1/*
2 * Copyright (C) 2015 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#ifndef InferredTypeTable_h
27#define InferredTypeTable_h
28
29#include "Identifier.h"
30#include "InferredType.h"
31#include "JSCell.h"
32
33namespace JSC {
34
35// A table of inferred types for some structure. This is a JSCell because that simplifies the Structure
36// destructor and makes lifetime easier to manage. For example, since it's a cell, we know that this thing
37// cannot be deleted while the DFG is running. This is separate from PropertyTable because most properties
38// will not have an InferredType, since most properties are in dictionaries (if you think of "a property"
39// as being "a property in some Structure"). Also, this will happily conflate the types of properties from
40// different structures even if the structures represent disjoint sets of objects.
41
42class InferredTypeTable final : public JSCell {
43public:
44 typedef JSCell Base;
45
46 static InferredTypeTable* create(VM&);
47
48 static const bool needsDestruction = true;
49 static void destroy(JSCell*);
50
51 static const unsigned StructureFlags = StructureIsImmortal | Base::StructureFlags;
52
53 static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
54
55 static void visitChildren(JSCell*, SlotVisitor&);
56
57 DECLARE_INFO;
58
59 ConcurrentJITLock& lock() { return m_lock; }
60
61 bool isEmpty() const { return m_table.isEmpty(); }
62
63 // Get the current inferred type. Returns nullptr for both Top and Bottom. Null means Bottom if the
64 // owning Structure doesn't know about the property.
65 InferredType* get(const ConcurrentJITLocker&, UniquedStringImpl*);
66 InferredType* get(UniquedStringImpl*);
67 InferredType* get(PropertyName);
68
69 enum StoredPropertyAge {
70 NewProperty,
71 OldProperty
72 };
73
74 // Returns true if the InferredType for this property is still relevant after the store. It's not
75 // relevant if it's Top. Note that this table will internally prune Top entries.
76 bool willStoreValue(VM&, PropertyName, JSValue, StoredPropertyAge);
77
78 // Invalidates the type for the property. Useful if we detect a store in a reflective context.
79 void makeTop(VM&, PropertyName, StoredPropertyAge);
80
81private:
82 InferredTypeTable(VM&);
83 ~InferredTypeTable();
84
85 // Bottom: absence from table.
86 // Top: null value in table, !value->isRelevant(), or absence from table.
87 //
88 // We know how to determine if absence from the table is bottom or top depending on whether the
89 // property is present in the owning structure. Hence, depending on the structure, absence may have
90 // different meanings. The way that this class determines if the owning structure knows of the property
91 // is that we differentiate between actions: replace or transition. If we're adding a new property
92 // (transition), then absence means bottom. If we're storing to an existing property (replace), then
93 // absence means top. To make this work, we have to watch out for the case where two structures, S1 and
94 // S2, share the same InferredTypeTable and neither of them initially know about property P. S1 may
95 // want to add P without a type, while S2 may want to add P with a type. If S1 added P and used absence
96 // to indicate Top, then S2 would use that absence to mean Bottom and would end up creating a non-Top
97 // entry in the table. Then S1 would forget that it wanted Top, and would use S2's type. Clearly,
98 // that's bad. We avoid such confusion by ensuring that a transition always adds an entry. Hence,
99 // absence-means-bottom only comes into play for properties added before the InferredTypeTable was
100 // created.
101 typedef HashMap<RefPtr<UniquedStringImpl>, WriteBarrier<InferredType>, IdentifierRepHash> TableType;
102
103 TableType m_table;
104
105 // We only grab this lock when we're doing modifications on the main thread, or reads on the compiler
106 // thread. The compiler thread is not allowed to do modifications.
107 ConcurrentJITLock m_lock;
108};
109
110} // namespace JSC
111
112#endif // InferredTypeTable_h
113
114
115