  CHECK(weekday()->IsUndefined(isolate) || weekday()->IsSmi() ||
943  weekday()->IsNaN());
944  CHECK(hour()->IsUndefined(isolate) || hour()->IsSmi() || hour()->IsNaN());
945  CHECK(min()->IsUndefined(isolate) || min()->IsSmi() || min()->IsNaN());
946  CHECK(sec()->IsUndefined(isolate) || sec()->IsSmi() || sec()->IsNaN());
947  CHECK(cache_stamp()->IsUndefined(isolate) || cache_stamp()->IsSmi() ||
948  cache_stamp()->IsNaN());
949 
950  if (month()->IsSmi()) {
951  int month = Smi::ToInt(this->month());
952  CHECK(0 <= month && month <= 11);
953  }
954  if (day()->IsSmi()) {
955  int day = Smi::ToInt(this->day());
956  CHECK(1 <= day && day <= 31);
957  }
958  if (hour()->IsSmi()) {
959  int hour = Smi::ToInt(this->hour());
960  CHECK(0 <= hour && hour <= 23);
961  }
962  if (min()->IsSmi()) {
963  int min = Smi::ToInt(this->min());
964  CHECK(0 <= min && min <= 59);
965  }
966  if (sec()->IsSmi()) {
967  int sec = Smi::ToInt(this->sec());
968  CHECK(0 <= sec && sec <= 59);
969  }
970  if (weekday()->IsSmi()) {
971  int weekday = Smi::ToInt(this->weekday());
972  CHECK(0 <= weekday && weekday <= 6);
973  }
974  if (cache_stamp()->IsSmi()) {
975  CHECK(Smi::ToInt(cache_stamp()) <=
976  Smi::ToInt(isolate->date_cache()->stamp()));
977  }
978 }
979 
980 void JSMessageObject::JSMessageObjectVerify(Isolate* isolate) {
981  CHECK(IsJSMessageObject());
982  VerifyObjectField(isolate, kStartPositionOffset);
983  VerifyObjectField(isolate, kEndPositionOffset);
984  VerifyObjectField(isolate, kArgumentsOffset);
985  VerifyObjectField(isolate, kScriptOffset);
986  VerifyObjectField(isolate, kStackFramesOffset);
987 }
988 
989 void String::StringVerify(Isolate* isolate) {
990  CHECK(IsString());
991  CHECK(length() >= 0 && length() <= Smi::kMaxValue);
992  CHECK_IMPLIES(length() == 0, *this == ReadOnlyRoots(isolate).empty_string());
993  if (IsInternalizedString()) {
994  CHECK(!Heap::InNewSpace(*this));
995  }
996  if (IsConsString()) {
997  ConsString::cast(*this)->ConsStringVerify(isolate);
998  } else if (IsSlicedString()) {
999  SlicedString::cast(*this)->SlicedStringVerify(isolate);
1000  } else if (IsThinString()) {
1001  ThinString::cast(*this)->ThinStringVerify(isolate);
1002  }
1003 }
1004 
1005 void ConsString::ConsStringVerify(Isolate* isolate) {
1006  CHECK(this->first()->IsString());
1007  CHECK(this->second() == ReadOnlyRoots(isolate).empty_string() ||
1008  this->second()->IsString());
1009  CHECK_GE(this->length(), ConsString::kMinLength);
1010  CHECK(this->length() == this->first()->length() + this->second()->length());
1011  if (this->IsFlat()) {
1012  // A flat cons can only be created by String::SlowFlatten.
1013  // Afterwards, the first part may be externalized or internalized.
1014  CHECK(this->first()->IsSeqString() || this->first()->IsExternalString() ||
1015  this->first()->IsThinString());
1016  }
1017 }
1018 
1019 void ThinString::ThinStringVerify(Isolate* isolate) {
1020  CHECK(this->actual()->IsInternalizedString());
1021  CHECK(this->actual()->IsSeqString() || this->actual()->IsExternalString());
1022 }
1023 
1024 void SlicedString::SlicedStringVerify(Isolate* isolate) {
1025  CHECK(!this->parent()->IsConsString());
1026  CHECK(!this->parent()->IsSlicedString());
1027  CHECK_GE(this->length(), SlicedString::kMinLength);
1028 }
1029 
1030 void JSBoundFunction::JSBoundFunctionVerify(Isolate* isolate) {
1031  CHECK(IsJSBoundFunction());
1032  JSObjectVerify(isolate);
1033  VerifyObjectField(isolate, kBoundThisOffset);
1034  VerifyObjectField(isolate, kBoundTargetFunctionOffset);
1035  VerifyObjectField(isolate, kBoundArgumentsOffset);
1036  CHECK(IsCallable());
1037 
1038  if (!raw_bound_target_function()->IsUndefined(isolate)) {
1039  CHECK(bound_target_function()->IsCallable());
1040  CHECK_EQ(IsConstructor(), bound_target_function()->IsConstructor());
1041  }
1042 }
1043 
1044 void JSFunction::JSFunctionVerify(Isolate* isolate) {
1045  CHECK(IsJSFunction());
1046  JSObjectVerify(isolate);
1047  VerifyHeapPointer(isolate, feedback_cell());
1048  CHECK(feedback_cell()->IsFeedbackCell());
1049  CHECK(code()->IsCode());
1050  CHECK(map()->is_callable());
1051  Handle<JSFunction> function(this, isolate);
1052  LookupIterator it(isolate, function, isolate->factory()->prototype_string(),
1053  LookupIterator::OWN_SKIP_INTERCEPTOR);
1054  if (has_prototype_slot()) {
1055  VerifyObjectField(isolate, kPrototypeOrInitialMapOffset);
1056  }
1057 
1058  if (has_prototype_property()) {
1059  CHECK(it.IsFound());
1060  CHECK_EQ(LookupIterator::ACCESSOR, it.state());
1061  CHECK(it.GetAccessors()->IsAccessorInfo());
1062  } else {
1063  CHECK(!it.IsFound() || it.state() != LookupIterator::ACCESSOR ||
1064  !it.GetAccessors()->IsAccessorInfo());
1065  }
1066 }
1067 
1068 void SharedFunctionInfo::SharedFunctionInfoVerify(Isolate* isolate) {
1069  CHECK(IsSharedFunctionInfo());
1070 
1071  VerifyObjectField(isolate, kFunctionDataOffset);
1072  VerifyObjectField(isolate, kOuterScopeInfoOrFeedbackMetadataOffset);
1073  VerifyObjectField(isolate, kScriptOrDebugInfoOffset);
1074  VerifyObjectField(isolate, kNameOrScopeInfoOffset);
1075 
1076  Object* value = name_or_scope_info();
1077  CHECK(value == kNoSharedNameSentinel || value->IsString() ||
1078  value->IsScopeInfo());
1079  if (value->IsScopeInfo()) {
1080  CHECK_LT(0, ScopeInfo::cast(value)->length());
1081  CHECK_NE(value, ReadOnlyRoots(isolate).empty_scope_info());
1082  }
1083 
1084  CHECK(HasWasmExportedFunctionData() || IsApiFunction() ||
1085  HasBytecodeArray() || HasAsmWasmData() || HasBuiltinId() ||
1086  HasUncompiledDataWithPreParsedScope() ||
1087  HasUncompiledDataWithoutPreParsedScope());
1088 
1089  CHECK(script_or_debug_info()->IsUndefined(isolate) ||
1090  script_or_debug_info()->IsScript() || HasDebugInfo());
1091 
1092  if (!is_compiled()) {
1093  CHECK(!HasFeedbackMetadata());
1094  CHECK(outer_scope_info()->IsScopeInfo() ||
1095  outer_scope_info()->IsTheHole(isolate));
1096  } else if (HasBytecodeArray()) {
1097  CHECK(HasFeedbackMetadata());
1098  CHECK(feedback_metadata()->IsFeedbackMetadata());
1099  }
1100 
1101  int expected_map_index = Context::FunctionMapIndex(
1102  language_mode(), kind(), true, HasSharedName(), needs_home_object());
1103  CHECK_EQ(expected_map_index, function_map_index());
1104 
1105  if (scope_info()->length() > 0) {
1106  ScopeInfo info = scope_info();
1107  CHECK(kind() == info->function_kind());
1108  CHECK_EQ(kind() == kModule, info->scope_type() == MODULE_SCOPE);
1109  }
1110 
1111  if (IsApiFunction()) {
1112  CHECK(construct_as_builtin());
1113  } else if (!HasBuiltinId()) {
1114  CHECK(!construct_as_builtin());
1115  } else {
1116  int id = builtin_id();
1117  if (id != Builtins::kCompileLazy && id != Builtins::kEmptyFunction) {
1118  CHECK(construct_as_builtin());
1119  } else {
1120  CHECK(!construct_as_builtin());
1121  }
1122  }
1123 }
1124 
1125 void JSGlobalProxy::JSGlobalProxyVerify(Isolate* isolate) {
1126  CHECK(IsJSGlobalProxy());
1127  JSObjectVerify(isolate);
1128  VerifyObjectField(isolate, JSGlobalProxy::kNativeContextOffset);
1129  CHECK(map()->is_access_check_needed());
1130  // Make sure that this object has no properties, elements.
