../deps/v8/src/objects/elements.cc

Bug Summary

File:	out/../deps/v8/src/objects/elements.cc
Warning:	line 3436, column 11 Branch condition evaluates to a garbage value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-unknown-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name elements.cc -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 2 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=/home/maurizio/node-v18.6.0/out -resource-dir /usr/local/lib/clang/16.0.0 -D _GLIBCXX_USE_CXX11_ABI=1 -D NODE_OPENSSL_CONF_NAME=nodejs_conf -D NODE_OPENSSL_HAS_QUIC -D V8_GYP_BUILD -D V8_TYPED_ARRAY_MAX_SIZE_IN_HEAP=64 -D __STDC_FORMAT_MACROS -D OPENSSL_NO_PINSHARED -D OPENSSL_THREADS -D V8_TARGET_ARCH_X64 -D V8_HAVE_TARGET_OS -D V8_TARGET_OS_LINUX -D V8_EMBEDDER_STRING="-node.8" -D ENABLE_DISASSEMBLER -D V8_PROMISE_INTERNAL_FIELD_COUNT=1 -D V8_SHORT_BUILTIN_CALLS -D OBJECT_PRINT -D V8_INTL_SUPPORT -D V8_ATOMIC_OBJECT_FIELD_WRITES -D V8_ENABLE_LAZY_SOURCE_POSITIONS -D V8_USE_SIPHASH -D V8_SHARED_RO_HEAP -D V8_WIN64_UNWINDING_INFO -D V8_ENABLE_REGEXP_INTERPRETER_THREADED_DISPATCH -D V8_SNAPSHOT_COMPRESSION -D V8_ENABLE_WEBASSEMBLY -D V8_ENABLE_JAVASCRIPT_PROMISE_HOOKS -D V8_ALLOCATION_FOLDING -D V8_ALLOCATION_SITE_TRACKING -D V8_SCRIPTORMODULE_LEGACY_LIFETIME -D V8_ADVANCED_BIGINT_ALGORITHMS -D ICU_UTIL_DATA_IMPL=ICU_UTIL_DATA_STATIC -D UCONFIG_NO_SERVICE=1 -D U_ENABLE_DYLOAD=0 -D U_STATIC_IMPLEMENTATION=1 -D U_HAVE_STD_STRING=1 -D UCONFIG_NO_BREAK_ITERATION=0 -I ../deps/v8 -I ../deps/v8/include -I /home/maurizio/node-v18.6.0/out/Release/obj/gen/inspector-generated-output-root -I ../deps/v8/third_party/inspector_protocol -I /home/maurizio/node-v18.6.0/out/Release/obj/gen -I /home/maurizio/node-v18.6.0/out/Release/obj/gen/generate-bytecode-output-root -I ../deps/icu-small/source/i18n -I ../deps/icu-small/source/common -I ../deps/v8/third_party/zlib -I ../deps/v8/third_party/zlib/google -internal-isystem /usr/lib/gcc/x86_64-redhat-linux/8/../../../../include/c++/8 -internal-isystem /usr/lib/gcc/x86_64-redhat-linux/8/../../../../include/c++/8/x86_64-redhat-linux -internal-isystem /usr/lib/gcc/x86_64-redhat-linux/8/../../../../include/c++/8/backward -internal-isystem /usr/local/lib/clang/16.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-redhat-linux/8/../../../../x86_64-redhat-linux/include -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-unused-parameter -Wno-return-type -std=gnu++17 -fdeprecated-macro -fdebug-compilation-dir=/home/maurizio/node-v18.6.0/out -ferror-limit 19 -fno-rtti -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-08-22-142216-507842-1 -x c++ ../deps/v8/src/objects/elements.cc
1// Copyright 2012 the V8 project authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.

5#include "src/objects/elements.h"

7#include "src/base/atomicops.h"
8#include "src/base/safe_conversions.h"
9#include "src/common/message-template.h"
10#include "src/execution/arguments.h"
11#include "src/execution/frames.h"
12#include "src/execution/isolate-inl.h"
13#include "src/execution/protectors-inl.h"
14#include "src/heap/factory.h"
15#include "src/heap/heap-inl.h"  // For MaxNumberToStringCacheSize.
16#include "src/heap/heap-write-barrier-inl.h"
17#include "src/numbers/conversions.h"
18#include "src/objects/arguments-inl.h"
19#include "src/objects/hash-table-inl.h"
20#include "src/objects/js-array-buffer-inl.h"
21#include "src/objects/js-array-inl.h"
22#include "src/objects/keys.h"
23#include "src/objects/objects-inl.h"
24#include "src/objects/slots-atomic-inl.h"
25#include "src/objects/slots.h"
26#include "src/utils/utils.h"

28// Each concrete ElementsAccessor can handle exactly one ElementsKind,
29// several abstract ElementsAccessor classes are used to allow sharing
30// common code.
31//
32// Inheritance hierarchy:
33// - ElementsAccessorBase                        (abstract)
34//   - FastElementsAccessor                      (abstract)
35//     - FastSmiOrObjectElementsAccessor
36//       - FastPackedSmiElementsAccessor
37//       - FastHoleySmiElementsAccessor
38//       - FastPackedObjectElementsAccessor
39//       - FastNonextensibleObjectElementsAccessor: template
40//         - FastPackedNonextensibleObjectElementsAccessor
41//         - FastHoleyNonextensibleObjectElementsAccessor
42//       - FastSealedObjectElementsAccessor: template
43//         - FastPackedSealedObjectElementsAccessor
44//         - FastHoleySealedObjectElementsAccessor
45//       - FastFrozenObjectElementsAccessor: template
46//         - FastPackedFrozenObjectElementsAccessor
47//         - FastHoleyFrozenObjectElementsAccessor
48//       - FastHoleyObjectElementsAccessor
49//     - FastDoubleElementsAccessor
50//       - FastPackedDoubleElementsAccessor
51//       - FastHoleyDoubleElementsAccessor
52//   - TypedElementsAccessor: template, with instantiations:
53//     - Uint8ElementsAccessor
54//     - Int8ElementsAccessor
55//     - Uint16ElementsAccessor
56//     - Int16ElementsAccessor
57//     - Uint32ElementsAccessor
58//     - Int32ElementsAccessor
59//     - Float32ElementsAccessor
60//     - Float64ElementsAccessor
61//     - Uint8ClampedElementsAccessor
62//     - BigUint64ElementsAccessor
63//     - BigInt64ElementsAccessor
64//     - RabGsabUint8ElementsAccessor
65//     - RabGsabInt8ElementsAccessor
66//     - RabGsabUint16ElementsAccessor
67//     - RabGsabInt16ElementsAccessor
68//     - RabGsabUint32ElementsAccessor
69//     - RabGsabInt32ElementsAccessor
70//     - RabGsabFloat32ElementsAccessor
71//     - RabGsabFloat64ElementsAccessor
72//     - RabGsabUint8ClampedElementsAccessor
73//     - RabGsabBigUint64ElementsAccessor
74//     - RabGsabBigInt64ElementsAccessor
75//   - DictionaryElementsAccessor
76//   - SloppyArgumentsElementsAccessor
77//     - FastSloppyArgumentsElementsAccessor
78//     - SlowSloppyArgumentsElementsAccessor
79//   - StringWrapperElementsAccessor
80//     - FastStringWrapperElementsAccessor
81//     - SlowStringWrapperElementsAccessor

83namespace v8 {
84namespace internal {

86namespace {

88#define RETURN_NOTHING_IF_NOT_SUCCESSFUL(call) \
do {                                         \
  if (!(call)) return Nothing<bool>();       \
} while (false)

93#define RETURN_FAILURE_IF_NOT_SUCCESSFUL(call)          \
do {                                                  \
  ExceptionStatus status_enum_result = (call);        \
  if (!status_enum_result) return status_enum_result; \
} while (false)

99static const int kPackedSizeNotKnown = -1;

101enum Where { AT_START, AT_END };

103// First argument in list is the accessor class, the second argument is the
104// accessor ElementsKind, and the third is the backing store class.  Use the
105// fast element handler for smi-only arrays.  The implementation is currently
106// identical.  Note that the order must match that of the ElementsKind enum for
107// the |accessor_array[]| below to work.
108#define ELEMENTS_LIST(V)                                                      \
V(FastPackedSmiElementsAccessor, PACKED_SMI_ELEMENTS, FixedArray)           \
V(FastHoleySmiElementsAccessor, HOLEY_SMI_ELEMENTS, FixedArray)             \
V(FastPackedObjectElementsAccessor, PACKED_ELEMENTS, FixedArray)            \
V(FastHoleyObjectElementsAccessor, HOLEY_ELEMENTS, FixedArray)              \
V(FastPackedDoubleElementsAccessor, PACKED_DOUBLE_ELEMENTS,                 \
  FixedDoubleArray)                                                         \
V(FastHoleyDoubleElementsAccessor, HOLEY_DOUBLE_ELEMENTS, FixedDoubleArray) \
V(FastPackedNonextensibleObjectElementsAccessor,                            \
  PACKED_NONEXTENSIBLE_ELEMENTS, FixedArray)                                \
V(FastHoleyNonextensibleObjectElementsAccessor,                             \
  HOLEY_NONEXTENSIBLE_ELEMENTS, FixedArray)                                 \
V(FastPackedSealedObjectElementsAccessor, PACKED_SEALED_ELEMENTS,           \
  FixedArray)                                                               \
V(FastHoleySealedObjectElementsAccessor, HOLEY_SEALED_ELEMENTS, FixedArray) \
V(FastPackedFrozenObjectElementsAccessor, PACKED_FROZEN_ELEMENTS,           \
  FixedArray)                                                               \
V(FastHoleyFrozenObjectElementsAccessor, HOLEY_FROZEN_ELEMENTS, FixedArray) \
V(DictionaryElementsAccessor, DICTIONARY_ELEMENTS, NumberDictionary)        \
V(FastSloppyArgumentsElementsAccessor, FAST_SLOPPY_ARGUMENTS_ELEMENTS,      \
  FixedArray)                                                               \
V(SlowSloppyArgumentsElementsAccessor, SLOW_SLOPPY_ARGUMENTS_ELEMENTS,      \
  FixedArray)                                                               \
V(FastStringWrapperElementsAccessor, FAST_STRING_WRAPPER_ELEMENTS,          \
  FixedArray)                                                               \
V(SlowStringWrapperElementsAccessor, SLOW_STRING_WRAPPER_ELEMENTS,          \
  FixedArray)                                                               \
V(Uint8ElementsAccessor, UINT8_ELEMENTS, ByteArray)                         \
V(Int8ElementsAccessor, INT8_ELEMENTS, ByteArray)                           \
V(Uint16ElementsAccessor, UINT16_ELEMENTS, ByteArray)                       \
V(Int16ElementsAccessor, INT16_ELEMENTS, ByteArray)                         \
V(Uint32ElementsAccessor, UINT32_ELEMENTS, ByteArray)                       \
V(Int32ElementsAccessor, INT32_ELEMENTS, ByteArray)                         \
V(Float32ElementsAccessor, FLOAT32_ELEMENTS, ByteArray)                     \
V(Float64ElementsAccessor, FLOAT64_ELEMENTS, ByteArray)                     \
V(Uint8ClampedElementsAccessor, UINT8_CLAMPED_ELEMENTS, ByteArray)          \
V(BigUint64ElementsAccessor, BIGUINT64_ELEMENTS, ByteArray)                 \
V(BigInt64ElementsAccessor, BIGINT64_ELEMENTS, ByteArray)                   \
V(RabGsabUint8ElementsAccessor, RAB_GSAB_UINT8_ELEMENTS, ByteArray)         \
V(RabGsabInt8ElementsAccessor, RAB_GSAB_INT8_ELEMENTS, ByteArray)           \
V(RabGsabUint16ElementsAccessor, RAB_GSAB_UINT16_ELEMENTS, ByteArray)       \
V(RabGsabInt16ElementsAccessor, RAB_GSAB_INT16_ELEMENTS, ByteArray)         \
V(RabGsabUint32ElementsAccessor, RAB_GSAB_UINT32_ELEMENTS, ByteArray)       \
V(RabGsabInt32ElementsAccessor, RAB_GSAB_INT32_ELEMENTS, ByteArray)         \
V(RabGsabFloat32ElementsAccessor, RAB_GSAB_FLOAT32_ELEMENTS, ByteArray)     \
V(RabGsabFloat64ElementsAccessor, RAB_GSAB_FLOAT64_ELEMENTS, ByteArray)     \
V(RabGsabUint8ClampedElementsAccessor, RAB_GSAB_UINT8_CLAMPED_ELEMENTS,     \
  ByteArray)                                                                \
V(RabGsabBigUint64ElementsAccessor, RAB_GSAB_BIGUINT64_ELEMENTS, ByteArray) \
V(RabGsabBigInt64ElementsAccessor, RAB_GSAB_BIGINT64_ELEMENTS, ByteArray)

159template <ElementsKind Kind>
160class ElementsKindTraits {
public:
using BackingStore = FixedArrayBase;
163};

165#define ELEMENTS_TRAITS(Class, KindParam, Store)    \
template <>                                       \
class ElementsKindTraits<KindParam> {             \
 public: /* NOLINT */                             \
  static constexpr ElementsKind Kind = KindParam; \
  using BackingStore = Store;                     \
};                                                \
constexpr ElementsKind ElementsKindTraits<KindParam>::Kind;
173ELEMENTS_LIST(ELEMENTS_TRAITS)
174#undef ELEMENTS_TRAITS

176V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result))
177MaybeHandle<Object> ThrowArrayLengthRangeError(Isolate* isolate) {
THROW_NEW_ERROR(isolate, NewRangeError(MessageTemplate::kInvalidArrayLength),do { auto* __isolate__ = (isolate); return __isolate__->template
 Throw<Object>(__isolate__->factory()->NewRangeError
(MessageTemplate::kInvalidArrayLength)); } while (false)
                Object)do { auto* __isolate__ = (isolate); return __isolate__->template
 Throw<Object>(__isolate__->factory()->NewRangeError
(MessageTemplate::kInvalidArrayLength)); } while (false);
180}

182WriteBarrierMode GetWriteBarrierMode(FixedArrayBase elements, ElementsKind kind,
                                   const DisallowGarbageCollection& promise) {
if (IsSmiElementsKind(kind)) return SKIP_WRITE_BARRIER;
if (IsDoubleElementsKind(kind)) return SKIP_WRITE_BARRIER;
return elements.GetWriteBarrierMode(promise);
187}

189// If kCopyToEndAndInitializeToHole is specified as the copy_size to
190// CopyElements, it copies all of elements from source after source_start to
191// destination array, padding any remaining uninitialized elements in the
192// destination array with the hole.
193constexpr int kCopyToEndAndInitializeToHole = -1;

195void CopyObjectToObjectElements(Isolate* isolate, FixedArrayBase from_base,
                              ElementsKind from_kind, uint32_t from_start,
                              FixedArrayBase to_base, ElementsKind to_kind,
                              uint32_t to_start, int raw_copy_size) {
ReadOnlyRoots roots(isolate);
DCHECK(to_base.map() != roots.fixed_cow_array_map())((void) 0);
DisallowGarbageCollection no_gc;
int copy_size = raw_copy_size;
if (raw_copy_size < 0) {
  DCHECK_EQ(kCopyToEndAndInitializeToHole, raw_copy_size)((void) 0);
  copy_size =
      std::min(from_base.length() - from_start, to_base.length() - to_start);
  int start = to_start + copy_size;
  int length = to_base.length() - start;
  if (length > 0) {
    MemsetTagged(FixedArray::cast(to_base).RawFieldOfElementAt(start),
                 roots.the_hole_value(), length);
  }
}
DCHECK((copy_size + static_cast<int>(to_start)) <= to_base.length() &&((void) 0)
       (copy_size + static_cast<int>(from_start)) <= from_base.length())((void) 0);
if (copy_size == 0) return;
FixedArray from = FixedArray::cast(from_base);
FixedArray to = FixedArray::cast(to_base);
DCHECK(IsSmiOrObjectElementsKind(from_kind))((void) 0);
DCHECK(IsSmiOrObjectElementsKind(to_kind))((void) 0);

WriteBarrierMode write_barrier_mode =
    (IsObjectElementsKind(from_kind) && IsObjectElementsKind(to_kind))
        ? UPDATE_WRITE_BARRIER
        : SKIP_WRITE_BARRIER;
to.CopyElements(isolate, to_start, from, from_start, copy_size,
                write_barrier_mode);
228}

