src/objects/js-function.h

// Copyright 2020 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef V8_OBJECTS_JS_FUNCTION_H_
#define V8_OBJECTS_JS_FUNCTION_H_

#include <atomic>
#include <optional>

#include "src/objects/code-kind.h"
#include "src/objects/js-objects.h"

// Has to be the last include (doesn't have include guards):
#include "src/objects/object-macros.h"

namespace v8::internal {

class AbstractCode;
class ClosureFeedbackCellArray;
class Tuple2;

// An abstract superclass for classes representing JavaScript function values.
// It doesn't carry any functionality but allows function classes to be
// identified in the type system.
V8_OBJECT class JSFunctionOrBoundFunctionOrWrappedFunction : public JSObject {
  V8_IT_ABSTRACT;

 public:
  static const int kLengthDescriptorIndex = 0;
  static const int kNameDescriptorIndex = 1;

  // https://tc39.es/proposal-shadowrealm/#sec-copynameandlength
  static Maybe<bool> CopyNameAndLength(
      Isolate* isolate,
      DirectHandle<JSFunctionOrBoundFunctionOrWrappedFunction> function,
      DirectHandle<JSReceiver> target, DirectHandle<String> prefix,
      int arg_count);

  static const int kHeaderSize;
} V8_OBJECT_END;

inline constexpr int JSFunctionOrBoundFunctionOrWrappedFunction::kHeaderSize =
    sizeof(JSFunctionOrBoundFunctionOrWrappedFunction);

// JSBoundFunction describes a bound function exotic object.
V8_OBJECT class JSBoundFunction
    : public JSFunctionOrBoundFunctionOrWrappedFunction {
 public:
  static MaybeHandle<String> GetName(Isolate* isolate,
                                     DirectHandle<JSBoundFunction> function);
  static Maybe<uint32_t> GetLength(Isolate* isolate,
                                   DirectHandle<JSBoundFunction> function);

  inline Tagged<JSCallable> bound_target_function() const;
  inline void set_bound_target_function(
      Tagged<JSCallable> value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);

  inline Tagged<Object> bound_this() const;
  inline void set_bound_this(Tagged<Object> value,
                             WriteBarrierMode mode = UPDATE_WRITE_BARRIER);

  inline Tagged<FixedArray> bound_arguments() const;
  inline void set_bound_arguments(Tagged<FixedArray> value,
                                  WriteBarrierMode mode = UPDATE_WRITE_BARRIER);

  // Dispatched behavior.
  DECL_PRINTER(JSBoundFunction)
  DECL_VERIFIER(JSBoundFunction)

  // The bound function's string representation implemented according
  // to ES6 section 19.2.3.5 Function.prototype.toString ( ).
  static DirectHandle<String> ToString(Isolate* isolate,
                                       DirectHandle<JSBoundFunction> function);

  static const int kHeaderSize;

 public:
  TaggedMember<JSCallable> bound_target_function_;
  TaggedMember<Object> bound_this_;
  TaggedMember<FixedArray> bound_arguments_;
} V8_OBJECT_END;

inline constexpr int JSBoundFunction::kHeaderSize = sizeof(JSBoundFunction);

// JSWrappedFunction describes a wrapped function exotic object.
V8_OBJECT class JSWrappedFunction
    : public JSFunctionOrBoundFunctionOrWrappedFunction {
 public:
  static MaybeHandle<String> GetName(Isolate* isolate,
                                     DirectHandle<JSWrappedFunction> function);
  static Maybe<uint32_t> GetLength(Isolate* isolate,
                                   DirectHandle<JSWrappedFunction> function);
  // https://tc39.es/proposal-shadowrealm/#sec-wrappedfunctioncreate
  static MaybeDirectHandle<Object> Create(
      Isolate* isolate, DirectHandle<NativeContext> creation_context,
      DirectHandle<JSReceiver> value);

  inline Tagged<JSCallable> wrapped_target_function() const;
  inline void set_wrapped_target_function(
      Tagged<JSCallable> value, WriteBarrierMode mode = UPDATE_WRITE_BARRIER);

  inline Tagged<NativeContext> context() const;
  inline void set_context(Tagged<NativeContext> value,
                          WriteBarrierMode mode = UPDATE_WRITE_BARRIER);

