Home | History | Annotate | Download | only in src
      1 // Copyright 2012 the V8 project authors. All rights reserved.
      2 // Redistribution and use in source and binary forms, with or without
      3 // modification, are permitted provided that the following conditions are
      4 // met:
      5 //
      6 //     * Redistributions of source code must retain the above copyright
      7 //       notice, this list of conditions and the following disclaimer.
      8 //     * Redistributions in binary form must reproduce the above
      9 //       copyright notice, this list of conditions and the following
     10 //       disclaimer in the documentation and/or other materials provided
     11 //       with the distribution.
     12 //     * Neither the name of Google Inc. nor the names of its
     13 //       contributors may be used to endorse or promote products derived
     14 //       from this software without specific prior written permission.
     15 //
     16 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     17 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     18 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
     19 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
     20 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     21 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
     22 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     23 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     24 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     25 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
     26 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     27 
     28 #include "v8.h"
     29 
     30 #include "api.h"
     31 #include "arguments.h"
     32 #include "bootstrapper.h"
     33 #include "codegen.h"
     34 #include "debug.h"
     35 #include "deoptimizer.h"
     36 #include "date.h"
     37 #include "elements.h"
     38 #include "execution.h"
     39 #include "full-codegen.h"
     40 #include "hydrogen.h"
     41 #include "objects-inl.h"
     42 #include "objects-visiting.h"
     43 #include "objects-visiting-inl.h"
     44 #include "macro-assembler.h"
     45 #include "mark-compact.h"
     46 #include "safepoint-table.h"
     47 #include "string-stream.h"
     48 #include "utils.h"
     49 #include "vm-state-inl.h"
     50 
     51 #ifdef ENABLE_DISASSEMBLER
     52 #include "disasm.h"
     53 #include "disassembler.h"
     54 #endif
     55 
     56 namespace v8 {
     57 namespace internal {
     58 
     59 void PrintElementsKind(FILE* out, ElementsKind kind) {
     60   ElementsAccessor* accessor = ElementsAccessor::ForKind(kind);
     61   PrintF(out, "%s", accessor->name());
     62 }
     63 
     64 
     65 MUST_USE_RESULT static MaybeObject* CreateJSValue(JSFunction* constructor,
     66                                                   Object* value) {
     67   Object* result;
     68   { MaybeObject* maybe_result =
     69         constructor->GetHeap()->AllocateJSObject(constructor);
     70     if (!maybe_result->ToObject(&result)) return maybe_result;
     71   }
     72   JSValue::cast(result)->set_value(value);
     73   return result;
     74 }
     75 
     76 
     77 MaybeObject* Object::ToObject(Context* global_context) {
     78   if (IsNumber()) {
     79     return CreateJSValue(global_context->number_function(), this);
     80   } else if (IsBoolean()) {
     81     return CreateJSValue(global_context->boolean_function(), this);
     82   } else if (IsString()) {
     83     return CreateJSValue(global_context->string_function(), this);
     84   }
     85   ASSERT(IsJSObject());
     86   return this;
     87 }
     88 
     89 
     90 MaybeObject* Object::ToObject() {
     91   if (IsJSReceiver()) {
     92     return this;
     93   } else if (IsNumber()) {
     94     Isolate* isolate = Isolate::Current();
     95     Context* global_context = isolate->context()->global_context();
     96     return CreateJSValue(global_context->number_function(), this);
     97   } else if (IsBoolean()) {
     98     Isolate* isolate = HeapObject::cast(this)->GetIsolate();
     99     Context* global_context = isolate->context()->global_context();
    100     return CreateJSValue(global_context->boolean_function(), this);
    101   } else if (IsString()) {
    102     Isolate* isolate = HeapObject::cast(this)->GetIsolate();
    103     Context* global_context = isolate->context()->global_context();
    104     return CreateJSValue(global_context->string_function(), this);
    105   }
    106 
    107   // Throw a type error.
    108   return Failure::InternalError();
    109 }
    110 
    111 
    112 Object* Object::ToBoolean() {
    113   if (IsTrue()) return this;
    114   if (IsFalse()) return this;
    115   if (IsSmi()) {
    116     return Isolate::Current()->heap()->ToBoolean(Smi::cast(this)->value() != 0);
    117   }
    118   HeapObject* heap_object = HeapObject::cast(this);
    119   if (heap_object->IsUndefined() || heap_object->IsNull()) {
    120     return heap_object->GetHeap()->false_value();
    121   }
    122   // Undetectable object is false
    123   if (heap_object->IsUndetectableObject()) {
    124     return heap_object->GetHeap()->false_value();
    125   }
    126   if (heap_object->IsString()) {
    127     return heap_object->GetHeap()->ToBoolean(
    128         String::cast(this)->length() != 0);
    129   }
    130   if (heap_object->IsHeapNumber()) {
    131     return HeapNumber::cast(this)->HeapNumberToBoolean();
    132   }
    133   return heap_object->GetHeap()->true_value();
    134 }
    135 
    136 
    137 void Object::Lookup(String* name, LookupResult* result) {
    138   Object* holder = NULL;
    139   if (IsJSReceiver()) {
    140     holder = this;
    141   } else {
    142     Context* global_context = Isolate::Current()->context()->global_context();
    143     if (IsNumber()) {
    144       holder = global_context->number_function()->instance_prototype();
    145     } else if (IsString()) {
    146       holder = global_context->string_function()->instance_prototype();
    147     } else if (IsBoolean()) {
    148       holder = global_context->boolean_function()->instance_prototype();
    149     }
    150   }
    151   ASSERT(holder != NULL);  // Cannot handle null or undefined.
    152   JSReceiver::cast(holder)->Lookup(name, result);
    153 }
    154 
    155 
    156 MaybeObject* Object::GetPropertyWithReceiver(Object* receiver,
    157                                              String* name,
    158                                              PropertyAttributes* attributes) {
    159   LookupResult result(name->GetIsolate());
    160   Lookup(name, &result);
    161   MaybeObject* value = GetProperty(receiver, &result, name, attributes);
    162   ASSERT(*attributes <= ABSENT);
    163   return value;
    164 }
    165 
    166 
    167 MaybeObject* JSObject::GetPropertyWithCallback(Object* receiver,
    168                                                Object* structure,
    169                                                String* name) {
    170   Isolate* isolate = name->GetIsolate();
    171   // To accommodate both the old and the new api we switch on the
    172   // data structure used to store the callbacks.  Eventually foreign
    173   // callbacks should be phased out.
    174   if (structure->IsForeign()) {
    175     AccessorDescriptor* callback =
    176         reinterpret_cast<AccessorDescriptor*>(
    177             Foreign::cast(structure)->foreign_address());
    178     MaybeObject* value = (callback->getter)(receiver, callback->data);
    179     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
    180     return value;
    181   }
    182 
    183   // api style callbacks.
    184   if (structure->IsAccessorInfo()) {
    185     AccessorInfo* data = AccessorInfo::cast(structure);
    186     Object* fun_obj = data->getter();
    187     v8::AccessorGetter call_fun = v8::ToCData<v8::AccessorGetter>(fun_obj);
    188     HandleScope scope(isolate);
    189     JSObject* self = JSObject::cast(receiver);
    190     Handle<String> key(name);
    191     LOG(isolate, ApiNamedPropertyAccess("load", self, name));
    192     CustomArguments args(isolate, data->data(), self, this);
    193     v8::AccessorInfo info(args.end());
    194     v8::Handle<v8::Value> result;
    195     {
    196       // Leaving JavaScript.
    197       VMState state(isolate, EXTERNAL);
    198       result = call_fun(v8::Utils::ToLocal(key), info);
    199     }
    200     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
    201     if (result.IsEmpty()) {
    202       return isolate->heap()->undefined_value();
    203     }
    204     return *v8::Utils::OpenHandle(*result);
    205   }
    206 
    207   // __defineGetter__ callback
    208   if (structure->IsAccessorPair()) {
    209     Object* getter = AccessorPair::cast(structure)->getter();
    210     if (getter->IsSpecFunction()) {
    211       // TODO(rossberg): nicer would be to cast to some JSCallable here...
    212       return GetPropertyWithDefinedGetter(receiver, JSReceiver::cast(getter));
    213     }
    214     // Getter is not a function.
    215     return isolate->heap()->undefined_value();
    216   }
    217 
    218   UNREACHABLE();
    219   return NULL;
    220 }
    221 
    222 
    223 MaybeObject* JSProxy::GetPropertyWithHandler(Object* receiver_raw,
    224                                              String* name_raw) {
    225   Isolate* isolate = GetIsolate();
    226   HandleScope scope(isolate);
    227   Handle<Object> receiver(receiver_raw);
    228   Handle<Object> name(name_raw);
    229 
    230   Handle<Object> args[] = { receiver, name };
    231   Handle<Object> result = CallTrap(
    232     "get", isolate->derived_get_trap(), ARRAY_SIZE(args), args);
    233   if (isolate->has_pending_exception()) return Failure::Exception();
    234 
    235   return *result;
    236 }
    237 
    238 
    239 Handle<Object> Object::GetElement(Handle<Object> object, uint32_t index) {
    240   Isolate* isolate = object->IsHeapObject()
    241       ? Handle<HeapObject>::cast(object)->GetIsolate()
    242       : Isolate::Current();
    243   CALL_HEAP_FUNCTION(isolate, object->GetElement(index), Object);
    244 }
    245 
    246 
    247 MaybeObject* JSProxy::GetElementWithHandler(Object* receiver,
    248                                             uint32_t index) {
    249   String* name;
    250   MaybeObject* maybe = GetHeap()->Uint32ToString(index);
    251   if (!maybe->To<String>(&name)) return maybe;
    252   return GetPropertyWithHandler(receiver, name);
    253 }
    254 
    255 
    256 MaybeObject* JSProxy::SetElementWithHandler(uint32_t index,
    257                                             Object* value,
    258                                             StrictModeFlag strict_mode) {
    259   String* name;
    260   MaybeObject* maybe = GetHeap()->Uint32ToString(index);
    261   if (!maybe->To<String>(&name)) return maybe;
    262   return SetPropertyWithHandler(name, value, NONE, strict_mode);
    263 }
    264 
    265 
    266 bool JSProxy::HasElementWithHandler(uint32_t index) {
    267   String* name;
    268   MaybeObject* maybe = GetHeap()->Uint32ToString(index);
    269   if (!maybe->To<String>(&name)) return maybe;
    270   return HasPropertyWithHandler(name);
    271 }
    272 
    273 
    274 MaybeObject* Object::GetPropertyWithDefinedGetter(Object* receiver,
    275                                                   JSReceiver* getter) {
    276   HandleScope scope;
    277   Handle<JSReceiver> fun(getter);
    278   Handle<Object> self(receiver);
    279 #ifdef ENABLE_DEBUGGER_SUPPORT
    280   Debug* debug = fun->GetHeap()->isolate()->debug();
    281   // Handle stepping into a getter if step into is active.
    282   // TODO(rossberg): should this apply to getters that are function proxies?
    283   if (debug->StepInActive() && fun->IsJSFunction()) {
    284     debug->HandleStepIn(
    285         Handle<JSFunction>::cast(fun), Handle<Object>::null(), 0, false);
    286   }
    287 #endif
    288 
    289   bool has_pending_exception;
    290   Handle<Object> result =
    291       Execution::Call(fun, self, 0, NULL, &has_pending_exception, true);
    292   // Check for pending exception and return the result.
    293   if (has_pending_exception) return Failure::Exception();
    294   return *result;
    295 }
    296 
    297 
    298 // Only deal with CALLBACKS and INTERCEPTOR
    299 MaybeObject* JSObject::GetPropertyWithFailedAccessCheck(
    300     Object* receiver,
    301     LookupResult* result,
    302     String* name,
    303     PropertyAttributes* attributes) {
    304   if (result->IsProperty()) {
    305     switch (result->type()) {
    306       case CALLBACKS: {
    307         // Only allow API accessors.
    308         Object* obj = result->GetCallbackObject();
    309         if (obj->IsAccessorInfo()) {
    310           AccessorInfo* info = AccessorInfo::cast(obj);
    311           if (info->all_can_read()) {
    312             *attributes = result->GetAttributes();
    313             return result->holder()->GetPropertyWithCallback(
    314                 receiver, result->GetCallbackObject(), name);
    315           }
    316         }
    317         break;
    318       }
    319       case NORMAL:
    320       case FIELD:
    321       case CONSTANT_FUNCTION: {
    322         // Search ALL_CAN_READ accessors in prototype chain.
    323         LookupResult r(GetIsolate());
    324         result->holder()->LookupRealNamedPropertyInPrototypes(name, &r);
    325         if (r.IsProperty()) {
    326           return GetPropertyWithFailedAccessCheck(receiver,
    327                                                   &r,
    328                                                   name,
    329                                                   attributes);
    330         }
    331         break;
    332       }
    333       case INTERCEPTOR: {
    334         // If the object has an interceptor, try real named properties.
    335         // No access check in GetPropertyAttributeWithInterceptor.
    336         LookupResult r(GetIsolate());
    337         result->holder()->LookupRealNamedProperty(name, &r);
    338         if (r.IsProperty()) {
    339           return GetPropertyWithFailedAccessCheck(receiver,
    340                                                   &r,
    341                                                   name,
    342                                                   attributes);
    343         }
    344         break;
    345       }
    346       default:
    347         UNREACHABLE();
    348     }
    349   }
    350 
    351   // No accessible property found.
    352   *attributes = ABSENT;
    353   Heap* heap = name->GetHeap();
    354   heap->isolate()->ReportFailedAccessCheck(this, v8::ACCESS_GET);
    355   return heap->undefined_value();
    356 }
    357 
    358 
    359 PropertyAttributes JSObject::GetPropertyAttributeWithFailedAccessCheck(
    360     Object* receiver,
    361     LookupResult* result,
    362     String* name,
    363     bool continue_search) {
    364   if (result->IsProperty()) {
    365     switch (result->type()) {
    366       case CALLBACKS: {
    367         // Only allow API accessors.
    368         Object* obj = result->GetCallbackObject();
    369         if (obj->IsAccessorInfo()) {
    370           AccessorInfo* info = AccessorInfo::cast(obj);
    371           if (info->all_can_read()) {
    372             return result->GetAttributes();
    373           }
    374         }
    375         break;
    376       }
    377 
    378       case NORMAL:
    379       case FIELD:
    380       case CONSTANT_FUNCTION: {
    381         if (!continue_search) break;
    382         // Search ALL_CAN_READ accessors in prototype chain.
    383         LookupResult r(GetIsolate());
    384         result->holder()->LookupRealNamedPropertyInPrototypes(name, &r);
    385         if (r.IsProperty()) {
    386           return GetPropertyAttributeWithFailedAccessCheck(receiver,
    387                                                            &r,
    388                                                            name,
    389                                                            continue_search);
    390         }
    391         break;
    392       }
    393 
    394       case INTERCEPTOR: {
    395         // If the object has an interceptor, try real named properties.
    396         // No access check in GetPropertyAttributeWithInterceptor.
    397         LookupResult r(GetIsolate());
    398         if (continue_search) {
    399           result->holder()->LookupRealNamedProperty(name, &r);
    400         } else {
    401           result->holder()->LocalLookupRealNamedProperty(name, &r);
    402         }
    403         if (r.IsProperty()) {
    404           return GetPropertyAttributeWithFailedAccessCheck(receiver,
    405                                                            &r,
    406                                                            name,
    407                                                            continue_search);
    408         }
    409         break;
    410       }
    411 
    412       default:
    413         UNREACHABLE();
    414     }
    415   }
    416 
    417   GetIsolate()->ReportFailedAccessCheck(this, v8::ACCESS_HAS);
    418   return ABSENT;
    419 }
    420 
    421 
    422 Object* JSObject::GetNormalizedProperty(LookupResult* result) {
    423   ASSERT(!HasFastProperties());
    424   Object* value = property_dictionary()->ValueAt(result->GetDictionaryEntry());
    425   if (IsGlobalObject()) {
    426     value = JSGlobalPropertyCell::cast(value)->value();
    427   }
    428   ASSERT(!value->IsJSGlobalPropertyCell());
    429   return value;
    430 }
    431 
    432 
    433 Object* JSObject::SetNormalizedProperty(LookupResult* result, Object* value) {
    434   ASSERT(!HasFastProperties());
    435   if (IsGlobalObject()) {
    436     JSGlobalPropertyCell* cell =
    437         JSGlobalPropertyCell::cast(
    438             property_dictionary()->ValueAt(result->GetDictionaryEntry()));
    439     cell->set_value(value);
    440   } else {
    441     property_dictionary()->ValueAtPut(result->GetDictionaryEntry(), value);
    442   }
    443   return value;
    444 }
    445 
    446 
    447 Handle<Object> JSObject::SetNormalizedProperty(Handle<JSObject> object,
    448                                                Handle<String> key,
    449                                                Handle<Object> value,
    450                                                PropertyDetails details) {
    451   CALL_HEAP_FUNCTION(object->GetIsolate(),
    452                      object->SetNormalizedProperty(*key, *value, details),
    453                      Object);
    454 }
    455 
    456 
    457 MaybeObject* JSObject::SetNormalizedProperty(String* name,
    458                                              Object* value,
    459                                              PropertyDetails details) {
    460   ASSERT(!HasFastProperties());
    461   int entry = property_dictionary()->FindEntry(name);
    462   if (entry == StringDictionary::kNotFound) {
    463     Object* store_value = value;
    464     if (IsGlobalObject()) {
    465       Heap* heap = name->GetHeap();
    466       MaybeObject* maybe_store_value =
    467           heap->AllocateJSGlobalPropertyCell(value);
    468       if (!maybe_store_value->ToObject(&store_value)) return maybe_store_value;
    469     }
    470     Object* dict;
    471     { MaybeObject* maybe_dict =
    472           property_dictionary()->Add(name, store_value, details);
    473       if (!maybe_dict->ToObject(&dict)) return maybe_dict;
    474     }
    475     set_properties(StringDictionary::cast(dict));
    476     return value;
    477   }
    478   // Preserve enumeration index.
    479   details = PropertyDetails(details.attributes(),
    480                             details.type(),
    481                             property_dictionary()->DetailsAt(entry).index());
    482   if (IsGlobalObject()) {
    483     JSGlobalPropertyCell* cell =
    484         JSGlobalPropertyCell::cast(property_dictionary()->ValueAt(entry));
    485     cell->set_value(value);
    486     // Please note we have to update the property details.
    487     property_dictionary()->DetailsAtPut(entry, details);
    488   } else {
    489     property_dictionary()->SetEntry(entry, name, value, details);
    490   }
    491   return value;
    492 }
    493 
    494 
    495 MaybeObject* JSObject::DeleteNormalizedProperty(String* name, DeleteMode mode) {
    496   ASSERT(!HasFastProperties());
    497   StringDictionary* dictionary = property_dictionary();
    498   int entry = dictionary->FindEntry(name);
    499   if (entry != StringDictionary::kNotFound) {
    500     // If we have a global object set the cell to the hole.
    501     if (IsGlobalObject()) {
    502       PropertyDetails details = dictionary->DetailsAt(entry);
    503       if (details.IsDontDelete()) {
    504         if (mode != FORCE_DELETION) return GetHeap()->false_value();
    505         // When forced to delete global properties, we have to make a
    506         // map change to invalidate any ICs that think they can load
    507         // from the DontDelete cell without checking if it contains
    508         // the hole value.
    509         Object* new_map;
    510         { MaybeObject* maybe_new_map = map()->CopyDropDescriptors();
    511           if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
    512         }
    513         set_map(Map::cast(new_map));
    514       }
    515       JSGlobalPropertyCell* cell =
    516           JSGlobalPropertyCell::cast(dictionary->ValueAt(entry));
    517       cell->set_value(cell->GetHeap()->the_hole_value());
    518       dictionary->DetailsAtPut(entry, details.AsDeleted());
    519     } else {
    520       Object* deleted = dictionary->DeleteProperty(entry, mode);
    521       if (deleted == GetHeap()->true_value()) {
    522         FixedArray* new_properties = NULL;
    523         MaybeObject* maybe_properties = dictionary->Shrink(name);
    524         if (!maybe_properties->To(&new_properties)) {
    525           return maybe_properties;
    526         }
    527         set_properties(new_properties);
    528       }
    529       return deleted;
    530     }
    531   }
    532   return GetHeap()->true_value();
    533 }
    534 
    535 
    536 bool JSObject::IsDirty() {
    537   Object* cons_obj = map()->constructor();
    538   if (!cons_obj->IsJSFunction())
    539     return true;
    540   JSFunction* fun = JSFunction::cast(cons_obj);
    541   if (!fun->shared()->IsApiFunction())
    542     return true;
    543   // If the object is fully fast case and has the same map it was
    544   // created with then no changes can have been made to it.
    545   return map() != fun->initial_map()
    546       || !HasFastElements()
    547       || !HasFastProperties();
    548 }
    549 
    550 
    551 Handle<Object> Object::GetProperty(Handle<Object> object,
    552                                    Handle<Object> receiver,
    553                                    LookupResult* result,
    554                                    Handle<String> key,
    555                                    PropertyAttributes* attributes) {
    556   Isolate* isolate = object->IsHeapObject()
    557       ? Handle<HeapObject>::cast(object)->GetIsolate()
    558       : Isolate::Current();
    559   CALL_HEAP_FUNCTION(
    560       isolate,
    561       object->GetProperty(*receiver, result, *key, attributes),
    562       Object);
    563 }
    564 
    565 
    566 MaybeObject* Object::GetProperty(Object* receiver,
    567                                  LookupResult* result,
    568                                  String* name,
    569                                  PropertyAttributes* attributes) {
    570   // Make sure that the top context does not change when doing
    571   // callbacks or interceptor calls.
    572   AssertNoContextChange ncc;
    573   Heap* heap = name->GetHeap();
    574 
    575   // Traverse the prototype chain from the current object (this) to
    576   // the holder and check for access rights. This avoids traversing the
    577   // objects more than once in case of interceptors, because the
    578   // holder will always be the interceptor holder and the search may
    579   // only continue with a current object just after the interceptor
    580   // holder in the prototype chain.
    581   // Proxy handlers do not use the proxy's prototype, so we can skip this.
    582   if (!result->IsHandler()) {
    583     Object* last = result->IsProperty()
    584         ? result->holder()
    585         : Object::cast(heap->null_value());
    586     ASSERT(this != this->GetPrototype());
    587     for (Object* current = this; true; current = current->GetPrototype()) {
    588       if (current->IsAccessCheckNeeded()) {
    589         // Check if we're allowed to read from the current object. Note
    590         // that even though we may not actually end up loading the named
    591         // property from the current object, we still check that we have
    592         // access to it.
    593         JSObject* checked = JSObject::cast(current);
    594         if (!heap->isolate()->MayNamedAccess(checked, name, v8::ACCESS_GET)) {
    595           return checked->GetPropertyWithFailedAccessCheck(receiver,
    596                                                            result,
    597                                                            name,
    598                                                            attributes);
    599         }
    600       }
    601       // Stop traversing the chain once we reach the last object in the
    602       // chain; either the holder of the result or null in case of an
    603       // absent property.
    604       if (current == last) break;
    605     }
    606   }
    607 
    608   if (!result->IsProperty()) {
    609     *attributes = ABSENT;
    610     return heap->undefined_value();
    611   }
    612   *attributes = result->GetAttributes();
    613   Object* value;
    614   switch (result->type()) {
    615     case NORMAL:
    616       value = result->holder()->GetNormalizedProperty(result);
    617       ASSERT(!value->IsTheHole() || result->IsReadOnly());
    618       return value->IsTheHole() ? heap->undefined_value() : value;
    619     case FIELD:
    620       value = result->holder()->FastPropertyAt(result->GetFieldIndex());
    621       ASSERT(!value->IsTheHole() || result->IsReadOnly());
    622       return value->IsTheHole() ? heap->undefined_value() : value;
    623     case CONSTANT_FUNCTION:
    624       return result->GetConstantFunction();
    625     case CALLBACKS:
    626       return result->holder()->GetPropertyWithCallback(
    627           receiver, result->GetCallbackObject(), name);
    628     case HANDLER:
    629       return result->proxy()->GetPropertyWithHandler(receiver, name);
    630     case INTERCEPTOR: {
    631       JSObject* recvr = JSObject::cast(receiver);
    632       return result->holder()->GetPropertyWithInterceptor(
    633           recvr, name, attributes);
    634     }
    635     case MAP_TRANSITION:
    636     case ELEMENTS_TRANSITION:
    637     case CONSTANT_TRANSITION:
    638     case NULL_DESCRIPTOR:
    639       break;
    640   }
    641   UNREACHABLE();
    642   return NULL;
    643 }
    644 
    645 
    646 MaybeObject* Object::GetElementWithReceiver(Object* receiver, uint32_t index) {
    647   Heap* heap = IsSmi()
    648       ? Isolate::Current()->heap()
    649       : HeapObject::cast(this)->GetHeap();
    650   Object* holder = this;
    651 
    652   // Iterate up the prototype chain until an element is found or the null
    653   // prototype is encountered.
    654   for (holder = this;
    655        holder != heap->null_value();
    656        holder = holder->GetPrototype()) {
    657     if (!holder->IsJSObject()) {
    658       Isolate* isolate = heap->isolate();
    659       Context* global_context = isolate->context()->global_context();
    660       if (holder->IsNumber()) {
    661         holder = global_context->number_function()->instance_prototype();
    662       } else if (holder->IsString()) {
    663         holder = global_context->string_function()->instance_prototype();
    664       } else if (holder->IsBoolean()) {
    665         holder = global_context->boolean_function()->instance_prototype();
    666       } else if (holder->IsJSProxy()) {
    667         return JSProxy::cast(holder)->GetElementWithHandler(receiver, index);
    668       } else {
    669         // Undefined and null have no indexed properties.
    670         ASSERT(holder->IsUndefined() || holder->IsNull());
    671         return heap->undefined_value();
    672       }
    673     }
    674 
    675     // Inline the case for JSObjects. Doing so significantly improves the
    676     // performance of fetching elements where checking the prototype chain is
    677     // necessary.
    678     JSObject* js_object = JSObject::cast(holder);
    679 
    680     // Check access rights if needed.
    681     if (js_object->IsAccessCheckNeeded()) {
    682       Isolate* isolate = heap->isolate();
    683       if (!isolate->MayIndexedAccess(js_object, index, v8::ACCESS_GET)) {
    684         isolate->ReportFailedAccessCheck(js_object, v8::ACCESS_GET);
    685         return heap->undefined_value();
    686       }
    687     }
    688 
    689     if (js_object->HasIndexedInterceptor()) {
    690       return js_object->GetElementWithInterceptor(receiver, index);
    691     }
    692 
    693     if (js_object->elements() != heap->empty_fixed_array()) {
    694       MaybeObject* result = js_object->GetElementsAccessor()->Get(
    695           receiver, js_object, index);
    696       if (result != heap->the_hole_value()) return result;
    697     }
    698   }
    699 
    700   return heap->undefined_value();
    701 }
    702 
    703 
    704 Object* Object::GetPrototype() {
    705   if (IsSmi()) {
    706     Heap* heap = Isolate::Current()->heap();
    707     Context* context = heap->isolate()->context()->global_context();
    708     return context->number_function()->instance_prototype();
    709   }
    710 
    711   HeapObject* heap_object = HeapObject::cast(this);
    712 
    713   // The object is either a number, a string, a boolean,
    714   // a real JS object, or a Harmony proxy.
    715   if (heap_object->IsJSReceiver()) {
    716     return heap_object->map()->prototype();
    717   }
    718   Heap* heap = heap_object->GetHeap();
    719   Context* context = heap->isolate()->context()->global_context();
    720 
    721   if (heap_object->IsHeapNumber()) {
    722     return context->number_function()->instance_prototype();
    723   }
    724   if (heap_object->IsString()) {
    725     return context->string_function()->instance_prototype();
    726   }
    727   if (heap_object->IsBoolean()) {
    728     return context->boolean_function()->instance_prototype();
    729   } else {
    730     return heap->null_value();
    731   }
    732 }
    733 
    734 
    735 MaybeObject* Object::GetHash(CreationFlag flag) {
    736   // The object is either a number, a string, an odd-ball,
    737   // a real JS object, or a Harmony proxy.
    738   if (IsNumber()) {
    739     uint32_t hash = ComputeLongHash(double_to_uint64(Number()));
    740     return Smi::FromInt(hash & Smi::kMaxValue);
    741   }
    742   if (IsString()) {
    743     uint32_t hash = String::cast(this)->Hash();
    744     return Smi::FromInt(hash);
    745   }
    746   if (IsOddball()) {
    747     uint32_t hash = Oddball::cast(this)->to_string()->Hash();
    748     return Smi::FromInt(hash);
    749   }
    750   if (IsJSReceiver()) {
    751     return JSReceiver::cast(this)->GetIdentityHash(flag);
    752   }
    753 
    754   UNREACHABLE();
    755   return Smi::FromInt(0);
    756 }
    757 
    758 
    759 bool Object::SameValue(Object* other) {
    760   if (other == this) return true;
    761   if (!IsHeapObject() || !other->IsHeapObject()) return false;
    762 
    763   // The object is either a number, a string, an odd-ball,
    764   // a real JS object, or a Harmony proxy.
    765   if (IsNumber() && other->IsNumber()) {
    766     double this_value = Number();
    767     double other_value = other->Number();
    768     return (this_value == other_value) ||
    769         (isnan(this_value) && isnan(other_value));
    770   }
    771   if (IsString() && other->IsString()) {
    772     return String::cast(this)->Equals(String::cast(other));
    773   }
    774   return false;
    775 }
    776 
    777 
    778 void Object::ShortPrint(FILE* out) {
    779   HeapStringAllocator allocator;
    780   StringStream accumulator(&allocator);
    781   ShortPrint(&accumulator);
    782   accumulator.OutputToFile(out);
    783 }
    784 
    785 
    786 void Object::ShortPrint(StringStream* accumulator) {
    787   if (IsSmi()) {
    788     Smi::cast(this)->SmiPrint(accumulator);
    789   } else if (IsFailure()) {
    790     Failure::cast(this)->FailurePrint(accumulator);
    791   } else {
    792     HeapObject::cast(this)->HeapObjectShortPrint(accumulator);
    793   }
    794 }
    795 
    796 
    797 void Smi::SmiPrint(FILE* out) {
    798   PrintF(out, "%d", value());
    799 }
    800 
    801 
    802 void Smi::SmiPrint(StringStream* accumulator) {
    803   accumulator->Add("%d", value());
    804 }
    805 
    806 
    807 void Failure::FailurePrint(StringStream* accumulator) {
    808   accumulator->Add("Failure(%p)", reinterpret_cast<void*>(value()));
    809 }
    810 
    811 
    812 void Failure::FailurePrint(FILE* out) {
    813   PrintF(out, "Failure(%p)", reinterpret_cast<void*>(value()));
    814 }
    815 
    816 
    817 // Should a word be prefixed by 'a' or 'an' in order to read naturally in
    818 // English?  Returns false for non-ASCII or words that don't start with
    819 // a capital letter.  The a/an rule follows pronunciation in English.
    820 // We don't use the BBC's overcorrect "an historic occasion" though if
    821 // you speak a dialect you may well say "an 'istoric occasion".
    822 static bool AnWord(String* str) {
    823   if (str->length() == 0) return false;  // A nothing.
    824   int c0 = str->Get(0);
    825   int c1 = str->length() > 1 ? str->Get(1) : 0;
    826   if (c0 == 'U') {
    827     if (c1 > 'Z') {
    828       return true;  // An Umpire, but a UTF8String, a U.
    829     }
    830   } else if (c0 == 'A' || c0 == 'E' || c0 == 'I' || c0 == 'O') {
    831     return true;    // An Ape, an ABCBook.
    832   } else if ((c1 == 0 || (c1 >= 'A' && c1 <= 'Z')) &&
    833            (c0 == 'F' || c0 == 'H' || c0 == 'M' || c0 == 'N' || c0 == 'R' ||
    834             c0 == 'S' || c0 == 'X')) {
    835     return true;    // An MP3File, an M.
    836   }
    837   return false;
    838 }
    839 
    840 
    841 MaybeObject* String::SlowTryFlatten(PretenureFlag pretenure) {
    842 #ifdef DEBUG
    843   // Do not attempt to flatten in debug mode when allocation is not
    844   // allowed.  This is to avoid an assertion failure when allocating.
    845   // Flattening strings is the only case where we always allow
    846   // allocation because no GC is performed if the allocation fails.
    847   if (!HEAP->IsAllocationAllowed()) return this;
    848 #endif
    849 
    850   Heap* heap = GetHeap();
    851   switch (StringShape(this).representation_tag()) {
    852     case kConsStringTag: {
    853       ConsString* cs = ConsString::cast(this);
    854       if (cs->second()->length() == 0) {
    855         return cs->first();
    856       }
    857       // There's little point in putting the flat string in new space if the
    858       // cons string is in old space.  It can never get GCed until there is
    859       // an old space GC.
    860       PretenureFlag tenure = heap->InNewSpace(this) ? pretenure : TENURED;
    861       int len = length();
    862       Object* object;
    863       String* result;
    864       if (IsAsciiRepresentation()) {
    865         { MaybeObject* maybe_object = heap->AllocateRawAsciiString(len, tenure);
    866           if (!maybe_object->ToObject(&object)) return maybe_object;
    867         }
    868         result = String::cast(object);
    869         String* first = cs->first();
    870         int first_length = first->length();
    871         char* dest = SeqAsciiString::cast(result)->GetChars();
    872         WriteToFlat(first, dest, 0, first_length);
    873         String* second = cs->second();
    874         WriteToFlat(second,
    875                     dest + first_length,
    876                     0,
    877                     len - first_length);
    878       } else {
    879         { MaybeObject* maybe_object =
    880               heap->AllocateRawTwoByteString(len, tenure);
    881           if (!maybe_object->ToObject(&object)) return maybe_object;
    882         }
    883         result = String::cast(object);
    884         uc16* dest = SeqTwoByteString::cast(result)->GetChars();
    885         String* first = cs->first();
    886         int first_length = first->length();
    887         WriteToFlat(first, dest, 0, first_length);
    888         String* second = cs->second();
    889         WriteToFlat(second,
    890                     dest + first_length,
    891                     0,
    892                     len - first_length);
    893       }
    894       cs->set_first(result);
    895       cs->set_second(heap->empty_string(), SKIP_WRITE_BARRIER);
    896       return result;
    897     }
    898     default:
    899       return this;
    900   }
    901 }
    902 
    903 
    904 bool String::MakeExternal(v8::String::ExternalStringResource* resource) {
    905   // Externalizing twice leaks the external resource, so it's
    906   // prohibited by the API.
    907   ASSERT(!this->IsExternalString());
    908 #ifdef DEBUG
    909   if (FLAG_enable_slow_asserts) {
    910     // Assert that the resource and the string are equivalent.
    911     ASSERT(static_cast<size_t>(this->length()) == resource->length());
    912     ScopedVector<uc16> smart_chars(this->length());
    913     String::WriteToFlat(this, smart_chars.start(), 0, this->length());
    914     ASSERT(memcmp(smart_chars.start(),
    915                   resource->data(),
    916                   resource->length() * sizeof(smart_chars[0])) == 0);
    917   }
    918 #endif  // DEBUG
    919   Heap* heap = GetHeap();
    920   int size = this->Size();  // Byte size of the original string.
    921   if (size < ExternalString::kShortSize) {
    922     return false;
    923   }
    924   bool is_ascii = this->IsAsciiRepresentation();
    925   bool is_symbol = this->IsSymbol();
    926 
    927   // Morph the object to an external string by adjusting the map and
    928   // reinitializing the fields.
    929   if (size >= ExternalString::kSize) {
    930     this->set_map_no_write_barrier(
    931         is_symbol
    932             ? (is_ascii ?  heap->external_symbol_with_ascii_data_map()
    933                         :  heap->external_symbol_map())
    934             : (is_ascii ?  heap->external_string_with_ascii_data_map()
    935                         :  heap->external_string_map()));
    936   } else {
    937     this->set_map_no_write_barrier(
    938         is_symbol
    939             ? (is_ascii ?  heap->short_external_symbol_with_ascii_data_map()
    940                         :  heap->short_external_symbol_map())
    941             : (is_ascii ?  heap->short_external_string_with_ascii_data_map()
    942                         :  heap->short_external_string_map()));
    943   }
    944   ExternalTwoByteString* self = ExternalTwoByteString::cast(this);
    945   self->set_resource(resource);
    946   if (is_symbol) self->Hash();  // Force regeneration of the hash value.
    947 
    948   // Fill the remainder of the string with dead wood.
    949   int new_size = this->Size();  // Byte size of the external String object.
    950   heap->CreateFillerObjectAt(this->address() + new_size, size - new_size);
    951   if (Marking::IsBlack(Marking::MarkBitFrom(this))) {
    952     MemoryChunk::IncrementLiveBytesFromMutator(this->address(),
    953                                                new_size - size);
    954   }
    955   return true;
    956 }
    957 
    958 
    959 bool String::MakeExternal(v8::String::ExternalAsciiStringResource* resource) {
    960 #ifdef DEBUG
    961   if (FLAG_enable_slow_asserts) {
    962     // Assert that the resource and the string are equivalent.
    963     ASSERT(static_cast<size_t>(this->length()) == resource->length());
    964     ScopedVector<char> smart_chars(this->length());
    965     String::WriteToFlat(this, smart_chars.start(), 0, this->length());
    966     ASSERT(memcmp(smart_chars.start(),
    967                   resource->data(),
    968                   resource->length() * sizeof(smart_chars[0])) == 0);
    969   }
    970 #endif  // DEBUG
    971   Heap* heap = GetHeap();
    972   int size = this->Size();  // Byte size of the original string.
    973   if (size < ExternalString::kShortSize) {
    974     return false;
    975   }
    976   bool is_symbol = this->IsSymbol();
    977 
    978   // Morph the object to an external string by adjusting the map and
    979   // reinitializing the fields.  Use short version if space is limited.
    980   if (size >= ExternalString::kSize) {
    981     this->set_map_no_write_barrier(
    982         is_symbol ? heap->external_ascii_symbol_map()
    983                   : heap->external_ascii_string_map());
    984   } else {
    985     this->set_map_no_write_barrier(
    986         is_symbol ? heap->short_external_ascii_symbol_map()
    987                   : heap->short_external_ascii_string_map());
    988   }
    989   ExternalAsciiString* self = ExternalAsciiString::cast(this);
    990   self->set_resource(resource);
    991   if (is_symbol) self->Hash();  // Force regeneration of the hash value.
    992 
    993   // Fill the remainder of the string with dead wood.
    994   int new_size = this->Size();  // Byte size of the external String object.
    995   heap->CreateFillerObjectAt(this->address() + new_size, size - new_size);
    996   if (Marking::IsBlack(Marking::MarkBitFrom(this))) {
    997     MemoryChunk::IncrementLiveBytesFromMutator(this->address(),
    998                                                new_size - size);
    999   }
   1000   return true;
   1001 }
   1002 
   1003 
   1004 void String::StringShortPrint(StringStream* accumulator) {
   1005   int len = length();
   1006   if (len > kMaxShortPrintLength) {
   1007     accumulator->Add("<Very long string[%u]>", len);
   1008     return;
   1009   }
   1010 
   1011   if (!LooksValid()) {
   1012     accumulator->Add("<Invalid String>");
   1013     return;
   1014   }
   1015 
   1016   StringInputBuffer buf(this);
   1017 
   1018   bool truncated = false;
   1019   if (len > kMaxShortPrintLength) {
   1020     len = kMaxShortPrintLength;
   1021     truncated = true;
   1022   }
   1023   bool ascii = true;
   1024   for (int i = 0; i < len; i++) {
   1025     int c = buf.GetNext();
   1026 
   1027     if (c < 32 || c >= 127) {
   1028       ascii = false;
   1029     }
   1030   }
   1031   buf.Reset(this);
   1032   if (ascii) {
   1033     accumulator->Add("<String[%u]: ", length());
   1034     for (int i = 0; i < len; i++) {
   1035       accumulator->Put(buf.GetNext());
   1036     }
   1037     accumulator->Put('>');
   1038   } else {
   1039     // Backslash indicates that the string contains control
   1040     // characters and that backslashes are therefore escaped.
   1041     accumulator->Add("<String[%u]\\: ", length());
   1042     for (int i = 0; i < len; i++) {
   1043       int c = buf.GetNext();
   1044       if (c == '\n') {
   1045         accumulator->Add("\\n");
   1046       } else if (c == '\r') {
   1047         accumulator->Add("\\r");
   1048       } else if (c == '\\') {
   1049         accumulator->Add("\\\\");
   1050       } else if (c < 32 || c > 126) {
   1051         accumulator->Add("\\x%02x", c);
   1052       } else {
   1053         accumulator->Put(c);
   1054       }
   1055     }
   1056     if (truncated) {
   1057       accumulator->Put('.');
   1058       accumulator->Put('.');
   1059       accumulator->Put('.');
   1060     }
   1061     accumulator->Put('>');
   1062   }
   1063   return;
   1064 }
   1065 
   1066 
   1067 void JSObject::JSObjectShortPrint(StringStream* accumulator) {
   1068   switch (map()->instance_type()) {
   1069     case JS_ARRAY_TYPE: {
   1070       double length = JSArray::cast(this)->length()->Number();
   1071       accumulator->Add("<JS Array[%u]>", static_cast<uint32_t>(length));
   1072       break;
   1073     }
   1074     case JS_WEAK_MAP_TYPE: {
   1075       accumulator->Add("<JS WeakMap>");
   1076       break;
   1077     }
   1078     case JS_REGEXP_TYPE: {
   1079       accumulator->Add("<JS RegExp>");
   1080       break;
   1081     }
   1082     case JS_FUNCTION_TYPE: {
   1083       Object* fun_name = JSFunction::cast(this)->shared()->name();
   1084       bool printed = false;
   1085       if (fun_name->IsString()) {
   1086         String* str = String::cast(fun_name);
   1087         if (str->length() > 0) {
   1088           accumulator->Add("<JS Function ");
   1089           accumulator->Put(str);
   1090           accumulator->Put('>');
   1091           printed = true;
   1092         }
   1093       }
   1094       if (!printed) {
   1095         accumulator->Add("<JS Function>");
   1096       }
   1097       break;
   1098     }
   1099     // All other JSObjects are rather similar to each other (JSObject,
   1100     // JSGlobalProxy, JSGlobalObject, JSUndetectableObject, JSValue).
   1101     default: {
   1102       Map* map_of_this = map();
   1103       Heap* heap = GetHeap();
   1104       Object* constructor = map_of_this->constructor();
   1105       bool printed = false;
   1106       if (constructor->IsHeapObject() &&
   1107           !heap->Contains(HeapObject::cast(constructor))) {
   1108         accumulator->Add("!!!INVALID CONSTRUCTOR!!!");
   1109       } else {
   1110         bool global_object = IsJSGlobalProxy();
   1111         if (constructor->IsJSFunction()) {
   1112           if (!heap->Contains(JSFunction::cast(constructor)->shared())) {
   1113             accumulator->Add("!!!INVALID SHARED ON CONSTRUCTOR!!!");
   1114           } else {
   1115             Object* constructor_name =
   1116                 JSFunction::cast(constructor)->shared()->name();
   1117             if (constructor_name->IsString()) {
   1118               String* str = String::cast(constructor_name);
   1119               if (str->length() > 0) {
   1120                 bool vowel = AnWord(str);
   1121                 accumulator->Add("<%sa%s ",
   1122                        global_object ? "Global Object: " : "",
   1123                        vowel ? "n" : "");
   1124                 accumulator->Put(str);
   1125                 printed = true;
   1126               }
   1127             }
   1128           }
   1129         }
   1130         if (!printed) {
   1131           accumulator->Add("<JS %sObject", global_object ? "Global " : "");
   1132         }
   1133       }
   1134       if (IsJSValue()) {
   1135         accumulator->Add(" value = ");
   1136         JSValue::cast(this)->value()->ShortPrint(accumulator);
   1137       }
   1138       accumulator->Put('>');
   1139       break;
   1140     }
   1141   }
   1142 }
   1143 
   1144 
   1145 void JSObject::PrintElementsTransition(
   1146     FILE* file, ElementsKind from_kind, FixedArrayBase* from_elements,
   1147     ElementsKind to_kind, FixedArrayBase* to_elements) {
   1148   if (from_kind != to_kind) {
   1149     PrintF(file, "elements transition [");
   1150     PrintElementsKind(file, from_kind);
   1151     PrintF(file, " -> ");
   1152     PrintElementsKind(file, to_kind);
   1153     PrintF(file, "] in ");
   1154     JavaScriptFrame::PrintTop(file, false, true);
   1155     PrintF(file, " for ");
   1156     ShortPrint(file);
   1157     PrintF(file, " from ");
   1158     from_elements->ShortPrint(file);
   1159     PrintF(file, " to ");
   1160     to_elements->ShortPrint(file);
   1161     PrintF(file, "\n");
   1162   }
   1163 }
   1164 
   1165 
   1166 void HeapObject::HeapObjectShortPrint(StringStream* accumulator) {
   1167   Heap* heap = GetHeap();
   1168   if (!heap->Contains(this)) {
   1169     accumulator->Add("!!!INVALID POINTER!!!");
   1170     return;
   1171   }
   1172   if (!heap->Contains(map())) {
   1173     accumulator->Add("!!!INVALID MAP!!!");
   1174     return;
   1175   }
   1176 
   1177   accumulator->Add("%p ", this);
   1178 
   1179   if (IsString()) {
   1180     String::cast(this)->StringShortPrint(accumulator);
   1181     return;
   1182   }
   1183   if (IsJSObject()) {
   1184     JSObject::cast(this)->JSObjectShortPrint(accumulator);
   1185     return;
   1186   }
   1187   switch (map()->instance_type()) {
   1188     case MAP_TYPE:
   1189       accumulator->Add("<Map(elements=%u)>", Map::cast(this)->elements_kind());
   1190       break;
   1191     case FIXED_ARRAY_TYPE:
   1192       accumulator->Add("<FixedArray[%u]>", FixedArray::cast(this)->length());
   1193       break;
   1194     case FIXED_DOUBLE_ARRAY_TYPE:
   1195       accumulator->Add("<FixedDoubleArray[%u]>",
   1196                        FixedDoubleArray::cast(this)->length());
   1197       break;
   1198     case BYTE_ARRAY_TYPE:
   1199       accumulator->Add("<ByteArray[%u]>", ByteArray::cast(this)->length());
   1200       break;
   1201     case FREE_SPACE_TYPE:
   1202       accumulator->Add("<FreeSpace[%u]>", FreeSpace::cast(this)->Size());
   1203       break;
   1204     case EXTERNAL_PIXEL_ARRAY_TYPE:
   1205       accumulator->Add("<ExternalPixelArray[%u]>",
   1206                        ExternalPixelArray::cast(this)->length());
   1207       break;
   1208     case EXTERNAL_BYTE_ARRAY_TYPE:
   1209       accumulator->Add("<ExternalByteArray[%u]>",
   1210                        ExternalByteArray::cast(this)->length());
   1211       break;
   1212     case EXTERNAL_UNSIGNED_BYTE_ARRAY_TYPE:
   1213       accumulator->Add("<ExternalUnsignedByteArray[%u]>",
   1214                        ExternalUnsignedByteArray::cast(this)->length());
   1215       break;
   1216     case EXTERNAL_SHORT_ARRAY_TYPE:
   1217       accumulator->Add("<ExternalShortArray[%u]>",
   1218                        ExternalShortArray::cast(this)->length());
   1219       break;
   1220     case EXTERNAL_UNSIGNED_SHORT_ARRAY_TYPE:
   1221       accumulator->Add("<ExternalUnsignedShortArray[%u]>",
   1222                        ExternalUnsignedShortArray::cast(this)->length());
   1223       break;
   1224     case EXTERNAL_INT_ARRAY_TYPE:
   1225       accumulator->Add("<ExternalIntArray[%u]>",
   1226                        ExternalIntArray::cast(this)->length());
   1227       break;
   1228     case EXTERNAL_UNSIGNED_INT_ARRAY_TYPE:
   1229       accumulator->Add("<ExternalUnsignedIntArray[%u]>",
   1230                        ExternalUnsignedIntArray::cast(this)->length());
   1231       break;
   1232     case EXTERNAL_FLOAT_ARRAY_TYPE:
   1233       accumulator->Add("<ExternalFloatArray[%u]>",
   1234                        ExternalFloatArray::cast(this)->length());
   1235       break;
   1236     case EXTERNAL_DOUBLE_ARRAY_TYPE:
   1237       accumulator->Add("<ExternalDoubleArray[%u]>",
   1238                        ExternalDoubleArray::cast(this)->length());
   1239       break;
   1240     case SHARED_FUNCTION_INFO_TYPE:
   1241       accumulator->Add("<SharedFunctionInfo>");
   1242       break;
   1243     case JS_MESSAGE_OBJECT_TYPE:
   1244       accumulator->Add("<JSMessageObject>");
   1245       break;
   1246 #define MAKE_STRUCT_CASE(NAME, Name, name) \
   1247   case NAME##_TYPE:                        \
   1248     accumulator->Put('<');                 \
   1249     accumulator->Add(#Name);               \
   1250     accumulator->Put('>');                 \
   1251     break;
   1252   STRUCT_LIST(MAKE_STRUCT_CASE)
   1253 #undef MAKE_STRUCT_CASE
   1254     case CODE_TYPE:
   1255       accumulator->Add("<Code>");
   1256       break;
   1257     case ODDBALL_TYPE: {
   1258       if (IsUndefined())
   1259         accumulator->Add("<undefined>");
   1260       else if (IsTheHole())
   1261         accumulator->Add("<the hole>");
   1262       else if (IsNull())
   1263         accumulator->Add("<null>");
   1264       else if (IsTrue())
   1265         accumulator->Add("<true>");
   1266       else if (IsFalse())
   1267         accumulator->Add("<false>");
   1268       else
   1269         accumulator->Add("<Odd Oddball>");
   1270       break;
   1271     }
   1272     case HEAP_NUMBER_TYPE:
   1273       accumulator->Add("<Number: ");
   1274       HeapNumber::cast(this)->HeapNumberPrint(accumulator);
   1275       accumulator->Put('>');
   1276       break;
   1277     case JS_PROXY_TYPE:
   1278       accumulator->Add("<JSProxy>");
   1279       break;
   1280     case JS_FUNCTION_PROXY_TYPE:
   1281       accumulator->Add("<JSFunctionProxy>");
   1282       break;
   1283     case FOREIGN_TYPE:
   1284       accumulator->Add("<Foreign>");
   1285       break;
   1286     case JS_GLOBAL_PROPERTY_CELL_TYPE:
   1287       accumulator->Add("Cell for ");
   1288       JSGlobalPropertyCell::cast(this)->value()->ShortPrint(accumulator);
   1289       break;
   1290     default:
   1291       accumulator->Add("<Other heap object (%d)>", map()->instance_type());
   1292       break;
   1293   }
   1294 }
   1295 
   1296 
   1297 void HeapObject::Iterate(ObjectVisitor* v) {
   1298   // Handle header
   1299   IteratePointer(v, kMapOffset);
   1300   // Handle object body
   1301   Map* m = map();
   1302   IterateBody(m->instance_type(), SizeFromMap(m), v);
   1303 }
   1304 
   1305 
   1306 void HeapObject::IterateBody(InstanceType type, int object_size,
   1307                              ObjectVisitor* v) {
   1308   // Avoiding <Type>::cast(this) because it accesses the map pointer field.
   1309   // During GC, the map pointer field is encoded.
   1310   if (type < FIRST_NONSTRING_TYPE) {
   1311     switch (type & kStringRepresentationMask) {
   1312       case kSeqStringTag:
   1313         break;
   1314       case kConsStringTag:
   1315         ConsString::BodyDescriptor::IterateBody(this, v);
   1316         break;
   1317       case kSlicedStringTag:
   1318         SlicedString::BodyDescriptor::IterateBody(this, v);
   1319         break;
   1320       case kExternalStringTag:
   1321         if ((type & kStringEncodingMask) == kAsciiStringTag) {
   1322           reinterpret_cast<ExternalAsciiString*>(this)->
   1323               ExternalAsciiStringIterateBody(v);
   1324         } else {
   1325           reinterpret_cast<ExternalTwoByteString*>(this)->
   1326               ExternalTwoByteStringIterateBody(v);
   1327         }
   1328         break;
   1329     }
   1330     return;
   1331   }
   1332 
   1333   switch (type) {
   1334     case FIXED_ARRAY_TYPE:
   1335       FixedArray::BodyDescriptor::IterateBody(this, object_size, v);
   1336       break;
   1337     case FIXED_DOUBLE_ARRAY_TYPE:
   1338       break;
   1339     case JS_OBJECT_TYPE:
   1340     case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
   1341     case JS_VALUE_TYPE:
   1342     case JS_DATE_TYPE:
   1343     case JS_ARRAY_TYPE:
   1344     case JS_SET_TYPE:
   1345     case JS_MAP_TYPE:
   1346     case JS_WEAK_MAP_TYPE:
   1347     case JS_REGEXP_TYPE:
   1348     case JS_GLOBAL_PROXY_TYPE:
   1349     case JS_GLOBAL_OBJECT_TYPE:
   1350     case JS_BUILTINS_OBJECT_TYPE:
   1351     case JS_MESSAGE_OBJECT_TYPE:
   1352       JSObject::BodyDescriptor::IterateBody(this, object_size, v);
   1353       break;
   1354     case JS_FUNCTION_TYPE:
   1355       reinterpret_cast<JSFunction*>(this)
   1356           ->JSFunctionIterateBody(object_size, v);
   1357       break;
   1358     case ODDBALL_TYPE:
   1359       Oddball::BodyDescriptor::IterateBody(this, v);
   1360       break;
   1361     case JS_PROXY_TYPE:
   1362       JSProxy::BodyDescriptor::IterateBody(this, v);
   1363       break;
   1364     case JS_FUNCTION_PROXY_TYPE:
   1365       JSFunctionProxy::BodyDescriptor::IterateBody(this, v);
   1366       break;
   1367     case FOREIGN_TYPE:
   1368       reinterpret_cast<Foreign*>(this)->ForeignIterateBody(v);
   1369       break;
   1370     case MAP_TYPE:
   1371       Map::BodyDescriptor::IterateBody(this, v);
   1372       break;
   1373     case CODE_TYPE:
   1374       reinterpret_cast<Code*>(this)->CodeIterateBody(v);
   1375       break;
   1376     case JS_GLOBAL_PROPERTY_CELL_TYPE:
   1377       JSGlobalPropertyCell::BodyDescriptor::IterateBody(this, v);
   1378       break;
   1379     case HEAP_NUMBER_TYPE:
   1380     case FILLER_TYPE:
   1381     case BYTE_ARRAY_TYPE:
   1382     case FREE_SPACE_TYPE:
   1383     case EXTERNAL_PIXEL_ARRAY_TYPE:
   1384     case EXTERNAL_BYTE_ARRAY_TYPE:
   1385     case EXTERNAL_UNSIGNED_BYTE_ARRAY_TYPE:
   1386     case EXTERNAL_SHORT_ARRAY_TYPE:
   1387     case EXTERNAL_UNSIGNED_SHORT_ARRAY_TYPE:
   1388     case EXTERNAL_INT_ARRAY_TYPE:
   1389     case EXTERNAL_UNSIGNED_INT_ARRAY_TYPE:
   1390     case EXTERNAL_FLOAT_ARRAY_TYPE:
   1391     case EXTERNAL_DOUBLE_ARRAY_TYPE:
   1392       break;
   1393     case SHARED_FUNCTION_INFO_TYPE: {
   1394       SharedFunctionInfo* shared = reinterpret_cast<SharedFunctionInfo*>(this);
   1395       shared->SharedFunctionInfoIterateBody(v);
   1396       break;
   1397     }
   1398 
   1399 #define MAKE_STRUCT_CASE(NAME, Name, name) \
   1400         case NAME##_TYPE:
   1401       STRUCT_LIST(MAKE_STRUCT_CASE)
   1402 #undef MAKE_STRUCT_CASE
   1403       StructBodyDescriptor::IterateBody(this, object_size, v);
   1404       break;
   1405     default:
   1406       PrintF("Unknown type: %d\n", type);
   1407       UNREACHABLE();
   1408   }
   1409 }
   1410 
   1411 
   1412 Object* HeapNumber::HeapNumberToBoolean() {
   1413   // NaN, +0, and -0 should return the false object
   1414 #if __BYTE_ORDER == __LITTLE_ENDIAN
   1415   union IeeeDoubleLittleEndianArchType u;
   1416 #elif __BYTE_ORDER == __BIG_ENDIAN
   1417   union IeeeDoubleBigEndianArchType u;
   1418 #endif
   1419   u.d = value();
   1420   if (u.bits.exp == 2047) {
   1421     // Detect NaN for IEEE double precision floating point.
   1422     if ((u.bits.man_low | u.bits.man_high) != 0)
   1423       return GetHeap()->false_value();
   1424   }
   1425   if (u.bits.exp == 0) {
   1426     // Detect +0, and -0 for IEEE double precision floating point.
   1427     if ((u.bits.man_low | u.bits.man_high) == 0)
   1428       return GetHeap()->false_value();
   1429   }
   1430   return GetHeap()->true_value();
   1431 }
   1432 
   1433 
   1434 void HeapNumber::HeapNumberPrint(FILE* out) {
   1435   PrintF(out, "%.16g", Number());
   1436 }
   1437 
   1438 
   1439 void HeapNumber::HeapNumberPrint(StringStream* accumulator) {
   1440   // The Windows version of vsnprintf can allocate when printing a %g string
   1441   // into a buffer that may not be big enough.  We don't want random memory
   1442   // allocation when producing post-crash stack traces, so we print into a
   1443   // buffer that is plenty big enough for any floating point number, then
   1444   // print that using vsnprintf (which may truncate but never allocate if
   1445   // there is no more space in the buffer).
   1446   EmbeddedVector<char, 100> buffer;
   1447   OS::SNPrintF(buffer, "%.16g", Number());
   1448   accumulator->Add("%s", buffer.start());
   1449 }
   1450 
   1451 
   1452 String* JSReceiver::class_name() {
   1453   if (IsJSFunction() && IsJSFunctionProxy()) {
   1454     return GetHeap()->function_class_symbol();
   1455   }
   1456   if (map()->constructor()->IsJSFunction()) {
   1457     JSFunction* constructor = JSFunction::cast(map()->constructor());
   1458     return String::cast(constructor->shared()->instance_class_name());
   1459   }
   1460   // If the constructor is not present, return "Object".
   1461   return GetHeap()->Object_symbol();
   1462 }
   1463 
   1464 
   1465 String* JSReceiver::constructor_name() {
   1466   if (map()->constructor()->IsJSFunction()) {
   1467     JSFunction* constructor = JSFunction::cast(map()->constructor());
   1468     String* name = String::cast(constructor->shared()->name());
   1469     if (name->length() > 0) return name;
   1470     String* inferred_name = constructor->shared()->inferred_name();
   1471     if (inferred_name->length() > 0) return inferred_name;
   1472     Object* proto = GetPrototype();
   1473     if (proto->IsJSObject()) return JSObject::cast(proto)->constructor_name();
   1474   }
   1475   // TODO(rossberg): what about proxies?
   1476   // If the constructor is not present, return "Object".
   1477   return GetHeap()->Object_symbol();
   1478 }
   1479 
   1480 
   1481 MaybeObject* JSObject::AddFastPropertyUsingMap(Map* new_map,
   1482                                                String* name,
   1483                                                Object* value) {
   1484   int index = new_map->PropertyIndexFor(name);
   1485   if (map()->unused_property_fields() == 0) {
   1486     ASSERT(map()->unused_property_fields() == 0);
   1487     int new_unused = new_map->unused_property_fields();
   1488     Object* values;
   1489     { MaybeObject* maybe_values =
   1490           properties()->CopySize(properties()->length() + new_unused + 1);
   1491       if (!maybe_values->ToObject(&values)) return maybe_values;
   1492     }
   1493     set_properties(FixedArray::cast(values));
   1494   }
   1495   set_map(new_map);
   1496   return FastPropertyAtPut(index, value);
   1497 }
   1498 
   1499 
   1500 static bool IsIdentifier(UnicodeCache* cache,
   1501                          unibrow::CharacterStream* buffer) {
   1502   // Checks whether the buffer contains an identifier (no escape).
   1503   if (!buffer->has_more()) return false;
   1504   if (!cache->IsIdentifierStart(buffer->GetNext())) {
   1505     return false;
   1506   }
   1507   while (buffer->has_more()) {
   1508     if (!cache->IsIdentifierPart(buffer->GetNext())) {
   1509       return false;
   1510     }
   1511   }
   1512   return true;
   1513 }
   1514 
   1515 
   1516 MaybeObject* JSObject::AddFastProperty(String* name,
   1517                                        Object* value,
   1518                                        PropertyAttributes attributes) {
   1519   ASSERT(!IsJSGlobalProxy());
   1520 
   1521   // Normalize the object if the name is an actual string (not the
   1522   // hidden symbols) and is not a real identifier.
   1523   Isolate* isolate = GetHeap()->isolate();
   1524   StringInputBuffer buffer(name);
   1525   if (!IsIdentifier(isolate->unicode_cache(), &buffer)
   1526       && name != isolate->heap()->hidden_symbol()) {
   1527     Object* obj;
   1528     { MaybeObject* maybe_obj =
   1529           NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
   1530       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   1531     }
   1532     return AddSlowProperty(name, value, attributes);
   1533   }
   1534 
   1535   DescriptorArray* old_descriptors = map()->instance_descriptors();
   1536   // Compute the new index for new field.
   1537   int index = map()->NextFreePropertyIndex();
   1538 
   1539   // Allocate new instance descriptors with (name, index) added
   1540   FieldDescriptor new_field(name, index, attributes);
   1541   Object* new_descriptors;
   1542   { MaybeObject* maybe_new_descriptors =
   1543         old_descriptors->CopyInsert(&new_field, REMOVE_TRANSITIONS);
   1544     if (!maybe_new_descriptors->ToObject(&new_descriptors)) {
   1545       return maybe_new_descriptors;
   1546     }
   1547   }
   1548 
   1549   // Only allow map transition if the object isn't the global object and there
   1550   // is not a transition for the name, or there's a transition for the name but
   1551   // it's unrelated to properties.
   1552   int descriptor_index = old_descriptors->Search(name);
   1553 
   1554   // Element transitions are stored in the descriptor for property "", which is
   1555   // not a identifier and should have forced a switch to slow properties above.
   1556   ASSERT(descriptor_index == DescriptorArray::kNotFound ||
   1557       old_descriptors->GetType(descriptor_index) != ELEMENTS_TRANSITION);
   1558   bool can_insert_transition = descriptor_index == DescriptorArray::kNotFound ||
   1559       old_descriptors->GetType(descriptor_index) == ELEMENTS_TRANSITION;
   1560   bool allow_map_transition =
   1561       can_insert_transition &&
   1562       (isolate->context()->global_context()->object_function()->map() != map());
   1563 
   1564   ASSERT(index < map()->inobject_properties() ||
   1565          (index - map()->inobject_properties()) < properties()->length() ||
   1566          map()->unused_property_fields() == 0);
   1567   // Allocate a new map for the object.
   1568   Object* r;
   1569   { MaybeObject* maybe_r = map()->CopyDropDescriptors();
   1570     if (!maybe_r->ToObject(&r)) return maybe_r;
   1571   }
   1572   Map* new_map = Map::cast(r);
   1573   if (allow_map_transition) {
   1574     // Allocate new instance descriptors for the old map with map transition.
   1575     MapTransitionDescriptor d(name, Map::cast(new_map), attributes);
   1576     Object* r;
   1577     { MaybeObject* maybe_r = old_descriptors->CopyInsert(&d, KEEP_TRANSITIONS);
   1578       if (!maybe_r->ToObject(&r)) return maybe_r;
   1579     }
   1580     old_descriptors = DescriptorArray::cast(r);
   1581   }
   1582 
   1583   if (map()->unused_property_fields() == 0) {
   1584     if (properties()->length() > MaxFastProperties()) {
   1585       Object* obj;
   1586       { MaybeObject* maybe_obj =
   1587             NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
   1588         if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   1589       }
   1590       return AddSlowProperty(name, value, attributes);
   1591     }
   1592     // Make room for the new value
   1593     Object* values;
   1594     { MaybeObject* maybe_values =
   1595           properties()->CopySize(properties()->length() + kFieldsAdded);
   1596       if (!maybe_values->ToObject(&values)) return maybe_values;
   1597     }
   1598     set_properties(FixedArray::cast(values));
   1599     new_map->set_unused_property_fields(kFieldsAdded - 1);
   1600   } else {
   1601     new_map->set_unused_property_fields(map()->unused_property_fields() - 1);
   1602   }
   1603   // We have now allocated all the necessary objects.
   1604   // All the changes can be applied at once, so they are atomic.
   1605   map()->set_instance_descriptors(old_descriptors);
   1606   new_map->set_instance_descriptors(DescriptorArray::cast(new_descriptors));
   1607   set_map(new_map);
   1608   return FastPropertyAtPut(index, value);
   1609 }
   1610 
   1611 
   1612 MaybeObject* JSObject::AddConstantFunctionProperty(
   1613     String* name,
   1614     JSFunction* function,
   1615     PropertyAttributes attributes) {
   1616   // Allocate new instance descriptors with (name, function) added
   1617   ConstantFunctionDescriptor d(name, function, attributes);
   1618   Object* new_descriptors;
   1619   { MaybeObject* maybe_new_descriptors =
   1620         map()->instance_descriptors()->CopyInsert(&d, REMOVE_TRANSITIONS);
   1621     if (!maybe_new_descriptors->ToObject(&new_descriptors)) {
   1622       return maybe_new_descriptors;
   1623     }
   1624   }
   1625 
   1626   // Allocate a new map for the object.
   1627   Object* new_map;
   1628   { MaybeObject* maybe_new_map = map()->CopyDropDescriptors();
   1629     if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
   1630   }
   1631 
   1632   DescriptorArray* descriptors = DescriptorArray::cast(new_descriptors);
   1633   Map::cast(new_map)->set_instance_descriptors(descriptors);
   1634   Map* old_map = map();
   1635   set_map(Map::cast(new_map));
   1636 
   1637   // If the old map is the global object map (from new Object()),
   1638   // then transitions are not added to it, so we are done.
   1639   Heap* heap = GetHeap();
   1640   if (old_map == heap->isolate()->context()->global_context()->
   1641       object_function()->map()) {
   1642     return function;
   1643   }
   1644 
   1645   // Do not add CONSTANT_TRANSITIONS to global objects
   1646   if (IsGlobalObject()) {
   1647     return function;
   1648   }
   1649 
   1650   // Add a CONSTANT_TRANSITION descriptor to the old map,
   1651   // so future assignments to this property on other objects
   1652   // of the same type will create a normal field, not a constant function.
   1653   // Don't do this for special properties, with non-trival attributes.
   1654   if (attributes != NONE) {
   1655     return function;
   1656   }
   1657   ConstTransitionDescriptor mark(name, Map::cast(new_map));
   1658   { MaybeObject* maybe_new_descriptors =
   1659         old_map->instance_descriptors()->CopyInsert(&mark, KEEP_TRANSITIONS);
   1660     if (!maybe_new_descriptors->ToObject(&new_descriptors)) {
   1661       // We have accomplished the main goal, so return success.
   1662       return function;
   1663     }
   1664   }
   1665   old_map->set_instance_descriptors(DescriptorArray::cast(new_descriptors));
   1666 
   1667   return function;
   1668 }
   1669 
   1670 
   1671 // Add property in slow mode
   1672 MaybeObject* JSObject::AddSlowProperty(String* name,
   1673                                        Object* value,
   1674                                        PropertyAttributes attributes) {
   1675   ASSERT(!HasFastProperties());
   1676   StringDictionary* dict = property_dictionary();
   1677   Object* store_value = value;
   1678   if (IsGlobalObject()) {
   1679     // In case name is an orphaned property reuse the cell.
   1680     int entry = dict->FindEntry(name);
   1681     if (entry != StringDictionary::kNotFound) {
   1682       store_value = dict->ValueAt(entry);
   1683       JSGlobalPropertyCell::cast(store_value)->set_value(value);
   1684       // Assign an enumeration index to the property and update
   1685       // SetNextEnumerationIndex.