1131  CHECK_EQ(0, FixedArray::cast(elements())->length());
1132 }
1133 
1134 void JSGlobalObject::JSGlobalObjectVerify(Isolate* isolate) {
1135  CHECK(IsJSGlobalObject());
1136  // Do not check the dummy global object for the builtins.
1137  if (global_dictionary()->NumberOfElements() == 0 &&
1138  elements()->length() == 0) {
1139  return;
1140  }
1141  JSObjectVerify(isolate);
1142 }
1143 
1144 void Oddball::OddballVerify(Isolate* isolate) {
1145  CHECK(IsOddball());
1146  Heap* heap = isolate->heap();
1147  VerifyHeapPointer(isolate, to_string());
1148  Object* number = to_number();
1149  if (number->IsHeapObject()) {
1150  CHECK(number == ReadOnlyRoots(heap).nan_value() ||
1151  number == ReadOnlyRoots(heap).hole_nan_value());
1152  } else {
1153  CHECK(number->IsSmi());
1154  int value = Smi::ToInt(number);
1155  // Hidden oddballs have negative smis.
1156  const int kLeastHiddenOddballNumber = -7;
1157  CHECK_LE(value, 1);
1158  CHECK_GE(value, kLeastHiddenOddballNumber);
1159  }
1160 
1161  ReadOnlyRoots roots(heap);
1162  if (map() == roots.undefined_map()) {
1163  CHECK(this == roots.undefined_value());
1164  } else if (map() == roots.the_hole_map()) {
1165  CHECK(this == roots.the_hole_value());
1166  } else if (map() == roots.null_map()) {
1167  CHECK(this == roots.null_value());
1168  } else if (map() == roots.boolean_map()) {
1169  CHECK(this == roots.true_value() || this == roots.false_value());
1170  } else if (map() == roots.uninitialized_map()) {
1171  CHECK(this == roots.uninitialized_value());
1172  } else if (map() == roots.arguments_marker_map()) {
1173  CHECK(this == roots.arguments_marker());
1174  } else if (map() == roots.termination_exception_map()) {
1175  CHECK(this == roots.termination_exception());
1176  } else if (map() == roots.exception_map()) {
1177  CHECK(this == roots.exception());
1178  } else if (map() == roots.optimized_out_map()) {
1179  CHECK(this == roots.optimized_out());
1180  } else if (map() == roots.stale_register_map()) {
1181  CHECK(this == roots.stale_register());
1182  } else if (map() == roots.self_reference_marker_map()) {
1183  // Multiple instances of this oddball may exist at once.
1184  CHECK_EQ(kind(), Oddball::kSelfReferenceMarker);
1185  } else {
1186  UNREACHABLE();
1187  }
1188 }
1189 
1190 void Cell::CellVerify(Isolate* isolate) {
1191  CHECK(IsCell());
1192  VerifyObjectField(isolate, kValueOffset);
1193 }
1194 
1195 void PropertyCell::PropertyCellVerify(Isolate* isolate) {
1196  CHECK(IsPropertyCell());
1197  VerifyObjectField(isolate, kValueOffset);
1198 }
1199 
1200 void CodeDataContainer::CodeDataContainerVerify(Isolate* isolate) {
1201  CHECK(IsCodeDataContainer());
1202  VerifyObjectField(isolate, kNextCodeLinkOffset);
1203  CHECK(next_code_link()->IsCode() || next_code_link()->IsUndefined(isolate));
1204 }
1205 
1206 void Code::CodeVerify(Isolate* isolate) {
1207  CHECK_LE(constant_pool_offset(), InstructionSize());
1208  CHECK(IsAligned(raw_instruction_start(), kCodeAlignment));
1209  relocation_info()->ObjectVerify(isolate);
1210  Address last_gc_pc = kNullAddress;
1211 
1212  for (RelocIterator it(*this); !it.done(); it.next()) {
1213  it.rinfo()->Verify(isolate);
1214  // Ensure that GC will not iterate twice over the same pointer.
1215  if (RelocInfo::IsGCRelocMode(it.rinfo()->rmode())) {
1216  CHECK(it.rinfo()->pc() != last_gc_pc);
1217  last_gc_pc = it.rinfo()->pc();
1218  }
1219  }
1220 }
1221 
1222 void JSArray::JSArrayVerify(Isolate* isolate) {
1223  JSObjectVerify(isolate);
1224  CHECK(length()->IsNumber() || length()->IsUndefined(isolate));
1225  // If a GC was caused while constructing this array, the elements
1226  // pointer may point to a one pointer filler map.
1227  if (!ElementsAreSafeToExamine()) return;
1228  if (elements()->IsUndefined(isolate)) return;
1229  CHECK(elements()->IsFixedArray() || elements()->IsFixedDoubleArray());
1230  if (elements()->length() == 0) {
1231  CHECK_EQ(elements(), ReadOnlyRoots(isolate).empty_fixed_array());
1232  }
1233  if (!length()->IsNumber()) return;
1234  // Verify that the length and the elements backing store are in sync.
1235  if (length()->IsSmi() && HasFastElements()) {
1236  if (elements()->length() > 0) {
1237  CHECK_IMPLIES(HasDoubleElements(), elements()->IsFixedDoubleArray());
1238  }
1239  int size = Smi::ToInt(length());
1240  // Holey / Packed backing stores might have slack or might have not been
1241  // properly initialized yet.
1242  CHECK(size <= elements()->length() ||
1243  elements() == ReadOnlyRoots(isolate).empty_fixed_array());
1244  } else {
1245  CHECK(HasDictionaryElements());
1246  uint32_t array_length;
1247  CHECK(length()->ToArrayLength(&array_length));
1248  if (array_length == 0xFFFFFFFF) {
1249  CHECK(length()->ToArrayLength(&array_length));
1250  }
1251  if (array_length != 0) {
1252  NumberDictionary dict = NumberDictionary::cast(elements());
1253  // The dictionary can never have more elements than the array length + 1.
1254  // If the backing store grows the verification might be triggered with
1255  // the old length in place.
1256  uint32_t nof_elements = static_cast<uint32_t>(dict->NumberOfElements());
1257  if (nof_elements != 0) nof_elements--;
1258  CHECK_LE(nof_elements, array_length);
1259  }
1260  }
1261 }
1262 
1263 void JSSet::JSSetVerify(Isolate* isolate) {
1264  CHECK(IsJSSet());
1265  JSObjectVerify(isolate);
1266  VerifyHeapPointer(isolate, table());
1267  CHECK(table()->IsOrderedHashSet() || table()->IsUndefined(isolate));
1268  // TODO(arv): Verify OrderedHashTable too.
1269 }
1270 
1271 void JSMap::JSMapVerify(Isolate* isolate) {
1272  CHECK(IsJSMap());
1273  JSObjectVerify(isolate);
1274  VerifyHeapPointer(isolate, table());
1275  CHECK(table()->IsOrderedHashMap() || table()->IsUndefined(isolate));
1276  // TODO(arv): Verify OrderedHashTable too.