  // Dispatched behavior.
  DECL_PRINTER(JSWrappedFunction)
  DECL_VERIFIER(JSWrappedFunction)

  // The wrapped function's string representation implemented according
  // to ES6 section 19.2.3.5 Function.prototype.toString ( ).
  static DirectHandle<String> ToString(
      Isolate* isolate, DirectHandle<JSWrappedFunction> function);

  static const int kHeaderSize;

 public:
  TaggedMember<JSCallable> wrapped_target_function_;
  TaggedMember<NativeContext> context_;
} V8_OBJECT_END;

inline constexpr int JSWrappedFunction::kHeaderSize = sizeof(JSWrappedFunction);

enum class BudgetModification { kReduce, kRaise, kReset };

// JSFunction describes JavaScript functions.
// This abstract class represents JS function objects with and without
// prototype. Respective subclass defines the layout of the object in memory
// but all the JSFunction related logic lives in this class.
V8_OBJECT class JSFunction : public JSFunctionOrBoundFunctionOrWrappedFunction {
  V8_IT_ABSTRACT;

 public:
  DECL_RELEASE_ACQUIRE_ACCESSORS(
      prototype_or_initial_map,
      Tagged<UnionOf<JSReceiver, Map, Tuple2, TheHole>>)

  void TraceOptimizationStatus(const char* reason, ...);

  // [shared]: The information about the function that can be shared by
  // instances.
  DECL_ACCESSORS(shared, Tagged<SharedFunctionInfo>)
  DECL_RELAXED_GETTER(shared, Tagged<SharedFunctionInfo>)

  // Fast binding requires length and name accessors.
  static const int kMinDescriptorsForFastBindAndWrap = 2;
  static const int kLengthDescriptorIndex = 0;
  static const int kNameDescriptorIndex = 1;

  static DirectHandle<Object> GetFunctionPrototype(
      Isolate* isolate, DirectHandle<JSFunction> function);

  // [context]: The context for this function.
  inline Tagged<Context> context();
  DECL_RELAXED_GETTER(context, Tagged<Context>)
  inline bool has_context() const;
  DECL_RELEASE_ACQUIRE_ACCESSORS(context, Tagged<Context>)
  inline void set_context(Tagged<Context> value,
                          WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
  inline Tagged<JSGlobalProxy> global_proxy();
  inline Tagged<NativeContext> native_context();
  inline uint32_t length();

  static Handle<String> GetName(Isolate* isolate,
                                DirectHandle<JSFunction> function);

  // [code]: The generated code object for this function.  Executed
  // when the function is invoked, e.g. foo() or new foo(). See
  // [[Call]] and [[Construct]] description in ECMA-262, section
  // 8.6.2, page 27.
  // Release/Acquire accessors are used when storing a newly-created
  // optimized code object, or when reading from the background thread.
  // Storing a builtin doesn't require release semantics because these objects
  // are fully initialized.
  DECL_TRUSTED_POINTER_GETTERS(code, Code)

  inline void UpdateOptimizedCode(
      Isolate* isolate, Tagged<Code> code,
      WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);
  inline void UpdateCode(
      Isolate* isolate, Tagged<Code> code,
      WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);
  inline void UpdateCodeKeepTieringRequests(
      Isolate* isolate, Tagged<Code> code,
      WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);

  // Returns the raw content of the Code field. When reading from a background
  // thread, the code field may still be uninitialized, in which case the field
  // contains Smi::zero().
  inline Tagged<Union<Smi, Code>> raw_code(IsolateForSandbox isolate) const;
  inline Tagged<Union<Smi, Code>> raw_code(IsolateForSandbox isolate,
                                           AcquireLoadTag tag) const;