   1686       int index = dict->NextEnumerationIndex();
   1687       PropertyDetails details = PropertyDetails(attributes, NORMAL, index);
   1688       dict->SetNextEnumerationIndex(index + 1);
   1689       dict->SetEntry(entry, name, store_value, details);
   1690       return value;
   1691     }
   1692     Heap* heap = GetHeap();
   1693     { MaybeObject* maybe_store_value =
   1694           heap->AllocateJSGlobalPropertyCell(value);
   1695       if (!maybe_store_value->ToObject(&store_value)) return maybe_store_value;
   1696     }
   1697     JSGlobalPropertyCell::cast(store_value)->set_value(value);
   1698   }
   1699   PropertyDetails details = PropertyDetails(attributes, NORMAL);
   1700   Object* result;
   1701   { MaybeObject* maybe_result = dict->Add(name, store_value, details);
   1702     if (!maybe_result->ToObject(&result)) return maybe_result;
   1703   }
   1704   if (dict != result) set_properties(StringDictionary::cast(result));
   1705   return value;
   1706 }
   1707 
   1708 
   1709 MaybeObject* JSObject::AddProperty(String* name,
   1710                                    Object* value,
   1711                                    PropertyAttributes attributes,
   1712                                    StrictModeFlag strict_mode) {
   1713   ASSERT(!IsJSGlobalProxy());
   1714   Map* map_of_this = map();
   1715   Heap* heap = GetHeap();
   1716   if (!map_of_this->is_extensible()) {
   1717     if (strict_mode == kNonStrictMode) {
   1718       return value;
   1719     } else {
   1720       Handle<Object> args[1] = {Handle<String>(name)};
   1721       return heap->isolate()->Throw(
   1722           *FACTORY->NewTypeError("object_not_extensible",
   1723                                  HandleVector(args, 1)));
   1724     }
   1725   }
   1726   if (HasFastProperties()) {
   1727     // Ensure the descriptor array does not get too big.
   1728     if (map_of_this->instance_descriptors()->number_of_descriptors() <
   1729         DescriptorArray::kMaxNumberOfDescriptors) {
   1730       if (value->IsJSFunction()) {
   1731         return AddConstantFunctionProperty(name,
   1732                                            JSFunction::cast(value),
   1733                                            attributes);
   1734       } else {
   1735         return AddFastProperty(name, value, attributes);
   1736       }
   1737     } else {
   1738       // Normalize the object to prevent very large instance descriptors.
   1739       // This eliminates unwanted N^2 allocation and lookup behavior.
   1740       Object* obj;
   1741       { MaybeObject* maybe_obj =
   1742             NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
   1743         if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   1744       }
   1745     }
   1746   }
   1747   return AddSlowProperty(name, value, attributes);
   1748 }
   1749 
   1750 
   1751 MaybeObject* JSObject::SetPropertyPostInterceptor(
   1752     String* name,
   1753     Object* value,
   1754     PropertyAttributes attributes,
   1755     StrictModeFlag strict_mode) {
   1756   // Check local property, ignore interceptor.
   1757   LookupResult result(GetIsolate());
   1758   LocalLookupRealNamedProperty(name, &result);
   1759   if (result.IsFound()) {
   1760     // An existing property, a map transition or a null descriptor was
   1761     // found.  Use set property to handle all these cases.
   1762     return SetProperty(&result, name, value, attributes, strict_mode);
   1763   }
   1764   bool found = false;
   1765   MaybeObject* result_object;
   1766   result_object = SetPropertyWithCallbackSetterInPrototypes(name,
   1767                                                             value,
   1768                                                             attributes,
   1769                                                             &found,
   1770                                                             strict_mode);
   1771   if (found) return result_object;
   1772   // Add a new real property.
   1773   return AddProperty(name, value, attributes, strict_mode);
   1774 }
   1775 
   1776 
   1777 MaybeObject* JSObject::ReplaceSlowProperty(String* name,
   1778                                            Object* value,
   1779                                            PropertyAttributes attributes) {
   1780   StringDictionary* dictionary = property_dictionary();
   1781   int old_index = dictionary->FindEntry(name);
   1782   int new_enumeration_index = 0;  // 0 means "Use the next available index."
   1783   if (old_index != -1) {
   1784     // All calls to ReplaceSlowProperty have had all transitions removed.
   1785     ASSERT(!dictionary->ContainsTransition(old_index));
   1786     new_enumeration_index = dictionary->DetailsAt(old_index).index();
   1787   }
   1788 
   1789   PropertyDetails new_details(attributes, NORMAL, new_enumeration_index);
   1790   return SetNormalizedProperty(name, value, new_details);
   1791 }
   1792 
   1793 
   1794 MaybeObject* JSObject::ConvertDescriptorToFieldAndMapTransition(
   1795     String* name,
   1796     Object* new_value,
   1797     PropertyAttributes attributes) {
   1798   Map* old_map = map();
   1799   Object* result;
   1800   { MaybeObject* maybe_result =
   1801         ConvertDescriptorToField(name, new_value, attributes);
   1802     if (!maybe_result->ToObject(&result)) return maybe_result;
   1803   }
   1804   // If we get to this point we have succeeded - do not return failure
   1805   // after this point.  Later stuff is optional.
   1806   if (!HasFastProperties()) {
   1807     return result;
   1808   }
   1809   // Do not add transitions to the map of "new Object()".
   1810   if (map() == GetIsolate()->context()->global_context()->
   1811       object_function()->map()) {
   1812     return result;
   1813   }
   1814 
   1815   MapTransitionDescriptor transition(name,
   1816                                      map(),
   1817                                      attributes);
   1818   Object* new_descriptors;
   1819   { MaybeObject* maybe_new_descriptors = old_map->instance_descriptors()->
   1820         CopyInsert(&transition, KEEP_TRANSITIONS);
   1821     if (!maybe_new_descriptors->ToObject(&new_descriptors)) {
   1822       return result;  // Yes, return _result_.
   1823     }
   1824   }
   1825   old_map->set_instance_descriptors(DescriptorArray::cast(new_descriptors));
   1826   return result;
   1827 }
   1828 
   1829 
   1830 MaybeObject* JSObject::ConvertDescriptorToField(String* name,
   1831                                                 Object* new_value,
   1832                                                 PropertyAttributes attributes) {
   1833   if (map()->unused_property_fields() == 0 &&
   1834       properties()->length() > MaxFastProperties()) {
   1835     Object* obj;
   1836     { MaybeObject* maybe_obj =
   1837           NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
   1838       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   1839     }
   1840     return ReplaceSlowProperty(name, new_value, attributes);
   1841   }
   1842 
   1843   int index = map()->NextFreePropertyIndex();
   1844   FieldDescriptor new_field(name, index, attributes);
   1845   // Make a new DescriptorArray replacing an entry with FieldDescriptor.
   1846   Object* descriptors_unchecked;
   1847   { MaybeObject* maybe_descriptors_unchecked = map()->instance_descriptors()->
   1848                                   CopyInsert(&new_field, REMOVE_TRANSITIONS);
   1849     if (!maybe_descriptors_unchecked->ToObject(&descriptors_unchecked)) {
   1850       return maybe_descriptors_unchecked;
   1851     }
   1852   }
   1853   DescriptorArray* new_descriptors =
   1854       DescriptorArray::cast(descriptors_unchecked);
   1855 
   1856   // Make a new map for the object.
   1857   Object* new_map_unchecked;
   1858   { MaybeObject* maybe_new_map_unchecked = map()->CopyDropDescriptors();
   1859     if (!maybe_new_map_unchecked->ToObject(&new_map_unchecked)) {
   1860       return maybe_new_map_unchecked;
   1861     }
   1862   }
   1863   Map* new_map = Map::cast(new_map_unchecked);
   1864   new_map->set_instance_descriptors(new_descriptors);
   1865 
   1866   // Make new properties array if necessary.
   1867   FixedArray* new_properties = 0;  // Will always be NULL or a valid pointer.
   1868   int new_unused_property_fields = map()->unused_property_fields() - 1;
   1869   if (map()->unused_property_fields() == 0) {
   1870     new_unused_property_fields = kFieldsAdded - 1;
   1871     Object* new_properties_object;
   1872     { MaybeObject* maybe_new_properties_object =
   1873           properties()->CopySize(properties()->length() + kFieldsAdded);
   1874       if (!maybe_new_properties_object->ToObject(&new_properties_object)) {
   1875         return maybe_new_properties_object;
   1876       }
   1877     }
   1878     new_properties = FixedArray::cast(new_properties_object);
   1879   }
   1880 
   1881   // Update pointers to commit changes.
   1882   // Object points to the new map.
   1883   new_map->set_unused_property_fields(new_unused_property_fields);
   1884   set_map(new_map);
   1885   if (new_properties) {
   1886     set_properties(FixedArray::cast(new_properties));
   1887   }
   1888   return FastPropertyAtPut(index, new_value);
   1889 }
   1890 
   1891 
   1892 
   1893 MaybeObject* JSObject::SetPropertyWithInterceptor(
   1894     String* name,
   1895     Object* value,
   1896     PropertyAttributes attributes,
   1897     StrictModeFlag strict_mode) {
   1898   Isolate* isolate = GetIsolate();
   1899   HandleScope scope(isolate);
   1900   Handle<JSObject> this_handle(this);
   1901   Handle<String> name_handle(name);
   1902   Handle<Object> value_handle(value, isolate);
   1903   Handle<InterceptorInfo> interceptor(GetNamedInterceptor());
   1904   if (!interceptor->setter()->IsUndefined()) {
   1905     LOG(isolate, ApiNamedPropertyAccess("interceptor-named-set", this, name));
   1906     CustomArguments args(isolate, interceptor->data(), this, this);
   1907     v8::AccessorInfo info(args.end());
   1908     v8::NamedPropertySetter setter =
   1909         v8::ToCData<v8::NamedPropertySetter>(interceptor->setter());
   1910     v8::Handle<v8::Value> result;
   1911     {
   1912       // Leaving JavaScript.
   1913       VMState state(isolate, EXTERNAL);
   1914       Handle<Object> value_unhole(value->IsTheHole() ?
   1915                                   isolate->heap()->undefined_value() :
   1916                                   value,
   1917                                   isolate);
   1918       result = setter(v8::Utils::ToLocal(name_handle),
   1919                       v8::Utils::ToLocal(value_unhole),
   1920                       info);
   1921     }
   1922     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   1923     if (!result.IsEmpty()) return *value_handle;
   1924   }
   1925   MaybeObject* raw_result =
   1926       this_handle->SetPropertyPostInterceptor(*name_handle,
   1927                                               *value_handle,
   1928                                               attributes,
   1929                                               strict_mode);
   1930   RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   1931   return raw_result;
   1932 }
   1933 
   1934 
   1935 Handle<Object> JSReceiver::SetProperty(Handle<JSReceiver> object,
   1936                                        Handle<String> key,
   1937                                        Handle<Object> value,
   1938                                        PropertyAttributes attributes,
   1939                                        StrictModeFlag strict_mode) {
   1940   CALL_HEAP_FUNCTION(object->GetIsolate(),
   1941                      object->SetProperty(*key, *value, attributes, strict_mode),
   1942                      Object);
   1943 }
   1944 
   1945 
   1946 MaybeObject* JSReceiver::SetProperty(String* name,
   1947                                      Object* value,
   1948                                      PropertyAttributes attributes,
   1949                                      StrictModeFlag strict_mode) {
   1950   LookupResult result(GetIsolate());
   1951   LocalLookup(name, &result);
   1952   return SetProperty(&result, name, value, attributes, strict_mode);
   1953 }
   1954 
   1955 
   1956 MaybeObject* JSObject::SetPropertyWithCallback(Object* structure,
   1957                                                String* name,
   1958                                                Object* value,
   1959                                                JSObject* holder,
   1960                                                StrictModeFlag strict_mode) {
   1961   Isolate* isolate = GetIsolate();
   1962   HandleScope scope(isolate);
   1963 
   1964   // We should never get here to initialize a const with the hole
   1965   // value since a const declaration would conflict with the setter.
   1966   ASSERT(!value->IsTheHole());
   1967   Handle<Object> value_handle(value, isolate);
   1968 
   1969   // To accommodate both the old and the new api we switch on the
   1970   // data structure used to store the callbacks.  Eventually foreign
   1971   // callbacks should be phased out.
   1972   if (structure->IsForeign()) {
   1973     AccessorDescriptor* callback =
   1974         reinterpret_cast<AccessorDescriptor*>(
   1975             Foreign::cast(structure)->foreign_address());
   1976     MaybeObject* obj = (callback->setter)(this,  value, callback->data);
   1977     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   1978     if (obj->IsFailure()) return obj;
   1979     return *value_handle;
   1980   }
   1981 
   1982   if (structure->IsAccessorInfo()) {
   1983     // api style callbacks
   1984     AccessorInfo* data = AccessorInfo::cast(structure);
   1985     Object* call_obj = data->setter();
   1986     v8::AccessorSetter call_fun = v8::ToCData<v8::AccessorSetter>(call_obj);
   1987     if (call_fun == NULL) return value;
   1988     Handle<String> key(name);
   1989     LOG(isolate, ApiNamedPropertyAccess("store", this, name));
   1990     CustomArguments args(isolate, data->data(), this, JSObject::cast(holder));
   1991     v8::AccessorInfo info(args.end());
   1992     {
   1993       // Leaving JavaScript.
   1994       VMState state(isolate, EXTERNAL);
   1995       call_fun(v8::Utils::ToLocal(key),
   1996                v8::Utils::ToLocal(value_handle),
   1997                info);
   1998     }
   1999     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   2000     return *value_handle;
   2001   }
   2002 
   2003   if (structure->IsAccessorPair()) {
   2004     Object* setter = AccessorPair::cast(structure)->setter();
   2005     if (setter->IsSpecFunction()) {
   2006       // TODO(rossberg): nicer would be to cast to some JSCallable here...
   2007      return SetPropertyWithDefinedSetter(JSReceiver::cast(setter), value);
   2008     } else {
   2009       if (strict_mode == kNonStrictMode) {
   2010         return value;
   2011       }
   2012       Handle<String> key(name);
   2013       Handle<Object> holder_handle(holder, isolate);
   2014       Handle<Object> args[2] = { key, holder_handle };
   2015       return isolate->Throw(
   2016           *isolate->factory()->NewTypeError("no_setter_in_callback",
   2017                                             HandleVector(args, 2)));
   2018     }
   2019   }
   2020 
   2021   UNREACHABLE();
   2022   return NULL;
   2023 }
   2024 
   2025 
   2026 MaybeObject* JSReceiver::SetPropertyWithDefinedSetter(JSReceiver* setter,
   2027                                                       Object* value) {
   2028   Isolate* isolate = GetIsolate();
   2029   Handle<Object> value_handle(value, isolate);
   2030   Handle<JSReceiver> fun(setter, isolate);
   2031   Handle<JSReceiver> self(this, isolate);
   2032 #ifdef ENABLE_DEBUGGER_SUPPORT
   2033   Debug* debug = isolate->debug();
   2034   // Handle stepping into a setter if step into is active.
   2035   // TODO(rossberg): should this apply to getters that are function proxies?
   2036   if (debug->StepInActive() && fun->IsJSFunction()) {
   2037     debug->HandleStepIn(
   2038         Handle<JSFunction>::cast(fun), Handle<Object>::null(), 0, false);
   2039   }
   2040 #endif
   2041   bool has_pending_exception;
   2042   Handle<Object> argv[] = { value_handle };
   2043   Execution::Call(fun, self, ARRAY_SIZE(argv), argv, &has_pending_exception);
   2044   // Check for pending exception and return the result.
   2045   if (has_pending_exception) return Failure::Exception();
   2046   return *value_handle;
   2047 }
   2048 
   2049 
   2050 void JSObject::LookupCallbackSetterInPrototypes(String* name,
   2051                                                 LookupResult* result) {
   2052   Heap* heap = GetHeap();
   2053   for (Object* pt = GetPrototype();
   2054        pt != heap->null_value();
   2055        pt = pt->GetPrototype()) {
   2056     if (pt->IsJSProxy()) {
   2057       return result->HandlerResult(JSProxy::cast(pt));
   2058     }
   2059     JSObject::cast(pt)->LocalLookupRealNamedProperty(name, result);
   2060     if (result->IsProperty()) {
   2061       if (result->type() == CALLBACKS && !result->IsReadOnly()) return;
   2062       // Found non-callback or read-only callback, stop looking.
   2063       break;
   2064     }
   2065   }
   2066   result->NotFound();
   2067 }
   2068 
   2069 
   2070 MaybeObject* JSObject::SetElementWithCallbackSetterInPrototypes(
   2071     uint32_t index,
   2072     Object* value,
   2073     bool* found,
   2074     StrictModeFlag strict_mode) {
   2075   Heap* heap = GetHeap();
   2076   for (Object* pt = GetPrototype();
   2077        pt != heap->null_value();
   2078        pt = pt->GetPrototype()) {
   2079     if (pt->IsJSProxy()) {
   2080       String* name;
   2081       MaybeObject* maybe = GetHeap()->Uint32ToString(index);
   2082       if (!maybe->To<String>(&name)) {
   2083         *found = true;  // Force abort
   2084         return maybe;
   2085       }
   2086       return JSProxy::cast(pt)->SetPropertyWithHandlerIfDefiningSetter(
   2087           name, value, NONE, strict_mode, found);
   2088     }
   2089     if (!JSObject::cast(pt)->HasDictionaryElements()) {
   2090       continue;
   2091     }
   2092     SeededNumberDictionary* dictionary =
   2093         JSObject::cast(pt)->element_dictionary();
   2094     int entry = dictionary->FindEntry(index);
   2095     if (entry != SeededNumberDictionary::kNotFound) {
   2096       PropertyDetails details = dictionary->DetailsAt(entry);
   2097       if (details.type() == CALLBACKS) {
   2098         *found = true;
   2099         return SetElementWithCallback(dictionary->ValueAt(entry),
   2100                                       index,
   2101                                       value,
   2102                                       JSObject::cast(pt),
   2103                                       strict_mode);
   2104       }
   2105     }
   2106   }
   2107   *found = false;
   2108   return heap->the_hole_value();
   2109 }
   2110 
   2111 MaybeObject* JSObject::SetPropertyWithCallbackSetterInPrototypes(
   2112     String* name,
   2113     Object* value,
   2114     PropertyAttributes attributes,
   2115     bool* found,
   2116     StrictModeFlag strict_mode) {
   2117   Heap* heap = GetHeap();
   2118   // We could not find a local property so let's check whether there is an
   2119   // accessor that wants to handle the property.
   2120   LookupResult accessor_result(heap->isolate());
   2121   LookupCallbackSetterInPrototypes(name, &accessor_result);
   2122   if (accessor_result.IsFound()) {
   2123     *found = true;
   2124     if (accessor_result.type() == CALLBACKS) {
   2125       return SetPropertyWithCallback(accessor_result.GetCallbackObject(),
   2126                                      name,
   2127                                      value,
   2128                                      accessor_result.holder(),
   2129                                      strict_mode);
   2130     } else if (accessor_result.type() == HANDLER) {
   2131       // There is a proxy in the prototype chain. Invoke its
   2132       // getPropertyDescriptor trap.
   2133       bool found = false;
   2134       // SetPropertyWithHandlerIfDefiningSetter can cause GC,
   2135       // make sure to use the handlified references after calling
   2136       // the function.
   2137       Handle<JSObject> self(this);
   2138       Handle<String> hname(name);
   2139       Handle<Object> hvalue(value);
   2140       MaybeObject* result =
   2141           accessor_result.proxy()->SetPropertyWithHandlerIfDefiningSetter(
   2142               name, value, attributes, strict_mode, &found);
   2143       if (found) return result;
   2144       // The proxy does not define the property as an accessor.
   2145       // Consequently, it has no effect on setting the receiver.
   2146       return self->AddProperty(*hname, *hvalue, attributes, strict_mode);
   2147     }
   2148   }
   2149   *found = false;
   2150   return heap->the_hole_value();
   2151 }
   2152 
   2153 
   2154 void JSObject::LookupInDescriptor(String* name, LookupResult* result) {
   2155   DescriptorArray* descriptors = map()->instance_descriptors();
   2156   int number = descriptors->SearchWithCache(name);
   2157   if (number != DescriptorArray::kNotFound) {
   2158     result->DescriptorResult(this, descriptors->GetDetails(number), number);
   2159   } else {
   2160     result->NotFound();
   2161   }
   2162 }
   2163 
   2164 
   2165 void Map::LookupInDescriptors(JSObject* holder,
   2166                               String* name,
   2167                               LookupResult* result) {
   2168   DescriptorArray* descriptors = instance_descriptors();
   2169   DescriptorLookupCache* cache =
   2170       GetHeap()->isolate()->descriptor_lookup_cache();
   2171   int number = cache->Lookup(descriptors, name);
   2172   if (number == DescriptorLookupCache::kAbsent) {
   2173     number = descriptors->Search(name);
   2174     cache->Update(descriptors, name, number);
   2175   }
   2176   if (number != DescriptorArray::kNotFound) {
   2177     result->DescriptorResult(holder, descriptors->GetDetails(number), number);
   2178   } else {
   2179     result->NotFound();
   2180   }
   2181 }
   2182 
   2183 
   2184 static bool ContainsMap(MapHandleList* maps, Handle<Map> map) {
   2185   ASSERT(!map.is_null());
   2186   for (int i = 0; i < maps->length(); ++i) {
   2187     if (!maps->at(i).is_null() && maps->at(i).is_identical_to(map)) return true;
   2188   }
   2189   return false;
   2190 }
   2191 
   2192 
   2193 template <class T>
   2194 static Handle<T> MaybeNull(T* p) {
   2195   if (p == NULL) return Handle<T>::null();
   2196   return Handle<T>(p);
   2197 }
   2198 
   2199 
   2200 Handle<Map> Map::FindTransitionedMap(MapHandleList* candidates) {
   2201   ElementsKind elms_kind = elements_kind();
   2202   if (elms_kind == FAST_DOUBLE_ELEMENTS) {
   2203     bool dummy = true;
   2204     Handle<Map> fast_map =
   2205         MaybeNull(LookupElementsTransitionMap(FAST_ELEMENTS, &dummy));
   2206     if (!fast_map.is_null() && ContainsMap(candidates, fast_map)) {
   2207       return fast_map;
   2208     }
   2209     return Handle<Map>::null();
   2210   }
   2211   if (elms_kind == FAST_SMI_ONLY_ELEMENTS) {
   2212     bool dummy = true;
   2213     Handle<Map> double_map =
   2214         MaybeNull(LookupElementsTransitionMap(FAST_DOUBLE_ELEMENTS, &dummy));
   2215     // In the current implementation, if the DOUBLE map doesn't exist, the
   2216     // FAST map can't exist either.
   2217     if (double_map.is_null()) return Handle<Map>::null();
   2218     Handle<Map> fast_map =
   2219         MaybeNull(double_map->LookupElementsTransitionMap(FAST_ELEMENTS,
   2220                                                           &dummy));
   2221     if (!fast_map.is_null() && ContainsMap(candidates, fast_map)) {
   2222       return fast_map;
   2223     }
   2224     if (ContainsMap(candidates, double_map)) return double_map;
   2225   }
   2226   return Handle<Map>::null();
   2227 }
   2228 
   2229 static Map* GetElementsTransitionMapFromDescriptor(Object* descriptor_contents,
   2230                                                    ElementsKind elements_kind) {
   2231   if (descriptor_contents->IsMap()) {
   2232     Map* map = Map::cast(descriptor_contents);
   2233     if (map->elements_kind() == elements_kind) {
   2234       return map;
   2235     }
   2236     return NULL;
   2237   }
   2238 
   2239   FixedArray* map_array = FixedArray::cast(descriptor_contents);
   2240   for (int i = 0; i < map_array->length(); ++i) {
   2241     Object* current = map_array->get(i);
   2242     // Skip undefined slots, they are sentinels for reclaimed maps.
   2243     if (!current->IsUndefined()) {
   2244       Map* current_map = Map::cast(map_array->get(i));
   2245       if (current_map->elements_kind() == elements_kind) {
   2246         return current_map;
   2247       }
   2248     }
   2249   }
   2250 
   2251   return NULL;
   2252 }
   2253 
   2254 
   2255 static MaybeObject* AddElementsTransitionMapToDescriptor(
   2256     Object* descriptor_contents,
   2257     Map* new_map) {
   2258   // Nothing was in the descriptor for an ELEMENTS_TRANSITION,
   2259   // simply add the map.
   2260   if (descriptor_contents == NULL) {
   2261     return new_map;
   2262   }
   2263 
   2264   // There was already a map in the descriptor, create a 2-element FixedArray
   2265   // to contain the existing map plus the new one.
   2266   FixedArray* new_array;
   2267   Heap* heap = new_map->GetHeap();
   2268   if (descriptor_contents->IsMap()) {
   2269     // Must tenure, DescriptorArray expects no new-space objects.
   2270     MaybeObject* maybe_new_array = heap->AllocateFixedArray(2, TENURED);
   2271     if (!maybe_new_array->To<FixedArray>(&new_array)) {
   2272       return maybe_new_array;
   2273     }
   2274     new_array->set(0, descriptor_contents);
   2275     new_array->set(1, new_map);
   2276     return new_array;
   2277   }
   2278 
   2279   // The descriptor already contained a list of maps for different ElementKinds
   2280   // of ELEMENTS_TRANSITION, first check the existing array for an undefined
   2281   // slot, and if that's not available, create a FixedArray to hold the existing
   2282   // maps plus the new one and fill it in.
   2283   FixedArray* array = FixedArray::cast(descriptor_contents);
   2284   for (int i = 0; i < array->length(); ++i) {
   2285     if (array->get(i)->IsUndefined()) {
   2286       array->set(i, new_map);
   2287       return array;
   2288     }
   2289   }
   2290 
   2291   // Must tenure, DescriptorArray expects no new-space objects.
   2292   MaybeObject* maybe_new_array =
   2293       heap->AllocateFixedArray(array->length() + 1, TENURED);
   2294   if (!maybe_new_array->To<FixedArray>(&new_array)) {
   2295     return maybe_new_array;
   2296   }
   2297   int i = 0;
   2298   while (i < array->length()) {
   2299     new_array->set(i, array->get(i));
   2300     ++i;
   2301   }
   2302   new_array->set(i, new_map);
   2303   return new_array;
   2304 }
   2305 
   2306 
   2307 String* Map::elements_transition_sentinel_name() {
   2308   return GetHeap()->empty_symbol();
   2309 }
   2310 
   2311 
   2312 Object* Map::GetDescriptorContents(String* sentinel_name,
   2313                                    bool* safe_to_add_transition) {
   2314   // Get the cached index for the descriptors lookup, or find and cache it.
   2315   DescriptorArray* descriptors = instance_descriptors();
   2316   DescriptorLookupCache* cache = GetIsolate()->descriptor_lookup_cache();
   2317   int index = cache->Lookup(descriptors, sentinel_name);
   2318   if (index == DescriptorLookupCache::kAbsent) {
   2319     index = descriptors->Search(sentinel_name);
   2320     cache->Update(descriptors, sentinel_name, index);
   2321   }
   2322   // If the transition already exists, return its descriptor.
   2323   if (index != DescriptorArray::kNotFound) {
   2324     PropertyDetails details(descriptors->GetDetails(index));
   2325     if (details.type() == ELEMENTS_TRANSITION) {
   2326       return descriptors->GetValue(index);
   2327     } else {
   2328       if (safe_to_add_transition != NULL) {
   2329         *safe_to_add_transition = false;
   2330       }
   2331     }
   2332   }
   2333   return NULL;
   2334 }
   2335 
   2336 
   2337 Map* Map::LookupElementsTransitionMap(ElementsKind elements_kind,
   2338                                       bool* safe_to_add_transition) {
   2339   // Special case: indirect SMI->FAST transition (cf. comment in
   2340   // AddElementsTransition()).
   2341   if (this->elements_kind() == FAST_SMI_ONLY_ELEMENTS &&
   2342       elements_kind == FAST_ELEMENTS) {
   2343     Map* double_map = this->LookupElementsTransitionMap(FAST_DOUBLE_ELEMENTS,
   2344                                                         safe_to_add_transition);
   2345     if (double_map == NULL) return double_map;
   2346     return double_map->LookupElementsTransitionMap(FAST_ELEMENTS,
   2347                                                    safe_to_add_transition);
   2348   }
   2349   Object* descriptor_contents = GetDescriptorContents(
   2350       elements_transition_sentinel_name(), safe_to_add_transition);
   2351   if (descriptor_contents != NULL) {
   2352     Map* maybe_transition_map =
   2353         GetElementsTransitionMapFromDescriptor(descriptor_contents,
   2354                                                elements_kind);
   2355     ASSERT(maybe_transition_map == NULL || maybe_transition_map->IsMap());
   2356     return maybe_transition_map;
   2357   }
   2358   return NULL;
   2359 }
   2360 
   2361 
   2362 MaybeObject* Map::AddElementsTransition(ElementsKind elements_kind,
   2363                                         Map* transitioned_map) {
   2364   // The map transition graph should be a tree, therefore the transition
   2365   // from SMI to FAST elements is not done directly, but by going through
   2366   // DOUBLE elements first.
   2367   if (this->elements_kind() == FAST_SMI_ONLY_ELEMENTS &&
   2368       elements_kind == FAST_ELEMENTS) {
   2369     bool safe_to_add = true;
   2370     Map* double_map = this->LookupElementsTransitionMap(
   2371         FAST_DOUBLE_ELEMENTS, &safe_to_add);
   2372     // This method is only called when safe_to_add_transition has been found
   2373     // to be true earlier.
   2374     ASSERT(safe_to_add);
   2375 
   2376     if (double_map == NULL) {
   2377       MaybeObject* maybe_map = this->CopyDropTransitions();
   2378       if (!maybe_map->To(&double_map)) return maybe_map;
   2379       double_map->set_elements_kind(FAST_DOUBLE_ELEMENTS);
   2380       MaybeObject* maybe_double_transition = this->AddElementsTransition(
   2381           FAST_DOUBLE_ELEMENTS, double_map);
   2382       if (maybe_double_transition->IsFailure()) return maybe_double_transition;
   2383     }
   2384     return double_map->AddElementsTransition(FAST_ELEMENTS, transitioned_map);
   2385   }
   2386 
   2387   bool safe_to_add_transition = true;
   2388   Object* descriptor_contents = GetDescriptorContents(
   2389       elements_transition_sentinel_name(), &safe_to_add_transition);
   2390   // This method is only called when safe_to_add_transition has been found
   2391   // to be true earlier.
   2392   ASSERT(safe_to_add_transition);
   2393   MaybeObject* maybe_new_contents =
   2394       AddElementsTransitionMapToDescriptor(descriptor_contents,
   2395                                            transitioned_map);
   2396   Object* new_contents;
   2397   if (!maybe_new_contents->ToObject(&new_contents)) {
   2398     return maybe_new_contents;
   2399   }
   2400 
   2401   ElementsTransitionDescriptor desc(elements_transition_sentinel_name(),
   2402                                     new_contents);
   2403   Object* new_descriptors;
   2404   MaybeObject* maybe_new_descriptors =
   2405       instance_descriptors()->CopyInsert(&desc, KEEP_TRANSITIONS);
   2406   if (!maybe_new_descriptors->ToObject(&new_descriptors)) {
   2407     return maybe_new_descriptors;
   2408   }
   2409   set_instance_descriptors(DescriptorArray::cast(new_descriptors));
   2410   return this;
   2411 }
   2412 
   2413 
   2414 Handle<Map> JSObject::GetElementsTransitionMap(Handle<JSObject> object,
   2415                                                ElementsKind to_kind) {
   2416   Isolate* isolate = object->GetIsolate();
   2417   CALL_HEAP_FUNCTION(isolate,
   2418                      object->GetElementsTransitionMap(isolate, to_kind),
   2419                      Map);
   2420 }
   2421 
   2422 
   2423 MaybeObject* JSObject::GetElementsTransitionMapSlow(ElementsKind to_kind) {
   2424   Map* current_map = map();
   2425   ElementsKind from_kind = current_map->elements_kind();
   2426 
   2427   if (from_kind == to_kind) return current_map;
   2428 
   2429   // Only objects with FastProperties can have DescriptorArrays and can track
   2430   // element-related maps. Also don't add descriptors to maps that are shared.
   2431   bool safe_to_add_transition = HasFastProperties() &&
   2432       !current_map->IsUndefined() &&
   2433       !current_map->is_shared();
   2434 
   2435   // Prevent long chains of DICTIONARY -> FAST_ELEMENTS maps caused by objects
   2436   // with elements that switch back and forth between dictionary and fast
   2437   // element mode.
   2438   if (from_kind == DICTIONARY_ELEMENTS && to_kind == FAST_ELEMENTS) {
   2439     safe_to_add_transition = false;
   2440   }
   2441 
   2442   if (safe_to_add_transition) {
   2443     // It's only safe to manipulate the descriptor array if it would be
   2444     // safe to add a transition.
   2445     Map* maybe_transition_map = current_map->LookupElementsTransitionMap(
   2446         to_kind, &safe_to_add_transition);
   2447     if (maybe_transition_map != NULL) {
   2448       return maybe_transition_map;
   2449     }
   2450   }
   2451 
   2452   Map* new_map = NULL;
   2453 
   2454   // No transition to an existing map for the given ElementsKind. Make a new
   2455   // one.
   2456   { MaybeObject* maybe_map = current_map->CopyDropTransitions();
   2457     if (!maybe_map->To(&new_map)) return maybe_map;
   2458   }
   2459 
   2460   new_map->set_elements_kind(to_kind);
   2461 
   2462   // Only remember the map transition if the object's map is NOT equal to the
   2463   // global object_function's map and there is not an already existing
   2464   // non-matching element transition.
   2465   Context* global_context = GetIsolate()->context()->global_context();
   2466   bool allow_map_transition = safe_to_add_transition &&
   2467       (global_context->object_function()->map() != map());
   2468   if (allow_map_transition) {
   2469     MaybeObject* maybe_transition =
   2470         current_map->AddElementsTransition(to_kind, new_map);
   2471     if (maybe_transition->IsFailure()) return maybe_transition;
   2472   }
   2473   return new_map;
   2474 }
   2475 
   2476 
   2477 void JSObject::LocalLookupRealNamedProperty(String* name,
   2478                                             LookupResult* result) {
   2479   if (IsJSGlobalProxy()) {
   2480     Object* proto = GetPrototype();
   2481     if (proto->IsNull()) return result->NotFound();
   2482     ASSERT(proto->IsJSGlobalObject());
   2483     // A GlobalProxy's prototype should always be a proper JSObject.
   2484     return JSObject::cast(proto)->LocalLookupRealNamedProperty(name, result);
   2485   }
   2486 
   2487   if (HasFastProperties()) {
   2488     LookupInDescriptor(name, result);
   2489     if (result->IsFound()) {
   2490       // A property, a map transition or a null descriptor was found.
   2491       // We return all of these result types because
   2492       // LocalLookupRealNamedProperty is used when setting properties
   2493       // where map transitions and null descriptors are handled.
   2494       ASSERT(result->holder() == this && result->type() != NORMAL);
   2495       // Disallow caching for uninitialized constants. These can only
   2496       // occur as fields.
   2497       if (result->IsReadOnly() && result->type() == FIELD &&
   2498           FastPropertyAt(result->GetFieldIndex())->IsTheHole()) {
   2499         result->DisallowCaching();
   2500       }
   2501       return;
   2502     }
   2503   } else {
   2504     int entry = property_dictionary()->FindEntry(name);
   2505     if (entry != StringDictionary::kNotFound) {
   2506       Object* value = property_dictionary()->ValueAt(entry);
   2507       if (IsGlobalObject()) {
   2508         PropertyDetails d = property_dictionary()->DetailsAt(entry);
   2509         if (d.IsDeleted()) {
   2510           result->NotFound();
   2511           return;
   2512         }
   2513         value = JSGlobalPropertyCell::cast(value)->value();
   2514       }
   2515       // Make sure to disallow caching for uninitialized constants
   2516       // found in the dictionary-mode objects.
   2517       if (value->IsTheHole()) result->DisallowCaching();
   2518       result->DictionaryResult(this, entry);
   2519       return;
   2520     }
   2521   }
   2522   result->NotFound();
   2523 }
   2524 
   2525 
   2526 void JSObject::LookupRealNamedProperty(String* name, LookupResult* result) {
   2527   LocalLookupRealNamedProperty(name, result);
   2528   if (result->IsProperty()) return;
   2529 
   2530   LookupRealNamedPropertyInPrototypes(name, result);
   2531 }
   2532 
   2533 
   2534 void JSObject::LookupRealNamedPropertyInPrototypes(String* name,
   2535                                                    LookupResult* result) {
   2536   Heap* heap = GetHeap();
   2537   for (Object* pt = GetPrototype();
   2538        pt != heap->null_value();
   2539        pt = JSObject::cast(pt)->GetPrototype()) {
   2540     JSObject::cast(pt)->LocalLookupRealNamedProperty(name, result);
   2541     if (result->IsProperty() && (result->type() != INTERCEPTOR)) return;
   2542   }
   2543   result->NotFound();
   2544 }
   2545 
   2546 
   2547 // We only need to deal with CALLBACKS and INTERCEPTORS
   2548 MaybeObject* JSObject::SetPropertyWithFailedAccessCheck(
   2549     LookupResult* result,
   2550     String* name,
   2551     Object* value,
   2552     bool check_prototype,
   2553     StrictModeFlag strict_mode) {
   2554   if (check_prototype && !result->IsProperty()) {
   2555     LookupCallbackSetterInPrototypes(name, result);
   2556   }
   2557 
   2558   if (result->IsProperty()) {
   2559     if (!result->IsReadOnly()) {
   2560       switch (result->type()) {
   2561         case CALLBACKS: {
   2562           Object* obj = result->GetCallbackObject();
   2563           if (obj->IsAccessorInfo()) {
   2564             AccessorInfo* info = AccessorInfo::cast(obj);
   2565             if (info->all_can_write()) {
   2566               return SetPropertyWithCallback(result->GetCallbackObject(),
   2567                                              name,
   2568                                              value,
   2569                                              result->holder(),
   2570                                              strict_mode);
   2571             }
   2572           }
   2573           break;
   2574         }
   2575         case INTERCEPTOR: {
   2576           // Try lookup real named properties. Note that only property can be
   2577           // set is callbacks marked as ALL_CAN_WRITE on the prototype chain.
   2578           LookupResult r(GetIsolate());
   2579           LookupRealNamedProperty(name, &r);
   2580           if (r.IsProperty()) {
   2581             return SetPropertyWithFailedAccessCheck(&r,
   2582                                                     name,
   2583                                                     value,
   2584                                                     check_prototype,
   2585                                                     strict_mode);
   2586           }
   2587           break;
   2588         }
   2589         default: {
   2590           break;
   2591         }
   2592       }
   2593     }
   2594   }
   2595 
   2596   Isolate* isolate = GetIsolate();
   2597   HandleScope scope(isolate);
   2598   Handle<Object> value_handle(value);
   2599   isolate->ReportFailedAccessCheck(this, v8::ACCESS_SET);
   2600   return *value_handle;
   2601 }
   2602 
   2603 
   2604 MaybeObject* JSReceiver::SetProperty(LookupResult* result,
   2605                                      String* key,
   2606                                      Object* value,
   2607                                      PropertyAttributes attributes,
   2608                                      StrictModeFlag strict_mode) {
   2609   if (result->IsFound() && result->type() == HANDLER) {
   2610     return result->proxy()->SetPropertyWithHandler(
   2611         key, value, attributes, strict_mode);
   2612   } else {
   2613     return JSObject::cast(this)->SetPropertyForResult(
   2614         result, key, value, attributes, strict_mode);
   2615   }
   2616 }
   2617 
   2618 
   2619 bool JSProxy::HasPropertyWithHandler(String* name_raw) {
   2620   Isolate* isolate = GetIsolate();
   2621   HandleScope scope(isolate);
   2622   Handle<Object> receiver(this);
   2623   Handle<Object> name(name_raw);
   2624 
   2625   Handle<Object> args[] = { name };
   2626   Handle<Object> result = CallTrap(
   2627     "has", isolate->derived_has_trap(), ARRAY_SIZE(args), args);
   2628   if (isolate->has_pending_exception()) return Failure::Exception();
   2629 
   2630   return result->ToBoolean()->IsTrue();
   2631 }
   2632 
   2633 
   2634 MUST_USE_RESULT MaybeObject* JSProxy::SetPropertyWithHandler(
   2635     String* name_raw,
   2636     Object* value_raw,
   2637     PropertyAttributes attributes,
   2638     StrictModeFlag strict_mode) {
   2639   Isolate* isolate = GetIsolate();
   2640   HandleScope scope(isolate);
   2641   Handle<Object> receiver(this);
   2642   Handle<Object> name(name_raw);
   2643   Handle<Object> value(value_raw);
   2644 
   2645   Handle<Object> args[] = { receiver, name, value };
   2646   CallTrap("set", isolate->derived_set_trap(), ARRAY_SIZE(args), args);
   2647   if (isolate->has_pending_exception()) return Failure::Exception();
   2648 
   2649   return *value;
   2650 }
   2651 
   2652 
   2653 MUST_USE_RESULT MaybeObject* JSProxy::SetPropertyWithHandlerIfDefiningSetter(
   2654     String* name_raw,
   2655     Object* value_raw,
   2656     PropertyAttributes attributes,
   2657     StrictModeFlag strict_mode,
   2658     bool* found) {
   2659   *found = true;  // except where defined otherwise...
   2660   Isolate* isolate = GetHeap()->isolate();
   2661   Handle<JSProxy> proxy(this);
   2662   Handle<Object> handler(this->handler());  // Trap might morph proxy.
   2663   Handle<String> name(name_raw);
   2664   Handle<Object> value(value_raw);
   2665   Handle<Object> args[] = { name };
   2666   Handle<Object> result = proxy->CallTrap(
   2667       "getPropertyDescriptor", Handle<Object>(), ARRAY_SIZE(args), args);
   2668   if (isolate->has_pending_exception()) return Failure::Exception();
   2669 
   2670   if (!result->IsUndefined()) {
   2671     // The proxy handler cares about this property.
   2672     // Check whether it is virtualized as an accessor.
   2673     // Emulate [[GetProperty]] semantics for proxies.
   2674     bool has_pending_exception;
   2675     Handle<Object> argv[] = { result };
   2676     Handle<Object> desc =
   2677         Execution::Call(isolate->to_complete_property_descriptor(), result,
   2678                         ARRAY_SIZE(argv), argv, &has_pending_exception);
   2679     if (has_pending_exception) return Failure::Exception();
   2680 
   2681     Handle<String> conf_name =
   2682         isolate->factory()->LookupAsciiSymbol("configurable_");
   2683     Handle<Object> configurable(v8::internal::GetProperty(desc, conf_name));
   2684     ASSERT(!isolate->has_pending_exception());
   2685     if (configurable->IsFalse()) {
   2686       Handle<String> trap =
   2687           isolate->factory()->LookupAsciiSymbol("getPropertyDescriptor");
   2688       Handle<Object> args[] = { handler, trap, name };
   2689       Handle<Object> error = isolate->factory()->NewTypeError(
   2690           "proxy_prop_not_configurable", HandleVector(args, ARRAY_SIZE(args)));
   2691       return isolate->Throw(*error);
   2692     }
   2693     ASSERT(configurable->IsTrue());
   2694 
   2695     // Check for AccessorDescriptor.
   2696     Handle<String> set_name = isolate->factory()->LookupAsciiSymbol("set_");
   2697     Handle<Object> setter(v8::internal::GetProperty(desc, set_name));
   2698     ASSERT(!isolate->has_pending_exception());
   2699     if (!setter->IsUndefined()) {
   2700       // We have a setter -- invoke it.
   2701       // TODO(rossberg): nicer would be to cast to some JSCallable here...
   2702       return proxy->SetPropertyWithDefinedSetter(
   2703           JSReceiver::cast(*setter), *value);
   2704     } else {
   2705       Handle<String> get_name = isolate->factory()->LookupAsciiSymbol("get_");
   2706       Handle<Object> getter(v8::internal::GetProperty(desc, get_name));
   2707       ASSERT(!isolate->has_pending_exception());
   2708       if (!getter->IsUndefined()) {
   2709         // We have a getter but no setter -- the property may not be
   2710         // written. In strict mode, throw an error.
   2711         if (strict_mode == kNonStrictMode) return *value;
   2712         Handle<Object> args[] = { name, proxy };
   2713         Handle<Object> error = isolate->factory()->NewTypeError(
   2714             "no_setter_in_callback", HandleVector(args, ARRAY_SIZE(args)));
   2715         return isolate->Throw(*error);
   2716       }
   2717     }
   2718     // Fall-through.
   2719   }
   2720 
   2721   // The proxy does not define the property as an accessor.
   2722   *found = false;
   2723   return *value;
   2724 }
   2725 
   2726 
   2727 MUST_USE_RESULT MaybeObject* JSProxy::DeletePropertyWithHandler(
   2728     String* name_raw, DeleteMode mode) {
   2729   Isolate* isolate = GetIsolate();
   2730   HandleScope scope(isolate);
   2731   Handle<Object> receiver(this);
   2732   Handle<Object> name(name_raw);
   2733 
   2734   Handle<Object> args[] = { name };
   2735   Handle<Object> result = CallTrap(
   2736     "delete", Handle<Object>(), ARRAY_SIZE(args), args);
   2737   if (isolate->has_pending_exception()) return Failure::Exception();
   2738 
   2739   Object* bool_result = result->ToBoolean();
   2740   if (mode == STRICT_DELETION && bool_result == GetHeap()->false_value()) {
   2741     Handle<String> trap_name = isolate->factory()->LookupAsciiSymbol("delete");
   2742     Handle<Object> args[] = { Handle<Object>(handler()), trap_name };
   2743     Handle<Object> error = isolate->factory()->NewTypeError(
   2744         "handler_failed", HandleVector(args, ARRAY_SIZE(args)));
   2745     isolate->Throw(*error);
   2746     return Failure::Exception();
   2747   }
   2748   return bool_result;
   2749 }
   2750 
   2751 
   2752 MUST_USE_RESULT MaybeObject* JSProxy::DeleteElementWithHandler(
   2753     uint32_t index,
   2754     DeleteMode mode) {
   2755   Isolate* isolate = GetIsolate();
   2756   HandleScope scope(isolate);
   2757   Handle<String> name = isolate->factory()->Uint32ToString(index);
   2758   return JSProxy::DeletePropertyWithHandler(*name, mode);
   2759 }
   2760 
   2761 
   2762 MUST_USE_RESULT PropertyAttributes JSProxy::GetPropertyAttributeWithHandler(
   2763     JSReceiver* receiver_raw,
   2764     String* name_raw) {
   2765   Isolate* isolate = GetIsolate();
   2766   HandleScope scope(isolate);
   2767   Handle<JSProxy> proxy(this);
   2768   Handle<Object> handler(this->handler());  // Trap might morph proxy.
   2769   Handle<JSReceiver> receiver(receiver_raw);
   2770   Handle<Object> name(name_raw);
   2771 
   2772   Handle<Object> args[] = { name };
   2773   Handle<Object> result = CallTrap(
   2774     "getPropertyDescriptor", Handle<Object>(), ARRAY_SIZE(args), args);
   2775   if (isolate->has_pending_exception()) return NONE;
   2776 
   2777   if (result->IsUndefined()) return ABSENT;
   2778 
   2779   bool has_pending_exception;
   2780   Handle<Object> argv[] = { result };
   2781   Handle<Object> desc =
   2782       Execution::Call(isolate->to_complete_property_descriptor(), result,
   2783                       ARRAY_SIZE(argv), argv, &has_pending_exception);
   2784   if (has_pending_exception) return NONE;
   2785 
   2786   // Convert result to PropertyAttributes.
   2787   Handle<String> enum_n = isolate->factory()->LookupAsciiSymbol("enumerable");
   2788   Handle<Object> enumerable(v8::internal::GetProperty(desc, enum_n));
   2789   if (isolate->has_pending_exception()) return NONE;
   2790   Handle<String> conf_n = isolate->factory()->LookupAsciiSymbol("configurable");
   2791   Handle<Object> configurable(v8::internal::GetProperty(desc, conf_n));
   2792   if (isolate->has_pending_exception()) return NONE;
   2793   Handle<String> writ_n = isolate->factory()->LookupAsciiSymbol("writable");
   2794   Handle<Object> writable(v8::internal::GetProperty(desc, writ_n));
   2795   if (isolate->has_pending_exception()) return NONE;
   2796 
   2797   if (configurable->IsFalse()) {
   2798     Handle<String> trap =
   2799         isolate->factory()->LookupAsciiSymbol("getPropertyDescriptor");
   2800     Handle<Object> args[] = { handler, trap, name };
   2801     Handle<Object> error = isolate->factory()->NewTypeError(
   2802         "proxy_prop_not_configurable", HandleVector(args, ARRAY_SIZE(args)));
   2803     isolate->Throw(*error);
   2804     return NONE;
   2805   }
   2806 
   2807   int attributes = NONE;
   2808   if (enumerable->ToBoolean()->IsFalse()) attributes |= DONT_ENUM;
   2809   if (configurable->ToBoolean()->IsFalse()) attributes |= DONT_DELETE;
   2810   if (writable->ToBoolean()->IsFalse()) attributes |= READ_ONLY;
   2811   return static_cast<PropertyAttributes>(attributes);
   2812 }
   2813 
   2814 
   2815 MUST_USE_RESULT PropertyAttributes JSProxy::GetElementAttributeWithHandler(
   2816     JSReceiver* receiver,
   2817     uint32_t index) {
   2818   Isolate* isolate = GetIsolate();
   2819   HandleScope scope(isolate);
   2820   Handle<String> name = isolate->factory()->Uint32ToString(index);
   2821   return GetPropertyAttributeWithHandler(receiver, *name);
   2822 }
   2823 
   2824 
   2825 void JSProxy::Fix() {
   2826   Isolate* isolate = GetIsolate();
   2827   HandleScope scope(isolate);
   2828   Handle<JSProxy> self(this);
   2829 
   2830   // Save identity hash.
   2831   MaybeObject* maybe_hash = GetIdentityHash(OMIT_CREATION);
   2832 
   2833   if (IsJSFunctionProxy()) {
   2834     isolate->factory()->BecomeJSFunction(self);
   2835     // Code will be set on the JavaScript side.
   2836   } else {
   2837     isolate->factory()->BecomeJSObject(self);
   2838   }
   2839   ASSERT(self->IsJSObject());
   2840 
   2841   // Inherit identity, if it was present.
   2842   Object* hash;
   2843   if (maybe_hash->To<Object>(&hash) && hash->IsSmi()) {
   2844     Handle<JSObject> new_self(JSObject::cast(*self));
   2845     isolate->factory()->SetIdentityHash(new_self, hash);
   2846   }
   2847 }
   2848 
   2849 
   2850 MUST_USE_RESULT Handle<Object> JSProxy::CallTrap(const char* name,
   2851                                                  Handle<Object> derived,
   2852                                                  int argc,
   2853                                                  Handle<Object> argv[]) {
   2854   Isolate* isolate = GetIsolate();
   2855   Handle<Object> handler(this->handler());
   2856 
   2857   Handle<String> trap_name = isolate->factory()->LookupAsciiSymbol(name);
   2858   Handle<Object> trap(v8::internal::GetProperty(handler, trap_name));
   2859   if (isolate->has_pending_exception()) return trap;
   2860 
   2861   if (trap->IsUndefined()) {
   2862     if (derived.is_null()) {
   2863       Handle<Object> args[] = { handler, trap_name };
   2864       Handle<Object> error = isolate->factory()->NewTypeError(
   2865         "handler_trap_missing", HandleVector(args, ARRAY_SIZE(args)));
   2866       isolate->Throw(*error);
   2867       return Handle<Object>();
   2868     }
   2869     trap = Handle<Object>(derived);
   2870   }
   2871 
   2872   bool threw;
   2873   return Execution::Call(trap, handler, argc, argv, &threw);
   2874 }
   2875 
   2876 
   2877 MaybeObject* JSObject::SetPropertyForResult(LookupResult* result,
   2878                                             String* name,
   2879                                             Object* value,
   2880                                             PropertyAttributes attributes,
   2881                                             StrictModeFlag strict_mode) {
   2882   Heap* heap = GetHeap();
   2883   // Make sure that the top context does not change when doing callbacks or
   2884   // interceptor calls.
   2885   AssertNoContextChange ncc;
   2886 
   2887   // Optimization for 2-byte strings often used as keys in a decompression
   2888   // dictionary.  We make these short keys into symbols to avoid constantly
   2889   // reallocating them.
   2890   if (!name->IsSymbol() && name->length() <= 2) {
   2891     Object* symbol_version;
   2892     { MaybeObject* maybe_symbol_version = heap->LookupSymbol(name);
   2893       if (maybe_symbol_version->ToObject(&symbol_version)) {
   2894         name = String::cast(symbol_version);
   2895       }
   2896     }
   2897   }
   2898 
   2899   // Check access rights if needed.
   2900   if (IsAccessCheckNeeded()) {
   2901     if (!heap->isolate()->MayNamedAccess(this, name, v8::ACCESS_SET)) {
   2902       return SetPropertyWithFailedAccessCheck(
   2903           result, name, value, true, strict_mode);
   2904     }
   2905   }
   2906 
   2907   if (IsJSGlobalProxy()) {
   2908     Object* proto = GetPrototype();
   2909     if (proto->IsNull()) return value;
   2910     ASSERT(proto->IsJSGlobalObject());
   2911     return JSObject::cast(proto)->SetPropertyForResult(
   2912         result, name, value, attributes, strict_mode);
   2913   }
   2914 
   2915   if (!result->IsProperty() && !IsJSContextExtensionObject()) {
   2916     bool found = false;
   2917     MaybeObject* result_object;
   2918     result_object = SetPropertyWithCallbackSetterInPrototypes(name,
   2919                                                               value,
   2920                                                               attributes,
   2921                                                               &found,
   2922                                                               strict_mode);
   2923     if (found) return result_object;
   2924   }
   2925 
   2926   // At this point, no GC should have happened, as this would invalidate
   2927   // 'result', which we cannot handlify!
   2928 
   2929   if (!result->IsFound()) {
   2930     // Neither properties nor transitions found.
   2931     return AddProperty(name, value, attributes, strict_mode);
   2932   }
   2933   if (result->IsReadOnly() && result->IsProperty()) {
   2934     if (strict_mode == kStrictMode) {
   2935       Handle<JSObject> self(this);
   2936       Handle<String> hname(name);
   2937       Handle<Object> args[] = { hname, self };
   2938       return heap->isolate()->Throw(*heap->isolate()->factory()->NewTypeError(
   2939           "strict_read_only_property", HandleVector(args, ARRAY_SIZE(args))));
   2940     } else {
   2941       return value;
   2942     }
   2943   }
   2944   // This is a real property that is not read-only, or it is a
   2945   // transition or null descriptor and there are no setters in the prototypes.
   2946   switch (result->type()) {
   2947     case NORMAL:
   2948       return SetNormalizedProperty(result, value);
   2949     case FIELD:
   2950       return FastPropertyAtPut(result->GetFieldIndex(), value);
   2951     case MAP_TRANSITION:
   2952       if (attributes == result->GetAttributes()) {
   2953         // Only use map transition if the attributes match.
   2954         return AddFastPropertyUsingMap(result->GetTransitionMap(),
   2955                                        name,
   2956                                        value);
   2957       }
   2958       return ConvertDescriptorToField(name, value, attributes);
   2959     case CONSTANT_FUNCTION:
   2960       // Only replace the function if necessary.
   2961       if (value == result->GetConstantFunction()) return value;
   2962       // Preserve the attributes of this existing property.
   2963       attributes = result->GetAttributes();
   2964       return ConvertDescriptorToField(name, value, attributes);
   2965     case CALLBACKS:
   2966       return SetPropertyWithCallback(result->GetCallbackObject(),
   2967                                      name,
   2968                                      value,
   2969                                      result->holder(),
   2970                                      strict_mode);
   2971     case INTERCEPTOR:
   2972       return SetPropertyWithInterceptor(name, value, attributes, strict_mode);
   2973     case CONSTANT_TRANSITION: {
   2974       // If the same constant function is being added we can simply
   2975       // transition to the target map.
   2976       Map* target_map = result->GetTransitionMap();
   2977       DescriptorArray* target_descriptors = target_map->instance_descriptors();
   2978       int number = target_descriptors->SearchWithCache(name);
   2979       ASSERT(number != DescriptorArray::kNotFound);
   2980       ASSERT(target_descriptors->GetType(number) == CONSTANT_FUNCTION);
   2981       JSFunction* function =
   2982           JSFunction::cast(target_descriptors->GetValue(number));
   2983       if (value == function) {
   2984         set_map(target_map);
   2985         return value;
   2986       }
   2987       // Otherwise, replace with a MAP_TRANSITION to a new map with a
   2988       // FIELD, even if the value is a constant function.
   2989       return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
   2990     }
   2991     case NULL_DESCRIPTOR:
   2992     case ELEMENTS_TRANSITION:
   2993       return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
   2994     case HANDLER:
   2995       UNREACHABLE();
   2996       return value;
   2997   }
   2998   UNREACHABLE();  // keep the compiler happy
   2999   return value;
   3000 }
   3001 
   3002 
   3003 // Set a real local property, even if it is READ_ONLY.  If the property is not
   3004 // present, add it with attributes NONE.  This code is an exact clone of
   3005 // SetProperty, with the check for IsReadOnly and the check for a
   3006 // callback setter removed.  The two lines looking up the LookupResult
   3007 // result are also added.  If one of the functions is changed, the other
   3008 // should be.
   3009 // Note that this method cannot be used to set the prototype of a function
   3010 // because ConvertDescriptorToField() which is called in "case CALLBACKS:"
   3011 // doesn't handle function prototypes correctly.
   3012 Handle<Object> JSObject::SetLocalPropertyIgnoreAttributes(
   3013     Handle<JSObject> object,
   3014     Handle<String> key,
   3015     Handle<Object> value,
   3016     PropertyAttributes attributes) {
   3017   CALL_HEAP_FUNCTION(
   3018     object->GetIsolate(),
   3019     object->SetLocalPropertyIgnoreAttributes(*key, *value, attributes),
   3020     Object);
   3021 }
   3022 
   3023 
   3024 MaybeObject* JSObject::SetLocalPropertyIgnoreAttributes(
   3025     String* name,
   3026     Object* value,
   3027     PropertyAttributes attributes) {
   3028 
   3029   // Make sure that the top context does not change when doing callbacks or
   3030   // interceptor calls.
   3031   AssertNoContextChange ncc;
   3032   Isolate* isolate = GetIsolate();
   3033   LookupResult result(isolate);
   3034   LocalLookup(name, &result);
   3035   // Check access rights if needed.
   3036   if (IsAccessCheckNeeded()) {
   3037     if (!isolate->MayNamedAccess(this, name, v8::ACCESS_SET)) {
   3038       return SetPropertyWithFailedAccessCheck(&result,
   3039                                               name,
   3040                                               value,
   3041                                               false,
   3042                                               kNonStrictMode);
   3043     }
   3044   }
   3045 
   3046   if (IsJSGlobalProxy()) {
   3047     Object* proto = GetPrototype();
   3048     if (proto->IsNull()) return value;
   3049     ASSERT(proto->IsJSGlobalObject());
   3050     return JSObject::cast(proto)->SetLocalPropertyIgnoreAttributes(
   3051         name,
   3052         value,
   3053         attributes);
   3054   }
   3055 
   3056   // Check for accessor in prototype chain removed here in clone.
   3057   if (!result.IsFound()) {
   3058     // Neither properties nor transitions found.
   3059     return AddProperty(name, value, attributes, kNonStrictMode);
   3060   }
   3061 
   3062   PropertyDetails details = PropertyDetails(attributes, NORMAL);
   3063 
   3064   // Check of IsReadOnly removed from here in clone.
   3065   switch (result.type()) {
   3066     case NORMAL:
   3067       return SetNormalizedProperty(name, value, details);
   3068     case FIELD:
   3069       return FastPropertyAtPut(result.GetFieldIndex(), value);
   3070     case MAP_TRANSITION:
   3071       if (attributes == result.GetAttributes()) {
   3072         // Only use map transition if the attributes match.
   3073         return AddFastPropertyUsingMap(result.GetTransitionMap(),
   3074                                        name,
   3075                                        value);
   3076       }
   3077       return ConvertDescriptorToField(name, value, attributes);
   3078     case CONSTANT_FUNCTION:
   3079       // Only replace the function if necessary.
   3080       if (value == result.GetConstantFunction()) return value;
   3081       // Preserve the attributes of this existing property.
   3082       attributes = result.GetAttributes();
   3083       return ConvertDescriptorToField(name, value, attributes);
   3084     case CALLBACKS:
   3085     case INTERCEPTOR:
   3086       // Override callback in clone
   3087       return ConvertDescriptorToField(name, value, attributes);
   3088     case CONSTANT_TRANSITION:
   3089       // Replace with a MAP_TRANSITION to a new map with a FIELD, even
   3090       // if the value is a function.
   3091       return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
   3092     case NULL_DESCRIPTOR:
   3093     case ELEMENTS_TRANSITION:
   3094       return ConvertDescriptorToFieldAndMapTransition(name, value, attributes);
   3095     case HANDLER:
   3096       UNREACHABLE();
   3097       return value;
   3098   }
   3099   UNREACHABLE();  // keep the compiler happy
   3100   return value;
   3101 }
   3102 
   3103 
   3104 PropertyAttributes JSObject::GetPropertyAttributePostInterceptor(
   3105       JSObject* receiver,
   3106       String* name,
   3107       bool continue_search) {
   3108   // Check local property, ignore interceptor.
   3109   LookupResult result(GetIsolate());
   3110   LocalLookupRealNamedProperty(name, &result);
   3111   if (result.IsProperty()) return result.GetAttributes();
   3112 
   3113   if (continue_search) {
   3114     // Continue searching via the prototype chain.
   3115     Object* pt = GetPrototype();
   3116     if (!pt->IsNull()) {
   3117       return JSObject::cast(pt)->
   3118         GetPropertyAttributeWithReceiver(receiver, name);
   3119     }
   3120   }
   3121   return ABSENT;
   3122 }
   3123 
   3124 
   3125 PropertyAttributes JSObject::GetPropertyAttributeWithInterceptor(
   3126       JSObject* receiver,
   3127       String* name,
   3128       bool continue_search) {
   3129   Isolate* isolate = GetIsolate();
   3130 
   3131   // Make sure that the top context does not change when doing
   3132   // callbacks or interceptor calls.
   3133   AssertNoContextChange ncc;
   3134 
   3135   HandleScope scope(isolate);
   3136   Handle<InterceptorInfo> interceptor(GetNamedInterceptor());
   3137   Handle<JSObject> receiver_handle(receiver);
   3138   Handle<JSObject> holder_handle(this);
   3139   Handle<String> name_handle(name);
   3140   CustomArguments args(isolate, interceptor->data(), receiver, this);
   3141   v8::AccessorInfo info(args.end());
   3142   if (!interceptor->query()->IsUndefined()) {
   3143     v8::NamedPropertyQuery query =
   3144         v8::ToCData<v8::NamedPropertyQuery>(interceptor->query());
   3145     LOG(isolate,
   3146         ApiNamedPropertyAccess("interceptor-named-has", *holder_handle, name));
   3147     v8::Handle<v8::Integer> result;
   3148     {
   3149       // Leaving JavaScript.
   3150       VMState state(isolate, EXTERNAL);
   3151       result = query(v8::Utils::ToLocal(name_handle), info);
   3152     }
   3153     if (!result.IsEmpty()) {
   3154       ASSERT(result->IsInt32());
   3155       return static_cast<PropertyAttributes>(result->Int32Value());
   3156     }
   3157   } else if (!interceptor->getter()->IsUndefined()) {
   3158     v8::NamedPropertyGetter getter =
   3159         v8::ToCData<v8::NamedPropertyGetter>(interceptor->getter());
   3160     LOG(isolate,
   3161         ApiNamedPropertyAccess("interceptor-named-get-has", this, name));
   3162     v8::Handle<v8::Value> result;
   3163     {
   3164       // Leaving JavaScript.
   3165       VMState state(isolate, EXTERNAL);
   3166       result = getter(v8::Utils::ToLocal(name_handle), info);
   3167     }
   3168     if (!result.IsEmpty()) return DONT_ENUM;
   3169   }
   3170   return holder_handle->GetPropertyAttributePostInterceptor(*receiver_handle,
   3171                                                             *name_handle,
   3172                                                             continue_search);
   3173 }
   3174 
   3175 
   3176 PropertyAttributes JSReceiver::GetPropertyAttributeWithReceiver(
   3177       JSReceiver* receiver,
   3178       String* key) {
   3179   uint32_t index = 0;
   3180   if (IsJSObject() && key->AsArrayIndex(&index)) {
   3181     return JSObject::cast(this)->HasElementWithReceiver(receiver, index)
   3182         ? NONE : ABSENT;
   3183   }
   3184   // Named property.
   3185   LookupResult result(GetIsolate());
   3186   Lookup(key, &result);
   3187   return GetPropertyAttribute(receiver, &result, key, true);
   3188 }
   3189 
   3190 
   3191 PropertyAttributes JSReceiver::GetPropertyAttribute(JSReceiver* receiver,
   3192                                                     LookupResult* result,
   3193                                                     String* name,
   3194                                                     bool continue_search) {
   3195   // Check access rights if needed.
   3196   if (IsAccessCheckNeeded()) {
   3197     JSObject* this_obj = JSObject::cast(this);
   3198     Heap* heap = GetHeap();
   3199     if (!heap->isolate()->MayNamedAccess(this_obj, name, v8::ACCESS_HAS)) {
   3200       return this_obj->GetPropertyAttributeWithFailedAccessCheck(
   3201           receiver, result, name, continue_search);
   3202     }
   3203   }
   3204   if (result->IsProperty()) {
   3205     switch (result->type()) {
   3206       case NORMAL:  // fall through
   3207       case FIELD:
   3208       case CONSTANT_FUNCTION:
   3209       case CALLBACKS:
   3210         return result->GetAttributes();
   3211       case HANDLER: {
   3212         return JSProxy::cast(result->proxy())->GetPropertyAttributeWithHandler(
   3213             receiver, name);
   3214       }
   3215       case INTERCEPTOR:
   3216         return result->holder()->GetPropertyAttributeWithInterceptor(
   3217             JSObject::cast(receiver), name, continue_search);
   3218       default:
   3219         UNREACHABLE();
   3220     }
   3221   }
   3222   return ABSENT;
   3223 }
   3224 
   3225 
   3226 PropertyAttributes JSReceiver::GetLocalPropertyAttribute(String* name) {
   3227   // Check whether the name is an array index.
   3228   uint32_t index = 0;
   3229   if (IsJSObject() && name->AsArrayIndex(&index)) {
   3230     if (JSObject::cast(this)->HasLocalElement(index)) return NONE;
   3231     return ABSENT;
   3232   }
   3233   // Named property.
   3234   LookupResult result(GetIsolate());
   3235   LocalLookup(name, &result);
   3236   return GetPropertyAttribute(this, &result, name, false);
   3237 }
   3238 
   3239 
   3240 MaybeObject* NormalizedMapCache::Get(JSObject* obj,
   3241                                      PropertyNormalizationMode mode) {
   3242   Isolate* isolate = obj->GetIsolate();
   3243   Map* fast = obj->map();
   3244   int index = fast->Hash() % kEntries;
   3245   Object* result = get(index);
   3246   if (result->IsMap() &&
   3247       Map::cast(result)->EquivalentToForNormalization(fast, mode)) {
   3248 #ifdef DEBUG
   3249     if (FLAG_verify_heap) {
   3250       Map::cast(result)->SharedMapVerify();
   3251     }
   3252     if (FLAG_enable_slow_asserts) {
   3253       // The cached map should match newly created normalized map bit-by-bit.
   3254       Object* fresh;
   3255       { MaybeObject* maybe_fresh =
   3256             fast->CopyNormalized(mode, SHARED_NORMALIZED_MAP);
   3257         if (maybe_fresh->ToObject(&fresh)) {
   3258           ASSERT(memcmp(Map::cast(fresh)->address(),
   3259                         Map::cast(result)->address(),
   3260                         Map::kSize) == 0);
   3261         }
   3262       }
   3263     }
   3264 #endif
   3265     return result;
   3266   }
   3267 
   3268   { MaybeObject* maybe_result =
   3269         fast->CopyNormalized(mode, SHARED_NORMALIZED_MAP);
   3270     if (!maybe_result->ToObject(&result)) return maybe_result;
   3271   }
   3272   set(index, result);
   3273   isolate->counters()->normalized_maps()->Increment();
   3274 
   3275   return result;
   3276 }
   3277 
   3278 
   3279 void NormalizedMapCache::Clear() {
   3280   int entries = length();
   3281   for (int i = 0; i != entries; i++) {
   3282     set_undefined(i);
   3283   }
   3284 }
   3285 
   3286 
   3287 void JSObject::UpdateMapCodeCache(Handle<JSObject> object,
   3288                                   Handle<String> name,
   3289                                   Handle<Code> code) {
   3290   Isolate* isolate = object->GetIsolate();
   3291   CALL_HEAP_FUNCTION_VOID(isolate,
   3292                           object->UpdateMapCodeCache(*name, *code));
   3293 }
   3294 
   3295 
   3296 MaybeObject* JSObject::UpdateMapCodeCache(String* name, Code* code) {
   3297   if (map()->is_shared()) {
   3298     // Fast case maps are never marked as shared.
   3299     ASSERT(!HasFastProperties());
   3300     // Replace the map with an identical copy that can be safely modified.