230void CopyDictionaryToObjectElements(Isolate* isolate, FixedArrayBase from_base,
                                  uint32_t from_start, FixedArrayBase to_base,
                                  ElementsKind to_kind, uint32_t to_start,
                                  int raw_copy_size) {
DisallowGarbageCollection no_gc;
NumberDictionary from = NumberDictionary::cast(from_base);
int copy_size = raw_copy_size;
if (raw_copy_size < 0) {
  DCHECK_EQ(kCopyToEndAndInitializeToHole, raw_copy_size)((void) 0);
  copy_size = from.max_number_key() + 1 - from_start;
  int start = to_start + copy_size;
  int length = to_base.length() - start;
  if (length > 0) {
    MemsetTagged(FixedArray::cast(to_base).RawFieldOfElementAt(start),
                 ReadOnlyRoots(isolate).the_hole_value(), length);
  }
}
DCHECK(to_base != from_base)((void) 0);
DCHECK(IsSmiOrObjectElementsKind(to_kind))((void) 0);
if (copy_size == 0) return;
FixedArray to = FixedArray::cast(to_base);
uint32_t to_length = to.length();
if (to_start + copy_size > to_length) {
  copy_size = to_length - to_start;
}
WriteBarrierMode write_barrier_mode = GetWriteBarrierMode(to, to_kind, no_gc);
for (int i = 0; i < copy_size; i++) {
  InternalIndex entry = from.FindEntry(isolate, i + from_start);
  if (entry.is_found()) {
    Object value = from.ValueAt(entry);
    DCHECK(!value.IsTheHole(isolate))((void) 0);
    to.set(i + to_start, value, write_barrier_mode);
  } else {
    to.set_the_hole(isolate, i + to_start);
  }
}
266}

268// NOTE: this method violates the handlified function signature convention:
269// raw pointer parameters in the function that allocates.
270// See ElementsAccessorBase::CopyElements() for details.
271void CopyDoubleToObjectElements(Isolate* isolate, FixedArrayBase from_base,
                              uint32_t from_start, FixedArrayBase to_base,
                              uint32_t to_start, int raw_copy_size) {
int copy_size = raw_copy_size;
if (raw_copy_size < 0) {
  DisallowGarbageCollection no_gc;
  DCHECK_EQ(kCopyToEndAndInitializeToHole, raw_copy_size)((void) 0);
  copy_size =
      std::min(from_base.length() - from_start, to_base.length() - to_start);
  // Also initialize the area that will be copied over since HeapNumber
  // allocation below can cause an incremental marking step, requiring all
  // existing heap objects to be propertly initialized.
  int start = to_start;
  int length = to_base.length() - start;
  if (length > 0) {
    MemsetTagged(FixedArray::cast(to_base).RawFieldOfElementAt(start),
                 ReadOnlyRoots(isolate).the_hole_value(), length);
  }
}

DCHECK((copy_size + static_cast<int>(to_start)) <= to_base.length() &&((void) 0)
       (copy_size + static_cast<int>(from_start)) <= from_base.length())((void) 0);
if (copy_size == 0) return;

// From here on, the code below could actually allocate. Therefore the raw
// values are wrapped into handles.
Handle<FixedDoubleArray> from(FixedDoubleArray::cast(from_base), isolate);
Handle<FixedArray> to(FixedArray::cast(to_base), isolate);

// Use an outer loop to not waste too much time on creating HandleScopes.
// On the other hand we might overflow a single handle scope depending on
// the copy_size.
int offset = 0;
while (offset < copy_size) {
  HandleScope scope(isolate);
  offset += 100;
  for (int i = offset - 100; i < offset && i < copy_size; ++i) {
    Handle<Object> value =
        FixedDoubleArray::get(*from, i + from_start, isolate);
    to->set(i + to_start, *value, UPDATE_WRITE_BARRIER);
  }
}
313}

315void CopyDoubleToDoubleElements(FixedArrayBase from_base, uint32_t from_start,
                              FixedArrayBase to_base, uint32_t to_start,
                              int raw_copy_size) {
DisallowGarbageCollection no_gc;
int copy_size = raw_copy_size;
if (raw_copy_size < 0) {
  DCHECK_EQ(kCopyToEndAndInitializeToHole, raw_copy_size)((void) 0);
  copy_size =
      std::min(from_base.length() - from_start, to_base.length() - to_start);
  for (int i = to_start + copy_size; i < to_base.length(); ++i) {
    FixedDoubleArray::cast(to_base).set_the_hole(i);
  }
}
DCHECK((copy_size + static_cast<int>(to_start)) <= to_base.length() &&((void) 0)
       (copy_size + static_cast<int>(from_start)) <= from_base.length())((void) 0);
if (copy_size == 0) return;
FixedDoubleArray from = FixedDoubleArray::cast(from_base);
FixedDoubleArray to = FixedDoubleArray::cast(to_base);
Address to_address = to.address() + FixedDoubleArray::kHeaderSize;
Address from_address = from.address() + FixedDoubleArray::kHeaderSize;
to_address += kDoubleSize * to_start;
from_address += kDoubleSize * from_start;
337#ifdef V8_COMPRESS_POINTERS
// TODO(ishell, v8:8875): we use CopyTagged() in order to avoid unaligned
// access to double values in the arrays. This will no longed be necessary
// once the allocations alignment issue is fixed.
int words_per_double = (kDoubleSize / kTaggedSize);
CopyTagged(to_address, from_address,
           static_cast<size_t>(words_per_double * copy_size));
344#else
int words_per_double = (kDoubleSize / kSystemPointerSize);
CopyWords(to_address, from_address,
          static_cast<size_t>(words_per_double * copy_size));
348#endif
349}

351void CopySmiToDoubleElements(FixedArrayBase from_base, uint32_t from_start,
                           FixedArrayBase to_base, uint32_t to_start,
                           int raw_copy_size) {
DisallowGarbageCollection no_gc;
int copy_size = raw_copy_size;
if (raw_copy_size < 0) {
  DCHECK_EQ(kCopyToEndAndInitializeToHole, raw_copy_size)((void) 0);
  copy_size = from_base.length() - from_start;
  for (int i = to_start + copy_size; i < to_base.length(); ++i) {
    FixedDoubleArray::cast(to_base).set_the_hole(i);
  }
}
DCHECK((copy_size + static_cast<int>(to_start)) <= to_base.length() &&((void) 0)
       (copy_size + static_cast<int>(from_start)) <= from_base.length())((void) 0);
if (copy_size == 0) return;
FixedArray from = FixedArray::cast(from_base);
FixedDoubleArray to = FixedDoubleArray::cast(to_base);
Object the_hole = from.GetReadOnlyRoots().the_hole_value();
for (uint32_t from_end = from_start + static_cast<uint32_t>(copy_size);
     from_start < from_end; from_start++, to_start++) {
  Object hole_or_smi = from.get(from_start);
  if (hole_or_smi == the_hole) {
    to.set_the_hole(to_start);
  } else {
    to.set(to_start, Smi::ToInt(hole_or_smi));
  }
}
378}

380void CopyPackedSmiToDoubleElements(FixedArrayBase from_base,
                                 uint32_t from_start, FixedArrayBase to_base,
                                 uint32_t to_start, int packed_size,
                                 int raw_copy_size) {
DisallowGarbageCollection no_gc;
int copy_size = raw_copy_size;
uint32_t to_end;
if (raw_copy_size < 0) {
  DCHECK_EQ(kCopyToEndAndInitializeToHole, raw_copy_size)((void) 0);
  copy_size = packed_size - from_start;
  to_end = to_base.length();
  for (uint32_t i = to_start + copy_size; i < to_end; ++i) {
    FixedDoubleArray::cast(to_base).set_the_hole(i);
  }
} else {
  to_end = to_start + static_cast<uint32_t>(copy_size);
}
DCHECK(static_cast<int>(to_end) <= to_base.length())((void) 0);
DCHECK(packed_size >= 0 && packed_size <= copy_size)((void) 0);
DCHECK((copy_size + static_cast<int>(to_start)) <= to_base.length() &&((void) 0)
       (copy_size + static_cast<int>(from_start)) <= from_base.length())((void) 0);
if (copy_size == 0) return;
FixedArray from = FixedArray::cast(from_base);
FixedDoubleArray to = FixedDoubleArray::cast(to_base);
for (uint32_t from_end = from_start + static_cast<uint32_t>(packed_size);
     from_start < from_end; from_start++, to_start++) {
  Object smi = from.get(from_start);
  DCHECK(!smi.IsTheHole())((void) 0);
  to.set(to_start, Smi::ToInt(smi));
}
410}

412void CopyObjectToDoubleElements(FixedArrayBase from_base, uint32_t from_start,
                              FixedArrayBase to_base, uint32_t to_start,
                              int raw_copy_size) {
DisallowGarbageCollection no_gc;
int copy_size = raw_copy_size;
if (raw_copy_size < 0) {
  DCHECK_EQ(kCopyToEndAndInitializeToHole, raw_copy_size)((void) 0);
  copy_size = from_base.length() - from_start;
  for (int i = to_start + copy_size; i < to_base.length(); ++i) {
    FixedDoubleArray::cast(to_base).set_the_hole(i);
  }
}
DCHECK((copy_size + static_cast<int>(to_start)) <= to_base.length() &&((void) 0)
       (copy_size + static_cast<int>(from_start)) <= from_base.length())((void) 0);
if (copy_size == 0) return;
FixedArray from = FixedArray::cast(from_base);
FixedDoubleArray to = FixedDoubleArray::cast(to_base);
Object the_hole = from.GetReadOnlyRoots().the_hole_value();
for (uint32_t from_end = from_start + copy_size; from_start < from_end;
     from_start++, to_start++) {
  Object hole_or_object = from.get(from_start);
  if (hole_or_object == the_hole) {
    to.set_the_hole(to_start);
  } else {
    to.set(to_start, hole_or_object.Number());
  }
}
439}

441void CopyDictionaryToDoubleElements(Isolate* isolate, FixedArrayBase from_base,
                                  uint32_t from_start, FixedArrayBase to_base,
                                  uint32_t to_start, int raw_copy_size) {
DisallowGarbageCollection no_gc;
NumberDictionary from = NumberDictionary::cast(from_base);
int copy_size = raw_copy_size;
if (copy_size < 0) {
  DCHECK_EQ(kCopyToEndAndInitializeToHole, copy_size)((void) 0);
  copy_size = from.max_number_key() + 1 - from_start;
  for (int i = to_start + copy_size; i < to_base.length(); ++i) {
    FixedDoubleArray::cast(to_base).set_the_hole(i);
  }
}
if (copy_size == 0) return;
FixedDoubleArray to = FixedDoubleArray::cast(to_base);
uint32_t to_length = to.length();
if (to_start + copy_size > to_length) {
  copy_size = to_length - to_start;
}
for (int i = 0; i < copy_size; i++) {
  InternalIndex entry = from.FindEntry(isolate, i + from_start);
  if (entry.is_found()) {
    to.set(i + to_start, from.ValueAt(entry).Number());
  } else {
    to.set_the_hole(i + to_start);
  }
}
468}

470void SortIndices(Isolate* isolate, Handle<FixedArray> indices,
               uint32_t sort_size) {
if (sort_size == 0) return;

// Use AtomicSlot wrapper to ensure that std::sort uses atomic load and
// store operations that are safe for concurrent marking.
AtomicSlot start(indices->GetFirstElementAddress());
AtomicSlot end(start + sort_size);
std::sort(start, end, [isolate](Tagged_t elementA, Tagged_t elementB) {
479#ifdef V8_COMPRESS_POINTERS
  Object a(DecompressTaggedAny(isolate, elementA));
  Object b(DecompressTaggedAny(isolate, elementB));
482#else
  Object a(elementA);
  Object b(elementB);
485#endif
  if (a.IsSmi() || !a.IsUndefined(isolate)) {
    if (!b.IsSmi() && b.IsUndefined(isolate)) {
      return true;
    }
    return a.Number() < b.Number();
  }
  return !b.IsSmi() && b.IsUndefined(isolate);
});
isolate->heap()->WriteBarrierForRange(*indices, ObjectSlot(start),
                                      ObjectSlot(end));
496}

498Maybe<bool> IncludesValueSlowPath(Isolate* isolate, Handle<JSObject> receiver,
                                Handle<Object> value, size_t start_from,
                                size_t length) {
bool search_for_hole = value->IsUndefined(isolate);
for (size_t k = start_from; k < length; ++k) {
  LookupIterator it(isolate, receiver, k);
  if (!it.IsFound()) {
    if (search_for_hole) return Just(true);
    continue;
  }
  Handle<Object> element_k;
  ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, element_k,do { if (!(Object::GetProperty(&it)).ToHandle(&element_k
)) { ((void) 0); return Nothing<bool>(); } } while (false
)
                                   Object::GetProperty(&it), Nothing<bool>())do { if (!(Object::GetProperty(&it)).ToHandle(&element_k
)) { ((void) 0); return Nothing<bool>(); } } while (false
);

  if (value->SameValueZero(*element_k)) return Just(true);
}

return Just(false);
516}

518Maybe<int64_t> IndexOfValueSlowPath(Isolate* isolate, Handle<JSObject> receiver,
                                  Handle<Object> value, size_t start_from,
                                  size_t length) {
for (size_t k = start_from; k < length; ++k) {
  LookupIterator it(isolate, receiver, k);
  if (!it.IsFound()) {
    continue;
  }
  Handle<Object> element_k;
  ASSIGN_RETURN_ON_EXCEPTION_VALUE(do { if (!(Object::GetProperty(&it)).ToHandle(&element_k
)) { ((void) 0); return Nothing<int64_t>(); } } while (
false)
      isolate, element_k, Object::GetProperty(&it), Nothing<int64_t>())do { if (!(Object::GetProperty(&it)).ToHandle(&element_k
)) { ((void) 0); return Nothing<int64_t>(); } } while (
false);

  if (value->StrictEquals(*element_k)) return Just<int64_t>(k);
}

return Just<int64_t>(-1);
534}

536// The InternalElementsAccessor is a helper class to expose otherwise protected
537// methods to its subclasses. Namely, we don't want to publicly expose methods
538// that take an entry (instead of an index) as an argument.
539class InternalElementsAccessor : public ElementsAccessor {
public:
InternalIndex GetEntryForIndex(Isolate* isolate, JSObject holder,
                               FixedArrayBase backing_store,
                               size_t index) override = 0;

PropertyDetails GetDetails(JSObject holder, InternalIndex entry) override = 0;
546};

548// Base class for element handler implementations. Contains the
549// the common logic for objects with different ElementsKinds.
550// Subclasses must specialize method for which the element
551// implementation differs from the base class implementation.
552//
553// This class is intended to be used in the following way:
554//
555//   class SomeElementsAccessor :
556//       public ElementsAccessorBase<SomeElementsAccessor,
557//                                   BackingStoreClass> {
558//     ...
559//   }
560//
561// This is an example of the Curiously Recurring Template Pattern (see
562// http://en.wikipedia.org/wiki/Curiously_recurring_template_pattern).  We use
563// CRTP to guarantee aggressive compile time optimizations (i.e.  inlining and
564// specialization of SomeElementsAccessor methods).
565template <typename Subclass, typename ElementsTraitsParam>
566class ElementsAccessorBase : public InternalElementsAccessor {
public:
ElementsAccessorBase() = default;
ElementsAccessorBase(const ElementsAccessorBase&) = delete;
ElementsAccessorBase& operator=(const ElementsAccessorBase&) = delete;

using ElementsTraits = ElementsTraitsParam;
using BackingStore = typename ElementsTraitsParam::BackingStore;

static ElementsKind kind() { return ElementsTraits::Kind; }

static void ValidateContents(JSObject holder, size_t length) {}

static void ValidateImpl(JSObject holder) {
  FixedArrayBase fixed_array_base = holder.elements();
  if (!fixed_array_base.IsHeapObject()) return;
  // Arrays that have been shifted in place can't be verified.
  if (fixed_array_base.IsFreeSpaceOrFiller()) return;
  size_t length = 0;
  if (holder.IsJSArray()) {
    Object length_obj = JSArray::cast(holder).length();
    if (length_obj.IsSmi()) {
      length = Smi::ToInt(length_obj);
    }
  } else if (holder.IsJSTypedArray()) {
    length = JSTypedArray::cast(holder).length();
  } else {
    length = fixed_array_base.length();
  }
  Subclass::ValidateContents(holder, length);
}

void Validate(JSObject holder) final {
  DisallowGarbageCollection no_gc;
  Subclass::ValidateImpl(holder);
}

bool HasElement(JSObject holder, uint32_t index, FixedArrayBase backing_store,
                PropertyFilter filter) final {
  return Subclass::HasElementImpl(holder.GetIsolate(), holder, index,
                                  backing_store, filter);
}

static bool HasElementImpl(Isolate* isolate, JSObject holder, size_t index,
                           FixedArrayBase backing_store,
                           PropertyFilter filter = ALL_PROPERTIES) {
  return Subclass::GetEntryForIndexImpl(isolate, holder, backing_store, index,
                                        filter)
      .is_found();
}

bool HasEntry(JSObject holder, InternalIndex entry) final {
  return Subclass::HasEntryImpl(holder.GetIsolate(), holder.elements(),
                                entry);
}

static bool HasEntryImpl(Isolate* isolate, FixedArrayBase backing_store,
                         InternalIndex entry) {
  UNIMPLEMENTED()V8_Fatal("unimplemented code");
}

bool HasAccessors(JSObject holder) final {
  return Subclass::HasAccessorsImpl(holder, holder.elements());
}

static bool HasAccessorsImpl(JSObject holder, FixedArrayBase backing_store) {
  return false;
}