1277 }
1278 
1279 void JSSetIterator::JSSetIteratorVerify(Isolate* isolate) {
1280  CHECK(IsJSSetIterator());
1281  JSObjectVerify(isolate);
1282  VerifyHeapPointer(isolate, table());
1283  CHECK(table()->IsOrderedHashSet());
1284  CHECK(index()->IsSmi());
1285 }
1286 
1287 void JSMapIterator::JSMapIteratorVerify(Isolate* isolate) {
1288  CHECK(IsJSMapIterator());
1289  JSObjectVerify(isolate);
1290  VerifyHeapPointer(isolate, table());
1291  CHECK(table()->IsOrderedHashMap());
1292  CHECK(index()->IsSmi());
1293 }
1294 
1295 void JSWeakCell::JSWeakCellVerify(Isolate* isolate) {
1296  CHECK(IsJSWeakCell());
1297  JSObjectVerify(isolate);
1298 
1299  CHECK(next()->IsJSWeakCell() || next()->IsUndefined(isolate));
1300  if (next()->IsJSWeakCell()) {
1301  CHECK_EQ(JSWeakCell::cast(next())->prev(), this);
1302  }
1303  CHECK(prev()->IsJSWeakCell() || prev()->IsUndefined(isolate));
1304  if (prev()->IsJSWeakCell()) {
1305  CHECK_EQ(JSWeakCell::cast(prev())->next(), this);
1306  }
1307 
1308  CHECK(factory()->IsUndefined(isolate) || factory()->IsJSWeakFactory());
1309 }
1310 
1311 void JSWeakFactory::JSWeakFactoryVerify(Isolate* isolate) {
1312  CHECK(IsJSWeakFactory());
1313  JSObjectVerify(isolate);
1314  VerifyHeapPointer(isolate, cleanup());
1315  CHECK(active_cells()->IsUndefined(isolate) || active_cells()->IsJSWeakCell());
1316  if (active_cells()->IsJSWeakCell()) {
1317  CHECK(JSWeakCell::cast(active_cells())->prev()->IsUndefined(isolate));
1318  }
1319  CHECK(cleared_cells()->IsUndefined(isolate) ||
1320  cleared_cells()->IsJSWeakCell());
1321  if (cleared_cells()->IsJSWeakCell()) {
1322  CHECK(JSWeakCell::cast(cleared_cells())->prev()->IsUndefined(isolate));
1323  }
1324 }
1325 
1326 void JSWeakFactoryCleanupIterator::JSWeakFactoryCleanupIteratorVerify(
1327  Isolate* isolate) {
1328  CHECK(IsJSWeakFactoryCleanupIterator());
1329  JSObjectVerify(isolate);
1330  VerifyHeapPointer(isolate, factory());
1331 }
1332 
1333 void WeakFactoryCleanupJobTask::WeakFactoryCleanupJobTaskVerify(
1334  Isolate* isolate) {
1335  CHECK(IsWeakFactoryCleanupJobTask());
1336  CHECK(factory()->IsJSWeakFactory());
1337 }
1338 
1339 void JSWeakMap::JSWeakMapVerify(Isolate* isolate) {
1340  CHECK(IsJSWeakMap());
1341  JSObjectVerify(isolate);
1342  VerifyHeapPointer(isolate, table());
1343  CHECK(table()->IsEphemeronHashTable() || table()->IsUndefined(isolate));
1344 }
1345 
1346 void JSArrayIterator::JSArrayIteratorVerify(Isolate* isolate) {
1347  CHECK(IsJSArrayIterator());
1348  JSObjectVerify(isolate);
1349  CHECK(iterated_object()->IsJSReceiver());
1350 
1351  CHECK_GE(next_index()->Number(), 0);
1352  CHECK_LE(next_index()->Number(), kMaxSafeInteger);
1353 
1354  if (iterated_object()->IsJSTypedArray()) {
1355  // JSTypedArray::length is limited to Smi range.
1356  CHECK(next_index()->IsSmi());
1357  CHECK_LE(next_index()->Number(), Smi::kMaxValue);
1358  } else if (iterated_object()->IsJSArray()) {
1359  // JSArray::length is limited to Uint32 range.
1360  CHECK_LE(next_index()->Number(), kMaxUInt32);
1361  }
1362 }
1363 
1364 void JSStringIterator::JSStringIteratorVerify(Isolate* isolate) {
1365  CHECK(IsJSStringIterator());
1366  JSObjectVerify(isolate);
1367  CHECK(string()->IsString());
1368 
1369  CHECK_GE(index(), 0);
1370  CHECK_LE(index(), String::kMaxLength);
1371 }
1372 
1373 void JSAsyncFromSyncIterator::JSAsyncFromSyncIteratorVerify(Isolate* isolate) {
1374  CHECK(IsJSAsyncFromSyncIterator());
1375  JSObjectVerify(isolate);
1376  VerifyHeapPointer(isolate, sync_iterator());
1377 }
1378 
1379 void JSWeakSet::JSWeakSetVerify(Isolate* isolate) {
1380  CHECK(IsJSWeakSet());
1381  JSObjectVerify(isolate);
1382  VerifyHeapPointer(isolate, table());
1383  CHECK(table()->IsEphemeronHashTable() || table()->IsUndefined(isolate));
1384 }
1385 
1386 void Microtask::MicrotaskVerify(Isolate* isolate) { CHECK(IsMicrotask()); }
1387 
1388 void CallableTask::CallableTaskVerify(Isolate* isolate) {
1389  CHECK(IsCallableTask());
1390  MicrotaskVerify(isolate);
1391  VerifyHeapPointer(isolate, callable());
1392  CHECK(callable()->IsCallable());
1393  VerifyHeapPointer(isolate, context());
1394  CHECK(context()->IsContext());
1395 }
1396 
1397 void CallbackTask::CallbackTaskVerify(Isolate* isolate) {
1398  CHECK(IsCallbackTask());
1399  MicrotaskVerify(isolate);
1400  VerifyHeapPointer(isolate, callback());
1401  VerifyHeapPointer(isolate, data());
1402 }
1403 
1404 void PromiseReactionJobTask::PromiseReactionJobTaskVerify(Isolate* isolate) {
1405  CHECK(IsPromiseReactionJobTask());
1406  MicrotaskVerify(isolate);
1407  VerifyPointer(isolate, argument());
1408  VerifyHeapPointer(isolate, context());
1409  CHECK(context()->IsContext());
1410  VerifyHeapPointer(isolate, handler());
1411  CHECK(handler()->IsUndefined(isolate) || handler()->IsCallable());
1412  VerifyHeapPointer(isolate, promise_or_capability());
1413  CHECK(promise_or_capability()->IsJSPromise() ||
1414  promise_or_capability()->IsPromiseCapability() ||
1415  promise_or_capability()->IsUndefined(isolate));
1416 }
1417 
1418 void PromiseFulfillReactionJobTask::PromiseFulfillReactionJobTaskVerify(
1419  Isolate* isolate) {
1420  CHECK(IsPromiseFulfillReactionJobTask());
1421  PromiseReactionJobTaskVerify(isolate);
1422 }
1423 
1424 void PromiseRejectReactionJobTask::PromiseRejectReactionJobTaskVerify(
1425  Isolate* isolate) {
1426  CHECK(IsPromiseRejectReactionJobTask());
1427  PromiseReactionJobTaskVerify(isolate);
1428 }
1429 
1430 void PromiseResolveThenableJobTask::PromiseResolveThenableJobTaskVerify(
1431  Isolate* isolate) {
1432  CHECK(IsPromiseResolveThenableJobTask());
1433  MicrotaskVerify(isolate);
1434  VerifyHeapPointer(isolate, context());
1435  CHECK(context()->IsContext());
1436  VerifyHeapPointer(isolate, promise_to_resolve());
1437  CHECK(promise_to_resolve()->IsJSPromise());
1438  VerifyHeapPointer(isolate, then());
1439  CHECK(then()->IsCallable());
1440  CHECK(then()->IsJSReceiver());
1441  VerifyHeapPointer(isolate, thenable());
1442  CHECK(thenable()->IsJSReceiver());
1443 }
1444 
1445 void PromiseCapability::PromiseCapabilityVerify(Isolate* isolate) {
1446  CHECK(IsPromiseCapability());
1447 
1448  VerifyHeapPointer(isolate, promise());
1449  CHECK(promise()->IsJSReceiver() || promise()->IsUndefined(isolate));
1450  VerifyPointer(isolate, resolve());
1451  VerifyPointer(isolate, reject());
1452 }
1453 
1454 void PromiseReaction::PromiseReactionVerify(Isolate* isolate) {
1455  CHECK(IsPromiseReaction());
1456 
1457  VerifyPointer(isolate, next());
1458  CHECK(next()->IsSmi() || next()->IsPromiseReaction());
1459  VerifyHeapPointer(isolate, reject_handler());