   3301     Object* obj;
   3302     { MaybeObject* maybe_obj = map()->CopyNormalized(KEEP_INOBJECT_PROPERTIES,
   3303                                                      UNIQUE_NORMALIZED_MAP);
   3304       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   3305     }
   3306     GetIsolate()->counters()->normalized_maps()->Increment();
   3307 
   3308     set_map(Map::cast(obj));
   3309   }
   3310   return map()->UpdateCodeCache(name, code);
   3311 }
   3312 
   3313 
   3314 void JSObject::NormalizeProperties(Handle<JSObject> object,
   3315                                    PropertyNormalizationMode mode,
   3316                                    int expected_additional_properties) {
   3317   CALL_HEAP_FUNCTION_VOID(object->GetIsolate(),
   3318                           object->NormalizeProperties(
   3319                               mode, expected_additional_properties));
   3320 }
   3321 
   3322 
   3323 MaybeObject* JSObject::NormalizeProperties(PropertyNormalizationMode mode,
   3324                                            int expected_additional_properties) {
   3325   if (!HasFastProperties()) return this;
   3326 
   3327   // The global object is always normalized.
   3328   ASSERT(!IsGlobalObject());
   3329   // JSGlobalProxy must never be normalized
   3330   ASSERT(!IsJSGlobalProxy());
   3331 
   3332   Map* map_of_this = map();
   3333 
   3334   // Allocate new content.
   3335   int property_count = map_of_this->NumberOfDescribedProperties();
   3336   if (expected_additional_properties > 0) {
   3337     property_count += expected_additional_properties;
   3338   } else {
   3339     property_count += 2;  // Make space for two more properties.
   3340   }
   3341   StringDictionary* dictionary;
   3342   { MaybeObject* maybe_dictionary = StringDictionary::Allocate(property_count);
   3343     if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
   3344   }
   3345 
   3346   DescriptorArray* descs = map_of_this->instance_descriptors();
   3347   for (int i = 0; i < descs->number_of_descriptors(); i++) {
   3348     PropertyDetails details(descs->GetDetails(i));
   3349     switch (details.type()) {
   3350       case CONSTANT_FUNCTION: {
   3351         PropertyDetails d =
   3352             PropertyDetails(details.attributes(), NORMAL, details.index());
   3353         Object* value = descs->GetConstantFunction(i);
   3354         MaybeObject* maybe_dictionary =
   3355             dictionary->Add(descs->GetKey(i), value, d);
   3356         if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
   3357         break;
   3358       }
   3359       case FIELD: {
   3360         PropertyDetails d =
   3361             PropertyDetails(details.attributes(), NORMAL, details.index());
   3362         Object* value = FastPropertyAt(descs->GetFieldIndex(i));
   3363         MaybeObject* maybe_dictionary =
   3364             dictionary->Add(descs->GetKey(i), value, d);
   3365         if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
   3366         break;
   3367       }
   3368       case CALLBACKS: {
   3369         if (!descs->IsProperty(i)) break;
   3370         Object* value = descs->GetCallbacksObject(i);
   3371         if (value->IsAccessorPair()) {
   3372           MaybeObject* maybe_copy =
   3373               AccessorPair::cast(value)->CopyWithoutTransitions();
   3374           if (!maybe_copy->To(&value)) return maybe_copy;
   3375         }
   3376         MaybeObject* maybe_dictionary =
   3377             dictionary->Add(descs->GetKey(i), value, details);
   3378         if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
   3379         break;
   3380       }
   3381       case MAP_TRANSITION:
   3382       case CONSTANT_TRANSITION:
   3383       case NULL_DESCRIPTOR:
   3384       case INTERCEPTOR:
   3385       case ELEMENTS_TRANSITION:
   3386         break;
   3387       case HANDLER:
   3388       case NORMAL:
   3389         UNREACHABLE();
   3390         break;
   3391     }
   3392   }
   3393 
   3394   Heap* current_heap = GetHeap();
   3395 
   3396   // Copy the next enumeration index from instance descriptor.
   3397   int index = map_of_this->instance_descriptors()->NextEnumerationIndex();
   3398   dictionary->SetNextEnumerationIndex(index);
   3399 
   3400   Map* new_map;
   3401   { MaybeObject* maybe_map =
   3402         current_heap->isolate()->context()->global_context()->
   3403         normalized_map_cache()->Get(this, mode);
   3404     if (!maybe_map->To(&new_map)) return maybe_map;
   3405   }
   3406 
   3407   // We have now successfully allocated all the necessary objects.
   3408   // Changes can now be made with the guarantee that all of them take effect.
   3409 
   3410   // Resize the object in the heap if necessary.
   3411   int new_instance_size = new_map->instance_size();
   3412   int instance_size_delta = map_of_this->instance_size() - new_instance_size;
   3413   ASSERT(instance_size_delta >= 0);
   3414   current_heap->CreateFillerObjectAt(this->address() + new_instance_size,
   3415                                      instance_size_delta);
   3416   if (Marking::IsBlack(Marking::MarkBitFrom(this))) {
   3417     MemoryChunk::IncrementLiveBytesFromMutator(this->address(),
   3418                                                -instance_size_delta);
   3419   }
   3420 
   3421 
   3422   set_map(new_map);
   3423   new_map->clear_instance_descriptors();
   3424 
   3425   set_properties(dictionary);
   3426 
   3427   current_heap->isolate()->counters()->props_to_dictionary()->Increment();
   3428 
   3429 #ifdef DEBUG
   3430   if (FLAG_trace_normalization) {
   3431     PrintF("Object properties have been normalized:\n");
   3432     Print();
   3433   }
   3434 #endif
   3435   return this;
   3436 }
   3437 
   3438 
   3439 void JSObject::TransformToFastProperties(Handle<JSObject> object,
   3440                                          int unused_property_fields) {
   3441   CALL_HEAP_FUNCTION_VOID(
   3442       object->GetIsolate(),
   3443       object->TransformToFastProperties(unused_property_fields));
   3444 }
   3445 
   3446 
   3447 MaybeObject* JSObject::TransformToFastProperties(int unused_property_fields) {
   3448   if (HasFastProperties()) return this;
   3449   ASSERT(!IsGlobalObject());
   3450   return property_dictionary()->
   3451       TransformPropertiesToFastFor(this, unused_property_fields);
   3452 }
   3453 
   3454 
   3455 Handle<SeededNumberDictionary> JSObject::NormalizeElements(
   3456     Handle<JSObject> object) {
   3457   CALL_HEAP_FUNCTION(object->GetIsolate(),
   3458                      object->NormalizeElements(),
   3459                      SeededNumberDictionary);
   3460 }
   3461 
   3462 
   3463 MaybeObject* JSObject::NormalizeElements() {
   3464   ASSERT(!HasExternalArrayElements());
   3465 
   3466   // Find the backing store.
   3467   FixedArrayBase* array = FixedArrayBase::cast(elements());
   3468   Map* old_map = array->map();
   3469   bool is_arguments =
   3470       (old_map == old_map->GetHeap()->non_strict_arguments_elements_map());
   3471   if (is_arguments) {
   3472     array = FixedArrayBase::cast(FixedArray::cast(array)->get(1));
   3473   }
   3474   if (array->IsDictionary()) return array;
   3475 
   3476   ASSERT(HasFastElements() ||
   3477          HasFastSmiOnlyElements() ||
   3478          HasFastDoubleElements() ||
   3479          HasFastArgumentsElements());
   3480   // Compute the effective length and allocate a new backing store.
   3481   int length = IsJSArray()
   3482       ? Smi::cast(JSArray::cast(this)->length())->value()
   3483       : array->length();
   3484   int old_capacity = 0;
   3485   int used_elements = 0;
   3486   GetElementsCapacityAndUsage(&old_capacity, &used_elements);
   3487   SeededNumberDictionary* dictionary = NULL;
   3488   { Object* object;
   3489     MaybeObject* maybe = SeededNumberDictionary::Allocate(used_elements);
   3490     if (!maybe->ToObject(&object)) return maybe;
   3491     dictionary = SeededNumberDictionary::cast(object);
   3492   }
   3493 
   3494   // Copy the elements to the new backing store.
   3495   bool has_double_elements = array->IsFixedDoubleArray();
   3496   for (int i = 0; i < length; i++) {
   3497     Object* value = NULL;
   3498     if (has_double_elements) {
   3499       FixedDoubleArray* double_array = FixedDoubleArray::cast(array);
   3500       if (double_array->is_the_hole(i)) {
   3501         value = GetIsolate()->heap()->the_hole_value();
   3502       } else {
   3503         // Objects must be allocated in the old object space, since the
   3504         // overall number of HeapNumbers needed for the conversion might
   3505         // exceed the capacity of new space, and we would fail repeatedly
   3506         // trying to convert the FixedDoubleArray.
   3507         MaybeObject* maybe_value_object =
   3508             GetHeap()->AllocateHeapNumber(double_array->get_scalar(i), TENURED);
   3509         if (!maybe_value_object->ToObject(&value)) return maybe_value_object;
   3510       }
   3511     } else {
   3512       ASSERT(old_map->has_fast_elements() ||
   3513              old_map->has_fast_smi_only_elements());
   3514       value = FixedArray::cast(array)->get(i);
   3515     }
   3516     PropertyDetails details = PropertyDetails(NONE, NORMAL);
   3517     if (!value->IsTheHole()) {
   3518       Object* result;
   3519       MaybeObject* maybe_result =
   3520           dictionary->AddNumberEntry(i, value, details);
   3521       if (!maybe_result->ToObject(&result)) return maybe_result;
   3522       dictionary = SeededNumberDictionary::cast(result);
   3523     }
   3524   }
   3525 
   3526   // Switch to using the dictionary as the backing storage for elements.
   3527   if (is_arguments) {
   3528     FixedArray::cast(elements())->set(1, dictionary);
   3529   } else {
   3530     // Set the new map first to satify the elements type assert in
   3531     // set_elements().
   3532     Object* new_map;
   3533     MaybeObject* maybe = GetElementsTransitionMap(GetIsolate(),
   3534                                                   DICTIONARY_ELEMENTS);
   3535     if (!maybe->ToObject(&new_map)) return maybe;
   3536     set_map(Map::cast(new_map));
   3537     set_elements(dictionary);
   3538   }
   3539 
   3540   old_map->GetHeap()->isolate()->counters()->elements_to_dictionary()->
   3541       Increment();
   3542 
   3543 #ifdef DEBUG
   3544   if (FLAG_trace_normalization) {
   3545     PrintF("Object elements have been normalized:\n");
   3546     Print();
   3547   }
   3548 #endif
   3549 
   3550   ASSERT(HasDictionaryElements() || HasDictionaryArgumentsElements());
   3551   return dictionary;
   3552 }
   3553 
   3554 
   3555 Smi* JSReceiver::GenerateIdentityHash() {
   3556   Isolate* isolate = GetIsolate();
   3557 
   3558   int hash_value;
   3559   int attempts = 0;
   3560   do {
   3561     // Generate a random 32-bit hash value but limit range to fit
   3562     // within a smi.
   3563     hash_value = V8::RandomPrivate(isolate) & Smi::kMaxValue;
   3564     attempts++;
   3565   } while (hash_value == 0 && attempts < 30);
   3566   hash_value = hash_value != 0 ? hash_value : 1;  // never return 0
   3567 
   3568   return Smi::FromInt(hash_value);
   3569 }
   3570 
   3571 
   3572 MaybeObject* JSObject::SetIdentityHash(Object* hash, CreationFlag flag) {
   3573   MaybeObject* maybe = SetHiddenProperty(GetHeap()->identity_hash_symbol(),
   3574                                          hash);
   3575   if (maybe->IsFailure()) return maybe;
   3576   return this;
   3577 }
   3578 
   3579 
   3580 int JSObject::GetIdentityHash(Handle<JSObject> obj) {
   3581   CALL_AND_RETRY(obj->GetIsolate(),
   3582                  obj->GetIdentityHash(ALLOW_CREATION),
   3583                  return Smi::cast(__object__)->value(),
   3584                  return 0);
   3585 }
   3586 
   3587 
   3588 MaybeObject* JSObject::GetIdentityHash(CreationFlag flag) {
   3589   Object* stored_value = GetHiddenProperty(GetHeap()->identity_hash_symbol());
   3590   if (stored_value->IsSmi()) return stored_value;
   3591 
   3592   // Do not generate permanent identity hash code if not requested.
   3593   if (flag == OMIT_CREATION) return GetHeap()->undefined_value();
   3594 
   3595   Smi* hash = GenerateIdentityHash();
   3596   MaybeObject* result = SetHiddenProperty(GetHeap()->identity_hash_symbol(),
   3597                                           hash);
   3598   if (result->IsFailure()) return result;
   3599   if (result->ToObjectUnchecked()->IsUndefined()) {
   3600     // Trying to get hash of detached proxy.
   3601     return Smi::FromInt(0);
   3602   }
   3603   return hash;
   3604 }
   3605 
   3606 
   3607 MaybeObject* JSProxy::GetIdentityHash(CreationFlag flag) {
   3608   Object* hash = this->hash();
   3609   if (!hash->IsSmi() && flag == ALLOW_CREATION) {
   3610     hash = GenerateIdentityHash();
   3611     set_hash(hash);
   3612   }
   3613   return hash;
   3614 }
   3615 
   3616 
   3617 Object* JSObject::GetHiddenProperty(String* key) {
   3618   if (IsJSGlobalProxy()) {
   3619     // For a proxy, use the prototype as target object.
   3620     Object* proxy_parent = GetPrototype();
   3621     // If the proxy is detached, return undefined.
   3622     if (proxy_parent->IsNull()) return GetHeap()->undefined_value();
   3623     ASSERT(proxy_parent->IsJSGlobalObject());
   3624     return JSObject::cast(proxy_parent)->GetHiddenProperty(key);
   3625   }
   3626   ASSERT(!IsJSGlobalProxy());
   3627   MaybeObject* hidden_lookup = GetHiddenPropertiesDictionary(false);
   3628   ASSERT(!hidden_lookup->IsFailure());  // No failure when passing false as arg.
   3629   if (hidden_lookup->ToObjectUnchecked()->IsUndefined()) {
   3630     return GetHeap()->undefined_value();
   3631   }
   3632   StringDictionary* dictionary =
   3633       StringDictionary::cast(hidden_lookup->ToObjectUnchecked());
   3634   int entry = dictionary->FindEntry(key);
   3635   if (entry == StringDictionary::kNotFound) return GetHeap()->undefined_value();
   3636   return dictionary->ValueAt(entry);
   3637 }
   3638 
   3639 
   3640 Handle<Object> JSObject::SetHiddenProperty(Handle<JSObject> obj,
   3641                                  Handle<String> key,
   3642                                  Handle<Object> value) {
   3643   CALL_HEAP_FUNCTION(obj->GetIsolate(),
   3644                      obj->SetHiddenProperty(*key, *value),
   3645                      Object);
   3646 }
   3647 
   3648 
   3649 MaybeObject* JSObject::SetHiddenProperty(String* key, Object* value) {
   3650   if (IsJSGlobalProxy()) {
   3651     // For a proxy, use the prototype as target object.
   3652     Object* proxy_parent = GetPrototype();
   3653     // If the proxy is detached, return undefined.
   3654     if (proxy_parent->IsNull()) return GetHeap()->undefined_value();
   3655     ASSERT(proxy_parent->IsJSGlobalObject());
   3656     return JSObject::cast(proxy_parent)->SetHiddenProperty(key, value);
   3657   }
   3658   ASSERT(!IsJSGlobalProxy());
   3659   MaybeObject* hidden_lookup = GetHiddenPropertiesDictionary(true);
   3660   StringDictionary* dictionary;
   3661   if (!hidden_lookup->To<StringDictionary>(&dictionary)) return hidden_lookup;
   3662 
   3663   // If it was found, check if the key is already in the dictionary.
   3664   int entry = dictionary->FindEntry(key);
   3665   if (entry != StringDictionary::kNotFound) {
   3666     // If key was found, just update the value.
   3667     dictionary->ValueAtPut(entry, value);
   3668     return this;
   3669   }
   3670   // Key was not already in the dictionary, so add the entry.
   3671   MaybeObject* insert_result = dictionary->Add(key,
   3672                                                value,
   3673                                                PropertyDetails(NONE, NORMAL));
   3674   StringDictionary* new_dict;
   3675   if (!insert_result->To<StringDictionary>(&new_dict)) return insert_result;
   3676   if (new_dict != dictionary) {
   3677     // If adding the key expanded the dictionary (i.e., Add returned a new
   3678     // dictionary), store it back to the object.
   3679     MaybeObject* store_result = SetHiddenPropertiesDictionary(new_dict);
   3680     if (store_result->IsFailure()) return store_result;
   3681   }
   3682   // Return this to mark success.
   3683   return this;
   3684 }
   3685 
   3686 
   3687 void JSObject::DeleteHiddenProperty(String* key) {
   3688   if (IsJSGlobalProxy()) {
   3689     // For a proxy, use the prototype as target object.
   3690     Object* proxy_parent = GetPrototype();
   3691     // If the proxy is detached, return immediately.
   3692     if (proxy_parent->IsNull()) return;
   3693     ASSERT(proxy_parent->IsJSGlobalObject());
   3694     JSObject::cast(proxy_parent)->DeleteHiddenProperty(key);
   3695     return;
   3696   }
   3697   MaybeObject* hidden_lookup = GetHiddenPropertiesDictionary(false);
   3698   ASSERT(!hidden_lookup->IsFailure());  // No failure when passing false as arg.
   3699   if (hidden_lookup->ToObjectUnchecked()->IsUndefined()) return;
   3700   StringDictionary* dictionary =
   3701       StringDictionary::cast(hidden_lookup->ToObjectUnchecked());
   3702   int entry = dictionary->FindEntry(key);
   3703   if (entry == StringDictionary::kNotFound) {
   3704     // Key wasn't in dictionary. Deletion is a success.
   3705     return;
   3706   }
   3707   // Key was in the dictionary. Remove it.
   3708   dictionary->DeleteProperty(entry, JSReceiver::FORCE_DELETION);
   3709 }
   3710 
   3711 
   3712 bool JSObject::HasHiddenProperties() {
   3713   return GetPropertyAttributePostInterceptor(this,
   3714                                              GetHeap()->hidden_symbol(),
   3715                                              false) != ABSENT;
   3716 }
   3717 
   3718 
   3719 MaybeObject* JSObject::GetHiddenPropertiesDictionary(bool create_if_absent) {
   3720   ASSERT(!IsJSGlobalProxy());
   3721   if (HasFastProperties()) {
   3722     // If the object has fast properties, check whether the first slot
   3723     // in the descriptor array matches the hidden symbol. Since the
   3724     // hidden symbols hash code is zero (and no other string has hash
   3725     // code zero) it will always occupy the first entry if present.
   3726     DescriptorArray* descriptors = this->map()->instance_descriptors();
   3727     if ((descriptors->number_of_descriptors() > 0) &&
   3728         (descriptors->GetKey(0) == GetHeap()->hidden_symbol())) {
   3729       if (descriptors->GetType(0) == FIELD) {
   3730         Object* hidden_store =
   3731             this->FastPropertyAt(descriptors->GetFieldIndex(0));
   3732         return StringDictionary::cast(hidden_store);
   3733       } else {
   3734         ASSERT(descriptors->GetType(0) == NULL_DESCRIPTOR ||
   3735                descriptors->GetType(0) == MAP_TRANSITION);
   3736       }
   3737     }
   3738   } else {
   3739     PropertyAttributes attributes;
   3740     // You can't install a getter on a property indexed by the hidden symbol,
   3741     // so we can be sure that GetLocalPropertyPostInterceptor returns a real
   3742     // object.
   3743     Object* lookup =
   3744         GetLocalPropertyPostInterceptor(this,
   3745                                         GetHeap()->hidden_symbol(),
   3746                                         &attributes)->ToObjectUnchecked();
   3747     if (!lookup->IsUndefined()) {
   3748       return StringDictionary::cast(lookup);
   3749     }
   3750   }
   3751   if (!create_if_absent) return GetHeap()->undefined_value();
   3752   const int kInitialSize = 5;
   3753   MaybeObject* dict_alloc = StringDictionary::Allocate(kInitialSize);
   3754   StringDictionary* dictionary;
   3755   if (!dict_alloc->To<StringDictionary>(&dictionary)) return dict_alloc;
   3756   MaybeObject* store_result =
   3757       SetPropertyPostInterceptor(GetHeap()->hidden_symbol(),
   3758                                  dictionary,
   3759                                  DONT_ENUM,
   3760                                  kNonStrictMode);
   3761   if (store_result->IsFailure()) return store_result;
   3762   return dictionary;
   3763 }
   3764 
   3765 
   3766 MaybeObject* JSObject::SetHiddenPropertiesDictionary(
   3767     StringDictionary* dictionary) {
   3768   ASSERT(!IsJSGlobalProxy());
   3769   ASSERT(HasHiddenProperties());
   3770   if (HasFastProperties()) {
   3771     // If the object has fast properties, check whether the first slot
   3772     // in the descriptor array matches the hidden symbol. Since the
   3773     // hidden symbols hash code is zero (and no other string has hash
   3774     // code zero) it will always occupy the first entry if present.
   3775     DescriptorArray* descriptors = this->map()->instance_descriptors();
   3776     if ((descriptors->number_of_descriptors() > 0) &&
   3777         (descriptors->GetKey(0) == GetHeap()->hidden_symbol())) {
   3778       if (descriptors->GetType(0) == FIELD) {
   3779         this->FastPropertyAtPut(descriptors->GetFieldIndex(0), dictionary);
   3780         return this;
   3781       } else {
   3782         ASSERT(descriptors->GetType(0) == NULL_DESCRIPTOR ||
   3783                descriptors->GetType(0) == MAP_TRANSITION);
   3784       }
   3785     }
   3786   }
   3787   MaybeObject* store_result =
   3788       SetPropertyPostInterceptor(GetHeap()->hidden_symbol(),
   3789                                  dictionary,
   3790                                  DONT_ENUM,
   3791                                  kNonStrictMode);
   3792   if (store_result->IsFailure()) return store_result;
   3793   return this;
   3794 }
   3795 
   3796 
   3797 MaybeObject* JSObject::DeletePropertyPostInterceptor(String* name,
   3798                                                      DeleteMode mode) {
   3799   // Check local property, ignore interceptor.
   3800   LookupResult result(GetIsolate());
   3801   LocalLookupRealNamedProperty(name, &result);
   3802   if (!result.IsProperty()) return GetHeap()->true_value();
   3803 
   3804   // Normalize object if needed.
   3805   Object* obj;
   3806   { MaybeObject* maybe_obj = NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
   3807     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   3808   }
   3809 
   3810   return DeleteNormalizedProperty(name, mode);
   3811 }
   3812 
   3813 
   3814 MaybeObject* JSObject::DeletePropertyWithInterceptor(String* name) {
   3815   Isolate* isolate = GetIsolate();
   3816   HandleScope scope(isolate);
   3817   Handle<InterceptorInfo> interceptor(GetNamedInterceptor());
   3818   Handle<String> name_handle(name);
   3819   Handle<JSObject> this_handle(this);
   3820   if (!interceptor->deleter()->IsUndefined()) {
   3821     v8::NamedPropertyDeleter deleter =
   3822         v8::ToCData<v8::NamedPropertyDeleter>(interceptor->deleter());
   3823     LOG(isolate,
   3824         ApiNamedPropertyAccess("interceptor-named-delete", *this_handle, name));
   3825     CustomArguments args(isolate, interceptor->data(), this, this);
   3826     v8::AccessorInfo info(args.end());
   3827     v8::Handle<v8::Boolean> result;
   3828     {
   3829       // Leaving JavaScript.
   3830       VMState state(isolate, EXTERNAL);
   3831       result = deleter(v8::Utils::ToLocal(name_handle), info);
   3832     }
   3833     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   3834     if (!result.IsEmpty()) {
   3835       ASSERT(result->IsBoolean());
   3836       return *v8::Utils::OpenHandle(*result);
   3837     }
   3838   }
   3839   MaybeObject* raw_result =
   3840       this_handle->DeletePropertyPostInterceptor(*name_handle, NORMAL_DELETION);
   3841   RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   3842   return raw_result;
   3843 }
   3844 
   3845 
   3846 MaybeObject* JSObject::DeleteElementWithInterceptor(uint32_t index) {
   3847   Isolate* isolate = GetIsolate();
   3848   Heap* heap = isolate->heap();
   3849   // Make sure that the top context does not change when doing
   3850   // callbacks or interceptor calls.
   3851   AssertNoContextChange ncc;
   3852   HandleScope scope(isolate);
   3853   Handle<InterceptorInfo> interceptor(GetIndexedInterceptor());
   3854   if (interceptor->deleter()->IsUndefined()) return heap->false_value();
   3855   v8::IndexedPropertyDeleter deleter =
   3856       v8::ToCData<v8::IndexedPropertyDeleter>(interceptor->deleter());
   3857   Handle<JSObject> this_handle(this);
   3858   LOG(isolate,
   3859       ApiIndexedPropertyAccess("interceptor-indexed-delete", this, index));
   3860   CustomArguments args(isolate, interceptor->data(), this, this);
   3861   v8::AccessorInfo info(args.end());
   3862   v8::Handle<v8::Boolean> result;
   3863   {
   3864     // Leaving JavaScript.
   3865     VMState state(isolate, EXTERNAL);
   3866     result = deleter(index, info);
   3867   }
   3868   RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   3869   if (!result.IsEmpty()) {
   3870     ASSERT(result->IsBoolean());
   3871     return *v8::Utils::OpenHandle(*result);
   3872   }
   3873   MaybeObject* raw_result = this_handle->GetElementsAccessor()->Delete(
   3874       *this_handle,
   3875       index,
   3876       NORMAL_DELETION);
   3877   RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   3878   return raw_result;
   3879 }
   3880 
   3881 
   3882 Handle<Object> JSObject::DeleteElement(Handle<JSObject> obj,
   3883                                        uint32_t index) {
   3884   CALL_HEAP_FUNCTION(obj->GetIsolate(),
   3885                      obj->DeleteElement(index, JSObject::NORMAL_DELETION),
   3886                      Object);
   3887 }
   3888 
   3889 
   3890 MaybeObject* JSObject::DeleteElement(uint32_t index, DeleteMode mode) {
   3891   Isolate* isolate = GetIsolate();
   3892   // Check access rights if needed.
   3893   if (IsAccessCheckNeeded() &&
   3894       !isolate->MayIndexedAccess(this, index, v8::ACCESS_DELETE)) {
   3895     isolate->ReportFailedAccessCheck(this, v8::ACCESS_DELETE);
   3896     return isolate->heap()->false_value();
   3897   }
   3898 
   3899   if (IsJSGlobalProxy()) {
   3900     Object* proto = GetPrototype();
   3901     if (proto->IsNull()) return isolate->heap()->false_value();
   3902     ASSERT(proto->IsJSGlobalObject());
   3903     return JSGlobalObject::cast(proto)->DeleteElement(index, mode);
   3904   }
   3905 
   3906   if (HasIndexedInterceptor()) {
   3907     // Skip interceptor if forcing deletion.
   3908     if (mode != FORCE_DELETION) {
   3909       return DeleteElementWithInterceptor(index);
   3910     }
   3911     mode = JSReceiver::FORCE_DELETION;
   3912   }
   3913 
   3914   return GetElementsAccessor()->Delete(this, index, mode);
   3915 }
   3916 
   3917 
   3918 Handle<Object> JSObject::DeleteProperty(Handle<JSObject> obj,
   3919                               Handle<String> prop) {
   3920   CALL_HEAP_FUNCTION(obj->GetIsolate(),
   3921                      obj->DeleteProperty(*prop, JSObject::NORMAL_DELETION),
   3922                      Object);
   3923 }
   3924 
   3925 
   3926 MaybeObject* JSObject::DeleteProperty(String* name, DeleteMode mode) {
   3927   Isolate* isolate = GetIsolate();
   3928   // ECMA-262, 3rd, 8.6.2.5
   3929   ASSERT(name->IsString());
   3930 
   3931   // Check access rights if needed.
   3932   if (IsAccessCheckNeeded() &&
   3933       !isolate->MayNamedAccess(this, name, v8::ACCESS_DELETE)) {
   3934     isolate->ReportFailedAccessCheck(this, v8::ACCESS_DELETE);
   3935     return isolate->heap()->false_value();
   3936   }
   3937 
   3938   if (IsJSGlobalProxy()) {
   3939     Object* proto = GetPrototype();
   3940     if (proto->IsNull()) return isolate->heap()->false_value();
   3941     ASSERT(proto->IsJSGlobalObject());
   3942     return JSGlobalObject::cast(proto)->DeleteProperty(name, mode);
   3943   }
   3944 
   3945   uint32_t index = 0;
   3946   if (name->AsArrayIndex(&index)) {
   3947     return DeleteElement(index, mode);
   3948   } else {
   3949     LookupResult result(isolate);
   3950     LocalLookup(name, &result);
   3951     if (!result.IsProperty()) return isolate->heap()->true_value();
   3952     // Ignore attributes if forcing a deletion.
   3953     if (result.IsDontDelete() && mode != FORCE_DELETION) {
   3954       if (mode == STRICT_DELETION) {
   3955         // Deleting a non-configurable property in strict mode.
   3956         HandleScope scope(isolate);
   3957         Handle<Object> args[2] = { Handle<Object>(name), Handle<Object>(this) };
   3958         return isolate->Throw(*isolate->factory()->NewTypeError(
   3959             "strict_delete_property", HandleVector(args, 2)));
   3960       }
   3961       return isolate->heap()->false_value();
   3962     }
   3963     // Check for interceptor.
   3964     if (result.type() == INTERCEPTOR) {
   3965       // Skip interceptor if forcing a deletion.
   3966       if (mode == FORCE_DELETION) {
   3967         return DeletePropertyPostInterceptor(name, mode);
   3968       }
   3969       return DeletePropertyWithInterceptor(name);
   3970     }
   3971     // Normalize object if needed.
   3972     Object* obj;
   3973     { MaybeObject* maybe_obj =
   3974           NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
   3975       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   3976     }
   3977     // Make sure the properties are normalized before removing the entry.
   3978     return DeleteNormalizedProperty(name, mode);
   3979   }
   3980 }
   3981 
   3982 
   3983 MaybeObject* JSReceiver::DeleteElement(uint32_t index, DeleteMode mode) {
   3984   if (IsJSProxy()) {
   3985     return JSProxy::cast(this)->DeleteElementWithHandler(index, mode);
   3986   }
   3987   return JSObject::cast(this)->DeleteElement(index, mode);
   3988 }
   3989 
   3990 
   3991 MaybeObject* JSReceiver::DeleteProperty(String* name, DeleteMode mode) {
   3992   if (IsJSProxy()) {
   3993     return JSProxy::cast(this)->DeletePropertyWithHandler(name, mode);
   3994   }
   3995   return JSObject::cast(this)->DeleteProperty(name, mode);
   3996 }
   3997 
   3998 
   3999 bool JSObject::ReferencesObjectFromElements(FixedArray* elements,
   4000                                             ElementsKind kind,
   4001                                             Object* object) {
   4002   ASSERT(kind == FAST_ELEMENTS ||
   4003          kind == DICTIONARY_ELEMENTS);
   4004   if (kind == FAST_ELEMENTS) {
   4005     int length = IsJSArray()
   4006         ? Smi::cast(JSArray::cast(this)->length())->value()
   4007         : elements->length();
   4008     for (int i = 0; i < length; ++i) {
   4009       Object* element = elements->get(i);
   4010       if (!element->IsTheHole() && element == object) return true;
   4011     }
   4012   } else {
   4013     Object* key =
   4014         SeededNumberDictionary::cast(elements)->SlowReverseLookup(object);
   4015     if (!key->IsUndefined()) return true;
   4016   }
   4017   return false;
   4018 }
   4019 
   4020 
   4021 // Check whether this object references another object.
   4022 bool JSObject::ReferencesObject(Object* obj) {
   4023   Map* map_of_this = map();
   4024   Heap* heap = GetHeap();
   4025   AssertNoAllocation no_alloc;
   4026 
   4027   // Is the object the constructor for this object?
   4028   if (map_of_this->constructor() == obj) {
   4029     return true;
   4030   }
   4031 
   4032   // Is the object the prototype for this object?
   4033   if (map_of_this->prototype() == obj) {
   4034     return true;
   4035   }
   4036 
   4037   // Check if the object is among the named properties.
   4038   Object* key = SlowReverseLookup(obj);
   4039   if (!key->IsUndefined()) {
   4040     return true;
   4041   }
   4042 
   4043   // Check if the object is among the indexed properties.
   4044   ElementsKind kind = GetElementsKind();
   4045   switch (kind) {
   4046     case EXTERNAL_PIXEL_ELEMENTS:
   4047     case EXTERNAL_BYTE_ELEMENTS:
   4048     case EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
   4049     case EXTERNAL_SHORT_ELEMENTS:
   4050     case EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
   4051     case EXTERNAL_INT_ELEMENTS:
   4052     case EXTERNAL_UNSIGNED_INT_ELEMENTS:
   4053     case EXTERNAL_FLOAT_ELEMENTS:
   4054     case EXTERNAL_DOUBLE_ELEMENTS:
   4055     case FAST_DOUBLE_ELEMENTS:
   4056       // Raw pixels and external arrays do not reference other
   4057       // objects.
   4058       break;
   4059     case FAST_SMI_ONLY_ELEMENTS:
   4060       break;
   4061     case FAST_ELEMENTS:
   4062     case DICTIONARY_ELEMENTS: {
   4063       FixedArray* elements = FixedArray::cast(this->elements());
   4064       if (ReferencesObjectFromElements(elements, kind, obj)) return true;
   4065       break;
   4066     }
   4067     case NON_STRICT_ARGUMENTS_ELEMENTS: {
   4068       FixedArray* parameter_map = FixedArray::cast(elements());
   4069       // Check the mapped parameters.
   4070       int length = parameter_map->length();
   4071       for (int i = 2; i < length; ++i) {
   4072         Object* value = parameter_map->get(i);
   4073         if (!value->IsTheHole() && value == obj) return true;
   4074       }
   4075       // Check the arguments.
   4076       FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
   4077       kind = arguments->IsDictionary() ? DICTIONARY_ELEMENTS : FAST_ELEMENTS;
   4078       if (ReferencesObjectFromElements(arguments, kind, obj)) return true;
   4079       break;
   4080     }
   4081   }
   4082 
   4083   // For functions check the context.
   4084   if (IsJSFunction()) {
   4085     // Get the constructor function for arguments array.
   4086     JSObject* arguments_boilerplate =
   4087         heap->isolate()->context()->global_context()->
   4088             arguments_boilerplate();
   4089     JSFunction* arguments_function =
   4090         JSFunction::cast(arguments_boilerplate->map()->constructor());
   4091 
   4092     // Get the context and don't check if it is the global context.
   4093     JSFunction* f = JSFunction::cast(this);
   4094     Context* context = f->context();
   4095     if (context->IsGlobalContext()) {
   4096       return false;
   4097     }
   4098 
   4099     // Check the non-special context slots.
   4100     for (int i = Context::MIN_CONTEXT_SLOTS; i < context->length(); i++) {
   4101       // Only check JS objects.
   4102       if (context->get(i)->IsJSObject()) {
   4103         JSObject* ctxobj = JSObject::cast(context->get(i));
   4104         // If it is an arguments array check the content.
   4105         if (ctxobj->map()->constructor() == arguments_function) {
   4106           if (ctxobj->ReferencesObject(obj)) {
   4107             return true;
   4108           }
   4109         } else if (ctxobj == obj) {
   4110           return true;
   4111         }
   4112       }
   4113     }
   4114 
   4115     // Check the context extension (if any) if it can have references.
   4116     if (context->has_extension() && !context->IsCatchContext()) {
   4117       return JSObject::cast(context->extension())->ReferencesObject(obj);
   4118     }
   4119   }
   4120 
   4121   // No references to object.
   4122   return false;
   4123 }
   4124 
   4125 
   4126 Handle<Object> JSObject::PreventExtensions(Handle<JSObject> object) {
   4127   CALL_HEAP_FUNCTION(object->GetIsolate(), object->PreventExtensions(), Object);
   4128 }
   4129 
   4130 
   4131 MaybeObject* JSObject::PreventExtensions() {
   4132   Isolate* isolate = GetIsolate();
   4133   if (IsAccessCheckNeeded() &&
   4134       !isolate->MayNamedAccess(this,
   4135                                isolate->heap()->undefined_value(),
   4136                                v8::ACCESS_KEYS)) {
   4137     isolate->ReportFailedAccessCheck(this, v8::ACCESS_KEYS);
   4138     return isolate->heap()->false_value();
   4139   }
   4140 
   4141   if (IsJSGlobalProxy()) {
   4142     Object* proto = GetPrototype();
   4143     if (proto->IsNull()) return this;
   4144     ASSERT(proto->IsJSGlobalObject());
   4145     return JSObject::cast(proto)->PreventExtensions();
   4146   }
   4147 
   4148   // It's not possible to seal objects with external array elements
   4149   if (HasExternalArrayElements()) {
   4150     HandleScope scope(isolate);
   4151     Handle<Object> object(this);
   4152     Handle<Object> error  =
   4153         isolate->factory()->NewTypeError(
   4154             "cant_prevent_ext_external_array_elements",
   4155             HandleVector(&object, 1));
   4156     return isolate->Throw(*error);
   4157   }
   4158 
   4159   // If there are fast elements we normalize.
   4160   SeededNumberDictionary* dictionary = NULL;
   4161   { MaybeObject* maybe = NormalizeElements();
   4162     if (!maybe->To<SeededNumberDictionary>(&dictionary)) return maybe;
   4163   }
   4164   ASSERT(HasDictionaryElements() || HasDictionaryArgumentsElements());
   4165   // Make sure that we never go back to fast case.
   4166   dictionary->set_requires_slow_elements();
   4167 
   4168   // Do a map transition, other objects with this map may still
   4169   // be extensible.
   4170   Map* new_map;
   4171   { MaybeObject* maybe = map()->CopyDropTransitions();
   4172     if (!maybe->To<Map>(&new_map)) return maybe;
   4173   }
   4174   new_map->set_is_extensible(false);
   4175   set_map(new_map);
   4176   ASSERT(!map()->is_extensible());
   4177   return new_map;
   4178 }
   4179 
   4180 
   4181 // Tests for the fast common case for property enumeration:
   4182 // - This object and all prototypes has an enum cache (which means that
   4183 //   it is no proxy, has no interceptors and needs no access checks).
   4184 // - This object has no elements.
   4185 // - No prototype has enumerable properties/elements.
   4186 bool JSReceiver::IsSimpleEnum() {
   4187   Heap* heap = GetHeap();
   4188   for (Object* o = this;
   4189        o != heap->null_value();
   4190        o = JSObject::cast(o)->GetPrototype()) {
   4191     if (!o->IsJSObject()) return false;
   4192     JSObject* curr = JSObject::cast(o);
   4193     if (!curr->map()->instance_descriptors()->HasEnumCache()) return false;
   4194     ASSERT(!curr->HasNamedInterceptor());
   4195     ASSERT(!curr->HasIndexedInterceptor());
   4196     ASSERT(!curr->IsAccessCheckNeeded());
   4197     if (curr->NumberOfEnumElements() > 0) return false;
   4198     if (curr != this) {
   4199       FixedArray* curr_fixed_array =
   4200           FixedArray::cast(curr->map()->instance_descriptors()->GetEnumCache());
   4201       if (curr_fixed_array->length() > 0) return false;
   4202     }
   4203   }
   4204   return true;
   4205 }
   4206 
   4207 
   4208 int Map::NumberOfDescribedProperties(PropertyAttributes filter) {
   4209   int result = 0;
   4210   DescriptorArray* descs = instance_descriptors();
   4211   for (int i = 0; i < descs->number_of_descriptors(); i++) {
   4212     PropertyDetails details(descs->GetDetails(i));
   4213     if (descs->IsProperty(i) && (details.attributes() & filter) == 0) {
   4214       result++;
   4215     }
   4216   }
   4217   return result;
   4218 }
   4219 
   4220 
   4221 int Map::PropertyIndexFor(String* name) {
   4222   DescriptorArray* descs = instance_descriptors();
   4223   for (int i = 0; i < descs->number_of_descriptors(); i++) {
   4224     if (name->Equals(descs->GetKey(i)) && !descs->IsNullDescriptor(i)) {
   4225       return descs->GetFieldIndex(i);
   4226     }
   4227   }
   4228   return -1;
   4229 }
   4230 
   4231 
   4232 int Map::NextFreePropertyIndex() {
   4233   int max_index = -1;
   4234   DescriptorArray* descs = instance_descriptors();
   4235   for (int i = 0; i < descs->number_of_descriptors(); i++) {
   4236     if (descs->GetType(i) == FIELD) {
   4237       int current_index = descs->GetFieldIndex(i);
   4238       if (current_index > max_index) max_index = current_index;
   4239     }
   4240   }
   4241   return max_index + 1;
   4242 }
   4243 
   4244 
   4245 AccessorDescriptor* Map::FindAccessor(String* name) {
   4246   DescriptorArray* descs = instance_descriptors();
   4247   for (int i = 0; i < descs->number_of_descriptors(); i++) {
   4248     if (name->Equals(descs->GetKey(i)) && descs->GetType(i) == CALLBACKS) {
   4249       return descs->GetCallbacks(i);
   4250     }
   4251   }
   4252   return NULL;
   4253 }
   4254 
   4255 
   4256 void JSReceiver::LocalLookup(String* name, LookupResult* result) {
   4257   ASSERT(name->IsString());
   4258 
   4259   Heap* heap = GetHeap();
   4260 
   4261   if (IsJSGlobalProxy()) {
   4262     Object* proto = GetPrototype();
   4263     if (proto->IsNull()) return result->NotFound();
   4264     ASSERT(proto->IsJSGlobalObject());
   4265     return JSReceiver::cast(proto)->LocalLookup(name, result);
   4266   }
   4267 
   4268   if (IsJSProxy()) {
   4269     result->HandlerResult(JSProxy::cast(this));
   4270     return;
   4271   }
   4272 
   4273   // Do not use inline caching if the object is a non-global object
   4274   // that requires access checks.
   4275   if (IsAccessCheckNeeded()) {
   4276     result->DisallowCaching();
   4277   }
   4278 
   4279   JSObject* js_object = JSObject::cast(this);
   4280 
   4281   // Check __proto__ before interceptor.
   4282   if (name->Equals(heap->Proto_symbol()) && !IsJSContextExtensionObject()) {
   4283     result->ConstantResult(js_object);
   4284     return;
   4285   }
   4286 
   4287   // Check for lookup interceptor except when bootstrapping.
   4288   if (js_object->HasNamedInterceptor() &&
   4289       !heap->isolate()->bootstrapper()->IsActive()) {
   4290     result->InterceptorResult(js_object);
   4291     return;
   4292   }
   4293 
   4294   js_object->LocalLookupRealNamedProperty(name, result);
   4295 }
   4296 
   4297 
   4298 void JSReceiver::Lookup(String* name, LookupResult* result) {
   4299   // Ecma-262 3rd 8.6.2.4
   4300   Heap* heap = GetHeap();
   4301   for (Object* current = this;
   4302        current != heap->null_value();
   4303        current = JSObject::cast(current)->GetPrototype()) {
   4304     JSReceiver::cast(current)->LocalLookup(name, result);
   4305     if (result->IsProperty()) return;
   4306   }
   4307   result->NotFound();
   4308 }
   4309 
   4310 
   4311 // Search object and it's prototype chain for callback properties.
   4312 void JSObject::LookupCallback(String* name, LookupResult* result) {
   4313   Heap* heap = GetHeap();
   4314   for (Object* current = this;
   4315        current != heap->null_value() && current->IsJSObject();
   4316        current = JSObject::cast(current)->GetPrototype()) {
   4317     JSObject::cast(current)->LocalLookupRealNamedProperty(name, result);
   4318     if (result->IsFound() && result->type() == CALLBACKS) return;
   4319   }
   4320   result->NotFound();
   4321 }
   4322 
   4323 
   4324 // Try to update an accessor in an elements dictionary. Return true if the
   4325 // update succeeded, and false otherwise.
   4326 static bool UpdateGetterSetterInDictionary(
   4327     SeededNumberDictionary* dictionary,
   4328     uint32_t index,
   4329     Object* getter,
   4330     Object* setter,
   4331     PropertyAttributes attributes) {
   4332   int entry = dictionary->FindEntry(index);
   4333   if (entry != SeededNumberDictionary::kNotFound) {
   4334     Object* result = dictionary->ValueAt(entry);
   4335     PropertyDetails details = dictionary->DetailsAt(entry);
   4336     if (details.type() == CALLBACKS && result->IsAccessorPair()) {
   4337       ASSERT(!details.IsDontDelete());
   4338       if (details.attributes() != attributes) {
   4339         dictionary->DetailsAtPut(entry,
   4340                                  PropertyDetails(attributes, CALLBACKS, index));
   4341       }
   4342       AccessorPair::cast(result)->SetComponents(getter, setter);
   4343       return true;
   4344     }
   4345   }
   4346   return false;
   4347 }
   4348 
   4349 
   4350 MaybeObject* JSObject::DefineElementAccessor(uint32_t index,
   4351                                              Object* getter,
   4352                                              Object* setter,
   4353                                              PropertyAttributes attributes) {
   4354   switch (GetElementsKind()) {
   4355     case FAST_SMI_ONLY_ELEMENTS:
   4356     case FAST_ELEMENTS:
   4357     case FAST_DOUBLE_ELEMENTS:
   4358       break;
   4359     case EXTERNAL_PIXEL_ELEMENTS:
   4360     case EXTERNAL_BYTE_ELEMENTS:
   4361     case EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
   4362     case EXTERNAL_SHORT_ELEMENTS:
   4363     case EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
   4364     case EXTERNAL_INT_ELEMENTS:
   4365     case EXTERNAL_UNSIGNED_INT_ELEMENTS:
   4366     case EXTERNAL_FLOAT_ELEMENTS:
   4367     case EXTERNAL_DOUBLE_ELEMENTS:
   4368       // Ignore getters and setters on pixel and external array elements.
   4369       return GetHeap()->undefined_value();
   4370     case DICTIONARY_ELEMENTS:
   4371       if (UpdateGetterSetterInDictionary(element_dictionary(),
   4372                                          index,
   4373                                          getter,
   4374                                          setter,
   4375                                          attributes)) {
   4376         return GetHeap()->undefined_value();
   4377       }
   4378       break;
   4379     case NON_STRICT_ARGUMENTS_ELEMENTS: {
   4380       // Ascertain whether we have read-only properties or an existing
   4381       // getter/setter pair in an arguments elements dictionary backing
   4382       // store.
   4383       FixedArray* parameter_map = FixedArray::cast(elements());
   4384       uint32_t length = parameter_map->length();
   4385       Object* probe =
   4386           index < (length - 2) ? parameter_map->get(index + 2) : NULL;
   4387       if (probe == NULL || probe->IsTheHole()) {
   4388         FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
   4389         if (arguments->IsDictionary()) {
   4390           SeededNumberDictionary* dictionary =
   4391               SeededNumberDictionary::cast(arguments);
   4392           if (UpdateGetterSetterInDictionary(dictionary,
   4393                                              index,
   4394                                              getter,
   4395                                              setter,
   4396                                              attributes)) {
   4397             return GetHeap()->undefined_value();
   4398           }
   4399         }
   4400       }
   4401       break;
   4402     }
   4403   }
   4404 
   4405   AccessorPair* accessors;
   4406   { MaybeObject* maybe_accessors = GetHeap()->AllocateAccessorPair();
   4407     if (!maybe_accessors->To(&accessors)) return maybe_accessors;
   4408   }
   4409   accessors->SetComponents(getter, setter);
   4410 
   4411   return SetElementCallback(index, accessors, attributes);
   4412 }
   4413 
   4414 
   4415 MaybeObject* JSObject::DefinePropertyAccessor(String* name,
   4416                                               Object* getter,
   4417                                               Object* setter,
   4418                                               PropertyAttributes attributes) {
   4419   // Lookup the name.
   4420   LookupResult result(GetHeap()->isolate());
   4421   LocalLookupRealNamedProperty(name, &result);
   4422   if (result.IsFound()) {
   4423     if (result.type() == CALLBACKS) {
   4424       ASSERT(!result.IsDontDelete());
   4425       Object* obj = result.GetCallbackObject();
   4426       // Need to preserve old getters/setters.
   4427       if (obj->IsAccessorPair()) {
   4428         AccessorPair* copy;
   4429         { MaybeObject* maybe_copy =
   4430               AccessorPair::cast(obj)->CopyWithoutTransitions();
   4431           if (!maybe_copy->To(&copy)) return maybe_copy;
   4432         }
   4433         copy->SetComponents(getter, setter);
   4434         // Use set to update attributes.
   4435         return SetPropertyCallback(name, copy, attributes);
   4436       }
   4437     }
   4438   }
   4439 
   4440   AccessorPair* accessors;
   4441   { MaybeObject* maybe_accessors = GetHeap()->AllocateAccessorPair();
   4442     if (!maybe_accessors->To(&accessors)) return maybe_accessors;
   4443   }
   4444   accessors->SetComponents(getter, setter);
   4445 
   4446   return SetPropertyCallback(name, accessors, attributes);
   4447 }
   4448 
   4449 
   4450 bool JSObject::CanSetCallback(String* name) {
   4451   ASSERT(!IsAccessCheckNeeded() ||
   4452          GetIsolate()->MayNamedAccess(this, name, v8::ACCESS_SET));
   4453 
   4454   // Check if there is an API defined callback object which prohibits
   4455   // callback overwriting in this object or it's prototype chain.
   4456   // This mechanism is needed for instance in a browser setting, where
   4457   // certain accessors such as window.location should not be allowed
   4458   // to be overwritten because allowing overwriting could potentially
   4459   // cause security problems.
   4460   LookupResult callback_result(GetIsolate());
   4461   LookupCallback(name, &callback_result);
   4462   if (callback_result.IsProperty()) {
   4463     Object* obj = callback_result.GetCallbackObject();
   4464     if (obj->IsAccessorInfo() &&
   4465         AccessorInfo::cast(obj)->prohibits_overwriting()) {
   4466       return false;
   4467     }
   4468   }
   4469 
   4470   return true;
   4471 }
   4472 
   4473 
   4474 MaybeObject* JSObject::SetElementCallback(uint32_t index,
   4475                                           Object* structure,
   4476                                           PropertyAttributes attributes) {
   4477   PropertyDetails details = PropertyDetails(attributes, CALLBACKS);
   4478 
   4479   // Normalize elements to make this operation simple.
   4480   SeededNumberDictionary* dictionary;
   4481   { MaybeObject* maybe_dictionary = NormalizeElements();
   4482     if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
   4483   }
   4484   ASSERT(HasDictionaryElements() || HasDictionaryArgumentsElements());
   4485 
   4486   // Update the dictionary with the new CALLBACKS property.
   4487   { MaybeObject* maybe_dictionary = dictionary->Set(index, structure, details);
   4488     if (!maybe_dictionary->To(&dictionary)) return maybe_dictionary;
   4489   }
   4490 
   4491   dictionary->set_requires_slow_elements();
   4492   // Update the dictionary backing store on the object.
   4493   if (elements()->map() == GetHeap()->non_strict_arguments_elements_map()) {
   4494     // Also delete any parameter alias.
   4495     //
   4496     // TODO(kmillikin): when deleting the last parameter alias we could
   4497     // switch to a direct backing store without the parameter map.  This
   4498     // would allow GC of the context.
   4499     FixedArray* parameter_map = FixedArray::cast(elements());
   4500     if (index < static_cast<uint32_t>(parameter_map->length()) - 2) {
   4501       parameter_map->set(index + 2, GetHeap()->the_hole_value());
   4502     }
   4503     parameter_map->set(1, dictionary);
   4504   } else {
   4505     set_elements(dictionary);
   4506   }
   4507 
   4508   return GetHeap()->undefined_value();
   4509 }
   4510 
   4511 
   4512 MaybeObject* JSObject::SetPropertyCallback(String* name,
   4513                                            Object* structure,
   4514                                            PropertyAttributes attributes) {
   4515   // Normalize object to make this operation simple.
   4516   { MaybeObject* maybe_ok = NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
   4517     if (maybe_ok->IsFailure()) return maybe_ok;
   4518   }
   4519 
   4520   // For the global object allocate a new map to invalidate the global inline
   4521   // caches which have a global property cell reference directly in the code.
   4522   if (IsGlobalObject()) {
   4523     Map* new_map;
   4524     { MaybeObject* maybe_new_map = map()->CopyDropDescriptors();
   4525       if (!maybe_new_map->To(&new_map)) return maybe_new_map;
   4526     }
   4527     set_map(new_map);
   4528     // When running crankshaft, changing the map is not enough. We
   4529     // need to deoptimize all functions that rely on this global
   4530     // object.
   4531     Deoptimizer::DeoptimizeGlobalObject(this);
   4532   }
   4533 
   4534   // Update the dictionary with the new CALLBACKS property.
   4535   PropertyDetails details = PropertyDetails(attributes, CALLBACKS);
   4536   { MaybeObject* maybe_ok = SetNormalizedProperty(name, structure, details);
   4537     if (maybe_ok->IsFailure()) return maybe_ok;
   4538   }
   4539 
   4540   return GetHeap()->undefined_value();
   4541 }
   4542 
   4543 
   4544 void JSObject::DefineAccessor(Handle<JSObject> object,
   4545                               Handle<String> name,
   4546                               Handle<Object> getter,
   4547                               Handle<Object> setter,
   4548                               PropertyAttributes attributes) {
   4549   CALL_HEAP_FUNCTION_VOID(
   4550       object->GetIsolate(),
   4551       object->DefineAccessor(*name, *getter, *setter, attributes));
   4552 }
   4553 
   4554 MaybeObject* JSObject::DefineAccessor(String* name,
   4555                                       Object* getter,
   4556                                       Object* setter,
   4557                                       PropertyAttributes attributes) {
   4558   Isolate* isolate = GetIsolate();
   4559   // Check access rights if needed.
   4560   if (IsAccessCheckNeeded() &&
   4561       !isolate->MayNamedAccess(this, name, v8::ACCESS_SET)) {
   4562     isolate->ReportFailedAccessCheck(this, v8::ACCESS_SET);
   4563     return isolate->heap()->undefined_value();
   4564   }
   4565 
   4566   if (IsJSGlobalProxy()) {
   4567     Object* proto = GetPrototype();
   4568     if (proto->IsNull()) return this;
   4569     ASSERT(proto->IsJSGlobalObject());
   4570     return JSObject::cast(proto)->DefineAccessor(
   4571         name, getter, setter, attributes);
   4572   }
   4573 
   4574   // Make sure that the top context does not change when doing callbacks or
   4575   // interceptor calls.
   4576   AssertNoContextChange ncc;
   4577 
   4578   // Try to flatten before operating on the string.
   4579   name->TryFlatten();
   4580 
   4581   if (!CanSetCallback(name)) return isolate->heap()->undefined_value();
   4582 
   4583   uint32_t index = 0;
   4584   return name->AsArrayIndex(&index) ?
   4585       DefineElementAccessor(index, getter, setter, attributes) :
   4586       DefinePropertyAccessor(name, getter, setter, attributes);
   4587 }
   4588 
   4589 
   4590 MaybeObject* JSObject::DefineAccessor(AccessorInfo* info) {
   4591   Isolate* isolate = GetIsolate();
   4592   String* name = String::cast(info->name());
   4593   // Check access rights if needed.
   4594   if (IsAccessCheckNeeded() &&
   4595       !isolate->MayNamedAccess(this, name, v8::ACCESS_SET)) {
   4596     isolate->ReportFailedAccessCheck(this, v8::ACCESS_SET);
   4597     return isolate->heap()->undefined_value();
   4598   }
   4599 
   4600   if (IsJSGlobalProxy()) {
   4601     Object* proto = GetPrototype();
   4602     if (proto->IsNull()) return this;
   4603     ASSERT(proto->IsJSGlobalObject());
   4604     return JSObject::cast(proto)->DefineAccessor(info);
   4605   }
   4606 
   4607   // Make sure that the top context does not change when doing callbacks or
   4608   // interceptor calls.
   4609   AssertNoContextChange ncc;
   4610 
   4611   // Try to flatten before operating on the string.
   4612   name->TryFlatten();
   4613 
   4614   if (!CanSetCallback(name)) {
   4615     return isolate->heap()->undefined_value();
   4616   }
   4617 
   4618   uint32_t index = 0;
   4619   bool is_element = name->AsArrayIndex(&index);
   4620 
   4621   if (is_element) {
   4622     if (IsJSArray()) return isolate->heap()->undefined_value();
   4623 
   4624     // Accessors overwrite previous callbacks (cf. with getters/setters).
   4625     switch (GetElementsKind()) {
   4626       case FAST_SMI_ONLY_ELEMENTS:
   4627       case FAST_ELEMENTS:
   4628       case FAST_DOUBLE_ELEMENTS:
   4629         break;
   4630       case EXTERNAL_PIXEL_ELEMENTS:
   4631       case EXTERNAL_BYTE_ELEMENTS:
   4632       case EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
   4633       case EXTERNAL_SHORT_ELEMENTS:
   4634       case EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
   4635       case EXTERNAL_INT_ELEMENTS:
   4636       case EXTERNAL_UNSIGNED_INT_ELEMENTS:
   4637       case EXTERNAL_FLOAT_ELEMENTS:
   4638       case EXTERNAL_DOUBLE_ELEMENTS:
   4639         // Ignore getters and setters on pixel and external array
   4640         // elements.
   4641         return isolate->heap()->undefined_value();
   4642       case DICTIONARY_ELEMENTS:
   4643         break;
   4644       case NON_STRICT_ARGUMENTS_ELEMENTS:
   4645         UNIMPLEMENTED();
   4646         break;
   4647     }
   4648 
   4649     { MaybeObject* maybe_ok =
   4650           SetElementCallback(index, info, info->property_attributes());
   4651       if (maybe_ok->IsFailure()) return maybe_ok;
   4652     }
   4653   } else {
   4654     // Lookup the name.
   4655     LookupResult result(isolate);
   4656     LocalLookup(name, &result);
   4657     // ES5 forbids turning a property into an accessor if it's not
   4658     // configurable (that is IsDontDelete in ES3 and v8), see 8.6.1 (Table 5).
   4659     if (result.IsProperty() && (result.IsReadOnly() || result.IsDontDelete())) {
   4660       return isolate->heap()->undefined_value();
   4661     }
   4662     { MaybeObject* maybe_ok =
   4663           SetPropertyCallback(name, info, info->property_attributes());
   4664       if (maybe_ok->IsFailure()) return maybe_ok;
   4665     }
   4666   }
   4667 
   4668   return this;
   4669 }
   4670 
   4671 
   4672 Object* JSObject::LookupAccessor(String* name, AccessorComponent component) {
   4673   Heap* heap = GetHeap();
   4674 
   4675   // Make sure that the top context does not change when doing callbacks or
   4676   // interceptor calls.
   4677   AssertNoContextChange ncc;
   4678 
   4679   // Check access rights if needed.
   4680   if (IsAccessCheckNeeded() &&
   4681       !heap->isolate()->MayNamedAccess(this, name, v8::ACCESS_HAS)) {
   4682     heap->isolate()->ReportFailedAccessCheck(this, v8::ACCESS_HAS);
   4683     return heap->undefined_value();
   4684   }
   4685 
   4686   // Make the lookup and include prototypes.
   4687   uint32_t index = 0;
   4688   if (name->AsArrayIndex(&index)) {
   4689     for (Object* obj = this;
   4690          obj != heap->null_value();
   4691          obj = JSObject::cast(obj)->GetPrototype()) {
   4692       JSObject* js_object = JSObject::cast(obj);
   4693       if (js_object->HasDictionaryElements()) {
   4694         SeededNumberDictionary* dictionary = js_object->element_dictionary();
   4695         int entry = dictionary->FindEntry(index);
   4696         if (entry != SeededNumberDictionary::kNotFound) {
   4697           Object* element = dictionary->ValueAt(entry);
   4698           if (dictionary->DetailsAt(entry).type() == CALLBACKS &&
   4699               element->IsAccessorPair()) {
   4700             return AccessorPair::cast(element)->GetComponent(component);
   4701           }
   4702         }
   4703       }
   4704     }
   4705   } else {
   4706     for (Object* obj = this;
   4707          obj != heap->null_value();
   4708          obj = JSObject::cast(obj)->GetPrototype()) {
   4709       LookupResult result(heap->isolate());
   4710       JSObject::cast(obj)->LocalLookup(name, &result);
   4711       if (result.IsProperty()) {
   4712         if (result.IsReadOnly()) return heap->undefined_value();
   4713         if (result.type() == CALLBACKS) {
   4714           Object* obj = result.GetCallbackObject();
   4715           if (obj->IsAccessorPair()) {
   4716             return AccessorPair::cast(obj)->GetComponent(component);
   4717           }
   4718         }
   4719       }
   4720     }
   4721   }
   4722   return heap->undefined_value();
   4723 }
   4724 
   4725 
   4726 Object* JSObject::SlowReverseLookup(Object* value) {
   4727   if (HasFastProperties()) {
   4728     DescriptorArray* descs = map()->instance_descriptors();
   4729     for (int i = 0; i < descs->number_of_descriptors(); i++) {
   4730       if (descs->GetType(i) == FIELD) {
   4731         if (FastPropertyAt(descs->GetFieldIndex(i)) == value) {
   4732           return descs->GetKey(i);
   4733         }
   4734       } else if (descs->GetType(i) == CONSTANT_FUNCTION) {
   4735         if (descs->GetConstantFunction(i) == value) {
   4736           return descs->GetKey(i);
   4737         }
   4738       }
   4739     }
   4740     return GetHeap()->undefined_value();
   4741   } else {
   4742     return property_dictionary()->SlowReverseLookup(value);
   4743   }
   4744 }
   4745 
   4746 
   4747 MaybeObject* Map::CopyDropDescriptors() {
   4748   Heap* heap = GetHeap();
   4749   Object* result;
   4750   { MaybeObject* maybe_result =
   4751         heap->AllocateMap(instance_type(), instance_size());
   4752     if (!maybe_result->ToObject(&result)) return maybe_result;
   4753   }
   4754   Map::cast(result)->set_prototype(prototype());
   4755   Map::cast(result)->set_constructor(constructor());
   4756   // Don't copy descriptors, so map transitions always remain a forest.
   4757   // If we retained the same descriptors we would have two maps
   4758   // pointing to the same transition which is bad because the garbage
   4759   // collector relies on being able to reverse pointers from transitions
   4760   // to maps.  If properties need to be retained use CopyDropTransitions.
   4761   Map::cast(result)->clear_instance_descriptors();
   4762   // Please note instance_type and instance_size are set when allocated.
   4763   Map::cast(result)->set_inobject_properties(inobject_properties());
   4764   Map::cast(result)->set_unused_property_fields(unused_property_fields());
   4765 
   4766   // If the map has pre-allocated properties always start out with a descriptor
   4767   // array describing these properties.
   4768   if (pre_allocated_property_fields() > 0) {
   4769     ASSERT(constructor()->IsJSFunction());
   4770     JSFunction* ctor = JSFunction::cast(constructor());
   4771     Object* descriptors;
   4772     { MaybeObject* maybe_descriptors =
   4773           ctor->initial_map()->instance_descriptors()->RemoveTransitions();
   4774       if (!maybe_descriptors->ToObject(&descriptors)) return maybe_descriptors;
   4775     }
   4776     Map::cast(result)->set_instance_descriptors(
   4777         DescriptorArray::cast(descriptors));
   4778     Map::cast(result)->set_pre_allocated_property_fields(
   4779         pre_allocated_property_fields());
   4780   }
   4781   Map::cast(result)->set_bit_field(bit_field());
   4782   Map::cast(result)->set_bit_field2(bit_field2());
   4783   Map::cast(result)->set_bit_field3(bit_field3());
   4784   Map::cast(result)->set_is_shared(false);
   4785   Map::cast(result)->ClearCodeCache(heap);
   4786   return result;
   4787 }
   4788 
   4789 
   4790 MaybeObject* Map::CopyNormalized(PropertyNormalizationMode mode,
   4791                                  NormalizedMapSharingMode sharing) {
   4792   int new_instance_size = instance_size();
   4793   if (mode == CLEAR_INOBJECT_PROPERTIES) {
   4794     new_instance_size -= inobject_properties() * kPointerSize;
   4795   }
   4796 
   4797   Object* result;
   4798   { MaybeObject* maybe_result =
   4799         GetHeap()->AllocateMap(instance_type(), new_instance_size);
   4800     if (!maybe_result->ToObject(&result)) return maybe_result;
   4801   }
   4802 
   4803   if (mode != CLEAR_INOBJECT_PROPERTIES) {
   4804     Map::cast(result)->set_inobject_properties(inobject_properties());
   4805   }
   4806 
   4807   Map::cast(result)->set_prototype(prototype());
   4808   Map::cast(result)->set_constructor(constructor());
   4809 
   4810   Map::cast(result)->set_bit_field(bit_field());
   4811   Map::cast(result)->set_bit_field2(bit_field2());
   4812   Map::cast(result)->set_bit_field3(bit_field3());
   4813 
   4814   Map::cast(result)->set_is_shared(sharing == SHARED_NORMALIZED_MAP);
   4815 
   4816 #ifdef DEBUG
   4817   if (FLAG_verify_heap && Map::cast(result)->is_shared()) {
   4818     Map::cast(result)->SharedMapVerify();
   4819   }
   4820 #endif
   4821 
   4822   return result;
   4823 }
   4824 
   4825 
   4826 MaybeObject* Map::CopyDropTransitions() {
   4827   Object* new_map;
   4828   { MaybeObject* maybe_new_map = CopyDropDescriptors();
   4829     if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
   4830   }
   4831   Object* descriptors;
   4832   { MaybeObject* maybe_descriptors =
   4833         instance_descriptors()->RemoveTransitions();
   4834     if (!maybe_descriptors->ToObject(&descriptors)) return maybe_descriptors;
   4835   }
   4836   cast(new_map)->set_instance_descriptors(DescriptorArray::cast(descriptors));
   4837   return new_map;
   4838 }
   4839 
   4840 void Map::UpdateCodeCache(Handle<Map> map,
   4841                           Handle<String> name,
   4842                           Handle<Code> code) {
   4843   Isolate* isolate = map->GetIsolate();
   4844   CALL_HEAP_FUNCTION_VOID(isolate,
   4845                           map->UpdateCodeCache(*name, *code));
   4846 }
   4847 
   4848 MaybeObject* Map::UpdateCodeCache(String* name, Code* code) {
   4849   // Allocate the code cache if not present.
   4850   if (code_cache()->IsFixedArray()) {
   4851     Object* result;
   4852     { MaybeObject* maybe_result = GetHeap()->AllocateCodeCache();
   4853       if (!maybe_result->ToObject(&result)) return maybe_result;
   4854     }
   4855     set_code_cache(result);
   4856   }
   4857 
   4858   // Update the code cache.
   4859   return CodeCache::cast(code_cache())->Update(name, code);
   4860 }
   4861 
   4862 
   4863 Object* Map::FindInCodeCache(String* name, Code::Flags flags) {
   4864   // Do a lookup if a code cache exists.
   4865   if (!code_cache()->IsFixedArray()) {
   4866     return CodeCache::cast(code_cache())->Lookup(name, flags);
   4867   } else {
   4868     return GetHeap()->undefined_value();
   4869   }
   4870 }
   4871 
   4872 
   4873 int Map::IndexInCodeCache(Object* name, Code* code) {
   4874   // Get the internal index if a code cache exists.
   4875   if (!code_cache()->IsFixedArray()) {
   4876     return CodeCache::cast(code_cache())->GetIndex(name, code);
   4877   }
   4878   return -1;
   4879 }
   4880 
   4881 
   4882 void Map::RemoveFromCodeCache(String* name, Code* code, int index) {
   4883   // No GC is supposed to happen between a call to IndexInCodeCache and
   4884   // RemoveFromCodeCache so the code cache must be there.
   4885   ASSERT(!code_cache()->IsFixedArray());
   4886   CodeCache::cast(code_cache())->RemoveByIndex(name, code, index);
   4887 }
   4888 
   4889 
   4890 // An iterator over all map transitions in an descriptor array, reusing the map
   4891 // field of the contens array while it is running.
   4892 class IntrusiveMapTransitionIterator {
   4893  public:
   4894   explicit IntrusiveMapTransitionIterator(DescriptorArray* descriptor_array)
   4895       : descriptor_array_(descriptor_array) { }
   4896 
   4897   void Start() {
   4898     ASSERT(!IsIterating());
   4899     if (HasContentArray()) *ContentHeader() = Smi::FromInt(0);
   4900   }
   4901 
   4902   bool IsIterating() {
   4903     return HasContentArray() && (*ContentHeader())->IsSmi();
   4904   }
   4905 
   4906   Map* Next() {
   4907     ASSERT(IsIterating());
   4908     FixedArray* contents = ContentArray();
   4909     // Attention, tricky index manipulation ahead: Every entry in the contents
   4910     // array consists of a value/details pair, so the index is typically even.
   4911     // An exception is made for CALLBACKS entries: An even index means we look
   4912     // at its getter, and an odd index means we look at its setter.