Handle<Object> Get(Handle<JSObject> holder, InternalIndex entry) final {
  return Subclass::GetInternalImpl(holder, entry);
}

static Handle<Object> GetInternalImpl(Handle<JSObject> holder,
                                      InternalIndex entry) {
  return Subclass::GetImpl(holder->GetIsolate(), holder->elements(), entry);
}

static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase backing_store,
                              InternalIndex entry) {
  return handle(BackingStore::cast(backing_store).get(entry.as_int()),
                isolate);
}

void Set(Handle<JSObject> holder, InternalIndex entry, Object value) final {
  Subclass::SetImpl(holder, entry, value);
}

void Reconfigure(Handle<JSObject> object, Handle<FixedArrayBase> store,
                 InternalIndex entry, Handle<Object> value,
                 PropertyAttributes attributes) final {
  Subclass::ReconfigureImpl(object, store, entry, value, attributes);
}

static void ReconfigureImpl(Handle<JSObject> object,
                            Handle<FixedArrayBase> store, InternalIndex entry,
                            Handle<Object> value,
                            PropertyAttributes attributes) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

Maybe<bool> Add(Handle<JSObject> object, uint32_t index, Handle<Object> value,
                PropertyAttributes attributes, uint32_t new_capacity) final {
  return Subclass::AddImpl(object, index, value, attributes, new_capacity);
}

static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

Maybe<uint32_t> Push(Handle<JSArray> receiver, BuiltinArguments* args,
                     uint32_t push_size) final {
  return Subclass::PushImpl(receiver, args, push_size);
}

static Maybe<uint32_t> PushImpl(Handle<JSArray> receiver,
                                BuiltinArguments* args, uint32_t push_sized) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

Maybe<uint32_t> Unshift(Handle<JSArray> receiver, BuiltinArguments* args,
                        uint32_t unshift_size) final {
  return Subclass::UnshiftImpl(receiver, args, unshift_size);
}

static Maybe<uint32_t> UnshiftImpl(Handle<JSArray> receiver,
                                   BuiltinArguments* args,
                                   uint32_t unshift_size) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

MaybeHandle<Object> Pop(Handle<JSArray> receiver) final {
  return Subclass::PopImpl(receiver);
}

static MaybeHandle<Object> PopImpl(Handle<JSArray> receiver) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

MaybeHandle<Object> Shift(Handle<JSArray> receiver) final {
  return Subclass::ShiftImpl(receiver);
}

static MaybeHandle<Object> ShiftImpl(Handle<JSArray> receiver) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

Maybe<bool> SetLength(Handle<JSArray> array, uint32_t length) final {
  return Subclass::SetLengthImpl(
      array->GetIsolate(), array, length,
      handle(array->elements(), array->GetIsolate()));
}

static Maybe<bool> SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
                                 uint32_t length,
                                 Handle<FixedArrayBase> backing_store) {
  DCHECK(!array->SetLengthWouldNormalize(length))((void) 0);
  DCHECK(IsFastElementsKind(array->GetElementsKind()))((void) 0);
  uint32_t old_length = 0;
  CHECK(array->length().ToArrayIndex(&old_length))do { if ((__builtin_expect(!!(!(array->length().ToArrayIndex
(&old_length))), 0))) { V8_Fatal("Check failed: %s.", "array->length().ToArrayIndex(&old_length)"
); } } while (false);

  if (old_length < length) {
    ElementsKind kind = array->GetElementsKind();
    if (!IsHoleyElementsKind(kind)) {
      kind = GetHoleyElementsKind(kind);
      JSObject::TransitionElementsKind(array, kind);
    }
  }

  // Check whether the backing store should be shrunk.
  uint32_t capacity = backing_store->length();
  old_length = std::min(old_length, capacity);
  if (length == 0) {
    array->initialize_elements();
  } else if (length <= capacity) {
    if (IsSmiOrObjectElementsKind(kind())) {
      JSObject::EnsureWritableFastElements(array);
      if (array->elements() != *backing_store) {
        backing_store = handle(array->elements(), isolate);
      }
    }
    if (2 * length + JSObject::kMinAddedElementsCapacity <= capacity) {
      // If more than half the elements won't be used, trim the array.
      // Do not trim from short arrays to prevent frequent trimming on
      // repeated pop operations.
      // Leave some space to allow for subsequent push operations.
      int elements_to_trim = length + 1 == old_length
                                 ? (capacity - length) / 2
                                 : capacity - length;
      isolate->heap()->RightTrimFixedArray(*backing_store, elements_to_trim);
      // Fill the non-trimmed elements with holes.
      BackingStore::cast(*backing_store)
          .FillWithHoles(length,
                         std::min(old_length, capacity - elements_to_trim));
    } else {
      // Otherwise, fill the unused tail with holes.
      BackingStore::cast(*backing_store).FillWithHoles(length, old_length);
    }
  } else {
    // Check whether the backing store should be expanded.
    capacity = std::max(length, JSObject::NewElementsCapacity(capacity));
    MAYBE_RETURN(Subclass::GrowCapacityAndConvertImpl(array, capacity),do { if ((Subclass::GrowCapacityAndConvertImpl(array, capacity
)).IsNothing()) return Nothing<bool>(); } while (false)
                 Nothing<bool>())do { if ((Subclass::GrowCapacityAndConvertImpl(array, capacity
)).IsNothing()) return Nothing<bool>(); } while (false);
  }

  array->set_length(Smi::FromInt(length));
  JSObject::ValidateElements(*array);
  return Just(true);
}

size_t NumberOfElements(JSObject receiver) final {
  return Subclass::NumberOfElementsImpl(receiver, receiver.elements());
}

static uint32_t NumberOfElementsImpl(JSObject receiver,
                                     FixedArrayBase backing_store) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static size_t GetMaxIndex(JSObject receiver, FixedArrayBase elements) {
  if (receiver.IsJSArray()) {
    DCHECK(JSArray::cast(receiver).length().IsSmi())((void) 0);
    return static_cast<uint32_t>(
        Smi::ToInt(JSArray::cast(receiver).length()));
  }
  return Subclass::GetCapacityImpl(receiver, elements);
}

static size_t GetMaxNumberOfEntries(JSObject receiver,
                                    FixedArrayBase elements) {
  return Subclass::GetMaxIndex(receiver, elements);
}

static MaybeHandle<FixedArrayBase> ConvertElementsWithCapacity(
    Handle<JSObject> object, Handle<FixedArrayBase> old_elements,
    ElementsKind from_kind, uint32_t capacity) {
  return ConvertElementsWithCapacity(object, old_elements, from_kind,
                                     capacity, 0, 0);
}

static MaybeHandle<FixedArrayBase> ConvertElementsWithCapacity(
    Handle<JSObject> object, Handle<FixedArrayBase> old_elements,
    ElementsKind from_kind, uint32_t capacity, uint32_t src_index,
    uint32_t dst_index) {
  Isolate* isolate = object->GetIsolate();
  Handle<FixedArrayBase> new_elements;
  // TODO(victorgomes): Retrieve native context in optimized code
  // and remove the check isolate->context().is_null().
  if (IsDoubleElementsKind(kind())) {
    if (!isolate->context().is_null() &&
        !base::IsInRange(capacity, 0, FixedDoubleArray::kMaxLength)) {
      return isolate->Throw<FixedArrayBase>(isolate->factory()->NewRangeError(
          MessageTemplate::kInvalidArrayLength));
    }
    new_elements = isolate->factory()->NewFixedDoubleArray(capacity);
  } else {
    if (!isolate->context().is_null() &&
        !base::IsInRange(capacity, 0, FixedArray::kMaxLength)) {
      return isolate->Throw<FixedArrayBase>(isolate->factory()->NewRangeError(
          MessageTemplate::kInvalidArrayLength));
    }
    new_elements = isolate->factory()->NewFixedArray(capacity);
  }

  int packed_size = kPackedSizeNotKnown;
  if (IsFastPackedElementsKind(from_kind) && object->IsJSArray()) {
    packed_size = Smi::ToInt(JSArray::cast(*object).length());
  }

  Subclass::CopyElementsImpl(isolate, *old_elements, src_index, *new_elements,
                             from_kind, dst_index, packed_size,
                             kCopyToEndAndInitializeToHole);

  return MaybeHandle<FixedArrayBase>(new_elements);
}

static Maybe<bool> TransitionElementsKindImpl(Handle<JSObject> object,
                                              Handle<Map> to_map) {
  Isolate* isolate = object->GetIsolate();
  Handle<Map> from_map = handle(object->map(), isolate);
  ElementsKind from_kind = from_map->elements_kind();
  ElementsKind to_kind = to_map->elements_kind();
  if (IsHoleyElementsKind(from_kind)) {
    to_kind = GetHoleyElementsKind(to_kind);
  }
  if (from_kind != to_kind) {
    // This method should never be called for any other case.
    DCHECK(IsFastElementsKind(from_kind))((void) 0);
    DCHECK(IsFastElementsKind(to_kind))((void) 0);
    DCHECK_NE(TERMINAL_FAST_ELEMENTS_KIND, from_kind)((void) 0);

    Handle<FixedArrayBase> from_elements(object->elements(), isolate);
    if (object->elements() == ReadOnlyRoots(isolate).empty_fixed_array() ||
        IsDoubleElementsKind(from_kind) == IsDoubleElementsKind(to_kind)) {
      // No change is needed to the elements() buffer, the transition
      // only requires a map change.
      JSObject::MigrateToMap(isolate, object, to_map);
    } else {
      DCHECK(((void) 0)
          (IsSmiElementsKind(from_kind) && IsDoubleElementsKind(to_kind)) ||((void) 0)
          (IsDoubleElementsKind(from_kind) && IsObjectElementsKind(to_kind)))((void) 0);
      uint32_t capacity = static_cast<uint32_t>(object->elements().length());
      Handle<FixedArrayBase> elements;
      ASSIGN_RETURN_ON_EXCEPTION_VALUE(do { if (!(ConvertElementsWithCapacity(object, from_elements,
 from_kind, capacity)).ToHandle(&elements)) { ((void) 0);
 return Nothing<bool>(); } } while (false)
          object->GetIsolate(), elements,do { if (!(ConvertElementsWithCapacity(object, from_elements,
 from_kind, capacity)).ToHandle(&elements)) { ((void) 0);
 return Nothing<bool>(); } } while (false)
          ConvertElementsWithCapacity(object, from_elements, from_kind,do { if (!(ConvertElementsWithCapacity(object, from_elements,
 from_kind, capacity)).ToHandle(&elements)) { ((void) 0);
 return Nothing<bool>(); } } while (false)
                                      capacity),do { if (!(ConvertElementsWithCapacity(object, from_elements,
 from_kind, capacity)).ToHandle(&elements)) { ((void) 0);
 return Nothing<bool>(); } } while (false)
          Nothing<bool>())do { if (!(ConvertElementsWithCapacity(object, from_elements,
 from_kind, capacity)).ToHandle(&elements)) { ((void) 0);
 return Nothing<bool>(); } } while (false);
      JSObject::SetMapAndElements(object, to_map, elements);
    }
    if (FLAG_trace_elements_transitions) {
      JSObject::PrintElementsTransition(stdoutstdout, object, from_kind,
                                        from_elements, to_kind,
                                        handle(object->elements(), isolate));
    }
  }
  return Just(true);
}

static Maybe<bool> GrowCapacityAndConvertImpl(Handle<JSObject> object,
                                              uint32_t capacity) {
  ElementsKind from_kind = object->GetElementsKind();
  if (IsSmiOrObjectElementsKind(from_kind)) {
    // Array optimizations rely on the prototype lookups of Array objects
    // always returning undefined. If there is a store to the initial
    // prototype object, make sure all of these optimizations are invalidated.
    object->GetIsolate()->UpdateNoElementsProtectorOnSetLength(object);
  }
  Handle<FixedArrayBase> old_elements(object->elements(),
                                      object->GetIsolate());
  // This method should only be called if there's a reason to update the
  // elements.
  DCHECK(IsDoubleElementsKind(from_kind) != IsDoubleElementsKind(kind()) ||((void) 0)
         IsDictionaryElementsKind(from_kind) ||((void) 0)
         static_cast<uint32_t>(old_elements->length()) < capacity)((void) 0);
  return Subclass::BasicGrowCapacityAndConvertImpl(
      object, old_elements, from_kind, kind(), capacity);
}

static Maybe<bool> BasicGrowCapacityAndConvertImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> old_elements,
    ElementsKind from_kind, ElementsKind to_kind, uint32_t capacity) {
  Handle<FixedArrayBase> elements;
  ASSIGN_RETURN_ON_EXCEPTION_VALUE(do { if (!(ConvertElementsWithCapacity(object, old_elements, from_kind
, capacity)).ToHandle(&elements)) { ((void) 0); return Nothing
<bool>(); } } while (false)
      object->GetIsolate(), elements,do { if (!(ConvertElementsWithCapacity(object, old_elements, from_kind
, capacity)).ToHandle(&elements)) { ((void) 0); return Nothing
<bool>(); } } while (false)
      ConvertElementsWithCapacity(object, old_elements, from_kind, capacity),do { if (!(ConvertElementsWithCapacity(object, old_elements, from_kind
, capacity)).ToHandle(&elements)) { ((void) 0); return Nothing
<bool>(); } } while (false)
      Nothing<bool>())do { if (!(ConvertElementsWithCapacity(object, old_elements, from_kind
, capacity)).ToHandle(&elements)) { ((void) 0); return Nothing
<bool>(); } } while (false);

  if (IsHoleyElementsKind(from_kind)) {
    to_kind = GetHoleyElementsKind(to_kind);
  }
  Handle<Map> new_map = JSObject::GetElementsTransitionMap(object, to_kind);
  JSObject::SetMapAndElements(object, new_map, elements);

  // Transition through the allocation site as well if present.
  JSObject::UpdateAllocationSite(object, to_kind);

  if (FLAG_trace_elements_transitions) {
    JSObject::PrintElementsTransition(stdoutstdout, object, from_kind, old_elements,
                                      to_kind, elements);
  }
  return Just(true);
}

Maybe<bool> TransitionElementsKind(Handle<JSObject> object,
                                   Handle<Map> map) final {
  return Subclass::TransitionElementsKindImpl(object, map);
}

Maybe<bool> GrowCapacityAndConvert(Handle<JSObject> object,
                                   uint32_t capacity) final {
  return Subclass::GrowCapacityAndConvertImpl(object, capacity);
}

Maybe<bool> GrowCapacity(Handle<JSObject> object, uint32_t index) final {
  // This function is intended to be called from optimized code. We don't
  // want to trigger lazy deopts there, so refuse to handle cases that would.
  if (object->map().is_prototype_map() ||
      object->WouldConvertToSlowElements(index)) {
    return Just(false);
  }
  Handle<FixedArrayBase> old_elements(object->elements(),
                                      object->GetIsolate());
  uint32_t new_capacity = JSObject::NewElementsCapacity(index + 1);
  DCHECK(static_cast<uint32_t>(old_elements->length()) < new_capacity)((void) 0);
  Handle<FixedArrayBase> elements;
  ASSIGN_RETURN_ON_EXCEPTION_VALUE(do { if (!(ConvertElementsWithCapacity(object, old_elements, kind
(), new_capacity)).ToHandle(&elements)) { ((void) 0); return
 Nothing<bool>(); } } while (false)
      object->GetIsolate(), elements,do { if (!(ConvertElementsWithCapacity(object, old_elements, kind
(), new_capacity)).ToHandle(&elements)) { ((void) 0); return
 Nothing<bool>(); } } while (false)
      ConvertElementsWithCapacity(object, old_elements, kind(), new_capacity),do { if (!(ConvertElementsWithCapacity(object, old_elements, kind
(), new_capacity)).ToHandle(&elements)) { ((void) 0); return
 Nothing<bool>(); } } while (false)
      Nothing<bool>())do { if (!(ConvertElementsWithCapacity(object, old_elements, kind
(), new_capacity)).ToHandle(&elements)) { ((void) 0); return
 Nothing<bool>(); } } while (false);