1460  CHECK(reject_handler()->IsUndefined(isolate) ||
1461  reject_handler()->IsCallable());
1462  VerifyHeapPointer(isolate, fulfill_handler());
1463  CHECK(fulfill_handler()->IsUndefined(isolate) ||
1464  fulfill_handler()->IsCallable());
1465  VerifyHeapPointer(isolate, promise_or_capability());
1466  CHECK(promise_or_capability()->IsJSPromise() ||
1467  promise_or_capability()->IsPromiseCapability() ||
1468  promise_or_capability()->IsUndefined(isolate));
1469 }
1470 
1471 void JSPromise::JSPromiseVerify(Isolate* isolate) {
1472  CHECK(IsJSPromise());
1473  JSObjectVerify(isolate);
1474  VerifyPointer(isolate, reactions_or_result());
1475  VerifySmiField(kFlagsOffset);
1476  if (status() == Promise::kPending) {
1477  CHECK(reactions()->IsSmi() || reactions()->IsPromiseReaction());
1478  }
1479 }
1480 
1481 template <typename Derived>
1482 void SmallOrderedHashTable<Derived>::SmallOrderedHashTableVerify(
1483  Isolate* isolate) {
1484  CHECK(IsSmallOrderedHashTable());
1485 
1486  int capacity = Capacity();
1487  CHECK_GE(capacity, kMinCapacity);
1488  CHECK_LE(capacity, kMaxCapacity);
1489 
1490  for (int entry = 0; entry < NumberOfBuckets(); entry++) {
1491  int bucket = GetFirstEntry(entry);
1492  if (bucket == kNotFound) continue;
1493  CHECK_GE(bucket, 0);
1494  CHECK_LE(bucket, capacity);
1495  }
1496 
1497  for (int entry = 0; entry < NumberOfElements(); entry++) {
1498  int chain = GetNextEntry(entry);
1499  if (chain == kNotFound) continue;
1500  CHECK_GE(chain, 0);
1501  CHECK_LE(chain, capacity);
1502  }
1503 
1504  for (int entry = 0; entry < NumberOfElements(); entry++) {
1505  for (int offset = 0; offset < Derived::kEntrySize; offset++) {
1506  Object* val = GetDataEntry(entry, offset);
1507  VerifyPointer(isolate, val);
1508  }
1509  }
1510 
1511  for (int entry = NumberOfElements(); entry < NumberOfDeletedElements();
1512  entry++) {
1513  for (int offset = 0; offset < Derived::kEntrySize; offset++) {
1514  Object* val = GetDataEntry(entry, offset);
1515  CHECK(val->IsTheHole(isolate));
1516  }
1517  }
1518 
1519  for (int entry = NumberOfElements() + NumberOfDeletedElements();
1520  entry < Capacity(); entry++) {
1521  for (int offset = 0; offset < Derived::kEntrySize; offset++) {
1522  Object* val = GetDataEntry(entry, offset);
1523  CHECK(val->IsTheHole(isolate));
1524  }
1525  }
1526 }
1527 
1528 template void SmallOrderedHashTable<
1529  SmallOrderedHashMap>::SmallOrderedHashTableVerify(Isolate* isolate);
1530 template void SmallOrderedHashTable<
1531  SmallOrderedHashSet>::SmallOrderedHashTableVerify(Isolate* isolate);
1532 template void SmallOrderedHashTable<
1533  SmallOrderedNameDictionary>::SmallOrderedHashTableVerify(Isolate* isolate);
1534 
1535 void JSRegExp::JSRegExpVerify(Isolate* isolate) {
1536  JSObjectVerify(isolate);
1537  CHECK(data()->IsUndefined(isolate) || data()->IsFixedArray());
1538  switch (TypeTag()) {
1539  case JSRegExp::ATOM: {
1540  FixedArray arr = FixedArray::cast(data());
1541  CHECK(arr->get(JSRegExp::kAtomPatternIndex)->IsString());
1542  break;
1543  }
1544  case JSRegExp::IRREGEXP: {
1545  bool is_native = RegExpImpl::UsesNativeRegExp();
1546 
1547  FixedArray arr = FixedArray::cast(data());
1548  Object* one_byte_data = arr->get(JSRegExp::kIrregexpLatin1CodeIndex);
1549  // Smi : Not compiled yet (-1).
1550  // Code/ByteArray: Compiled code.
1551  CHECK(
1552  (one_byte_data->IsSmi() &&
1553  Smi::ToInt(one_byte_data) == JSRegExp::kUninitializedValue) ||
1554  (is_native ? one_byte_data->IsCode() : one_byte_data->IsByteArray()));
1555  Object* uc16_data = arr->get(JSRegExp::kIrregexpUC16CodeIndex);
1556  CHECK((uc16_data->IsSmi() &&
1557  Smi::ToInt(uc16_data) == JSRegExp::kUninitializedValue) ||
1558  (is_native ? uc16_data->IsCode() : uc16_data->IsByteArray()));
1559 
1560  CHECK(arr->get(JSRegExp::kIrregexpCaptureCountIndex)->IsSmi());
1561  CHECK(arr->get(JSRegExp::kIrregexpMaxRegisterCountIndex)->IsSmi());
1562  break;
1563  }
1564  default:
1565  CHECK_EQ(JSRegExp::NOT_COMPILED, TypeTag());
1566  CHECK(data()->IsUndefined(isolate));
1567  break;
1568  }
1569 }
1570 
1571 void JSRegExpStringIterator::JSRegExpStringIteratorVerify(Isolate* isolate) {
1572  CHECK(IsJSRegExpStringIterator());
1573  JSObjectVerify(isolate);
1574  CHECK(iterating_string()->IsString());
1575  CHECK(iterating_regexp()->IsObject());
1576  VerifySmiField(kFlagsOffset);
1577 }
1578 
1579 void JSProxy::JSProxyVerify(Isolate* isolate) {
1580  CHECK(IsJSProxy());
1581  CHECK(map()->GetConstructor()->IsJSFunction());
1582  VerifyPointer(isolate, target());
1583  VerifyPointer(isolate, handler());
1584  if (!IsRevoked()) {
1585  CHECK_EQ(target()->IsCallable(), map()->is_callable());
1586  CHECK_EQ(target()->IsConstructor(), map()->is_constructor());
1587  }
1588  CHECK(map()->prototype()->IsNull(isolate));
1589  // There should be no properties on a Proxy.
1590  CHECK_EQ(0, map()->NumberOfOwnDescriptors());
1591 }
1592 
1593 void JSArrayBuffer::JSArrayBufferVerify(Isolate* isolate) {
1594  CHECK(IsJSArrayBuffer());
1595  if (FIELD_SIZE(kOptionalPaddingOffset)) {
1596  CHECK_EQ(4, FIELD_SIZE(kOptionalPaddingOffset));
1597  CHECK_EQ(0,
1598  *reinterpret_cast<uint32_t*>(address() + kOptionalPaddingOffset));
1599  }
1600  JSObjectVerify(isolate);
1601 }
1602 
1603 void JSArrayBufferView::JSArrayBufferViewVerify(Isolate* isolate) {
1604  CHECK(IsJSArrayBufferView());
1605  JSObjectVerify(isolate);
1606  VerifyPointer(isolate, buffer());
1607  CHECK(buffer()->IsJSArrayBuffer() || buffer()->IsUndefined(isolate) ||
1608  buffer() == Smi::kZero);
1609  CHECK_LE(byte_length(), JSArrayBuffer::kMaxByteLength);
1610  CHECK_LE(byte_offset(), JSArrayBuffer::kMaxByteLength);
1611 }
1612 
1613 void JSTypedArray::JSTypedArrayVerify(Isolate* isolate) {
1614  CHECK(IsJSTypedArray());
1615  JSArrayBufferViewVerify(isolate);
1616  VerifyPointer(isolate, raw_length());
1617  CHECK(raw_length()->IsSmi() || raw_length()->IsUndefined(isolate));
1618  VerifyPointer(isolate, elements());
1619 }
1620 
1621 void JSDataView::JSDataViewVerify(Isolate* isolate) {
1622  CHECK(IsJSDataView());
1623  JSArrayBufferViewVerify(isolate);
1624 }
1625 
1626 void Foreign::ForeignVerify(Isolate* isolate) { CHECK(IsForeign()); }
1627 
1628 void AsyncGeneratorRequest::AsyncGeneratorRequestVerify(Isolate* isolate) {
1629  CHECK(IsAsyncGeneratorRequest());
1630  VerifySmiField(kResumeModeOffset);
1631  CHECK_GE(resume_mode(), JSGeneratorObject::kNext);
1632  CHECK_LE(resume_mode(), JSGeneratorObject::kThrow);
1633  CHECK(promise()->IsJSPromise());
1634  VerifyPointer(isolate, value());
1635  VerifyPointer(isolate, next());
1636  next()->ObjectVerify(isolate);