  // Returns the address of the function code's instruction start.
  inline Address instruction_start(IsolateForSandbox isolate) const;

  // Get the abstract code associated with the function, which will either be
  // an InstructionStream object or a BytecodeArray.
  template <typename IsolateT>
  inline Tagged<AbstractCode> abstract_code(IsolateT* isolate);

  static inline JSDispatchHandle AllocateDispatchHandle(
      DirectHandle<JSFunction> function, Isolate* isolate,
      uint16_t parameter_count, DirectHandle<Code> code,
      WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);
  inline void clear_dispatch_handle();
  inline JSDispatchHandle dispatch_handle() const;
  inline JSDispatchHandle dispatch_handle(AcquireLoadTag) const;
  inline void set_dispatch_handle(
      JSDispatchHandle handle,
      WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);

  // The predicates for querying code kinds related to this function have
  // specific terminology:
  //
  // - Attached: all code kinds that are directly attached to this JSFunction
  //   object.
  // - Available: all code kinds that are either attached or available through
  //   indirect means such as the feedback vector's optimized code cache.
  // - Active: the single code kind that would be executed if this function
  //   were called in its current state. Note that there may not be an active
  //   code kind if the function is not compiled. Also, asm/wasm functions are
  //   currently not supported.
  //
  // Note: code objects that are marked_for_deoptimization are not part of the
  // attached/available/active sets. This is because the JSFunction might have
  // been already deoptimized but its code() still needs to be unlinked, which
  // will happen on its next activation.

  bool HasAvailableHigherTierCodeThan(IsolateForSandbox isolate,
                                      CodeKind kind) const;
  // As above but only considers available code kinds passing the filter mask.
  bool HasAvailableHigherTierCodeThanWithFilter(IsolateForSandbox isolate,
                                                CodeKind kind,
                                                CodeKinds filter_mask) const;

  // True, iff any generated code kind is attached/available to this function.
  V8_EXPORT_PRIVATE bool HasAttachedOptimizedCode(
      IsolateForSandbox isolate) const;
  bool HasAvailableOptimizedCode(IsolateForSandbox isolate) const;

  bool HasAttachedCodeKind(IsolateForSandbox isolate, CodeKind kind) const;
  bool HasAvailableCodeKind(IsolateForSandbox isolate, CodeKind kind) const;

  std::optional<CodeKind> GetActiveTier(IsolateForSandbox isolate) const;
  V8_EXPORT_PRIVATE bool ActiveTierIsIgnition(IsolateForSandbox isolate) const;
  bool ActiveTierIsBaseline(IsolateForSandbox isolate) const;
  bool ActiveTierIsMaglev(IsolateForSandbox isolate) const;
  bool ActiveTierIsTurbofan(IsolateForSandbox isolate) const;

  // Similar to SharedFunctionInfo::CanDiscardCompiled. Returns true, if the
  // attached code can be recreated at a later point by replacing it with
  // CompileLazy.
  bool CanDiscardCompiled(IsolateForSandbox isolate) const;

  // Tells whether function's code object checks its tiering state (some code
  // kinds, e.g. TURBOFAN, ignore the tiering state).
  inline bool ChecksTieringState(IsolateForSandbox isolate);

  // Tiering up a function happens as follows:
  // 1. RequestOptimization is called
  //    -> From now on `IsOptimizationRequested` and also
  //    `IsTieringRequestedOrInProgress` return true.
  // 2. On the next function invocation the optimization is triggered. While the
  //    optimization progresses in the background both
  //    `IsTieringRequestedOrInProgress` and `tiering_in_progress` return
  //    true. It also means the optimization is no longer requested (i.e.,
  //    `IsOptimizationRequested` returns false).
  // 3. Once the compilation job is finalized the functions code is installed
  //    via `UpdateCode` and any remaining flags cleared by
  //    `ResetTieringRequests`.
  // NB: Osr tiering state is tracked separately from these.