  DCHECK_EQ(object->GetElementsKind(), kind())((void) 0);
  // Transition through the allocation site as well if present.
  if (JSObject::UpdateAllocationSite<AllocationSiteUpdateMode::kCheckOnly>(
          object, kind())) {
    return Just(false);
  }

  object->set_elements(*elements);
  return Just(true);
}

void Delete(Handle<JSObject> obj, InternalIndex entry) final {
  Subclass::DeleteImpl(obj, entry);
}

static void CopyElementsImpl(Isolate* isolate, FixedArrayBase from,
                             uint32_t from_start, FixedArrayBase to,
                             ElementsKind from_kind, uint32_t to_start,
                             int packed_size, int copy_size) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

void CopyElements(JSObject from_holder, uint32_t from_start,
                  ElementsKind from_kind, Handle<FixedArrayBase> to,
                  uint32_t to_start, int copy_size) final {
  int packed_size = kPackedSizeNotKnown;
  bool is_packed =
      IsFastPackedElementsKind(from_kind) && from_holder.IsJSArray();
  if (is_packed) {
    packed_size = Smi::ToInt(JSArray::cast(from_holder).length());
    if (copy_size >= 0 && packed_size > copy_size) {
      packed_size = copy_size;
    }
  }
  FixedArrayBase from = from_holder.elements();
  // NOTE: the Subclass::CopyElementsImpl() methods
  // violate the handlified function signature convention:
  // raw pointer parameters in the function that allocates. This is done
  // intentionally to avoid ArrayConcat() builtin performance degradation.
  //
  // Details: The idea is that allocations actually happen only in case of
  // copying from object with fast double elements to object with object
  // elements. In all the other cases there are no allocations performed and
  // handle creation causes noticeable performance degradation of the builtin.
  Subclass::CopyElementsImpl(from_holder.GetIsolate(), from, from_start, *to,
                             from_kind, to_start, packed_size, copy_size);
}

void CopyElements(Isolate* isolate, Handle<FixedArrayBase> source,
                  ElementsKind source_kind,
                  Handle<FixedArrayBase> destination, int size) override {
  Subclass::CopyElementsImpl(isolate, *source, 0, *destination, source_kind,
                             0, kPackedSizeNotKnown, size);
}

void CopyTypedArrayElementsSlice(JSTypedArray source,
                                 JSTypedArray destination, size_t start,
                                 size_t end) override {
  Subclass::CopyTypedArrayElementsSliceImpl(source, destination, start, end);
}

static void CopyTypedArrayElementsSliceImpl(JSTypedArray source,
                                            JSTypedArray destination,
                                            size_t start, size_t end) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

Object CopyElements(Handle<Object> source, Handle<JSObject> destination,
                    size_t length, size_t offset) final {
  return Subclass::CopyElementsHandleImpl(source, destination, length,
                                          offset);
}

static Object CopyElementsHandleImpl(Handle<Object> source,
                                     Handle<JSObject> destination,
                                     size_t length, size_t offset) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

Handle<NumberDictionary> Normalize(Handle<JSObject> object) final {
  return Subclass::NormalizeImpl(
      object, handle(object->elements(), object->GetIsolate()));
}

static Handle<NumberDictionary> NormalizeImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> elements) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

Maybe<bool> CollectValuesOrEntries(Isolate* isolate, Handle<JSObject> object,
                                   Handle<FixedArray> values_or_entries,
                                   bool get_entries, int* nof_items,
                                   PropertyFilter filter) override {
  return Subclass::CollectValuesOrEntriesImpl(
      isolate, object, values_or_entries, get_entries, nof_items, filter);
}

static Maybe<bool> CollectValuesOrEntriesImpl(
    Isolate* isolate, Handle<JSObject> object,
    Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
    PropertyFilter filter) {
  DCHECK_EQ(*nof_items, 0)((void) 0);
  KeyAccumulator accumulator(isolate, KeyCollectionMode::kOwnOnly,
                             ALL_PROPERTIES);
  RETURN_NOTHING_IF_NOT_SUCCESSFUL(Subclass::CollectElementIndicesImpl(
      object, handle(object->elements(), isolate), &accumulator));
  Handle<FixedArray> keys = accumulator.GetKeys();

  int count = 0;
  int i = 0;
  ElementsKind original_elements_kind = object->GetElementsKind();

  for (; i < keys->length(); ++i) {
    Handle<Object> key(keys->get(i), isolate);
    uint32_t index;
    if (!key->ToUint32(&index)) continue;

    DCHECK_EQ(object->GetElementsKind(), original_elements_kind)((void) 0);
    InternalIndex entry = Subclass::GetEntryForIndexImpl(
        isolate, *object, object->elements(), index, filter);
    if (entry.is_not_found()) continue;
    PropertyDetails details = Subclass::GetDetailsImpl(*object, entry);

    Handle<Object> value;
    if (details.kind() == PropertyKind::kData) {
      value = Subclass::GetInternalImpl(object, entry);
    } else {
      // This might modify the elements and/or change the elements kind.
      LookupIterator it(isolate, object, index, LookupIterator::OWN);
      ASSIGN_RETURN_ON_EXCEPTION_VALUE(do { if (!(Object::GetProperty(&it)).ToHandle(&value)
) { ((void) 0); return Nothing<bool>(); } } while (false
)
          isolate, value, Object::GetProperty(&it), Nothing<bool>())do { if (!(Object::GetProperty(&it)).ToHandle(&value)
) { ((void) 0); return Nothing<bool>(); } } while (false
);
    }
    if (get_entries) value = MakeEntryPair(isolate, index, value);
    values_or_entries->set(count++, *value);
    if (object->GetElementsKind() != original_elements_kind) break;
  }

  // Slow path caused by changes in elements kind during iteration.
  for (; i < keys->length(); i++) {
    Handle<Object> key(keys->get(i), isolate);
    uint32_t index;
    if (!key->ToUint32(&index)) continue;

    if (filter & ONLY_ENUMERABLE) {
      InternalElementsAccessor* accessor =
          reinterpret_cast<InternalElementsAccessor*>(
              object->GetElementsAccessor());
      InternalIndex entry = accessor->GetEntryForIndex(
          isolate, *object, object->elements(), index);
      if (entry.is_not_found()) continue;
      PropertyDetails details = accessor->GetDetails(*object, entry);
      if (!details.IsEnumerable()) continue;
    }

    Handle<Object> value;
    LookupIterator it(isolate, object, index, LookupIterator::OWN);
    ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, value, Object::GetProperty(&it),do { if (!(Object::GetProperty(&it)).ToHandle(&value)
) { ((void) 0); return Nothing<bool>(); } } while (false
)
                                     Nothing<bool>())do { if (!(Object::GetProperty(&it)).ToHandle(&value)
) { ((void) 0); return Nothing<bool>(); } } while (false
);

    if (get_entries) value = MakeEntryPair(isolate, index, value);
    values_or_entries->set(count++, *value);
  }

  *nof_items = count;
  return Just(true);
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) ExceptionStatus CollectElementIndices(
    Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
    KeyAccumulator* keys) final {
  if (keys->filter() & ONLY_ALL_CAN_READ) return ExceptionStatus::kSuccess;
  return Subclass::CollectElementIndicesImpl(object, backing_store, keys);
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus CollectElementIndicesImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
    KeyAccumulator* keys) {
  DCHECK_NE(DICTIONARY_ELEMENTS, kind())((void) 0);
  // Non-dictionary elements can't have all-can-read accessors.
  size_t length = Subclass::GetMaxIndex(*object, *backing_store);
  PropertyFilter filter = keys->filter();
  Isolate* isolate = keys->isolate();
  Factory* factory = isolate->factory();
  for (size_t i = 0; i < length; i++) {
    if (Subclass::HasElementImpl(isolate, *object, i, *backing_store,
                                 filter)) {
      RETURN_FAILURE_IF_NOT_SUCCESSFUL(
          keys->AddKey(factory->NewNumberFromSize(i)));
    }
  }
  return ExceptionStatus::kSuccess;
}

static Handle<FixedArray> DirectCollectElementIndicesImpl(
    Isolate* isolate, Handle<JSObject> object,
    Handle<FixedArrayBase> backing_store, GetKeysConversion convert,
    PropertyFilter filter, Handle<FixedArray> list, uint32_t* nof_indices,
    uint32_t insertion_index = 0) {
  size_t length = Subclass::GetMaxIndex(*object, *backing_store);
  uint32_t const kMaxStringTableEntries =
      isolate->heap()->MaxNumberToStringCacheSize();
  for (size_t i = 0; i < length; i++) {
    if (Subclass::HasElementImpl(isolate, *object, i, *backing_store,
                                 filter)) {
      if (convert == GetKeysConversion::kConvertToString) {
        bool use_cache = i < kMaxStringTableEntries;
        Handle<String> index_string =
            isolate->factory()->SizeToString(i, use_cache);
        list->set(insertion_index, *index_string);
      } else {
        Handle<Object> number = isolate->factory()->NewNumberFromSize(i);
        list->set(insertion_index, *number);
      }
      insertion_index++;
    }
  }
  *nof_indices = insertion_index;
  return list;
}

MaybeHandle<FixedArray> PrependElementIndices(
    Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
    Handle<FixedArray> keys, GetKeysConversion convert,
    PropertyFilter filter) final {
  return Subclass::PrependElementIndicesImpl(object, backing_store, keys,
                                             convert, filter);
}

static MaybeHandle<FixedArray> PrependElementIndicesImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
    Handle<FixedArray> keys, GetKeysConversion convert,
    PropertyFilter filter) {
  Isolate* isolate = object->GetIsolate();
  uint32_t nof_property_keys = keys->length();
  size_t initial_list_length =
      Subclass::GetMaxNumberOfEntries(*object, *backing_store);

  if (initial_list_length > FixedArray::kMaxLength - nof_property_keys) {
    return isolate->Throw<FixedArray>(isolate->factory()->NewRangeError(
        MessageTemplate::kInvalidArrayLength));
  }
  initial_list_length += nof_property_keys;

  // Collect the element indices into a new list.
  DCHECK_LE(initial_list_length, std::numeric_limits<int>::max())((void) 0);
  MaybeHandle<FixedArray> raw_array = isolate->factory()->TryNewFixedArray(
      static_cast<int>(initial_list_length));
  Handle<FixedArray> combined_keys;

  // If we have a holey backing store try to precisely estimate the backing
  // store size as a last emergency measure if we cannot allocate the big
  // array.
  if (!raw_array.ToHandle(&combined_keys)) {
    if (IsHoleyOrDictionaryElementsKind(kind())) {
      // If we overestimate the result list size we might end up in the
      // large-object space which doesn't free memory on shrinking the list.
      // Hence we try to estimate the final size for holey backing stores more
      // precisely here.
      initial_list_length =
          Subclass::NumberOfElementsImpl(*object, *backing_store);
      initial_list_length += nof_property_keys;
    }
    DCHECK_LE(initial_list_length, std::numeric_limits<int>::max())((void) 0);
    combined_keys = isolate->factory()->NewFixedArray(
        static_cast<int>(initial_list_length));
  }

  uint32_t nof_indices = 0;
  bool needs_sorting = IsDictionaryElementsKind(kind()) ||
                       IsSloppyArgumentsElementsKind(kind());
  combined_keys = Subclass::DirectCollectElementIndicesImpl(
      isolate, object, backing_store,
      needs_sorting ? GetKeysConversion::kKeepNumbers : convert, filter,
      combined_keys, &nof_indices);

  if (needs_sorting) {
    SortIndices(isolate, combined_keys, nof_indices);
    // Indices from dictionary elements should only be converted after
    // sorting.
    if (convert == GetKeysConversion::kConvertToString) {
      for (uint32_t i = 0; i < nof_indices; i++) {
        Handle<Object> index_string = isolate->factory()->Uint32ToString(
            combined_keys->get(i).Number());
        combined_keys->set(i, *index_string);
      }
    }
  }

  // Copy over the passed-in property keys.
  CopyObjectToObjectElements(isolate, *keys, PACKED_ELEMENTS, 0,
                             *combined_keys, PACKED_ELEMENTS, nof_indices,
                             nof_property_keys);

  // For holey elements and arguments we might have to shrink the collected
  // keys since the estimates might be off.
  if (IsHoleyOrDictionaryElementsKind(kind()) ||
      IsSloppyArgumentsElementsKind(kind())) {
    // Shrink combined_keys to the final size.
    int final_size = nof_indices + nof_property_keys;
    DCHECK_LE(final_size, combined_keys->length())((void) 0);
    return FixedArray::ShrinkOrEmpty(isolate, combined_keys, final_size);
  }

  return combined_keys;
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) ExceptionStatus AddElementsToKeyAccumulator(
    Handle<JSObject> receiver, KeyAccumulator* accumulator,
    AddKeyConversion convert) final {
  return Subclass::AddElementsToKeyAccumulatorImpl(receiver, accumulator,
                                                   convert);
}

static uint32_t GetCapacityImpl(JSObject holder,
                                FixedArrayBase backing_store) {
  return backing_store.length();
}

size_t GetCapacity(JSObject holder, FixedArrayBase backing_store) final {
  return Subclass::GetCapacityImpl(holder, backing_store);
}

static MaybeHandle<Object> FillImpl(Handle<JSObject> receiver,
                                    Handle<Object> obj_value, size_t start,
                                    size_t end) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

MaybeHandle<Object> Fill(Handle<JSObject> receiver, Handle<Object> obj_value,
                         size_t start, size_t end) override {
  return Subclass::FillImpl(receiver, obj_value, start, end);
}

static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                     Handle<JSObject> receiver,
                                     Handle<Object> value, size_t start_from,
                                     size_t length) {
  return IncludesValueSlowPath(isolate, receiver, value, start_from, length);
}

Maybe<bool> IncludesValue(Isolate* isolate, Handle<JSObject> receiver,
                          Handle<Object> value, size_t start_from,
                          size_t length) final {
  return Subclass::IncludesValueImpl(isolate, receiver, value, start_from,
                                     length);
}

static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                       Handle<JSObject> receiver,
                                       Handle<Object> value,
                                       size_t start_from, size_t length) {
  return IndexOfValueSlowPath(isolate, receiver, value, start_from, length);
}

Maybe<int64_t> IndexOfValue(Isolate* isolate, Handle<JSObject> receiver,
                            Handle<Object> value, size_t start_from,
                            size_t length) final {
  return Subclass::IndexOfValueImpl(isolate, receiver, value, start_from,
1
Calling 'TypedElementsAccessor::IndexOfValueImpl'→
                                    length);
}

static Maybe<int64_t> LastIndexOfValueImpl(Handle<JSObject> receiver,
                                           Handle<Object> value,
                                           size_t start_from) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

Maybe<int64_t> LastIndexOfValue(Handle<JSObject> receiver,
                                Handle<Object> value,
                                size_t start_from) final {
  return Subclass::LastIndexOfValueImpl(receiver, value, start_from);
}

static void ReverseImpl(JSObject receiver) { UNREACHABLE()V8_Fatal("unreachable code"); }

void Reverse(JSObject receiver) final { Subclass::ReverseImpl(receiver); }

static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                          FixedArrayBase backing_store,
                                          size_t index,
                                          PropertyFilter filter) {
  DCHECK(IsFastElementsKind(kind()) ||((void) 0)
         IsAnyNonextensibleElementsKind(kind()))((void) 0);
  size_t length = Subclass::GetMaxIndex(holder, backing_store);
  if (IsHoleyElementsKindForRead(kind())) {
    DCHECK_IMPLIES(((void) 0)
        index < length,((void) 0)
        index <= static_cast<size_t>(std::numeric_limits<int>::max()))((void) 0);
    return index < length &&
                   !BackingStore::cast(backing_store)
                        .is_the_hole(isolate, static_cast<int>(index))
               ? InternalIndex(index)
               : InternalIndex::NotFound();
  } else {
    return index < length ? InternalIndex(index) : InternalIndex::NotFound();
  }
}

InternalIndex GetEntryForIndex(Isolate* isolate, JSObject holder,
                               FixedArrayBase backing_store,
                               size_t index) final {
  return Subclass::GetEntryForIndexImpl(isolate, holder, backing_store, index,
                                        ALL_PROPERTIES);
}

static PropertyDetails GetDetailsImpl(FixedArrayBase backing_store,
                                      InternalIndex entry) {
  return PropertyDetails(PropertyKind::kData, NONE,
                         PropertyCellType::kNoCell);
}

static PropertyDetails GetDetailsImpl(JSObject holder, InternalIndex entry) {
  return PropertyDetails(PropertyKind::kData, NONE,
                         PropertyCellType::kNoCell);
}

PropertyDetails GetDetails(JSObject holder, InternalIndex entry) final {
  return Subclass::GetDetailsImpl(holder, entry);
}

Handle<FixedArray> CreateListFromArrayLike(Isolate* isolate,
                                           Handle<JSObject> object,
                                           uint32_t length) final {
  return Subclass::CreateListFromArrayLikeImpl(isolate, object, length);
}

static Handle<FixedArray> CreateListFromArrayLikeImpl(Isolate* isolate,
                                                      Handle<JSObject> object,
                                                      uint32_t length) {
  UNREACHABLE()V8_Fatal("unreachable code");
}
1391};