   4913     int index = Smi::cast(*ContentHeader())->value();
   4914     while (index < contents->length()) {
   4915       PropertyDetails details(Smi::cast(contents->get(index | 1)));
   4916       switch (details.type()) {
   4917         case MAP_TRANSITION:
   4918         case CONSTANT_TRANSITION:
   4919         case ELEMENTS_TRANSITION:
   4920           // We definitely have a map transition.
   4921           *ContentHeader() = Smi::FromInt(index + 2);
   4922           return static_cast<Map*>(contents->get(index));
   4923         case CALLBACKS: {
   4924           // We might have a map transition in a getter or in a setter.
   4925           AccessorPair* accessors =
   4926               static_cast<AccessorPair*>(contents->get(index & ~1));
   4927           Object* accessor =
   4928               ((index & 1) == 0) ? accessors->getter() : accessors->setter();
   4929           index++;
   4930           if (accessor->IsMap()) {
   4931             *ContentHeader() = Smi::FromInt(index);
   4932             return static_cast<Map*>(accessor);
   4933           }
   4934           break;
   4935         }
   4936         case NORMAL:
   4937         case FIELD:
   4938         case CONSTANT_FUNCTION:
   4939         case HANDLER:
   4940         case INTERCEPTOR:
   4941         case NULL_DESCRIPTOR:
   4942           // We definitely have no map transition.
   4943           index += 2;
   4944           break;
   4945       }
   4946     }
   4947     *ContentHeader() = descriptor_array_->GetHeap()->fixed_array_map();
   4948     return NULL;
   4949   }
   4950 
   4951  private:
   4952   bool HasContentArray() {
   4953     return descriptor_array_-> length() > DescriptorArray::kContentArrayIndex;
   4954   }
   4955 
   4956   FixedArray* ContentArray() {
   4957     Object* array = descriptor_array_->get(DescriptorArray::kContentArrayIndex);
   4958     return static_cast<FixedArray*>(array);
   4959   }
   4960 
   4961   Object** ContentHeader() {
   4962     return HeapObject::RawField(ContentArray(), DescriptorArray::kMapOffset);
   4963   }
   4964 
   4965   DescriptorArray* descriptor_array_;
   4966 };
   4967 
   4968 
   4969 // An iterator over all prototype transitions, reusing the map field of the
   4970 // underlying array while it is running.
   4971 class IntrusivePrototypeTransitionIterator {
   4972  public:
   4973   explicit IntrusivePrototypeTransitionIterator(FixedArray* proto_trans)
   4974       : proto_trans_(proto_trans) { }
   4975 
   4976   void Start() {
   4977     ASSERT(!IsIterating());
   4978     if (HasTransitions()) *Header() = Smi::FromInt(0);
   4979   }
   4980 
   4981   bool IsIterating() {
   4982     return HasTransitions() && (*Header())->IsSmi();
   4983   }
   4984 
   4985   Map* Next() {
   4986     ASSERT(IsIterating());
   4987     int transitionNumber = Smi::cast(*Header())->value();
   4988     if (transitionNumber < NumberOfTransitions()) {
   4989       *Header() = Smi::FromInt(transitionNumber + 1);
   4990       return GetTransition(transitionNumber);
   4991     }
   4992     *Header() = proto_trans_->GetHeap()->fixed_array_map();
   4993     return NULL;
   4994   }
   4995 
   4996  private:
   4997   bool HasTransitions() {
   4998     return proto_trans_->length() >= Map::kProtoTransitionHeaderSize;
   4999   }
   5000 
   5001   Object** Header() {
   5002     return HeapObject::RawField(proto_trans_, FixedArray::kMapOffset);
   5003   }
   5004 
   5005   int NumberOfTransitions() {
   5006     Object* num = proto_trans_->get(Map::kProtoTransitionNumberOfEntriesOffset);
   5007     return Smi::cast(num)->value();
   5008   }
   5009 
   5010   Map* GetTransition(int transitionNumber) {
   5011     return Map::cast(proto_trans_->get(IndexFor(transitionNumber)));
   5012   }
   5013 
   5014   int IndexFor(int transitionNumber) {
   5015     return Map::kProtoTransitionHeaderSize +
   5016         Map::kProtoTransitionMapOffset +
   5017         transitionNumber * Map::kProtoTransitionElementsPerEntry;
   5018   }
   5019 
   5020   FixedArray* proto_trans_;
   5021 };
   5022 
   5023 
   5024 // To traverse the transition tree iteratively, we have to store two kinds of
   5025 // information in a map: The parent map in the traversal and which children of a
   5026 // node have already been visited. To do this without additional memory, we
   5027 // temporarily reuse two maps with known values:
   5028 //
   5029 //  (1) The map of the map temporarily holds the parent, and is restored to the
   5030 //      meta map afterwards.
   5031 //
   5032 //  (2) The info which children have already been visited depends on which part
   5033 //      of the map we currently iterate:
   5034 //
   5035 //    (a) If we currently follow normal map transitions, we temporarily store
   5036 //        the current index in the map of the FixedArray of the desciptor
   5037 //        array's contents, and restore it to the fixed array map afterwards.
   5038 //        Note that a single descriptor can have 0, 1, or 2 transitions.
   5039 //
   5040 //    (b) If we currently follow prototype transitions, we temporarily store
   5041 //        the current index in the map of the FixedArray holding the prototype
   5042 //        transitions, and restore it to the fixed array map afterwards.
   5043 //
   5044 // Note that the child iterator is just a concatenation of two iterators: One
   5045 // iterating over map transitions and one iterating over prototype transisitons.
   5046 class TraversableMap : public Map {
   5047  public:
   5048   // Record the parent in the traversal within this map. Note that this destroys
   5049   // this map's map!
   5050   void SetParent(TraversableMap* parent) { set_map_no_write_barrier(parent); }
   5051 
   5052   // Reset the current map's map, returning the parent previously stored in it.
   5053   TraversableMap* GetAndResetParent() {
   5054     TraversableMap* old_parent = static_cast<TraversableMap*>(map());
   5055     set_map_no_write_barrier(GetHeap()->meta_map());
   5056     return old_parent;
   5057   }
   5058 
   5059   // Start iterating over this map's children, possibly destroying a FixedArray
   5060   // map (see explanation above).
   5061   void ChildIteratorStart() {
   5062     IntrusiveMapTransitionIterator(instance_descriptors()).Start();
   5063     IntrusivePrototypeTransitionIterator(
   5064         unchecked_prototype_transitions()).Start();
   5065   }
   5066 
   5067   // If we have an unvisited child map, return that one and advance. If we have
   5068   // none, return NULL and reset any destroyed FixedArray maps.
   5069   TraversableMap* ChildIteratorNext() {
   5070     IntrusiveMapTransitionIterator descriptor_iterator(instance_descriptors());
   5071     if (descriptor_iterator.IsIterating()) {
   5072       Map* next = descriptor_iterator.Next();
   5073       if (next != NULL) return static_cast<TraversableMap*>(next);
   5074     }
   5075     IntrusivePrototypeTransitionIterator
   5076         proto_iterator(unchecked_prototype_transitions());
   5077     if (proto_iterator.IsIterating()) {
   5078       Map* next = proto_iterator.Next();
   5079       if (next != NULL) return static_cast<TraversableMap*>(next);
   5080     }
   5081     return NULL;
   5082   }
   5083 };
   5084 
   5085 
   5086 // Traverse the transition tree in postorder without using the C++ stack by
   5087 // doing pointer reversal.
   5088 void Map::TraverseTransitionTree(TraverseCallback callback, void* data) {
   5089   TraversableMap* current = static_cast<TraversableMap*>(this);
   5090   current->ChildIteratorStart();
   5091   while (true) {
   5092     TraversableMap* child = current->ChildIteratorNext();
   5093     if (child != NULL) {
   5094       child->ChildIteratorStart();
   5095       child->SetParent(current);
   5096       current = child;
   5097     } else {
   5098       TraversableMap* parent = current->GetAndResetParent();
   5099       callback(current, data);
   5100       if (current == this) break;
   5101       current = parent;
   5102     }
   5103   }
   5104 }
   5105 
   5106 
   5107 MaybeObject* CodeCache::Update(String* name, Code* code) {
   5108   // The number of monomorphic stubs for normal load/store/call IC's can grow to
   5109   // a large number and therefore they need to go into a hash table. They are
   5110   // used to load global properties from cells.
   5111   if (code->type() == NORMAL) {
   5112     // Make sure that a hash table is allocated for the normal load code cache.
   5113     if (normal_type_cache()->IsUndefined()) {
   5114       Object* result;
   5115       { MaybeObject* maybe_result =
   5116             CodeCacheHashTable::Allocate(CodeCacheHashTable::kInitialSize);
   5117         if (!maybe_result->ToObject(&result)) return maybe_result;
   5118       }
   5119       set_normal_type_cache(result);
   5120     }
   5121     return UpdateNormalTypeCache(name, code);
   5122   } else {
   5123     ASSERT(default_cache()->IsFixedArray());
   5124     return UpdateDefaultCache(name, code);
   5125   }
   5126 }
   5127 
   5128 
   5129 MaybeObject* CodeCache::UpdateDefaultCache(String* name, Code* code) {
   5130   // When updating the default code cache we disregard the type encoded in the
   5131   // flags. This allows call constant stubs to overwrite call field
   5132   // stubs, etc.
   5133   Code::Flags flags = Code::RemoveTypeFromFlags(code->flags());
   5134 
   5135   // First check whether we can update existing code cache without
   5136   // extending it.
   5137   FixedArray* cache = default_cache();
   5138   int length = cache->length();
   5139   int deleted_index = -1;
   5140   for (int i = 0; i < length; i += kCodeCacheEntrySize) {
   5141     Object* key = cache->get(i);
   5142     if (key->IsNull()) {
   5143       if (deleted_index < 0) deleted_index = i;
   5144       continue;
   5145     }
   5146     if (key->IsUndefined()) {
   5147       if (deleted_index >= 0) i = deleted_index;
   5148       cache->set(i + kCodeCacheEntryNameOffset, name);
   5149       cache->set(i + kCodeCacheEntryCodeOffset, code);
   5150       return this;
   5151     }
   5152     if (name->Equals(String::cast(key))) {
   5153       Code::Flags found =
   5154           Code::cast(cache->get(i + kCodeCacheEntryCodeOffset))->flags();
   5155       if (Code::RemoveTypeFromFlags(found) == flags) {
   5156         cache->set(i + kCodeCacheEntryCodeOffset, code);
   5157         return this;
   5158       }
   5159     }
   5160   }
   5161 
   5162   // Reached the end of the code cache.  If there were deleted
   5163   // elements, reuse the space for the first of them.
   5164   if (deleted_index >= 0) {
   5165     cache->set(deleted_index + kCodeCacheEntryNameOffset, name);
   5166     cache->set(deleted_index + kCodeCacheEntryCodeOffset, code);
   5167     return this;
   5168   }
   5169 
   5170   // Extend the code cache with some new entries (at least one). Must be a
   5171   // multiple of the entry size.
   5172   int new_length = length + ((length >> 1)) + kCodeCacheEntrySize;
   5173   new_length = new_length - new_length % kCodeCacheEntrySize;
   5174   ASSERT((new_length % kCodeCacheEntrySize) == 0);
   5175   Object* result;
   5176   { MaybeObject* maybe_result = cache->CopySize(new_length);
   5177     if (!maybe_result->ToObject(&result)) return maybe_result;
   5178   }
   5179 
   5180   // Add the (name, code) pair to the new cache.
   5181   cache = FixedArray::cast(result);
   5182   cache->set(length + kCodeCacheEntryNameOffset, name);
   5183   cache->set(length + kCodeCacheEntryCodeOffset, code);
   5184   set_default_cache(cache);
   5185   return this;
   5186 }
   5187 
   5188 
   5189 MaybeObject* CodeCache::UpdateNormalTypeCache(String* name, Code* code) {
   5190   // Adding a new entry can cause a new cache to be allocated.
   5191   CodeCacheHashTable* cache = CodeCacheHashTable::cast(normal_type_cache());
   5192   Object* new_cache;
   5193   { MaybeObject* maybe_new_cache = cache->Put(name, code);
   5194     if (!maybe_new_cache->ToObject(&new_cache)) return maybe_new_cache;
   5195   }
   5196   set_normal_type_cache(new_cache);
   5197   return this;
   5198 }
   5199 
   5200 
   5201 Object* CodeCache::Lookup(String* name, Code::Flags flags) {
   5202   if (Code::ExtractTypeFromFlags(flags) == NORMAL) {
   5203     return LookupNormalTypeCache(name, flags);
   5204   } else {
   5205     return LookupDefaultCache(name, flags);
   5206   }
   5207 }
   5208 
   5209 
   5210 Object* CodeCache::LookupDefaultCache(String* name, Code::Flags flags) {
   5211   FixedArray* cache = default_cache();
   5212   int length = cache->length();
   5213   for (int i = 0; i < length; i += kCodeCacheEntrySize) {
   5214     Object* key = cache->get(i + kCodeCacheEntryNameOffset);
   5215     // Skip deleted elements.
   5216     if (key->IsNull()) continue;
   5217     if (key->IsUndefined()) return key;
   5218     if (name->Equals(String::cast(key))) {
   5219       Code* code = Code::cast(cache->get(i + kCodeCacheEntryCodeOffset));
   5220       if (code->flags() == flags) {
   5221         return code;
   5222       }
   5223     }
   5224   }
   5225   return GetHeap()->undefined_value();
   5226 }
   5227 
   5228 
   5229 Object* CodeCache::LookupNormalTypeCache(String* name, Code::Flags flags) {
   5230   if (!normal_type_cache()->IsUndefined()) {
   5231     CodeCacheHashTable* cache = CodeCacheHashTable::cast(normal_type_cache());
   5232     return cache->Lookup(name, flags);
   5233   } else {
   5234     return GetHeap()->undefined_value();
   5235   }
   5236 }
   5237 
   5238 
   5239 int CodeCache::GetIndex(Object* name, Code* code) {
   5240   if (code->type() == NORMAL) {
   5241     if (normal_type_cache()->IsUndefined()) return -1;
   5242     CodeCacheHashTable* cache = CodeCacheHashTable::cast(normal_type_cache());
   5243     return cache->GetIndex(String::cast(name), code->flags());
   5244   }
   5245 
   5246   FixedArray* array = default_cache();
   5247   int len = array->length();
   5248   for (int i = 0; i < len; i += kCodeCacheEntrySize) {
   5249     if (array->get(i + kCodeCacheEntryCodeOffset) == code) return i + 1;
   5250   }
   5251   return -1;
   5252 }
   5253 
   5254 
   5255 void CodeCache::RemoveByIndex(Object* name, Code* code, int index) {
   5256   if (code->type() == NORMAL) {
   5257     ASSERT(!normal_type_cache()->IsUndefined());
   5258     CodeCacheHashTable* cache = CodeCacheHashTable::cast(normal_type_cache());
   5259     ASSERT(cache->GetIndex(String::cast(name), code->flags()) == index);
   5260     cache->RemoveByIndex(index);
   5261   } else {
   5262     FixedArray* array = default_cache();
   5263     ASSERT(array->length() >= index && array->get(index)->IsCode());
   5264     // Use null instead of undefined for deleted elements to distinguish
   5265     // deleted elements from unused elements.  This distinction is used
   5266     // when looking up in the cache and when updating the cache.
   5267     ASSERT_EQ(1, kCodeCacheEntryCodeOffset - kCodeCacheEntryNameOffset);
   5268     array->set_null(index - 1);  // Name.
   5269     array->set_null(index);  // Code.
   5270   }
   5271 }
   5272 
   5273 
   5274 // The key in the code cache hash table consists of the property name and the
   5275 // code object. The actual match is on the name and the code flags. If a key
   5276 // is created using the flags and not a code object it can only be used for
   5277 // lookup not to create a new entry.
   5278 class CodeCacheHashTableKey : public HashTableKey {
   5279  public:
   5280   CodeCacheHashTableKey(String* name, Code::Flags flags)
   5281       : name_(name), flags_(flags), code_(NULL) { }
   5282 
   5283   CodeCacheHashTableKey(String* name, Code* code)
   5284       : name_(name),
   5285         flags_(code->flags()),
   5286         code_(code) { }
   5287 
   5288 
   5289   bool IsMatch(Object* other) {
   5290     if (!other->IsFixedArray()) return false;
   5291     FixedArray* pair = FixedArray::cast(other);
   5292     String* name = String::cast(pair->get(0));
   5293     Code::Flags flags = Code::cast(pair->get(1))->flags();
   5294     if (flags != flags_) {
   5295       return false;
   5296     }
   5297     return name_->Equals(name);
   5298   }
   5299 
   5300   static uint32_t NameFlagsHashHelper(String* name, Code::Flags flags) {
   5301     return name->Hash() ^ flags;
   5302   }
   5303 
   5304   uint32_t Hash() { return NameFlagsHashHelper(name_, flags_); }
   5305 
   5306   uint32_t HashForObject(Object* obj) {
   5307     FixedArray* pair = FixedArray::cast(obj);
   5308     String* name = String::cast(pair->get(0));
   5309     Code* code = Code::cast(pair->get(1));
   5310     return NameFlagsHashHelper(name, code->flags());
   5311   }
   5312 
   5313   MUST_USE_RESULT MaybeObject* AsObject() {
   5314     ASSERT(code_ != NULL);
   5315     Object* obj;
   5316     { MaybeObject* maybe_obj = code_->GetHeap()->AllocateFixedArray(2);
   5317       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   5318     }
   5319     FixedArray* pair = FixedArray::cast(obj);
   5320     pair->set(0, name_);
   5321     pair->set(1, code_);
   5322     return pair;
   5323   }
   5324 
   5325  private:
   5326   String* name_;
   5327   Code::Flags flags_;
   5328   // TODO(jkummerow): We should be able to get by without this.
   5329   Code* code_;
   5330 };
   5331 
   5332 
   5333 Object* CodeCacheHashTable::Lookup(String* name, Code::Flags flags) {
   5334   CodeCacheHashTableKey key(name, flags);
   5335   int entry = FindEntry(&key);
   5336   if (entry == kNotFound) return GetHeap()->undefined_value();
   5337   return get(EntryToIndex(entry) + 1);
   5338 }
   5339 
   5340 
   5341 MaybeObject* CodeCacheHashTable::Put(String* name, Code* code) {
   5342   CodeCacheHashTableKey key(name, code);
   5343   Object* obj;
   5344   { MaybeObject* maybe_obj = EnsureCapacity(1, &key);
   5345     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   5346   }
   5347 
   5348   // Don't use |this|, as the table might have grown.
   5349   CodeCacheHashTable* cache = reinterpret_cast<CodeCacheHashTable*>(obj);
   5350 
   5351   int entry = cache->FindInsertionEntry(key.Hash());
   5352   Object* k;
   5353   { MaybeObject* maybe_k = key.AsObject();
   5354     if (!maybe_k->ToObject(&k)) return maybe_k;
   5355   }
   5356 
   5357   cache->set(EntryToIndex(entry), k);
   5358   cache->set(EntryToIndex(entry) + 1, code);
   5359   cache->ElementAdded();
   5360   return cache;
   5361 }
   5362 
   5363 
   5364 int CodeCacheHashTable::GetIndex(String* name, Code::Flags flags) {
   5365   CodeCacheHashTableKey key(name, flags);
   5366   int entry = FindEntry(&key);
   5367   return (entry == kNotFound) ? -1 : entry;
   5368 }
   5369 
   5370 
   5371 void CodeCacheHashTable::RemoveByIndex(int index) {
   5372   ASSERT(index >= 0);
   5373   Heap* heap = GetHeap();
   5374   set(EntryToIndex(index), heap->the_hole_value());
   5375   set(EntryToIndex(index) + 1, heap->the_hole_value());
   5376   ElementRemoved();
   5377 }
   5378 
   5379 
   5380 void PolymorphicCodeCache::Update(Handle<PolymorphicCodeCache> cache,
   5381                                   MapHandleList* maps,
   5382                                   Code::Flags flags,
   5383                                   Handle<Code> code) {
   5384   Isolate* isolate = cache->GetIsolate();
   5385   CALL_HEAP_FUNCTION_VOID(isolate, cache->Update(maps, flags, *code));
   5386 }
   5387 
   5388 
   5389 MaybeObject* PolymorphicCodeCache::Update(MapHandleList* maps,
   5390                                           Code::Flags flags,
   5391                                           Code* code) {
   5392   // Initialize cache if necessary.
   5393   if (cache()->IsUndefined()) {
   5394     Object* result;
   5395     { MaybeObject* maybe_result =
   5396           PolymorphicCodeCacheHashTable::Allocate(
   5397               PolymorphicCodeCacheHashTable::kInitialSize);
   5398       if (!maybe_result->ToObject(&result)) return maybe_result;
   5399     }
   5400     set_cache(result);
   5401   } else {
   5402     // This entry shouldn't be contained in the cache yet.
   5403     ASSERT(PolymorphicCodeCacheHashTable::cast(cache())
   5404                ->Lookup(maps, flags)->IsUndefined());
   5405   }
   5406   PolymorphicCodeCacheHashTable* hash_table =
   5407       PolymorphicCodeCacheHashTable::cast(cache());
   5408   Object* new_cache;
   5409   { MaybeObject* maybe_new_cache = hash_table->Put(maps, flags, code);
   5410     if (!maybe_new_cache->ToObject(&new_cache)) return maybe_new_cache;
   5411   }
   5412   set_cache(new_cache);
   5413   return this;
   5414 }
   5415 
   5416 
   5417 Handle<Object> PolymorphicCodeCache::Lookup(MapHandleList* maps,
   5418                                             Code::Flags flags) {
   5419   if (!cache()->IsUndefined()) {
   5420     PolymorphicCodeCacheHashTable* hash_table =
   5421         PolymorphicCodeCacheHashTable::cast(cache());
   5422     return Handle<Object>(hash_table->Lookup(maps, flags));
   5423   } else {
   5424     return GetIsolate()->factory()->undefined_value();
   5425   }
   5426 }
   5427 
   5428 
   5429 // Despite their name, object of this class are not stored in the actual
   5430 // hash table; instead they're temporarily used for lookups. It is therefore
   5431 // safe to have a weak (non-owning) pointer to a MapList as a member field.
   5432 class PolymorphicCodeCacheHashTableKey : public HashTableKey {
   5433  public:
   5434   // Callers must ensure that |maps| outlives the newly constructed object.
   5435   PolymorphicCodeCacheHashTableKey(MapHandleList* maps, int code_flags)
   5436       : maps_(maps),
   5437         code_flags_(code_flags) {}
   5438 
   5439   bool IsMatch(Object* other) {
   5440     MapHandleList other_maps(kDefaultListAllocationSize);
   5441     int other_flags;
   5442     FromObject(other, &other_flags, &other_maps);
   5443     if (code_flags_ != other_flags) return false;
   5444     if (maps_->length() != other_maps.length()) return false;
   5445     // Compare just the hashes first because it's faster.
   5446     int this_hash = MapsHashHelper(maps_, code_flags_);
   5447     int other_hash = MapsHashHelper(&other_maps, other_flags);
   5448     if (this_hash != other_hash) return false;
   5449 
   5450     // Full comparison: for each map in maps_, look for an equivalent map in
   5451     // other_maps. This implementation is slow, but probably good enough for
   5452     // now because the lists are short (<= 4 elements currently).
   5453     for (int i = 0; i < maps_->length(); ++i) {
   5454       bool match_found = false;
   5455       for (int j = 0; j < other_maps.length(); ++j) {
   5456         if (*(maps_->at(i)) == *(other_maps.at(j))) {
   5457           match_found = true;
   5458           break;
   5459         }
   5460       }
   5461       if (!match_found) return false;
   5462     }
   5463     return true;
   5464   }
   5465 
   5466   static uint32_t MapsHashHelper(MapHandleList* maps, int code_flags) {
   5467     uint32_t hash = code_flags;
   5468     for (int i = 0; i < maps->length(); ++i) {
   5469       hash ^= maps->at(i)->Hash();
   5470     }
   5471     return hash;
   5472   }
   5473 
   5474   uint32_t Hash() {
   5475     return MapsHashHelper(maps_, code_flags_);
   5476   }
   5477 
   5478   uint32_t HashForObject(Object* obj) {
   5479     MapHandleList other_maps(kDefaultListAllocationSize);
   5480     int other_flags;
   5481     FromObject(obj, &other_flags, &other_maps);
   5482     return MapsHashHelper(&other_maps, other_flags);
   5483   }
   5484 
   5485   MUST_USE_RESULT MaybeObject* AsObject() {
   5486     Object* obj;
   5487     // The maps in |maps_| must be copied to a newly allocated FixedArray,
   5488     // both because the referenced MapList is short-lived, and because C++
   5489     // objects can't be stored in the heap anyway.
   5490     { MaybeObject* maybe_obj =
   5491         HEAP->AllocateUninitializedFixedArray(maps_->length() + 1);
   5492       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   5493     }
   5494     FixedArray* list = FixedArray::cast(obj);
   5495     list->set(0, Smi::FromInt(code_flags_));
   5496     for (int i = 0; i < maps_->length(); ++i) {
   5497       list->set(i + 1, *maps_->at(i));
   5498     }
   5499     return list;
   5500   }
   5501 
   5502  private:
   5503   static MapHandleList* FromObject(Object* obj,
   5504                                    int* code_flags,
   5505                                    MapHandleList* maps) {
   5506     FixedArray* list = FixedArray::cast(obj);
   5507     maps->Rewind(0);
   5508     *code_flags = Smi::cast(list->get(0))->value();
   5509     for (int i = 1; i < list->length(); ++i) {
   5510       maps->Add(Handle<Map>(Map::cast(list->get(i))));
   5511     }
   5512     return maps;
   5513   }
   5514 
   5515   MapHandleList* maps_;  // weak.
   5516   int code_flags_;
   5517   static const int kDefaultListAllocationSize = kMaxKeyedPolymorphism + 1;
   5518 };
   5519 
   5520 
   5521 Object* PolymorphicCodeCacheHashTable::Lookup(MapHandleList* maps,
   5522                                               int code_flags) {
   5523   PolymorphicCodeCacheHashTableKey key(maps, code_flags);
   5524   int entry = FindEntry(&key);
   5525   if (entry == kNotFound) return GetHeap()->undefined_value();
   5526   return get(EntryToIndex(entry) + 1);
   5527 }
   5528 
   5529 
   5530 MaybeObject* PolymorphicCodeCacheHashTable::Put(MapHandleList* maps,
   5531                                                 int code_flags,
   5532                                                 Code* code) {
   5533   PolymorphicCodeCacheHashTableKey key(maps, code_flags);
   5534   Object* obj;
   5535   { MaybeObject* maybe_obj = EnsureCapacity(1, &key);
   5536     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   5537   }
   5538   PolymorphicCodeCacheHashTable* cache =
   5539       reinterpret_cast<PolymorphicCodeCacheHashTable*>(obj);
   5540   int entry = cache->FindInsertionEntry(key.Hash());
   5541   { MaybeObject* maybe_obj = key.AsObject();
   5542     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   5543   }
   5544   cache->set(EntryToIndex(entry), obj);
   5545   cache->set(EntryToIndex(entry) + 1, code);
   5546   cache->ElementAdded();
   5547   return cache;
   5548 }
   5549 
   5550 
   5551 MaybeObject* FixedArray::AddKeysFromJSArray(JSArray* array) {
   5552   ElementsAccessor* accessor = array->GetElementsAccessor();
   5553   MaybeObject* maybe_result =
   5554       accessor->AddElementsToFixedArray(array, array, this);
   5555   FixedArray* result;
   5556   if (!maybe_result->To<FixedArray>(&result)) return maybe_result;
   5557 #ifdef DEBUG
   5558   if (FLAG_enable_slow_asserts) {
   5559     for (int i = 0; i < result->length(); i++) {
   5560       Object* current = result->get(i);
   5561       ASSERT(current->IsNumber() || current->IsString());
   5562     }
   5563   }
   5564 #endif
   5565   return result;
   5566 }
   5567 
   5568 
   5569 MaybeObject* FixedArray::UnionOfKeys(FixedArray* other) {
   5570   ElementsAccessor* accessor = ElementsAccessor::ForArray(other);
   5571   MaybeObject* maybe_result =
   5572       accessor->AddElementsToFixedArray(NULL, NULL, this, other);
   5573   FixedArray* result;
   5574   if (!maybe_result->To<FixedArray>(&result)) return maybe_result;
   5575 #ifdef DEBUG
   5576   if (FLAG_enable_slow_asserts) {
   5577     for (int i = 0; i < result->length(); i++) {
   5578       Object* current = result->get(i);
   5579       ASSERT(current->IsNumber() || current->IsString());
   5580     }
   5581   }
   5582 #endif
   5583   return result;
   5584 }
   5585 
   5586 
   5587 MaybeObject* FixedArray::CopySize(int new_length) {
   5588   Heap* heap = GetHeap();
   5589   if (new_length == 0) return heap->empty_fixed_array();
   5590   Object* obj;
   5591   { MaybeObject* maybe_obj = heap->AllocateFixedArray(new_length);
   5592     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   5593   }
   5594   FixedArray* result = FixedArray::cast(obj);
   5595   // Copy the content
   5596   AssertNoAllocation no_gc;
   5597   int len = length();
   5598   if (new_length < len) len = new_length;
   5599   // We are taking the map from the old fixed array so the map is sure to
   5600   // be an immortal immutable object.
   5601   result->set_map_no_write_barrier(map());
   5602   WriteBarrierMode mode = result->GetWriteBarrierMode(no_gc);
   5603   for (int i = 0; i < len; i++) {
   5604     result->set(i, get(i), mode);
   5605   }
   5606   return result;
   5607 }
   5608 
   5609 
   5610 void FixedArray::CopyTo(int pos, FixedArray* dest, int dest_pos, int len) {
   5611   AssertNoAllocation no_gc;
   5612   WriteBarrierMode mode = dest->GetWriteBarrierMode(no_gc);
   5613   for (int index = 0; index < len; index++) {
   5614     dest->set(dest_pos+index, get(pos+index), mode);
   5615   }
   5616 }
   5617 
   5618 
   5619 #ifdef DEBUG
   5620 bool FixedArray::IsEqualTo(FixedArray* other) {
   5621   if (length() != other->length()) return false;
   5622   for (int i = 0 ; i < length(); ++i) {
   5623     if (get(i) != other->get(i)) return false;
   5624   }
   5625   return true;
   5626 }
   5627 #endif
   5628 
   5629 
   5630 MaybeObject* DescriptorArray::Allocate(int number_of_descriptors) {
   5631   Heap* heap = Isolate::Current()->heap();
   5632   if (number_of_descriptors == 0) {
   5633     return heap->empty_descriptor_array();
   5634   }
   5635   // Allocate the array of keys.
   5636   Object* array;
   5637   { MaybeObject* maybe_array =
   5638         heap->AllocateFixedArray(ToKeyIndex(number_of_descriptors));
   5639     if (!maybe_array->ToObject(&array)) return maybe_array;
   5640   }
   5641   // Do not use DescriptorArray::cast on incomplete object.
   5642   FixedArray* result = FixedArray::cast(array);
   5643 
   5644   // Allocate the content array and set it in the descriptor array.
   5645   { MaybeObject* maybe_array =
   5646         heap->AllocateFixedArray(number_of_descriptors << 1);
   5647     if (!maybe_array->ToObject(&array)) return maybe_array;
   5648   }
   5649   result->set(kBitField3StorageIndex, Smi::FromInt(0));
   5650   result->set(kContentArrayIndex, array);
   5651   result->set(kEnumerationIndexIndex,
   5652               Smi::FromInt(PropertyDetails::kInitialIndex));
   5653   return result;
   5654 }
   5655 
   5656 
   5657 void DescriptorArray::SetEnumCache(FixedArray* bridge_storage,
   5658                                    FixedArray* new_cache,
   5659                                    Object* new_index_cache) {
   5660   ASSERT(bridge_storage->length() >= kEnumCacheBridgeLength);
   5661   ASSERT(new_index_cache->IsSmi() || new_index_cache->IsFixedArray());
   5662   if (HasEnumCache()) {
   5663     FixedArray::cast(get(kEnumerationIndexIndex))->
   5664       set(kEnumCacheBridgeCacheIndex, new_cache);
   5665     FixedArray::cast(get(kEnumerationIndexIndex))->
   5666       set(kEnumCacheBridgeIndicesCacheIndex, new_index_cache);
   5667   } else {
   5668     if (IsEmpty()) return;  // Do nothing for empty descriptor array.
   5669     FixedArray::cast(bridge_storage)->
   5670       set(kEnumCacheBridgeCacheIndex, new_cache);
   5671     FixedArray::cast(bridge_storage)->
   5672       set(kEnumCacheBridgeIndicesCacheIndex, new_index_cache);
   5673     NoWriteBarrierSet(FixedArray::cast(bridge_storage),
   5674                       kEnumCacheBridgeEnumIndex,
   5675                       get(kEnumerationIndexIndex));
   5676     set(kEnumerationIndexIndex, bridge_storage);
   5677   }
   5678 }
   5679 
   5680 
   5681 static bool InsertionPointFound(String* key1, String* key2) {
   5682   return key1->Hash() > key2->Hash() || key1 == key2;
   5683 }
   5684 
   5685 
   5686 void DescriptorArray::CopyFrom(Handle<DescriptorArray> dst,
   5687                                int dst_index,
   5688                                Handle<DescriptorArray> src,
   5689                                int src_index,
   5690                                const WhitenessWitness& witness) {
   5691   CALL_HEAP_FUNCTION_VOID(dst->GetIsolate(),
   5692                           dst->CopyFrom(dst_index, *src, src_index, witness));
   5693 }
   5694 
   5695 
   5696 MaybeObject* DescriptorArray::CopyFrom(int dst_index,
   5697                                        DescriptorArray* src,
   5698                                        int src_index,
   5699                                        const WhitenessWitness& witness) {
   5700   Object* value = src->GetValue(src_index);
   5701   PropertyDetails details(src->GetDetails(src_index));
   5702   if (details.type() == CALLBACKS && value->IsAccessorPair()) {
   5703     MaybeObject* maybe_copy =
   5704         AccessorPair::cast(value)->CopyWithoutTransitions();
   5705     if (!maybe_copy->To(&value)) return maybe_copy;
   5706   }
   5707   Descriptor desc(src->GetKey(src_index), value, details);
   5708   Set(dst_index, &desc, witness);
   5709   return this;
   5710 }
   5711 
   5712 
   5713 MaybeObject* DescriptorArray::CopyInsert(Descriptor* descriptor,
   5714                                          TransitionFlag transition_flag) {
   5715   // Transitions are only kept when inserting another transition.
   5716   // This precondition is not required by this function's implementation, but
   5717   // is currently required by the semantics of maps, so we check it.
   5718   // Conversely, we filter after replacing, so replacing a transition and
   5719   // removing all other transitions is not supported.
   5720   bool remove_transitions = transition_flag == REMOVE_TRANSITIONS;
   5721   ASSERT(remove_transitions == !descriptor->ContainsTransition());
   5722   ASSERT(descriptor->GetDetails().type() != NULL_DESCRIPTOR);
   5723 
   5724   // Ensure the key is a symbol.
   5725   { MaybeObject* maybe_result = descriptor->KeyToSymbol();
   5726     if (maybe_result->IsFailure()) return maybe_result;
   5727   }
   5728 
   5729   int new_size = 0;
   5730   for (int i = 0; i < number_of_descriptors(); i++) {
   5731     if (IsNullDescriptor(i)) continue;
   5732     if (remove_transitions && IsTransitionOnly(i)) continue;
   5733     new_size++;
   5734   }
   5735 
   5736   // If key is in descriptor, we replace it in-place when filtering.
   5737   // Count a null descriptor for key as inserted, not replaced.
   5738   int index = Search(descriptor->GetKey());
   5739   const bool replacing = (index != kNotFound);
   5740   bool keep_enumeration_index = false;
   5741   if (replacing) {
   5742     // We are replacing an existing descriptor.  We keep the enumeration
   5743     // index of a visible property.
   5744     PropertyType t = PropertyDetails(GetDetails(index)).type();
   5745     if (t == CONSTANT_FUNCTION ||
   5746         t == FIELD ||
   5747         t == CALLBACKS ||
   5748         t == INTERCEPTOR) {
   5749       keep_enumeration_index = true;
   5750     } else if (remove_transitions) {
   5751      // Replaced descriptor has been counted as removed if it is
   5752      // a transition that will be replaced.  Adjust count in this case.
   5753       ++new_size;
   5754     }
   5755   } else {
   5756     ++new_size;
   5757   }
   5758 
   5759   DescriptorArray* new_descriptors;
   5760   { MaybeObject* maybe_result = Allocate(new_size);
   5761     if (!maybe_result->To(&new_descriptors)) return maybe_result;
   5762   }
   5763 
   5764   DescriptorArray::WhitenessWitness witness(new_descriptors);
   5765 
   5766   // Set the enumeration index in the descriptors and set the enumeration index
   5767   // in the result.
   5768   int enumeration_index = NextEnumerationIndex();
   5769   if (!descriptor->ContainsTransition()) {
   5770     if (keep_enumeration_index) {
   5771       descriptor->SetEnumerationIndex(
   5772           PropertyDetails(GetDetails(index)).index());
   5773     } else {
   5774       descriptor->SetEnumerationIndex(enumeration_index);
   5775       ++enumeration_index;
   5776     }
   5777   }
   5778   new_descriptors->SetNextEnumerationIndex(enumeration_index);
   5779 
   5780   // Copy the descriptors, filtering out transitions and null descriptors,
   5781   // and inserting or replacing a descriptor.
   5782   int to_index = 0;
   5783   int insertion_index = -1;
   5784   int from_index = 0;
   5785   while (from_index < number_of_descriptors()) {
   5786     if (insertion_index < 0 &&
   5787         InsertionPointFound(GetKey(from_index), descriptor->GetKey())) {
   5788       insertion_index = to_index++;
   5789       if (replacing) from_index++;
   5790     } else {
   5791       if (!(IsNullDescriptor(from_index) ||
   5792             (remove_transitions && IsTransitionOnly(from_index)))) {
   5793         MaybeObject* copy_result =
   5794             new_descriptors->CopyFrom(to_index++, this, from_index, witness);
   5795         if (copy_result->IsFailure()) return copy_result;
   5796       }
   5797       from_index++;
   5798     }
   5799   }
   5800   if (insertion_index < 0) insertion_index = to_index++;
   5801   new_descriptors->Set(insertion_index, descriptor, witness);
   5802 
   5803   ASSERT(to_index == new_descriptors->number_of_descriptors());
   5804   SLOW_ASSERT(new_descriptors->IsSortedNoDuplicates());
   5805 
   5806   return new_descriptors;
   5807 }
   5808 
   5809 
   5810 MaybeObject* DescriptorArray::RemoveTransitions() {
   5811   // Allocate the new descriptor array.
   5812   int new_number_of_descriptors = 0;
   5813   for (int i = 0; i < number_of_descriptors(); i++) {
   5814     if (IsProperty(i)) new_number_of_descriptors++;
   5815   }
   5816   DescriptorArray* new_descriptors;
   5817   { MaybeObject* maybe_result = Allocate(new_number_of_descriptors);
   5818     if (!maybe_result->To(&new_descriptors)) return maybe_result;
   5819   }
   5820 
   5821   // Copy the content.
   5822   DescriptorArray::WhitenessWitness witness(new_descriptors);
   5823   int next_descriptor = 0;
   5824   for (int i = 0; i < number_of_descriptors(); i++) {
   5825     if (IsProperty(i)) {
   5826       MaybeObject* copy_result =
   5827           new_descriptors->CopyFrom(next_descriptor++, this, i, witness);
   5828       if (copy_result->IsFailure()) return copy_result;
   5829     }
   5830   }
   5831   ASSERT(next_descriptor == new_descriptors->number_of_descriptors());
   5832 
   5833   return new_descriptors;
   5834 }
   5835 
   5836 
   5837 void DescriptorArray::SortUnchecked(const WhitenessWitness& witness) {
   5838   // In-place heap sort.
   5839   int len = number_of_descriptors();
   5840 
   5841   // Bottom-up max-heap construction.
   5842   // Index of the last node with children
   5843   const int max_parent_index = (len / 2) - 1;
   5844   for (int i = max_parent_index; i >= 0; --i) {
   5845     int parent_index = i;
   5846     const uint32_t parent_hash = GetKey(i)->Hash();
   5847     while (parent_index <= max_parent_index) {
   5848       int child_index = 2 * parent_index + 1;
   5849       uint32_t child_hash = GetKey(child_index)->Hash();
   5850       if (child_index + 1 < len) {
   5851         uint32_t right_child_hash = GetKey(child_index + 1)->Hash();
   5852         if (right_child_hash > child_hash) {
   5853           child_index++;
   5854           child_hash = right_child_hash;
   5855         }
   5856       }
   5857       if (child_hash <= parent_hash) break;
   5858       NoIncrementalWriteBarrierSwapDescriptors(parent_index, child_index);
   5859       // Now element at child_index could be < its children.
   5860       parent_index = child_index;  // parent_hash remains correct.
   5861     }
   5862   }
   5863 
   5864   // Extract elements and create sorted array.
   5865   for (int i = len - 1; i > 0; --i) {
   5866     // Put max element at the back of the array.
   5867     NoIncrementalWriteBarrierSwapDescriptors(0, i);
   5868     // Shift down the new top element.
   5869     int parent_index = 0;
   5870     const uint32_t parent_hash = GetKey(parent_index)->Hash();
   5871     const int max_parent_index = (i / 2) - 1;
   5872     while (parent_index <= max_parent_index) {
   5873       int child_index = parent_index * 2 + 1;
   5874       uint32_t child_hash = GetKey(child_index)->Hash();
   5875       if (child_index + 1 < i) {
   5876         uint32_t right_child_hash = GetKey(child_index + 1)->Hash();
   5877         if (right_child_hash > child_hash) {
   5878           child_index++;
   5879           child_hash = right_child_hash;
   5880         }
   5881       }
   5882       if (child_hash <= parent_hash) break;
   5883       NoIncrementalWriteBarrierSwapDescriptors(parent_index, child_index);
   5884       parent_index = child_index;
   5885     }
   5886   }
   5887 }
   5888 
   5889 
   5890 void DescriptorArray::Sort(const WhitenessWitness& witness) {
   5891   SortUnchecked(witness);
   5892   SLOW_ASSERT(IsSortedNoDuplicates());
   5893 }
   5894 
   5895 
   5896 int DescriptorArray::BinarySearch(String* name, int low, int high) {
   5897   uint32_t hash = name->Hash();
   5898 
   5899   while (low <= high) {
   5900     int mid = (low + high) / 2;
   5901     String* mid_name = GetKey(mid);
   5902     uint32_t mid_hash = mid_name->Hash();
   5903 
   5904     if (mid_hash > hash) {
   5905       high = mid - 1;
   5906       continue;
   5907     }
   5908     if (mid_hash < hash) {
   5909       low = mid + 1;
   5910       continue;
   5911     }
   5912     // Found an element with the same hash-code.
   5913     ASSERT(hash == mid_hash);
   5914     // There might be more, so we find the first one and
   5915     // check them all to see if we have a match.
   5916     if (name == mid_name  && !is_null_descriptor(mid)) return mid;
   5917     while ((mid > low) && (GetKey(mid - 1)->Hash() == hash)) mid--;
   5918     for (; (mid <= high) && (GetKey(mid)->Hash() == hash); mid++) {
   5919       if (GetKey(mid)->Equals(name) && !is_null_descriptor(mid)) return mid;
   5920     }
   5921     break;
   5922   }
   5923   return kNotFound;
   5924 }
   5925 
   5926 
   5927 int DescriptorArray::LinearSearch(String* name, int len) {
   5928   uint32_t hash = name->Hash();
   5929   for (int number = 0; number < len; number++) {
   5930     String* entry = GetKey(number);
   5931     if ((entry->Hash() == hash) &&
   5932         name->Equals(entry) &&
   5933         !is_null_descriptor(number)) {
   5934       return number;
   5935     }
   5936   }
   5937   return kNotFound;
   5938 }
   5939 
   5940 
   5941 MaybeObject* AccessorPair::CopyWithoutTransitions() {
   5942   Heap* heap = GetHeap();
   5943   AccessorPair* copy;
   5944   { MaybeObject* maybe_copy = heap->AllocateAccessorPair();
   5945     if (!maybe_copy->To(&copy)) return maybe_copy;
   5946   }
   5947   copy->set_getter(getter()->IsMap() ? heap->the_hole_value() : getter());
   5948   copy->set_setter(setter()->IsMap() ? heap->the_hole_value() : setter());
   5949   return copy;
   5950 }
   5951 
   5952 
   5953 Object* AccessorPair::GetComponent(AccessorComponent component) {
   5954     Object* accessor = (component == ACCESSOR_GETTER) ? getter() : setter();
   5955     return accessor->IsTheHole() ? GetHeap()->undefined_value() : accessor;
   5956 }
   5957 
   5958 
   5959 MaybeObject* DeoptimizationInputData::Allocate(int deopt_entry_count,
   5960                                                PretenureFlag pretenure) {
   5961   ASSERT(deopt_entry_count > 0);
   5962   return HEAP->AllocateFixedArray(LengthFor(deopt_entry_count),
   5963                                   pretenure);
   5964 }
   5965 
   5966 
   5967 MaybeObject* DeoptimizationOutputData::Allocate(int number_of_deopt_points,
   5968                                                 PretenureFlag pretenure) {
   5969   if (number_of_deopt_points == 0) return HEAP->empty_fixed_array();
   5970   return HEAP->AllocateFixedArray(LengthOfFixedArray(number_of_deopt_points),
   5971                                   pretenure);
   5972 }
   5973 
   5974 
   5975 #ifdef DEBUG
   5976 bool DescriptorArray::IsEqualTo(DescriptorArray* other) {
   5977   if (IsEmpty()) return other->IsEmpty();
   5978   if (other->IsEmpty()) return false;
   5979   if (length() != other->length()) return false;
   5980   for (int i = 0; i < length(); ++i) {
   5981     if (get(i) != other->get(i) && i != kContentArrayIndex) return false;
   5982   }
   5983   return GetContentArray()->IsEqualTo(other->GetContentArray());
   5984 }
   5985 #endif
   5986 
   5987 
   5988 bool String::LooksValid() {
   5989   if (!Isolate::Current()->heap()->Contains(this)) return false;
   5990   return true;
   5991 }
   5992 
   5993 
   5994 String::FlatContent String::GetFlatContent() {
   5995   int length = this->length();
   5996   StringShape shape(this);
   5997   String* string = this;
   5998   int offset = 0;
   5999   if (shape.representation_tag() == kConsStringTag) {
   6000     ConsString* cons = ConsString::cast(string);
   6001     if (cons->second()->length() != 0) {
   6002       return FlatContent();
   6003     }
   6004     string = cons->first();
   6005     shape = StringShape(string);
   6006   }
   6007   if (shape.representation_tag() == kSlicedStringTag) {
   6008     SlicedString* slice = SlicedString::cast(string);
   6009     offset = slice->offset();
   6010     string = slice->parent();
   6011     shape = StringShape(string);
   6012     ASSERT(shape.representation_tag() != kConsStringTag &&
   6013            shape.representation_tag() != kSlicedStringTag);
   6014   }
   6015   if (shape.encoding_tag() == kAsciiStringTag) {
   6016     const char* start;
   6017     if (shape.representation_tag() == kSeqStringTag) {
   6018       start = SeqAsciiString::cast(string)->GetChars();
   6019     } else {
   6020       start = ExternalAsciiString::cast(string)->GetChars();
   6021     }
   6022     return FlatContent(Vector<const char>(start + offset, length));
   6023   } else {
   6024     ASSERT(shape.encoding_tag() == kTwoByteStringTag);
   6025     const uc16* start;
   6026     if (shape.representation_tag() == kSeqStringTag) {
   6027       start = SeqTwoByteString::cast(string)->GetChars();
   6028     } else {
   6029       start = ExternalTwoByteString::cast(string)->GetChars();
   6030     }
   6031     return FlatContent(Vector<const uc16>(start + offset, length));
   6032   }
   6033 }
   6034 
   6035 
   6036 SmartArrayPointer<char> String::ToCString(AllowNullsFlag allow_nulls,
   6037                                           RobustnessFlag robust_flag,
   6038                                           int offset,
   6039                                           int length,
   6040                                           int* length_return) {
   6041   if (robust_flag == ROBUST_STRING_TRAVERSAL && !LooksValid()) {
   6042     return SmartArrayPointer<char>(NULL);
   6043   }
   6044   Heap* heap = GetHeap();
   6045 
   6046   // Negative length means the to the end of the string.
   6047   if (length < 0) length = kMaxInt - offset;
   6048 
   6049   // Compute the size of the UTF-8 string. Start at the specified offset.
   6050   Access<StringInputBuffer> buffer(
   6051       heap->isolate()->objects_string_input_buffer());
   6052   buffer->Reset(offset, this);
   6053   int character_position = offset;
   6054   int utf8_bytes = 0;
   6055   int last = unibrow::Utf16::kNoPreviousCharacter;
   6056   while (buffer->has_more() && character_position++ < offset + length) {
   6057     uint16_t character = buffer->GetNext();
   6058     utf8_bytes += unibrow::Utf8::Length(character, last);
   6059     last = character;
   6060   }
   6061 
   6062   if (length_return) {
   6063     *length_return = utf8_bytes;
   6064   }
   6065 
   6066   char* result = NewArray<char>(utf8_bytes + 1);
   6067 
   6068   // Convert the UTF-16 string to a UTF-8 buffer. Start at the specified offset.
   6069   buffer->Rewind();
   6070   buffer->Seek(offset);
   6071   character_position = offset;
   6072   int utf8_byte_position = 0;
   6073   last = unibrow::Utf16::kNoPreviousCharacter;
   6074   while (buffer->has_more() && character_position++ < offset + length) {
   6075     uint16_t character = buffer->GetNext();
   6076     if (allow_nulls == DISALLOW_NULLS && character == 0) {
   6077       character = ' ';
   6078     }
   6079     utf8_byte_position +=
   6080         unibrow::Utf8::Encode(result + utf8_byte_position, character, last);
   6081     last = character;
   6082   }
   6083   result[utf8_byte_position] = 0;
   6084   return SmartArrayPointer<char>(result);
   6085 }
   6086 
   6087 
   6088 SmartArrayPointer<char> String::ToCString(AllowNullsFlag allow_nulls,
   6089                                           RobustnessFlag robust_flag,
   6090                                           int* length_return) {
   6091   return ToCString(allow_nulls, robust_flag, 0, -1, length_return);
   6092 }
   6093 
   6094 
   6095 const uc16* String::GetTwoByteData() {
   6096   return GetTwoByteData(0);
   6097 }
   6098 
   6099 
   6100 const uc16* String::GetTwoByteData(unsigned start) {
   6101   ASSERT(!IsAsciiRepresentationUnderneath());
   6102   switch (StringShape(this).representation_tag()) {
   6103     case kSeqStringTag:
   6104       return SeqTwoByteString::cast(this)->SeqTwoByteStringGetData(start);
   6105     case kExternalStringTag:
   6106       return ExternalTwoByteString::cast(this)->
   6107         ExternalTwoByteStringGetData(start);
   6108     case kSlicedStringTag: {
   6109       SlicedString* slice = SlicedString::cast(this);
   6110       return slice->parent()->GetTwoByteData(start + slice->offset());
   6111     }
   6112     case kConsStringTag:
   6113       UNREACHABLE();
   6114       return NULL;
   6115   }
   6116   UNREACHABLE();
   6117   return NULL;
   6118 }
   6119 
   6120 
   6121 SmartArrayPointer<uc16> String::ToWideCString(RobustnessFlag robust_flag) {
   6122   if (robust_flag == ROBUST_STRING_TRAVERSAL && !LooksValid()) {
   6123     return SmartArrayPointer<uc16>();
   6124   }
   6125   Heap* heap = GetHeap();
   6126 
   6127   Access<StringInputBuffer> buffer(
   6128       heap->isolate()->objects_string_input_buffer());
   6129   buffer->Reset(this);
   6130 
   6131   uc16* result = NewArray<uc16>(length() + 1);
   6132 
   6133   int i = 0;
   6134   while (buffer->has_more()) {
   6135     uint16_t character = buffer->GetNext();
   6136     result[i++] = character;
   6137   }
   6138   result[i] = 0;
   6139   return SmartArrayPointer<uc16>(result);
   6140 }
   6141 
   6142 
   6143 const uc16* SeqTwoByteString::SeqTwoByteStringGetData(unsigned start) {
   6144   return reinterpret_cast<uc16*>(
   6145       reinterpret_cast<char*>(this) - kHeapObjectTag + kHeaderSize) + start;
   6146 }
   6147 
   6148 
   6149 void SeqTwoByteString::SeqTwoByteStringReadBlockIntoBuffer(ReadBlockBuffer* rbb,
   6150                                                            unsigned* offset_ptr,
   6151                                                            unsigned max_chars) {
   6152   unsigned chars_read = 0;
   6153   unsigned offset = *offset_ptr;
   6154   while (chars_read < max_chars) {
   6155     uint16_t c = *reinterpret_cast<uint16_t*>(
   6156         reinterpret_cast<char*>(this) -
   6157             kHeapObjectTag + kHeaderSize + offset * kShortSize);
   6158     if (c <= kMaxAsciiCharCode) {
   6159       // Fast case for ASCII characters.   Cursor is an input output argument.
   6160       if (!unibrow::CharacterStream::EncodeAsciiCharacter(c,
   6161                                                           rbb->util_buffer,
   6162                                                           rbb->capacity,
   6163                                                           rbb->cursor)) {
   6164         break;
   6165       }
   6166     } else {
   6167       if (!unibrow::CharacterStream::EncodeNonAsciiCharacter(c,
   6168                                                              rbb->util_buffer,
   6169                                                              rbb->capacity,
   6170                                                              rbb->cursor)) {
   6171         break;
   6172       }
   6173     }
   6174     offset++;
   6175     chars_read++;
   6176   }
   6177   *offset_ptr = offset;
   6178   rbb->remaining += chars_read;
   6179 }
   6180 
   6181 
   6182 const unibrow::byte* SeqAsciiString::SeqAsciiStringReadBlock(
   6183     unsigned* remaining,
   6184     unsigned* offset_ptr,
   6185     unsigned max_chars) {
   6186   const unibrow::byte* b = reinterpret_cast<unibrow::byte*>(this) -
   6187       kHeapObjectTag + kHeaderSize + *offset_ptr * kCharSize;
   6188   *remaining = max_chars;
   6189   *offset_ptr += max_chars;
   6190   return b;
   6191 }
   6192 
   6193 
   6194 // This will iterate unless the block of string data spans two 'halves' of
   6195 // a ConsString, in which case it will recurse.  Since the block of string
   6196 // data to be read has a maximum size this limits the maximum recursion
   6197 // depth to something sane.  Since C++ does not have tail call recursion
   6198 // elimination, the iteration must be explicit. Since this is not an
   6199 // -IntoBuffer method it can delegate to one of the efficient
   6200 // *AsciiStringReadBlock routines.
   6201 const unibrow::byte* ConsString::ConsStringReadBlock(ReadBlockBuffer* rbb,
   6202                                                      unsigned* offset_ptr,
   6203                                                      unsigned max_chars) {
   6204   ConsString* current = this;
   6205   unsigned offset = *offset_ptr;
   6206   int offset_correction = 0;
   6207 
   6208   while (true) {
   6209     String* left = current->first();
   6210     unsigned left_length = (unsigned)left->length();
   6211     if (left_length > offset &&
   6212         (max_chars <= left_length - offset ||
   6213          (rbb->capacity <= left_length - offset &&
   6214           (max_chars = left_length - offset, true)))) {  // comma operator!
   6215       // Left hand side only - iterate unless we have reached the bottom of
   6216       // the cons tree.  The assignment on the left of the comma operator is
   6217       // in order to make use of the fact that the -IntoBuffer routines can
   6218       // produce at most 'capacity' characters.  This enables us to postpone
   6219       // the point where we switch to the -IntoBuffer routines (below) in order
   6220       // to maximize the chances of delegating a big chunk of work to the
   6221       // efficient *AsciiStringReadBlock routines.
   6222       if (StringShape(left).IsCons()) {
   6223         current = ConsString::cast(left);
   6224         continue;
   6225       } else {
   6226         const unibrow::byte* answer =
   6227             String::ReadBlock(left, rbb, &offset, max_chars);
   6228         *offset_ptr = offset + offset_correction;
   6229         return answer;
   6230       }
   6231     } else if (left_length <= offset) {
   6232       // Right hand side only - iterate unless we have reached the bottom of
   6233       // the cons tree.
   6234       String* right = current->second();
   6235       offset -= left_length;
   6236       offset_correction += left_length;
   6237       if (StringShape(right).IsCons()) {
   6238         current = ConsString::cast(right);
   6239         continue;
   6240       } else {
   6241         const unibrow::byte* answer =
   6242             String::ReadBlock(right, rbb, &offset, max_chars);
   6243         *offset_ptr = offset + offset_correction;
   6244         return answer;
   6245       }
   6246     } else {
   6247       // The block to be read spans two sides of the ConsString, so we call the
   6248       // -IntoBuffer version, which will recurse.  The -IntoBuffer methods
   6249       // are able to assemble data from several part strings because they use
   6250       // the util_buffer to store their data and never return direct pointers
   6251       // to their storage.  We don't try to read more than the buffer capacity
   6252       // here or we can get too much recursion.
   6253       ASSERT(rbb->remaining == 0);
   6254       ASSERT(rbb->cursor == 0);
   6255       current->ConsStringReadBlockIntoBuffer(
   6256           rbb,
   6257           &offset,
   6258           max_chars > rbb->capacity ? rbb->capacity : max_chars);
   6259       *offset_ptr = offset + offset_correction;
   6260       return rbb->util_buffer;
   6261     }
   6262   }
   6263 }
   6264 
   6265 
   6266 const unibrow::byte* ExternalAsciiString::ExternalAsciiStringReadBlock(
   6267       unsigned* remaining,
   6268       unsigned* offset_ptr,
   6269       unsigned max_chars) {
   6270   // Cast const char* to unibrow::byte* (signedness difference).
   6271   const unibrow::byte* b =
   6272       reinterpret_cast<const unibrow::byte*>(GetChars()) + *offset_ptr;
   6273   *remaining = max_chars;
   6274   *offset_ptr += max_chars;
   6275   return b;
   6276 }
   6277 
   6278 
   6279 void ExternalTwoByteString::ExternalTwoByteStringReadBlockIntoBuffer(
   6280       ReadBlockBuffer* rbb,
   6281       unsigned* offset_ptr,
   6282       unsigned max_chars) {
   6283   unsigned chars_read = 0;
   6284   unsigned offset = *offset_ptr;
   6285   const uint16_t* data = GetChars();
   6286   while (chars_read < max_chars) {
   6287     uint16_t c = data[offset];
   6288     if (c <= kMaxAsciiCharCode) {
   6289       // Fast case for ASCII characters. Cursor is an input output argument.
   6290       if (!unibrow::CharacterStream::EncodeAsciiCharacter(c,
   6291                                                           rbb->util_buffer,
   6292                                                           rbb->capacity,
   6293                                                           rbb->cursor))
   6294         break;
   6295     } else {
   6296       if (!unibrow::CharacterStream::EncodeNonAsciiCharacter(c,
   6297                                                              rbb->util_buffer,
   6298                                                              rbb->capacity,
   6299                                                              rbb->cursor))
   6300         break;
   6301     }
   6302     offset++;
   6303     chars_read++;
   6304   }
   6305   *offset_ptr = offset;
   6306   rbb->remaining += chars_read;
   6307 }
   6308 
   6309 
   6310 void SeqAsciiString::SeqAsciiStringReadBlockIntoBuffer(ReadBlockBuffer* rbb,
   6311                                                  unsigned* offset_ptr,
   6312                                                  unsigned max_chars) {
   6313   unsigned capacity = rbb->capacity - rbb->cursor;
   6314   if (max_chars > capacity) max_chars = capacity;
   6315   memcpy(rbb->util_buffer + rbb->cursor,
   6316          reinterpret_cast<char*>(this) - kHeapObjectTag + kHeaderSize +
   6317              *offset_ptr * kCharSize,
   6318          max_chars);
   6319   rbb->remaining += max_chars;
   6320   *offset_ptr += max_chars;
   6321   rbb->cursor += max_chars;
   6322 }
   6323 
   6324 
   6325 void ExternalAsciiString::ExternalAsciiStringReadBlockIntoBuffer(
   6326       ReadBlockBuffer* rbb,
   6327       unsigned* offset_ptr,
   6328       unsigned max_chars) {
   6329   unsigned capacity = rbb->capacity - rbb->cursor;
   6330   if (max_chars > capacity) max_chars = capacity;
   6331   memcpy(rbb->util_buffer + rbb->cursor, GetChars() + *offset_ptr, max_chars);
   6332   rbb->remaining += max_chars;
   6333   *offset_ptr += max_chars;
   6334   rbb->cursor += max_chars;
   6335 }
   6336 
   6337 
   6338 // This method determines the type of string involved and then copies
   6339 // a whole chunk of characters into a buffer, or returns a pointer to a buffer
   6340 // where they can be found.  The pointer is not necessarily valid across a GC
   6341 // (see AsciiStringReadBlock).
   6342 const unibrow::byte* String::ReadBlock(String* input,
   6343                                        ReadBlockBuffer* rbb,
   6344                                        unsigned* offset_ptr,
   6345                                        unsigned max_chars) {
   6346   ASSERT(*offset_ptr <= static_cast<unsigned>(input->length()));
   6347   if (max_chars == 0) {
   6348     rbb->remaining = 0;
   6349     return NULL;
   6350   }
   6351   switch (StringShape(input).representation_tag()) {
   6352     case kSeqStringTag:
   6353       if (input->IsAsciiRepresentation()) {
   6354         SeqAsciiString* str = SeqAsciiString::cast(input);
   6355         return str->SeqAsciiStringReadBlock(&rbb->remaining,
   6356                                             offset_ptr,
   6357                                             max_chars);
   6358       } else {
   6359         SeqTwoByteString* str = SeqTwoByteString::cast(input);
   6360         str->SeqTwoByteStringReadBlockIntoBuffer(rbb,
   6361                                                  offset_ptr,
   6362                                                  max_chars);
   6363         return rbb->util_buffer;
   6364       }
   6365     case kConsStringTag:
   6366       return ConsString::cast(input)->ConsStringReadBlock(rbb,
   6367                                                           offset_ptr,
   6368                                                           max_chars);
   6369     case kExternalStringTag:
   6370       if (input->IsAsciiRepresentation()) {
   6371         return ExternalAsciiString::cast(input)->ExternalAsciiStringReadBlock(
   6372             &rbb->remaining,
   6373             offset_ptr,
   6374             max_chars);
   6375       } else {
   6376         ExternalTwoByteString::cast(input)->
   6377             ExternalTwoByteStringReadBlockIntoBuffer(rbb,
   6378                                                      offset_ptr,
   6379                                                      max_chars);
   6380         return rbb->util_buffer;
   6381       }
   6382     case kSlicedStringTag:
   6383       return SlicedString::cast(input)->SlicedStringReadBlock(rbb,
   6384                                                               offset_ptr,
   6385                                                               max_chars);
   6386     default:
   6387       break;
   6388   }
   6389 
   6390   UNREACHABLE();
   6391   return 0;
   6392 }
   6393 
   6394 
   6395 void Relocatable::PostGarbageCollectionProcessing() {
   6396   Isolate* isolate = Isolate::Current();
   6397   Relocatable* current = isolate->relocatable_top();
   6398   while (current != NULL) {
   6399     current->PostGarbageCollection();
   6400     current = current->prev_;
   6401   }
   6402 }
   6403 
   6404 
   6405 // Reserve space for statics needing saving and restoring.
   6406 int Relocatable::ArchiveSpacePerThread() {
   6407   return sizeof(Isolate::Current()->relocatable_top());
   6408 }
   6409 
   6410 
   6411 // Archive statics that are thread local.
   6412 char* Relocatable::ArchiveState(Isolate* isolate, char* to) {
   6413   *reinterpret_cast<Relocatable**>(to) = isolate->relocatable_top();
   6414   isolate->set_relocatable_top(NULL);
   6415   return to + ArchiveSpacePerThread();
   6416 }
   6417 
   6418 
   6419 // Restore statics that are thread local.
   6420 char* Relocatable::RestoreState(Isolate* isolate, char* from) {
   6421   isolate->set_relocatable_top(*reinterpret_cast<Relocatable**>(from));
   6422   return from + ArchiveSpacePerThread();
   6423 }
   6424 
   6425 
   6426 char* Relocatable::Iterate(ObjectVisitor* v, char* thread_storage) {
   6427   Relocatable* top = *reinterpret_cast<Relocatable**>(thread_storage);
   6428   Iterate(v, top);
   6429   return thread_storage + ArchiveSpacePerThread();
   6430 }
   6431 
   6432 
   6433 void Relocatable::Iterate(ObjectVisitor* v) {
   6434   Isolate* isolate = Isolate::Current();
   6435   Iterate(v, isolate->relocatable_top());
   6436 }
   6437 
   6438 
   6439 void Relocatable::Iterate(ObjectVisitor* v, Relocatable* top) {
   6440   Relocatable* current = top;
   6441   while (current != NULL) {
   6442     current->IterateInstance(v);
   6443     current = current->prev_;
   6444   }
   6445 }
   6446 
   6447 
   6448 FlatStringReader::FlatStringReader(Isolate* isolate, Handle<String> str)
   6449     : Relocatable(isolate),
   6450       str_(str.location()),
   6451       length_(str->length()) {
   6452   PostGarbageCollection();
   6453 }
   6454 
   6455 
   6456 FlatStringReader::FlatStringReader(Isolate* isolate, Vector<const char> input)
   6457     : Relocatable(isolate),
   6458       str_(0),
   6459       is_ascii_(true),
   6460       length_(input.length()),
   6461       start_(input.start()) { }
   6462 
   6463 
   6464 void FlatStringReader::PostGarbageCollection() {
   6465   if (str_ == NULL) return;
   6466   Handle<String> str(str_);
   6467   ASSERT(str->IsFlat());
   6468   String::FlatContent content = str->GetFlatContent();
   6469   ASSERT(content.IsFlat());
   6470   is_ascii_ = content.IsAscii();
   6471   if (is_ascii_) {
   6472     start_ = content.ToAsciiVector().start();
   6473   } else {
   6474     start_ = content.ToUC16Vector().start();
   6475   }
   6476 }
   6477 
   6478 
   6479 void StringInputBuffer::Seek(unsigned pos) {
   6480   Reset(pos, input_);
   6481 }
   6482 
   6483 
   6484 void SafeStringInputBuffer::Seek(unsigned pos) {
   6485   Reset(pos, input_);
   6486 }
   6487 
   6488 
   6489 // This method determines the type of string involved and then copies
   6490 // a whole chunk of characters into a buffer.  It can be used with strings
   6491 // that have been glued together to form a ConsString and which must cooperate
   6492 // to fill up a buffer.