1637 }
1638 
1639 void BigInt::BigIntVerify(Isolate* isolate) {
1640  CHECK(IsBigInt());
1641  CHECK_GE(length(), 0);
1642  CHECK_IMPLIES(is_zero(), !sign()); // There is no -0n.
1643 }
1644 
1645 void JSModuleNamespace::JSModuleNamespaceVerify(Isolate* isolate) {
1646  CHECK(IsJSModuleNamespace());
1647  VerifyPointer(isolate, module());
1648 }
1649 
1650 void ModuleInfoEntry::ModuleInfoEntryVerify(Isolate* isolate) {
1651  CHECK(IsModuleInfoEntry());
1652 
1653  CHECK(export_name()->IsUndefined(isolate) || export_name()->IsString());
1654  CHECK(local_name()->IsUndefined(isolate) || local_name()->IsString());
1655  CHECK(import_name()->IsUndefined(isolate) || import_name()->IsString());
1656 
1657  VerifySmiField(kModuleRequestOffset);
1658  VerifySmiField(kCellIndexOffset);
1659  VerifySmiField(kBegPosOffset);
1660  VerifySmiField(kEndPosOffset);
1661 
1662  CHECK_IMPLIES(import_name()->IsString(), module_request() >= 0);
1663  CHECK_IMPLIES(export_name()->IsString() && import_name()->IsString(),
1664  local_name()->IsUndefined(isolate));
1665 }
1666 
1667 void Module::ModuleVerify(Isolate* isolate) {
1668  CHECK(IsModule());
1669 
1670  VerifyPointer(isolate, code());
1671  VerifyPointer(isolate, exports());
1672  VerifyPointer(isolate, module_namespace());
1673  VerifyPointer(isolate, requested_modules());
1674  VerifyPointer(isolate, script());
1675  VerifyPointer(isolate, import_meta());
1676  VerifyPointer(isolate, exception());
1677  VerifySmiField(kHashOffset);
1678  VerifySmiField(kStatusOffset);
1679 
1680  CHECK((status() >= kEvaluating && code()->IsModuleInfo()) ||
1681  (status() == kInstantiated && code()->IsJSGeneratorObject()) ||
1682  (status() == kInstantiating && code()->IsJSFunction()) ||
1683  (code()->IsSharedFunctionInfo()));
1684 
1685  CHECK_EQ(status() == kErrored, !exception()->IsTheHole(isolate));
1686 
1687  CHECK(module_namespace()->IsUndefined(isolate) ||
1688  module_namespace()->IsJSModuleNamespace());
1689  if (module_namespace()->IsJSModuleNamespace()) {
1690  CHECK_LE(kInstantiating, status());
1691  CHECK_EQ(JSModuleNamespace::cast(module_namespace())->module(), this);
1692  }
1693 
1694  CHECK_EQ(requested_modules()->length(), info()->module_requests()->length());
1695 
1696  CHECK(import_meta()->IsTheHole(isolate) || import_meta()->IsJSObject());
1697 
1698  CHECK_NE(hash(), 0);
1699 }
1700 
1701 void PrototypeInfo::PrototypeInfoVerify(Isolate* isolate) {
1702  CHECK(IsPrototypeInfo());
1703  Object* module_ns = module_namespace();
1704  CHECK(module_ns->IsJSModuleNamespace() || module_ns->IsUndefined(isolate));
1705  if (prototype_users()->IsWeakArrayList()) {
1706  PrototypeUsers::Verify(WeakArrayList::cast(prototype_users()));
1707  } else {
1708  CHECK(prototype_users()->IsSmi());
1709  }
1710 }
1711 
1712 void PrototypeUsers::Verify(WeakArrayList* array) {
1713  if (array->length() == 0) {
1714  // Allow empty & uninitialized lists.
1715  return;
1716  }
1717  // Verify empty slot chain.
1718  int empty_slot = Smi::ToInt(empty_slot_index(array));
1719  int empty_slots_count = 0;
1720  while (empty_slot != kNoEmptySlotsMarker) {
1721  CHECK_GT(empty_slot, 0);
1722  CHECK_LT(empty_slot, array->length());
1723  empty_slot = array->Get(empty_slot).ToSmi().value();
1724  ++empty_slots_count;
1725  }
1726 
1727  // Verify that all elements are either weak pointers or SMIs marking empty
1728  // slots.
1729  int weak_maps_count = 0;
1730  for (int i = kFirstIndex; i < array->length(); ++i) {
1731  HeapObject* heap_object;
1732  MaybeObject object = array->Get(i);
1733  if ((object->GetHeapObjectIfWeak(&heap_object) && heap_object->IsMap()) ||
1734  object->IsCleared()) {
1735  ++weak_maps_count;
1736  } else {
1737  CHECK(object->IsSmi());
1738  }
1739  }
1740 
1741  CHECK_EQ(weak_maps_count + empty_slots_count + 1, array->length());
1742 }
1743 
1744 void Tuple2::Tuple2Verify(Isolate* isolate) {
1745  CHECK(IsTuple2());
1746  Heap* heap = isolate->heap();
1747  if (this == ReadOnlyRoots(heap).empty_enum_cache()) {
1748  CHECK_EQ(ReadOnlyRoots(heap).empty_fixed_array(),
1749  EnumCache::cast(this)->keys());
1750  CHECK_EQ(ReadOnlyRoots(heap).empty_fixed_array(),
1751  EnumCache::cast(this)->indices());
1752  } else {
1753  VerifyObjectField(isolate, kValue1Offset);
1754  VerifyObjectField(isolate, kValue2Offset);
1755  }
1756 }
1757 
1758 void Tuple3::Tuple3Verify(Isolate* isolate) {
1759  CHECK(IsTuple3());
1760  VerifyObjectField(isolate, kValue1Offset);
1761  VerifyObjectField(isolate, kValue2Offset);
1762  VerifyObjectField(isolate, kValue3Offset);
1763 }
1764 
1765 void ObjectBoilerplateDescription::ObjectBoilerplateDescriptionVerify(
1766  Isolate* isolate) {
1767  CHECK(IsObjectBoilerplateDescription());
1768  CHECK_GE(this->length(),
1769  ObjectBoilerplateDescription::kDescriptionStartIndex);
1770  this->FixedArrayVerify(isolate);
1771 }
1772 
1773 void ArrayBoilerplateDescription::ArrayBoilerplateDescriptionVerify(
1774  Isolate* isolate) {
1775  CHECK(IsArrayBoilerplateDescription());
1776  CHECK(constant_elements()->IsFixedArrayBase());
1777  VerifyObjectField(isolate, kConstantElementsOffset);
1778 }
1779 
1780 void AsmWasmData::AsmWasmDataVerify(Isolate* isolate) {
1781  CHECK(IsAsmWasmData());
1782  VerifyObjectField(isolate, kManagedNativeModuleOffset);
1783  VerifyObjectField(isolate, kExportWrappersOffset);
1784  VerifyObjectField(isolate, kAsmJsOffsetTableOffset);
1785  CHECK(uses_bitset()->IsHeapNumber());
1786  VerifyObjectField(isolate, kUsesBitsetOffset);
1787 }
1788 
1789 void WasmDebugInfo::WasmDebugInfoVerify(Isolate* isolate) {
1790  CHECK(IsWasmDebugInfo());
1791  VerifyObjectField(isolate, kInstanceOffset);
1792  CHECK(wasm_instance()->IsWasmInstanceObject());
1793  VerifyObjectField(isolate, kInterpreterHandleOffset);
1794  CHECK(interpreter_handle()->IsUndefined(isolate) ||
1795  interpreter_handle()->IsForeign());
1796  VerifyObjectField(isolate, kInterpretedFunctionsOffset);
1797  VerifyObjectField(isolate, kLocalsNamesOffset);
1798  VerifyObjectField(isolate, kCWasmEntriesOffset);
1799  VerifyObjectField(isolate, kCWasmEntryMapOffset);
1800 }
1801 
1802 void WasmInstanceObject::WasmInstanceObjectVerify(Isolate* isolate) {
1803  JSObjectVerify(isolate);
1804  CHECK(IsWasmInstanceObject());
1805 
1806  // Just generically check all tagged fields. Don't check the untagged fields,
1807  // as some of them might still contain the "undefined" value if the
1808  // WasmInstanceObject is not fully set up yet.