  // Mark this function for optimization. The function will be recompiled
  // the next time it is executed.
  void RequestOptimization(Isolate* isolate, CodeKind target_kind,
                           ConcurrencyMode mode = ConcurrencyMode::kConcurrent);

  inline bool IsLoggingRequested(Isolate* isolate) const;
  inline bool IsOptimizationRequested(Isolate* isolate) const;
  inline bool IsMaglevRequested(Isolate* isolate) const;
  inline bool IsTurbofanRequested(Isolate* isolate) const;
  V8_INLINE std::optional<CodeKind> GetRequestedOptimizationIfAny(
      Isolate* isolate,
      ConcurrencyMode mode = ConcurrencyMode::kConcurrent) const;

  inline bool tiering_in_progress() const;
  // NB: Tiering includes Optimization and Logging requests.
  inline bool IsTieringRequestedOrInProgress(Isolate* isolate) const;

  inline void SetTieringInProgress(
      Isolate* isolate, bool in_progress,
      BytecodeOffset osr_offset = BytecodeOffset::None());
  inline void ResetTieringRequests(Isolate* isolate);

  inline bool osr_tiering_in_progress();

  // Sets the interrupt budget based on whether the function has a feedback
  // vector and any optimized code.
  void SetInterruptBudget(Isolate* isolate, BudgetModification kind,
                          std::optional<CodeKind> override_active_tier = {});

  // If slack tracking is active, it computes instance size of the initial map
  // with minimum permissible object slack.  If it is not active, it simply
  // returns the initial map's instance size.
  int ComputeInstanceSizeWithMinSlack(Isolate* isolate);

  // Completes inobject slack tracking on initial map if it is active.
  inline void CompleteInobjectSlackTrackingIfActive(Isolate* isolate);

  // [raw_feedback_cell]: Gives raw access to the FeedbackCell used to hold the
  /// FeedbackVector eventually. Generally this shouldn't be used to get the
  // feedback_vector, instead use feedback_vector() which correctly deals with
  // the JSFunction's bytecode being flushed.
  DECL_ACCESSORS(raw_feedback_cell, Tagged<FeedbackCell>)

  // [raw_feedback_cell] (synchronized version) When this is initialized from a
  // newly allocated object (instead of a root sentinel), it should
  // be written with release store semantics.
  DECL_RELEASE_ACQUIRE_ACCESSORS(raw_feedback_cell, Tagged<FeedbackCell>)

  // Functions related to feedback vector. feedback_vector() can be used once
  // the function has feedback vectors allocated. feedback vectors may not be
  // available after compile when lazily allocating feedback vectors.
  DECL_GETTER(feedback_vector, Tagged<FeedbackVector>)
  DECL_GETTER(has_feedback_vector, bool)
  V8_EXPORT_PRIVATE static void EnsureFeedbackVector(
      Isolate* isolate, DirectHandle<JSFunction> function,
      IsCompiledScope* compiled_scope);
  static void CreateAndAttachFeedbackVector(Isolate* isolate,
                                            DirectHandle<JSFunction> function,
                                            IsCompiledScope* compiled_scope);

  // Functions related to closure feedback cell array that holds feedback cells
  // used to create closures from this function. We allocate closure feedback
  // cell arrays after compile, when we want to allocate feedback vectors
  // lazily.
  inline bool has_closure_feedback_cell_array() const;
  inline Tagged<ClosureFeedbackCellArray> closure_feedback_cell_array() const;
  static void EnsureClosureFeedbackCellArray(Isolate* isolate,
                                             DirectHandle<JSFunction> function);

  // Initializes the feedback cell of |function|. In lite mode, this would be
  // initialized to the closure feedback cell array that holds the feedback
  // cells for create closure calls from this function. In the regular mode,
  // this allocates feedback vector.
  static void InitializeFeedbackCell(Isolate* isolate,
                                     DirectHandle<JSFunction> function,
                                     IsCompiledScope* compiled_scope,
                                     bool reset_budget_for_feedback_allocation);