1393class DictionaryElementsAccessor
  : public ElementsAccessorBase<DictionaryElementsAccessor,
                                ElementsKindTraits<DICTIONARY_ELEMENTS>> {
public:
static uint32_t GetMaxIndex(JSObject receiver, FixedArrayBase elements) {
  // We cannot properly estimate this for dictionaries.
  UNREACHABLE()V8_Fatal("unreachable code");
}

static uint32_t GetMaxNumberOfEntries(JSObject receiver,
                                      FixedArrayBase backing_store) {
  return NumberOfElementsImpl(receiver, backing_store);
}

static uint32_t NumberOfElementsImpl(JSObject receiver,
                                     FixedArrayBase backing_store) {
  NumberDictionary dict = NumberDictionary::cast(backing_store);
  return dict.NumberOfElements();
}

static Maybe<bool> SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
                                 uint32_t length,
                                 Handle<FixedArrayBase> backing_store) {
  Handle<NumberDictionary> dict =
      Handle<NumberDictionary>::cast(backing_store);
  uint32_t old_length = 0;
  CHECK(array->length().ToArrayLength(&old_length))do { if ((__builtin_expect(!!(!(array->length().ToArrayLength
(&old_length))), 0))) { V8_Fatal("Check failed: %s.", "array->length().ToArrayLength(&old_length)"
); } } while (false);
  {
    DisallowGarbageCollection no_gc;
    ReadOnlyRoots roots(isolate);
    if (length < old_length) {
      if (dict->requires_slow_elements()) {
        // Find last non-deletable element in range of elements to be
        // deleted and adjust range accordingly.
        for (InternalIndex entry : dict->IterateEntries()) {
          Object index = dict->KeyAt(isolate, entry);
          if (dict->IsKey(roots, index)) {
            uint32_t number = static_cast<uint32_t>(index.Number());
            if (length <= number && number < old_length) {
              PropertyDetails details = dict->DetailsAt(entry);
              if (!details.IsConfigurable()) length = number + 1;
            }
          }
        }
      }

      if (length == 0) {
        // Flush the backing store.
        array->initialize_elements();
      } else {
        // Remove elements that should be deleted.
        int removed_entries = 0;
        for (InternalIndex entry : dict->IterateEntries()) {
          Object index = dict->KeyAt(isolate, entry);
          if (dict->IsKey(roots, index)) {
            uint32_t number = static_cast<uint32_t>(index.Number());
            if (length <= number && number < old_length) {
              dict->ClearEntry(entry);
              removed_entries++;
            }
          }
        }

        if (removed_entries > 0) {
          // Update the number of elements.
          dict->ElementsRemoved(removed_entries);
        }
      }
    }
  }

  Handle<Object> length_obj = isolate->factory()->NewNumberFromUint(length);
  array->set_length(*length_obj);
  return Just(true);
}

static void CopyElementsImpl(Isolate* isolate, FixedArrayBase from,
                             uint32_t from_start, FixedArrayBase to,
                             ElementsKind from_kind, uint32_t to_start,
                             int packed_size, int copy_size) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
  Handle<NumberDictionary> dict(NumberDictionary::cast(obj->elements()),
                                obj->GetIsolate());
  dict = NumberDictionary::DeleteEntry(obj->GetIsolate(), dict, entry);
  obj->set_elements(*dict);
}

static bool HasAccessorsImpl(JSObject holder, FixedArrayBase backing_store) {
  DisallowGarbageCollection no_gc;
  NumberDictionary dict = NumberDictionary::cast(backing_store);
  if (!dict.requires_slow_elements()) return false;
  PtrComprCageBase cage_base = GetPtrComprCageBase(holder);
  ReadOnlyRoots roots = holder.GetReadOnlyRoots(cage_base);
  for (InternalIndex i : dict.IterateEntries()) {
    Object key = dict.KeyAt(cage_base, i);
    if (!dict.IsKey(roots, key)) continue;
    PropertyDetails details = dict.DetailsAt(i);
    if (details.kind() == PropertyKind::kAccessor) return true;
  }
  return false;
}

static Object GetRaw(FixedArrayBase store, InternalIndex entry) {
  NumberDictionary backing_store = NumberDictionary::cast(store);
  return backing_store.ValueAt(entry);
}

static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase backing_store,
                              InternalIndex entry) {
  return handle(GetRaw(backing_store, entry), isolate);
}

static inline void SetImpl(Handle<JSObject> holder, InternalIndex entry,
                           Object value) {
  SetImpl(holder->elements(), entry, value);
}

static inline void SetImpl(FixedArrayBase backing_store, InternalIndex entry,
                           Object value) {
  NumberDictionary::cast(backing_store).ValueAtPut(entry, value);
}

static void ReconfigureImpl(Handle<JSObject> object,
                            Handle<FixedArrayBase> store, InternalIndex entry,
                            Handle<Object> value,
                            PropertyAttributes attributes) {
  NumberDictionary dictionary = NumberDictionary::cast(*store);
  if (attributes != NONE) object->RequireSlowElements(dictionary);
  dictionary.ValueAtPut(entry, *value);
  PropertyDetails details = dictionary.DetailsAt(entry);
  details =
      PropertyDetails(PropertyKind::kData, attributes,
                      PropertyCellType::kNoCell, details.dictionary_index());

  dictionary.DetailsAtPut(entry, details);
}

static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  PropertyDetails details(PropertyKind::kData, attributes,
                          PropertyCellType::kNoCell);
  Handle<NumberDictionary> dictionary =
      object->HasFastElements() || object->HasFastStringWrapperElements()
          ? JSObject::NormalizeElements(object)
          : handle(NumberDictionary::cast(object->elements()),
                   object->GetIsolate());
  Handle<NumberDictionary> new_dictionary = NumberDictionary::Add(
      object->GetIsolate(), dictionary, index, value, details);
  new_dictionary->UpdateMaxNumberKey(index, object);
  if (attributes != NONE) object->RequireSlowElements(*new_dictionary);
  if (dictionary.is_identical_to(new_dictionary)) return Just(true);
  object->set_elements(*new_dictionary);
  return Just(true);
}

static bool HasEntryImpl(Isolate* isolate, FixedArrayBase store,
                         InternalIndex entry) {
  DisallowGarbageCollection no_gc;
  NumberDictionary dict = NumberDictionary::cast(store);
  Object index = dict.KeyAt(isolate, entry);
  return !index.IsTheHole(isolate);
}

static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                          FixedArrayBase store, size_t index,
                                          PropertyFilter filter) {
  DisallowGarbageCollection no_gc;
  NumberDictionary dictionary = NumberDictionary::cast(store);
  DCHECK_LE(index, std::numeric_limits<uint32_t>::max())((void) 0);
  InternalIndex entry =
      dictionary.FindEntry(isolate, static_cast<uint32_t>(index));
  if (entry.is_not_found()) return entry;

  if (filter != ALL_PROPERTIES) {
    PropertyDetails details = dictionary.DetailsAt(entry);
    PropertyAttributes attr = details.attributes();
    if ((attr & filter) != 0) return InternalIndex::NotFound();
  }
  return entry;
}

static PropertyDetails GetDetailsImpl(JSObject holder, InternalIndex entry) {
  return GetDetailsImpl(holder.elements(), entry);
}

static PropertyDetails GetDetailsImpl(FixedArrayBase backing_store,
                                      InternalIndex entry) {
  return NumberDictionary::cast(backing_store).DetailsAt(entry);
}

static uint32_t FilterKey(Handle<NumberDictionary> dictionary,
                          InternalIndex entry, Object raw_key,
                          PropertyFilter filter) {
  DCHECK(raw_key.IsNumber())((void) 0);
  DCHECK_LE(raw_key.Number(), kMaxUInt32)((void) 0);
  PropertyDetails details = dictionary->DetailsAt(entry);
  PropertyAttributes attr = details.attributes();
  if ((attr & filter) != 0) return kMaxUInt32;
  return static_cast<uint32_t>(raw_key.Number());
}

static uint32_t GetKeyForEntryImpl(Isolate* isolate,
                                   Handle<NumberDictionary> dictionary,
                                   InternalIndex entry,
                                   PropertyFilter filter) {
  DisallowGarbageCollection no_gc;
  Object raw_key = dictionary->KeyAt(isolate, entry);
  if (!dictionary->IsKey(ReadOnlyRoots(isolate), raw_key)) return kMaxUInt32;
  return FilterKey(dictionary, entry, raw_key, filter);
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus CollectElementIndicesImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
    KeyAccumulator* keys) {
  if (keys->filter() & SKIP_STRINGS) return ExceptionStatus::kSuccess;
  Isolate* isolate = keys->isolate();
  Handle<NumberDictionary> dictionary =
      Handle<NumberDictionary>::cast(backing_store);
  Handle<FixedArray> elements = isolate->factory()->NewFixedArray(
      GetMaxNumberOfEntries(*object, *backing_store));
  int insertion_index = 0;
  PropertyFilter filter = keys->filter();
  ReadOnlyRoots roots(isolate);
  for (InternalIndex i : dictionary->IterateEntries()) {
    AllowGarbageCollection allow_gc;
    Object raw_key = dictionary->KeyAt(isolate, i);
    if (!dictionary->IsKey(roots, raw_key)) continue;
    uint32_t key = FilterKey(dictionary, i, raw_key, filter);
    if (key == kMaxUInt32) {
      // This might allocate, but {raw_key} is not used afterwards.
      keys->AddShadowingKey(raw_key, &allow_gc);
      continue;
    }
    elements->set(insertion_index, raw_key);
    insertion_index++;
  }
  SortIndices(isolate, elements, insertion_index);
  for (int i = 0; i < insertion_index; i++) {
    RETURN_FAILURE_IF_NOT_SUCCESSFUL(keys->AddKey(elements->get(i)));
  }
  return ExceptionStatus::kSuccess;
}

static Handle<FixedArray> DirectCollectElementIndicesImpl(
    Isolate* isolate, Handle<JSObject> object,
    Handle<FixedArrayBase> backing_store, GetKeysConversion convert,
    PropertyFilter filter, Handle<FixedArray> list, uint32_t* nof_indices,
    uint32_t insertion_index = 0) {
  if (filter & SKIP_STRINGS) return list;
  if (filter & ONLY_ALL_CAN_READ) return list;

  Handle<NumberDictionary> dictionary =
      Handle<NumberDictionary>::cast(backing_store);
  for (InternalIndex i : dictionary->IterateEntries()) {
    uint32_t key = GetKeyForEntryImpl(isolate, dictionary, i, filter);
    if (key == kMaxUInt32) continue;
    Handle<Object> index = isolate->factory()->NewNumberFromUint(key);
    list->set(insertion_index, *index);
    insertion_index++;
  }
  *nof_indices = insertion_index;
  return list;
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus AddElementsToKeyAccumulatorImpl(
    Handle<JSObject> receiver, KeyAccumulator* accumulator,
    AddKeyConversion convert) {
  Isolate* isolate = accumulator->isolate();
  Handle<NumberDictionary> dictionary(
      NumberDictionary::cast(receiver->elements()), isolate);
  ReadOnlyRoots roots(isolate);
  for (InternalIndex i : dictionary->IterateEntries()) {
    Object k = dictionary->KeyAt(isolate, i);
    if (!dictionary->IsKey(roots, k)) continue;
    Object value = dictionary->ValueAt(isolate, i);
    DCHECK(!value.IsTheHole(isolate))((void) 0);
    DCHECK(!value.IsAccessorPair())((void) 0);
    DCHECK(!value.IsAccessorInfo())((void) 0);
    RETURN_FAILURE_IF_NOT_SUCCESSFUL(accumulator->AddKey(value, convert));
  }
  return ExceptionStatus::kSuccess;
}

static bool IncludesValueFastPath(Isolate* isolate, Handle<JSObject> receiver,
                                  Handle<Object> value, size_t start_from,
                                  size_t length, Maybe<bool>* result) {
  DisallowGarbageCollection no_gc;
  NumberDictionary dictionary = NumberDictionary::cast(receiver->elements());
  Object the_hole = ReadOnlyRoots(isolate).the_hole_value();
  Object undefined = ReadOnlyRoots(isolate).undefined_value();

  // Scan for accessor properties. If accessors are present, then elements
  // must be accessed in order via the slow path.
  bool found = false;
  for (InternalIndex i : dictionary.IterateEntries()) {
    Object k = dictionary.KeyAt(isolate, i);
    if (k == the_hole) continue;
    if (k == undefined) continue;

    uint32_t index;
    if (!k.ToArrayIndex(&index) || index < start_from || index >= length) {
      continue;
    }

    if (dictionary.DetailsAt(i).kind() == PropertyKind::kAccessor) {
      // Restart from beginning in slow path, otherwise we may observably
      // access getters out of order
      return false;
    } else if (!found) {
      Object element_k = dictionary.ValueAt(isolate, i);
      if (value->SameValueZero(element_k)) found = true;
    }
  }

  *result = Just(found);
  return true;
}

static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                     Handle<JSObject> receiver,
                                     Handle<Object> value, size_t start_from,
                                     size_t length) {
  DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver))((void) 0);
  bool search_for_hole = value->IsUndefined(isolate);

  if (!search_for_hole) {
    Maybe<bool> result = Nothing<bool>();
    if (DictionaryElementsAccessor::IncludesValueFastPath(
            isolate, receiver, value, start_from, length, &result)) {
      return result;
    }
  }
  ElementsKind original_elements_kind = receiver->GetElementsKind();
  USE(original_elements_kind)do { ::v8::base::Use unused_tmp_array_for_use_macro[]{original_elements_kind
}; (void)unused_tmp_array_for_use_macro; } while (false);
  Handle<NumberDictionary> dictionary(
      NumberDictionary::cast(receiver->elements()), isolate);
  // Iterate through the entire range, as accessing elements out of order is
  // observable.
  for (size_t k = start_from; k < length; ++k) {
    DCHECK_EQ(receiver->GetElementsKind(), original_elements_kind)((void) 0);
    InternalIndex entry =
        dictionary->FindEntry(isolate, static_cast<uint32_t>(k));
    if (entry.is_not_found()) {
      if (search_for_hole) return Just(true);
      continue;
    }

    PropertyDetails details = GetDetailsImpl(*dictionary, entry);
    switch (details.kind()) {
      case PropertyKind::kData: {
        Object element_k = dictionary->ValueAt(entry);
        if (value->SameValueZero(element_k)) return Just(true);
        break;
      }
      case PropertyKind::kAccessor: {
        LookupIterator it(isolate, receiver, k,
                          LookupIterator::OWN_SKIP_INTERCEPTOR);
        DCHECK(it.IsFound())((void) 0);
        DCHECK_EQ(it.state(), LookupIterator::ACCESSOR)((void) 0);
        Handle<Object> element_k;

        ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, element_k,do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<bool>();
 } } while (false)
                                         Object::GetPropertyWithAccessor(&it),do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<bool>();
 } } while (false)
                                         Nothing<bool>())do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<bool>();
 } } while (false);

        if (value->SameValueZero(*element_k)) return Just(true);

        // Bailout to slow path if elements on prototype changed
        if (!JSObject::PrototypeHasNoElements(isolate, *receiver)) {
          return IncludesValueSlowPath(isolate, receiver, value, k + 1,
                                       length);
        }

        // Continue if elements unchanged
        if (*dictionary == receiver->elements()) continue;

        // Otherwise, bailout or update elements

        // If switched to initial elements, return true if searching for
        // undefined, and false otherwise.
        if (receiver->map().GetInitialElements() == receiver->elements()) {
          return Just(search_for_hole);
        }

        // If switched to fast elements, continue with the correct accessor.
        if (receiver->GetElementsKind() != DICTIONARY_ELEMENTS) {
          ElementsAccessor* accessor = receiver->GetElementsAccessor();
          return accessor->IncludesValue(isolate, receiver, value, k + 1,
                                         length);
        }
        dictionary =
            handle(NumberDictionary::cast(receiver->elements()), isolate);
        break;
      }
    }
  }
  return Just(false);
}

static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                       Handle<JSObject> receiver,
                                       Handle<Object> value,
                                       size_t start_from, size_t length) {
  DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver))((void) 0);

  ElementsKind original_elements_kind = receiver->GetElementsKind();
  USE(original_elements_kind)do { ::v8::base::Use unused_tmp_array_for_use_macro[]{original_elements_kind
}; (void)unused_tmp_array_for_use_macro; } while (false);
  Handle<NumberDictionary> dictionary(
      NumberDictionary::cast(receiver->elements()), isolate);
  // Iterate through entire range, as accessing elements out of order is
  // observable.
  for (size_t k = start_from; k < length; ++k) {
    DCHECK_EQ(receiver->GetElementsKind(), original_elements_kind)((void) 0);
    DCHECK_LE(k, std::numeric_limits<uint32_t>::max())((void) 0);
    InternalIndex entry =
        dictionary->FindEntry(isolate, static_cast<uint32_t>(k));
    if (entry.is_not_found()) continue;