   6493 void String::ReadBlockIntoBuffer(String* input,
   6494                                  ReadBlockBuffer* rbb,
   6495                                  unsigned* offset_ptr,
   6496                                  unsigned max_chars) {
   6497   ASSERT(*offset_ptr <= (unsigned)input->length());
   6498   if (max_chars == 0) return;
   6499 
   6500   switch (StringShape(input).representation_tag()) {
   6501     case kSeqStringTag:
   6502       if (input->IsAsciiRepresentation()) {
   6503         SeqAsciiString::cast(input)->SeqAsciiStringReadBlockIntoBuffer(rbb,
   6504                                                                  offset_ptr,
   6505                                                                  max_chars);
   6506         return;
   6507       } else {
   6508         SeqTwoByteString::cast(input)->SeqTwoByteStringReadBlockIntoBuffer(rbb,
   6509                                                                      offset_ptr,
   6510                                                                      max_chars);
   6511         return;
   6512       }
   6513     case kConsStringTag:
   6514       ConsString::cast(input)->ConsStringReadBlockIntoBuffer(rbb,
   6515                                                              offset_ptr,
   6516                                                              max_chars);
   6517       return;
   6518     case kExternalStringTag:
   6519       if (input->IsAsciiRepresentation()) {
   6520         ExternalAsciiString::cast(input)->
   6521             ExternalAsciiStringReadBlockIntoBuffer(rbb, offset_ptr, max_chars);
   6522       } else {
   6523         ExternalTwoByteString::cast(input)->
   6524             ExternalTwoByteStringReadBlockIntoBuffer(rbb,
   6525                                                      offset_ptr,
   6526                                                      max_chars);
   6527        }
   6528        return;
   6529     case kSlicedStringTag:
   6530       SlicedString::cast(input)->SlicedStringReadBlockIntoBuffer(rbb,
   6531                                                                  offset_ptr,
   6532                                                                  max_chars);
   6533       return;
   6534     default:
   6535       break;
   6536   }
   6537 
   6538   UNREACHABLE();
   6539   return;
   6540 }
   6541 
   6542 
   6543 const unibrow::byte* String::ReadBlock(String* input,
   6544                                        unibrow::byte* util_buffer,
   6545                                        unsigned capacity,
   6546                                        unsigned* remaining,
   6547                                        unsigned* offset_ptr) {
   6548   ASSERT(*offset_ptr <= (unsigned)input->length());
   6549   unsigned chars = input->length() - *offset_ptr;
   6550   ReadBlockBuffer rbb(util_buffer, 0, capacity, 0);
   6551   const unibrow::byte* answer = ReadBlock(input, &rbb, offset_ptr, chars);
   6552   ASSERT(rbb.remaining <= static_cast<unsigned>(input->length()));
   6553   *remaining = rbb.remaining;
   6554   return answer;
   6555 }
   6556 
   6557 
   6558 const unibrow::byte* String::ReadBlock(String** raw_input,
   6559                                        unibrow::byte* util_buffer,
   6560                                        unsigned capacity,
   6561                                        unsigned* remaining,
   6562                                        unsigned* offset_ptr) {
   6563   Handle<String> input(raw_input);
   6564   ASSERT(*offset_ptr <= (unsigned)input->length());
   6565   unsigned chars = input->length() - *offset_ptr;
   6566   if (chars > capacity) chars = capacity;
   6567   ReadBlockBuffer rbb(util_buffer, 0, capacity, 0);
   6568   ReadBlockIntoBuffer(*input, &rbb, offset_ptr, chars);
   6569   ASSERT(rbb.remaining <= static_cast<unsigned>(input->length()));
   6570   *remaining = rbb.remaining;
   6571   return rbb.util_buffer;
   6572 }
   6573 
   6574 
   6575 // This will iterate unless the block of string data spans two 'halves' of
   6576 // a ConsString, in which case it will recurse.  Since the block of string
   6577 // data to be read has a maximum size this limits the maximum recursion
   6578 // depth to something sane.  Since C++ does not have tail call recursion
   6579 // elimination, the iteration must be explicit.
   6580 void ConsString::ConsStringReadBlockIntoBuffer(ReadBlockBuffer* rbb,
   6581                                                unsigned* offset_ptr,
   6582                                                unsigned max_chars) {
   6583   ConsString* current = this;
   6584   unsigned offset = *offset_ptr;
   6585   int offset_correction = 0;
   6586 
   6587   while (true) {
   6588     String* left = current->first();
   6589     unsigned left_length = (unsigned)left->length();
   6590     if (left_length > offset &&
   6591       max_chars <= left_length - offset) {
   6592       // Left hand side only - iterate unless we have reached the bottom of
   6593       // the cons tree.
   6594       if (StringShape(left).IsCons()) {
   6595         current = ConsString::cast(left);
   6596         continue;
   6597       } else {
   6598         String::ReadBlockIntoBuffer(left, rbb, &offset, max_chars);
   6599         *offset_ptr = offset + offset_correction;
   6600         return;
   6601       }
   6602     } else if (left_length <= offset) {
   6603       // Right hand side only - iterate unless we have reached the bottom of
   6604       // the cons tree.
   6605       offset -= left_length;
   6606       offset_correction += left_length;
   6607       String* right = current->second();
   6608       if (StringShape(right).IsCons()) {
   6609         current = ConsString::cast(right);
   6610         continue;
   6611       } else {
   6612         String::ReadBlockIntoBuffer(right, rbb, &offset, max_chars);
   6613         *offset_ptr = offset + offset_correction;
   6614         return;
   6615       }
   6616     } else {
   6617       // The block to be read spans two sides of the ConsString, so we recurse.
   6618       // First recurse on the left.
   6619       max_chars -= left_length - offset;
   6620       String::ReadBlockIntoBuffer(left, rbb, &offset, left_length - offset);
   6621       // We may have reached the max or there may not have been enough space
   6622       // in the buffer for the characters in the left hand side.
   6623       if (offset == left_length) {
   6624         // Recurse on the right.
   6625         String* right = String::cast(current->second());
   6626         offset -= left_length;
   6627         offset_correction += left_length;
   6628         String::ReadBlockIntoBuffer(right, rbb, &offset, max_chars);
   6629       }
   6630       *offset_ptr = offset + offset_correction;
   6631       return;
   6632     }
   6633   }
   6634 }
   6635 
   6636 
   6637 uint16_t ConsString::ConsStringGet(int index) {
   6638   ASSERT(index >= 0 && index < this->length());
   6639 
   6640   // Check for a flattened cons string
   6641   if (second()->length() == 0) {
   6642     String* left = first();
   6643     return left->Get(index);
   6644   }
   6645 
   6646   String* string = String::cast(this);
   6647 
   6648   while (true) {
   6649     if (StringShape(string).IsCons()) {
   6650       ConsString* cons_string = ConsString::cast(string);
   6651       String* left = cons_string->first();
   6652       if (left->length() > index) {
   6653         string = left;
   6654       } else {
   6655         index -= left->length();
   6656         string = cons_string->second();
   6657       }
   6658     } else {
   6659       return string->Get(index);
   6660     }
   6661   }
   6662 
   6663   UNREACHABLE();
   6664   return 0;
   6665 }
   6666 
   6667 
   6668 uint16_t SlicedString::SlicedStringGet(int index) {
   6669   return parent()->Get(offset() + index);
   6670 }
   6671 
   6672 
   6673 const unibrow::byte* SlicedString::SlicedStringReadBlock(
   6674     ReadBlockBuffer* buffer, unsigned* offset_ptr, unsigned chars) {
   6675   unsigned offset = this->offset();
   6676   *offset_ptr += offset;
   6677   const unibrow::byte* answer = String::ReadBlock(String::cast(parent()),
   6678                                                   buffer, offset_ptr, chars);
   6679   *offset_ptr -= offset;
   6680   return answer;
   6681 }
   6682 
   6683 
   6684 void SlicedString::SlicedStringReadBlockIntoBuffer(
   6685     ReadBlockBuffer* buffer, unsigned* offset_ptr, unsigned chars) {
   6686   unsigned offset = this->offset();
   6687   *offset_ptr += offset;
   6688   String::ReadBlockIntoBuffer(String::cast(parent()),
   6689                               buffer, offset_ptr, chars);
   6690   *offset_ptr -= offset;
   6691 }
   6692 
   6693 template <typename sinkchar>
   6694 void String::WriteToFlat(String* src,
   6695                          sinkchar* sink,
   6696                          int f,
   6697                          int t) {
   6698   String* source = src;
   6699   int from = f;
   6700   int to = t;
   6701   while (true) {
   6702     ASSERT(0 <= from && from <= to && to <= source->length());
   6703     switch (StringShape(source).full_representation_tag()) {
   6704       case kAsciiStringTag | kExternalStringTag: {
   6705         CopyChars(sink,
   6706                   ExternalAsciiString::cast(source)->GetChars() + from,
   6707                   to - from);
   6708         return;
   6709       }
   6710       case kTwoByteStringTag | kExternalStringTag: {
   6711         const uc16* data =
   6712             ExternalTwoByteString::cast(source)->GetChars();
   6713         CopyChars(sink,
   6714                   data + from,
   6715                   to - from);
   6716         return;
   6717       }
   6718       case kAsciiStringTag | kSeqStringTag: {
   6719         CopyChars(sink,
   6720                   SeqAsciiString::cast(source)->GetChars() + from,
   6721                   to - from);
   6722         return;
   6723       }
   6724       case kTwoByteStringTag | kSeqStringTag: {
   6725         CopyChars(sink,
   6726                   SeqTwoByteString::cast(source)->GetChars() + from,
   6727                   to - from);
   6728         return;
   6729       }
   6730       case kAsciiStringTag | kConsStringTag:
   6731       case kTwoByteStringTag | kConsStringTag: {
   6732         ConsString* cons_string = ConsString::cast(source);
   6733         String* first = cons_string->first();
   6734         int boundary = first->length();
   6735         if (to - boundary >= boundary - from) {
   6736           // Right hand side is longer.  Recurse over left.
   6737           if (from < boundary) {
   6738             WriteToFlat(first, sink, from, boundary);
   6739             sink += boundary - from;
   6740             from = 0;
   6741           } else {
   6742             from -= boundary;
   6743           }
   6744           to -= boundary;
   6745           source = cons_string->second();
   6746         } else {
   6747           // Left hand side is longer.  Recurse over right.
   6748           if (to > boundary) {
   6749             String* second = cons_string->second();
   6750             // When repeatedly appending to a string, we get a cons string that
   6751             // is unbalanced to the left, a list, essentially.  We inline the
   6752             // common case of sequential ascii right child.
   6753             if (to - boundary == 1) {
   6754               sink[boundary - from] = static_cast<sinkchar>(second->Get(0));
   6755             } else if (second->IsSeqAsciiString()) {
   6756               CopyChars(sink + boundary - from,
   6757                         SeqAsciiString::cast(second)->GetChars(),
   6758                         to - boundary);
   6759             } else {
   6760               WriteToFlat(second,
   6761                           sink + boundary - from,
   6762                           0,
   6763                           to - boundary);
   6764             }
   6765             to = boundary;
   6766           }
   6767           source = first;
   6768         }
   6769         break;
   6770       }
   6771       case kAsciiStringTag | kSlicedStringTag:
   6772       case kTwoByteStringTag | kSlicedStringTag: {
   6773         SlicedString* slice = SlicedString::cast(source);
   6774         unsigned offset = slice->offset();
   6775         WriteToFlat(slice->parent(), sink, from + offset, to + offset);
   6776         return;
   6777       }
   6778     }
   6779   }
   6780 }
   6781 
   6782 
   6783 template <typename IteratorA, typename IteratorB>
   6784 static inline bool CompareStringContents(IteratorA* ia, IteratorB* ib) {
   6785   // General slow case check.  We know that the ia and ib iterators
   6786   // have the same length.
   6787   while (ia->has_more()) {
   6788     uint32_t ca = ia->GetNext();
   6789     uint32_t cb = ib->GetNext();
   6790     ASSERT(ca <= unibrow::Utf16::kMaxNonSurrogateCharCode);
   6791     ASSERT(cb <= unibrow::Utf16::kMaxNonSurrogateCharCode);
   6792     if (ca != cb)
   6793       return false;
   6794   }
   6795   return true;
   6796 }
   6797 
   6798 
   6799 // Compares the contents of two strings by reading and comparing
   6800 // int-sized blocks of characters.
   6801 template <typename Char>
   6802 static inline bool CompareRawStringContents(Vector<Char> a, Vector<Char> b) {
   6803   int length = a.length();
   6804   ASSERT_EQ(length, b.length());
   6805   const Char* pa = a.start();
   6806   const Char* pb = b.start();
   6807   int i = 0;
   6808 #ifndef V8_HOST_CAN_READ_UNALIGNED
   6809   // If this architecture isn't comfortable reading unaligned ints
   6810   // then we have to check that the strings are aligned before
   6811   // comparing them blockwise.
   6812   const int kAlignmentMask = sizeof(uint32_t) - 1;  // NOLINT
   6813   uint32_t pa_addr = reinterpret_cast<uint32_t>(pa);
   6814   uint32_t pb_addr = reinterpret_cast<uint32_t>(pb);
   6815   if (((pa_addr & kAlignmentMask) | (pb_addr & kAlignmentMask)) == 0) {
   6816 #endif
   6817     const int kStepSize = sizeof(int) / sizeof(Char);  // NOLINT
   6818     int endpoint = length - kStepSize;
   6819     // Compare blocks until we reach near the end of the string.
   6820     for (; i <= endpoint; i += kStepSize) {
   6821       uint32_t wa = *reinterpret_cast<const uint32_t*>(pa + i);
   6822       uint32_t wb = *reinterpret_cast<const uint32_t*>(pb + i);
   6823       if (wa != wb) {
   6824         return false;
   6825       }
   6826     }
   6827 #ifndef V8_HOST_CAN_READ_UNALIGNED
   6828   }
   6829 #endif
   6830   // Compare the remaining characters that didn't fit into a block.
   6831   for (; i < length; i++) {
   6832     if (a[i] != b[i]) {
   6833       return false;
   6834     }
   6835   }
   6836   return true;
   6837 }
   6838 
   6839 
   6840 template <typename IteratorA>
   6841 static inline bool CompareStringContentsPartial(Isolate* isolate,
   6842                                                 IteratorA* ia,
   6843                                                 String* b) {
   6844   String::FlatContent content = b->GetFlatContent();
   6845   if (content.IsFlat()) {
   6846     if (content.IsAscii()) {
   6847       VectorIterator<char> ib(content.ToAsciiVector());
   6848       return CompareStringContents(ia, &ib);
   6849     } else {
   6850       VectorIterator<uc16> ib(content.ToUC16Vector());
   6851       return CompareStringContents(ia, &ib);
   6852     }
   6853   } else {
   6854     isolate->objects_string_compare_buffer_b()->Reset(0, b);
   6855     return CompareStringContents(ia,
   6856                                  isolate->objects_string_compare_buffer_b());
   6857   }
   6858 }
   6859 
   6860 
   6861 bool String::SlowEquals(String* other) {
   6862   // Fast check: negative check with lengths.
   6863   int len = length();
   6864   if (len != other->length()) return false;
   6865   if (len == 0) return true;
   6866 
   6867   // Fast check: if hash code is computed for both strings
   6868   // a fast negative check can be performed.
   6869   if (HasHashCode() && other->HasHashCode()) {
   6870 #ifdef DEBUG
   6871     if (FLAG_enable_slow_asserts) {
   6872       if (Hash() != other->Hash()) {
   6873         bool found_difference = false;
   6874         for (int i = 0; i < len; i++) {
   6875           if (Get(i) != other->Get(i)) {
   6876             found_difference = true;
   6877             break;
   6878           }
   6879         }
   6880         ASSERT(found_difference);
   6881       }
   6882     }
   6883 #endif
   6884     if (Hash() != other->Hash()) return false;
   6885   }
   6886 
   6887   // We know the strings are both non-empty. Compare the first chars
   6888   // before we try to flatten the strings.
   6889   if (this->Get(0) != other->Get(0)) return false;
   6890 
   6891   String* lhs = this->TryFlattenGetString();
   6892   String* rhs = other->TryFlattenGetString();
   6893 
   6894   if (StringShape(lhs).IsSequentialAscii() &&
   6895       StringShape(rhs).IsSequentialAscii()) {
   6896     const char* str1 = SeqAsciiString::cast(lhs)->GetChars();
   6897     const char* str2 = SeqAsciiString::cast(rhs)->GetChars();
   6898     return CompareRawStringContents(Vector<const char>(str1, len),
   6899                                     Vector<const char>(str2, len));
   6900   }
   6901 
   6902   Isolate* isolate = GetIsolate();
   6903   String::FlatContent lhs_content = lhs->GetFlatContent();
   6904   String::FlatContent rhs_content = rhs->GetFlatContent();
   6905   if (lhs_content.IsFlat()) {
   6906     if (lhs_content.IsAscii()) {
   6907       Vector<const char> vec1 = lhs_content.ToAsciiVector();
   6908       if (rhs_content.IsFlat()) {
   6909         if (rhs_content.IsAscii()) {
   6910           Vector<const char> vec2 = rhs_content.ToAsciiVector();
   6911           return CompareRawStringContents(vec1, vec2);
   6912         } else {
   6913           VectorIterator<char> buf1(vec1);
   6914           VectorIterator<uc16> ib(rhs_content.ToUC16Vector());
   6915           return CompareStringContents(&buf1, &ib);
   6916         }
   6917       } else {
   6918         VectorIterator<char> buf1(vec1);
   6919         isolate->objects_string_compare_buffer_b()->Reset(0, rhs);
   6920         return CompareStringContents(&buf1,
   6921             isolate->objects_string_compare_buffer_b());
   6922       }
   6923     } else {
   6924       Vector<const uc16> vec1 = lhs_content.ToUC16Vector();
   6925       if (rhs_content.IsFlat()) {
   6926         if (rhs_content.IsAscii()) {
   6927           VectorIterator<uc16> buf1(vec1);
   6928           VectorIterator<char> ib(rhs_content.ToAsciiVector());
   6929           return CompareStringContents(&buf1, &ib);
   6930         } else {
   6931           Vector<const uc16> vec2(rhs_content.ToUC16Vector());
   6932           return CompareRawStringContents(vec1, vec2);
   6933         }
   6934       } else {
   6935         VectorIterator<uc16> buf1(vec1);
   6936         isolate->objects_string_compare_buffer_b()->Reset(0, rhs);
   6937         return CompareStringContents(&buf1,
   6938             isolate->objects_string_compare_buffer_b());
   6939       }
   6940     }
   6941   } else {
   6942     isolate->objects_string_compare_buffer_a()->Reset(0, lhs);
   6943     return CompareStringContentsPartial(isolate,
   6944         isolate->objects_string_compare_buffer_a(), rhs);
   6945   }
   6946 }
   6947 
   6948 
   6949 bool String::MarkAsUndetectable() {
   6950   if (StringShape(this).IsSymbol()) return false;
   6951 
   6952   Map* map = this->map();
   6953   Heap* heap = GetHeap();
   6954   if (map == heap->string_map()) {
   6955     this->set_map(heap->undetectable_string_map());
   6956     return true;
   6957   } else if (map == heap->ascii_string_map()) {
   6958     this->set_map(heap->undetectable_ascii_string_map());
   6959     return true;
   6960   }
   6961   // Rest cannot be marked as undetectable
   6962   return false;
   6963 }
   6964 
   6965 
   6966 bool String::IsEqualTo(Vector<const char> str) {
   6967   Isolate* isolate = GetIsolate();
   6968   int slen = length();
   6969   Access<UnicodeCache::Utf8Decoder>
   6970       decoder(isolate->unicode_cache()->utf8_decoder());
   6971   decoder->Reset(str.start(), str.length());
   6972   int i;
   6973   for (i = 0; i < slen && decoder->has_more(); i++) {
   6974     uint32_t r = decoder->GetNext();
   6975     if (r > unibrow::Utf16::kMaxNonSurrogateCharCode) {
   6976       if (i > slen - 1) return false;
   6977       if (Get(i++) != unibrow::Utf16::LeadSurrogate(r)) return false;
   6978       if (Get(i) != unibrow::Utf16::TrailSurrogate(r)) return false;
   6979     } else {
   6980       if (Get(i) != r) return false;
   6981     }
   6982   }
   6983   return i == slen && !decoder->has_more();
   6984 }
   6985 
   6986 
   6987 bool String::IsAsciiEqualTo(Vector<const char> str) {
   6988   int slen = length();
   6989   if (str.length() != slen) return false;
   6990   FlatContent content = GetFlatContent();
   6991   if (content.IsAscii()) {
   6992     return CompareChars(content.ToAsciiVector().start(),
   6993                         str.start(), slen) == 0;
   6994   }
   6995   for (int i = 0; i < slen; i++) {
   6996     if (Get(i) != static_cast<uint16_t>(str[i])) return false;
   6997   }
   6998   return true;
   6999 }
   7000 
   7001 
   7002 bool String::IsTwoByteEqualTo(Vector<const uc16> str) {
   7003   int slen = length();
   7004   if (str.length() != slen) return false;
   7005   FlatContent content = GetFlatContent();
   7006   if (content.IsTwoByte()) {
   7007     return CompareChars(content.ToUC16Vector().start(), str.start(), slen) == 0;
   7008   }
   7009   for (int i = 0; i < slen; i++) {
   7010     if (Get(i) != str[i]) return false;
   7011   }
   7012   return true;
   7013 }
   7014 
   7015 
   7016 uint32_t String::ComputeAndSetHash() {
   7017   // Should only be called if hash code has not yet been computed.
   7018   ASSERT(!HasHashCode());
   7019 
   7020   const int len = length();
   7021 
   7022   // Compute the hash code.
   7023   uint32_t field = 0;
   7024   if (StringShape(this).IsSequentialAscii()) {
   7025     field = HashSequentialString(SeqAsciiString::cast(this)->GetChars(),
   7026                                  len,
   7027                                  GetHeap()->HashSeed());
   7028   } else if (StringShape(this).IsSequentialTwoByte()) {
   7029     field = HashSequentialString(SeqTwoByteString::cast(this)->GetChars(),
   7030                                  len,
   7031                                  GetHeap()->HashSeed());
   7032   } else {
   7033     StringInputBuffer buffer(this);
   7034     field = ComputeHashField(&buffer, len, GetHeap()->HashSeed());
   7035   }
   7036 
   7037   // Store the hash code in the object.
   7038   set_hash_field(field);
   7039 
   7040   // Check the hash code is there.
   7041   ASSERT(HasHashCode());
   7042   uint32_t result = field >> kHashShift;
   7043   ASSERT(result != 0);  // Ensure that the hash value of 0 is never computed.
   7044   return result;
   7045 }
   7046 
   7047 
   7048 bool String::ComputeArrayIndex(unibrow::CharacterStream* buffer,
   7049                                uint32_t* index,
   7050                                int length) {
   7051   if (length == 0 || length > kMaxArrayIndexSize) return false;
   7052   uc32 ch = buffer->GetNext();
   7053 
   7054   // If the string begins with a '0' character, it must only consist
   7055   // of it to be a legal array index.
   7056   if (ch == '0') {
   7057     *index = 0;
   7058     return length == 1;
   7059   }
   7060 
   7061   // Convert string to uint32 array index; character by character.
   7062   int d = ch - '0';
   7063   if (d < 0 || d > 9) return false;
   7064   uint32_t result = d;
   7065   while (buffer->has_more()) {
   7066     d = buffer->GetNext() - '0';
   7067     if (d < 0 || d > 9) return false;
   7068     // Check that the new result is below the 32 bit limit.
   7069     if (result > 429496729U - ((d > 5) ? 1 : 0)) return false;
   7070     result = (result * 10) + d;
   7071   }
   7072 
   7073   *index = result;
   7074   return true;
   7075 }
   7076 
   7077 
   7078 bool String::SlowAsArrayIndex(uint32_t* index) {
   7079   if (length() <= kMaxCachedArrayIndexLength) {
   7080     Hash();  // force computation of hash code
   7081     uint32_t field = hash_field();
   7082     if ((field & kIsNotArrayIndexMask) != 0) return false;
   7083     // Isolate the array index form the full hash field.
   7084     *index = (kArrayIndexHashMask & field) >> kHashShift;
   7085     return true;
   7086   } else {
   7087     StringInputBuffer buffer(this);
   7088     return ComputeArrayIndex(&buffer, index, length());
   7089   }
   7090 }
   7091 
   7092 
   7093 uint32_t StringHasher::MakeArrayIndexHash(uint32_t value, int length) {
   7094   // For array indexes mix the length into the hash as an array index could
   7095   // be zero.
   7096   ASSERT(length > 0);
   7097   ASSERT(length <= String::kMaxArrayIndexSize);
   7098   ASSERT(TenToThe(String::kMaxCachedArrayIndexLength) <
   7099          (1 << String::kArrayIndexValueBits));
   7100 
   7101   value <<= String::kHashShift;
   7102   value |= length << String::kArrayIndexHashLengthShift;
   7103 
   7104   ASSERT((value & String::kIsNotArrayIndexMask) == 0);
   7105   ASSERT((length > String::kMaxCachedArrayIndexLength) ||
   7106          (value & String::kContainsCachedArrayIndexMask) == 0);
   7107   return value;
   7108 }
   7109 
   7110 
   7111 void StringHasher::AddSurrogatePair(uc32 c) {
   7112   uint16_t lead = unibrow::Utf16::LeadSurrogate(c);
   7113   AddCharacter(lead);
   7114   uint16_t trail = unibrow::Utf16::TrailSurrogate(c);
   7115   AddCharacter(trail);
   7116 }
   7117 
   7118 
   7119 void StringHasher::AddSurrogatePairNoIndex(uc32 c) {
   7120   uint16_t lead = unibrow::Utf16::LeadSurrogate(c);
   7121   AddCharacterNoIndex(lead);
   7122   uint16_t trail = unibrow::Utf16::TrailSurrogate(c);
   7123   AddCharacterNoIndex(trail);
   7124 }
   7125 
   7126 
   7127 uint32_t StringHasher::GetHashField() {
   7128   ASSERT(is_valid());
   7129   if (length_ <= String::kMaxHashCalcLength) {
   7130     if (is_array_index()) {
   7131       return MakeArrayIndexHash(array_index(), length_);
   7132     }
   7133     return (GetHash() << String::kHashShift) | String::kIsNotArrayIndexMask;
   7134   } else {
   7135     return (length_ << String::kHashShift) | String::kIsNotArrayIndexMask;
   7136   }
   7137 }
   7138 
   7139 
   7140 uint32_t String::ComputeHashField(unibrow::CharacterStream* buffer,
   7141                                   int length,
   7142                                   uint32_t seed) {
   7143   StringHasher hasher(length, seed);
   7144 
   7145   // Very long strings have a trivial hash that doesn't inspect the
   7146   // string contents.
   7147   if (hasher.has_trivial_hash()) {
   7148     return hasher.GetHashField();
   7149   }
   7150 
   7151   // Do the iterative array index computation as long as there is a
   7152   // chance this is an array index.
   7153   while (buffer->has_more() && hasher.is_array_index()) {
   7154     hasher.AddCharacter(buffer->GetNext());
   7155   }
   7156 
   7157   // Process the remaining characters without updating the array
   7158   // index.
   7159   while (buffer->has_more()) {
   7160     hasher.AddCharacterNoIndex(buffer->GetNext());
   7161   }
   7162 
   7163   return hasher.GetHashField();
   7164 }
   7165 
   7166 
   7167 MaybeObject* String::SubString(int start, int end, PretenureFlag pretenure) {
   7168   Heap* heap = GetHeap();
   7169   if (start == 0 && end == length()) return this;
   7170   MaybeObject* result = heap->AllocateSubString(this, start, end, pretenure);
   7171   return result;
   7172 }
   7173 
   7174 
   7175 void String::PrintOn(FILE* file) {
   7176   int length = this->length();
   7177   for (int i = 0; i < length; i++) {
   7178     fprintf(file, "%c", Get(i));
   7179   }
   7180 }
   7181 
   7182 
   7183 void Map::CreateOneBackPointer(Object* transition_target) {
   7184   if (!transition_target->IsMap()) return;
   7185   Map* target = Map::cast(transition_target);
   7186 #ifdef DEBUG
   7187   // Verify target.
   7188   Object* source_prototype = prototype();
   7189   Object* target_prototype = target->prototype();
   7190   ASSERT(source_prototype->IsJSReceiver() ||
   7191          source_prototype->IsMap() ||
   7192          source_prototype->IsNull());
   7193   ASSERT(target_prototype->IsJSReceiver() ||
   7194          target_prototype->IsNull());
   7195   ASSERT(source_prototype->IsMap() ||
   7196          source_prototype == target_prototype);
   7197 #endif
   7198   // Point target back to source.  set_prototype() will not let us set
   7199   // the prototype to a map, as we do here.
   7200   *RawField(target, kPrototypeOffset) = this;
   7201 }
   7202 
   7203 
   7204 void Map::CreateBackPointers() {
   7205   DescriptorArray* descriptors = instance_descriptors();
   7206   for (int i = 0; i < descriptors->number_of_descriptors(); i++) {
   7207     switch (descriptors->GetType(i)) {
   7208       case MAP_TRANSITION:
   7209       case CONSTANT_TRANSITION:
   7210         CreateOneBackPointer(descriptors->GetValue(i));
   7211         break;
   7212       case ELEMENTS_TRANSITION: {
   7213         Object* object = descriptors->GetValue(i);
   7214         if (object->IsMap()) {
   7215           CreateOneBackPointer(object);
   7216         } else {
   7217           FixedArray* array = FixedArray::cast(object);
   7218           for (int i = 0; i < array->length(); ++i) {
   7219             CreateOneBackPointer(array->get(i));
   7220           }
   7221         }
   7222         break;
   7223       }
   7224       case CALLBACKS: {
   7225         Object* object = descriptors->GetValue(i);
   7226         if (object->IsAccessorPair()) {
   7227           AccessorPair* accessors = AccessorPair::cast(object);
   7228           CreateOneBackPointer(accessors->getter());
   7229           CreateOneBackPointer(accessors->setter());
   7230         }
   7231         break;
   7232       }
   7233       case NORMAL:
   7234       case FIELD:
   7235       case CONSTANT_FUNCTION:
   7236       case HANDLER:
   7237       case INTERCEPTOR:
   7238       case NULL_DESCRIPTOR:
   7239         break;
   7240     }
   7241   }
   7242 }
   7243 
   7244 
   7245 bool Map::RestoreOneBackPointer(Object* object,
   7246                                 Object* real_prototype,
   7247                                 bool* keep_entry) {
   7248   if (!object->IsMap()) return false;
   7249   Map* map = Map::cast(object);
   7250   if (Marking::MarkBitFrom(map).Get()) {
   7251     *keep_entry = true;
   7252     return false;
   7253   }
   7254   ASSERT(map->prototype() == this || map->prototype() == real_prototype);
   7255   // Getter prototype() is read-only, set_prototype() has side effects.
   7256   *RawField(map, Map::kPrototypeOffset) = real_prototype;
   7257   return true;
   7258 }
   7259 
   7260 
   7261 void Map::ClearNonLiveTransitions(Heap* heap, Object* real_prototype) {
   7262   DescriptorArray* d = DescriptorArray::cast(
   7263       *RawField(this, Map::kInstanceDescriptorsOrBitField3Offset));
   7264   if (d->IsEmpty()) return;
   7265   Smi* NullDescriptorDetails =
   7266     PropertyDetails(NONE, NULL_DESCRIPTOR).AsSmi();
   7267   FixedArray* contents = FixedArray::cast(
   7268       d->get(DescriptorArray::kContentArrayIndex));
   7269   ASSERT(contents->length() >= 2);
   7270   for (int i = 0; i < contents->length(); i += 2) {
   7271     // If the pair (value, details) is a map transition, check if the target is
   7272     // live. If not, null the descriptor. Also drop the back pointer for that
   7273     // map transition, so that this map is not reached again by following a back
   7274     // pointer from a non-live object.
   7275     bool keep_entry = false;
   7276     PropertyDetails details(Smi::cast(contents->get(i + 1)));
   7277     switch (details.type()) {
   7278       case MAP_TRANSITION:
   7279       case CONSTANT_TRANSITION:
   7280         RestoreOneBackPointer(contents->get(i), real_prototype, &keep_entry);
   7281         break;
   7282       case ELEMENTS_TRANSITION: {
   7283         Object* object = contents->get(i);
   7284         if (object->IsMap()) {
   7285           RestoreOneBackPointer(object, real_prototype, &keep_entry);
   7286         } else {
   7287           FixedArray* array = FixedArray::cast(object);
   7288           for (int j = 0; j < array->length(); ++j) {
   7289             if (RestoreOneBackPointer(array->get(j),
   7290                                       real_prototype,
   7291                                       &keep_entry)) {
   7292               array->set_undefined(j);
   7293             }
   7294           }
   7295         }
   7296         break;
   7297       }
   7298       case CALLBACKS: {
   7299         Object* object = contents->get(i);
   7300         if (object->IsAccessorPair()) {
   7301           AccessorPair* accessors = AccessorPair::cast(object);
   7302           if (RestoreOneBackPointer(accessors->getter(),
   7303                                     real_prototype,
   7304                                     &keep_entry)) {
   7305             accessors->set_getter(heap->the_hole_value());
   7306           }
   7307           if (RestoreOneBackPointer(accessors->setter(),
   7308                                     real_prototype,
   7309                                     &keep_entry)) {
   7310             accessors->set_setter(heap->the_hole_value());
   7311           }
   7312         } else {
   7313           keep_entry = true;
   7314         }
   7315         break;
   7316       }
   7317       case NORMAL:
   7318       case FIELD:
   7319       case CONSTANT_FUNCTION:
   7320       case HANDLER:
   7321       case INTERCEPTOR:
   7322       case NULL_DESCRIPTOR:
   7323         keep_entry = true;
   7324         break;
   7325     }
   7326     // Make sure that an entry containing only dead transitions gets collected.
   7327     // What we *really* want to do here is removing this entry completely, but
   7328     // for technical reasons we can't do this, so we zero it out instead.
   7329     if (!keep_entry) {
   7330       contents->set_unchecked(i + 1, NullDescriptorDetails);
   7331       contents->set_null_unchecked(heap, i);
   7332     }
   7333   }
   7334 }
   7335 
   7336 
   7337 int Map::Hash() {
   7338   // For performance reasons we only hash the 3 most variable fields of a map:
   7339   // constructor, prototype and bit_field2.
   7340 
   7341   // Shift away the tag.
   7342   int hash = (static_cast<uint32_t>(
   7343         reinterpret_cast<uintptr_t>(constructor())) >> 2);
   7344 
   7345   // XOR-ing the prototype and constructor directly yields too many zero bits
   7346   // when the two pointers are close (which is fairly common).
   7347   // To avoid this we shift the prototype 4 bits relatively to the constructor.
   7348   hash ^= (static_cast<uint32_t>(
   7349         reinterpret_cast<uintptr_t>(prototype())) << 2);
   7350 
   7351   return hash ^ (hash >> 16) ^ bit_field2();
   7352 }
   7353 
   7354 
   7355 bool Map::EquivalentToForNormalization(Map* other,
   7356                                        PropertyNormalizationMode mode) {
   7357   return
   7358     constructor() == other->constructor() &&
   7359     prototype() == other->prototype() &&
   7360     inobject_properties() == ((mode == CLEAR_INOBJECT_PROPERTIES) ?
   7361                               0 :
   7362                               other->inobject_properties()) &&
   7363     instance_type() == other->instance_type() &&
   7364     bit_field() == other->bit_field() &&
   7365     bit_field2() == other->bit_field2() &&
   7366     (bit_field3() & ~(1<<Map::kIsShared)) ==
   7367         (other->bit_field3() & ~(1<<Map::kIsShared));
   7368 }
   7369 
   7370 
   7371 void JSFunction::JSFunctionIterateBody(int object_size, ObjectVisitor* v) {
   7372   // Iterate over all fields in the body but take care in dealing with
   7373   // the code entry.
   7374   IteratePointers(v, kPropertiesOffset, kCodeEntryOffset);
   7375   v->VisitCodeEntry(this->address() + kCodeEntryOffset);
   7376   IteratePointers(v, kCodeEntryOffset + kPointerSize, object_size);
   7377 }
   7378 
   7379 
   7380 void JSFunction::MarkForLazyRecompilation() {
   7381   ASSERT(is_compiled() && !IsOptimized());
   7382   ASSERT(shared()->allows_lazy_compilation() ||
   7383          code()->optimizable());
   7384   Builtins* builtins = GetIsolate()->builtins();
   7385   ReplaceCode(builtins->builtin(Builtins::kLazyRecompile));
   7386 }
   7387 
   7388 
   7389 bool SharedFunctionInfo::EnsureCompiled(Handle<SharedFunctionInfo> shared,
   7390                                         ClearExceptionFlag flag) {
   7391   return shared->is_compiled() || CompileLazy(shared, flag);
   7392 }
   7393 
   7394 
   7395 static bool CompileLazyHelper(CompilationInfo* info,
   7396                               ClearExceptionFlag flag) {
   7397   // Compile the source information to a code object.
   7398   ASSERT(info->IsOptimizing() || !info->shared_info()->is_compiled());
   7399   ASSERT(!info->isolate()->has_pending_exception());
   7400   bool result = Compiler::CompileLazy(info);
   7401   ASSERT(result != Isolate::Current()->has_pending_exception());
   7402   if (!result && flag == CLEAR_EXCEPTION) {
   7403     info->isolate()->clear_pending_exception();
   7404   }
   7405   return result;
   7406 }
   7407 
   7408 
   7409 bool SharedFunctionInfo::CompileLazy(Handle<SharedFunctionInfo> shared,
   7410                                      ClearExceptionFlag flag) {
   7411   CompilationInfo info(shared);
   7412   return CompileLazyHelper(&info, flag);
   7413 }
   7414 
   7415 
   7416 bool JSFunction::CompileLazy(Handle<JSFunction> function,
   7417                              ClearExceptionFlag flag) {
   7418   bool result = true;
   7419   if (function->shared()->is_compiled()) {
   7420     function->ReplaceCode(function->shared()->code());
   7421     function->shared()->set_code_age(0);
   7422   } else {
   7423     CompilationInfo info(function);
   7424     result = CompileLazyHelper(&info, flag);
   7425     ASSERT(!result || function->is_compiled());
   7426   }
   7427   return result;
   7428 }
   7429 
   7430 
   7431 bool JSFunction::CompileOptimized(Handle<JSFunction> function,
   7432                                   int osr_ast_id,
   7433                                   ClearExceptionFlag flag) {
   7434   CompilationInfo info(function);
   7435   info.SetOptimizing(osr_ast_id);
   7436   return CompileLazyHelper(&info, flag);
   7437 }
   7438 
   7439 
   7440 bool JSFunction::IsInlineable() {
   7441   if (IsBuiltin()) return false;
   7442   SharedFunctionInfo* shared_info = shared();
   7443   // Check that the function has a script associated with it.
   7444   if (!shared_info->script()->IsScript()) return false;
   7445   if (shared_info->optimization_disabled()) return false;
   7446   Code* code = shared_info->code();
   7447   if (code->kind() == Code::OPTIMIZED_FUNCTION) return true;
   7448   // If we never ran this (unlikely) then lets try to optimize it.
   7449   if (code->kind() != Code::FUNCTION) return true;
   7450   return code->optimizable();
   7451 }
   7452 
   7453 
   7454 MaybeObject* JSFunction::SetInstancePrototype(Object* value) {
   7455   ASSERT(value->IsJSReceiver());
   7456   Heap* heap = GetHeap();
   7457   if (has_initial_map()) {
   7458     // If the function has allocated the initial map
   7459     // replace it with a copy containing the new prototype.
   7460     Map* new_map;
   7461     MaybeObject* maybe_new_map = initial_map()->CopyDropTransitions();
   7462     if (!maybe_new_map->To(&new_map)) return maybe_new_map;
   7463     new_map->set_prototype(value);
   7464     MaybeObject* maybe_object =
   7465         set_initial_map_and_cache_transitions(new_map);
   7466     if (maybe_object->IsFailure()) return maybe_object;
   7467   } else {
   7468     // Put the value in the initial map field until an initial map is
   7469     // needed.  At that point, a new initial map is created and the
   7470     // prototype is put into the initial map where it belongs.
   7471     set_prototype_or_initial_map(value);
   7472   }
   7473   heap->ClearInstanceofCache();
   7474   return value;
   7475 }
   7476 
   7477 
   7478 MaybeObject* JSFunction::SetPrototype(Object* value) {
   7479   ASSERT(should_have_prototype());
   7480   Object* construct_prototype = value;
   7481 
   7482   // If the value is not a JSReceiver, store the value in the map's
   7483   // constructor field so it can be accessed.  Also, set the prototype
   7484   // used for constructing objects to the original object prototype.
   7485   // See ECMA-262 13.2.2.
   7486   if (!value->IsJSReceiver()) {
   7487     // Copy the map so this does not affect unrelated functions.
   7488     // Remove map transitions because they point to maps with a
   7489     // different prototype.
   7490     Map* new_map;
   7491     { MaybeObject* maybe_new_map = map()->CopyDropTransitions();
   7492       if (!maybe_new_map->To(&new_map)) return maybe_new_map;
   7493     }
   7494     Heap* heap = new_map->GetHeap();
   7495     set_map(new_map);
   7496     new_map->set_constructor(value);
   7497     new_map->set_non_instance_prototype(true);
   7498     construct_prototype =
   7499         heap->isolate()->context()->global_context()->
   7500             initial_object_prototype();
   7501   } else {
   7502     map()->set_non_instance_prototype(false);
   7503   }
   7504 
   7505   return SetInstancePrototype(construct_prototype);
   7506 }
   7507 
   7508 
   7509 Object* JSFunction::RemovePrototype() {
   7510   Context* global_context = context()->global_context();
   7511   Map* no_prototype_map = shared()->is_classic_mode()
   7512       ? global_context->function_without_prototype_map()
   7513       : global_context->strict_mode_function_without_prototype_map();
   7514 
   7515   if (map() == no_prototype_map) {
   7516     // Be idempotent.
   7517     return this;
   7518   }
   7519 
   7520   ASSERT(map() == (shared()->is_classic_mode()
   7521                    ? global_context->function_map()
   7522                    : global_context->strict_mode_function_map()));
   7523 
   7524   set_map(no_prototype_map);
   7525   set_prototype_or_initial_map(no_prototype_map->GetHeap()->the_hole_value());
   7526   return this;
   7527 }
   7528 
   7529 
   7530 Object* JSFunction::SetInstanceClassName(String* name) {
   7531   shared()->set_instance_class_name(name);
   7532   return this;
   7533 }
   7534 
   7535 
   7536 void JSFunction::PrintName(FILE* out) {
   7537   SmartArrayPointer<char> name = shared()->DebugName()->ToCString();
   7538   PrintF(out, "%s", *name);
   7539 }
   7540 
   7541 
   7542 Context* JSFunction::GlobalContextFromLiterals(FixedArray* literals) {
   7543   return Context::cast(literals->get(JSFunction::kLiteralGlobalContextIndex));
   7544 }
   7545 
   7546 
   7547 MaybeObject* Oddball::Initialize(const char* to_string,
   7548                                  Object* to_number,
   7549                                  byte kind) {
   7550   String* symbol;
   7551   { MaybeObject* maybe_symbol =
   7552         Isolate::Current()->heap()->LookupAsciiSymbol(to_string);
   7553     if (!maybe_symbol->To(&symbol)) return maybe_symbol;
   7554   }
   7555   set_to_string(symbol);
   7556   set_to_number(to_number);
   7557   set_kind(kind);
   7558   return this;
   7559 }
   7560 
   7561 
   7562 String* SharedFunctionInfo::DebugName() {
   7563   Object* n = name();
   7564   if (!n->IsString() || String::cast(n)->length() == 0) return inferred_name();
   7565   return String::cast(n);
   7566 }
   7567 
   7568 
   7569 bool SharedFunctionInfo::HasSourceCode() {
   7570   return !script()->IsUndefined() &&
   7571          !reinterpret_cast<Script*>(script())->source()->IsUndefined();
   7572 }
   7573 
   7574 
   7575 Handle<Object> SharedFunctionInfo::GetSourceCode() {
   7576   if (!HasSourceCode()) return GetIsolate()->factory()->undefined_value();
   7577   Handle<String> source(String::cast(Script::cast(script())->source()));
   7578   return SubString(source, start_position(), end_position());
   7579 }
   7580 
   7581 
   7582 int SharedFunctionInfo::SourceSize() {
   7583   return end_position() - start_position();
   7584 }
   7585 
   7586 
   7587 int SharedFunctionInfo::CalculateInstanceSize() {
   7588   int instance_size =
   7589       JSObject::kHeaderSize +
   7590       expected_nof_properties() * kPointerSize;
   7591   if (instance_size > JSObject::kMaxInstanceSize) {
   7592     instance_size = JSObject::kMaxInstanceSize;
   7593   }
   7594   return instance_size;
   7595 }
   7596 
   7597 
   7598 int SharedFunctionInfo::CalculateInObjectProperties() {
   7599   return (CalculateInstanceSize() - JSObject::kHeaderSize) / kPointerSize;
   7600 }
   7601 
   7602 
   7603 bool SharedFunctionInfo::CanGenerateInlineConstructor(Object* prototype) {
   7604   // Check the basic conditions for generating inline constructor code.
   7605   if (!FLAG_inline_new
   7606       || !has_only_simple_this_property_assignments()
   7607       || this_property_assignments_count() == 0) {
   7608     return false;
   7609   }
   7610 
   7611   // If the prototype is null inline constructors cause no problems.
   7612   if (!prototype->IsJSObject()) {
   7613     ASSERT(prototype->IsNull());
   7614     return true;
   7615   }
   7616 
   7617   Heap* heap = GetHeap();
   7618 
   7619   // Traverse the proposed prototype chain looking for setters for properties of
   7620   // the same names as are set by the inline constructor.
   7621   for (Object* obj = prototype;
   7622        obj != heap->null_value();
   7623        obj = obj->GetPrototype()) {
   7624     JSObject* js_object = JSObject::cast(obj);
   7625     for (int i = 0; i < this_property_assignments_count(); i++) {
   7626       LookupResult result(heap->isolate());
   7627       String* name = GetThisPropertyAssignmentName(i);
   7628       js_object->LocalLookupRealNamedProperty(name, &result);
   7629       if (result.IsFound() && result.type() == CALLBACKS) {
   7630         return false;
   7631       }
   7632     }
   7633   }
   7634 
   7635   return true;
   7636 }
   7637 
   7638 
   7639 void SharedFunctionInfo::ForbidInlineConstructor() {
   7640   set_compiler_hints(BooleanBit::set(compiler_hints(),
   7641                                      kHasOnlySimpleThisPropertyAssignments,
   7642                                      false));
   7643 }
   7644 
   7645 
   7646 void SharedFunctionInfo::SetThisPropertyAssignmentsInfo(
   7647     bool only_simple_this_property_assignments,
   7648     FixedArray* assignments) {
   7649   set_compiler_hints(BooleanBit::set(compiler_hints(),
   7650                                      kHasOnlySimpleThisPropertyAssignments,
   7651                                      only_simple_this_property_assignments));
   7652   set_this_property_assignments(assignments);
   7653   set_this_property_assignments_count(assignments->length() / 3);
   7654 }
   7655 
   7656 
   7657 void SharedFunctionInfo::ClearThisPropertyAssignmentsInfo() {
   7658   Heap* heap = GetHeap();
   7659   set_compiler_hints(BooleanBit::set(compiler_hints(),
   7660                                      kHasOnlySimpleThisPropertyAssignments,
   7661                                      false));
   7662   set_this_property_assignments(heap->undefined_value());
   7663   set_this_property_assignments_count(0);
   7664 }
   7665 
   7666 
   7667 String* SharedFunctionInfo::GetThisPropertyAssignmentName(int index) {
   7668   Object* obj = this_property_assignments();
   7669   ASSERT(obj->IsFixedArray());
   7670   ASSERT(index < this_property_assignments_count());
   7671   obj = FixedArray::cast(obj)->get(index * 3);
   7672   ASSERT(obj->IsString());
   7673   return String::cast(obj);
   7674 }
   7675 
   7676 
   7677 bool SharedFunctionInfo::IsThisPropertyAssignmentArgument(int index) {
   7678   Object* obj = this_property_assignments();
   7679   ASSERT(obj->IsFixedArray());
   7680   ASSERT(index < this_property_assignments_count());
   7681   obj = FixedArray::cast(obj)->get(index * 3 + 1);
   7682   return Smi::cast(obj)->value() != -1;
   7683 }
   7684 
   7685 
   7686 int SharedFunctionInfo::GetThisPropertyAssignmentArgument(int index) {
   7687   ASSERT(IsThisPropertyAssignmentArgument(index));
   7688   Object* obj =
   7689       FixedArray::cast(this_property_assignments())->get(index * 3 + 1);
   7690   return Smi::cast(obj)->value();
   7691 }
   7692 
   7693 
   7694 Object* SharedFunctionInfo::GetThisPropertyAssignmentConstant(int index) {
   7695   ASSERT(!IsThisPropertyAssignmentArgument(index));
   7696   Object* obj =
   7697       FixedArray::cast(this_property_assignments())->get(index * 3 + 2);
   7698   return obj;
   7699 }
   7700 
   7701 
   7702 // Support function for printing the source code to a StringStream
   7703 // without any allocation in the heap.
   7704 void SharedFunctionInfo::SourceCodePrint(StringStream* accumulator,
   7705                                          int max_length) {
   7706   // For some native functions there is no source.
   7707   if (!HasSourceCode()) {
   7708     accumulator->Add("<No Source>");
   7709     return;
   7710   }
   7711 
   7712   // Get the source for the script which this function came from.
   7713   // Don't use String::cast because we don't want more assertion errors while
   7714   // we are already creating a stack dump.
   7715   String* script_source =
   7716       reinterpret_cast<String*>(Script::cast(script())->source());
   7717 
   7718   if (!script_source->LooksValid()) {
   7719     accumulator->Add("<Invalid Source>");
   7720     return;
   7721   }
   7722 
   7723   if (!is_toplevel()) {
   7724     accumulator->Add("function ");
   7725     Object* name = this->name();
   7726     if (name->IsString() && String::cast(name)->length() > 0) {
   7727       accumulator->PrintName(name);
   7728     }
   7729   }
   7730 
   7731   int len = end_position() - start_position();
   7732   if (len <= max_length || max_length < 0) {
   7733     accumulator->Put(script_source, start_position(), end_position());
   7734   } else {
   7735     accumulator->Put(script_source,
   7736                      start_position(),
   7737                      start_position() + max_length);
   7738     accumulator->Add("...\n");
   7739   }
   7740 }
   7741 
   7742 
   7743 static bool IsCodeEquivalent(Code* code, Code* recompiled) {
   7744   if (code->instruction_size() != recompiled->instruction_size()) return false;
   7745   ByteArray* code_relocation = code->relocation_info();
   7746   ByteArray* recompiled_relocation = recompiled->relocation_info();
   7747   int length = code_relocation->length();
   7748   if (length != recompiled_relocation->length()) return false;
   7749   int compare = memcmp(code_relocation->GetDataStartAddress(),
   7750                        recompiled_relocation->GetDataStartAddress(),
   7751                        length);
   7752   return compare == 0;
   7753 }
   7754 
   7755 
   7756 void SharedFunctionInfo::EnableDeoptimizationSupport(Code* recompiled) {
   7757   ASSERT(!has_deoptimization_support());
   7758   AssertNoAllocation no_allocation;
   7759   Code* code = this->code();
   7760   if (IsCodeEquivalent(code, recompiled)) {
   7761     // Copy the deoptimization data from the recompiled code.
   7762     code->set_deoptimization_data(recompiled->deoptimization_data());
   7763     code->set_has_deoptimization_support(true);
   7764   } else {
   7765     // TODO(3025757): In case the recompiled isn't equivalent to the
   7766     // old code, we have to replace it. We should try to avoid this
   7767     // altogether because it flushes valuable type feedback by
   7768     // effectively resetting all IC state.
   7769     set_code(recompiled);
   7770   }
   7771   ASSERT(has_deoptimization_support());
   7772 }
   7773 
   7774 
   7775 void SharedFunctionInfo::DisableOptimization() {
   7776   // Disable optimization for the shared function info and mark the
   7777   // code as non-optimizable. The marker on the shared function info
   7778   // is there because we flush non-optimized code thereby loosing the
   7779   // non-optimizable information for the code. When the code is
   7780   // regenerated and set on the shared function info it is marked as
   7781   // non-optimizable if optimization is disabled for the shared
   7782   // function info.
   7783   set_optimization_disabled(true);
   7784   // Code should be the lazy compilation stub or else unoptimized.  If the
   7785   // latter, disable optimization for the code too.
   7786   ASSERT(code()->kind() == Code::FUNCTION || code()->kind() == Code::BUILTIN);
   7787   if (code()->kind() == Code::FUNCTION) {
   7788     code()->set_optimizable(false);
   7789   }
   7790   if (FLAG_trace_opt) {
   7791     PrintF("[disabled optimization for %s]\n", *DebugName()->ToCString());
   7792   }
   7793 }
   7794 
   7795 
   7796 bool SharedFunctionInfo::VerifyBailoutId(int id) {
   7797   ASSERT(id != AstNode::kNoNumber);
   7798   Code* unoptimized = code();
   7799   DeoptimizationOutputData* data =
   7800       DeoptimizationOutputData::cast(unoptimized->deoptimization_data());
   7801   unsigned ignore = Deoptimizer::GetOutputInfo(data, id, this);
   7802   USE(ignore);
   7803   return true;  // Return true if there was no ASSERT.
   7804 }
   7805 
   7806 
   7807 void SharedFunctionInfo::StartInobjectSlackTracking(Map* map) {
   7808   ASSERT(!IsInobjectSlackTrackingInProgress());
   7809 
   7810   if (!FLAG_clever_optimizations) return;
   7811 
   7812   // Only initiate the tracking the first time.
   7813   if (live_objects_may_exist()) return;
   7814   set_live_objects_may_exist(true);
   7815 
   7816   // No tracking during the snapshot construction phase.
   7817   if (Serializer::enabled()) return;
   7818 
   7819   if (map->unused_property_fields() == 0) return;
   7820 
   7821   // Nonzero counter is a leftover from the previous attempt interrupted
   7822   // by GC, keep it.
   7823   if (construction_count() == 0) {
   7824     set_construction_count(kGenerousAllocationCount);
   7825   }
   7826   set_initial_map(map);
   7827   Builtins* builtins = map->GetHeap()->isolate()->builtins();
   7828   ASSERT_EQ(builtins->builtin(Builtins::kJSConstructStubGeneric),
   7829             construct_stub());
   7830   set_construct_stub(builtins->builtin(Builtins::kJSConstructStubCountdown));
   7831 }
   7832 
   7833 
   7834 // Called from GC, hence reinterpret_cast and unchecked accessors.
   7835 void SharedFunctionInfo::DetachInitialMap() {
   7836   Map* map = reinterpret_cast<Map*>(initial_map());
   7837 
   7838   // Make the map remember to restore the link if it survives the GC.
   7839   map->set_bit_field2(
   7840       map->bit_field2() | (1 << Map::kAttachedToSharedFunctionInfo));
   7841 
   7842   // Undo state changes made by StartInobjectTracking (except the
   7843   // construction_count). This way if the initial map does not survive the GC
   7844   // then StartInobjectTracking will be called again the next time the
   7845   // constructor is called. The countdown will continue and (possibly after
   7846   // several more GCs) CompleteInobjectSlackTracking will eventually be called.
   7847   Heap* heap = map->GetHeap();
   7848   set_initial_map(heap->raw_unchecked_undefined_value());
   7849   Builtins* builtins = heap->isolate()->builtins();
   7850   ASSERT_EQ(builtins->builtin(Builtins::kJSConstructStubCountdown),
   7851             *RawField(this, kConstructStubOffset));
   7852   set_construct_stub(builtins->builtin(Builtins::kJSConstructStubGeneric));
   7853   // It is safe to clear the flag: it will be set again if the map is live.
   7854   set_live_objects_may_exist(false);
   7855 }
   7856 
   7857 
   7858 // Called from GC, hence reinterpret_cast and unchecked accessors.
   7859 void SharedFunctionInfo::AttachInitialMap(Map* map) {
   7860   map->set_bit_field2(
   7861       map->bit_field2() & ~(1 << Map::kAttachedToSharedFunctionInfo));
   7862 
   7863   // Resume inobject slack tracking.
   7864   set_initial_map(map);
   7865   Builtins* builtins = map->GetHeap()->isolate()->builtins();
   7866   ASSERT_EQ(builtins->builtin(Builtins::kJSConstructStubGeneric),
   7867             *RawField(this, kConstructStubOffset));
   7868   set_construct_stub(builtins->builtin(Builtins::kJSConstructStubCountdown));
   7869   // The map survived the gc, so there may be objects referencing it.
   7870   set_live_objects_may_exist(true);
   7871 }
   7872 
   7873 
   7874 void SharedFunctionInfo::ResetForNewContext(int new_ic_age) {
   7875   code()->ClearInlineCaches();
   7876   set_ic_age(new_ic_age);
   7877   if (code()->kind() == Code::FUNCTION) {
   7878     code()->set_profiler_ticks(0);
   7879     if (optimization_disabled() &&
   7880         opt_count() >= Compiler::kDefaultMaxOptCount) {
   7881       // Re-enable optimizations if they were disabled due to opt_count limit.
   7882       set_optimization_disabled(false);
   7883       code()->set_optimizable(true);
   7884     }
   7885     set_opt_count(0);
   7886   }
   7887 }
   7888 
   7889 
   7890 static void GetMinInobjectSlack(Map* map, void* data) {
   7891   int slack = map->unused_property_fields();
   7892   if (*reinterpret_cast<int*>(data) > slack) {
   7893     *reinterpret_cast<int*>(data) = slack;
   7894   }
   7895 }
   7896 
   7897 
   7898 static void ShrinkInstanceSize(Map* map, void* data) {
   7899   int slack = *reinterpret_cast<int*>(data);
   7900   map->set_inobject_properties(map->inobject_properties() - slack);
   7901   map->set_unused_property_fields(map->unused_property_fields() - slack);
   7902   map->set_instance_size(map->instance_size() - slack * kPointerSize);
   7903 
   7904   // Visitor id might depend on the instance size, recalculate it.
   7905   map->set_visitor_id(StaticVisitorBase::GetVisitorId(map));
   7906 }
   7907 
   7908 
   7909 void SharedFunctionInfo::CompleteInobjectSlackTracking() {
   7910   ASSERT(live_objects_may_exist() && IsInobjectSlackTrackingInProgress());
   7911   Map* map = Map::cast(initial_map());
   7912 
   7913   Heap* heap = map->GetHeap();
   7914   set_initial_map(heap->undefined_value());
   7915   Builtins* builtins = heap->isolate()->builtins();
   7916   ASSERT_EQ(builtins->builtin(Builtins::kJSConstructStubCountdown),
   7917             construct_stub());
   7918   set_construct_stub(builtins->builtin(Builtins::kJSConstructStubGeneric));
   7919 
   7920   int slack = map->unused_property_fields();
   7921   map->TraverseTransitionTree(&GetMinInobjectSlack, &slack);
   7922   if (slack != 0) {
   7923     // Resize the initial map and all maps in its transition tree.
   7924     map->TraverseTransitionTree(&ShrinkInstanceSize, &slack);
   7925 
   7926     // Give the correct expected_nof_properties to initial maps created later.
   7927     ASSERT(expected_nof_properties() >= slack);
   7928     set_expected_nof_properties(expected_nof_properties() - slack);
   7929   }
   7930 }
   7931 
   7932 
   7933 void SharedFunctionInfo::SharedFunctionInfoIterateBody(ObjectVisitor* v) {
   7934   v->VisitSharedFunctionInfo(this);
   7935   SharedFunctionInfo::BodyDescriptor::IterateBody(this, v);
   7936 }
   7937 
   7938 
   7939 #define DECLARE_TAG(ignore1, name, ignore2) name,
   7940 const char* const VisitorSynchronization::kTags[
   7941     VisitorSynchronization::kNumberOfSyncTags] = {
   7942   VISITOR_SYNCHRONIZATION_TAGS_LIST(DECLARE_TAG)
   7943 };
   7944 #undef DECLARE_TAG
   7945 
   7946 
   7947 #define DECLARE_TAG(ignore1, ignore2, name) name,
   7948 const char* const VisitorSynchronization::kTagNames[
   7949     VisitorSynchronization::kNumberOfSyncTags] = {
   7950   VISITOR_SYNCHRONIZATION_TAGS_LIST(DECLARE_TAG)
   7951 };
   7952 #undef DECLARE_TAG
   7953 
   7954 
   7955 void ObjectVisitor::VisitCodeTarget(RelocInfo* rinfo) {
   7956   ASSERT(RelocInfo::IsCodeTarget(rinfo->rmode()));
   7957   Object* target = Code::GetCodeFromTargetAddress(rinfo->target_address());
   7958   Object* old_target = target;
   7959   VisitPointer(&target);
   7960   CHECK_EQ(target, old_target);  // VisitPointer doesn't change Code* *target.
   7961 }
   7962 
   7963 
   7964 void ObjectVisitor::VisitCodeEntry(Address entry_address) {
   7965   Object* code = Code::GetObjectFromEntryAddress(entry_address);
   7966   Object* old_code = code;
   7967   VisitPointer(&code);
   7968   if (code != old_code) {
   7969     Memory::Address_at(entry_address) = reinterpret_cast<Code*>(code)->entry();
   7970   }
   7971 }
   7972 
   7973 
   7974 void ObjectVisitor::VisitGlobalPropertyCell(RelocInfo* rinfo) {
   7975   ASSERT(rinfo->rmode() == RelocInfo::GLOBAL_PROPERTY_CELL);
   7976   Object* cell = rinfo->target_cell();
   7977   Object* old_cell = cell;
   7978   VisitPointer(&cell);
   7979   if (cell != old_cell) {
   7980     rinfo->set_target_cell(reinterpret_cast<JSGlobalPropertyCell*>(cell));
   7981   }
   7982 }
   7983 
   7984 
   7985 void ObjectVisitor::VisitDebugTarget(RelocInfo* rinfo) {
   7986   ASSERT((RelocInfo::IsJSReturn(rinfo->rmode()) &&
   7987           rinfo->IsPatchedReturnSequence()) ||
   7988          (RelocInfo::IsDebugBreakSlot(rinfo->rmode()) &&
   7989           rinfo->IsPatchedDebugBreakSlotSequence()));
   7990   Object* target = Code::GetCodeFromTargetAddress(rinfo->call_address());
   7991   Object* old_target = target;
   7992   VisitPointer(&target);
   7993   CHECK_EQ(target, old_target);  // VisitPointer doesn't change Code* *target.
   7994 }
   7995 
   7996 void ObjectVisitor::VisitEmbeddedPointer(RelocInfo* rinfo) {
   7997   ASSERT(rinfo->rmode() == RelocInfo::EMBEDDED_OBJECT);
   7998   VisitPointer(rinfo->target_object_address());
   7999 }
   8000 
   8001 void ObjectVisitor::VisitExternalReference(RelocInfo* rinfo) {
   8002   Address* p = rinfo->target_reference_address();
   8003   VisitExternalReferences(p, p + 1);
   8004 }
   8005 
   8006 void Code::InvalidateRelocation() {
   8007   set_relocation_info(GetHeap()->empty_byte_array());
   8008 }
   8009 
   8010 
   8011 void Code::Relocate(intptr_t delta) {
   8012   for (RelocIterator it(this, RelocInfo::kApplyMask); !it.done(); it.next()) {
   8013     it.rinfo()->apply(delta);
   8014   }
   8015   CPU::FlushICache(instruction_start(), instruction_size());
   8016 }
   8017 
   8018 
   8019 void Code::CopyFrom(const CodeDesc& desc) {
   8020   ASSERT(Marking::Color(this) == Marking::WHITE_OBJECT);
   8021 
   8022   // copy code
   8023   memmove(instruction_start(), desc.buffer, desc.instr_size);
   8024 
   8025   // copy reloc info
   8026   memmove(relocation_start(),
   8027           desc.buffer + desc.buffer_size - desc.reloc_size,
   8028           desc.reloc_size);
   8029 
   8030   // unbox handles and relocate
   8031   intptr_t delta = instruction_start() - desc.buffer;
   8032   int mode_mask = RelocInfo::kCodeTargetMask |
   8033                   RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT) |
   8034                   RelocInfo::ModeMask(RelocInfo::GLOBAL_PROPERTY_CELL) |
   8035                   RelocInfo::kApplyMask;
   8036   Assembler* origin = desc.origin;  // Needed to find target_object on X64.
   8037   for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
   8038     RelocInfo::Mode mode = it.rinfo()->rmode();
   8039     if (mode == RelocInfo::EMBEDDED_OBJECT) {
   8040       Handle<Object> p = it.rinfo()->target_object_handle(origin);
   8041       it.rinfo()->set_target_object(*p, SKIP_WRITE_BARRIER);
   8042     } else if (mode == RelocInfo::GLOBAL_PROPERTY_CELL) {
   8043       Handle<JSGlobalPropertyCell> cell  = it.rinfo()->target_cell_handle();
   8044       it.rinfo()->set_target_cell(*cell, SKIP_WRITE_BARRIER);
   8045     } else if (RelocInfo::IsCodeTarget(mode)) {
   8046       // rewrite code handles in inline cache targets to direct
   8047       // pointers to the first instruction in the code object
   8048       Handle<Object> p = it.rinfo()->target_object_handle(origin);
   8049       Code* code = Code::cast(*p);
   8050       it.rinfo()->set_target_address(code->instruction_start(),
   8051                                      SKIP_WRITE_BARRIER);
   8052     } else {
   8053       it.rinfo()->apply(delta);
   8054     }
   8055   }
   8056   CPU::FlushICache(instruction_start(), instruction_size());
   8057 }
   8058 
   8059 
   8060 // Locate the source position which is closest to the address in the code. This
   8061 // is using the source position information embedded in the relocation info.
   8062 // The position returned is relative to the beginning of the script where the
   8063 // source for this function is found.
   8064 int Code::SourcePosition(Address pc) {
   8065   int distance = kMaxInt;
   8066   int position = RelocInfo::kNoPosition;  // Initially no position found.
   8067   // Run through all the relocation info to find the best matching source
   8068   // position. All the code needs to be considered as the sequence of the
   8069   // instructions in the code does not necessarily follow the same order as the
   8070   // source.
   8071   RelocIterator it(this, RelocInfo::kPositionMask);
   8072   while (!it.done()) {
   8073     // Only look at positions after the current pc.
   8074     if (it.rinfo()->pc() < pc) {
   8075       // Get position and distance.
   8076 
   8077       int dist = static_cast<int>(pc - it.rinfo()->pc());
   8078       int pos = static_cast<int>(it.rinfo()->data());
   8079       // If this position is closer than the current candidate or if it has the
   8080       // same distance as the current candidate and the position is higher then
   8081       // this position is the new candidate.
   8082       if ((dist < distance) ||
   8083           (dist == distance && pos > position)) {
   8084         position = pos;
   8085         distance = dist;
   8086       }
   8087     }
   8088     it.next();
   8089   }
   8090   return position;
   8091 }
   8092 
   8093 
   8094 // Same as Code::SourcePosition above except it only looks for statement
   8095 // positions.
   8096 int Code::SourceStatementPosition(Address pc) {
   8097   // First find the position as close as possible using all position
   8098   // information.
   8099   int position = SourcePosition(pc);
   8100   // Now find the closest statement position before the position.
   8101   int statement_position = 0;
   8102   RelocIterator it(this, RelocInfo::kPositionMask);
   8103   while (!it.done()) {
   8104     if (RelocInfo::IsStatementPosition(it.rinfo()->rmode())) {
   8105       int p = static_cast<int>(it.rinfo()->data());
   8106       if (statement_position < p && p <= position) {
   8107         statement_position = p;
   8108       }
   8109     }
   8110     it.next();
   8111   }
   8112   return statement_position;
   8113 }
   8114 
   8115 
   8116 SafepointEntry Code::GetSafepointEntry(Address pc) {
   8117   SafepointTable table(this);
   8118   return table.FindEntry(pc);
   8119 }
   8120 
   8121 
   8122 void Code::SetNoStackCheckTable() {
   8123   // Indicate the absence of a stack-check table by a table start after the
   8124   // end of the instructions.  Table start must be aligned, so round up.
   8125   set_stack_check_table_offset(RoundUp(instruction_size(), kIntSize));
   8126 }
   8127 
   8128 
   8129 Map* Code::FindFirstMap() {
   8130   ASSERT(is_inline_cache_stub());
   8131   AssertNoAllocation no_allocation;
   8132   int mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
   8133   for (RelocIterator it(this, mask); !it.done(); it.next()) {
   8134     RelocInfo* info = it.rinfo();
   8135     Object* object = info->target_object();
   8136     if (object->IsMap()) return Map::cast(object);
   8137   }
   8138   return NULL;
   8139 }
   8140 
   8141 
   8142 void Code::ClearInlineCaches() {
   8143   int mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
   8144              RelocInfo::ModeMask(RelocInfo::CONSTRUCT_CALL) |
   8145              RelocInfo::ModeMask(RelocInfo::CODE_TARGET_WITH_ID) |
   8146              RelocInfo::ModeMask(RelocInfo::CODE_TARGET_CONTEXT);
   8147   for (RelocIterator it(this, mask); !it.done(); it.next()) {
   8148     RelocInfo* info = it.rinfo();
   8149     Code* target(Code::GetCodeFromTargetAddress(info->target_address()));
   8150     if (target->is_inline_cache_stub()) {
   8151       IC::Clear(info->pc());
   8152     }
   8153   }
   8154 }
   8155 
   8156 
   8157 #ifdef ENABLE_DISASSEMBLER
   8158 
   8159 void DeoptimizationInputData::DeoptimizationInputDataPrint(FILE* out) {
   8160   disasm::NameConverter converter;
   8161   int deopt_count = DeoptCount();
   8162   PrintF(out, "Deoptimization Input Data (deopt points = %d)\n", deopt_count);
   8163   if (0 == deopt_count) return;
   8164 
   8165   PrintF(out, "%6s  %6s  %6s %6s %12s\n", "index", "ast id", "argc", "pc",
   8166          FLAG_print_code_verbose ? "commands" : "");
   8167   for (int i = 0; i < deopt_count; i++) {
   8168     PrintF(out, "%6d  %6d  %6d %6d",
   8169            i,
   8170            AstId(i)->value(),
   8171            ArgumentsStackHeight(i)->value(),
   8172            Pc(i)->value());
   8173 
   8174     if (!FLAG_print_code_verbose) {
   8175       PrintF(out, "\n");
   8176       continue;
   8177     }
   8178     // Print details of the frame translation.