1809  for (int offset = kHeaderSize; offset < kFirstUntaggedOffset;
1810  offset += kPointerSize) {
1811  VerifyObjectField(isolate, offset);
1812  }
1813 }
1814 
1815 void WasmExportedFunctionData::WasmExportedFunctionDataVerify(
1816  Isolate* isolate) {
1817  CHECK(IsWasmExportedFunctionData());
1818  VerifyObjectField(isolate, kWrapperCodeOffset);
1819  CHECK(wrapper_code()->kind() == Code::JS_TO_WASM_FUNCTION ||
1820  wrapper_code()->kind() == Code::C_WASM_ENTRY);
1821  VerifyObjectField(isolate, kInstanceOffset);
1822  VerifySmiField(kJumpTableOffsetOffset);
1823  VerifySmiField(kFunctionIndexOffset);
1824 }
1825 
1826 void WasmModuleObject::WasmModuleObjectVerify(Isolate* isolate) {
1827  CHECK(IsWasmModuleObject());
1828  VerifyObjectField(isolate, kNativeModuleOffset);
1829  CHECK(managed_native_module()->IsForeign());
1830  VerifyObjectField(isolate, kExportWrappersOffset);
1831  CHECK(export_wrappers()->IsFixedArray());
1832  VerifyObjectField(isolate, kScriptOffset);
1833  VerifyObjectField(isolate, kAsmJsOffsetTableOffset);
1834  VerifyObjectField(isolate, kBreakPointInfosOffset);
1835 }
1836 
1837 void DataHandler::DataHandlerVerify(Isolate* isolate) {
1838  CHECK(IsDataHandler());
1839  CHECK_IMPLIES(!smi_handler()->IsSmi(),
1840  smi_handler()->IsCode() && IsStoreHandler());
1841  CHECK(validity_cell()->IsSmi() || validity_cell()->IsCell());
1842  int data_count = data_field_count();
1843  if (data_count >= 1) {
1844  VerifyMaybeObjectField(isolate, kData1Offset);
1845  }
1846  if (data_count >= 2) {
1847  VerifyMaybeObjectField(isolate, kData2Offset);
1848  }
1849  if (data_count >= 3) {
1850  VerifyMaybeObjectField(isolate, kData3Offset);
1851  }
1852 }
1853 
1854 void LoadHandler::LoadHandlerVerify(Isolate* isolate) {
1855  DataHandler::DataHandlerVerify(isolate);
1856  // TODO(ishell): check handler integrity
1857 }
1858 
1859 void StoreHandler::StoreHandlerVerify(Isolate* isolate) {
1860  DataHandler::DataHandlerVerify(isolate);
1861  // TODO(ishell): check handler integrity
1862 }
1863 
1864 void AccessorInfo::AccessorInfoVerify(Isolate* isolate) {
1865  CHECK(IsAccessorInfo());
1866  VerifyPointer(isolate, name());
1867  VerifyPointer(isolate, expected_receiver_type());
1868  VerifyForeignPointer(isolate, this, getter());
1869  VerifyForeignPointer(isolate, this, setter());
1870  VerifyForeignPointer(isolate, this, js_getter());
1871  VerifyPointer(isolate, data());
1872 }
1873 
1874 void AccessorPair::AccessorPairVerify(Isolate* isolate) {
1875  CHECK(IsAccessorPair());
1876  VerifyPointer(isolate, getter());
1877  VerifyPointer(isolate, setter());
1878 }
1879 
1880 void AccessCheckInfo::AccessCheckInfoVerify(Isolate* isolate) {
1881  CHECK(IsAccessCheckInfo());
1882  VerifyPointer(isolate, callback());
1883  VerifyPointer(isolate, named_interceptor());
1884  VerifyPointer(isolate, indexed_interceptor());
1885  VerifyPointer(isolate, data());
1886 }
1887 
1888 void CallHandlerInfo::CallHandlerInfoVerify(Isolate* isolate) {
1889  CHECK(IsCallHandlerInfo());
1890  CHECK(map() == ReadOnlyRoots(isolate).side_effect_call_handler_info_map() ||
1891  map() ==
1892  ReadOnlyRoots(isolate).side_effect_free_call_handler_info_map() ||
1893  map() == ReadOnlyRoots(isolate)
1894  .next_call_side_effect_free_call_handler_info_map());
1895  VerifyPointer(isolate, callback());
1896  VerifyPointer(isolate, js_callback());
1897  VerifyPointer(isolate, data());
1898 }
1899 
1900 void InterceptorInfo::InterceptorInfoVerify(Isolate* isolate) {
1901  CHECK(IsInterceptorInfo());
1902  VerifyForeignPointer(isolate, this, getter());
1903  VerifyForeignPointer(isolate, this, setter());
1904  VerifyForeignPointer(isolate, this, query());
1905  VerifyForeignPointer(isolate, this, deleter());
1906  VerifyForeignPointer(isolate, this, enumerator());
1907  VerifyPointer(isolate, data());
1908  VerifySmiField(kFlagsOffset);
1909 }
1910 
1911 void TemplateInfo::TemplateInfoVerify(Isolate* isolate) {
1912  VerifyPointer(isolate, tag());
1913  VerifyPointer(isolate, property_list());
1914  VerifyPointer(isolate, property_accessors());
1915 }
1916 
1917 void FunctionTemplateInfo::FunctionTemplateInfoVerify(Isolate* isolate) {
1918  CHECK(IsFunctionTemplateInfo());
1919  TemplateInfoVerify(isolate);
1920  VerifyPointer(isolate, serial_number());
1921  VerifyPointer(isolate, call_code());
1922  VerifyPointer(isolate, signature());
1923  VerifyPointer(isolate, cached_property_name());
1924  VerifyPointer(isolate, rare_data());
1925 }
1926 
1927 void FunctionTemplateRareData::FunctionTemplateRareDataVerify(
1928  Isolate* isolate) {
1929  CHECK(IsFunctionTemplateRareData());
1930  VerifyPointer(isolate, prototype_template());
1931  VerifyPointer(isolate, parent_template());
1932  VerifyPointer(isolate, named_property_handler());
1933  VerifyPointer(isolate, indexed_property_handler());
1934  VerifyPointer(isolate, instance_template());
1935  VerifyPointer(isolate, access_check_info());
1936 }
1937 
1938 void ObjectTemplateInfo::ObjectTemplateInfoVerify(Isolate* isolate) {
1939  CHECK(IsObjectTemplateInfo());
1940  TemplateInfoVerify(isolate);
1941  VerifyPointer(isolate, constructor());
1942  VerifyPointer(isolate, data());
1943 }
1944 
1945 void AllocationSite::AllocationSiteVerify(Isolate* isolate) {
1946  CHECK(IsAllocationSite());
1947 }
1948 
1949 void AllocationMemento::AllocationMementoVerify(Isolate* isolate) {
1950  CHECK(IsAllocationMemento());
1951  VerifyHeapPointer(isolate, allocation_site());
1952  CHECK(!IsValid() || GetAllocationSite()->IsAllocationSite());
1953 }
1954 
1955 void Script::ScriptVerify(Isolate* isolate) {
1956  CHECK(IsScript());
1957  VerifyPointer(isolate, source());
1958  VerifyPointer(isolate, name());
1959  VerifyPointer(isolate, line_ends());
1960  for (int i = 0; i < shared_function_infos()->length(); ++i) {
1961  MaybeObject maybe_object = shared_function_infos()->Get(i);
1962  HeapObject* heap_object;
1963  CHECK(maybe_object->IsWeak() || maybe_object->IsCleared() ||
1964  (maybe_object->GetHeapObjectIfStrong(&heap_object) &&
1965  heap_object->IsUndefined(isolate)));
1966  }
1967 }
1968 
1969 void NormalizedMapCache::NormalizedMapCacheVerify(Isolate* isolate) {
1970  WeakFixedArray::cast(this)->WeakFixedArrayVerify(isolate);
1971  if (FLAG_enable_slow_asserts) {
1972  for (int i = 0; i < length(); i++) {
1973  MaybeObject e = WeakFixedArray::Get(i);
1974  HeapObject* heap_object;
1975  if (e->GetHeapObjectIfWeak(&heap_object)) {
1976  Map::cast(heap_object)->DictionaryMapVerify(isolate);
1977  } else {
1978  CHECK(e->IsCleared() || (e->GetHeapObjectIfStrong(&heap_object) &&