    PropertyDetails details =
        GetDetailsImpl(*dictionary, InternalIndex(entry));
    switch (details.kind()) {
      case PropertyKind::kData: {
        Object element_k = dictionary->ValueAt(entry);
        if (value->StrictEquals(element_k)) {
          return Just<int64_t>(k);
        }
        break;
      }
      case PropertyKind::kAccessor: {
        LookupIterator it(isolate, receiver, k,
                          LookupIterator::OWN_SKIP_INTERCEPTOR);
        DCHECK(it.IsFound())((void) 0);
        DCHECK_EQ(it.state(), LookupIterator::ACCESSOR)((void) 0);
        Handle<Object> element_k;

        ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, element_k,do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<int64_t>
(); } } while (false)
                                         Object::GetPropertyWithAccessor(&it),do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<int64_t>
(); } } while (false)
                                         Nothing<int64_t>())do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<int64_t>
(); } } while (false);

        if (value->StrictEquals(*element_k)) return Just<int64_t>(k);

        // Bailout to slow path if elements on prototype changed.
        if (!JSObject::PrototypeHasNoElements(isolate, *receiver)) {
          return IndexOfValueSlowPath(isolate, receiver, value, k + 1,
                                      length);
        }

        // Continue if elements unchanged.
        if (*dictionary == receiver->elements()) continue;

        // Otherwise, bailout or update elements.
        if (receiver->GetElementsKind() != DICTIONARY_ELEMENTS) {
          // Otherwise, switch to slow path.
          return IndexOfValueSlowPath(isolate, receiver, value, k + 1,
                                      length);
        }
        dictionary =
            handle(NumberDictionary::cast(receiver->elements()), isolate);
        break;
      }
    }
  }
  return Just<int64_t>(-1);
}

static void ValidateContents(JSObject holder, size_t length) {
  DisallowGarbageCollection no_gc;
1865#if DEBUG
  DCHECK_EQ(holder.map().elements_kind(), DICTIONARY_ELEMENTS)((void) 0);
  if (!FLAG_enable_slow_asserts) return;
  ReadOnlyRoots roots = holder.GetReadOnlyRoots();
  NumberDictionary dictionary = NumberDictionary::cast(holder.elements());
  // Validate the requires_slow_elements and max_number_key values.
  bool requires_slow_elements = false;
  int max_key = 0;
  for (InternalIndex i : dictionary.IterateEntries()) {
    Object k;
    if (!dictionary.ToKey(roots, i, &k)) continue;
    DCHECK_LE(0.0, k.Number())((void) 0);
    if (k.Number() > NumberDictionary::kRequiresSlowElementsLimit) {
      requires_slow_elements = true;
    } else {
      max_key = std::max(max_key, Smi::ToInt(k));
    }
  }
  if (requires_slow_elements) {
    DCHECK(dictionary.requires_slow_elements())((void) 0);
  } else if (!dictionary.requires_slow_elements()) {
    DCHECK_LE(max_key, dictionary.max_number_key())((void) 0);
  }
1888#endif
}
1890};

1892// Super class for all fast element arrays.
1893template <typename Subclass, typename KindTraits>
1894class FastElementsAccessor : public ElementsAccessorBase<Subclass, KindTraits> {
public:
using BackingStore = typename KindTraits::BackingStore;

static Handle<NumberDictionary> NormalizeImpl(Handle<JSObject> object,
                                              Handle<FixedArrayBase> store) {
  Isolate* isolate = object->GetIsolate();
  ElementsKind kind = Subclass::kind();

  // Ensure that notifications fire if the array or object prototypes are
  // normalizing.
  if (IsSmiOrObjectElementsKind(kind) ||
      kind == FAST_STRING_WRAPPER_ELEMENTS) {
    isolate->UpdateNoElementsProtectorOnNormalizeElements(object);
  }

  int capacity = object->GetFastElementsUsage();
  Handle<NumberDictionary> dictionary =
      NumberDictionary::New(isolate, capacity);

  PropertyDetails details = PropertyDetails::Empty();
  int j = 0;
  int max_number_key = -1;
  for (int i = 0; j < capacity; i++) {
    if (IsHoleyElementsKindForRead(kind)) {
      if (BackingStore::cast(*store).is_the_hole(isolate, i)) continue;
    }
    max_number_key = i;
    Handle<Object> value =
        Subclass::GetImpl(isolate, *store, InternalIndex(i));
    dictionary =
        NumberDictionary::Add(isolate, dictionary, i, value, details);
    j++;
  }

  if (max_number_key > 0) {
    dictionary->UpdateMaxNumberKey(static_cast<uint32_t>(max_number_key),
                                   object);
  }
  return dictionary;
}

static void DeleteAtEnd(Handle<JSObject> obj,
                        Handle<BackingStore> backing_store, uint32_t entry) {
  uint32_t length = static_cast<uint32_t>(backing_store->length());
  Isolate* isolate = obj->GetIsolate();
  for (; entry > 0; entry--) {
    if (!backing_store->is_the_hole(isolate, entry - 1)) break;
  }
  if (entry == 0) {
    FixedArray empty = ReadOnlyRoots(isolate).empty_fixed_array();
    // Dynamically ask for the elements kind here since we manually redirect
    // the operations for argument backing stores.
    if (obj->GetElementsKind() == FAST_SLOPPY_ARGUMENTS_ELEMENTS) {
      SloppyArgumentsElements::cast(obj->elements()).set_arguments(empty);
    } else {
      obj->set_elements(empty);
    }
    return;
  }

  isolate->heap()->RightTrimFixedArray(*backing_store, length - entry);
}

static void DeleteCommon(Handle<JSObject> obj, uint32_t entry,
                         Handle<FixedArrayBase> store) {
  DCHECK(obj->HasSmiOrObjectElements() || obj->HasDoubleElements() ||((void) 0)
         obj->HasNonextensibleElements() || obj->HasFastArgumentsElements() ||((void) 0)
         obj->HasFastStringWrapperElements())((void) 0);
  Handle<BackingStore> backing_store = Handle<BackingStore>::cast(store);
  if (!obj->IsJSArray() &&
      entry == static_cast<uint32_t>(store->length()) - 1) {
    DeleteAtEnd(obj, backing_store, entry);
    return;
  }

  Isolate* isolate = obj->GetIsolate();
  backing_store->set_the_hole(isolate, entry);

  // TODO(verwaest): Move this out of elements.cc.
  // If the backing store is larger than a certain size and
  // has too few used values, normalize it.
  const int kMinLengthForSparsenessCheck = 64;
  if (backing_store->length() < kMinLengthForSparsenessCheck) return;
  uint32_t length = 0;
  if (obj->IsJSArray()) {
    JSArray::cast(*obj).length().ToArrayLength(&length);
  } else {
    length = static_cast<uint32_t>(store->length());
  }

  // To avoid doing the check on every delete, use a counter-based heuristic.
  const int kLengthFraction = 16;
  // The above constant must be large enough to ensure that we check for
  // normalization frequently enough. At a minimum, it should be large
  // enough to reliably hit the "window" of remaining elements count where
  // normalization would be beneficial.
  STATIC_ASSERT(kLengthFraction >=static_assert(kLengthFraction >= NumberDictionary::kEntrySize
 * NumberDictionary::kPreferFastElementsSizeFactor, "kLengthFraction >= NumberDictionary::kEntrySize * NumberDictionary::kPreferFastElementsSizeFactor"
)
                NumberDictionary::kEntrySize *static_assert(kLengthFraction >= NumberDictionary::kEntrySize
 * NumberDictionary::kPreferFastElementsSizeFactor, "kLengthFraction >= NumberDictionary::kEntrySize * NumberDictionary::kPreferFastElementsSizeFactor"
)
                    NumberDictionary::kPreferFastElementsSizeFactor)static_assert(kLengthFraction >= NumberDictionary::kEntrySize
 * NumberDictionary::kPreferFastElementsSizeFactor, "kLengthFraction >= NumberDictionary::kEntrySize * NumberDictionary::kPreferFastElementsSizeFactor"
);
  size_t current_counter = isolate->elements_deletion_counter();
  if (current_counter < length / kLengthFraction) {
    isolate->set_elements_deletion_counter(current_counter + 1);
    return;
  }
  // Reset the counter whenever the full check is performed.
  isolate->set_elements_deletion_counter(0);

  if (!obj->IsJSArray()) {
    uint32_t i;
    for (i = entry + 1; i < length; i++) {
      if (!backing_store->is_the_hole(isolate, i)) break;
    }
    if (i == length) {
      DeleteAtEnd(obj, backing_store, entry);
      return;
    }
  }
  int num_used = 0;
  for (int i = 0; i < backing_store->length(); ++i) {
    if (!backing_store->is_the_hole(isolate, i)) {
      ++num_used;
      // Bail out if a number dictionary wouldn't be able to save much space.
      if (NumberDictionary::kPreferFastElementsSizeFactor *
              NumberDictionary::ComputeCapacity(num_used) *
              NumberDictionary::kEntrySize >
          static_cast<uint32_t>(backing_store->length())) {
        return;
      }
    }
  }
  JSObject::NormalizeElements(obj);
}

static void ReconfigureImpl(Handle<JSObject> object,
                            Handle<FixedArrayBase> store, InternalIndex entry,
                            Handle<Object> value,
                            PropertyAttributes attributes) {
  Handle<NumberDictionary> dictionary = JSObject::NormalizeElements(object);
  entry = InternalIndex(
      dictionary->FindEntry(object->GetIsolate(), entry.as_uint32()));
  DictionaryElementsAccessor::ReconfigureImpl(object, dictionary, entry,
                                              value, attributes);
}

static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  DCHECK_EQ(NONE, attributes)((void) 0);
  ElementsKind from_kind = object->GetElementsKind();
  ElementsKind to_kind = Subclass::kind();
  if (IsDictionaryElementsKind(from_kind) ||
      IsDoubleElementsKind(from_kind) != IsDoubleElementsKind(to_kind) ||
      Subclass::GetCapacityImpl(*object, object->elements()) !=
          new_capacity) {
    MAYBE_RETURN(Subclass::GrowCapacityAndConvertImpl(object, new_capacity),do { if ((Subclass::GrowCapacityAndConvertImpl(object, new_capacity
)).IsNothing()) return Nothing<bool>(); } while (false)
                 Nothing<bool>())do { if ((Subclass::GrowCapacityAndConvertImpl(object, new_capacity
)).IsNothing()) return Nothing<bool>(); } while (false);
  } else {
    if (IsFastElementsKind(from_kind) && from_kind != to_kind) {
      JSObject::TransitionElementsKind(object, to_kind);
    }
    if (IsSmiOrObjectElementsKind(from_kind)) {
      DCHECK(IsSmiOrObjectElementsKind(to_kind))((void) 0);
      JSObject::EnsureWritableFastElements(object);
    }
  }
  Subclass::SetImpl(object, InternalIndex(index), *value);
  return Just(true);
}

static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
  ElementsKind kind = KindTraits::Kind;
  if (IsFastPackedElementsKind(kind) ||
      kind == PACKED_NONEXTENSIBLE_ELEMENTS) {
    JSObject::TransitionElementsKind(obj, GetHoleyElementsKind(kind));
  }
  if (IsSmiOrObjectElementsKind(KindTraits::Kind) ||
      IsNonextensibleElementsKind(kind)) {
    JSObject::EnsureWritableFastElements(obj);
  }
  DeleteCommon(obj, entry.as_uint32(),
               handle(obj->elements(), obj->GetIsolate()));
}

static bool HasEntryImpl(Isolate* isolate, FixedArrayBase backing_store,
                         InternalIndex entry) {
  return !BackingStore::cast(backing_store)
              .is_the_hole(isolate, entry.as_int());
}

static uint32_t NumberOfElementsImpl(JSObject receiver,
                                     FixedArrayBase backing_store) {
  size_t max_index = Subclass::GetMaxIndex(receiver, backing_store);
  DCHECK_LE(max_index, std::numeric_limits<uint32_t>::max())((void) 0);
  if (IsFastPackedElementsKind(Subclass::kind())) {
    return static_cast<uint32_t>(max_index);
  }
  Isolate* isolate = receiver.GetIsolate();
  uint32_t count = 0;
  for (size_t i = 0; i < max_index; i++) {
    if (Subclass::HasEntryImpl(isolate, backing_store, InternalIndex(i))) {
      count++;
    }
  }
  return count;
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus AddElementsToKeyAccumulatorImpl(
    Handle<JSObject> receiver, KeyAccumulator* accumulator,
    AddKeyConversion convert) {
  Isolate* isolate = accumulator->isolate();
  Handle<FixedArrayBase> elements(receiver->elements(), isolate);
  size_t length = Subclass::GetMaxNumberOfEntries(*receiver, *elements);
  for (size_t i = 0; i < length; i++) {
    if (IsFastPackedElementsKind(KindTraits::Kind) ||
        HasEntryImpl(isolate, *elements, InternalIndex(i))) {
      RETURN_FAILURE_IF_NOT_SUCCESSFUL(accumulator->AddKey(
          Subclass::GetImpl(isolate, *elements, InternalIndex(i)), convert));
    }
  }
  return ExceptionStatus::kSuccess;
}

static void ValidateContents(JSObject holder, size_t length) {
2119#if DEBUG
  Isolate* isolate = holder.GetIsolate();
  Heap* heap = isolate->heap();
  FixedArrayBase elements = holder.elements();
  Map map = elements.map();
  if (IsSmiOrObjectElementsKind(KindTraits::Kind)) {
    DCHECK_NE(map, ReadOnlyRoots(heap).fixed_double_array_map())((void) 0);
  } else if (IsDoubleElementsKind(KindTraits::Kind)) {
    DCHECK_NE(map, ReadOnlyRoots(heap).fixed_cow_array_map())((void) 0);
    if (map == ReadOnlyRoots(heap).fixed_array_map()) DCHECK_EQ(0u, length)((void) 0);
  } else {
    UNREACHABLE()V8_Fatal("unreachable code");
  }
  if (length == 0u) return;  // nothing to do!
2133#if ENABLE_SLOW_DCHECKS
  DisallowGarbageCollection no_gc;
  BackingStore backing_store = BackingStore::cast(elements);
  DCHECK(length <= std::numeric_limits<int>::max())((void) 0);
  int length_int = static_cast<int>(length);
  if (IsSmiElementsKind(KindTraits::Kind)) {
    HandleScope scope(isolate);
    for (int i = 0; i < length_int; i++) {
      DCHECK(BackingStore::get(backing_store, i, isolate)->IsSmi() ||((void) 0)
             (IsHoleyElementsKind(KindTraits::Kind) &&((void) 0)
              backing_store.is_the_hole(isolate, i)))((void) 0);
    }
  } else if (KindTraits::Kind == PACKED_ELEMENTS ||
             KindTraits::Kind == PACKED_DOUBLE_ELEMENTS) {
    for (int i = 0; i < length_int; i++) {
      DCHECK(!backing_store.is_the_hole(isolate, i))((void) 0);
    }
  } else {
    DCHECK(IsHoleyElementsKind(KindTraits::Kind))((void) 0);
  }
2153#endif
2154#endif
}

static MaybeHandle<Object> PopImpl(Handle<JSArray> receiver) {
  return Subclass::RemoveElement(receiver, AT_END);
}

static MaybeHandle<Object> ShiftImpl(Handle<JSArray> receiver) {
  return Subclass::RemoveElement(receiver, AT_START);
}

static Maybe<uint32_t> PushImpl(Handle<JSArray> receiver,
                                BuiltinArguments* args, uint32_t push_size) {
  Handle<FixedArrayBase> backing_store(receiver->elements(),
                                       receiver->GetIsolate());
  return Subclass::AddArguments(receiver, backing_store, args, push_size,
                                AT_END);
}

static Maybe<uint32_t> UnshiftImpl(Handle<JSArray> receiver,
                                   BuiltinArguments* args,
                                   uint32_t unshift_size) {
  Handle<FixedArrayBase> backing_store(receiver->elements(),
                                       receiver->GetIsolate());
  return Subclass::AddArguments(receiver, backing_store, args, unshift_size,
                                AT_START);
}

static void MoveElements(Isolate* isolate, Handle<JSArray> receiver,
                         Handle<FixedArrayBase> backing_store, int dst_index,
                         int src_index, int len, int hole_start,
                         int hole_end) {
  DisallowGarbageCollection no_gc;
  BackingStore dst_elms = BackingStore::cast(*backing_store);
  if (len > JSArray::kMaxCopyElements && dst_index == 0 &&
      isolate->heap()->CanMoveObjectStart(dst_elms)) {
    dst_elms = BackingStore::cast(
        isolate->heap()->LeftTrimFixedArray(dst_elms, src_index));
    // Update all the copies of this backing_store handle.
    backing_store.PatchValue(dst_elms);
    receiver->set_elements(dst_elms);
    // Adjust the hole offset as the array has been shrunk.
    hole_end -= src_index;
    DCHECK_LE(hole_start, backing_store->length())((void) 0);
    DCHECK_LE(hole_end, backing_store->length())((void) 0);
  } else if (len != 0) {
    WriteBarrierMode mode =
        GetWriteBarrierMode(dst_elms, KindTraits::Kind, no_gc);
    dst_elms.MoveElements(isolate, dst_index, src_index, len, mode);
  }
  if (hole_start != hole_end) {
    dst_elms.FillWithHoles(hole_start, hole_end);
  }
}

static MaybeHandle<Object> FillImpl(Handle<JSObject> receiver,
                                    Handle<Object> obj_value, size_t start,
                                    size_t end) {
  // Ensure indexes are within array bounds
  DCHECK_LE(0, start)((void) 0);
  DCHECK_LE(start, end)((void) 0);