   8179     int translation_index = TranslationIndex(i)->value();
   8180     TranslationIterator iterator(TranslationByteArray(), translation_index);
   8181     Translation::Opcode opcode =
   8182         static_cast<Translation::Opcode>(iterator.Next());
   8183     ASSERT(Translation::BEGIN == opcode);
   8184     int frame_count = iterator.Next();
   8185     int jsframe_count = iterator.Next();
   8186     PrintF(out, "  %s {frame count=%d, js frame count=%d}\n",
   8187            Translation::StringFor(opcode),
   8188            frame_count,
   8189            jsframe_count);
   8190 
   8191     while (iterator.HasNext() &&
   8192            Translation::BEGIN !=
   8193            (opcode = static_cast<Translation::Opcode>(iterator.Next()))) {
   8194       PrintF(out, "%24s    %s ", "", Translation::StringFor(opcode));
   8195 
   8196       switch (opcode) {
   8197         case Translation::BEGIN:
   8198           UNREACHABLE();
   8199           break;
   8200 
   8201         case Translation::JS_FRAME: {
   8202           int ast_id = iterator.Next();
   8203           int function_id = iterator.Next();
   8204           JSFunction* function =
   8205               JSFunction::cast(LiteralArray()->get(function_id));
   8206           unsigned height = iterator.Next();
   8207           PrintF(out, "{ast_id=%d, function=", ast_id);
   8208           function->PrintName(out);
   8209           PrintF(out, ", height=%u}", height);
   8210           break;
   8211         }
   8212 
   8213         case Translation::ARGUMENTS_ADAPTOR_FRAME:
   8214         case Translation::CONSTRUCT_STUB_FRAME: {
   8215           int function_id = iterator.Next();
   8216           JSFunction* function =
   8217               JSFunction::cast(LiteralArray()->get(function_id));
   8218           unsigned height = iterator.Next();
   8219           PrintF(out, "{function=");
   8220           function->PrintName(out);
   8221           PrintF(out, ", height=%u}", height);
   8222           break;
   8223         }
   8224 
   8225         case Translation::DUPLICATE:
   8226           break;
   8227 
   8228         case Translation::REGISTER: {
   8229           int reg_code = iterator.Next();
   8230             PrintF(out, "{input=%s}", converter.NameOfCPURegister(reg_code));
   8231           break;
   8232         }
   8233 
   8234         case Translation::INT32_REGISTER: {
   8235           int reg_code = iterator.Next();
   8236           PrintF(out, "{input=%s}", converter.NameOfCPURegister(reg_code));
   8237           break;
   8238         }
   8239 
   8240         case Translation::DOUBLE_REGISTER: {
   8241           int reg_code = iterator.Next();
   8242           PrintF(out, "{input=%s}",
   8243                  DoubleRegister::AllocationIndexToString(reg_code));
   8244           break;
   8245         }
   8246 
   8247         case Translation::STACK_SLOT: {
   8248           int input_slot_index = iterator.Next();
   8249           PrintF(out, "{input=%d}", input_slot_index);
   8250           break;
   8251         }
   8252 
   8253         case Translation::INT32_STACK_SLOT: {
   8254           int input_slot_index = iterator.Next();
   8255           PrintF(out, "{input=%d}", input_slot_index);
   8256           break;
   8257         }
   8258 
   8259         case Translation::DOUBLE_STACK_SLOT: {
   8260           int input_slot_index = iterator.Next();
   8261           PrintF(out, "{input=%d}", input_slot_index);
   8262           break;
   8263         }
   8264 
   8265         case Translation::LITERAL: {
   8266           unsigned literal_index = iterator.Next();
   8267           PrintF(out, "{literal_id=%u}", literal_index);
   8268           break;
   8269         }
   8270 
   8271         case Translation::ARGUMENTS_OBJECT:
   8272           break;
   8273       }
   8274       PrintF(out, "\n");
   8275     }
   8276   }
   8277 }
   8278 
   8279 
   8280 void DeoptimizationOutputData::DeoptimizationOutputDataPrint(FILE* out) {
   8281   PrintF(out, "Deoptimization Output Data (deopt points = %d)\n",
   8282          this->DeoptPoints());
   8283   if (this->DeoptPoints() == 0) return;
   8284 
   8285   PrintF("%6s  %8s  %s\n", "ast id", "pc", "state");
   8286   for (int i = 0; i < this->DeoptPoints(); i++) {
   8287     int pc_and_state = this->PcAndState(i)->value();
   8288     PrintF("%6d  %8d  %s\n",
   8289            this->AstId(i)->value(),
   8290            FullCodeGenerator::PcField::decode(pc_and_state),
   8291            FullCodeGenerator::State2String(
   8292                FullCodeGenerator::StateField::decode(pc_and_state)));
   8293   }
   8294 }
   8295 
   8296 
   8297 // Identify kind of code.
   8298 const char* Code::Kind2String(Kind kind) {
   8299   switch (kind) {
   8300     case FUNCTION: return "FUNCTION";
   8301     case OPTIMIZED_FUNCTION: return "OPTIMIZED_FUNCTION";
   8302     case STUB: return "STUB";
   8303     case BUILTIN: return "BUILTIN";
   8304     case LOAD_IC: return "LOAD_IC";
   8305     case KEYED_LOAD_IC: return "KEYED_LOAD_IC";
   8306     case STORE_IC: return "STORE_IC";
   8307     case KEYED_STORE_IC: return "KEYED_STORE_IC";
   8308     case CALL_IC: return "CALL_IC";
   8309     case KEYED_CALL_IC: return "KEYED_CALL_IC";
   8310     case UNARY_OP_IC: return "UNARY_OP_IC";
   8311     case BINARY_OP_IC: return "BINARY_OP_IC";
   8312     case COMPARE_IC: return "COMPARE_IC";
   8313     case TO_BOOLEAN_IC: return "TO_BOOLEAN_IC";
   8314   }
   8315   UNREACHABLE();
   8316   return NULL;
   8317 }
   8318 
   8319 
   8320 const char* Code::ICState2String(InlineCacheState state) {
   8321   switch (state) {
   8322     case UNINITIALIZED: return "UNINITIALIZED";
   8323     case PREMONOMORPHIC: return "PREMONOMORPHIC";
   8324     case MONOMORPHIC: return "MONOMORPHIC";
   8325     case MONOMORPHIC_PROTOTYPE_FAILURE: return "MONOMORPHIC_PROTOTYPE_FAILURE";
   8326     case MEGAMORPHIC: return "MEGAMORPHIC";
   8327     case DEBUG_BREAK: return "DEBUG_BREAK";
   8328     case DEBUG_PREPARE_STEP_IN: return "DEBUG_PREPARE_STEP_IN";
   8329   }
   8330   UNREACHABLE();
   8331   return NULL;
   8332 }
   8333 
   8334 
   8335 const char* Code::PropertyType2String(PropertyType type) {
   8336   switch (type) {
   8337     case NORMAL: return "NORMAL";
   8338     case FIELD: return "FIELD";
   8339     case CONSTANT_FUNCTION: return "CONSTANT_FUNCTION";
   8340     case CALLBACKS: return "CALLBACKS";
   8341     case HANDLER: return "HANDLER";
   8342     case INTERCEPTOR: return "INTERCEPTOR";
   8343     case MAP_TRANSITION: return "MAP_TRANSITION";
   8344     case ELEMENTS_TRANSITION: return "ELEMENTS_TRANSITION";
   8345     case CONSTANT_TRANSITION: return "CONSTANT_TRANSITION";
   8346     case NULL_DESCRIPTOR: return "NULL_DESCRIPTOR";
   8347   }
   8348   UNREACHABLE();  // keep the compiler happy
   8349   return NULL;
   8350 }
   8351 
   8352 
   8353 void Code::PrintExtraICState(FILE* out, Kind kind, ExtraICState extra) {
   8354   const char* name = NULL;
   8355   switch (kind) {
   8356     case CALL_IC:
   8357       if (extra == STRING_INDEX_OUT_OF_BOUNDS) {
   8358         name = "STRING_INDEX_OUT_OF_BOUNDS";
   8359       }
   8360       break;
   8361     case STORE_IC:
   8362     case KEYED_STORE_IC:
   8363       if (extra == kStrictMode) {
   8364         name = "STRICT";
   8365       }
   8366       break;
   8367     default:
   8368       break;
   8369   }
   8370   if (name != NULL) {
   8371     PrintF(out, "extra_ic_state = %s\n", name);
   8372   } else {
   8373     PrintF(out, "extra_ic_state = %d\n", extra);
   8374   }
   8375 }
   8376 
   8377 
   8378 void Code::Disassemble(const char* name, FILE* out) {
   8379   PrintF(out, "kind = %s\n", Kind2String(kind()));
   8380   if (is_inline_cache_stub()) {
   8381     PrintF(out, "ic_state = %s\n", ICState2String(ic_state()));
   8382     PrintExtraICState(out, kind(), extra_ic_state());
   8383     if (ic_state() == MONOMORPHIC) {
   8384       PrintF(out, "type = %s\n", PropertyType2String(type()));
   8385     }
   8386     if (is_call_stub() || is_keyed_call_stub()) {
   8387       PrintF(out, "argc = %d\n", arguments_count());
   8388     }
   8389   }
   8390   if ((name != NULL) && (name[0] != '\0')) {
   8391     PrintF(out, "name = %s\n", name);
   8392   }
   8393   if (kind() == OPTIMIZED_FUNCTION) {
   8394     PrintF(out, "stack_slots = %d\n", stack_slots());
   8395   }
   8396 
   8397   PrintF(out, "Instructions (size = %d)\n", instruction_size());
   8398   Disassembler::Decode(out, this);
   8399   PrintF(out, "\n");
   8400 
   8401   if (kind() == FUNCTION) {
   8402     DeoptimizationOutputData* data =
   8403         DeoptimizationOutputData::cast(this->deoptimization_data());
   8404     data->DeoptimizationOutputDataPrint(out);
   8405   } else if (kind() == OPTIMIZED_FUNCTION) {
   8406     DeoptimizationInputData* data =
   8407         DeoptimizationInputData::cast(this->deoptimization_data());
   8408     data->DeoptimizationInputDataPrint(out);
   8409   }
   8410   PrintF("\n");
   8411 
   8412   if (kind() == OPTIMIZED_FUNCTION) {
   8413     SafepointTable table(this);
   8414     PrintF(out, "Safepoints (size = %u)\n", table.size());
   8415     for (unsigned i = 0; i < table.length(); i++) {
   8416       unsigned pc_offset = table.GetPcOffset(i);
   8417       PrintF(out, "%p  %4d  ", (instruction_start() + pc_offset), pc_offset);
   8418       table.PrintEntry(i);
   8419       PrintF(out, " (sp -> fp)");
   8420       SafepointEntry entry = table.GetEntry(i);
   8421       if (entry.deoptimization_index() != Safepoint::kNoDeoptimizationIndex) {
   8422         PrintF(out, "  %6d", entry.deoptimization_index());
   8423       } else {
   8424         PrintF(out, "  <none>");
   8425       }
   8426       if (entry.argument_count() > 0) {
   8427         PrintF(out, " argc: %d", entry.argument_count());
   8428       }
   8429       PrintF(out, "\n");
   8430     }
   8431     PrintF(out, "\n");
   8432   } else if (kind() == FUNCTION) {
   8433     unsigned offset = stack_check_table_offset();
   8434     // If there is no stack check table, the "table start" will at or after
   8435     // (due to alignment) the end of the instruction stream.
   8436     if (static_cast<int>(offset) < instruction_size()) {
   8437       unsigned* address =
   8438           reinterpret_cast<unsigned*>(instruction_start() + offset);
   8439       unsigned length = address[0];
   8440       PrintF(out, "Stack checks (size = %u)\n", length);
   8441       PrintF(out, "ast_id  pc_offset\n");
   8442       for (unsigned i = 0; i < length; ++i) {
   8443         unsigned index = (2 * i) + 1;
   8444         PrintF(out, "%6u  %9u\n", address[index], address[index + 1]);
   8445       }
   8446       PrintF(out, "\n");
   8447     }
   8448   }
   8449 
   8450   PrintF("RelocInfo (size = %d)\n", relocation_size());
   8451   for (RelocIterator it(this); !it.done(); it.next()) it.rinfo()->Print(out);
   8452   PrintF(out, "\n");
   8453 }
   8454 #endif  // ENABLE_DISASSEMBLER
   8455 
   8456 
   8457 MaybeObject* JSObject::SetFastElementsCapacityAndLength(
   8458     int capacity,
   8459     int length,
   8460     SetFastElementsCapacityMode set_capacity_mode) {
   8461   Heap* heap = GetHeap();
   8462   // We should never end in here with a pixel or external array.
   8463   ASSERT(!HasExternalArrayElements());
   8464 
   8465   // Allocate a new fast elements backing store.
   8466   FixedArray* new_elements;
   8467   { MaybeObject* maybe = heap->AllocateFixedArrayWithHoles(capacity);
   8468     if (!maybe->To(&new_elements)) return maybe;
   8469   }
   8470 
   8471   // Find the new map to use for this object if there is a map change.
   8472   Map* new_map = NULL;
   8473   if (elements()->map() != heap->non_strict_arguments_elements_map()) {
   8474     // The resized array has FAST_SMI_ONLY_ELEMENTS if the capacity mode forces
   8475     // it, or if it's allowed and the old elements array contained only SMIs.
   8476     bool has_fast_smi_only_elements =
   8477         (set_capacity_mode == kForceSmiOnlyElements) ||
   8478         ((set_capacity_mode == kAllowSmiOnlyElements) &&
   8479          (elements()->map()->has_fast_smi_only_elements() ||
   8480           elements() == heap->empty_fixed_array()));
   8481     ElementsKind elements_kind = has_fast_smi_only_elements
   8482         ? FAST_SMI_ONLY_ELEMENTS
   8483         : FAST_ELEMENTS;
   8484     MaybeObject* maybe = GetElementsTransitionMap(GetIsolate(), elements_kind);
   8485     if (!maybe->To(&new_map)) return maybe;
   8486   }
   8487 
   8488   FixedArrayBase* old_elements = elements();
   8489   ElementsKind elements_kind = GetElementsKind();
   8490   ElementsAccessor* accessor = ElementsAccessor::ForKind(elements_kind);
   8491   ElementsKind to_kind = (elements_kind == FAST_SMI_ONLY_ELEMENTS)
   8492       ? FAST_SMI_ONLY_ELEMENTS
   8493       : FAST_ELEMENTS;
   8494   //  int copy_size = Min(old_elements_raw->length(), new_elements->length());
   8495   accessor->CopyElements(this, new_elements, to_kind);
   8496   if (elements_kind != NON_STRICT_ARGUMENTS_ELEMENTS) {
   8497     set_map_and_elements(new_map, new_elements);
   8498   } else {
   8499     FixedArray* parameter_map = FixedArray::cast(old_elements);
   8500     parameter_map->set(1, new_elements);
   8501   }
   8502 
   8503   if (FLAG_trace_elements_transitions) {
   8504     PrintElementsTransition(stdout, elements_kind, old_elements,
   8505                             GetElementsKind(), new_elements);
   8506   }
   8507 
   8508   // Update the length if necessary.
   8509   if (IsJSArray()) {
   8510     JSArray::cast(this)->set_length(Smi::FromInt(length));
   8511   }
   8512 
   8513   return new_elements;
   8514 }
   8515 
   8516 
   8517 MaybeObject* JSObject::SetFastDoubleElementsCapacityAndLength(
   8518     int capacity,
   8519     int length) {
   8520   Heap* heap = GetHeap();
   8521   // We should never end in here with a pixel or external array.
   8522   ASSERT(!HasExternalArrayElements());
   8523 
   8524   FixedArrayBase* elems;
   8525   { MaybeObject* maybe_obj =
   8526         heap->AllocateUninitializedFixedDoubleArray(capacity);
   8527     if (!maybe_obj->To(&elems)) return maybe_obj;
   8528   }
   8529 
   8530   Map* new_map;
   8531   { MaybeObject* maybe_obj =
   8532         GetElementsTransitionMap(heap->isolate(), FAST_DOUBLE_ELEMENTS);
   8533     if (!maybe_obj->To(&new_map)) return maybe_obj;
   8534   }
   8535 
   8536   FixedArrayBase* old_elements = elements();
   8537   ElementsKind elements_kind = GetElementsKind();
   8538   ElementsAccessor* accessor = ElementsAccessor::ForKind(elements_kind);
   8539   accessor->CopyElements(this, elems, FAST_DOUBLE_ELEMENTS);
   8540   if (elements_kind != NON_STRICT_ARGUMENTS_ELEMENTS) {
   8541     set_map_and_elements(new_map, elems);
   8542   } else {
   8543     FixedArray* parameter_map = FixedArray::cast(old_elements);
   8544     parameter_map->set(1, elems);
   8545   }
   8546 
   8547   if (FLAG_trace_elements_transitions) {
   8548     PrintElementsTransition(stdout, elements_kind, old_elements,
   8549                             FAST_DOUBLE_ELEMENTS, elems);
   8550   }
   8551 
   8552   if (IsJSArray()) {
   8553     JSArray::cast(this)->set_length(Smi::FromInt(length));
   8554   }
   8555 
   8556   return this;
   8557 }
   8558 
   8559 
   8560 MaybeObject* JSArray::Initialize(int capacity) {
   8561   Heap* heap = GetHeap();
   8562   ASSERT(capacity >= 0);
   8563   set_length(Smi::FromInt(0));
   8564   FixedArray* new_elements;
   8565   if (capacity == 0) {
   8566     new_elements = heap->empty_fixed_array();
   8567   } else {
   8568     MaybeObject* maybe_obj = heap->AllocateFixedArrayWithHoles(capacity);
   8569     if (!maybe_obj->To(&new_elements)) return maybe_obj;
   8570   }
   8571   set_elements(new_elements);
   8572   return this;
   8573 }
   8574 
   8575 
   8576 void JSArray::Expand(int required_size) {
   8577   GetIsolate()->factory()->SetElementsCapacityAndLength(
   8578       Handle<JSArray>(this), required_size, required_size);
   8579 }
   8580 
   8581 
   8582 MaybeObject* JSArray::SetElementsLength(Object* len) {
   8583   // We should never end in here with a pixel or external array.
   8584   ASSERT(AllowsSetElementsLength());
   8585   return GetElementsAccessor()->SetLength(this, len);
   8586 }
   8587 
   8588 
   8589 Object* Map::GetPrototypeTransition(Object* prototype) {
   8590   FixedArray* cache = prototype_transitions();
   8591   int number_of_transitions = NumberOfProtoTransitions();
   8592   const int proto_offset =
   8593       kProtoTransitionHeaderSize + kProtoTransitionPrototypeOffset;
   8594   const int map_offset = kProtoTransitionHeaderSize + kProtoTransitionMapOffset;
   8595   const int step = kProtoTransitionElementsPerEntry;
   8596   for (int i = 0; i < number_of_transitions; i++) {
   8597     if (cache->get(proto_offset + i * step) == prototype) {
   8598       Object* map = cache->get(map_offset + i * step);
   8599       ASSERT(map->IsMap());
   8600       return map;
   8601     }
   8602   }
   8603   return NULL;
   8604 }
   8605 
   8606 
   8607 MaybeObject* Map::PutPrototypeTransition(Object* prototype, Map* map) {
   8608   ASSERT(map->IsMap());
   8609   ASSERT(HeapObject::cast(prototype)->map()->IsMap());
   8610   // Don't cache prototype transition if this map is shared.
   8611   if (is_shared() || !FLAG_cache_prototype_transitions) return this;
   8612 
   8613   FixedArray* cache = prototype_transitions();
   8614 
   8615   const int step = kProtoTransitionElementsPerEntry;
   8616   const int header = kProtoTransitionHeaderSize;
   8617 
   8618   int capacity = (cache->length() - header) / step;
   8619 
   8620   int transitions = NumberOfProtoTransitions() + 1;
   8621 
   8622   if (transitions > capacity) {
   8623     if (capacity > kMaxCachedPrototypeTransitions) return this;
   8624 
   8625     FixedArray* new_cache;
   8626     // Grow array by factor 2 over and above what we need.
   8627     { MaybeObject* maybe_cache =
   8628           GetHeap()->AllocateFixedArray(transitions * 2 * step + header);
   8629       if (!maybe_cache->To(&new_cache)) return maybe_cache;
   8630     }
   8631 
   8632     for (int i = 0; i < capacity * step; i++) {
   8633       new_cache->set(i + header, cache->get(i + header));
   8634     }
   8635     cache = new_cache;
   8636     set_prototype_transitions(cache);
   8637   }
   8638 
   8639   int last = transitions - 1;
   8640 
   8641   cache->set(header + last * step + kProtoTransitionPrototypeOffset, prototype);
   8642   cache->set(header + last * step + kProtoTransitionMapOffset, map);
   8643   SetNumberOfProtoTransitions(transitions);
   8644 
   8645   return cache;
   8646 }
   8647 
   8648 
   8649 MaybeObject* JSReceiver::SetPrototype(Object* value,
   8650                                       bool skip_hidden_prototypes) {
   8651 #ifdef DEBUG
   8652   int size = Size();
   8653 #endif
   8654 
   8655   Heap* heap = GetHeap();
   8656   // Silently ignore the change if value is not a JSObject or null.
   8657   // SpiderMonkey behaves this way.
   8658   if (!value->IsJSReceiver() && !value->IsNull()) return value;
   8659 
   8660   // From 8.6.2 Object Internal Methods
   8661   // ...
   8662   // In addition, if [[Extensible]] is false the value of the [[Class]] and
   8663   // [[Prototype]] internal properties of the object may not be modified.
   8664   // ...
   8665   // Implementation specific extensions that modify [[Class]], [[Prototype]]
   8666   // or [[Extensible]] must not violate the invariants defined in the preceding
   8667   // paragraph.
   8668   if (!this->map()->is_extensible()) {
   8669     HandleScope scope(heap->isolate());
   8670     Handle<Object> handle(this, heap->isolate());
   8671     return heap->isolate()->Throw(
   8672         *FACTORY->NewTypeError("non_extensible_proto",
   8673                                HandleVector<Object>(&handle, 1)));
   8674   }
   8675 
   8676   // Before we can set the prototype we need to be sure
   8677   // prototype cycles are prevented.
   8678   // It is sufficient to validate that the receiver is not in the new prototype
   8679   // chain.
   8680   for (Object* pt = value; pt != heap->null_value(); pt = pt->GetPrototype()) {
   8681     if (JSReceiver::cast(pt) == this) {
   8682       // Cycle detected.
   8683       HandleScope scope(heap->isolate());
   8684       return heap->isolate()->Throw(
   8685           *FACTORY->NewError("cyclic_proto", HandleVector<Object>(NULL, 0)));
   8686     }
   8687   }
   8688 
   8689   JSReceiver* real_receiver = this;
   8690 
   8691   if (skip_hidden_prototypes) {
   8692     // Find the first object in the chain whose prototype object is not
   8693     // hidden and set the new prototype on that object.
   8694     Object* current_proto = real_receiver->GetPrototype();
   8695     while (current_proto->IsJSObject() &&
   8696           JSReceiver::cast(current_proto)->map()->is_hidden_prototype()) {
   8697       real_receiver = JSReceiver::cast(current_proto);
   8698       current_proto = current_proto->GetPrototype();
   8699     }
   8700   }
   8701 
   8702   // Set the new prototype of the object.
   8703   Map* map = real_receiver->map();
   8704 
   8705   // Nothing to do if prototype is already set.
   8706   if (map->prototype() == value) return value;
   8707 
   8708   Object* new_map = map->GetPrototypeTransition(value);
   8709   if (new_map == NULL) {
   8710     { MaybeObject* maybe_new_map = map->CopyDropTransitions();
   8711       if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
   8712     }
   8713 
   8714     { MaybeObject* maybe_new_cache =
   8715           map->PutPrototypeTransition(value, Map::cast(new_map));
   8716       if (maybe_new_cache->IsFailure()) return maybe_new_cache;
   8717     }
   8718 
   8719     Map::cast(new_map)->set_prototype(value);
   8720   }
   8721   ASSERT(Map::cast(new_map)->prototype() == value);
   8722   real_receiver->set_map(Map::cast(new_map));
   8723 
   8724   heap->ClearInstanceofCache();
   8725   ASSERT(size == Size());
   8726   return value;
   8727 }
   8728 
   8729 
   8730 MaybeObject* JSObject::EnsureCanContainElements(Arguments* args,
   8731                                                 uint32_t first_arg,
   8732                                                 uint32_t arg_count,
   8733                                                 EnsureElementsMode mode) {
   8734   // Elements in |Arguments| are ordered backwards (because they're on the
   8735   // stack), but the method that's called here iterates over them in forward
   8736   // direction.
   8737   return EnsureCanContainElements(
   8738       args->arguments() - first_arg - (arg_count - 1),
   8739       arg_count, mode);
   8740 }
   8741 
   8742 
   8743 bool JSObject::HasElementWithInterceptor(JSReceiver* receiver, uint32_t index) {
   8744   Isolate* isolate = GetIsolate();
   8745   // Make sure that the top context does not change when doing
   8746   // callbacks or interceptor calls.
   8747   AssertNoContextChange ncc;
   8748   HandleScope scope(isolate);
   8749   Handle<InterceptorInfo> interceptor(GetIndexedInterceptor());
   8750   Handle<JSReceiver> receiver_handle(receiver);
   8751   Handle<JSObject> holder_handle(this);
   8752   CustomArguments args(isolate, interceptor->data(), receiver, this);
   8753   v8::AccessorInfo info(args.end());
   8754   if (!interceptor->query()->IsUndefined()) {
   8755     v8::IndexedPropertyQuery query =
   8756         v8::ToCData<v8::IndexedPropertyQuery>(interceptor->query());
   8757     LOG(isolate,
   8758         ApiIndexedPropertyAccess("interceptor-indexed-has", this, index));
   8759     v8::Handle<v8::Integer> result;
   8760     {
   8761       // Leaving JavaScript.
   8762       VMState state(isolate, EXTERNAL);
   8763       result = query(index, info);
   8764     }
   8765     if (!result.IsEmpty()) {
   8766       ASSERT(result->IsInt32());
   8767       return true;  // absence of property is signaled by empty handle.
   8768     }
   8769   } else if (!interceptor->getter()->IsUndefined()) {
   8770     v8::IndexedPropertyGetter getter =
   8771         v8::ToCData<v8::IndexedPropertyGetter>(interceptor->getter());
   8772     LOG(isolate,
   8773         ApiIndexedPropertyAccess("interceptor-indexed-has-get", this, index));
   8774     v8::Handle<v8::Value> result;
   8775     {
   8776       // Leaving JavaScript.
   8777       VMState state(isolate, EXTERNAL);
   8778       result = getter(index, info);
   8779     }
   8780     if (!result.IsEmpty()) return true;
   8781   }
   8782 
   8783   if (holder_handle->GetElementsAccessor()->HasElement(
   8784           *receiver_handle, *holder_handle, index)) {
   8785     return true;
   8786   }
   8787 
   8788   if (holder_handle->IsStringObjectWithCharacterAt(index)) return true;
   8789   Object* pt = holder_handle->GetPrototype();
   8790   if (pt->IsJSProxy()) {
   8791     // We need to follow the spec and simulate a call to [[GetOwnProperty]].
   8792     return JSProxy::cast(pt)->GetElementAttributeWithHandler(
   8793         receiver, index) != ABSENT;
   8794   }
   8795   if (pt->IsNull()) return false;
   8796   return JSObject::cast(pt)->HasElementWithReceiver(*receiver_handle, index);
   8797 }
   8798 
   8799 
   8800 JSObject::LocalElementType JSObject::HasLocalElement(uint32_t index) {
   8801   // Check access rights if needed.
   8802   if (IsAccessCheckNeeded()) {
   8803     Heap* heap = GetHeap();
   8804     if (!heap->isolate()->MayIndexedAccess(this, index, v8::ACCESS_HAS)) {
   8805       heap->isolate()->ReportFailedAccessCheck(this, v8::ACCESS_HAS);
   8806       return UNDEFINED_ELEMENT;
   8807     }
   8808   }
   8809 
   8810   if (IsJSGlobalProxy()) {
   8811     Object* proto = GetPrototype();
   8812     if (proto->IsNull()) return UNDEFINED_ELEMENT;
   8813     ASSERT(proto->IsJSGlobalObject());
   8814     return JSObject::cast(proto)->HasLocalElement(index);
   8815   }
   8816 
   8817   // Check for lookup interceptor
   8818   if (HasIndexedInterceptor()) {
   8819     return HasElementWithInterceptor(this, index) ? INTERCEPTED_ELEMENT
   8820                                                   : UNDEFINED_ELEMENT;
   8821   }
   8822 
   8823   // Handle [] on String objects.
   8824   if (this->IsStringObjectWithCharacterAt(index)) {
   8825     return STRING_CHARACTER_ELEMENT;
   8826   }
   8827 
   8828   switch (GetElementsKind()) {
   8829     case FAST_SMI_ONLY_ELEMENTS:
   8830     case FAST_ELEMENTS: {
   8831       uint32_t length = IsJSArray() ?
   8832           static_cast<uint32_t>
   8833               (Smi::cast(JSArray::cast(this)->length())->value()) :
   8834           static_cast<uint32_t>(FixedArray::cast(elements())->length());
   8835       if ((index < length) &&
   8836           !FixedArray::cast(elements())->get(index)->IsTheHole()) {
   8837         return FAST_ELEMENT;
   8838       }
   8839       break;
   8840     }
   8841     case FAST_DOUBLE_ELEMENTS: {
   8842       uint32_t length = IsJSArray() ?
   8843           static_cast<uint32_t>
   8844               (Smi::cast(JSArray::cast(this)->length())->value()) :
   8845           static_cast<uint32_t>(FixedDoubleArray::cast(elements())->length());
   8846       if ((index < length) &&
   8847           !FixedDoubleArray::cast(elements())->is_the_hole(index)) {
   8848         return FAST_ELEMENT;
   8849       }
   8850       break;
   8851     }
   8852     case EXTERNAL_PIXEL_ELEMENTS: {
   8853       ExternalPixelArray* pixels = ExternalPixelArray::cast(elements());
   8854       if (index < static_cast<uint32_t>(pixels->length())) return FAST_ELEMENT;
   8855       break;
   8856     }
   8857     case EXTERNAL_BYTE_ELEMENTS:
   8858     case EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
   8859     case EXTERNAL_SHORT_ELEMENTS:
   8860     case EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
   8861     case EXTERNAL_INT_ELEMENTS:
   8862     case EXTERNAL_UNSIGNED_INT_ELEMENTS:
   8863     case EXTERNAL_FLOAT_ELEMENTS:
   8864     case EXTERNAL_DOUBLE_ELEMENTS: {
   8865       ExternalArray* array = ExternalArray::cast(elements());
   8866       if (index < static_cast<uint32_t>(array->length())) return FAST_ELEMENT;
   8867       break;
   8868     }
   8869     case DICTIONARY_ELEMENTS: {
   8870       if (element_dictionary()->FindEntry(index) !=
   8871           SeededNumberDictionary::kNotFound) {
   8872         return DICTIONARY_ELEMENT;
   8873       }
   8874       break;
   8875     }
   8876     case NON_STRICT_ARGUMENTS_ELEMENTS: {
   8877       // Aliased parameters and non-aliased elements in a fast backing store
   8878       // behave as FAST_ELEMENT.  Non-aliased elements in a dictionary
   8879       // backing store behave as DICTIONARY_ELEMENT.
   8880       FixedArray* parameter_map = FixedArray::cast(elements());
   8881       uint32_t length = parameter_map->length();
   8882       Object* probe =
   8883           index < (length - 2) ? parameter_map->get(index + 2) : NULL;
   8884       if (probe != NULL && !probe->IsTheHole()) return FAST_ELEMENT;
   8885       // If not aliased, check the arguments.
   8886       FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
   8887       if (arguments->IsDictionary()) {
   8888         SeededNumberDictionary* dictionary =
   8889             SeededNumberDictionary::cast(arguments);
   8890         if (dictionary->FindEntry(index) != SeededNumberDictionary::kNotFound) {
   8891           return DICTIONARY_ELEMENT;
   8892         }
   8893       } else {
   8894         length = arguments->length();
   8895         probe = (index < length) ? arguments->get(index) : NULL;
   8896         if (probe != NULL && !probe->IsTheHole()) return FAST_ELEMENT;
   8897       }
   8898       break;
   8899     }
   8900   }
   8901 
   8902   return UNDEFINED_ELEMENT;
   8903 }
   8904 
   8905 
   8906 bool JSObject::HasElementWithReceiver(JSReceiver* receiver, uint32_t index) {
   8907   // Check access rights if needed.
   8908   if (IsAccessCheckNeeded()) {
   8909     Heap* heap = GetHeap();
   8910     if (!heap->isolate()->MayIndexedAccess(this, index, v8::ACCESS_HAS)) {
   8911       heap->isolate()->ReportFailedAccessCheck(this, v8::ACCESS_HAS);
   8912       return false;
   8913     }
   8914   }
   8915 
   8916   // Check for lookup interceptor
   8917   if (HasIndexedInterceptor()) {
   8918     return HasElementWithInterceptor(receiver, index);
   8919   }
   8920 
   8921   ElementsAccessor* accessor = GetElementsAccessor();
   8922   if (accessor->HasElement(receiver, this, index)) {
   8923     return true;
   8924   }
   8925 
   8926   // Handle [] on String objects.
   8927   if (this->IsStringObjectWithCharacterAt(index)) return true;
   8928 
   8929   Object* pt = GetPrototype();
   8930   if (pt->IsNull()) return false;
   8931   if (pt->IsJSProxy()) {
   8932     // We need to follow the spec and simulate a call to [[GetOwnProperty]].
   8933     return JSProxy::cast(pt)->GetElementAttributeWithHandler(
   8934         receiver, index) != ABSENT;
   8935   }
   8936   return JSObject::cast(pt)->HasElementWithReceiver(receiver, index);
   8937 }
   8938 
   8939 
   8940 MaybeObject* JSObject::SetElementWithInterceptor(uint32_t index,
   8941                                                  Object* value,
   8942                                                  PropertyAttributes attributes,
   8943                                                  StrictModeFlag strict_mode,
   8944                                                  bool check_prototype,
   8945                                                  SetPropertyMode set_mode) {
   8946   Isolate* isolate = GetIsolate();
   8947   // Make sure that the top context does not change when doing
   8948   // callbacks or interceptor calls.
   8949   AssertNoContextChange ncc;
   8950   HandleScope scope(isolate);
   8951   Handle<InterceptorInfo> interceptor(GetIndexedInterceptor());
   8952   Handle<JSObject> this_handle(this);
   8953   Handle<Object> value_handle(value, isolate);
   8954   if (!interceptor->setter()->IsUndefined()) {
   8955     v8::IndexedPropertySetter setter =
   8956         v8::ToCData<v8::IndexedPropertySetter>(interceptor->setter());
   8957     LOG(isolate,
   8958         ApiIndexedPropertyAccess("interceptor-indexed-set", this, index));
   8959     CustomArguments args(isolate, interceptor->data(), this, this);
   8960     v8::AccessorInfo info(args.end());
   8961     v8::Handle<v8::Value> result;
   8962     {
   8963       // Leaving JavaScript.
   8964       VMState state(isolate, EXTERNAL);
   8965       result = setter(index, v8::Utils::ToLocal(value_handle), info);
   8966     }
   8967     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   8968     if (!result.IsEmpty()) return *value_handle;
   8969   }
   8970   MaybeObject* raw_result =
   8971       this_handle->SetElementWithoutInterceptor(index,
   8972                                                 *value_handle,
   8973                                                 attributes,
   8974                                                 strict_mode,
   8975                                                 check_prototype,
   8976                                                 set_mode);
   8977   RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   8978   return raw_result;
   8979 }
   8980 
   8981 
   8982 MaybeObject* JSObject::GetElementWithCallback(Object* receiver,
   8983                                               Object* structure,
   8984                                               uint32_t index,
   8985                                               Object* holder) {
   8986   Isolate* isolate = GetIsolate();
   8987   ASSERT(!structure->IsForeign());
   8988 
   8989   // api style callbacks.
   8990   if (structure->IsAccessorInfo()) {
   8991     Handle<AccessorInfo> data(AccessorInfo::cast(structure));
   8992     Object* fun_obj = data->getter();
   8993     v8::AccessorGetter call_fun = v8::ToCData<v8::AccessorGetter>(fun_obj);
   8994     HandleScope scope(isolate);
   8995     Handle<JSObject> self(JSObject::cast(receiver));
   8996     Handle<JSObject> holder_handle(JSObject::cast(holder));
   8997     Handle<Object> number = isolate->factory()->NewNumberFromUint(index);
   8998     Handle<String> key = isolate->factory()->NumberToString(number);
   8999     LOG(isolate, ApiNamedPropertyAccess("load", *self, *key));
   9000     CustomArguments args(isolate, data->data(), *self, *holder_handle);
   9001     v8::AccessorInfo info(args.end());
   9002     v8::Handle<v8::Value> result;
   9003     {
   9004       // Leaving JavaScript.
   9005       VMState state(isolate, EXTERNAL);
   9006       result = call_fun(v8::Utils::ToLocal(key), info);
   9007     }
   9008     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   9009     if (result.IsEmpty()) return isolate->heap()->undefined_value();
   9010     return *v8::Utils::OpenHandle(*result);
   9011   }
   9012 
   9013   // __defineGetter__ callback
   9014   if (structure->IsAccessorPair()) {
   9015     Object* getter = AccessorPair::cast(structure)->getter();
   9016     if (getter->IsSpecFunction()) {
   9017       // TODO(rossberg): nicer would be to cast to some JSCallable here...
   9018       return GetPropertyWithDefinedGetter(receiver, JSReceiver::cast(getter));
   9019     }
   9020     // Getter is not a function.
   9021     return isolate->heap()->undefined_value();
   9022   }
   9023 
   9024   UNREACHABLE();
   9025   return NULL;
   9026 }
   9027 
   9028 
   9029 MaybeObject* JSObject::SetElementWithCallback(Object* structure,
   9030                                               uint32_t index,
   9031                                               Object* value,
   9032                                               JSObject* holder,
   9033                                               StrictModeFlag strict_mode) {
   9034   Isolate* isolate = GetIsolate();
   9035   HandleScope scope(isolate);
   9036 
   9037   // We should never get here to initialize a const with the hole
   9038   // value since a const declaration would conflict with the setter.
   9039   ASSERT(!value->IsTheHole());
   9040   Handle<Object> value_handle(value, isolate);
   9041 
   9042   // To accommodate both the old and the new api we switch on the
   9043   // data structure used to store the callbacks.  Eventually foreign
   9044   // callbacks should be phased out.
   9045   ASSERT(!structure->IsForeign());
   9046 
   9047   if (structure->IsAccessorInfo()) {
   9048     // api style callbacks
   9049     Handle<JSObject> self(this);
   9050     Handle<JSObject> holder_handle(JSObject::cast(holder));
   9051     Handle<AccessorInfo> data(AccessorInfo::cast(structure));
   9052     Object* call_obj = data->setter();
   9053     v8::AccessorSetter call_fun = v8::ToCData<v8::AccessorSetter>(call_obj);
   9054     if (call_fun == NULL) return value;
   9055     Handle<Object> number = isolate->factory()->NewNumberFromUint(index);
   9056     Handle<String> key(isolate->factory()->NumberToString(number));
   9057     LOG(isolate, ApiNamedPropertyAccess("store", *self, *key));
   9058     CustomArguments args(isolate, data->data(), *self, *holder_handle);
   9059     v8::AccessorInfo info(args.end());
   9060     {
   9061       // Leaving JavaScript.
   9062       VMState state(isolate, EXTERNAL);
   9063       call_fun(v8::Utils::ToLocal(key),
   9064                v8::Utils::ToLocal(value_handle),
   9065                info);
   9066     }
   9067     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   9068     return *value_handle;
   9069   }
   9070 
   9071   if (structure->IsAccessorPair()) {
   9072     Handle<Object> setter(AccessorPair::cast(structure)->setter());
   9073     if (setter->IsSpecFunction()) {
   9074       // TODO(rossberg): nicer would be to cast to some JSCallable here...
   9075       return SetPropertyWithDefinedSetter(JSReceiver::cast(*setter), value);
   9076     } else {
   9077       if (strict_mode == kNonStrictMode) {
   9078         return value;
   9079       }
   9080       Handle<Object> holder_handle(holder, isolate);
   9081       Handle<Object> key(isolate->factory()->NewNumberFromUint(index));
   9082       Handle<Object> args[2] = { key, holder_handle };
   9083       return isolate->Throw(
   9084           *isolate->factory()->NewTypeError("no_setter_in_callback",
   9085                                             HandleVector(args, 2)));
   9086     }
   9087   }
   9088 
   9089   UNREACHABLE();
   9090   return NULL;
   9091 }
   9092 
   9093 
   9094 bool JSObject::HasFastArgumentsElements() {
   9095   Heap* heap = GetHeap();
   9096   if (!elements()->IsFixedArray()) return false;
   9097   FixedArray* elements = FixedArray::cast(this->elements());
   9098   if (elements->map() != heap->non_strict_arguments_elements_map()) {
   9099     return false;
   9100   }
   9101   FixedArray* arguments = FixedArray::cast(elements->get(1));
   9102   return !arguments->IsDictionary();
   9103 }
   9104 
   9105 
   9106 bool JSObject::HasDictionaryArgumentsElements() {
   9107   Heap* heap = GetHeap();
   9108   if (!elements()->IsFixedArray()) return false;
   9109   FixedArray* elements = FixedArray::cast(this->elements());
   9110   if (elements->map() != heap->non_strict_arguments_elements_map()) {
   9111     return false;
   9112   }
   9113   FixedArray* arguments = FixedArray::cast(elements->get(1));
   9114   return arguments->IsDictionary();
   9115 }
   9116 
   9117 
   9118 // Adding n elements in fast case is O(n*n).
   9119 // Note: revisit design to have dual undefined values to capture absent
   9120 // elements.
   9121 MaybeObject* JSObject::SetFastElement(uint32_t index,
   9122                                       Object* value,
   9123                                       StrictModeFlag strict_mode,
   9124                                       bool check_prototype) {
   9125   ASSERT(HasFastTypeElements() ||
   9126          HasFastArgumentsElements());
   9127 
   9128   FixedArray* backing_store = FixedArray::cast(elements());
   9129   if (backing_store->map() == GetHeap()->non_strict_arguments_elements_map()) {
   9130     backing_store = FixedArray::cast(backing_store->get(1));
   9131   } else {
   9132     MaybeObject* maybe = EnsureWritableFastElements();
   9133     if (!maybe->To(&backing_store)) return maybe;
   9134   }
   9135   uint32_t capacity = static_cast<uint32_t>(backing_store->length());
   9136 
   9137   if (check_prototype &&
   9138       (index >= capacity || backing_store->get(index)->IsTheHole())) {
   9139     bool found;
   9140     MaybeObject* result = SetElementWithCallbackSetterInPrototypes(index,
   9141                                                                    value,
   9142                                                                    &found,
   9143                                                                    strict_mode);
   9144     if (found) return result;
   9145   }
   9146 
   9147   uint32_t new_capacity = capacity;
   9148   // Check if the length property of this object needs to be updated.
   9149   uint32_t array_length = 0;
   9150   bool must_update_array_length = false;
   9151   if (IsJSArray()) {
   9152     CHECK(JSArray::cast(this)->length()->ToArrayIndex(&array_length));
   9153     if (index >= array_length) {
   9154       must_update_array_length = true;
   9155       array_length = index + 1;
   9156     }
   9157   }
   9158   // Check if the capacity of the backing store needs to be increased, or if
   9159   // a transition to slow elements is necessary.
   9160   if (index >= capacity) {
   9161     bool convert_to_slow = true;
   9162     if ((index - capacity) < kMaxGap) {
   9163       new_capacity = NewElementsCapacity(index + 1);
   9164       ASSERT(new_capacity > index);
   9165       if (!ShouldConvertToSlowElements(new_capacity)) {
   9166         convert_to_slow = false;
   9167       }
   9168     }
   9169     if (convert_to_slow) {
   9170       MaybeObject* result = NormalizeElements();
   9171       if (result->IsFailure()) return result;
   9172       return SetDictionaryElement(index, value, NONE, strict_mode,
   9173                                   check_prototype);
   9174     }
   9175   }
   9176   // Convert to fast double elements if appropriate.
   9177   if (HasFastSmiOnlyElements() && !value->IsSmi() && value->IsNumber()) {
   9178     MaybeObject* maybe =
   9179         SetFastDoubleElementsCapacityAndLength(new_capacity, array_length);
   9180     if (maybe->IsFailure()) return maybe;
   9181     FixedDoubleArray::cast(elements())->set(index, value->Number());
   9182     return value;
   9183   }
   9184   // Change elements kind from SMI_ONLY to generic FAST if necessary.
   9185   if (HasFastSmiOnlyElements() && !value->IsSmi()) {
   9186     Map* new_map;
   9187     { MaybeObject* maybe_new_map = GetElementsTransitionMap(GetIsolate(),
   9188                                                             FAST_ELEMENTS);
   9189       if (!maybe_new_map->To(&new_map)) return maybe_new_map;
   9190     }
   9191     set_map(new_map);
   9192     if (FLAG_trace_elements_transitions) {
   9193       PrintElementsTransition(stdout, FAST_SMI_ONLY_ELEMENTS, elements(),
   9194                               FAST_ELEMENTS, elements());
   9195     }
   9196   }
   9197   // Increase backing store capacity if that's been decided previously.
   9198   if (new_capacity != capacity) {
   9199     FixedArray* new_elements;
   9200     SetFastElementsCapacityMode set_capacity_mode =
   9201         value->IsSmi() && HasFastSmiOnlyElements()
   9202             ? kAllowSmiOnlyElements
   9203             : kDontAllowSmiOnlyElements;
   9204     { MaybeObject* maybe =
   9205           SetFastElementsCapacityAndLength(new_capacity,
   9206                                            array_length,
   9207                                            set_capacity_mode);
   9208       if (!maybe->To(&new_elements)) return maybe;
   9209     }
   9210     new_elements->set(index, value);
   9211     return value;
   9212   }
   9213   // Finally, set the new element and length.
   9214   ASSERT(elements()->IsFixedArray());
   9215   backing_store->set(index, value);
   9216   if (must_update_array_length) {
   9217     JSArray::cast(this)->set_length(Smi::FromInt(array_length));
   9218   }
   9219   return value;
   9220 }
   9221 
   9222 
   9223 MaybeObject* JSObject::SetDictionaryElement(uint32_t index,
   9224                                             Object* value,
   9225                                             PropertyAttributes attributes,
   9226                                             StrictModeFlag strict_mode,
   9227                                             bool check_prototype,
   9228                                             SetPropertyMode set_mode) {
   9229   ASSERT(HasDictionaryElements() || HasDictionaryArgumentsElements());
   9230   Isolate* isolate = GetIsolate();
   9231   Heap* heap = isolate->heap();
   9232 
   9233   // Insert element in the dictionary.
   9234   FixedArray* elements = FixedArray::cast(this->elements());
   9235   bool is_arguments =
   9236       (elements->map() == heap->non_strict_arguments_elements_map());
   9237   SeededNumberDictionary* dictionary = NULL;
   9238   if (is_arguments) {
   9239     dictionary = SeededNumberDictionary::cast(elements->get(1));
   9240   } else {
   9241     dictionary = SeededNumberDictionary::cast(elements);
   9242   }
   9243 
   9244   int entry = dictionary->FindEntry(index);
   9245   if (entry != SeededNumberDictionary::kNotFound) {
   9246     Object* element = dictionary->ValueAt(entry);
   9247     PropertyDetails details = dictionary->DetailsAt(entry);
   9248     if (details.type() == CALLBACKS && set_mode == SET_PROPERTY) {
   9249       return SetElementWithCallback(element, index, value, this, strict_mode);
   9250     } else {
   9251       dictionary->UpdateMaxNumberKey(index);
   9252       // If a value has not been initialized we allow writing to it even if it
   9253       // is read-only (a declared const that has not been initialized).  If a
   9254       // value is being defined we skip attribute checks completely.
   9255       if (set_mode == DEFINE_PROPERTY) {
   9256         details = PropertyDetails(attributes, NORMAL, details.index());
   9257         dictionary->DetailsAtPut(entry, details);
   9258       } else if (details.IsReadOnly() && !element->IsTheHole()) {
   9259         if (strict_mode == kNonStrictMode) {
   9260           return isolate->heap()->undefined_value();
   9261         } else {
   9262           Handle<Object> holder(this);
   9263           Handle<Object> number = isolate->factory()->NewNumberFromUint(index);
   9264           Handle<Object> args[2] = { number, holder };
   9265           Handle<Object> error =
   9266               isolate->factory()->NewTypeError("strict_read_only_property",
   9267                                                HandleVector(args, 2));
   9268           return isolate->Throw(*error);
   9269         }
   9270       }
   9271       // Elements of the arguments object in slow mode might be slow aliases.
   9272       if (is_arguments && element->IsAliasedArgumentsEntry()) {
   9273         AliasedArgumentsEntry* entry = AliasedArgumentsEntry::cast(element);
   9274         Context* context = Context::cast(elements->get(0));
   9275         int context_index = entry->aliased_context_slot();
   9276         ASSERT(!context->get(context_index)->IsTheHole());
   9277         context->set(context_index, value);
   9278         // For elements that are still writable we keep slow aliasing.
   9279         if (!details.IsReadOnly()) value = element;
   9280       }
   9281       dictionary->ValueAtPut(entry, value);
   9282     }
   9283   } else {
   9284     // Index not already used. Look for an accessor in the prototype chain.
   9285     if (check_prototype) {
   9286       bool found;
   9287       MaybeObject* result =
   9288           SetElementWithCallbackSetterInPrototypes(
   9289               index, value, &found, strict_mode);
   9290       if (found) return result;
   9291     }
   9292     // When we set the is_extensible flag to false we always force the
   9293     // element into dictionary mode (and force them to stay there).
   9294     if (!map()->is_extensible()) {
   9295       if (strict_mode == kNonStrictMode) {
   9296         return isolate->heap()->undefined_value();
   9297       } else {
   9298         Handle<Object> number = isolate->factory()->NewNumberFromUint(index);
   9299         Handle<String> name = isolate->factory()->NumberToString(number);
   9300         Handle<Object> args[1] = { name };
   9301         Handle<Object> error =
   9302             isolate->factory()->NewTypeError("object_not_extensible",
   9303                                              HandleVector(args, 1));
   9304         return isolate->Throw(*error);
   9305       }
   9306     }
   9307     FixedArrayBase* new_dictionary;
   9308     PropertyDetails details = PropertyDetails(attributes, NORMAL);
   9309     MaybeObject* maybe = dictionary->AddNumberEntry(index, value, details);
   9310     if (!maybe->To(&new_dictionary)) return maybe;
   9311     if (dictionary != SeededNumberDictionary::cast(new_dictionary)) {
   9312       if (is_arguments) {
   9313         elements->set(1, new_dictionary);
   9314       } else {
   9315         set_elements(new_dictionary);
   9316       }
   9317       dictionary = SeededNumberDictionary::cast(new_dictionary);
   9318     }
   9319   }
   9320 
   9321   // Update the array length if this JSObject is an array.
   9322   if (IsJSArray()) {
   9323     MaybeObject* result =
   9324         JSArray::cast(this)->JSArrayUpdateLengthFromIndex(index, value);
   9325     if (result->IsFailure()) return result;
   9326   }
   9327 
   9328   // Attempt to put this object back in fast case.
   9329   if (ShouldConvertToFastElements()) {
   9330     uint32_t new_length = 0;
   9331     if (IsJSArray()) {
   9332       CHECK(JSArray::cast(this)->length()->ToArrayIndex(&new_length));
   9333     } else {
   9334       new_length = dictionary->max_number_key() + 1;
   9335     }
   9336     SetFastElementsCapacityMode set_capacity_mode = FLAG_smi_only_arrays
   9337         ? kAllowSmiOnlyElements
   9338         : kDontAllowSmiOnlyElements;
   9339     bool has_smi_only_elements = false;
   9340     bool should_convert_to_fast_double_elements =
   9341         ShouldConvertToFastDoubleElements(&has_smi_only_elements);
   9342     if (has_smi_only_elements) {
   9343       set_capacity_mode = kForceSmiOnlyElements;
   9344     }
   9345     MaybeObject* result = should_convert_to_fast_double_elements
   9346         ? SetFastDoubleElementsCapacityAndLength(new_length, new_length)
   9347         : SetFastElementsCapacityAndLength(new_length,
   9348                                            new_length,
   9349                                            set_capacity_mode);
   9350     if (result->IsFailure()) return result;
   9351 #ifdef DEBUG
   9352     if (FLAG_trace_normalization) {
   9353       PrintF("Object elements are fast case again:\n");
   9354       Print();
   9355     }
   9356 #endif
   9357   }
   9358   return value;
   9359 }
   9360 
   9361 
   9362 MUST_USE_RESULT MaybeObject* JSObject::SetFastDoubleElement(
   9363     uint32_t index,
   9364     Object* value,
   9365     StrictModeFlag strict_mode,
   9366     bool check_prototype) {
   9367   ASSERT(HasFastDoubleElements());
   9368 
   9369   FixedArrayBase* base_elms = FixedArrayBase::cast(elements());
   9370   uint32_t elms_length = static_cast<uint32_t>(base_elms->length());
   9371 
   9372   // If storing to an element that isn't in the array, pass the store request
   9373   // up the prototype chain before storing in the receiver's elements.
   9374   if (check_prototype &&
   9375       (index >= elms_length ||
   9376        FixedDoubleArray::cast(base_elms)->is_the_hole(index))) {
   9377     bool found;
   9378     MaybeObject* result = SetElementWithCallbackSetterInPrototypes(index,
   9379                                                                    value,
   9380                                                                    &found,
   9381                                                                    strict_mode);
   9382     if (found) return result;
   9383   }
   9384 
   9385   // If the value object is not a heap number, switch to fast elements and try
   9386   // again.
   9387   bool value_is_smi = value->IsSmi();
   9388   if (!value->IsNumber()) {
   9389     Object* obj;
   9390     uint32_t length = elms_length;
   9391     if (IsJSArray()) {
   9392       CHECK(JSArray::cast(this)->length()->ToArrayIndex(&length));
   9393     }
   9394     MaybeObject* maybe_obj = SetFastElementsCapacityAndLength(
   9395         elms_length,
   9396         length,
   9397         kDontAllowSmiOnlyElements);
   9398     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   9399     return SetFastElement(index,
   9400                           value,
   9401                           strict_mode,
   9402                           check_prototype);
   9403   }
   9404 
   9405   double double_value = value_is_smi
   9406       ? static_cast<double>(Smi::cast(value)->value())
   9407       : HeapNumber::cast(value)->value();
   9408 
   9409   // Check whether there is extra space in the fixed array.
   9410   if (index < elms_length) {
   9411     FixedDoubleArray* elms = FixedDoubleArray::cast(elements());
   9412     elms->set(index, double_value);
   9413     if (IsJSArray()) {
   9414       // Update the length of the array if needed.
   9415       uint32_t array_length = 0;
   9416       CHECK(JSArray::cast(this)->length()->ToArrayIndex(&array_length));
   9417       if (index >= array_length) {
   9418         JSArray::cast(this)->set_length(Smi::FromInt(index + 1));
   9419       }
   9420     }
   9421     return value;
   9422   }
   9423 
   9424   // Allow gap in fast case.
   9425   if ((index - elms_length) < kMaxGap) {
   9426     // Try allocating extra space.
   9427     int new_capacity = NewElementsCapacity(index+1);
   9428     if (!ShouldConvertToSlowElements(new_capacity)) {
   9429       ASSERT(static_cast<uint32_t>(new_capacity) > index);
   9430       Object* obj;
   9431       { MaybeObject* maybe_obj =
   9432             SetFastDoubleElementsCapacityAndLength(new_capacity,
   9433                                                    index + 1);
   9434         if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   9435       }
   9436       FixedDoubleArray::cast(elements())->set(index, double_value);
   9437       return value;
   9438     }
   9439   }
   9440 
   9441   // Otherwise default to slow case.
   9442   ASSERT(HasFastDoubleElements());
   9443   ASSERT(map()->has_fast_double_elements());
   9444   ASSERT(elements()->IsFixedDoubleArray());
   9445   Object* obj;
   9446   { MaybeObject* maybe_obj = NormalizeElements();
   9447     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   9448   }
   9449   ASSERT(HasDictionaryElements());
   9450   return SetElement(index, value, NONE, strict_mode, check_prototype);
   9451 }
   9452 
   9453 
   9454 MaybeObject* JSReceiver::SetElement(uint32_t index,
   9455                                     Object* value,
   9456                                     PropertyAttributes attributes,
   9457                                     StrictModeFlag strict_mode,
   9458                                     bool check_proto) {
   9459   if (IsJSProxy()) {
   9460     return JSProxy::cast(this)->SetElementWithHandler(
   9461         index, value, strict_mode);
   9462   } else {
   9463     return JSObject::cast(this)->SetElement(
   9464         index, value, attributes, strict_mode, check_proto);
   9465   }
   9466 }
   9467 
   9468 
   9469 Handle<Object> JSObject::SetOwnElement(Handle<JSObject> object,
   9470                                        uint32_t index,
   9471                                        Handle<Object> value,
   9472                                        StrictModeFlag strict_mode) {
   9473   ASSERT(!object->HasExternalArrayElements());
   9474   CALL_HEAP_FUNCTION(
   9475       object->GetIsolate(),
   9476       object->SetElement(index, *value, NONE, strict_mode, false),
   9477       Object);
   9478 }
   9479 
   9480 
   9481 Handle<Object> JSObject::SetElement(Handle<JSObject> object,
   9482                                     uint32_t index,
   9483                                     Handle<Object> value,
   9484                                     PropertyAttributes attr,
   9485                                     StrictModeFlag strict_mode,
   9486                                     SetPropertyMode set_mode) {
   9487   if (object->HasExternalArrayElements()) {
   9488     if (!value->IsSmi() && !value->IsHeapNumber() && !value->IsUndefined()) {
   9489       bool has_exception;
   9490       Handle<Object> number = Execution::ToNumber(value, &has_exception);
   9491       if (has_exception) return Handle<Object>();
   9492       value = number;
   9493     }
   9494   }
   9495   CALL_HEAP_FUNCTION(
   9496       object->GetIsolate(),
   9497       object->SetElement(index, *value, attr, strict_mode, true, set_mode),
   9498       Object);
   9499 }
   9500 
   9501 
   9502 MaybeObject* JSObject::SetElement(uint32_t index,
   9503                                   Object* value,
   9504                                   PropertyAttributes attributes,
   9505                                   StrictModeFlag strict_mode,
   9506                                   bool check_prototype,
   9507                                   SetPropertyMode set_mode) {
   9508   // Check access rights if needed.
   9509   if (IsAccessCheckNeeded()) {
   9510     Heap* heap = GetHeap();
   9511     if (!heap->isolate()->MayIndexedAccess(this, index, v8::ACCESS_SET)) {
   9512       HandleScope scope(heap->isolate());
   9513       Handle<Object> value_handle(value);
   9514       heap->isolate()->ReportFailedAccessCheck(this, v8::ACCESS_SET);
   9515       return *value_handle;
   9516     }
   9517   }
   9518 
   9519   if (IsJSGlobalProxy()) {
   9520     Object* proto = GetPrototype();
   9521     if (proto->IsNull()) return value;
   9522     ASSERT(proto->IsJSGlobalObject());
   9523     return JSObject::cast(proto)->SetElement(index,
   9524                                              value,
   9525                                              attributes,
   9526                                              strict_mode,
   9527                                              check_prototype,
   9528                                              set_mode);
   9529   }
   9530 
   9531   // Don't allow element properties to be redefined for external arrays.
   9532   if (HasExternalArrayElements() && set_mode == DEFINE_PROPERTY) {
   9533     Isolate* isolate = GetHeap()->isolate();
   9534     Handle<Object> number = isolate->factory()->NewNumberFromUint(index);
   9535     Handle<Object> args[] = { Handle<Object>(this), number };
   9536     Handle<Object> error = isolate->factory()->NewTypeError(
   9537         "redef_external_array_element", HandleVector(args, ARRAY_SIZE(args)));
   9538     return isolate->Throw(*error);
   9539   }
   9540 
   9541   // Normalize the elements to enable attributes on the property.
   9542   if ((attributes & (DONT_DELETE | DONT_ENUM | READ_ONLY)) != 0) {
   9543     SeededNumberDictionary* dictionary;
   9544     MaybeObject* maybe_object = NormalizeElements();
   9545     if (!maybe_object->To(&dictionary)) return maybe_object;
   9546     // Make sure that we never go back to fast case.
   9547     dictionary->set_requires_slow_elements();
   9548   }
   9549 
   9550   // Check for lookup interceptor
   9551   if (HasIndexedInterceptor()) {
   9552     return SetElementWithInterceptor(index,
   9553                                      value,
   9554                                      attributes,
   9555                                      strict_mode,
   9556                                      check_prototype,
   9557                                      set_mode);
   9558   }
   9559 
   9560   return SetElementWithoutInterceptor(index,
   9561                                       value,
   9562                                       attributes,
   9563                                       strict_mode,
   9564                                       check_prototype,
   9565                                       set_mode);
   9566 }
   9567 
   9568 
   9569 MaybeObject* JSObject::SetElementWithoutInterceptor(uint32_t index,
   9570                                                     Object* value,
   9571                                                     PropertyAttributes attr,
   9572                                                     StrictModeFlag strict_mode,
   9573                                                     bool check_prototype,
   9574                                                     SetPropertyMode set_mode) {
   9575   ASSERT(HasDictionaryElements() ||
   9576          HasDictionaryArgumentsElements() ||
   9577          (attr & (DONT_DELETE | DONT_ENUM | READ_ONLY)) == 0);
   9578   Isolate* isolate = GetIsolate();
   9579   switch (GetElementsKind()) {
   9580     case FAST_SMI_ONLY_ELEMENTS:
   9581     case FAST_ELEMENTS:
   9582       return SetFastElement(index, value, strict_mode, check_prototype);
   9583     case FAST_DOUBLE_ELEMENTS:
   9584       return SetFastDoubleElement(index, value, strict_mode, check_prototype);
   9585     case EXTERNAL_PIXEL_ELEMENTS: {
   9586       ExternalPixelArray* pixels = ExternalPixelArray::cast(elements());
   9587       return pixels->SetValue(index, value);
   9588     }
   9589     case EXTERNAL_BYTE_ELEMENTS: {
   9590       ExternalByteArray* array = ExternalByteArray::cast(elements());
   9591       return array->SetValue(index, value);
   9592     }
   9593     case EXTERNAL_UNSIGNED_BYTE_ELEMENTS: {
   9594       ExternalUnsignedByteArray* array =
   9595           ExternalUnsignedByteArray::cast(elements());
   9596       return array->SetValue(index, value);
   9597     }
   9598     case EXTERNAL_SHORT_ELEMENTS: {
   9599       ExternalShortArray* array = ExternalShortArray::cast(elements());
   9600       return array->SetValue(index, value);
   9601     }
   9602     case EXTERNAL_UNSIGNED_SHORT_ELEMENTS: {
   9603       ExternalUnsignedShortArray* array =
   9604           ExternalUnsignedShortArray::cast(elements());
   9605       return array->SetValue(index, value);
   9606     }
   9607     case EXTERNAL_INT_ELEMENTS: {
   9608       ExternalIntArray* array = ExternalIntArray::cast(elements());
   9609       return array->SetValue(index, value);
   9610     }
   9611     case EXTERNAL_UNSIGNED_INT_ELEMENTS: {
   9612       ExternalUnsignedIntArray* array =
   9613           ExternalUnsignedIntArray::cast(elements());
   9614       return array->SetValue(index, value);
   9615     }
   9616     case EXTERNAL_FLOAT_ELEMENTS: {
   9617       ExternalFloatArray* array = ExternalFloatArray::cast(elements());
   9618       return array->SetValue(index, value);
   9619     }
   9620     case EXTERNAL_DOUBLE_ELEMENTS: {
   9621       ExternalDoubleArray* array = ExternalDoubleArray::cast(elements());
   9622       return array->SetValue(index, value);
   9623     }
   9624     case DICTIONARY_ELEMENTS:
   9625       return SetDictionaryElement(index, value, attr, strict_mode,
   9626                                   check_prototype, set_mode);
   9627     case NON_STRICT_ARGUMENTS_ELEMENTS: {
   9628       FixedArray* parameter_map = FixedArray::cast(elements());
   9629       uint32_t length = parameter_map->length();
   9630       Object* probe =
   9631           (index < length - 2) ? parameter_map->get(index + 2) : NULL;
   9632       if (probe != NULL && !probe->IsTheHole()) {
   9633         Context* context = Context::cast(parameter_map->get(0));
   9634         int context_index = Smi::cast(probe)->value();
   9635         ASSERT(!context->get(context_index)->IsTheHole());
   9636         context->set(context_index, value);
   9637         // Redefining attributes of an aliased element destroys fast aliasing.
   9638         if (set_mode == SET_PROPERTY || attr == NONE) return value;
   9639         parameter_map->set_the_hole(index + 2);
   9640         // For elements that are still writable we re-establish slow aliasing.
   9641         if ((attr & READ_ONLY) == 0) {
   9642           MaybeObject* maybe_entry =
   9643               isolate->heap()->AllocateAliasedArgumentsEntry(context_index);
   9644           if (!maybe_entry->ToObject(&value)) return maybe_entry;
   9645         }
   9646       }
   9647       FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
   9648       if (arguments->IsDictionary()) {
   9649         return SetDictionaryElement(index, value, attr, strict_mode,
   9650                                     check_prototype, set_mode);
   9651       } else {
   9652         return SetFastElement(index, value, strict_mode, check_prototype);
   9653       }
   9654     }
   9655   }
   9656   // All possible cases have been handled above. Add a return to avoid the
   9657   // complaints from the compiler.
   9658   UNREACHABLE();
   9659   return isolate->heap()->null_value();
   9660 }
   9661 
   9662 
   9663 Handle<Object> JSObject::TransitionElementsKind(Handle<JSObject> object,
   9664                                                 ElementsKind to_kind) {
   9665   CALL_HEAP_FUNCTION(object->GetIsolate(),
   9666                      object->TransitionElementsKind(to_kind),
   9667                      Object);
   9668 }
   9669 
   9670 
   9671 MaybeObject* JSObject::TransitionElementsKind(ElementsKind to_kind) {
   9672   ElementsKind from_kind = map()->elements_kind();
   9673 
   9674   Isolate* isolate = GetIsolate();
   9675   if ((from_kind == FAST_SMI_ONLY_ELEMENTS ||
   9676       elements() == isolate->heap()->empty_fixed_array()) &&
   9677       to_kind == FAST_ELEMENTS) {
   9678     ASSERT(from_kind != FAST_ELEMENTS);
   9679     MaybeObject* maybe_new_map = GetElementsTransitionMap(isolate, to_kind);
   9680     Map* new_map;
   9681     if (!maybe_new_map->To(&new_map)) return maybe_new_map;
   9682     set_map(new_map);
   9683     if (FLAG_trace_elements_transitions) {
   9684       FixedArrayBase* elms = FixedArrayBase::cast(elements());
   9685       PrintElementsTransition(stdout, from_kind, elms, to_kind, elms);
   9686     }
   9687     return this;
   9688   }
   9689 
   9690   FixedArrayBase* elms = FixedArrayBase::cast(elements());
   9691   uint32_t capacity = static_cast<uint32_t>(elms->length());
   9692   uint32_t length = capacity;
   9693 
   9694   if (IsJSArray()) {
   9695     Object* raw_length = JSArray::cast(this)->length();
   9696     if (raw_length->IsUndefined()) {
   9697       // If length is undefined, then JSArray is being initialized and has no
   9698       // elements, assume a length of zero.
   9699       length = 0;
   9700     } else {
   9701       CHECK(JSArray::cast(this)->length()->ToArrayIndex(&length));
   9702     }
   9703   }
   9704 
   9705   if (from_kind == FAST_SMI_ONLY_ELEMENTS &&
   9706       to_kind == FAST_DOUBLE_ELEMENTS) {
   9707     MaybeObject* maybe_result =
   9708         SetFastDoubleElementsCapacityAndLength(capacity, length);
   9709     if (maybe_result->IsFailure()) return maybe_result;
   9710     return this;
   9711   }
   9712 
   9713   if (from_kind == FAST_DOUBLE_ELEMENTS && to_kind == FAST_ELEMENTS) {
   9714     MaybeObject* maybe_result = SetFastElementsCapacityAndLength(
   9715         capacity, length, kDontAllowSmiOnlyElements);
   9716     if (maybe_result->IsFailure()) return maybe_result;
   9717     return this;
   9718   }
   9719 
   9720   // This method should never be called for any other case than the ones
   9721   // handled above.