  // Unconditionally clear the type feedback vector, even those that we usually
  // keep (e.g.: BinaryOp feedback).
  void ClearAllTypeFeedbackInfoForTesting(Isolate* isolate);

  // Resets function to clear compiled data after bytecode has been flushed.
  inline bool NeedsResetDueToFlushedBytecode(Isolate* isolate);
  inline bool NeedsResetDueToFlushedBytecode(Isolate* isolate,
                                             Tagged<SharedFunctionInfo> sfi,
                                             Tagged<Code> code);
  inline void ResetIfCodeFlushed(
      Isolate* isolate,
      std::optional<
          std::function<void(Tagged<HeapObject> object, ObjectSlot slot,
                             Tagged<HeapObject> target)>>
          gc_notify_updated_slot = std::nullopt);

  // Returns if the closure's code field has to be updated because it has
  // stale baseline code.
  inline bool NeedsResetDueToFlushedBaselineCode(IsolateForSandbox isolate);

  // Returns if baseline code is a candidate for flushing. This method is called
  // from concurrent marking so we should be careful when accessing data fields.
  inline bool ShouldFlushBaselineCode(
      base::EnumSet<CodeFlushMode> code_flush_mode);

  DECL_GETTER(has_prototype_slot, bool)

  // The initial map for an object created by this constructor.
  DECL_GETTER(initial_map, Tagged<Map>)
  inline bool TryGetInitialMap(Tagged<Map>* out_initial_map) const;

  static void SetInitialMap(Isolate* isolate, DirectHandle<JSFunction> function,
                            DirectHandle<Map> initial_map,
                            DirectHandle<JSPrototype> prototype);
  static void SetInitialMap(Isolate* isolate, DirectHandle<JSFunction> function,
                            DirectHandle<Map> initial_map,
                            DirectHandle<JSPrototype> prototype,
                            DirectHandle<JSFunction> constructor);

  DECL_GETTER(has_initial_map, bool)
  V8_EXPORT_PRIVATE static void EnsureHasInitialMap(
      Isolate* isolate, DirectHandle<JSFunction> function);

  // Creates a map that matches the constructor's initial map, but with
  // [[prototype]] being new.target.prototype. Because new.target can be a
  // JSProxy, this can call back into JavaScript.
  V8_EXPORT_PRIVATE static V8_WARN_UNUSED_RESULT MaybeHandle<Map> GetDerivedMap(
      Isolate* isolate, DirectHandle<JSFunction> constructor,
      DirectHandle<JSReceiver> new_target);

  // Like GetDerivedMap, but returns a map with a RAB / GSAB ElementsKind.
  static V8_WARN_UNUSED_RESULT MaybeDirectHandle<Map>
  GetDerivedRabGsabTypedArrayMap(Isolate* isolate,
                                 DirectHandle<JSFunction> constructor,
                                 DirectHandle<JSReceiver> new_target);

  // Like GetDerivedMap, but can be used for DataViews for retrieving / creating
  // a map with a JS_RAB_GSAB_DATA_VIEW instance type.
  static V8_WARN_UNUSED_RESULT MaybeDirectHandle<Map>
  GetDerivedRabGsabDataViewMap(Isolate* isolate,
                               DirectHandle<JSReceiver> new_target);

  // Get and set the prototype property on a JSFunction. If the
  // function has an initial map the prototype is set on the initial
  // map. Otherwise, the prototype is put in the initial map field
  // until an initial map is needed. In case the prototype value is
  // not a JSReceiver, it's wrapped in a Tuple2, containing
  // <Map|JSReceiver, JSAny && !JSReceiver>, where the first value is the
  // initial map or instance prototype value, and the second one is the
  // non-instance prototype value.