  // Make sure COW arrays are copied.
  if (IsSmiOrObjectElementsKind(Subclass::kind())) {
    JSObject::EnsureWritableFastElements(receiver);
  }

  // Make sure we have enough space.
  DCHECK_LE(end, std::numeric_limits<uint32_t>::max())((void) 0);
  if (end > Subclass::GetCapacityImpl(*receiver, receiver->elements())) {
    MAYBE_RETURN_NULL(Subclass::GrowCapacityAndConvertImpl(do { if ((Subclass::GrowCapacityAndConvertImpl( receiver, static_cast
<uint32_t>(end))).IsNothing()) return MaybeHandle<Object
>(); } while (false)
        receiver, static_cast<uint32_t>(end)))do { if ((Subclass::GrowCapacityAndConvertImpl( receiver, static_cast
<uint32_t>(end))).IsNothing()) return MaybeHandle<Object
>(); } while (false);
    CHECK_EQ(Subclass::kind(), receiver->GetElementsKind())do { bool _cmp = ::v8::base::CmpEQImpl< typename ::v8::base
::pass_value_or_ref<decltype(Subclass::kind())>::type, typename
 ::v8::base::pass_value_or_ref<decltype(receiver->GetElementsKind
())>::type>((Subclass::kind()), (receiver->GetElementsKind
())); do { if ((__builtin_expect(!!(!(_cmp)), 0))) { V8_Fatal
("Check failed: %s.", "Subclass::kind()" " " "==" " " "receiver->GetElementsKind()"
); } } while (false); } while (false);
  }
  DCHECK_LE(end, Subclass::GetCapacityImpl(*receiver, receiver->elements()))((void) 0);

  for (size_t index = start; index < end; ++index) {
    Subclass::SetImpl(receiver, InternalIndex(index), *obj_value);
  }
  return MaybeHandle<Object>(receiver);
}

static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                     Handle<JSObject> receiver,
                                     Handle<Object> search_value,
                                     size_t start_from, size_t length) {
  DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver))((void) 0);
  DisallowGarbageCollection no_gc;
  FixedArrayBase elements_base = receiver->elements();
  Object the_hole = ReadOnlyRoots(isolate).the_hole_value();
  Object undefined = ReadOnlyRoots(isolate).undefined_value();
  Object value = *search_value;

  if (start_from >= length) return Just(false);

  // Elements beyond the capacity of the backing store treated as undefined.
  size_t elements_length = static_cast<size_t>(elements_base.length());
  if (value == undefined && elements_length < length) return Just(true);
  if (elements_length == 0) {
    DCHECK_NE(value, undefined)((void) 0);
    return Just(false);
  }

  length = std::min(elements_length, length);
  DCHECK_LE(length, std::numeric_limits<int>::max())((void) 0);

  if (!value.IsNumber()) {
    if (value == undefined) {
      // Search for `undefined` or The Hole. Even in the case of
      // PACKED_DOUBLE_ELEMENTS or PACKED_SMI_ELEMENTS, we might encounter The
      // Hole here, since the {length} used here can be larger than
      // JSArray::length.
      if (IsSmiOrObjectElementsKind(Subclass::kind()) ||
          IsAnyNonextensibleElementsKind(Subclass::kind())) {
        FixedArray elements = FixedArray::cast(receiver->elements());

        for (size_t k = start_from; k < length; ++k) {
          Object element_k = elements.get(static_cast<int>(k));

          if (element_k == the_hole || element_k == undefined) {
            return Just(true);
          }
        }
        return Just(false);
      } else {
        // Search for The Hole in HOLEY_DOUBLE_ELEMENTS or
        // PACKED_DOUBLE_ELEMENTS.
        DCHECK(IsDoubleElementsKind(Subclass::kind()))((void) 0);
        FixedDoubleArray elements =
            FixedDoubleArray::cast(receiver->elements());

        for (size_t k = start_from; k < length; ++k) {
          if (elements.is_the_hole(static_cast<int>(k))) return Just(true);
        }
        return Just(false);
      }
    } else if (!IsObjectElementsKind(Subclass::kind()) &&
               !IsAnyNonextensibleElementsKind(Subclass::kind())) {
      // Search for non-number, non-Undefined value, with either
      // PACKED_SMI_ELEMENTS, PACKED_DOUBLE_ELEMENTS, HOLEY_SMI_ELEMENTS or
      // HOLEY_DOUBLE_ELEMENTS. Guaranteed to return false, since these
      // elements kinds can only contain Number values or undefined.
      return Just(false);
    } else {
      // Search for non-number, non-Undefined value with either
      // PACKED_ELEMENTS or HOLEY_ELEMENTS.
      DCHECK(IsObjectElementsKind(Subclass::kind()) ||((void) 0)
             IsAnyNonextensibleElementsKind(Subclass::kind()))((void) 0);
      FixedArray elements = FixedArray::cast(receiver->elements());

      for (size_t k = start_from; k < length; ++k) {
        Object element_k = elements.get(static_cast<int>(k));
        if (element_k == the_hole) continue;
        if (value.SameValueZero(element_k)) return Just(true);
      }
      return Just(false);
    }
  } else {
    if (!value.IsNaN()) {
      double search_number = value.Number();
      if (IsDoubleElementsKind(Subclass::kind())) {
        // Search for non-NaN Number in PACKED_DOUBLE_ELEMENTS or
        // HOLEY_DOUBLE_ELEMENTS --- Skip TheHole, and trust UCOMISD or
        // similar operation for result.
        FixedDoubleArray elements =
            FixedDoubleArray::cast(receiver->elements());

        for (size_t k = start_from; k < length; ++k) {
          if (elements.is_the_hole(static_cast<int>(k))) continue;
          if (elements.get_scalar(static_cast<int>(k)) == search_number) {
            return Just(true);
          }
        }
        return Just(false);
      } else {
        // Search for non-NaN Number in PACKED_ELEMENTS, HOLEY_ELEMENTS,
        // PACKED_SMI_ELEMENTS or HOLEY_SMI_ELEMENTS --- Skip non-Numbers,
        // and trust UCOMISD or similar operation for result
        FixedArray elements = FixedArray::cast(receiver->elements());

        for (size_t k = start_from; k < length; ++k) {
          Object element_k = elements.get(static_cast<int>(k));
          if (element_k.IsNumber() && element_k.Number() == search_number) {
            return Just(true);
          }
        }
        return Just(false);
      }
    } else {
      // Search for NaN --- NaN cannot be represented with Smi elements, so
      // abort if ElementsKind is PACKED_SMI_ELEMENTS or HOLEY_SMI_ELEMENTS
      if (IsSmiElementsKind(Subclass::kind())) return Just(false);

      if (IsDoubleElementsKind(Subclass::kind())) {
        // Search for NaN in PACKED_DOUBLE_ELEMENTS or
        // HOLEY_DOUBLE_ELEMENTS --- Skip The Hole and trust
        // std::isnan(elementK) for result
        FixedDoubleArray elements =
            FixedDoubleArray::cast(receiver->elements());

        for (size_t k = start_from; k < length; ++k) {
          if (elements.is_the_hole(static_cast<int>(k))) continue;
          if (std::isnan(elements.get_scalar(static_cast<int>(k)))) {
            return Just(true);
          }
        }
        return Just(false);
      } else {
        // Search for NaN in PACKED_ELEMENTS or HOLEY_ELEMENTS. Return true
        // if elementK->IsHeapNumber() && std::isnan(elementK->Number())
        DCHECK(IsObjectElementsKind(Subclass::kind()) ||((void) 0)
               IsAnyNonextensibleElementsKind(Subclass::kind()))((void) 0);
        FixedArray elements = FixedArray::cast(receiver->elements());

        for (size_t k = start_from; k < length; ++k) {
          if (elements.get(static_cast<int>(k)).IsNaN()) return Just(true);
        }
        return Just(false);
      }
    }
  }
}

static Handle<FixedArray> CreateListFromArrayLikeImpl(Isolate* isolate,
                                                      Handle<JSObject> object,
                                                      uint32_t length) {
  Handle<FixedArray> result = isolate->factory()->NewFixedArray(length);
  Handle<FixedArrayBase> elements(object->elements(), isolate);
  for (uint32_t i = 0; i < length; i++) {
    InternalIndex entry(i);
    if (!Subclass::HasEntryImpl(isolate, *elements, entry)) continue;
    Handle<Object> value;
    value = Subclass::GetImpl(isolate, *elements, entry);
    if (value->IsName()) {
      value = isolate->factory()->InternalizeName(Handle<Name>::cast(value));
    }
    result->set(i, *value);
  }
  return result;
}

static MaybeHandle<Object> RemoveElement(Handle<JSArray> receiver,
                                         Where remove_position) {
  Isolate* isolate = receiver->GetIsolate();
  ElementsKind kind = KindTraits::Kind;
  if (IsSmiOrObjectElementsKind(kind)) {
    HandleScope scope(isolate);
    JSObject::EnsureWritableFastElements(receiver);
  }
  Handle<FixedArrayBase> backing_store(receiver->elements(), isolate);
  uint32_t length = static_cast<uint32_t>(Smi::ToInt(receiver->length()));
  DCHECK_GT(length, 0)((void) 0);
  int new_length = length - 1;
  int remove_index = remove_position == AT_START ? 0 : new_length;
  Handle<Object> result =
      Subclass::GetImpl(isolate, *backing_store, InternalIndex(remove_index));
  if (remove_position == AT_START) {
    Subclass::MoveElements(isolate, receiver, backing_store, 0, 1, new_length,
                           0, 0);
  }
  MAYBE_RETURN_NULL(do { if ((Subclass::SetLengthImpl(isolate, receiver, new_length
, backing_store)).IsNothing()) return MaybeHandle<Object>
(); } while (false)
      Subclass::SetLengthImpl(isolate, receiver, new_length, backing_store))do { if ((Subclass::SetLengthImpl(isolate, receiver, new_length
, backing_store)).IsNothing()) return MaybeHandle<Object>
(); } while (false);

  if (IsHoleyElementsKind(kind) && result->IsTheHole(isolate)) {
    return isolate->factory()->undefined_value();
  }
  return MaybeHandle<Object>(result);
}

static Maybe<uint32_t> AddArguments(Handle<JSArray> receiver,
                                    Handle<FixedArrayBase> backing_store,
                                    BuiltinArguments* args, uint32_t add_size,
                                    Where add_position) {
  uint32_t length = Smi::ToInt(receiver->length());
  DCHECK_LT(0, add_size)((void) 0);
  uint32_t elms_len = backing_store->length();
  // Check we do not overflow the new_length.
  DCHECK(add_size <= static_cast<uint32_t>(Smi::kMaxValue - length))((void) 0);
  uint32_t new_length = length + add_size;
  Isolate* isolate = receiver->GetIsolate();

  if (new_length > elms_len) {
    // New backing storage is needed.
    uint32_t capacity = JSObject::NewElementsCapacity(new_length);
    // If we add arguments to the start we have to shift the existing objects.
    int copy_dst_index = add_position == AT_START ? add_size : 0;
    // Copy over all objects to a new backing_store.
    ASSIGN_RETURN_ON_EXCEPTION_VALUE(do { if (!(Subclass::ConvertElementsWithCapacity(receiver, backing_store
, KindTraits::Kind, capacity, 0, copy_dst_index)).ToHandle(&
backing_store)) { ((void) 0); return Nothing<uint32_t>(
); } } while (false)
        isolate, backing_store,do { if (!(Subclass::ConvertElementsWithCapacity(receiver, backing_store
, KindTraits::Kind, capacity, 0, copy_dst_index)).ToHandle(&
backing_store)) { ((void) 0); return Nothing<uint32_t>(
); } } while (false)
        Subclass::ConvertElementsWithCapacity(receiver, backing_store,do { if (!(Subclass::ConvertElementsWithCapacity(receiver, backing_store
, KindTraits::Kind, capacity, 0, copy_dst_index)).ToHandle(&
backing_store)) { ((void) 0); return Nothing<uint32_t>(
); } } while (false)
                                              KindTraits::Kind, capacity, 0,do { if (!(Subclass::ConvertElementsWithCapacity(receiver, backing_store
, KindTraits::Kind, capacity, 0, copy_dst_index)).ToHandle(&
backing_store)) { ((void) 0); return Nothing<uint32_t>(
); } } while (false)
                                              copy_dst_index),do { if (!(Subclass::ConvertElementsWithCapacity(receiver, backing_store
, KindTraits::Kind, capacity, 0, copy_dst_index)).ToHandle(&
backing_store)) { ((void) 0); return Nothing<uint32_t>(
); } } while (false)
        Nothing<uint32_t>())do { if (!(Subclass::ConvertElementsWithCapacity(receiver, backing_store
, KindTraits::Kind, capacity, 0, copy_dst_index)).ToHandle(&
backing_store)) { ((void) 0); return Nothing<uint32_t>(
); } } while (false);
    receiver->set_elements(*backing_store);
  } else if (add_position == AT_START) {
    // If the backing store has enough capacity and we add elements to the
    // start we have to shift the existing objects.
    Subclass::MoveElements(isolate, receiver, backing_store, add_size, 0,
                           length, 0, 0);
  }

  int insertion_index = add_position == AT_START ? 0 : length;
  // Copy the arguments to the start.
  Subclass::CopyArguments(args, backing_store, add_size, 1, insertion_index);
  // Set the length.
  receiver->set_length(Smi::FromInt(new_length));
  return Just(new_length);
}

static void CopyArguments(BuiltinArguments* args,
                          Handle<FixedArrayBase> dst_store,
                          uint32_t copy_size, uint32_t src_index,
                          uint32_t dst_index) {
  // Add the provided values.
  DisallowGarbageCollection no_gc;
  FixedArrayBase raw_backing_store = *dst_store;
  WriteBarrierMode mode = raw_backing_store.GetWriteBarrierMode(no_gc);
  for (uint32_t i = 0; i < copy_size; i++) {
    Object argument = (*args)[src_index + i];
    DCHECK(!argument.IsTheHole())((void) 0);
    Subclass::SetImpl(raw_backing_store, InternalIndex(dst_index + i),
                      argument, mode);
  }
}
2478};

2480template <typename Subclass, typename KindTraits>
2481class FastSmiOrObjectElementsAccessor
  : public FastElementsAccessor<Subclass, KindTraits> {
public:
static inline void SetImpl(Handle<JSObject> holder, InternalIndex entry,
                           Object value) {
  SetImpl(holder->elements(), entry, value);
}

static inline void SetImpl(FixedArrayBase backing_store, InternalIndex entry,
                           Object value) {
  FixedArray::cast(backing_store).set(entry.as_int(), value);
}

static inline void SetImpl(FixedArrayBase backing_store, InternalIndex entry,
                           Object value, WriteBarrierMode mode) {
  FixedArray::cast(backing_store).set(entry.as_int(), value, mode);
}

static Object GetRaw(FixedArray backing_store, InternalIndex entry) {
  return backing_store.get(entry.as_int());
}