   9722   UNREACHABLE();
   9723   return GetIsolate()->heap()->null_value();
   9724 }
   9725 
   9726 
   9727 // static
   9728 bool Map::IsValidElementsTransition(ElementsKind from_kind,
   9729                                     ElementsKind to_kind) {
   9730   return
   9731       (from_kind == FAST_SMI_ONLY_ELEMENTS &&
   9732           (to_kind == FAST_DOUBLE_ELEMENTS || to_kind == FAST_ELEMENTS)) ||
   9733       (from_kind == FAST_DOUBLE_ELEMENTS && to_kind == FAST_ELEMENTS);
   9734 }
   9735 
   9736 
   9737 MaybeObject* JSArray::JSArrayUpdateLengthFromIndex(uint32_t index,
   9738                                                    Object* value) {
   9739   uint32_t old_len = 0;
   9740   CHECK(length()->ToArrayIndex(&old_len));
   9741   // Check to see if we need to update the length. For now, we make
   9742   // sure that the length stays within 32-bits (unsigned).
   9743   if (index >= old_len && index != 0xffffffff) {
   9744     Object* len;
   9745     { MaybeObject* maybe_len =
   9746           GetHeap()->NumberFromDouble(static_cast<double>(index) + 1);
   9747       if (!maybe_len->ToObject(&len)) return maybe_len;
   9748     }
   9749     set_length(len);
   9750   }
   9751   return value;
   9752 }
   9753 
   9754 
   9755 MaybeObject* JSObject::GetElementWithInterceptor(Object* receiver,
   9756                                                  uint32_t index) {
   9757   Isolate* isolate = GetIsolate();
   9758   // Make sure that the top context does not change when doing
   9759   // callbacks or interceptor calls.
   9760   AssertNoContextChange ncc;
   9761   HandleScope scope(isolate);
   9762   Handle<InterceptorInfo> interceptor(GetIndexedInterceptor(), isolate);
   9763   Handle<Object> this_handle(receiver, isolate);
   9764   Handle<JSObject> holder_handle(this, isolate);
   9765   if (!interceptor->getter()->IsUndefined()) {
   9766     v8::IndexedPropertyGetter getter =
   9767         v8::ToCData<v8::IndexedPropertyGetter>(interceptor->getter());
   9768     LOG(isolate,
   9769         ApiIndexedPropertyAccess("interceptor-indexed-get", this, index));
   9770     CustomArguments args(isolate, interceptor->data(), receiver, this);
   9771     v8::AccessorInfo info(args.end());
   9772     v8::Handle<v8::Value> result;
   9773     {
   9774       // Leaving JavaScript.
   9775       VMState state(isolate, EXTERNAL);
   9776       result = getter(index, info);
   9777     }
   9778     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   9779     if (!result.IsEmpty()) return *v8::Utils::OpenHandle(*result);
   9780   }
   9781 
   9782   Heap* heap = holder_handle->GetHeap();
   9783   ElementsAccessor* handler = holder_handle->GetElementsAccessor();
   9784   MaybeObject* raw_result = handler->Get(*this_handle,
   9785                                          *holder_handle,
   9786                                          index);
   9787   if (raw_result != heap->the_hole_value()) return raw_result;
   9788 
   9789   RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   9790 
   9791   Object* pt = holder_handle->GetPrototype();
   9792   if (pt == heap->null_value()) return heap->undefined_value();
   9793   return pt->GetElementWithReceiver(*this_handle, index);
   9794 }
   9795 
   9796 
   9797 bool JSObject::HasDenseElements() {
   9798   int capacity = 0;
   9799   int used = 0;
   9800   GetElementsCapacityAndUsage(&capacity, &used);
   9801   return (capacity == 0) || (used > (capacity / 2));
   9802 }
   9803 
   9804 
   9805 void JSObject::GetElementsCapacityAndUsage(int* capacity, int* used) {
   9806   *capacity = 0;
   9807   *used = 0;
   9808 
   9809   FixedArrayBase* backing_store_base = FixedArrayBase::cast(elements());
   9810   FixedArray* backing_store = NULL;
   9811   switch (GetElementsKind()) {
   9812     case NON_STRICT_ARGUMENTS_ELEMENTS:
   9813       backing_store_base =
   9814           FixedArray::cast(FixedArray::cast(backing_store_base)->get(1));
   9815       backing_store = FixedArray::cast(backing_store_base);
   9816       if (backing_store->IsDictionary()) {
   9817         SeededNumberDictionary* dictionary =
   9818             SeededNumberDictionary::cast(backing_store);
   9819         *capacity = dictionary->Capacity();
   9820         *used = dictionary->NumberOfElements();
   9821         break;
   9822       }
   9823       // Fall through.
   9824     case FAST_SMI_ONLY_ELEMENTS:
   9825     case FAST_ELEMENTS:
   9826       backing_store = FixedArray::cast(backing_store_base);
   9827       *capacity = backing_store->length();
   9828       for (int i = 0; i < *capacity; ++i) {
   9829         if (!backing_store->get(i)->IsTheHole()) ++(*used);
   9830       }
   9831       break;
   9832     case DICTIONARY_ELEMENTS: {
   9833       SeededNumberDictionary* dictionary =
   9834           SeededNumberDictionary::cast(FixedArray::cast(elements()));
   9835       *capacity = dictionary->Capacity();
   9836       *used = dictionary->NumberOfElements();
   9837       break;
   9838     }
   9839     case FAST_DOUBLE_ELEMENTS: {
   9840       FixedDoubleArray* elms = FixedDoubleArray::cast(elements());
   9841       *capacity = elms->length();
   9842       for (int i = 0; i < *capacity; i++) {
   9843         if (!elms->is_the_hole(i)) ++(*used);
   9844       }
   9845       break;
   9846     }
   9847     case EXTERNAL_BYTE_ELEMENTS:
   9848     case EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
   9849     case EXTERNAL_SHORT_ELEMENTS:
   9850     case EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
   9851     case EXTERNAL_INT_ELEMENTS:
   9852     case EXTERNAL_UNSIGNED_INT_ELEMENTS:
   9853     case EXTERNAL_FLOAT_ELEMENTS:
   9854     case EXTERNAL_DOUBLE_ELEMENTS:
   9855     case EXTERNAL_PIXEL_ELEMENTS:
   9856       // External arrays are considered 100% used.
   9857       ExternalArray* external_array = ExternalArray::cast(elements());
   9858       *capacity = external_array->length();
   9859       *used = external_array->length();
   9860       break;
   9861   }
   9862 }
   9863 
   9864 
   9865 bool JSObject::ShouldConvertToSlowElements(int new_capacity) {
   9866   STATIC_ASSERT(kMaxUncheckedOldFastElementsLength <=
   9867                 kMaxUncheckedFastElementsLength);
   9868   if (new_capacity <= kMaxUncheckedOldFastElementsLength ||
   9869       (new_capacity <= kMaxUncheckedFastElementsLength &&
   9870        GetHeap()->InNewSpace(this))) {
   9871     return false;
   9872   }
   9873   // If the fast-case backing storage takes up roughly three times as
   9874   // much space (in machine words) as a dictionary backing storage
   9875   // would, the object should have slow elements.
   9876   int old_capacity = 0;
   9877   int used_elements = 0;
   9878   GetElementsCapacityAndUsage(&old_capacity, &used_elements);
   9879   int dictionary_size = SeededNumberDictionary::ComputeCapacity(used_elements) *
   9880       SeededNumberDictionary::kEntrySize;
   9881   return 3 * dictionary_size <= new_capacity;
   9882 }
   9883 
   9884 
   9885 bool JSObject::ShouldConvertToFastElements() {
   9886   ASSERT(HasDictionaryElements() || HasDictionaryArgumentsElements());
   9887   // If the elements are sparse, we should not go back to fast case.
   9888   if (!HasDenseElements()) return false;
   9889   // An object requiring access checks is never allowed to have fast
   9890   // elements.  If it had fast elements we would skip security checks.
   9891   if (IsAccessCheckNeeded()) return false;
   9892 
   9893   FixedArray* elements = FixedArray::cast(this->elements());
   9894   SeededNumberDictionary* dictionary = NULL;
   9895   if (elements->map() == GetHeap()->non_strict_arguments_elements_map()) {
   9896     dictionary = SeededNumberDictionary::cast(elements->get(1));
   9897   } else {
   9898     dictionary = SeededNumberDictionary::cast(elements);
   9899   }
   9900   // If an element has been added at a very high index in the elements
   9901   // dictionary, we cannot go back to fast case.
   9902   if (dictionary->requires_slow_elements()) return false;
   9903   // If the dictionary backing storage takes up roughly half as much
   9904   // space (in machine words) as a fast-case backing storage would,
   9905   // the object should have fast elements.
   9906   uint32_t array_size = 0;
   9907   if (IsJSArray()) {
   9908     CHECK(JSArray::cast(this)->length()->ToArrayIndex(&array_size));
   9909   } else {
   9910     array_size = dictionary->max_number_key();
   9911   }
   9912   uint32_t dictionary_size = static_cast<uint32_t>(dictionary->Capacity()) *
   9913       SeededNumberDictionary::kEntrySize;
   9914   return 2 * dictionary_size >= array_size;
   9915 }
   9916 
   9917 
   9918 bool JSObject::ShouldConvertToFastDoubleElements(
   9919     bool* has_smi_only_elements) {
   9920   *has_smi_only_elements = false;
   9921   if (FLAG_unbox_double_arrays) {
   9922     ASSERT(HasDictionaryElements());
   9923     SeededNumberDictionary* dictionary =
   9924         SeededNumberDictionary::cast(elements());
   9925     bool found_double = false;
   9926     for (int i = 0; i < dictionary->Capacity(); i++) {
   9927       Object* key = dictionary->KeyAt(i);
   9928       if (key->IsNumber()) {
   9929         Object* value = dictionary->ValueAt(i);
   9930         if (!value->IsNumber()) return false;
   9931         if (!value->IsSmi()) {
   9932           found_double = true;
   9933         }
   9934       }
   9935     }
   9936     *has_smi_only_elements = !found_double;
   9937     return found_double;
   9938   } else {
   9939     return false;
   9940   }
   9941 }
   9942 
   9943 
   9944 // Certain compilers request function template instantiation when they
   9945 // see the definition of the other template functions in the
   9946 // class. This requires us to have the template functions put
   9947 // together, so even though this function belongs in objects-debug.cc,
   9948 // we keep it here instead to satisfy certain compilers.
   9949 #ifdef OBJECT_PRINT
   9950 template<typename Shape, typename Key>
   9951 void Dictionary<Shape, Key>::Print(FILE* out) {
   9952   int capacity = HashTable<Shape, Key>::Capacity();
   9953   for (int i = 0; i < capacity; i++) {
   9954     Object* k = HashTable<Shape, Key>::KeyAt(i);
   9955     if (HashTable<Shape, Key>::IsKey(k)) {
   9956       PrintF(out, " ");
   9957       if (k->IsString()) {
   9958         String::cast(k)->StringPrint(out);
   9959       } else {
   9960         k->ShortPrint(out);
   9961       }
   9962       PrintF(out, ": ");
   9963       ValueAt(i)->ShortPrint(out);
   9964       PrintF(out, "\n");
   9965     }
   9966   }
   9967 }
   9968 #endif
   9969 
   9970 
   9971 template<typename Shape, typename Key>
   9972 void Dictionary<Shape, Key>::CopyValuesTo(FixedArray* elements) {
   9973   int pos = 0;
   9974   int capacity = HashTable<Shape, Key>::Capacity();
   9975   AssertNoAllocation no_gc;
   9976   WriteBarrierMode mode = elements->GetWriteBarrierMode(no_gc);
   9977   for (int i = 0; i < capacity; i++) {
   9978     Object* k =  Dictionary<Shape, Key>::KeyAt(i);
   9979     if (Dictionary<Shape, Key>::IsKey(k)) {
   9980       elements->set(pos++, ValueAt(i), mode);
   9981     }
   9982   }
   9983   ASSERT(pos == elements->length());
   9984 }
   9985 
   9986 
   9987 InterceptorInfo* JSObject::GetNamedInterceptor() {
   9988   ASSERT(map()->has_named_interceptor());
   9989   JSFunction* constructor = JSFunction::cast(map()->constructor());
   9990   ASSERT(constructor->shared()->IsApiFunction());
   9991   Object* result =
   9992       constructor->shared()->get_api_func_data()->named_property_handler();
   9993   return InterceptorInfo::cast(result);
   9994 }
   9995 
   9996 
   9997 InterceptorInfo* JSObject::GetIndexedInterceptor() {
   9998   ASSERT(map()->has_indexed_interceptor());
   9999   JSFunction* constructor = JSFunction::cast(map()->constructor());
   10000   ASSERT(constructor->shared()->IsApiFunction());
   10001   Object* result =
   10002       constructor->shared()->get_api_func_data()->indexed_property_handler();
   10003   return InterceptorInfo::cast(result);
   10004 }
   10005 
   10006 
   10007 MaybeObject* JSObject::GetPropertyPostInterceptor(
   10008     JSReceiver* receiver,
   10009     String* name,
   10010     PropertyAttributes* attributes) {
   10011   // Check local property in holder, ignore interceptor.
   10012   LookupResult result(GetIsolate());
   10013   LocalLookupRealNamedProperty(name, &result);
   10014   if (result.IsProperty()) {
   10015     return GetProperty(receiver, &result, name, attributes);
   10016   }
   10017   // Continue searching via the prototype chain.
   10018   Object* pt = GetPrototype();
   10019   *attributes = ABSENT;
   10020   if (pt->IsNull()) return GetHeap()->undefined_value();
   10021   return pt->GetPropertyWithReceiver(receiver, name, attributes);
   10022 }
   10023 
   10024 
   10025 MaybeObject* JSObject::GetLocalPropertyPostInterceptor(
   10026     JSReceiver* receiver,
   10027     String* name,
   10028     PropertyAttributes* attributes) {
   10029   // Check local property in holder, ignore interceptor.
   10030   LookupResult result(GetIsolate());
   10031   LocalLookupRealNamedProperty(name, &result);
   10032   if (result.IsProperty()) {
   10033     return GetProperty(receiver, &result, name, attributes);
   10034   }
   10035   return GetHeap()->undefined_value();
   10036 }
   10037 
   10038 
   10039 MaybeObject* JSObject::GetPropertyWithInterceptor(
   10040     JSReceiver* receiver,
   10041     String* name,
   10042     PropertyAttributes* attributes) {
   10043   Isolate* isolate = GetIsolate();
   10044   InterceptorInfo* interceptor = GetNamedInterceptor();
   10045   HandleScope scope(isolate);
   10046   Handle<JSReceiver> receiver_handle(receiver);
   10047   Handle<JSObject> holder_handle(this);
   10048   Handle<String> name_handle(name);
   10049 
   10050   if (!interceptor->getter()->IsUndefined()) {
   10051     v8::NamedPropertyGetter getter =
   10052         v8::ToCData<v8::NamedPropertyGetter>(interceptor->getter());
   10053     LOG(isolate,
   10054         ApiNamedPropertyAccess("interceptor-named-get", *holder_handle, name));
   10055     CustomArguments args(isolate, interceptor->data(), receiver, this);
   10056     v8::AccessorInfo info(args.end());
   10057     v8::Handle<v8::Value> result;
   10058     {
   10059       // Leaving JavaScript.
   10060       VMState state(isolate, EXTERNAL);
   10061       result = getter(v8::Utils::ToLocal(name_handle), info);
   10062     }
   10063     RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   10064     if (!result.IsEmpty()) {
   10065       *attributes = NONE;
   10066       return *v8::Utils::OpenHandle(*result);
   10067     }
   10068   }
   10069 
   10070   MaybeObject* result = holder_handle->GetPropertyPostInterceptor(
   10071       *receiver_handle,
   10072       *name_handle,
   10073       attributes);
   10074   RETURN_IF_SCHEDULED_EXCEPTION(isolate);
   10075   return result;
   10076 }
   10077 
   10078 
   10079 bool JSObject::HasRealNamedProperty(String* key) {
   10080   // Check access rights if needed.
   10081   Isolate* isolate = GetIsolate();
   10082   if (IsAccessCheckNeeded()) {
   10083     if (!isolate->MayNamedAccess(this, key, v8::ACCESS_HAS)) {
   10084       isolate->ReportFailedAccessCheck(this, v8::ACCESS_HAS);
   10085       return false;
   10086     }
   10087   }
   10088 
   10089   LookupResult result(isolate);
   10090   LocalLookupRealNamedProperty(key, &result);
   10091   return result.IsProperty() && (result.type() != INTERCEPTOR);
   10092 }
   10093 
   10094 
   10095 bool JSObject::HasRealElementProperty(uint32_t index) {
   10096   // Check access rights if needed.
   10097   if (IsAccessCheckNeeded()) {
   10098     Heap* heap = GetHeap();
   10099     if (!heap->isolate()->MayIndexedAccess(this, index, v8::ACCESS_HAS)) {
   10100       heap->isolate()->ReportFailedAccessCheck(this, v8::ACCESS_HAS);
   10101       return false;
   10102     }
   10103   }
   10104 
   10105   if (IsJSGlobalProxy()) {
   10106     Object* proto = GetPrototype();
   10107     if (proto->IsNull()) return false;
   10108     ASSERT(proto->IsJSGlobalObject());
   10109     return JSObject::cast(proto)->HasRealElementProperty(index);
   10110   }
   10111 
   10112   // Handle [] on String objects.
   10113   if (this->IsStringObjectWithCharacterAt(index)) return true;
   10114 
   10115   switch (GetElementsKind()) {
   10116     case FAST_SMI_ONLY_ELEMENTS:
   10117     case FAST_ELEMENTS: {
   10118       uint32_t length = IsJSArray() ?
   10119           static_cast<uint32_t>(
   10120               Smi::cast(JSArray::cast(this)->length())->value()) :
   10121           static_cast<uint32_t>(FixedArray::cast(elements())->length());
   10122       return (index < length) &&
   10123           !FixedArray::cast(elements())->get(index)->IsTheHole();
   10124     }
   10125     case FAST_DOUBLE_ELEMENTS: {
   10126       uint32_t length = IsJSArray() ?
   10127           static_cast<uint32_t>(
   10128               Smi::cast(JSArray::cast(this)->length())->value()) :
   10129           static_cast<uint32_t>(FixedDoubleArray::cast(elements())->length());
   10130       return (index < length) &&
   10131           !FixedDoubleArray::cast(elements())->is_the_hole(index);
   10132       break;
   10133     }
   10134     case EXTERNAL_PIXEL_ELEMENTS: {
   10135       ExternalPixelArray* pixels = ExternalPixelArray::cast(elements());
   10136       return index < static_cast<uint32_t>(pixels->length());
   10137     }
   10138     case EXTERNAL_BYTE_ELEMENTS:
   10139     case EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
   10140     case EXTERNAL_SHORT_ELEMENTS:
   10141     case EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
   10142     case EXTERNAL_INT_ELEMENTS:
   10143     case EXTERNAL_UNSIGNED_INT_ELEMENTS:
   10144     case EXTERNAL_FLOAT_ELEMENTS:
   10145     case EXTERNAL_DOUBLE_ELEMENTS: {
   10146       ExternalArray* array = ExternalArray::cast(elements());
   10147       return index < static_cast<uint32_t>(array->length());
   10148     }
   10149     case DICTIONARY_ELEMENTS: {
   10150       return element_dictionary()->FindEntry(index)
   10151           != SeededNumberDictionary::kNotFound;
   10152     }
   10153     case NON_STRICT_ARGUMENTS_ELEMENTS:
   10154       UNIMPLEMENTED();
   10155       break;
   10156   }
   10157   // All possibilities have been handled above already.
   10158   UNREACHABLE();
   10159   return GetHeap()->null_value();
   10160 }
   10161 
   10162 
   10163 bool JSObject::HasRealNamedCallbackProperty(String* key) {
   10164   // Check access rights if needed.
   10165   Isolate* isolate = GetIsolate();
   10166   if (IsAccessCheckNeeded()) {
   10167     if (!isolate->MayNamedAccess(this, key, v8::ACCESS_HAS)) {
   10168       isolate->ReportFailedAccessCheck(this, v8::ACCESS_HAS);
   10169       return false;
   10170     }
   10171   }
   10172 
   10173   LookupResult result(isolate);
   10174   LocalLookupRealNamedProperty(key, &result);
   10175   return result.IsFound() && (result.type() == CALLBACKS);
   10176 }
   10177 
   10178 
   10179 int JSObject::NumberOfLocalProperties(PropertyAttributes filter) {
   10180   return HasFastProperties() ?
   10181       map()->NumberOfDescribedProperties(filter) :
   10182       property_dictionary()->NumberOfElementsFilterAttributes(filter);
   10183 }
   10184 
   10185 
   10186 void FixedArray::SwapPairs(FixedArray* numbers, int i, int j) {
   10187   Object* temp = get(i);
   10188   set(i, get(j));
   10189   set(j, temp);
   10190   if (this != numbers) {
   10191     temp = numbers->get(i);
   10192     numbers->set(i, Smi::cast(numbers->get(j)));
   10193     numbers->set(j, Smi::cast(temp));
   10194   }
   10195 }
   10196 
   10197 
   10198 static void InsertionSortPairs(FixedArray* content,
   10199                                FixedArray* numbers,
   10200                                int len) {
   10201   for (int i = 1; i < len; i++) {
   10202     int j = i;
   10203     while (j > 0 &&
   10204            (NumberToUint32(numbers->get(j - 1)) >
   10205             NumberToUint32(numbers->get(j)))) {
   10206       content->SwapPairs(numbers, j - 1, j);
   10207       j--;
   10208     }
   10209   }
   10210 }
   10211 
   10212 
   10213 void HeapSortPairs(FixedArray* content, FixedArray* numbers, int len) {
   10214   // In-place heap sort.
   10215   ASSERT(content->length() == numbers->length());
   10216 
   10217   // Bottom-up max-heap construction.
   10218   for (int i = 1; i < len; ++i) {
   10219     int child_index = i;
   10220     while (child_index > 0) {
   10221       int parent_index = ((child_index + 1) >> 1) - 1;
   10222       uint32_t parent_value = NumberToUint32(numbers->get(parent_index));
   10223       uint32_t child_value = NumberToUint32(numbers->get(child_index));
   10224       if (parent_value < child_value) {
   10225         content->SwapPairs(numbers, parent_index, child_index);
   10226       } else {
   10227         break;
   10228       }
   10229       child_index = parent_index;
   10230     }
   10231   }
   10232 
   10233   // Extract elements and create sorted array.
   10234   for (int i = len - 1; i > 0; --i) {
   10235     // Put max element at the back of the array.
   10236     content->SwapPairs(numbers, 0, i);
   10237     // Sift down the new top element.
   10238     int parent_index = 0;
   10239     while (true) {
   10240       int child_index = ((parent_index + 1) << 1) - 1;
   10241       if (child_index >= i) break;
   10242       uint32_t child1_value = NumberToUint32(numbers->get(child_index));
   10243       uint32_t child2_value = NumberToUint32(numbers->get(child_index + 1));
   10244       uint32_t parent_value = NumberToUint32(numbers->get(parent_index));
   10245       if (child_index + 1 >= i || child1_value > child2_value) {
   10246         if (parent_value > child1_value) break;
   10247         content->SwapPairs(numbers, parent_index, child_index);
   10248         parent_index = child_index;
   10249       } else {
   10250         if (parent_value > child2_value) break;
   10251         content->SwapPairs(numbers, parent_index, child_index + 1);
   10252         parent_index = child_index + 1;
   10253       }
   10254     }
   10255   }
   10256 }
   10257 
   10258 
   10259 // Sort this array and the numbers as pairs wrt. the (distinct) numbers.
   10260 void FixedArray::SortPairs(FixedArray* numbers, uint32_t len) {
   10261   ASSERT(this->length() == numbers->length());
   10262   // For small arrays, simply use insertion sort.
   10263   if (len <= 10) {
   10264     InsertionSortPairs(this, numbers, len);
   10265     return;
   10266   }
   10267   // Check the range of indices.
   10268   uint32_t min_index = NumberToUint32(numbers->get(0));
   10269   uint32_t max_index = min_index;
   10270   uint32_t i;
   10271   for (i = 1; i < len; i++) {
   10272     if (NumberToUint32(numbers->get(i)) < min_index) {
   10273       min_index = NumberToUint32(numbers->get(i));
   10274     } else if (NumberToUint32(numbers->get(i)) > max_index) {
   10275       max_index = NumberToUint32(numbers->get(i));
   10276     }
   10277   }
   10278   if (max_index - min_index + 1 == len) {
   10279     // Indices form a contiguous range, unless there are duplicates.
   10280     // Do an in-place linear time sort assuming distinct numbers, but
   10281     // avoid hanging in case they are not.
   10282     for (i = 0; i < len; i++) {
   10283       uint32_t p;
   10284       uint32_t j = 0;
   10285       // While the current element at i is not at its correct position p,
   10286       // swap the elements at these two positions.
   10287       while ((p = NumberToUint32(numbers->get(i)) - min_index) != i &&
   10288              j++ < len) {
   10289         SwapPairs(numbers, i, p);
   10290       }
   10291     }
   10292   } else {
   10293     HeapSortPairs(this, numbers, len);
   10294     return;
   10295   }
   10296 }
   10297 
   10298 
   10299 // Fill in the names of local properties into the supplied storage. The main
   10300 // purpose of this function is to provide reflection information for the object
   10301 // mirrors.
   10302 void JSObject::GetLocalPropertyNames(FixedArray* storage, int index) {
   10303   ASSERT(storage->length() >= (NumberOfLocalProperties() - index));
   10304   if (HasFastProperties()) {
   10305     DescriptorArray* descs = map()->instance_descriptors();
   10306     for (int i = 0; i < descs->number_of_descriptors(); i++) {
   10307       if (descs->IsProperty(i)) storage->set(index++, descs->GetKey(i));
   10308     }
   10309     ASSERT(storage->length() >= index);
   10310   } else {
   10311     property_dictionary()->CopyKeysTo(storage,
   10312                                       index,
   10313                                       StringDictionary::UNSORTED);
   10314   }
   10315 }
   10316 
   10317 
   10318 int JSObject::NumberOfLocalElements(PropertyAttributes filter) {
   10319   return GetLocalElementKeys(NULL, filter);
   10320 }
   10321 
   10322 
   10323 int JSObject::NumberOfEnumElements() {
   10324   // Fast case for objects with no elements.
   10325   if (!IsJSValue() && HasFastElements()) {
   10326     uint32_t length = IsJSArray() ?
   10327         static_cast<uint32_t>(
   10328             Smi::cast(JSArray::cast(this)->length())->value()) :
   10329         static_cast<uint32_t>(FixedArray::cast(elements())->length());
   10330     if (length == 0) return 0;
   10331   }
   10332   // Compute the number of enumerable elements.
   10333   return NumberOfLocalElements(static_cast<PropertyAttributes>(DONT_ENUM));
   10334 }
   10335 
   10336 
   10337 int JSObject::GetLocalElementKeys(FixedArray* storage,
   10338                                   PropertyAttributes filter) {
   10339   int counter = 0;
   10340   switch (GetElementsKind()) {
   10341     case FAST_SMI_ONLY_ELEMENTS:
   10342     case FAST_ELEMENTS: {
   10343       int length = IsJSArray() ?
   10344           Smi::cast(JSArray::cast(this)->length())->value() :
   10345           FixedArray::cast(elements())->length();
   10346       for (int i = 0; i < length; i++) {
   10347         if (!FixedArray::cast(elements())->get(i)->IsTheHole()) {
   10348           if (storage != NULL) {
   10349             storage->set(counter, Smi::FromInt(i));
   10350           }
   10351           counter++;
   10352         }
   10353       }
   10354       ASSERT(!storage || storage->length() >= counter);
   10355       break;
   10356     }
   10357     case FAST_DOUBLE_ELEMENTS: {
   10358       int length = IsJSArray() ?
   10359           Smi::cast(JSArray::cast(this)->length())->value() :
   10360           FixedDoubleArray::cast(elements())->length();
   10361       for (int i = 0; i < length; i++) {
   10362         if (!FixedDoubleArray::cast(elements())->is_the_hole(i)) {
   10363           if (storage != NULL) {
   10364             storage->set(counter, Smi::FromInt(i));
   10365           }
   10366           counter++;
   10367         }
   10368       }
   10369       ASSERT(!storage || storage->length() >= counter);
   10370       break;
   10371     }
   10372     case EXTERNAL_PIXEL_ELEMENTS: {
   10373       int length = ExternalPixelArray::cast(elements())->length();
   10374       while (counter < length) {
   10375         if (storage != NULL) {
   10376           storage->set(counter, Smi::FromInt(counter));
   10377         }
   10378         counter++;
   10379       }
   10380       ASSERT(!storage || storage->length() >= counter);
   10381       break;
   10382     }
   10383     case EXTERNAL_BYTE_ELEMENTS:
   10384     case EXTERNAL_UNSIGNED_BYTE_ELEMENTS:
   10385     case EXTERNAL_SHORT_ELEMENTS:
   10386     case EXTERNAL_UNSIGNED_SHORT_ELEMENTS:
   10387     case EXTERNAL_INT_ELEMENTS:
   10388     case EXTERNAL_UNSIGNED_INT_ELEMENTS:
   10389     case EXTERNAL_FLOAT_ELEMENTS:
   10390     case EXTERNAL_DOUBLE_ELEMENTS: {
   10391       int length = ExternalArray::cast(elements())->length();
   10392       while (counter < length) {
   10393         if (storage != NULL) {
   10394           storage->set(counter, Smi::FromInt(counter));
   10395         }
   10396         counter++;
   10397       }
   10398       ASSERT(!storage || storage->length() >= counter);
   10399       break;
   10400     }
   10401     case DICTIONARY_ELEMENTS: {
   10402       if (storage != NULL) {
   10403         element_dictionary()->CopyKeysTo(storage,
   10404                                          filter,
   10405                                          SeededNumberDictionary::SORTED);
   10406       }
   10407       counter += element_dictionary()->NumberOfElementsFilterAttributes(filter);
   10408       break;
   10409     }
   10410     case NON_STRICT_ARGUMENTS_ELEMENTS: {
   10411       FixedArray* parameter_map = FixedArray::cast(elements());
   10412       int mapped_length = parameter_map->length() - 2;
   10413       FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
   10414       if (arguments->IsDictionary()) {
   10415         // Copy the keys from arguments first, because Dictionary::CopyKeysTo
   10416         // will insert in storage starting at index 0.
   10417         SeededNumberDictionary* dictionary =
   10418             SeededNumberDictionary::cast(arguments);
   10419         if (storage != NULL) {
   10420           dictionary->CopyKeysTo(
   10421               storage, filter, SeededNumberDictionary::UNSORTED);
   10422         }
   10423         counter += dictionary->NumberOfElementsFilterAttributes(filter);
   10424         for (int i = 0; i < mapped_length; ++i) {
   10425           if (!parameter_map->get(i + 2)->IsTheHole()) {
   10426             if (storage != NULL) storage->set(counter, Smi::FromInt(i));
   10427             ++counter;
   10428           }
   10429         }
   10430         if (storage != NULL) storage->SortPairs(storage, counter);
   10431 
   10432       } else {
   10433         int backing_length = arguments->length();
   10434         int i = 0;
   10435         for (; i < mapped_length; ++i) {
   10436           if (!parameter_map->get(i + 2)->IsTheHole()) {
   10437             if (storage != NULL) storage->set(counter, Smi::FromInt(i));
   10438             ++counter;
   10439           } else if (i < backing_length && !arguments->get(i)->IsTheHole()) {
   10440             if (storage != NULL) storage->set(counter, Smi::FromInt(i));
   10441             ++counter;
   10442           }
   10443         }
   10444         for (; i < backing_length; ++i) {
   10445           if (storage != NULL) storage->set(counter, Smi::FromInt(i));
   10446           ++counter;
   10447         }
   10448       }
   10449       break;
   10450     }
   10451   }
   10452 
   10453   if (this->IsJSValue()) {
   10454     Object* val = JSValue::cast(this)->value();
   10455     if (val->IsString()) {
   10456       String* str = String::cast(val);
   10457       if (storage) {
   10458         for (int i = 0; i < str->length(); i++) {
   10459           storage->set(counter + i, Smi::FromInt(i));
   10460         }
   10461       }
   10462       counter += str->length();
   10463     }
   10464   }
   10465   ASSERT(!storage || storage->length() == counter);
   10466   return counter;
   10467 }
   10468 
   10469 
   10470 int JSObject::GetEnumElementKeys(FixedArray* storage) {
   10471   return GetLocalElementKeys(storage,
   10472                              static_cast<PropertyAttributes>(DONT_ENUM));
   10473 }
   10474 
   10475 
   10476 // StringKey simply carries a string object as key.
   10477 class StringKey : public HashTableKey {
   10478  public:
   10479   explicit StringKey(String* string) :
   10480       string_(string),
   10481       hash_(HashForObject(string)) { }
   10482 
   10483   bool IsMatch(Object* string) {
   10484     // We know that all entries in a hash table had their hash keys created.
   10485     // Use that knowledge to have fast failure.
   10486     if (hash_ != HashForObject(string)) {
   10487       return false;
   10488     }
   10489     return string_->Equals(String::cast(string));
   10490   }
   10491 
   10492   uint32_t Hash() { return hash_; }
   10493 
   10494   uint32_t HashForObject(Object* other) { return String::cast(other)->Hash(); }
   10495 
   10496   Object* AsObject() { return string_; }
   10497 
   10498   String* string_;
   10499   uint32_t hash_;
   10500 };
   10501 
   10502 
   10503 // StringSharedKeys are used as keys in the eval cache.
   10504 class StringSharedKey : public HashTableKey {
   10505  public:
   10506   StringSharedKey(String* source,
   10507                   SharedFunctionInfo* shared,
   10508                   LanguageMode language_mode,
   10509                   int scope_position)
   10510       : source_(source),
   10511         shared_(shared),
   10512         language_mode_(language_mode),
   10513         scope_position_(scope_position) { }
   10514 
   10515   bool IsMatch(Object* other) {
   10516     if (!other->IsFixedArray()) return false;
   10517     FixedArray* other_array = FixedArray::cast(other);
   10518     SharedFunctionInfo* shared = SharedFunctionInfo::cast(other_array->get(0));
   10519     if (shared != shared_) return false;
   10520     int language_unchecked = Smi::cast(other_array->get(2))->value();
   10521     ASSERT(language_unchecked == CLASSIC_MODE ||
   10522            language_unchecked == STRICT_MODE ||
   10523            language_unchecked == EXTENDED_MODE);
   10524     LanguageMode language_mode = static_cast<LanguageMode>(language_unchecked);
   10525     if (language_mode != language_mode_) return false;
   10526     int scope_position = Smi::cast(other_array->get(3))->value();
   10527     if (scope_position != scope_position_) return false;
   10528     String* source = String::cast(other_array->get(1));
   10529     return source->Equals(source_);
   10530   }
   10531 
   10532   static uint32_t StringSharedHashHelper(String* source,
   10533                                          SharedFunctionInfo* shared,
   10534                                          LanguageMode language_mode,
   10535                                          int scope_position) {
   10536     uint32_t hash = source->Hash();
   10537     if (shared->HasSourceCode()) {
   10538       // Instead of using the SharedFunctionInfo pointer in the hash
   10539       // code computation, we use a combination of the hash of the
   10540       // script source code and the start position of the calling scope.
   10541       // We do this to ensure that the cache entries can survive garbage
   10542       // collection.
   10543       Script* script = Script::cast(shared->script());
   10544       hash ^= String::cast(script->source())->Hash();
   10545       if (language_mode == STRICT_MODE) hash ^= 0x8000;
   10546       if (language_mode == EXTENDED_MODE) hash ^= 0x0080;
   10547       hash += scope_position;
   10548     }
   10549     return hash;
   10550   }
   10551 
   10552   uint32_t Hash() {
   10553     return StringSharedHashHelper(
   10554         source_, shared_, language_mode_, scope_position_);
   10555   }
   10556 
   10557   uint32_t HashForObject(Object* obj) {
   10558     FixedArray* other_array = FixedArray::cast(obj);
   10559     SharedFunctionInfo* shared = SharedFunctionInfo::cast(other_array->get(0));
   10560     String* source = String::cast(other_array->get(1));
   10561     int language_unchecked = Smi::cast(other_array->get(2))->value();
   10562     ASSERT(language_unchecked == CLASSIC_MODE ||
   10563            language_unchecked == STRICT_MODE ||
   10564            language_unchecked == EXTENDED_MODE);
   10565     LanguageMode language_mode = static_cast<LanguageMode>(language_unchecked);
   10566     int scope_position = Smi::cast(other_array->get(3))->value();
   10567     return StringSharedHashHelper(
   10568         source, shared, language_mode, scope_position);
   10569   }
   10570 
   10571   MUST_USE_RESULT MaybeObject* AsObject() {
   10572     Object* obj;
   10573     { MaybeObject* maybe_obj = source_->GetHeap()->AllocateFixedArray(4);
   10574       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   10575     }
   10576     FixedArray* other_array = FixedArray::cast(obj);
   10577     other_array->set(0, shared_);
   10578     other_array->set(1, source_);
   10579     other_array->set(2, Smi::FromInt(language_mode_));
   10580     other_array->set(3, Smi::FromInt(scope_position_));
   10581     return other_array;
   10582   }
   10583 
   10584  private:
   10585   String* source_;
   10586   SharedFunctionInfo* shared_;
   10587   LanguageMode language_mode_;
   10588   int scope_position_;
   10589 };
   10590 
   10591 
   10592 // RegExpKey carries the source and flags of a regular expression as key.
   10593 class RegExpKey : public HashTableKey {
   10594  public:
   10595   RegExpKey(String* string, JSRegExp::Flags flags)
   10596       : string_(string),
   10597         flags_(Smi::FromInt(flags.value())) { }
   10598 
   10599   // Rather than storing the key in the hash table, a pointer to the
   10600   // stored value is stored where the key should be.  IsMatch then
   10601   // compares the search key to the found object, rather than comparing
   10602   // a key to a key.
   10603   bool IsMatch(Object* obj) {
   10604     FixedArray* val = FixedArray::cast(obj);
   10605     return string_->Equals(String::cast(val->get(JSRegExp::kSourceIndex)))
   10606         && (flags_ == val->get(JSRegExp::kFlagsIndex));
   10607   }
   10608 
   10609   uint32_t Hash() { return RegExpHash(string_, flags_); }
   10610 
   10611   Object* AsObject() {
   10612     // Plain hash maps, which is where regexp keys are used, don't
   10613     // use this function.
   10614     UNREACHABLE();
   10615     return NULL;
   10616   }
   10617 
   10618   uint32_t HashForObject(Object* obj) {
   10619     FixedArray* val = FixedArray::cast(obj);
   10620     return RegExpHash(String::cast(val->get(JSRegExp::kSourceIndex)),
   10621                       Smi::cast(val->get(JSRegExp::kFlagsIndex)));
   10622   }
   10623 
   10624   static uint32_t RegExpHash(String* string, Smi* flags) {
   10625     return string->Hash() + flags->value();
   10626   }
   10627 
   10628   String* string_;
   10629   Smi* flags_;
   10630 };
   10631 
   10632 // Utf8SymbolKey carries a vector of chars as key.
   10633 class Utf8SymbolKey : public HashTableKey {
   10634  public:
   10635   explicit Utf8SymbolKey(Vector<const char> string, uint32_t seed)
   10636       : string_(string), hash_field_(0), seed_(seed) { }
   10637 
   10638   bool IsMatch(Object* string) {
   10639     return String::cast(string)->IsEqualTo(string_);
   10640   }
   10641 
   10642   uint32_t Hash() {
   10643     if (hash_field_ != 0) return hash_field_ >> String::kHashShift;
   10644     unibrow::Utf8InputBuffer<> buffer(string_.start(),
   10645                                       static_cast<unsigned>(string_.length()));
   10646     chars_ = buffer.Utf16Length();
   10647     hash_field_ = String::ComputeHashField(&buffer, chars_, seed_);
   10648     uint32_t result = hash_field_ >> String::kHashShift;
   10649     ASSERT(result != 0);  // Ensure that the hash value of 0 is never computed.
   10650     return result;
   10651   }
   10652 
   10653   uint32_t HashForObject(Object* other) {
   10654     return String::cast(other)->Hash();
   10655   }
   10656 
   10657   MaybeObject* AsObject() {
   10658     if (hash_field_ == 0) Hash();
   10659     return Isolate::Current()->heap()->AllocateSymbol(
   10660         string_, chars_, hash_field_);
   10661   }
   10662 
   10663   Vector<const char> string_;
   10664   uint32_t hash_field_;
   10665   int chars_;  // Caches the number of characters when computing the hash code.
   10666   uint32_t seed_;
   10667 };
   10668 
   10669 
   10670 template <typename Char>
   10671 class SequentialSymbolKey : public HashTableKey {
   10672  public:
   10673   explicit SequentialSymbolKey(Vector<const Char> string, uint32_t seed)
   10674       : string_(string), hash_field_(0), seed_(seed) { }
   10675 
   10676   uint32_t Hash() {
   10677     StringHasher hasher(string_.length(), seed_);
   10678 
   10679     // Very long strings have a trivial hash that doesn't inspect the
   10680     // string contents.
   10681     if (hasher.has_trivial_hash()) {
   10682       hash_field_ = hasher.GetHashField();
   10683     } else {
   10684       int i = 0;
   10685       // Do the iterative array index computation as long as there is a
   10686       // chance this is an array index.
   10687       while (i < string_.length() && hasher.is_array_index()) {
   10688         hasher.AddCharacter(static_cast<uc32>(string_[i]));
   10689         i++;
   10690       }
   10691 
   10692       // Process the remaining characters without updating the array
   10693       // index.
   10694       while (i < string_.length()) {
   10695         hasher.AddCharacterNoIndex(static_cast<uc32>(string_[i]));
   10696         i++;
   10697       }
   10698       hash_field_ = hasher.GetHashField();
   10699     }
   10700 
   10701     uint32_t result = hash_field_ >> String::kHashShift;
   10702     ASSERT(result != 0);  // Ensure that the hash value of 0 is never computed.
   10703     return result;
   10704   }
   10705 
   10706 
   10707   uint32_t HashForObject(Object* other) {
   10708     return String::cast(other)->Hash();
   10709   }
   10710 
   10711   Vector<const Char> string_;
   10712   uint32_t hash_field_;
   10713   uint32_t seed_;
   10714 };
   10715 
   10716 
   10717 
   10718 class AsciiSymbolKey : public SequentialSymbolKey<char> {
   10719  public:
   10720   AsciiSymbolKey(Vector<const char> str, uint32_t seed)
   10721       : SequentialSymbolKey<char>(str, seed) { }
   10722 
   10723   bool IsMatch(Object* string) {
   10724     return String::cast(string)->IsAsciiEqualTo(string_);
   10725   }
   10726 
   10727   MaybeObject* AsObject() {
   10728     if (hash_field_ == 0) Hash();
   10729     return HEAP->AllocateAsciiSymbol(string_, hash_field_);
   10730   }
   10731 };
   10732 
   10733 
   10734 class SubStringAsciiSymbolKey : public HashTableKey {
   10735  public:
   10736   explicit SubStringAsciiSymbolKey(Handle<SeqAsciiString> string,
   10737                                    int from,
   10738                                    int length,
   10739                                    uint32_t seed)
   10740       : string_(string), from_(from), length_(length), seed_(seed) { }
   10741 
   10742   uint32_t Hash() {
   10743     ASSERT(length_ >= 0);
   10744     ASSERT(from_ + length_ <= string_->length());
   10745     StringHasher hasher(length_, string_->GetHeap()->HashSeed());
   10746 
   10747     // Very long strings have a trivial hash that doesn't inspect the
   10748     // string contents.
   10749     if (hasher.has_trivial_hash()) {
   10750       hash_field_ = hasher.GetHashField();
   10751     } else {
   10752       int i = 0;
   10753       // Do the iterative array index computation as long as there is a
   10754       // chance this is an array index.
   10755       while (i < length_ && hasher.is_array_index()) {
   10756         hasher.AddCharacter(static_cast<uc32>(
   10757             string_->SeqAsciiStringGet(i + from_)));
   10758         i++;
   10759       }
   10760 
   10761       // Process the remaining characters without updating the array
   10762       // index.
   10763       while (i < length_) {
   10764         hasher.AddCharacterNoIndex(static_cast<uc32>(
   10765             string_->SeqAsciiStringGet(i + from_)));
   10766         i++;
   10767       }
   10768       hash_field_ = hasher.GetHashField();
   10769     }
   10770 
   10771     uint32_t result = hash_field_ >> String::kHashShift;
   10772     ASSERT(result != 0);  // Ensure that the hash value of 0 is never computed.
   10773     return result;
   10774   }
   10775 
   10776 
   10777   uint32_t HashForObject(Object* other) {
   10778     return String::cast(other)->Hash();
   10779   }
   10780 
   10781   bool IsMatch(Object* string) {
   10782     Vector<const char> chars(string_->GetChars() + from_, length_);
   10783     return String::cast(string)->IsAsciiEqualTo(chars);
   10784   }
   10785 
   10786   MaybeObject* AsObject() {
   10787     if (hash_field_ == 0) Hash();
   10788     Vector<const char> chars(string_->GetChars() + from_, length_);
   10789     return HEAP->AllocateAsciiSymbol(chars, hash_field_);
   10790   }
   10791 
   10792  private:
   10793   Handle<SeqAsciiString> string_;
   10794   int from_;
   10795   int length_;
   10796   uint32_t hash_field_;
   10797   uint32_t seed_;
   10798 };
   10799 
   10800 
   10801 class TwoByteSymbolKey : public SequentialSymbolKey<uc16> {
   10802  public:
   10803   explicit TwoByteSymbolKey(Vector<const uc16> str, uint32_t seed)
   10804       : SequentialSymbolKey<uc16>(str, seed) { }
   10805 
   10806   bool IsMatch(Object* string) {
   10807     return String::cast(string)->IsTwoByteEqualTo(string_);
   10808   }
   10809 
   10810   MaybeObject* AsObject() {
   10811     if (hash_field_ == 0) Hash();
   10812     return HEAP->AllocateTwoByteSymbol(string_, hash_field_);
   10813   }
   10814 };
   10815 
   10816 
   10817 // SymbolKey carries a string/symbol object as key.
   10818 class SymbolKey : public HashTableKey {
   10819  public:
   10820   explicit SymbolKey(String* string)
   10821       : string_(string) { }
   10822 
   10823   bool IsMatch(Object* string) {
   10824     return String::cast(string)->Equals(string_);
   10825   }
   10826 
   10827   uint32_t Hash() { return string_->Hash(); }
   10828 
   10829   uint32_t HashForObject(Object* other) {
   10830     return String::cast(other)->Hash();
   10831   }
   10832 
   10833   MaybeObject* AsObject() {
   10834     // Attempt to flatten the string, so that symbols will most often
   10835     // be flat strings.
   10836     string_ = string_->TryFlattenGetString();
   10837     Heap* heap = string_->GetHeap();
   10838     // Transform string to symbol if possible.
   10839     Map* map = heap->SymbolMapForString(string_);
   10840     if (map != NULL) {
   10841       string_->set_map_no_write_barrier(map);
   10842       ASSERT(string_->IsSymbol());
   10843       return string_;
   10844     }
   10845     // Otherwise allocate a new symbol.
   10846     StringInputBuffer buffer(string_);
   10847     return heap->AllocateInternalSymbol(&buffer,
   10848                                         string_->length(),
   10849                                         string_->hash_field());
   10850   }
   10851 
   10852   static uint32_t StringHash(Object* obj) {
   10853     return String::cast(obj)->Hash();
   10854   }
   10855 
   10856   String* string_;
   10857 };
   10858 
   10859 
   10860 template<typename Shape, typename Key>
   10861 void HashTable<Shape, Key>::IteratePrefix(ObjectVisitor* v) {
   10862   IteratePointers(v, 0, kElementsStartOffset);
   10863 }
   10864 
   10865 
   10866 template<typename Shape, typename Key>
   10867 void HashTable<Shape, Key>::IterateElements(ObjectVisitor* v) {
   10868   IteratePointers(v,
   10869                   kElementsStartOffset,
   10870                   kHeaderSize + length() * kPointerSize);
   10871 }
   10872 
   10873 
   10874 template<typename Shape, typename Key>
   10875 MaybeObject* HashTable<Shape, Key>::Allocate(int at_least_space_for,
   10876                                              PretenureFlag pretenure) {
   10877   int capacity = ComputeCapacity(at_least_space_for);
   10878   if (capacity > HashTable::kMaxCapacity) {
   10879     return Failure::OutOfMemoryException();
   10880   }
   10881 
   10882   Object* obj;
   10883   { MaybeObject* maybe_obj = Isolate::Current()->heap()->
   10884         AllocateHashTable(EntryToIndex(capacity), pretenure);
   10885     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   10886   }
   10887   HashTable::cast(obj)->SetNumberOfElements(0);
   10888   HashTable::cast(obj)->SetNumberOfDeletedElements(0);
   10889   HashTable::cast(obj)->SetCapacity(capacity);
   10890   return obj;
   10891 }
   10892 
   10893 
   10894 // Find entry for key otherwise return kNotFound.
   10895 int StringDictionary::FindEntry(String* key) {
   10896   if (!key->IsSymbol()) {
   10897     return HashTable<StringDictionaryShape, String*>::FindEntry(key);
   10898   }
   10899 
   10900   // Optimized for symbol key. Knowledge of the key type allows:
   10901   // 1. Move the check if the key is a symbol out of the loop.
   10902   // 2. Avoid comparing hash codes in symbol to symbol comparison.
   10903   // 3. Detect a case when a dictionary key is not a symbol but the key is.
   10904   //    In case of positive result the dictionary key may be replaced by
   10905   //    the symbol with minimal performance penalty. It gives a chance to
   10906   //    perform further lookups in code stubs (and significant performance boost
   10907   //    a certain style of code).
   10908 
   10909   // EnsureCapacity will guarantee the hash table is never full.
   10910   uint32_t capacity = Capacity();
   10911   uint32_t entry = FirstProbe(key->Hash(), capacity);
   10912   uint32_t count = 1;
   10913 
   10914   while (true) {
   10915     int index = EntryToIndex(entry);
   10916     Object* element = get(index);
   10917     if (element->IsUndefined()) break;  // Empty entry.
   10918     if (key == element) return entry;
   10919     if (!element->IsSymbol() &&
   10920         !element->IsTheHole() &&
   10921         String::cast(element)->Equals(key)) {
   10922       // Replace a non-symbol key by the equivalent symbol for faster further
   10923       // lookups.
   10924       set(index, key);
   10925       return entry;
   10926     }
   10927     ASSERT(element->IsTheHole() || !String::cast(element)->Equals(key));
   10928     entry = NextProbe(entry, count++, capacity);
   10929   }
   10930   return kNotFound;
   10931 }
   10932 
   10933 
   10934 bool StringDictionary::ContainsTransition(int entry) {
   10935   switch (DetailsAt(entry).type()) {
   10936     case MAP_TRANSITION:
   10937     case CONSTANT_TRANSITION:
   10938     case ELEMENTS_TRANSITION:
   10939       return true;
   10940     case CALLBACKS: {
   10941       Object* value = ValueAt(entry);
   10942       if (!value->IsAccessorPair()) return false;
   10943       AccessorPair* accessors = AccessorPair::cast(value);
   10944       return accessors->getter()->IsMap() || accessors->setter()->IsMap();
   10945     }
   10946     case NORMAL:
   10947     case FIELD:
   10948     case CONSTANT_FUNCTION:
   10949     case HANDLER:
   10950     case INTERCEPTOR:
   10951     case NULL_DESCRIPTOR:
   10952       return false;
   10953   }
   10954   UNREACHABLE();  // Keep the compiler happy.
   10955   return false;
   10956 }
   10957 
   10958 
   10959 template<typename Shape, typename Key>
   10960 MaybeObject* HashTable<Shape, Key>::Rehash(HashTable* new_table, Key key) {
   10961   ASSERT(NumberOfElements() < new_table->Capacity());
   10962 
   10963   AssertNoAllocation no_gc;
   10964   WriteBarrierMode mode = new_table->GetWriteBarrierMode(no_gc);
   10965 
   10966   // Copy prefix to new array.
   10967   for (int i = kPrefixStartIndex;
   10968        i < kPrefixStartIndex + Shape::kPrefixSize;
   10969        i++) {
   10970     new_table->set(i, get(i), mode);
   10971   }
   10972 
   10973   // Rehash the elements.
   10974   int capacity = Capacity();
   10975   for (int i = 0; i < capacity; i++) {
   10976     uint32_t from_index = EntryToIndex(i);
   10977     Object* k = get(from_index);
   10978     if (IsKey(k)) {
   10979       uint32_t hash = HashTable<Shape, Key>::HashForObject(key, k);
   10980       uint32_t insertion_index =
   10981           EntryToIndex(new_table->FindInsertionEntry(hash));
   10982       for (int j = 0; j < Shape::kEntrySize; j++) {
   10983         new_table->set(insertion_index + j, get(from_index + j), mode);
   10984       }
   10985     }
   10986   }
   10987   new_table->SetNumberOfElements(NumberOfElements());
   10988   new_table->SetNumberOfDeletedElements(0);
   10989   return new_table;
   10990 }
   10991 
   10992 
   10993 template<typename Shape, typename Key>
   10994 MaybeObject* HashTable<Shape, Key>::EnsureCapacity(int n, Key key) {
   10995   int capacity = Capacity();
   10996   int nof = NumberOfElements() + n;
   10997   int nod = NumberOfDeletedElements();
   10998   // Return if:
   10999   //   50% is still free after adding n elements and
   11000   //   at most 50% of the free elements are deleted elements.
   11001   if (nod <= (capacity - nof) >> 1) {
   11002     int needed_free = nof >> 1;
   11003     if (nof + needed_free <= capacity) return this;
   11004   }
   11005 
   11006   const int kMinCapacityForPretenure = 256;
   11007   bool pretenure =
   11008       (capacity > kMinCapacityForPretenure) && !GetHeap()->InNewSpace(this);
   11009   Object* obj;
   11010   { MaybeObject* maybe_obj =
   11011         Allocate(nof * 2, pretenure ? TENURED : NOT_TENURED);
   11012     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11013   }
   11014 
   11015   return Rehash(HashTable::cast(obj), key);
   11016 }
   11017 
   11018 
   11019 template<typename Shape, typename Key>
   11020 MaybeObject* HashTable<Shape, Key>::Shrink(Key key) {
   11021   int capacity = Capacity();
   11022   int nof = NumberOfElements();
   11023 
   11024   // Shrink to fit the number of elements if only a quarter of the
   11025   // capacity is filled with elements.
   11026   if (nof > (capacity >> 2)) return this;
   11027   // Allocate a new dictionary with room for at least the current
   11028   // number of elements. The allocation method will make sure that
   11029   // there is extra room in the dictionary for additions. Don't go
   11030   // lower than room for 16 elements.
   11031   int at_least_room_for = nof;
   11032   if (at_least_room_for < 16) return this;
   11033 
   11034   const int kMinCapacityForPretenure = 256;
   11035   bool pretenure =
   11036       (at_least_room_for > kMinCapacityForPretenure) &&
   11037       !GetHeap()->InNewSpace(this);
   11038   Object* obj;
   11039   { MaybeObject* maybe_obj =
   11040         Allocate(at_least_room_for, pretenure ? TENURED : NOT_TENURED);
   11041     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11042   }
   11043 
   11044   return Rehash(HashTable::cast(obj), key);
   11045 }
   11046 
   11047 
   11048 template<typename Shape, typename Key>
   11049 uint32_t HashTable<Shape, Key>::FindInsertionEntry(uint32_t hash) {
   11050   uint32_t capacity = Capacity();
   11051   uint32_t entry = FirstProbe(hash, capacity);
   11052   uint32_t count = 1;
   11053   // EnsureCapacity will guarantee the hash table is never full.
   11054   while (true) {
   11055     Object* element = KeyAt(entry);
   11056     if (element->IsUndefined() || element->IsTheHole()) break;
   11057     entry = NextProbe(entry, count++, capacity);
   11058   }
   11059   return entry;
   11060 }
   11061 
   11062 // Force instantiation of template instances class.
   11063 // Please note this list is compiler dependent.
   11064 
   11065 template class HashTable<SymbolTableShape, HashTableKey*>;
   11066 
   11067 template class HashTable<CompilationCacheShape, HashTableKey*>;
   11068 
   11069 template class HashTable<MapCacheShape, HashTableKey*>;
   11070 
   11071 template class HashTable<ObjectHashTableShape<1>, Object*>;
   11072 
   11073 template class HashTable<ObjectHashTableShape<2>, Object*>;
   11074 
   11075 template class Dictionary<StringDictionaryShape, String*>;
   11076 
   11077 template class Dictionary<SeededNumberDictionaryShape, uint32_t>;
   11078 
   11079 template class Dictionary<UnseededNumberDictionaryShape, uint32_t>;
   11080 
   11081 template MaybeObject* Dictionary<SeededNumberDictionaryShape, uint32_t>::
   11082     Allocate(int at_least_space_for);
   11083 
   11084 template MaybeObject* Dictionary<UnseededNumberDictionaryShape, uint32_t>::
   11085     Allocate(int at_least_space_for);
   11086 
   11087 template MaybeObject* Dictionary<StringDictionaryShape, String*>::Allocate(
   11088     int);
   11089 
   11090 template MaybeObject* Dictionary<SeededNumberDictionaryShape, uint32_t>::AtPut(
   11091     uint32_t, Object*);
   11092 
   11093 template MaybeObject* Dictionary<UnseededNumberDictionaryShape, uint32_t>::
   11094     AtPut(uint32_t, Object*);
   11095 
   11096 template Object* Dictionary<SeededNumberDictionaryShape, uint32_t>::
   11097     SlowReverseLookup(Object* value);
   11098 
   11099 template Object* Dictionary<UnseededNumberDictionaryShape, uint32_t>::
   11100     SlowReverseLookup(Object* value);
   11101 
   11102 template Object* Dictionary<StringDictionaryShape, String*>::SlowReverseLookup(
   11103     Object*);
   11104 
   11105 template void Dictionary<SeededNumberDictionaryShape, uint32_t>::CopyKeysTo(
   11106     FixedArray*,
   11107     PropertyAttributes,
   11108     Dictionary<SeededNumberDictionaryShape, uint32_t>::SortMode);
   11109 
   11110 template Object* Dictionary<StringDictionaryShape, String*>::DeleteProperty(
   11111     int, JSObject::DeleteMode);
   11112 
   11113 template Object* Dictionary<SeededNumberDictionaryShape, uint32_t>::
   11114     DeleteProperty(int, JSObject::DeleteMode);
   11115 
   11116 template MaybeObject* Dictionary<StringDictionaryShape, String*>::Shrink(
   11117     String*);
   11118 
   11119 template MaybeObject* Dictionary<SeededNumberDictionaryShape, uint32_t>::Shrink(
   11120     uint32_t);
   11121 
   11122 template void Dictionary<StringDictionaryShape, String*>::CopyKeysTo(
   11123     FixedArray*,
   11124     int,
   11125     Dictionary<StringDictionaryShape, String*>::SortMode);
   11126 
   11127 template int
   11128 Dictionary<StringDictionaryShape, String*>::NumberOfElementsFilterAttributes(
   11129     PropertyAttributes);
   11130 
   11131 template MaybeObject* Dictionary<StringDictionaryShape, String*>::Add(
   11132     String*, Object*, PropertyDetails);
   11133 
   11134 template MaybeObject*
   11135 Dictionary<StringDictionaryShape, String*>::GenerateNewEnumerationIndices();
   11136 
   11137 template int
   11138 Dictionary<SeededNumberDictionaryShape, uint32_t>::
   11139     NumberOfElementsFilterAttributes(PropertyAttributes);
   11140 
   11141 template MaybeObject* Dictionary<SeededNumberDictionaryShape, uint32_t>::Add(
   11142     uint32_t, Object*, PropertyDetails);
   11143 
   11144 template MaybeObject* Dictionary<UnseededNumberDictionaryShape, uint32_t>::Add(
   11145     uint32_t, Object*, PropertyDetails);
   11146 
   11147 template MaybeObject* Dictionary<SeededNumberDictionaryShape, uint32_t>::
   11148     EnsureCapacity(int, uint32_t);
   11149 
   11150 template MaybeObject* Dictionary<UnseededNumberDictionaryShape, uint32_t>::
   11151     EnsureCapacity(int, uint32_t);
   11152 
   11153 template MaybeObject* Dictionary<StringDictionaryShape, String*>::
   11154     EnsureCapacity(int, String*);
   11155 
   11156 template MaybeObject* Dictionary<SeededNumberDictionaryShape, uint32_t>::
   11157     AddEntry(uint32_t, Object*, PropertyDetails, uint32_t);
   11158 
   11159 template MaybeObject* Dictionary<UnseededNumberDictionaryShape, uint32_t>::
   11160     AddEntry(uint32_t, Object*, PropertyDetails, uint32_t);
   11161 
   11162 template MaybeObject* Dictionary<StringDictionaryShape, String*>::AddEntry(
   11163     String*, Object*, PropertyDetails, uint32_t);
   11164 
   11165 template
   11166 int Dictionary<SeededNumberDictionaryShape, uint32_t>::NumberOfEnumElements();
   11167 
   11168 template
   11169 int Dictionary<StringDictionaryShape, String*>::NumberOfEnumElements();
   11170 
   11171 template
   11172 int HashTable<SeededNumberDictionaryShape, uint32_t>::FindEntry(uint32_t);
   11173 
   11174 
   11175 // Collates undefined and unexisting elements below limit from position
   11176 // zero of the elements. The object stays in Dictionary mode.
   11177 MaybeObject* JSObject::PrepareSlowElementsForSort(uint32_t limit) {
   11178   ASSERT(HasDictionaryElements());
   11179   // Must stay in dictionary mode, either because of requires_slow_elements,
   11180   // or because we are not going to sort (and therefore compact) all of the
   11181   // elements.
   11182   SeededNumberDictionary* dict = element_dictionary();
   11183   HeapNumber* result_double = NULL;
   11184   if (limit > static_cast<uint32_t>(Smi::kMaxValue)) {
   11185     // Allocate space for result before we start mutating the object.
   11186     Object* new_double;
   11187     { MaybeObject* maybe_new_double = GetHeap()->AllocateHeapNumber(0.0);
   11188       if (!maybe_new_double->ToObject(&new_double)) return maybe_new_double;
   11189     }
   11190     result_double = HeapNumber::cast(new_double);
   11191   }
   11192 
   11193   Object* obj;
   11194   { MaybeObject* maybe_obj =
   11195         SeededNumberDictionary::Allocate(dict->NumberOfElements());
   11196     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11197   }
   11198   SeededNumberDictionary* new_dict = SeededNumberDictionary::cast(obj);
   11199 
   11200   AssertNoAllocation no_alloc;
   11201 
   11202   uint32_t pos = 0;
   11203   uint32_t undefs = 0;
   11204   int capacity = dict->Capacity();
   11205   for (int i = 0; i < capacity; i++) {
   11206     Object* k = dict->KeyAt(i);
   11207     if (dict->IsKey(k)) {
   11208       ASSERT(k->IsNumber());
   11209       ASSERT(!k->IsSmi() || Smi::cast(k)->value() >= 0);
   11210       ASSERT(!k->IsHeapNumber() || HeapNumber::cast(k)->value() >= 0);
   11211       ASSERT(!k->IsHeapNumber() || HeapNumber::cast(k)->value() <= kMaxUInt32);
   11212       Object* value = dict->ValueAt(i);
   11213       PropertyDetails details = dict->DetailsAt(i);
   11214       if (details.type() == CALLBACKS) {
   11215         // Bail out and do the sorting of undefineds and array holes in JS.
   11216         return Smi::FromInt(-1);
   11217       }
   11218       uint32_t key = NumberToUint32(k);
   11219       // In the following we assert that adding the entry to the new dictionary
   11220       // does not cause GC.  This is the case because we made sure to allocate
   11221       // the dictionary big enough above, so it need not grow.
   11222       if (key < limit) {
   11223         if (value->IsUndefined()) {
   11224           undefs++;
   11225         } else {
   11226           if (pos > static_cast<uint32_t>(Smi::kMaxValue)) {
   11227             // Adding an entry with the key beyond smi-range requires
   11228             // allocation. Bailout.
   11229             return Smi::FromInt(-1);
   11230           }
   11231           new_dict->AddNumberEntry(pos, value, details)->ToObjectUnchecked();
   11232           pos++;
   11233         }
   11234       } else {
   11235         if (key > static_cast<uint32_t>(Smi::kMaxValue)) {
   11236           // Adding an entry with the key beyond smi-range requires
   11237           // allocation. Bailout.
   11238           return Smi::FromInt(-1);
   11239         }
   11240         new_dict->AddNumberEntry(key, value, details)->ToObjectUnchecked();
   11241       }
   11242     }
   11243   }
   11244 
   11245   uint32_t result = pos;
   11246   PropertyDetails no_details = PropertyDetails(NONE, NORMAL);
   11247   Heap* heap = GetHeap();
   11248   while (undefs > 0) {
   11249     if (pos > static_cast<uint32_t>(Smi::kMaxValue)) {
   11250       // Adding an entry with the key beyond smi-range requires
   11251       // allocation. Bailout.
   11252       return Smi::FromInt(-1);
   11253     }
   11254     new_dict->AddNumberEntry(pos, heap->undefined_value(), no_details)->
   11255         ToObjectUnchecked();
   11256     pos++;
   11257     undefs--;
   11258   }
   11259 
   11260   set_elements(new_dict);
   11261 
   11262   if (result <= static_cast<uint32_t>(Smi::kMaxValue)) {
   11263     return Smi::FromInt(static_cast<int>(result));
   11264   }
   11265 
   11266   ASSERT_NE(NULL, result_double);
   11267   result_double->set_value(static_cast<double>(result));
   11268   return result_double;
   11269 }
   11270 
   11271 
   11272 // Collects all defined (non-hole) and non-undefined (array) elements at
   11273 // the start of the elements array.
   11274 // If the object is in dictionary mode, it is converted to fast elements
   11275 // mode.
   11276 MaybeObject* JSObject::PrepareElementsForSort(uint32_t limit) {
   11277   Heap* heap = GetHeap();
   11278 
   11279   if (HasDictionaryElements()) {
   11280     // Convert to fast elements containing only the existing properties.
   11281     // Ordering is irrelevant, since we are going to sort anyway.
   11282     SeededNumberDictionary* dict = element_dictionary();
   11283     if (IsJSArray() || dict->requires_slow_elements() ||
   11284         dict->max_number_key() >= limit) {
   11285       return PrepareSlowElementsForSort(limit);
   11286     }
   11287     // Convert to fast elements.
   11288 
   11289     Object* obj;
   11290     { MaybeObject* maybe_obj = GetElementsTransitionMap(GetIsolate(),
   11291                                                         FAST_ELEMENTS);
   11292       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11293     }
   11294     Map* new_map = Map::cast(obj);
   11295 
   11296     PretenureFlag tenure = heap->InNewSpace(this) ? NOT_TENURED: TENURED;
   11297     Object* new_array;
   11298     { MaybeObject* maybe_new_array =
   11299           heap->AllocateFixedArray(dict->NumberOfElements(), tenure);
   11300       if (!maybe_new_array->ToObject(&new_array)) return maybe_new_array;
   11301     }
   11302     FixedArray* fast_elements = FixedArray::cast(new_array);
   11303     dict->CopyValuesTo(fast_elements);
   11304 
   11305     set_map(new_map);
   11306     set_elements(fast_elements);
   11307   } else if (HasExternalArrayElements()) {
   11308     // External arrays cannot have holes or undefined elements.
   11309     return Smi::FromInt(ExternalArray::cast(elements())->length());
   11310   } else if (!HasFastDoubleElements()) {
   11311     Object* obj;
   11312     { MaybeObject* maybe_obj = EnsureWritableFastElements();
   11313       if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11314     }
   11315   }
   11316   ASSERT(HasFastTypeElements() || HasFastDoubleElements());
   11317 
   11318   // Collect holes at the end, undefined before that and the rest at the
   11319   // start, and return the number of non-hole, non-undefined values.
   11320 
   11321   FixedArrayBase* elements_base = FixedArrayBase::cast(this->elements());
   11322   uint32_t elements_length = static_cast<uint32_t>(elements_base->length());
   11323   if (limit > elements_length) {
   11324     limit = elements_length ;
   11325   }
   11326   if (limit == 0) {
   11327     return Smi::FromInt(0);
   11328   }
   11329 
   11330   HeapNumber* result_double = NULL;
   11331   if (limit > static_cast<uint32_t>(Smi::kMaxValue)) {
   11332     // Pessimistically allocate space for return value before
   11333     // we start mutating the array.
   11334     Object* new_double;
   11335     { MaybeObject* maybe_new_double = heap->AllocateHeapNumber(0.0);
   11336       if (!maybe_new_double->ToObject(&new_double)) return maybe_new_double;
   11337     }
   11338     result_double = HeapNumber::cast(new_double);
   11339   }
   11340 
   11341   uint32_t result = 0;
   11342   if (elements_base->map() == heap->fixed_double_array_map()) {
   11343     FixedDoubleArray* elements = FixedDoubleArray::cast(elements_base);
   11344     // Split elements into defined and the_hole, in that order.