1979  heap_object->IsUndefined(isolate)));
1980  }
1981  }
1982  }
1983 }
1984 
1985 void DebugInfo::DebugInfoVerify(Isolate* isolate) {
1986  CHECK(IsDebugInfo());
1987  VerifyPointer(isolate, shared());
1988  VerifyPointer(isolate, script());
1989  VerifyPointer(isolate, original_bytecode_array());
1990  VerifyPointer(isolate, break_points());
1991 }
1992 
1993 void StackFrameInfo::StackFrameInfoVerify(Isolate* isolate) {
1994  CHECK(IsStackFrameInfo());
1995  VerifyPointer(isolate, script_name());
1996  VerifyPointer(isolate, script_name_or_source_url());
1997  VerifyPointer(isolate, function_name());
1998 }
1999 
2000 void PreParsedScopeData::PreParsedScopeDataVerify(Isolate* isolate) {
2001  CHECK(IsPreParsedScopeData());
2002  CHECK(scope_data()->IsByteArray());
2003  CHECK_GE(length(), 0);
2004 
2005  for (int i = 0; i < length(); ++i) {
2006  Object* child = child_data(i);
2007  CHECK(child->IsPreParsedScopeData() || child->IsNull());
2008  VerifyPointer(isolate, child);
2009  }
2010 }
2011 
2012 void UncompiledDataWithPreParsedScope::UncompiledDataWithPreParsedScopeVerify(
2013  Isolate* isolate) {
2014  CHECK(IsUncompiledDataWithPreParsedScope());
2015  VerifyPointer(isolate, inferred_name());
2016  VerifyPointer(isolate, pre_parsed_scope_data());
2017 }
2018 
2019 void UncompiledDataWithoutPreParsedScope::
2020  UncompiledDataWithoutPreParsedScopeVerify(Isolate* isolate) {
2021  CHECK(IsUncompiledDataWithoutPreParsedScope());
2022  VerifyPointer(isolate, inferred_name());
2023 }
2024 
2025 void InterpreterData::InterpreterDataVerify(Isolate* isolate) {
2026  CHECK(IsInterpreterData());
2027  CHECK(bytecode_array()->IsBytecodeArray());
2028  CHECK(interpreter_trampoline()->IsCode());
2029 }
2030 
2031 #ifdef V8_INTL_SUPPORT
2032 void JSV8BreakIterator::JSV8BreakIteratorVerify(Isolate* isolate) {
2033  JSObjectVerify(isolate);
2034  VerifyObjectField(isolate, kLocaleOffset);
2035  VerifyObjectField(isolate, kTypeOffset);
2036  VerifyObjectField(isolate, kBreakIteratorOffset);
2037  VerifyObjectField(isolate, kUnicodeStringOffset);
2038  VerifyObjectField(isolate, kBoundAdoptTextOffset);
2039  VerifyObjectField(isolate, kBoundFirstOffset);
2040  VerifyObjectField(isolate, kBoundNextOffset);
2041  VerifyObjectField(isolate, kBoundCurrentOffset);
2042  VerifyObjectField(isolate, kBoundBreakTypeOffset);
2043 }
2044 
2045 void JSCollator::JSCollatorVerify(Isolate* isolate) {
2046  CHECK(IsJSCollator());
2047  JSObjectVerify(isolate);
2048  VerifyObjectField(isolate, kICUCollatorOffset);
2049  VerifyObjectField(isolate, kBoundCompareOffset);
2050 }
2051 
2052 void JSDateTimeFormat::JSDateTimeFormatVerify(Isolate* isolate) {
2053  JSObjectVerify(isolate);
2054  VerifyObjectField(isolate, kICULocaleOffset);
2055  VerifyObjectField(isolate, kICUSimpleDateFormatOffset);
2056  VerifyObjectField(isolate, kBoundFormatOffset);
2057 }
2058 
2059 void JSListFormat::JSListFormatVerify(Isolate* isolate) {
2060  JSObjectVerify(isolate);
2061  VerifyObjectField(isolate, kLocaleOffset);
2062  VerifyObjectField(isolate, kICUFormatterOffset);
2063  VerifyObjectField(isolate, kFlagsOffset);
2064 }
2065 
2066 void JSLocale::JSLocaleVerify(Isolate* isolate) {
2067  JSObjectVerify(isolate);
2068  VerifyObjectField(isolate, kLanguageOffset);
2069  VerifyObjectField(isolate, kScriptOffset);
2070  VerifyObjectField(isolate, kRegionOffset);
2071  VerifyObjectField(isolate, kBaseNameOffset);
2072  VerifyObjectField(isolate, kLocaleOffset);
2073  // Unicode extension fields.
2074  VerifyObjectField(isolate, kFlagsOffset);
2075  VerifyObjectField(isolate, kCalendarOffset);
2076  VerifyObjectField(isolate, kCollationOffset);
2077  VerifyObjectField(isolate, kNumberingSystemOffset);
2078 }
2079 
2080 void JSNumberFormat::JSNumberFormatVerify(Isolate* isolate) {
2081  CHECK(IsJSNumberFormat());
2082  JSObjectVerify(isolate);
2083  VerifyObjectField(isolate, kLocaleOffset);
2084  VerifyObjectField(isolate, kICUNumberFormatOffset);
2085  VerifyObjectField(isolate, kBoundFormatOffset);
2086  VerifyObjectField(isolate, kFlagsOffset);
2087 }
2088 
2089 void JSPluralRules::JSPluralRulesVerify(Isolate* isolate) {
2090  CHECK(IsJSPluralRules());
2091  JSObjectVerify(isolate);
2092  VerifyObjectField(isolate, kLocaleOffset);
2093  VerifyObjectField(isolate, kFlagsOffset);
2094  VerifyObjectField(isolate, kICUPluralRulesOffset);
2095  VerifyObjectField(isolate, kICUDecimalFormatOffset);
2096 }
2097 
2098 void JSRelativeTimeFormat::JSRelativeTimeFormatVerify(Isolate* isolate) {
2099  JSObjectVerify(isolate);
2100  VerifyObjectField(isolate, kLocaleOffset);
2101  VerifyObjectField(isolate, kICUFormatterOffset);
2102  VerifyObjectField(isolate, kFlagsOffset);
2103 }
2104 
2105 void JSSegmentIterator::JSSegmentIteratorVerify(Isolate* isolate) {
2106  JSObjectVerify(isolate);
2107  VerifyObjectField(isolate, kICUBreakIteratorOffset);
2108  VerifyObjectField(isolate, kUnicodeStringOffset);
2109  VerifyObjectField(isolate, kFlagsOffset);
2110 }
2111 
2112 void JSSegmenter::JSSegmenterVerify(Isolate* isolate) {
2113  JSObjectVerify(isolate);
2114  VerifyObjectField(isolate, kLocaleOffset);
2115  VerifyObjectField(isolate, kICUBreakIteratorOffset);
2116  VerifyObjectField(isolate, kFlagsOffset);
2117 }
2118 #endif // V8_INTL_SUPPORT
2119 
2120 #endif // VERIFY_HEAP
2121 
2122 #ifdef DEBUG
2123 
2124 void JSObject::IncrementSpillStatistics(Isolate* isolate,
2125  SpillInformation* info) {
2126  info->number_of_objects_++;
2127  // Named properties
2128  if (HasFastProperties()) {
2129  info->number_of_objects_with_fast_properties_++;
2130  info->number_of_fast_used_fields_ += map()->NextFreePropertyIndex();
2131  info->number_of_fast_unused_fields_ += map()->UnusedPropertyFields();
2132  } else if (IsJSGlobalObject()) {
2133  GlobalDictionary dict = JSGlobalObject::cast(this)->global_dictionary();
2134  info->number_of_slow_used_properties_ += dict->NumberOfElements();
2135  info->number_of_slow_unused_properties_ +=
2136  dict->Capacity() - dict->NumberOfElements();
2137  } else {
2138  NameDictionary dict = property_dictionary();
2139  info->number_of_slow_used_properties_ += dict->NumberOfElements();
2140  info->number_of_slow_unused_properties_ +=
2141  dict->Capacity() - dict->NumberOfElements();
2142  }
2143  // Indexed properties
2144  switch (GetElementsKind()) {
2145  case HOLEY_SMI_ELEMENTS:
2146  case PACKED_SMI_ELEMENTS:
2147  case HOLEY_DOUBLE_ELEMENTS:
2148  case PACKED_DOUBLE_ELEMENTS:
2149  case HOLEY_ELEMENTS:
2150  case PACKED_ELEMENTS:
2151  case FAST_STRING_WRAPPER_ELEMENTS: {