  // Returns true if the function has a prototype value set.
  DECL_GETTER(has_prototype, bool)
  DECL_GETTER(prototype, Tagged<JSAny>)

  // Returns true if the function has an initialized instance prototype value
  // (the prototype that will be set as __proto__ for instances created by this
  // function).
  DECL_GETTER(has_instance_prototype, bool)
  DECL_GETTER(instance_prototype, Tagged<JSReceiver>)

  // Returns true if the function has a prototype but it's not a JSReceiver.
  DECL_GETTER(has_non_instance_prototype, bool)

  // Returns true if this function's kind guarantees that it has a
  // non-configurable "prototype" property.
  DECL_GETTER(has_prototype_property, bool)
  // Returns true if accessing function's "prototype" property requires a
  // property lookup (i.e. the function kind does not guarantee that it has
  // a non-configurable "prototype" property).
  DECL_GETTER(PrototypeRequiresRuntimeLookup, bool)

  // Returns instance prototype object based on function's kind which should
  // be used when function is in non-instance prototype mode.
  // See https://tc39.es/ecma262/#sec-ordinarycreatefromconstructor and
  // https://tc39.es/ecma262/#sec-getprototypefromconstructor.
  DECL_GETTER(GetIntrinsicDefaultProto, Tagged<JSReceiver>)

  static void SetPrototype(Isolate* isolate, DirectHandle<JSFunction> function,
                           DirectHandle<Object> value);

  // Returns if this function has been compiled to native code yet.
  inline bool is_compiled(IsolateForSandbox isolate) const;

  std::unique_ptr<char[]> DebugNameCStr();
  void PrintName(FILE* out = stdout);

  // Calculate the instance size and in-object properties count.
  // {CalculateExpectedNofProperties} can trigger compilation.
  static V8_WARN_UNUSED_RESULT int CalculateExpectedNofProperties(
      Isolate* isolate, DirectHandle<JSFunction> function);
  static void CalculateInstanceSizeHelper(InstanceType instance_type,
                                          int requested_embedder_fields,
                                          int requested_in_object_properties,
                                          int* instance_size,
                                          int* in_object_properties);

  // Dispatched behavior.
  DECL_PRINTER(JSFunction)
  DECL_VERIFIER(JSFunction)

  static DirectHandle<String> GetName(DirectHandle<JSFunction> function);

  // ES6 section 9.2.11 SetFunctionName
  // Because of the way this abstract operation is used in the spec,
  // it should never fail, but in practice it will fail if the generated
  // function name's length exceeds String::kMaxLength.
  static V8_WARN_UNUSED_RESULT bool SetName(Isolate* isolate,
                                            DirectHandle<JSFunction> function,
                                            DirectHandle<Name> name,
                                            DirectHandle<String> prefix);

  // The function's name if it is configured, otherwise shared function info
  // debug name.
  static DirectHandle<String> GetDebugName(
      Isolate* isolate, DirectHandle<JSFunction> function,
      AllowAllocation allow_allocation = AllowAllocation{true});

  // The function's string representation implemented according to
  // ES6 section 19.2.3.5 Function.prototype.toString ( ).
  static DirectHandle<String> ToString(Isolate* isolate,
                                       DirectHandle<JSFunction> function);

  class BodyDescriptor;

  // Returns the set of code kinds of compilation artifacts (bytecode,
  // generated code) attached to this JSFunction.
  // Note that attached code objects that are marked_for_deoptimization are not
  // included in this set.
  // Also considers locations outside of this JSFunction. For example the
  // optimized code cache slot in the feedback vector, and the shared function
  // info.
  CodeKinds GetAvailableCodeKinds(IsolateForSandbox isolate) const;

#if TAGGED_SIZE_8_BYTES
  static const int kPaddingOffset;
  static const int kPaddingOffsetEnd;
#endif

 private:
  // The bottleneck for decoding the prototype_or_initial_map field.
  struct PrototypeOrInitialMapData;
  inline bool TryGetPrototypeOrInitialMap(PrototypeOrInitialMapData* out) const;

  inline void UpdateCodeImpl(Isolate* isolate, Tagged<Code> code,
                             WriteBarrierMode mode, bool keep_tiering_request);