   11345     unsigned int holes = limit;
   11346     // Assume most arrays contain no holes and undefined values, so minimize the
   11347     // number of stores of non-undefined, non-the-hole values.
   11348     for (unsigned int i = 0; i < holes; i++) {
   11349       if (elements->is_the_hole(i)) {
   11350         holes--;
   11351       } else {
   11352         continue;
   11353       }
   11354       // Position i needs to be filled.
   11355       while (holes > i) {
   11356         if (elements->is_the_hole(holes)) {
   11357           holes--;
   11358         } else {
   11359           elements->set(i, elements->get_scalar(holes));
   11360           break;
   11361         }
   11362       }
   11363     }
   11364     result = holes;
   11365     while (holes < limit) {
   11366       elements->set_the_hole(holes);
   11367       holes++;
   11368     }
   11369   } else {
   11370     FixedArray* elements = FixedArray::cast(elements_base);
   11371     AssertNoAllocation no_alloc;
   11372 
   11373     // Split elements into defined, undefined and the_hole, in that order.  Only
   11374     // count locations for undefined and the hole, and fill them afterwards.
   11375     WriteBarrierMode write_barrier = elements->GetWriteBarrierMode(no_alloc);
   11376     unsigned int undefs = limit;
   11377     unsigned int holes = limit;
   11378     // Assume most arrays contain no holes and undefined values, so minimize the
   11379     // number of stores of non-undefined, non-the-hole values.
   11380     for (unsigned int i = 0; i < undefs; i++) {
   11381       Object* current = elements->get(i);
   11382       if (current->IsTheHole()) {
   11383         holes--;
   11384         undefs--;
   11385       } else if (current->IsUndefined()) {
   11386         undefs--;
   11387       } else {
   11388         continue;
   11389       }
   11390       // Position i needs to be filled.
   11391       while (undefs > i) {
   11392         current = elements->get(undefs);
   11393         if (current->IsTheHole()) {
   11394           holes--;
   11395           undefs--;
   11396         } else if (current->IsUndefined()) {
   11397           undefs--;
   11398         } else {
   11399           elements->set(i, current, write_barrier);
   11400           break;
   11401         }
   11402       }
   11403     }
   11404     result = undefs;
   11405     while (undefs < holes) {
   11406       elements->set_undefined(undefs);
   11407       undefs++;
   11408     }
   11409     while (holes < limit) {
   11410       elements->set_the_hole(holes);
   11411       holes++;
   11412     }
   11413   }
   11414 
   11415   if (result <= static_cast<uint32_t>(Smi::kMaxValue)) {
   11416     return Smi::FromInt(static_cast<int>(result));
   11417   }
   11418   ASSERT_NE(NULL, result_double);
   11419   result_double->set_value(static_cast<double>(result));
   11420   return result_double;
   11421 }
   11422 
   11423 
   11424 Object* ExternalPixelArray::SetValue(uint32_t index, Object* value) {
   11425   uint8_t clamped_value = 0;
   11426   if (index < static_cast<uint32_t>(length())) {
   11427     if (value->IsSmi()) {
   11428       int int_value = Smi::cast(value)->value();
   11429       if (int_value < 0) {
   11430         clamped_value = 0;
   11431       } else if (int_value > 255) {
   11432         clamped_value = 255;
   11433       } else {
   11434         clamped_value = static_cast<uint8_t>(int_value);
   11435       }
   11436     } else if (value->IsHeapNumber()) {
   11437       double double_value = HeapNumber::cast(value)->value();
   11438       if (!(double_value > 0)) {
   11439         // NaN and less than zero clamp to zero.
   11440         clamped_value = 0;
   11441       } else if (double_value > 255) {
   11442         // Greater than 255 clamp to 255.
   11443         clamped_value = 255;
   11444       } else {
   11445         // Other doubles are rounded to the nearest integer.
   11446         clamped_value = static_cast<uint8_t>(double_value + 0.5);
   11447       }
   11448     } else {
   11449       // Clamp undefined to zero (default). All other types have been
   11450       // converted to a number type further up in the call chain.
   11451       ASSERT(value->IsUndefined());
   11452     }
   11453     set(index, clamped_value);
   11454   }
   11455   return Smi::FromInt(clamped_value);
   11456 }
   11457 
   11458 
   11459 template<typename ExternalArrayClass, typename ValueType>
   11460 static MaybeObject* ExternalArrayIntSetter(Heap* heap,
   11461                                            ExternalArrayClass* receiver,
   11462                                            uint32_t index,
   11463                                            Object* value) {
   11464   ValueType cast_value = 0;
   11465   if (index < static_cast<uint32_t>(receiver->length())) {
   11466     if (value->IsSmi()) {
   11467       int int_value = Smi::cast(value)->value();
   11468       cast_value = static_cast<ValueType>(int_value);
   11469     } else if (value->IsHeapNumber()) {
   11470       double double_value = HeapNumber::cast(value)->value();
   11471       cast_value = static_cast<ValueType>(DoubleToInt32(double_value));
   11472     } else {
   11473       // Clamp undefined to zero (default). All other types have been
   11474       // converted to a number type further up in the call chain.
   11475       ASSERT(value->IsUndefined());
   11476     }
   11477     receiver->set(index, cast_value);
   11478   }
   11479   return heap->NumberFromInt32(cast_value);
   11480 }
   11481 
   11482 
   11483 MaybeObject* ExternalByteArray::SetValue(uint32_t index, Object* value) {
   11484   return ExternalArrayIntSetter<ExternalByteArray, int8_t>
   11485       (GetHeap(), this, index, value);
   11486 }
   11487 
   11488 
   11489 MaybeObject* ExternalUnsignedByteArray::SetValue(uint32_t index,
   11490                                                  Object* value) {
   11491   return ExternalArrayIntSetter<ExternalUnsignedByteArray, uint8_t>
   11492       (GetHeap(), this, index, value);
   11493 }
   11494 
   11495 
   11496 MaybeObject* ExternalShortArray::SetValue(uint32_t index,
   11497                                           Object* value) {
   11498   return ExternalArrayIntSetter<ExternalShortArray, int16_t>
   11499       (GetHeap(), this, index, value);
   11500 }
   11501 
   11502 
   11503 MaybeObject* ExternalUnsignedShortArray::SetValue(uint32_t index,
   11504                                                   Object* value) {
   11505   return ExternalArrayIntSetter<ExternalUnsignedShortArray, uint16_t>
   11506       (GetHeap(), this, index, value);
   11507 }
   11508 
   11509 
   11510 MaybeObject* ExternalIntArray::SetValue(uint32_t index, Object* value) {
   11511   return ExternalArrayIntSetter<ExternalIntArray, int32_t>
   11512       (GetHeap(), this, index, value);
   11513 }
   11514 
   11515 
   11516 MaybeObject* ExternalUnsignedIntArray::SetValue(uint32_t index, Object* value) {
   11517   uint32_t cast_value = 0;
   11518   Heap* heap = GetHeap();
   11519   if (index < static_cast<uint32_t>(length())) {
   11520     if (value->IsSmi()) {
   11521       int int_value = Smi::cast(value)->value();
   11522       cast_value = static_cast<uint32_t>(int_value);
   11523     } else if (value->IsHeapNumber()) {
   11524       double double_value = HeapNumber::cast(value)->value();
   11525       cast_value = static_cast<uint32_t>(DoubleToUint32(double_value));
   11526     } else {
   11527       // Clamp undefined to zero (default). All other types have been
   11528       // converted to a number type further up in the call chain.
   11529       ASSERT(value->IsUndefined());
   11530     }
   11531     set(index, cast_value);
   11532   }
   11533   return heap->NumberFromUint32(cast_value);
   11534 }
   11535 
   11536 
   11537 MaybeObject* ExternalFloatArray::SetValue(uint32_t index, Object* value) {
   11538   float cast_value = static_cast<float>(OS::nan_value());
   11539   Heap* heap = GetHeap();
   11540   if (index < static_cast<uint32_t>(length())) {
   11541     if (value->IsSmi()) {
   11542       int int_value = Smi::cast(value)->value();
   11543       cast_value = static_cast<float>(int_value);
   11544     } else if (value->IsHeapNumber()) {
   11545       double double_value = HeapNumber::cast(value)->value();
   11546       cast_value = static_cast<float>(double_value);
   11547     } else {
   11548       // Clamp undefined to NaN (default). All other types have been
   11549       // converted to a number type further up in the call chain.
   11550       ASSERT(value->IsUndefined());
   11551     }
   11552     set(index, cast_value);
   11553   }
   11554   return heap->AllocateHeapNumber(cast_value);
   11555 }
   11556 
   11557 
   11558 MaybeObject* ExternalDoubleArray::SetValue(uint32_t index, Object* value) {
   11559   double double_value = OS::nan_value();
   11560   Heap* heap = GetHeap();
   11561   if (index < static_cast<uint32_t>(length())) {
   11562     if (value->IsSmi()) {
   11563       int int_value = Smi::cast(value)->value();
   11564       double_value = static_cast<double>(int_value);
   11565     } else if (value->IsHeapNumber()) {
   11566       double_value = HeapNumber::cast(value)->value();
   11567     } else {
   11568       // Clamp undefined to NaN (default). All other types have been
   11569       // converted to a number type further up in the call chain.
   11570       ASSERT(value->IsUndefined());
   11571     }
   11572     set(index, double_value);
   11573   }
   11574   return heap->AllocateHeapNumber(double_value);
   11575 }
   11576 
   11577 
   11578 JSGlobalPropertyCell* GlobalObject::GetPropertyCell(LookupResult* result) {
   11579   ASSERT(!HasFastProperties());
   11580   Object* value = property_dictionary()->ValueAt(result->GetDictionaryEntry());
   11581   return JSGlobalPropertyCell::cast(value);
   11582 }
   11583 
   11584 
   11585 Handle<JSGlobalPropertyCell> GlobalObject::EnsurePropertyCell(
   11586     Handle<GlobalObject> global,
   11587     Handle<String> name) {
   11588   Isolate* isolate = global->GetIsolate();
   11589   CALL_HEAP_FUNCTION(isolate,
   11590                      global->EnsurePropertyCell(*name),
   11591                      JSGlobalPropertyCell);
   11592 }
   11593 
   11594 
   11595 MaybeObject* GlobalObject::EnsurePropertyCell(String* name) {
   11596   ASSERT(!HasFastProperties());
   11597   int entry = property_dictionary()->FindEntry(name);
   11598   if (entry == StringDictionary::kNotFound) {
   11599     Heap* heap = GetHeap();
   11600     Object* cell;
   11601     { MaybeObject* maybe_cell =
   11602           heap->AllocateJSGlobalPropertyCell(heap->the_hole_value());
   11603       if (!maybe_cell->ToObject(&cell)) return maybe_cell;
   11604     }
   11605     PropertyDetails details(NONE, NORMAL);
   11606     details = details.AsDeleted();
   11607     Object* dictionary;
   11608     { MaybeObject* maybe_dictionary =
   11609           property_dictionary()->Add(name, cell, details);
   11610       if (!maybe_dictionary->ToObject(&dictionary)) return maybe_dictionary;
   11611     }
   11612     set_properties(StringDictionary::cast(dictionary));
   11613     return cell;
   11614   } else {
   11615     Object* value = property_dictionary()->ValueAt(entry);
   11616     ASSERT(value->IsJSGlobalPropertyCell());
   11617     return value;
   11618   }
   11619 }
   11620 
   11621 
   11622 MaybeObject* SymbolTable::LookupString(String* string, Object** s) {
   11623   SymbolKey key(string);
   11624   return LookupKey(&key, s);
   11625 }
   11626 
   11627 
   11628 // This class is used for looking up two character strings in the symbol table.
   11629 // If we don't have a hit we don't want to waste much time so we unroll the
   11630 // string hash calculation loop here for speed.  Doesn't work if the two
   11631 // characters form a decimal integer, since such strings have a different hash
   11632 // algorithm.
   11633 class TwoCharHashTableKey : public HashTableKey {
   11634  public:
   11635   TwoCharHashTableKey(uint32_t c1, uint32_t c2, uint32_t seed)
   11636     : c1_(c1), c2_(c2) {
   11637     // Char 1.
   11638     uint32_t hash = seed;
   11639     hash += c1;
   11640     hash += hash << 10;
   11641     hash ^= hash >> 6;
   11642     // Char 2.
   11643     hash += c2;
   11644     hash += hash << 10;
   11645     hash ^= hash >> 6;
   11646     // GetHash.
   11647     hash += hash << 3;
   11648     hash ^= hash >> 11;
   11649     hash += hash << 15;
   11650     if ((hash & String::kHashBitMask) == 0) hash = String::kZeroHash;
   11651 #ifdef DEBUG
   11652     StringHasher hasher(2, seed);
   11653     hasher.AddCharacter(c1);
   11654     hasher.AddCharacter(c2);
   11655     // If this assert fails then we failed to reproduce the two-character
   11656     // version of the string hashing algorithm above.  One reason could be
   11657     // that we were passed two digits as characters, since the hash
   11658     // algorithm is different in that case.
   11659     ASSERT_EQ(static_cast<int>(hasher.GetHash()), static_cast<int>(hash));
   11660 #endif
   11661     hash_ = hash;
   11662   }
   11663 
   11664   bool IsMatch(Object* o) {
   11665     if (!o->IsString()) return false;
   11666     String* other = String::cast(o);
   11667     if (other->length() != 2) return false;
   11668     if (other->Get(0) != c1_) return false;
   11669     return other->Get(1) == c2_;
   11670   }
   11671 
   11672   uint32_t Hash() { return hash_; }
   11673   uint32_t HashForObject(Object* key) {
   11674     if (!key->IsString()) return 0;
   11675     return String::cast(key)->Hash();
   11676   }
   11677 
   11678   Object* AsObject() {
   11679     // The TwoCharHashTableKey is only used for looking in the symbol
   11680     // table, not for adding to it.
   11681     UNREACHABLE();
   11682     return NULL;
   11683   }
   11684 
   11685  private:
   11686   uint32_t c1_;
   11687   uint32_t c2_;
   11688   uint32_t hash_;
   11689 };
   11690 
   11691 
   11692 bool SymbolTable::LookupSymbolIfExists(String* string, String** symbol) {
   11693   SymbolKey key(string);
   11694   int entry = FindEntry(&key);
   11695   if (entry == kNotFound) {
   11696     return false;
   11697   } else {
   11698     String* result = String::cast(KeyAt(entry));
   11699     ASSERT(StringShape(result).IsSymbol());
   11700     *symbol = result;
   11701     return true;
   11702   }
   11703 }
   11704 
   11705 
   11706 bool SymbolTable::LookupTwoCharsSymbolIfExists(uint32_t c1,
   11707                                                uint32_t c2,
   11708                                                String** symbol) {
   11709   TwoCharHashTableKey key(c1, c2, GetHeap()->HashSeed());
   11710   int entry = FindEntry(&key);
   11711   if (entry == kNotFound) {
   11712     return false;
   11713   } else {
   11714     String* result = String::cast(KeyAt(entry));
   11715     ASSERT(StringShape(result).IsSymbol());
   11716     *symbol = result;
   11717     return true;
   11718   }
   11719 }
   11720 
   11721 
   11722 MaybeObject* SymbolTable::LookupSymbol(Vector<const char> str,
   11723                                        Object** s) {
   11724   Utf8SymbolKey key(str, GetHeap()->HashSeed());
   11725   return LookupKey(&key, s);
   11726 }
   11727 
   11728 
   11729 MaybeObject* SymbolTable::LookupAsciiSymbol(Vector<const char> str,
   11730                                             Object** s) {
   11731   AsciiSymbolKey key(str, GetHeap()->HashSeed());
   11732   return LookupKey(&key, s);
   11733 }
   11734 
   11735 
   11736 MaybeObject* SymbolTable::LookupSubStringAsciiSymbol(Handle<SeqAsciiString> str,
   11737                                                      int from,
   11738                                                      int length,
   11739                                                      Object** s) {
   11740   SubStringAsciiSymbolKey key(str, from, length, GetHeap()->HashSeed());
   11741   return LookupKey(&key, s);
   11742 }
   11743 
   11744 
   11745 MaybeObject* SymbolTable::LookupTwoByteSymbol(Vector<const uc16> str,
   11746                                               Object** s) {
   11747   TwoByteSymbolKey key(str, GetHeap()->HashSeed());
   11748   return LookupKey(&key, s);
   11749 }
   11750 
   11751 MaybeObject* SymbolTable::LookupKey(HashTableKey* key, Object** s) {
   11752   int entry = FindEntry(key);
   11753 
   11754   // Symbol already in table.
   11755   if (entry != kNotFound) {
   11756     *s = KeyAt(entry);
   11757     return this;
   11758   }
   11759 
   11760   // Adding new symbol. Grow table if needed.
   11761   Object* obj;
   11762   { MaybeObject* maybe_obj = EnsureCapacity(1, key);
   11763     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11764   }
   11765 
   11766   // Create symbol object.
   11767   Object* symbol;
   11768   { MaybeObject* maybe_symbol = key->AsObject();
   11769     if (!maybe_symbol->ToObject(&symbol)) return maybe_symbol;
   11770   }
   11771 
   11772   // If the symbol table grew as part of EnsureCapacity, obj is not
   11773   // the current symbol table and therefore we cannot use
   11774   // SymbolTable::cast here.
   11775   SymbolTable* table = reinterpret_cast<SymbolTable*>(obj);
   11776 
   11777   // Add the new symbol and return it along with the symbol table.
   11778   entry = table->FindInsertionEntry(key->Hash());
   11779   table->set(EntryToIndex(entry), symbol);
   11780   table->ElementAdded();
   11781   *s = symbol;
   11782   return table;
   11783 }
   11784 
   11785 
   11786 Object* CompilationCacheTable::Lookup(String* src) {
   11787   StringKey key(src);
   11788   int entry = FindEntry(&key);
   11789   if (entry == kNotFound) return GetHeap()->undefined_value();
   11790   return get(EntryToIndex(entry) + 1);
   11791 }
   11792 
   11793 
   11794 Object* CompilationCacheTable::LookupEval(String* src,
   11795                                           Context* context,
   11796                                           LanguageMode language_mode,
   11797                                           int scope_position) {
   11798   StringSharedKey key(src,
   11799                       context->closure()->shared(),
   11800                       language_mode,
   11801                       scope_position);
   11802   int entry = FindEntry(&key);
   11803   if (entry == kNotFound) return GetHeap()->undefined_value();
   11804   return get(EntryToIndex(entry) + 1);
   11805 }
   11806 
   11807 
   11808 Object* CompilationCacheTable::LookupRegExp(String* src,
   11809                                             JSRegExp::Flags flags) {
   11810   RegExpKey key(src, flags);
   11811   int entry = FindEntry(&key);
   11812   if (entry == kNotFound) return GetHeap()->undefined_value();
   11813   return get(EntryToIndex(entry) + 1);
   11814 }
   11815 
   11816 
   11817 MaybeObject* CompilationCacheTable::Put(String* src, Object* value) {
   11818   StringKey key(src);
   11819   Object* obj;
   11820   { MaybeObject* maybe_obj = EnsureCapacity(1, &key);
   11821     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11822   }
   11823 
   11824   CompilationCacheTable* cache =
   11825       reinterpret_cast<CompilationCacheTable*>(obj);
   11826   int entry = cache->FindInsertionEntry(key.Hash());
   11827   cache->set(EntryToIndex(entry), src);
   11828   cache->set(EntryToIndex(entry) + 1, value);
   11829   cache->ElementAdded();
   11830   return cache;
   11831 }
   11832 
   11833 
   11834 MaybeObject* CompilationCacheTable::PutEval(String* src,
   11835                                             Context* context,
   11836                                             SharedFunctionInfo* value,
   11837                                             int scope_position) {
   11838   StringSharedKey key(src,
   11839                       context->closure()->shared(),
   11840                       value->language_mode(),
   11841                       scope_position);
   11842   Object* obj;
   11843   { MaybeObject* maybe_obj = EnsureCapacity(1, &key);
   11844     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11845   }
   11846 
   11847   CompilationCacheTable* cache =
   11848       reinterpret_cast<CompilationCacheTable*>(obj);
   11849   int entry = cache->FindInsertionEntry(key.Hash());
   11850 
   11851   Object* k;
   11852   { MaybeObject* maybe_k = key.AsObject();
   11853     if (!maybe_k->ToObject(&k)) return maybe_k;
   11854   }
   11855 
   11856   cache->set(EntryToIndex(entry), k);
   11857   cache->set(EntryToIndex(entry) + 1, value);
   11858   cache->ElementAdded();
   11859   return cache;
   11860 }
   11861 
   11862 
   11863 MaybeObject* CompilationCacheTable::PutRegExp(String* src,
   11864                                               JSRegExp::Flags flags,
   11865                                               FixedArray* value) {
   11866   RegExpKey key(src, flags);
   11867   Object* obj;
   11868   { MaybeObject* maybe_obj = EnsureCapacity(1, &key);
   11869     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11870   }
   11871 
   11872   CompilationCacheTable* cache =
   11873       reinterpret_cast<CompilationCacheTable*>(obj);
   11874   int entry = cache->FindInsertionEntry(key.Hash());
   11875   // We store the value in the key slot, and compare the search key
   11876   // to the stored value with a custon IsMatch function during lookups.
   11877   cache->set(EntryToIndex(entry), value);
   11878   cache->set(EntryToIndex(entry) + 1, value);
   11879   cache->ElementAdded();
   11880   return cache;
   11881 }
   11882 
   11883 
   11884 void CompilationCacheTable::Remove(Object* value) {
   11885   Object* the_hole_value = GetHeap()->the_hole_value();
   11886   for (int entry = 0, size = Capacity(); entry < size; entry++) {
   11887     int entry_index = EntryToIndex(entry);
   11888     int value_index = entry_index + 1;
   11889     if (get(value_index) == value) {
   11890       NoWriteBarrierSet(this, entry_index, the_hole_value);
   11891       NoWriteBarrierSet(this, value_index, the_hole_value);
   11892       ElementRemoved();
   11893     }
   11894   }
   11895   return;
   11896 }
   11897 
   11898 
   11899 // SymbolsKey used for HashTable where key is array of symbols.
   11900 class SymbolsKey : public HashTableKey {
   11901  public:
   11902   explicit SymbolsKey(FixedArray* symbols) : symbols_(symbols) { }
   11903 
   11904   bool IsMatch(Object* symbols) {
   11905     FixedArray* o = FixedArray::cast(symbols);
   11906     int len = symbols_->length();
   11907     if (o->length() != len) return false;
   11908     for (int i = 0; i < len; i++) {
   11909       if (o->get(i) != symbols_->get(i)) return false;
   11910     }
   11911     return true;
   11912   }
   11913 
   11914   uint32_t Hash() { return HashForObject(symbols_); }
   11915 
   11916   uint32_t HashForObject(Object* obj) {
   11917     FixedArray* symbols = FixedArray::cast(obj);
   11918     int len = symbols->length();
   11919     uint32_t hash = 0;
   11920     for (int i = 0; i < len; i++) {
   11921       hash ^= String::cast(symbols->get(i))->Hash();
   11922     }
   11923     return hash;
   11924   }
   11925 
   11926   Object* AsObject() { return symbols_; }
   11927 
   11928  private:
   11929   FixedArray* symbols_;
   11930 };
   11931 
   11932 
   11933 Object* MapCache::Lookup(FixedArray* array) {
   11934   SymbolsKey key(array);
   11935   int entry = FindEntry(&key);
   11936   if (entry == kNotFound) return GetHeap()->undefined_value();
   11937   return get(EntryToIndex(entry) + 1);
   11938 }
   11939 
   11940 
   11941 MaybeObject* MapCache::Put(FixedArray* array, Map* value) {
   11942   SymbolsKey key(array);
   11943   Object* obj;
   11944   { MaybeObject* maybe_obj = EnsureCapacity(1, &key);
   11945     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11946   }
   11947 
   11948   MapCache* cache = reinterpret_cast<MapCache*>(obj);
   11949   int entry = cache->FindInsertionEntry(key.Hash());
   11950   cache->set(EntryToIndex(entry), array);
   11951   cache->set(EntryToIndex(entry) + 1, value);
   11952   cache->ElementAdded();
   11953   return cache;
   11954 }
   11955 
   11956 
   11957 template<typename Shape, typename Key>
   11958 MaybeObject* Dictionary<Shape, Key>::Allocate(int at_least_space_for) {
   11959   Object* obj;
   11960   { MaybeObject* maybe_obj =
   11961         HashTable<Shape, Key>::Allocate(at_least_space_for);
   11962     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11963   }
   11964   // Initialize the next enumeration index.
   11965   Dictionary<Shape, Key>::cast(obj)->
   11966       SetNextEnumerationIndex(PropertyDetails::kInitialIndex);
   11967   return obj;
   11968 }
   11969 
   11970 
   11971 template<typename Shape, typename Key>
   11972 MaybeObject* Dictionary<Shape, Key>::GenerateNewEnumerationIndices() {
   11973   Heap* heap = Dictionary<Shape, Key>::GetHeap();
   11974   int length = HashTable<Shape, Key>::NumberOfElements();
   11975 
   11976   // Allocate and initialize iteration order array.
   11977   Object* obj;
   11978   { MaybeObject* maybe_obj = heap->AllocateFixedArray(length);
   11979     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11980   }
   11981   FixedArray* iteration_order = FixedArray::cast(obj);
   11982   for (int i = 0; i < length; i++) {
   11983     iteration_order->set(i, Smi::FromInt(i));
   11984   }
   11985 
   11986   // Allocate array with enumeration order.
   11987   { MaybeObject* maybe_obj = heap->AllocateFixedArray(length);
   11988     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   11989   }
   11990   FixedArray* enumeration_order = FixedArray::cast(obj);
   11991 
   11992   // Fill the enumeration order array with property details.
   11993   int capacity = HashTable<Shape, Key>::Capacity();
   11994   int pos = 0;
   11995   for (int i = 0; i < capacity; i++) {
   11996     if (Dictionary<Shape, Key>::IsKey(Dictionary<Shape, Key>::KeyAt(i))) {
   11997       enumeration_order->set(pos++, Smi::FromInt(DetailsAt(i).index()));
   11998     }
   11999   }
   12000 
   12001   // Sort the arrays wrt. enumeration order.
   12002   iteration_order->SortPairs(enumeration_order, enumeration_order->length());
   12003 
   12004   // Overwrite the enumeration_order with the enumeration indices.
   12005   for (int i = 0; i < length; i++) {
   12006     int index = Smi::cast(iteration_order->get(i))->value();
   12007     int enum_index = PropertyDetails::kInitialIndex + i;
   12008     enumeration_order->set(index, Smi::FromInt(enum_index));
   12009   }
   12010 
   12011   // Update the dictionary with new indices.
   12012   capacity = HashTable<Shape, Key>::Capacity();
   12013   pos = 0;
   12014   for (int i = 0; i < capacity; i++) {
   12015     if (Dictionary<Shape, Key>::IsKey(Dictionary<Shape, Key>::KeyAt(i))) {
   12016       int enum_index = Smi::cast(enumeration_order->get(pos++))->value();
   12017       PropertyDetails details = DetailsAt(i);
   12018       PropertyDetails new_details =
   12019           PropertyDetails(details.attributes(), details.type(), enum_index);
   12020       DetailsAtPut(i, new_details);
   12021     }
   12022   }
   12023 
   12024   // Set the next enumeration index.
   12025   SetNextEnumerationIndex(PropertyDetails::kInitialIndex+length);
   12026   return this;
   12027 }
   12028 
   12029 template<typename Shape, typename Key>
   12030 MaybeObject* Dictionary<Shape, Key>::EnsureCapacity(int n, Key key) {
   12031   // Check whether there are enough enumeration indices to add n elements.
   12032   if (Shape::kIsEnumerable &&
   12033       !PropertyDetails::IsValidIndex(NextEnumerationIndex() + n)) {
   12034     // If not, we generate new indices for the properties.
   12035     Object* result;
   12036     { MaybeObject* maybe_result = GenerateNewEnumerationIndices();
   12037       if (!maybe_result->ToObject(&result)) return maybe_result;
   12038     }
   12039   }
   12040   return HashTable<Shape, Key>::EnsureCapacity(n, key);
   12041 }
   12042 
   12043 
   12044 template<typename Shape, typename Key>
   12045 Object* Dictionary<Shape, Key>::DeleteProperty(int entry,
   12046                                                JSReceiver::DeleteMode mode) {
   12047   Heap* heap = Dictionary<Shape, Key>::GetHeap();
   12048   PropertyDetails details = DetailsAt(entry);
   12049   // Ignore attributes if forcing a deletion.
   12050   if (details.IsDontDelete() && mode != JSReceiver::FORCE_DELETION) {
   12051     return heap->false_value();
   12052   }
   12053   SetEntry(entry, heap->the_hole_value(), heap->the_hole_value());
   12054   HashTable<Shape, Key>::ElementRemoved();
   12055   return heap->true_value();
   12056 }
   12057 
   12058 
   12059 template<typename Shape, typename Key>
   12060 MaybeObject* Dictionary<Shape, Key>::Shrink(Key key) {
   12061   return HashTable<Shape, Key>::Shrink(key);
   12062 }
   12063 
   12064 
   12065 template<typename Shape, typename Key>
   12066 MaybeObject* Dictionary<Shape, Key>::AtPut(Key key, Object* value) {
   12067   int entry = this->FindEntry(key);
   12068 
   12069   // If the entry is present set the value;
   12070   if (entry != Dictionary<Shape, Key>::kNotFound) {
   12071     ValueAtPut(entry, value);
   12072     return this;
   12073   }
   12074 
   12075   // Check whether the dictionary should be extended.
   12076   Object* obj;
   12077   { MaybeObject* maybe_obj = EnsureCapacity(1, key);
   12078     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   12079   }
   12080 
   12081   Object* k;
   12082   { MaybeObject* maybe_k = Shape::AsObject(key);
   12083     if (!maybe_k->ToObject(&k)) return maybe_k;
   12084   }
   12085   PropertyDetails details = PropertyDetails(NONE, NORMAL);
   12086 
   12087   return Dictionary<Shape, Key>::cast(obj)->AddEntry(key, value, details,
   12088       Dictionary<Shape, Key>::Hash(key));
   12089 }
   12090 
   12091 
   12092 template<typename Shape, typename Key>
   12093 MaybeObject* Dictionary<Shape, Key>::Add(Key key,
   12094                                          Object* value,
   12095                                          PropertyDetails details) {
   12096   // Valdate key is absent.
   12097   SLOW_ASSERT((this->FindEntry(key) == Dictionary<Shape, Key>::kNotFound));
   12098   // Check whether the dictionary should be extended.
   12099   Object* obj;
   12100   { MaybeObject* maybe_obj = EnsureCapacity(1, key);
   12101     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   12102   }
   12103 
   12104   return Dictionary<Shape, Key>::cast(obj)->AddEntry(key, value, details,
   12105       Dictionary<Shape, Key>::Hash(key));
   12106 }
   12107 
   12108 
   12109 // Add a key, value pair to the dictionary.
   12110 template<typename Shape, typename Key>
   12111 MaybeObject* Dictionary<Shape, Key>::AddEntry(Key key,
   12112                                               Object* value,
   12113                                               PropertyDetails details,
   12114                                               uint32_t hash) {
   12115   // Compute the key object.
   12116   Object* k;
   12117   { MaybeObject* maybe_k = Shape::AsObject(key);
   12118     if (!maybe_k->ToObject(&k)) return maybe_k;
   12119   }
   12120 
   12121   uint32_t entry = Dictionary<Shape, Key>::FindInsertionEntry(hash);
   12122   // Insert element at empty or deleted entry
   12123   if (!details.IsDeleted() && details.index() == 0 && Shape::kIsEnumerable) {
   12124     // Assign an enumeration index to the property and update
   12125     // SetNextEnumerationIndex.
   12126     int index = NextEnumerationIndex();
   12127     details = PropertyDetails(details.attributes(), details.type(), index);
   12128     SetNextEnumerationIndex(index + 1);
   12129   }
   12130   SetEntry(entry, k, value, details);
   12131   ASSERT((Dictionary<Shape, Key>::KeyAt(entry)->IsNumber()
   12132           || Dictionary<Shape, Key>::KeyAt(entry)->IsString()));
   12133   HashTable<Shape, Key>::ElementAdded();
   12134   return this;
   12135 }
   12136 
   12137 
   12138 void SeededNumberDictionary::UpdateMaxNumberKey(uint32_t key) {
   12139   // If the dictionary requires slow elements an element has already
   12140   // been added at a high index.
   12141   if (requires_slow_elements()) return;
   12142   // Check if this index is high enough that we should require slow
   12143   // elements.
   12144   if (key > kRequiresSlowElementsLimit) {
   12145     set_requires_slow_elements();
   12146     return;
   12147   }
   12148   // Update max key value.
   12149   Object* max_index_object = get(kMaxNumberKeyIndex);
   12150   if (!max_index_object->IsSmi() || max_number_key() < key) {
   12151     FixedArray::set(kMaxNumberKeyIndex,
   12152                     Smi::FromInt(key << kRequiresSlowElementsTagSize));
   12153   }
   12154 }
   12155 
   12156 
   12157 MaybeObject* SeededNumberDictionary::AddNumberEntry(uint32_t key,
   12158                                                     Object* value,
   12159                                                     PropertyDetails details) {
   12160   UpdateMaxNumberKey(key);
   12161   SLOW_ASSERT(this->FindEntry(key) == kNotFound);
   12162   return Add(key, value, details);
   12163 }
   12164 
   12165 
   12166 MaybeObject* UnseededNumberDictionary::AddNumberEntry(uint32_t key,
   12167                                                       Object* value) {
   12168   SLOW_ASSERT(this->FindEntry(key) == kNotFound);
   12169   return Add(key, value, PropertyDetails(NONE, NORMAL));
   12170 }
   12171 
   12172 
   12173 MaybeObject* SeededNumberDictionary::AtNumberPut(uint32_t key, Object* value) {
   12174   UpdateMaxNumberKey(key);
   12175   return AtPut(key, value);
   12176 }
   12177 
   12178 
   12179 MaybeObject* UnseededNumberDictionary::AtNumberPut(uint32_t key,
   12180                                                    Object* value) {
   12181   return AtPut(key, value);
   12182 }
   12183 
   12184 
   12185 Handle<SeededNumberDictionary> SeededNumberDictionary::Set(
   12186     Handle<SeededNumberDictionary> dictionary,
   12187     uint32_t index,
   12188     Handle<Object> value,
   12189     PropertyDetails details) {
   12190   CALL_HEAP_FUNCTION(dictionary->GetIsolate(),
   12191                      dictionary->Set(index, *value, details),
   12192                      SeededNumberDictionary);
   12193 }
   12194 
   12195 
   12196 Handle<UnseededNumberDictionary> UnseededNumberDictionary::Set(
   12197     Handle<UnseededNumberDictionary> dictionary,
   12198     uint32_t index,
   12199     Handle<Object> value) {
   12200   CALL_HEAP_FUNCTION(dictionary->GetIsolate(),
   12201                      dictionary->Set(index, *value),
   12202                      UnseededNumberDictionary);
   12203 }
   12204 
   12205 
   12206 MaybeObject* SeededNumberDictionary::Set(uint32_t key,
   12207                                          Object* value,
   12208                                          PropertyDetails details) {
   12209   int entry = FindEntry(key);
   12210   if (entry == kNotFound) return AddNumberEntry(key, value, details);
   12211   // Preserve enumeration index.
   12212   details = PropertyDetails(details.attributes(),
   12213                             details.type(),
   12214                             DetailsAt(entry).index());
   12215   MaybeObject* maybe_object_key = SeededNumberDictionaryShape::AsObject(key);
   12216   Object* object_key;
   12217   if (!maybe_object_key->ToObject(&object_key)) return maybe_object_key;
   12218   SetEntry(entry, object_key, value, details);
   12219   return this;
   12220 }
   12221 
   12222 
   12223 MaybeObject* UnseededNumberDictionary::Set(uint32_t key,
   12224                                            Object* value) {
   12225   int entry = FindEntry(key);
   12226   if (entry == kNotFound) return AddNumberEntry(key, value);
   12227   MaybeObject* maybe_object_key = UnseededNumberDictionaryShape::AsObject(key);
   12228   Object* object_key;
   12229   if (!maybe_object_key->ToObject(&object_key)) return maybe_object_key;
   12230   SetEntry(entry, object_key, value);
   12231   return this;
   12232 }
   12233 
   12234 
   12235 
   12236 template<typename Shape, typename Key>
   12237 int Dictionary<Shape, Key>::NumberOfElementsFilterAttributes(
   12238     PropertyAttributes filter) {
   12239   int capacity = HashTable<Shape, Key>::Capacity();
   12240   int result = 0;
   12241   for (int i = 0; i < capacity; i++) {
   12242     Object* k = HashTable<Shape, Key>::KeyAt(i);
   12243     if (HashTable<Shape, Key>::IsKey(k)) {
   12244       PropertyDetails details = DetailsAt(i);
   12245       if (details.IsDeleted()) continue;
   12246       PropertyAttributes attr = details.attributes();
   12247       if ((attr & filter) == 0) result++;
   12248     }
   12249   }
   12250   return result;
   12251 }
   12252 
   12253 
   12254 template<typename Shape, typename Key>
   12255 int Dictionary<Shape, Key>::NumberOfEnumElements() {
   12256   return NumberOfElementsFilterAttributes(
   12257       static_cast<PropertyAttributes>(DONT_ENUM));
   12258 }
   12259 
   12260 
   12261 template<typename Shape, typename Key>
   12262 void Dictionary<Shape, Key>::CopyKeysTo(
   12263     FixedArray* storage,
   12264     PropertyAttributes filter,
   12265     typename Dictionary<Shape, Key>::SortMode sort_mode) {
   12266   ASSERT(storage->length() >= NumberOfEnumElements());
   12267   int capacity = HashTable<Shape, Key>::Capacity();
   12268   int index = 0;
   12269   for (int i = 0; i < capacity; i++) {
   12270      Object* k = HashTable<Shape, Key>::KeyAt(i);
   12271      if (HashTable<Shape, Key>::IsKey(k)) {
   12272        PropertyDetails details = DetailsAt(i);
   12273        if (details.IsDeleted()) continue;
   12274        PropertyAttributes attr = details.attributes();
   12275        if ((attr & filter) == 0) storage->set(index++, k);
   12276      }
   12277   }
   12278   if (sort_mode == Dictionary<Shape, Key>::SORTED) {
   12279     storage->SortPairs(storage, index);
   12280   }
   12281   ASSERT(storage->length() >= index);
   12282 }
   12283 
   12284 
   12285 void StringDictionary::CopyEnumKeysTo(FixedArray* storage,
   12286                                       FixedArray* sort_array) {
   12287   ASSERT(storage->length() >= NumberOfEnumElements());
   12288   int capacity = Capacity();
   12289   int index = 0;
   12290   for (int i = 0; i < capacity; i++) {
   12291      Object* k = KeyAt(i);
   12292      if (IsKey(k)) {
   12293        PropertyDetails details = DetailsAt(i);
   12294        if (details.IsDeleted() || details.IsDontEnum()) continue;
   12295        storage->set(index, k);
   12296        sort_array->set(index, Smi::FromInt(details.index()));
   12297        index++;
   12298      }
   12299   }
   12300   storage->SortPairs(sort_array, sort_array->length());
   12301   ASSERT(storage->length() >= index);
   12302 }
   12303 
   12304 
   12305 template<typename Shape, typename Key>
   12306 void Dictionary<Shape, Key>::CopyKeysTo(
   12307     FixedArray* storage,
   12308     int index,
   12309     typename Dictionary<Shape, Key>::SortMode sort_mode) {
   12310   ASSERT(storage->length() >= NumberOfElementsFilterAttributes(
   12311       static_cast<PropertyAttributes>(NONE)));
   12312   int capacity = HashTable<Shape, Key>::Capacity();
   12313   for (int i = 0; i < capacity; i++) {
   12314     Object* k = HashTable<Shape, Key>::KeyAt(i);
   12315     if (HashTable<Shape, Key>::IsKey(k)) {
   12316       PropertyDetails details = DetailsAt(i);
   12317       if (details.IsDeleted()) continue;
   12318       storage->set(index++, k);
   12319     }
   12320   }
   12321   if (sort_mode == Dictionary<Shape, Key>::SORTED) {
   12322     storage->SortPairs(storage, index);
   12323   }
   12324   ASSERT(storage->length() >= index);
   12325 }
   12326 
   12327 
   12328 // Backwards lookup (slow).
   12329 template<typename Shape, typename Key>
   12330 Object* Dictionary<Shape, Key>::SlowReverseLookup(Object* value) {
   12331   int capacity = HashTable<Shape, Key>::Capacity();
   12332   for (int i = 0; i < capacity; i++) {
   12333     Object* k =  HashTable<Shape, Key>::KeyAt(i);
   12334     if (Dictionary<Shape, Key>::IsKey(k)) {
   12335       Object* e = ValueAt(i);
   12336       if (e->IsJSGlobalPropertyCell()) {
   12337         e = JSGlobalPropertyCell::cast(e)->value();
   12338       }
   12339       if (e == value) return k;
   12340     }
   12341   }
   12342   Heap* heap = Dictionary<Shape, Key>::GetHeap();
   12343   return heap->undefined_value();
   12344 }
   12345 
   12346 
   12347 MaybeObject* StringDictionary::TransformPropertiesToFastFor(
   12348     JSObject* obj, int unused_property_fields) {
   12349   // Make sure we preserve dictionary representation if there are too many
   12350   // descriptors.
   12351   if (NumberOfElements() > DescriptorArray::kMaxNumberOfDescriptors) return obj;
   12352 
   12353   // Figure out if it is necessary to generate new enumeration indices.
   12354   int max_enumeration_index =
   12355       NextEnumerationIndex() +
   12356           (DescriptorArray::kMaxNumberOfDescriptors -
   12357            NumberOfElements());
   12358   if (!PropertyDetails::IsValidIndex(max_enumeration_index)) {
   12359     Object* result;
   12360     { MaybeObject* maybe_result = GenerateNewEnumerationIndices();
   12361       if (!maybe_result->ToObject(&result)) return maybe_result;
   12362     }
   12363   }
   12364 
   12365   int instance_descriptor_length = 0;
   12366   int number_of_fields = 0;
   12367 
   12368   Heap* heap = GetHeap();
   12369 
   12370   // Compute the length of the instance descriptor.
   12371   int capacity = Capacity();
   12372   for (int i = 0; i < capacity; i++) {
   12373     Object* k = KeyAt(i);
   12374     if (IsKey(k)) {
   12375       Object* value = ValueAt(i);
   12376       PropertyType type = DetailsAt(i).type();
   12377       ASSERT(type != FIELD);
   12378       instance_descriptor_length++;
   12379       if (type == NORMAL &&
   12380           (!value->IsJSFunction() || heap->InNewSpace(value))) {
   12381         number_of_fields += 1;
   12382       }
   12383     }
   12384   }
   12385 
   12386   // Allocate the instance descriptor.
   12387   DescriptorArray* descriptors;
   12388   { MaybeObject* maybe_descriptors =
   12389         DescriptorArray::Allocate(instance_descriptor_length);
   12390     if (!maybe_descriptors->To<DescriptorArray>(&descriptors)) {
   12391       return maybe_descriptors;
   12392     }
   12393   }
   12394 
   12395   DescriptorArray::WhitenessWitness witness(descriptors);
   12396 
   12397   int inobject_props = obj->map()->inobject_properties();
   12398   int number_of_allocated_fields =
   12399       number_of_fields + unused_property_fields - inobject_props;
   12400   if (number_of_allocated_fields < 0) {
   12401     // There is enough inobject space for all fields (including unused).
   12402     number_of_allocated_fields = 0;
   12403     unused_property_fields = inobject_props - number_of_fields;
   12404   }
   12405 
   12406   // Allocate the fixed array for the fields.
   12407   Object* fields;
   12408   { MaybeObject* maybe_fields =
   12409         heap->AllocateFixedArray(number_of_allocated_fields);
   12410     if (!maybe_fields->ToObject(&fields)) return maybe_fields;
   12411   }
   12412 
   12413   // Fill in the instance descriptor and the fields.
   12414   int next_descriptor = 0;
   12415   int current_offset = 0;
   12416   for (int i = 0; i < capacity; i++) {
   12417     Object* k = KeyAt(i);
   12418     if (IsKey(k)) {
   12419       Object* value = ValueAt(i);
   12420       // Ensure the key is a symbol before writing into the instance descriptor.
   12421       Object* key;
   12422       { MaybeObject* maybe_key = heap->LookupSymbol(String::cast(k));
   12423         if (!maybe_key->ToObject(&key)) return maybe_key;
   12424       }
   12425       PropertyDetails details = DetailsAt(i);
   12426       PropertyType type = details.type();
   12427 
   12428       if (value->IsJSFunction() && !heap->InNewSpace(value)) {
   12429         ConstantFunctionDescriptor d(String::cast(key),
   12430                                      JSFunction::cast(value),
   12431                                      details.attributes(),
   12432                                      details.index());
   12433         descriptors->Set(next_descriptor++, &d, witness);
   12434       } else if (type == NORMAL) {
   12435         if (current_offset < inobject_props) {
   12436           obj->InObjectPropertyAtPut(current_offset,
   12437                                      value,
   12438                                      UPDATE_WRITE_BARRIER);
   12439         } else {
   12440           int offset = current_offset - inobject_props;
   12441           FixedArray::cast(fields)->set(offset, value);
   12442         }
   12443         FieldDescriptor d(String::cast(key),
   12444                           current_offset++,
   12445                           details.attributes(),
   12446                           details.index());
   12447         descriptors->Set(next_descriptor++, &d, witness);
   12448       } else if (type == CALLBACKS) {
   12449         if (value->IsAccessorPair()) {
   12450           MaybeObject* maybe_copy =
   12451               AccessorPair::cast(value)->CopyWithoutTransitions();
   12452           if (!maybe_copy->To(&value)) return maybe_copy;
   12453         }
   12454         CallbacksDescriptor d(String::cast(key),
   12455                               value,
   12456                               details.attributes(),
   12457                               details.index());
   12458         descriptors->Set(next_descriptor++, &d, witness);
   12459       } else {
   12460         UNREACHABLE();
   12461       }
   12462     }
   12463   }
   12464   ASSERT(current_offset == number_of_fields);
   12465 
   12466   descriptors->Sort(witness);
   12467   // Allocate new map.
   12468   Object* new_map;
   12469   { MaybeObject* maybe_new_map = obj->map()->CopyDropDescriptors();
   12470     if (!maybe_new_map->ToObject(&new_map)) return maybe_new_map;
   12471   }
   12472 
   12473   // Transform the object.
   12474   obj->set_map(Map::cast(new_map));
   12475   obj->map()->set_instance_descriptors(descriptors);
   12476   obj->map()->set_unused_property_fields(unused_property_fields);
   12477 
   12478   obj->set_properties(FixedArray::cast(fields));
   12479   ASSERT(obj->IsJSObject());
   12480 
   12481   descriptors->SetNextEnumerationIndex(NextEnumerationIndex());
   12482   // Check that it really works.
   12483   ASSERT(obj->HasFastProperties());
   12484 
   12485   return obj;
   12486 }
   12487 
   12488 
   12489 bool ObjectHashSet::Contains(Object* key) {
   12490   ASSERT(IsKey(key));
   12491 
   12492   // If the object does not have an identity hash, it was never used as a key.
   12493   { MaybeObject* maybe_hash = key->GetHash(OMIT_CREATION);
   12494     if (maybe_hash->ToObjectUnchecked()->IsUndefined()) return false;
   12495   }
   12496   return (FindEntry(key) != kNotFound);
   12497 }
   12498 
   12499 
   12500 MaybeObject* ObjectHashSet::Add(Object* key) {
   12501   ASSERT(IsKey(key));
   12502 
   12503   // Make sure the key object has an identity hash code.
   12504   int hash;
   12505   { MaybeObject* maybe_hash = key->GetHash(ALLOW_CREATION);
   12506     if (maybe_hash->IsFailure()) return maybe_hash;
   12507     hash = Smi::cast(maybe_hash->ToObjectUnchecked())->value();
   12508   }
   12509   int entry = FindEntry(key);
   12510 
   12511   // Check whether key is already present.
   12512   if (entry != kNotFound) return this;
   12513 
   12514   // Check whether the hash set should be extended and add entry.
   12515   Object* obj;
   12516   { MaybeObject* maybe_obj = EnsureCapacity(1, key);
   12517     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   12518   }
   12519   ObjectHashSet* table = ObjectHashSet::cast(obj);
   12520   entry = table->FindInsertionEntry(hash);
   12521   table->set(EntryToIndex(entry), key);
   12522   table->ElementAdded();
   12523   return table;
   12524 }
   12525 
   12526 
   12527 MaybeObject* ObjectHashSet::Remove(Object* key) {
   12528   ASSERT(IsKey(key));
   12529 
   12530   // If the object does not have an identity hash, it was never used as a key.
   12531   { MaybeObject* maybe_hash = key->GetHash(OMIT_CREATION);
   12532     if (maybe_hash->ToObjectUnchecked()->IsUndefined()) return this;
   12533   }
   12534   int entry = FindEntry(key);
   12535 
   12536   // Check whether key is actually present.
   12537   if (entry == kNotFound) return this;
   12538 
   12539   // Remove entry and try to shrink this hash set.
   12540   set_the_hole(EntryToIndex(entry));
   12541   ElementRemoved();
   12542   return Shrink(key);
   12543 }
   12544 
   12545 
   12546 Object* ObjectHashTable::Lookup(Object* key) {
   12547   ASSERT(IsKey(key));
   12548 
   12549   // If the object does not have an identity hash, it was never used as a key.
   12550   { MaybeObject* maybe_hash = key->GetHash(OMIT_CREATION);
   12551     if (maybe_hash->ToObjectUnchecked()->IsUndefined()) {
   12552       return GetHeap()->undefined_value();
   12553     }
   12554   }
   12555   int entry = FindEntry(key);
   12556   if (entry == kNotFound) return GetHeap()->undefined_value();
   12557   return get(EntryToIndex(entry) + 1);
   12558 }
   12559 
   12560 
   12561 MaybeObject* ObjectHashTable::Put(Object* key, Object* value) {
   12562   ASSERT(IsKey(key));
   12563 
   12564   // Make sure the key object has an identity hash code.
   12565   int hash;
   12566   { MaybeObject* maybe_hash = key->GetHash(ALLOW_CREATION);
   12567     if (maybe_hash->IsFailure()) return maybe_hash;
   12568     hash = Smi::cast(maybe_hash->ToObjectUnchecked())->value();
   12569   }
   12570   int entry = FindEntry(key);
   12571 
   12572   // Check whether to perform removal operation.
   12573   if (value->IsUndefined()) {
   12574     if (entry == kNotFound) return this;
   12575     RemoveEntry(entry);
   12576     return Shrink(key);
   12577   }
   12578 
   12579   // Key is already in table, just overwrite value.
   12580   if (entry != kNotFound) {
   12581     set(EntryToIndex(entry) + 1, value);
   12582     return this;
   12583   }
   12584 
   12585   // Check whether the hash table should be extended.
   12586   Object* obj;
   12587   { MaybeObject* maybe_obj = EnsureCapacity(1, key);
   12588     if (!maybe_obj->ToObject(&obj)) return maybe_obj;
   12589   }
   12590   ObjectHashTable* table = ObjectHashTable::cast(obj);
   12591   table->AddEntry(table->FindInsertionEntry(hash), key, value);
   12592   return table;
   12593 }
   12594 
   12595 
   12596 void ObjectHashTable::AddEntry(int entry, Object* key, Object* value) {
   12597   set(EntryToIndex(entry), key);
   12598   set(EntryToIndex(entry) + 1, value);
   12599   ElementAdded();
   12600 }
   12601 
   12602 
   12603 void ObjectHashTable::RemoveEntry(int entry) {
   12604   set_the_hole(EntryToIndex(entry));
   12605   set_the_hole(EntryToIndex(entry) + 1);
   12606   ElementRemoved();
   12607 }
   12608 
   12609 
   12610 #ifdef ENABLE_DEBUGGER_SUPPORT
   12611 // Check if there is a break point at this code position.
   12612 bool DebugInfo::HasBreakPoint(int code_position) {
   12613   // Get the break point info object for this code position.
   12614   Object* break_point_info = GetBreakPointInfo(code_position);
   12615 
   12616   // If there is no break point info object or no break points in the break
   12617   // point info object there is no break point at this code position.
   12618   if (break_point_info->IsUndefined()) return false;
   12619   return BreakPointInfo::cast(break_point_info)->GetBreakPointCount() > 0;
   12620 }
   12621 
   12622 
   12623 // Get the break point info object for this code position.
   12624 Object* DebugInfo::GetBreakPointInfo(int code_position) {
   12625   // Find the index of the break point info object for this code position.
   12626   int index = GetBreakPointInfoIndex(code_position);
   12627 
   12628   // Return the break point info object if any.
   12629   if (index == kNoBreakPointInfo) return GetHeap()->undefined_value();
   12630   return BreakPointInfo::cast(break_points()->get(index));
   12631 }
   12632 
   12633 
   12634 // Clear a break point at the specified code position.
   12635 void DebugInfo::ClearBreakPoint(Handle<DebugInfo> debug_info,
   12636                                 int code_position,
   12637                                 Handle<Object> break_point_object) {
   12638   Handle<Object> break_point_info(debug_info->GetBreakPointInfo(code_position));
   12639   if (break_point_info->IsUndefined()) return;
   12640   BreakPointInfo::ClearBreakPoint(
   12641       Handle<BreakPointInfo>::cast(break_point_info),
   12642       break_point_object);
   12643 }
   12644 
   12645 
   12646 void DebugInfo::SetBreakPoint(Handle<DebugInfo> debug_info,
   12647                               int code_position,
   12648                               int source_position,
   12649                               int statement_position,
   12650                               Handle<Object> break_point_object) {
   12651   Isolate* isolate = Isolate::Current();
   12652   Handle<Object> break_point_info(debug_info->GetBreakPointInfo(code_position));
   12653   if (!break_point_info->IsUndefined()) {
   12654     BreakPointInfo::SetBreakPoint(
   12655         Handle<BreakPointInfo>::cast(break_point_info),
   12656         break_point_object);
   12657     return;
   12658   }
   12659 
   12660   // Adding a new break point for a code position which did not have any
   12661   // break points before. Try to find a free slot.
   12662   int index = kNoBreakPointInfo;
   12663   for (int i = 0; i < debug_info->break_points()->length(); i++) {
   12664     if (debug_info->break_points()->get(i)->IsUndefined()) {
   12665       index = i;
   12666       break;
   12667     }
   12668   }
   12669   if (index == kNoBreakPointInfo) {
   12670     // No free slot - extend break point info array.
   12671     Handle<FixedArray> old_break_points =
   12672         Handle<FixedArray>(FixedArray::cast(debug_info->break_points()));
   12673     Handle<FixedArray> new_break_points =
   12674         isolate->factory()->NewFixedArray(
   12675             old_break_points->length() +
   12676             Debug::kEstimatedNofBreakPointsInFunction);
   12677 
   12678     debug_info->set_break_points(*new_break_points);
   12679     for (int i = 0; i < old_break_points->length(); i++) {
   12680       new_break_points->set(i, old_break_points->get(i));
   12681     }
   12682     index = old_break_points->length();
   12683   }
   12684   ASSERT(index != kNoBreakPointInfo);
   12685 
   12686   // Allocate new BreakPointInfo object and set the break point.
   12687   Handle<BreakPointInfo> new_break_point_info = Handle<BreakPointInfo>::cast(
   12688       isolate->factory()->NewStruct(BREAK_POINT_INFO_TYPE));
   12689   new_break_point_info->set_code_position(Smi::FromInt(code_position));
   12690   new_break_point_info->set_source_position(Smi::FromInt(source_position));
   12691   new_break_point_info->
   12692       set_statement_position(Smi::FromInt(statement_position));
   12693   new_break_point_info->set_break_point_objects(
   12694       isolate->heap()->undefined_value());
   12695   BreakPointInfo::SetBreakPoint(new_break_point_info, break_point_object);
   12696   debug_info->break_points()->set(index, *new_break_point_info);
   12697 }
   12698 
   12699 
   12700 // Get the break point objects for a code position.
   12701 Object* DebugInfo::GetBreakPointObjects(int code_position) {
   12702   Object* break_point_info = GetBreakPointInfo(code_position);
   12703   if (break_point_info->IsUndefined()) {
   12704     return GetHeap()->undefined_value();
   12705   }
   12706   return BreakPointInfo::cast(break_point_info)->break_point_objects();
   12707 }
   12708 
   12709 
   12710 // Get the total number of break points.
   12711 int DebugInfo::GetBreakPointCount() {
   12712   if (break_points()->IsUndefined()) return 0;
   12713   int count = 0;
   12714   for (int i = 0; i < break_points()->length(); i++) {
   12715     if (!break_points()->get(i)->IsUndefined()) {
   12716       BreakPointInfo* break_point_info =
   12717           BreakPointInfo::cast(break_points()->get(i));
   12718       count += break_point_info->GetBreakPointCount();
   12719     }
   12720   }
   12721   return count;
   12722 }
   12723 
   12724 
   12725 Object* DebugInfo::FindBreakPointInfo(Handle<DebugInfo> debug_info,
   12726                                       Handle<Object> break_point_object) {
   12727   Heap* heap = debug_info->GetHeap();
   12728   if (debug_info->break_points()->IsUndefined()) return heap->undefined_value();
   12729   for (int i = 0; i < debug_info->break_points()->length(); i++) {
   12730     if (!debug_info->break_points()->get(i)->IsUndefined()) {
   12731       Handle<BreakPointInfo> break_point_info =
   12732           Handle<BreakPointInfo>(BreakPointInfo::cast(
   12733               debug_info->break_points()->get(i)));
   12734       if (BreakPointInfo::HasBreakPointObject(break_point_info,
   12735                                               break_point_object)) {
   12736         return *break_point_info;
   12737       }
   12738     }
   12739   }
   12740   return heap->undefined_value();
   12741 }
   12742 
   12743 
   12744 // Find the index of the break point info object for the specified code
   12745 // position.
   12746 int DebugInfo::GetBreakPointInfoIndex(int code_position) {
   12747   if (break_points()->IsUndefined()) return kNoBreakPointInfo;
   12748   for (int i = 0; i < break_points()->length(); i++) {
   12749     if (!break_points()->get(i)->IsUndefined()) {
   12750       BreakPointInfo* break_point_info =
   12751           BreakPointInfo::cast(break_points()->get(i));
   12752       if (break_point_info->code_position()->value() == code_position) {
   12753         return i;
   12754       }
   12755     }
   12756   }
   12757   return kNoBreakPointInfo;
   12758 }
   12759 
   12760 
   12761 // Remove the specified break point object.
   12762 void BreakPointInfo::ClearBreakPoint(Handle<BreakPointInfo> break_point_info,
   12763                                      Handle<Object> break_point_object) {
   12764   Isolate* isolate = Isolate::Current();
   12765   // If there are no break points just ignore.
   12766   if (break_point_info->break_point_objects()->IsUndefined()) return;
   12767   // If there is a single break point clear it if it is the same.
   12768   if (!break_point_info->break_point_objects()->IsFixedArray()) {
   12769     if (break_point_info->break_point_objects() == *break_point_object) {
   12770       break_point_info->set_break_point_objects(
   12771           isolate->heap()->undefined_value());
   12772     }
   12773     return;
   12774   }
   12775   // If there are multiple break points shrink the array
   12776   ASSERT(break_point_info->break_point_objects()->IsFixedArray());
   12777   Handle<FixedArray> old_array =
   12778       Handle<FixedArray>(
   12779           FixedArray::cast(break_point_info->break_point_objects()));
   12780   Handle<FixedArray> new_array =
   12781       isolate->factory()->NewFixedArray(old_array->length() - 1);
   12782   int found_count = 0;
   12783   for (int i = 0; i < old_array->length(); i++) {
   12784     if (old_array->get(i) == *break_point_object) {
   12785       ASSERT(found_count == 0);
   12786       found_count++;
   12787     } else {
   12788       new_array->set(i - found_count, old_array->get(i));
   12789     }
   12790   }
   12791   // If the break point was found in the list change it.
   12792   if (found_count > 0) break_point_info->set_break_point_objects(*new_array);
   12793 }
   12794 
   12795 
   12796 // Add the specified break point object.
   12797 void BreakPointInfo::SetBreakPoint(Handle<BreakPointInfo> break_point_info,
   12798                                    Handle<Object> break_point_object) {
   12799   // If there was no break point objects before just set it.
   12800   if (break_point_info->break_point_objects()->IsUndefined()) {
   12801     break_point_info->set_break_point_objects(*break_point_object);
   12802     return;
   12803   }
   12804   // If the break point object is the same as before just ignore.
   12805   if (break_point_info->break_point_objects() == *break_point_object) return;
   12806   // If there was one break point object before replace with array.
   12807   if (!break_point_info->break_point_objects()->IsFixedArray()) {
   12808     Handle<FixedArray> array = FACTORY->NewFixedArray(2);
   12809     array->set(0, break_point_info->break_point_objects());
   12810     array->set(1, *break_point_object);
   12811     break_point_info->set_break_point_objects(*array);
   12812     return;
   12813   }
   12814   // If there was more than one break point before extend array.
   12815   Handle<FixedArray> old_array =
   12816       Handle<FixedArray>(
   12817           FixedArray::cast(break_point_info->break_point_objects()));
   12818   Handle<FixedArray> new_array =
   12819       FACTORY->NewFixedArray(old_array->length() + 1);
   12820   for (int i = 0; i < old_array->length(); i++) {
   12821     // If the break point was there before just ignore.
   12822     if (old_array->get(i) == *break_point_object) return;
   12823     new_array->set(i, old_array->get(i));
   12824   }
   12825   // Add the new break point.
   12826   new_array->set(old_array->length(), *break_point_object);
   12827   break_point_info->set_break_point_objects(*new_array);
   12828 }
   12829 
   12830 
   12831 bool BreakPointInfo::HasBreakPointObject(
   12832     Handle<BreakPointInfo> break_point_info,
   12833     Handle<Object> break_point_object) {
   12834   // No break point.
   12835   if (break_point_info->break_point_objects()->IsUndefined()) return false;
   12836   // Single break point.
   12837   if (!break_point_info->break_point_objects()->IsFixedArray()) {
   12838     return break_point_info->break_point_objects() == *break_point_object;
   12839   }
   12840   // Multiple break points.
   12841   FixedArray* array = FixedArray::cast(break_point_info->break_point_objects());
   12842   for (int i = 0; i < array->length(); i++) {
   12843     if (array->get(i) == *break_point_object) {
   12844       return true;
   12845     }
   12846   }
   12847   return false;
   12848 }
   12849 
   12850 
   12851 // Get the number of break points.
   12852 int BreakPointInfo::GetBreakPointCount() {
   12853   // No break point.
   12854   if (break_point_objects()->IsUndefined()) return 0;
   12855   // Single break point.
   12856   if (!break_point_objects()->IsFixedArray()) return 1;
   12857   // Multiple break points.
   12858   return FixedArray::cast(break_point_objects())->length();
   12859 }
   12860 #endif  // ENABLE_DEBUGGER_SUPPORT
   12861 
   12862 
   12863 MaybeObject* JSDate::GetField(Object* object, Smi* index) {
   12864   return JSDate::cast(object)->DoGetField(
   12865       static_cast<FieldIndex>(index->value()));
   12866 }
   12867 
   12868 
   12869 Object* JSDate::DoGetField(FieldIndex index) {
   12870   ASSERT(index != kDateValue);
   12871 
   12872   DateCache* date_cache = GetIsolate()->date_cache();
   12873 
   12874   if (index < kFirstUncachedField) {
   12875     Object* stamp = cache_stamp();
   12876     if (stamp != date_cache->stamp() && stamp->IsSmi()) {
   12877       // Since the stamp is not NaN, the value is also not NaN.
   12878       int64_t local_time_ms =
   12879           date_cache->ToLocal(static_cast<int64_t>(value()->Number()));
   12880       SetLocalFields(local_time_ms, date_cache);
   12881     }
   12882     switch (index) {
   12883       case kYear: return year();
   12884       case kMonth: return month();
   12885       case kDay: return day();
   12886       case kWeekday: return weekday();
   12887       case kHour: return hour();
   12888       case kMinute: return min();
   12889       case kSecond: return sec();
   12890       default: UNREACHABLE();
   12891     }
   12892   }
   12893 
   12894   if (index >= kFirstUTCField) {
   12895     return GetUTCField(index, value()->Number(), date_cache);
   12896   }
   12897 
   12898   double time = value()->Number();
   12899   if (isnan(time)) return GetIsolate()->heap()->nan_value();
   12900 
   12901   int64_t local_time_ms = date_cache->ToLocal(static_cast<int64_t>(time));
   12902   int days = DateCache::DaysFromTime(local_time_ms);
   12903 
   12904   if (index == kDays) return Smi::FromInt(days);
   12905 
   12906   int time_in_day_ms = DateCache::TimeInDay(local_time_ms, days);
   12907   if (index == kMillisecond) return Smi::FromInt(time_in_day_ms % 1000);
   12908   ASSERT(index == kTimeInDay);
   12909   return Smi::FromInt(time_in_day_ms);
   12910 }
   12911 
   12912 
   12913 Object* JSDate::GetUTCField(FieldIndex index,
   12914                             double value,
   12915                             DateCache* date_cache) {
   12916   ASSERT(index >= kFirstUTCField);
   12917 
   12918   if (isnan(value)) return GetIsolate()->heap()->nan_value();
   12919 
   12920   int64_t time_ms = static_cast<int64_t>(value);
   12921 
   12922   if (index == kTimezoneOffset) {
   12923     return Smi::FromInt(date_cache->TimezoneOffset(time_ms));
   12924   }
   12925 
   12926   int days = DateCache::DaysFromTime(time_ms);
   12927 
   12928   if (index == kWeekdayUTC) return Smi::FromInt(date_cache->Weekday(days));
   12929 
   12930   if (index <= kDayUTC) {
   12931     int year, month, day;
   12932     date_cache->YearMonthDayFromDays(days, &year, &month, &day);
   12933     if (index == kYearUTC) return Smi::FromInt(year);
   12934     if (index == kMonthUTC) return Smi::FromInt(month);
   12935     ASSERT(index == kDayUTC);
   12936     return Smi::FromInt(day);
   12937   }
   12938 
   12939   int time_in_day_ms = DateCache::TimeInDay(time_ms, days);
   12940   switch (index) {
   12941     case kHourUTC: return Smi::FromInt(time_in_day_ms / (60 * 60 * 1000));
   12942     case kMinuteUTC: return Smi::FromInt((time_in_day_ms / (60 * 1000)) % 60);
   12943     case kSecondUTC: return Smi::FromInt((time_in_day_ms / 1000) % 60);
   12944     case kMillisecondUTC: return Smi::FromInt(time_in_day_ms % 1000);
   12945     case kDaysUTC: return Smi::FromInt(days);
   12946     case kTimeInDayUTC: return Smi::FromInt(time_in_day_ms);
   12947     default: UNREACHABLE();
   12948   }
   12949 
   12950   UNREACHABLE();
   12951   return NULL;
   12952 }
   12953 
   12954 
   12955 void JSDate::SetValue(Object* value, bool is_value_nan) {
   12956   set_value(value);
   12957   if (is_value_nan) {
   12958     HeapNumber* nan = GetIsolate()->heap()->nan_value();
   12959     set_cache_stamp(nan, SKIP_WRITE_BARRIER);
   12960     set_year(nan, SKIP_WRITE_BARRIER);
   12961     set_month(nan, SKIP_WRITE_BARRIER);
   12962     set_day(nan, SKIP_WRITE_BARRIER);
   12963     set_hour(nan, SKIP_WRITE_BARRIER);
   12964     set_min(nan, SKIP_WRITE_BARRIER);
   12965     set_sec(nan, SKIP_WRITE_BARRIER);
   12966     set_weekday(nan, SKIP_WRITE_BARRIER);
   12967   } else {
   12968     set_cache_stamp(Smi::FromInt(DateCache::kInvalidStamp), SKIP_WRITE_BARRIER);
   12969   }
   12970 }
   12971 
   12972 
   12973 void JSDate::SetLocalFields(int64_t local_time_ms, DateCache* date_cache) {
   12974   int days = DateCache::DaysFromTime(local_time_ms);
   12975   int time_in_day_ms = DateCache::TimeInDay(local_time_ms, days);
   12976   int year, month, day;
   12977   date_cache->YearMonthDayFromDays(days, &year, &month, &day);
   12978   int weekday = date_cache->Weekday(days);
   12979   int hour = time_in_day_ms / (60 * 60 * 1000);
   12980   int min = (time_in_day_ms / (60 * 1000)) % 60;
   12981   int sec = (time_in_day_ms / 1000) % 60;
   12982   set_cache_stamp(date_cache->stamp());
   12983   set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER);
   12984   set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER);
   12985   set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER);
   12986   set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER);
   12987   set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER);
   12988   set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER);
   12989   set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
   12990 }
   12991 
   12992 } }  // namespace v8::internal
   12993