2152  info->number_of_objects_with_fast_elements_++;
2153  int holes = 0;
2154  FixedArray e = FixedArray::cast(elements());
2155  int len = e->length();
2156  for (int i = 0; i < len; i++) {
2157  if (e->get(i)->IsTheHole(isolate)) holes++;
2158  }
2159  info->number_of_fast_used_elements_ += len - holes;
2160  info->number_of_fast_unused_elements_ += holes;
2161  break;
2162  }
2163 
2164 #define TYPED_ARRAY_CASE(Type, type, TYPE, ctype) case TYPE##_ELEMENTS:
2165 
2166  TYPED_ARRAYS(TYPED_ARRAY_CASE)
2167 #undef TYPED_ARRAY_CASE
2168  {
2169  info->number_of_objects_with_fast_elements_++;
2170  FixedArrayBase e = FixedArrayBase::cast(elements());
2171  info->number_of_fast_used_elements_ += e->length();
2172  break;
2173  }
2174  case DICTIONARY_ELEMENTS:
2175  case SLOW_STRING_WRAPPER_ELEMENTS: {
2176  NumberDictionary dict = element_dictionary();
2177  info->number_of_slow_used_elements_ += dict->NumberOfElements();
2178  info->number_of_slow_unused_elements_ +=
2179  dict->Capacity() - dict->NumberOfElements();
2180  break;
2181  }
2182  case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
2183  case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
2184  case NO_ELEMENTS:
2185  break;
2186  }
2187 }
2188 
2189 
2190 void JSObject::SpillInformation::Clear() {
2191  number_of_objects_ = 0;
2192  number_of_objects_with_fast_properties_ = 0;
2193  number_of_objects_with_fast_elements_ = 0;
2194  number_of_fast_used_fields_ = 0;
2195  number_of_fast_unused_fields_ = 0;
2196  number_of_slow_used_properties_ = 0;
2197  number_of_slow_unused_properties_ = 0;
2198  number_of_fast_used_elements_ = 0;
2199  number_of_fast_unused_elements_ = 0;
2200  number_of_slow_used_elements_ = 0;
2201  number_of_slow_unused_elements_ = 0;
2202 }
2203 
2204 
2205 void JSObject::SpillInformation::Print() {
2206  PrintF("\n JSObject Spill Statistics (#%d):\n", number_of_objects_);
2207 
2208  PrintF(" - fast properties (#%d): %d (used) %d (unused)\n",
2209  number_of_objects_with_fast_properties_,
2210  number_of_fast_used_fields_, number_of_fast_unused_fields_);
2211 
2212  PrintF(" - slow properties (#%d): %d (used) %d (unused)\n",
2213  number_of_objects_ - number_of_objects_with_fast_properties_,
2214  number_of_slow_used_properties_, number_of_slow_unused_properties_);
2215 
2216  PrintF(" - fast elements (#%d): %d (used) %d (unused)\n",
2217  number_of_objects_with_fast_elements_,
2218  number_of_fast_used_elements_, number_of_fast_unused_elements_);
2219 
2220  PrintF(" - slow elements (#%d): %d (used) %d (unused)\n",
2221  number_of_objects_ - number_of_objects_with_fast_elements_,
2222  number_of_slow_used_elements_, number_of_slow_unused_elements_);
2223 
2224  PrintF("\n");
2225 }
2226 
2227 bool DescriptorArray::IsSortedNoDuplicates(int valid_entries) {
2228  if (valid_entries == -1) valid_entries = number_of_descriptors();
2229  Name current_key;
2230  uint32_t current = 0;
2231  for (int i = 0; i < number_of_descriptors(); i++) {
2232  Name key = GetSortedKey(i);
2233  if (key == current_key) {
2234  Print();
2235  return false;
2236  }
2237  current_key = key;
2238  uint32_t hash = GetSortedKey(i)->Hash();
2239  if (hash < current) {
2240  Print();
2241  return false;
2242  }
2243  current = hash;
2244  }
2245  return true;
2246 }
2247 
2248 bool TransitionArray::IsSortedNoDuplicates(int valid_entries) {
2249  DCHECK_EQ(valid_entries, -1);
2250  Name prev_key;
2251  PropertyKind prev_kind = kData;
2252  PropertyAttributes prev_attributes = NONE;
2253  uint32_t prev_hash = 0;
2254 
2255  for (int i = 0; i < number_of_transitions(); i++) {
2256  Name key = GetSortedKey(i);
2257  uint32_t hash = key->Hash();
2258  PropertyKind kind = kData;
2259  PropertyAttributes attributes = NONE;
2260  if (!TransitionsAccessor::IsSpecialTransition(key->GetReadOnlyRoots(),
2261  key)) {
2262  Map target = GetTarget(i);
2263  PropertyDetails details =
2264  TransitionsAccessor::GetTargetDetails(key, target);
2265  kind = details.kind();
2266  attributes = details.attributes();
2267  } else {
2268  // Duplicate entries are not allowed for non-property transitions.
2269  DCHECK_NE(prev_key, key);
2270  }
2271 
2272  int cmp = CompareKeys(prev_key, prev_hash, prev_kind, prev_attributes, key,
2273  hash, kind, attributes);
2274  if (cmp >= 0) {
2275  Print();
2276  return false;
2277  }
2278  prev_key = key;
2279  prev_hash = hash;
2280  prev_attributes = attributes;
2281  prev_kind = kind;
2282  }
2283  return true;
2284 }
2285 
2286 bool TransitionsAccessor::IsSortedNoDuplicates() {
2287  // Simple and non-existent transitions are always sorted.
2288  if (encoding() != kFullTransitionArray) return true;
2289  return transitions()->IsSortedNoDuplicates();
2290 }
2291 
2292 static bool CheckOneBackPointer(Map current_map, Object* target) {
2293  return !target->IsMap() || Map::cast(target)->GetBackPointer() == current_map;
2294 }
2295 
2296 bool TransitionsAccessor::IsConsistentWithBackPointers() {
2297  int num_transitions = NumberOfTransitions();
2298  for (int i = 0; i < num_transitions; i++) {
2299  Map target = GetTarget(i);
2300  if (!CheckOneBackPointer(map_, target)) return false;
2301  }
2302  return true;
2303 }
2304 
2305 // Estimates if there is a path from the object to a context.
2306 // This function is not precise, and can return false even if
2307 // there is a path to a context.
2308 bool CanLeak(Object* obj, Isolate* isolate) {
2309  if (!obj->IsHeapObject()) return false;
2310  if (obj->IsCell()) {
2311  return CanLeak(Cell::cast(obj)->value(), isolate);
2312  }
2313  if (obj->IsPropertyCell()) {
2314  return CanLeak(PropertyCell::cast(obj)->value(), isolate);
2315  }
2316  if (obj->IsContext()) return true;
2317  if (obj->IsMap()) {
2318  Map map = Map::cast(obj);
2319  for (RootIndex root_index = RootIndex::kFirstStrongOrReadOnlyRoot;
2320  root_index <= RootIndex::kLastStrongOrReadOnlyRoot; ++root_index) {
2321  if (map == isolate->root(root_index)) return false;
2322  }
2323  return true;
2324  }
2325  return CanLeak(HeapObject::cast(obj)->map(), isolate);
2326 }
2327 
2328 void Code::VerifyEmbeddedObjects(Isolate* isolate, VerifyMode mode) {
2329  if (kind() == OPTIMIZED_FUNCTION) return;
2330  int mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
2331  for (RelocIterator it(*this, mask); !it.done(); it.next()) {
2332  Object* target = it.rinfo()->target_object();
2333  DCHECK(!CanLeak(target, isolate));
2334  }
2335 }
2336 
2337 #endif // DEBUG
2338 
2339 } // namespace internal
2340 } // namespace v8
v8
Definition: libplatform.h:13
uint32_t