  // Updates the Code in this function's dispatch table entry.
  inline void UpdateDispatchEntry(
      Isolate* isolate, Tagged<Code> new_code,
      WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);
  inline void UpdateDispatchEntryKeepTieringRequest(
      Isolate* isolate, Tagged<Code> new_code,
      WriteBarrierMode mode = WriteBarrierMode::UPDATE_WRITE_BARRIER);

  // Returns the set of code kinds of compilation artifacts (bytecode,
  // generated code) attached to this JSFunction.
  // Note that attached code objects that are marked_for_deoptimization are not
  // included in this set.
  // TODO(jgruber): Currently at most one code kind can be attached. Consider
  // adding a NOT_COMPILED kind and changing this function to simply return the
  // kind if this becomes more convenient in the future.
  CodeKinds GetAttachedCodeKinds(IsolateForSandbox isolate) const;

 public:
  JSDispatchHandleMember dispatch_handle_;
#if TAGGED_SIZE_8_BYTES
  uint32_t padding_;
#endif
  TaggedMember<SharedFunctionInfo> shared_function_info_;
  TaggedMember<Context> context_;
  TaggedMember<FeedbackCell> feedback_cell_;
} V8_OBJECT_END;

#if TAGGED_SIZE_8_BYTES
inline constexpr int JSFunction::kPaddingOffset =
    offsetof(JSFunction, padding_);
inline constexpr int JSFunction::kPaddingOffsetEnd =
    offsetof(JSFunction, padding_) + sizeof(uint32_t) - 1;
#endif

// Defines layout of JavaScript functions without prototype.
V8_OBJECT class JSFunctionWithoutPrototype : public JSFunction {
 public:
  static const int kHeaderSize;
  static const int kMinSize;
  DECL_PRINTER(JSFunctionWithoutPrototype)
  DECL_VERIFIER(JSFunctionWithoutPrototype)
} V8_OBJECT_END;

inline constexpr int JSFunctionWithoutPrototype::kHeaderSize =
    sizeof(JSFunctionWithoutPrototype);
inline constexpr int JSFunctionWithoutPrototype::kMinSize =
    sizeof(JSFunctionWithoutPrototype);

// Defines layout of JavaScript functions with prototype.
V8_OBJECT class JSFunctionWithPrototype : public JSFunction {
  V8_IT_ORDER(LAST);

 public:
  static const int kHeaderSize;
  static const int kMinSize;

  // The field can be in the following states:
  //  - TheHole - function's prototype was never accessed and thus it's not
  //      initialized yet,
  //  - JSReceiver - function has an instance prototype but initial map was
  //      not created yet (in this case the value is the prototype),
  //  - Map - this is the function's initial map and the function has an
  //      instance prototype,
  //  - Tuple2<Map|JSReceiver, JSAny && !JSReceiver> - function has a
  //      non-instance prototype, value1 contains initial map or instance
  //      prototype value, value2 contains the non-instance prototype value.
  DECL_RELEASE_ACQUIRE_ACCESSORS(
      prototype_or_initial_map,
      Tagged<UnionOf<JSReceiver, Map, Tuple2, TheHole>>)

  DECL_PRINTER(JSFunctionWithPrototype)
  DECL_VERIFIER(JSFunctionWithPrototype)

 public:
  TaggedMember<Object> prototype_or_initial_map_;
} V8_OBJECT_END;

inline constexpr int JSFunctionWithPrototype::kHeaderSize =
    sizeof(JSFunctionWithPrototype);
inline constexpr int JSFunctionWithPrototype::kMinSize =
    sizeof(JSFunctionWithPrototype);

V8_OBJECT class JSClassConstructor : public JSFunctionWithPrototype {
  V8_IT_ORDER(LAST);
} V8_OBJECT_END;

}  // namespace v8::internal

#include "src/objects/object-macros-undef.h"

#endif  // V8_OBJECTS_JS_FUNCTION_H_