// NOTE: this method violates the handlified function signature convention:
// raw pointer parameters in the function that allocates.
// See ElementsAccessor::CopyElements() for details.
// This method could actually allocate if copying from double elements to
// object elements.
static void CopyElementsImpl(Isolate* isolate, FixedArrayBase from,
                             uint32_t from_start, FixedArrayBase to,
                             ElementsKind from_kind, uint32_t to_start,
                             int packed_size, int copy_size) {
  DisallowGarbageCollection no_gc;
  ElementsKind to_kind = KindTraits::Kind;
  switch (from_kind) {
    case PACKED_SMI_ELEMENTS:
    case HOLEY_SMI_ELEMENTS:
    case PACKED_ELEMENTS:
    case PACKED_FROZEN_ELEMENTS:
    case PACKED_SEALED_ELEMENTS:
    case PACKED_NONEXTENSIBLE_ELEMENTS:
    case HOLEY_ELEMENTS:
    case HOLEY_FROZEN_ELEMENTS:
    case HOLEY_SEALED_ELEMENTS:
    case HOLEY_NONEXTENSIBLE_ELEMENTS:
      CopyObjectToObjectElements(isolate, from, from_kind, from_start, to,
                                 to_kind, to_start, copy_size);
      break;
    case PACKED_DOUBLE_ELEMENTS:
    case HOLEY_DOUBLE_ELEMENTS: {
      AllowGarbageCollection allow_allocation;
      DCHECK(IsObjectElementsKind(to_kind))((void) 0);
      CopyDoubleToObjectElements(isolate, from, from_start, to, to_start,
                                 copy_size);
      break;
    }
    case DICTIONARY_ELEMENTS:
      CopyDictionaryToObjectElements(isolate, from, from_start, to, to_kind,
                                     to_start, copy_size);
      break;
    case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
    case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
    case FAST_STRING_WRAPPER_ELEMENTS:
    case SLOW_STRING_WRAPPER_ELEMENTS:
2544#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype) case TYPE##_ELEMENTS:
      TYPED_ARRAYS(TYPED_ARRAY_CASE)TYPED_ARRAY_CASE(Uint8, uint8, UINT8, uint8_t) TYPED_ARRAY_CASE
(Int8, int8, INT8, int8_t) TYPED_ARRAY_CASE(Uint16, uint16, UINT16
, uint16_t) TYPED_ARRAY_CASE(Int16, int16, INT16, int16_t) TYPED_ARRAY_CASE
(Uint32, uint32, UINT32, uint32_t) TYPED_ARRAY_CASE(Int32, int32
, INT32, int32_t) TYPED_ARRAY_CASE(Float32, float32, FLOAT32,
 float) TYPED_ARRAY_CASE(Float64, float64, FLOAT64, double) TYPED_ARRAY_CASE
(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t) TYPED_ARRAY_CASE
(BigUint64, biguint64, BIGUINT64, uint64_t) TYPED_ARRAY_CASE(
BigInt64, bigint64, BIGINT64, int64_t)
      RAB_GSAB_TYPED_ARRAYS(TYPED_ARRAY_CASE)TYPED_ARRAY_CASE(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8
, uint8_t) TYPED_ARRAY_CASE(RabGsabInt8, rab_gsab_int8, RAB_GSAB_INT8
, int8_t) TYPED_ARRAY_CASE(RabGsabUint16, rab_gsab_uint16, RAB_GSAB_UINT16
, uint16_t) TYPED_ARRAY_CASE(RabGsabInt16, rab_gsab_int16, RAB_GSAB_INT16
, int16_t) TYPED_ARRAY_CASE(RabGsabUint32, rab_gsab_uint32, RAB_GSAB_UINT32
, uint32_t) TYPED_ARRAY_CASE(RabGsabInt32, rab_gsab_int32, RAB_GSAB_INT32
, int32_t) TYPED_ARRAY_CASE(RabGsabFloat32, rab_gsab_float32,
 RAB_GSAB_FLOAT32, float) TYPED_ARRAY_CASE(RabGsabFloat64, rab_gsab_float64
, RAB_GSAB_FLOAT64, double) TYPED_ARRAY_CASE(RabGsabUint8Clamped
, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) TYPED_ARRAY_CASE
(RabGsabBigUint64, rab_gsab_biguint64, RAB_GSAB_BIGUINT64, uint64_t
) TYPED_ARRAY_CASE(RabGsabBigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64
, int64_t)
2547#undef TYPED_ARRAY_CASE
    case WASM_ARRAY_ELEMENTS:
      // This function is currently only used for JSArrays with non-zero
      // length.
      UNREACHABLE()V8_Fatal("unreachable code");
    case NO_ELEMENTS:
      break;  // Nothing to do.
  }
}

static Maybe<bool> CollectValuesOrEntriesImpl(
    Isolate* isolate, Handle<JSObject> object,
    Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
    PropertyFilter filter) {
  int count = 0;
  if (get_entries) {
    // Collecting entries needs to allocate, so this code must be handlified.
    Handle<FixedArray> elements(FixedArray::cast(object->elements()),
                                isolate);
    uint32_t length = elements->length();
    for (uint32_t index = 0; index < length; ++index) {
      InternalIndex entry(index);
      if (!Subclass::HasEntryImpl(isolate, *elements, entry)) continue;
      Handle<Object> value = Subclass::GetImpl(isolate, *elements, entry);
      value = MakeEntryPair(isolate, index, value);
      values_or_entries->set(count++, *value);
    }
  } else {
    // No allocations here, so we can avoid handlification overhead.
    DisallowGarbageCollection no_gc;
    FixedArray elements = FixedArray::cast(object->elements());
    uint32_t length = elements.length();
    for (uint32_t index = 0; index < length; ++index) {
      InternalIndex entry(index);
      if (!Subclass::HasEntryImpl(isolate, elements, entry)) continue;
      Object value = GetRaw(elements, entry);
      values_or_entries->set(count++, value);
    }
  }
  *nof_items = count;
  return Just(true);
}

static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                       Handle<JSObject> receiver,
                                       Handle<Object> search_value,
                                       size_t start_from, size_t length) {
  DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver))((void) 0);
  DisallowGarbageCollection no_gc;
  FixedArrayBase elements_base = receiver->elements();
  Object value = *search_value;

  if (start_from >= length) return Just<int64_t>(-1);

  length = std::min(static_cast<size_t>(elements_base.length()), length);

  // Only FAST_{,HOLEY_}ELEMENTS can store non-numbers.
  if (!value.IsNumber() && !IsObjectElementsKind(Subclass::kind()) &&
      !IsAnyNonextensibleElementsKind(Subclass::kind())) {
    return Just<int64_t>(-1);
  }
  // NaN can never be found by strict equality.
  if (value.IsNaN()) return Just<int64_t>(-1);

  // k can be greater than receiver->length() below, but it is bounded by
  // elements_base->length() so we never read out of bounds. This means that
  // elements->get(k) can return the hole, for which the StrictEquals will
  // always fail.
  FixedArray elements = FixedArray::cast(receiver->elements());
  STATIC_ASSERT(FixedArray::kMaxLength <=static_assert(FixedArray::kMaxLength <= std::numeric_limits
<uint32_t>::max(), "FixedArray::kMaxLength <= std::numeric_limits<uint32_t>::max()"
)
                std::numeric_limits<uint32_t>::max())static_assert(FixedArray::kMaxLength <= std::numeric_limits
<uint32_t>::max(), "FixedArray::kMaxLength <= std::numeric_limits<uint32_t>::max()"
);
  for (size_t k = start_from; k < length; ++k) {
    if (value.StrictEquals(elements.get(static_cast<uint32_t>(k)))) {
      return Just<int64_t>(k);
    }
  }
  return Just<int64_t>(-1);
}
2625};

2627class FastPackedSmiElementsAccessor
  : public FastSmiOrObjectElementsAccessor<
        FastPackedSmiElementsAccessor,
        ElementsKindTraits<PACKED_SMI_ELEMENTS>> {};

2632class FastHoleySmiElementsAccessor
  : public FastSmiOrObjectElementsAccessor<
        FastHoleySmiElementsAccessor,
        ElementsKindTraits<HOLEY_SMI_ELEMENTS>> {};

2637class FastPackedObjectElementsAccessor
  : public FastSmiOrObjectElementsAccessor<
        FastPackedObjectElementsAccessor,
        ElementsKindTraits<PACKED_ELEMENTS>> {};

2642template <typename Subclass, typename KindTraits>
2643class FastNonextensibleObjectElementsAccessor
  : public FastSmiOrObjectElementsAccessor<Subclass, KindTraits> {
public:
using BackingStore = typename KindTraits::BackingStore;

static Maybe<uint32_t> PushImpl(Handle<JSArray> receiver,
                                BuiltinArguments* args, uint32_t push_size) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

// TODO(duongn): refactor this due to code duplication of sealed version.
// Consider using JSObject::NormalizeElements(). Also consider follow the fast
// element logic instead of changing to dictionary mode.
static Maybe<bool> SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
                                 uint32_t length,
                                 Handle<FixedArrayBase> backing_store) {
  uint32_t old_length = 0;
  CHECK(array->length().ToArrayIndex(&old_length))do { if ((__builtin_expect(!!(!(array->length().ToArrayIndex
(&old_length))), 0))) { V8_Fatal("Check failed: %s.", "array->length().ToArrayIndex(&old_length)"
); } } while (false);
  if (length == old_length) {
    // Do nothing.
    return Just(true);
  }

  // Transition to DICTIONARY_ELEMENTS.
  // Convert to dictionary mode.
  Handle<NumberDictionary> new_element_dictionary =
      old_length == 0 ? isolate->factory()->empty_slow_element_dictionary()
                      : array->GetElementsAccessor()->Normalize(array);

  // Migrate map.
  Handle<Map> new_map = Map::Copy(isolate, handle(array->map(), isolate),
                                  "SlowCopyForSetLengthImpl");
  new_map->set_is_extensible(false);
  new_map->set_elements_kind(DICTIONARY_ELEMENTS);
  JSObject::MigrateToMap(isolate, array, new_map);

  if (!new_element_dictionary.is_null()) {
    array->set_elements(*new_element_dictionary);
  }

  if (array->elements() !=
      ReadOnlyRoots(isolate).empty_slow_element_dictionary()) {
    Handle<NumberDictionary> dictionary(array->element_dictionary(), isolate);
    // Make sure we never go back to the fast case
    array->RequireSlowElements(*dictionary);
    JSObject::ApplyAttributesToDictionary(isolate, ReadOnlyRoots(isolate),
                                          dictionary,
                                          PropertyAttributes::NONE);
  }

  // Set length.
  Handle<FixedArrayBase> new_backing_store(array->elements(), isolate);
  return DictionaryElementsAccessor::SetLengthImpl(isolate, array, length,
                                                   new_backing_store);
}
2705};

2707class FastPackedNonextensibleObjectElementsAccessor
  : public FastNonextensibleObjectElementsAccessor<
        FastPackedNonextensibleObjectElementsAccessor,
        ElementsKindTraits<PACKED_NONEXTENSIBLE_ELEMENTS>> {};

2712class FastHoleyNonextensibleObjectElementsAccessor
  : public FastNonextensibleObjectElementsAccessor<
        FastHoleyNonextensibleObjectElementsAccessor,
        ElementsKindTraits<HOLEY_NONEXTENSIBLE_ELEMENTS>> {};

2717template <typename Subclass, typename KindTraits>
2718class FastSealedObjectElementsAccessor
  : public FastSmiOrObjectElementsAccessor<Subclass, KindTraits> {
public:
using BackingStore = typename KindTraits::BackingStore;

static Handle<Object> RemoveElement(Handle<JSArray> receiver,
                                    Where remove_position) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void DeleteAtEnd(Handle<JSObject> obj,
                        Handle<BackingStore> backing_store, uint32_t entry) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void DeleteCommon(Handle<JSObject> obj, uint32_t entry,
                         Handle<FixedArrayBase> store) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static MaybeHandle<Object> PopImpl(Handle<JSArray> receiver) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Maybe<uint32_t> PushImpl(Handle<JSArray> receiver,
                                BuiltinArguments* args, uint32_t push_size) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

// TODO(duongn): refactor this due to code duplication of nonextensible
// version. Consider using JSObject::NormalizeElements(). Also consider follow
// the fast element logic instead of changing to dictionary mode.
static Maybe<bool> SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
                                 uint32_t length,
                                 Handle<FixedArrayBase> backing_store) {
  uint32_t old_length = 0;
  CHECK(array->length().ToArrayIndex(&old_length))do { if ((__builtin_expect(!!(!(array->length().ToArrayIndex
(&old_length))), 0))) { V8_Fatal("Check failed: %s.", "array->length().ToArrayIndex(&old_length)"
); } } while (false);
  if (length == old_length) {
    // Do nothing.
    return Just(true);
  }

  // Transition to DICTIONARY_ELEMENTS.
  // Convert to dictionary mode
  Handle<NumberDictionary> new_element_dictionary =
      old_length == 0 ? isolate->factory()->empty_slow_element_dictionary()
                      : array->GetElementsAccessor()->Normalize(array);

  // Migrate map.
  Handle<Map> new_map = Map::Copy(isolate, handle(array->map(), isolate),
                                  "SlowCopyForSetLengthImpl");
  new_map->set_is_extensible(false);
  new_map->set_elements_kind(DICTIONARY_ELEMENTS);
  JSObject::MigrateToMap(isolate, array, new_map);

  if (!new_element_dictionary.is_null()) {
    array->set_elements(*new_element_dictionary);
  }

  if (array->elements() !=
      ReadOnlyRoots(isolate).empty_slow_element_dictionary()) {
    Handle<NumberDictionary> dictionary(array->element_dictionary(), isolate);
    // Make sure we never go back to the fast case
    array->RequireSlowElements(*dictionary);
    JSObject::ApplyAttributesToDictionary(isolate, ReadOnlyRoots(isolate),
                                          dictionary,
                                          PropertyAttributes::SEALED);
  }

  // Set length
  Handle<FixedArrayBase> new_backing_store(array->elements(), isolate);
  return DictionaryElementsAccessor::SetLengthImpl(isolate, array, length,
                                                   new_backing_store);
}
2803};

2805class FastPackedSealedObjectElementsAccessor
  : public FastSealedObjectElementsAccessor<
        FastPackedSealedObjectElementsAccessor,
        ElementsKindTraits<PACKED_SEALED_ELEMENTS>> {};

2810class FastHoleySealedObjectElementsAccessor
  : public FastSealedObjectElementsAccessor<
        FastHoleySealedObjectElementsAccessor,
        ElementsKindTraits<HOLEY_SEALED_ELEMENTS>> {};

2815template <typename Subclass, typename KindTraits>
2816class FastFrozenObjectElementsAccessor
  : public FastSmiOrObjectElementsAccessor<Subclass, KindTraits> {
public:
using BackingStore = typename KindTraits::BackingStore;

static inline void SetImpl(Handle<JSObject> holder, InternalIndex entry,
                           Object value) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static inline void SetImpl(FixedArrayBase backing_store, InternalIndex entry,
                           Object value) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static inline void SetImpl(FixedArrayBase backing_store, InternalIndex entry,
                           Object value, WriteBarrierMode mode) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Handle<Object> RemoveElement(Handle<JSArray> receiver,
                                    Where remove_position) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void DeleteAtEnd(Handle<JSObject> obj,
                        Handle<BackingStore> backing_store, uint32_t entry) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void DeleteCommon(Handle<JSObject> obj, uint32_t entry,
                         Handle<FixedArrayBase> store) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static MaybeHandle<Object> PopImpl(Handle<JSArray> receiver) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Maybe<uint32_t> PushImpl(Handle<JSArray> receiver,
                                BuiltinArguments* args, uint32_t push_size) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Maybe<bool> SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
                                 uint32_t length,
                                 Handle<FixedArrayBase> backing_store) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void ReconfigureImpl(Handle<JSObject> object,
                            Handle<FixedArrayBase> store, InternalIndex entry,
                            Handle<Object> value,
                            PropertyAttributes attributes) {
  UNREACHABLE()V8_Fatal("unreachable code");
}
2883};

2885class FastPackedFrozenObjectElementsAccessor
  : public FastFrozenObjectElementsAccessor<
        FastPackedFrozenObjectElementsAccessor,
        ElementsKindTraits<PACKED_FROZEN_ELEMENTS>> {};

2890class FastHoleyFrozenObjectElementsAccessor
  : public FastFrozenObjectElementsAccessor<
        FastHoleyFrozenObjectElementsAccessor,
        ElementsKindTraits<HOLEY_FROZEN_ELEMENTS>> {};

2895class FastHoleyObjectElementsAccessor
  : public FastSmiOrObjectElementsAccessor<
        FastHoleyObjectElementsAccessor, ElementsKindTraits<HOLEY_ELEMENTS>> {
2898};

2900template <typename Subclass, typename KindTraits>
2901class FastDoubleElementsAccessor
  : public FastElementsAccessor<Subclass, KindTraits> {
public:
static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase backing_store,
                              InternalIndex entry) {
  return FixedDoubleArray::get(FixedDoubleArray::cast(backing_store),
                               entry.as_int(), isolate);
}

static inline void SetImpl(Handle<JSObject> holder, InternalIndex entry,
                           Object value) {
  SetImpl(holder->elements(), entry, value);
}

static inline void SetImpl(FixedArrayBase backing_store, InternalIndex entry,
                           Object value) {
  FixedDoubleArray::cast(backing_store).set(entry.as_int(), value.Number());
}

static inline void SetImpl(FixedArrayBase backing_store, InternalIndex entry,
                           Object value, WriteBarrierMode mode) {
  FixedDoubleArray::cast(backing_store).set(entry.as_int(), value.Number());
}

static void CopyElementsImpl(Isolate* isolate, FixedArrayBase from,
                             uint32_t from_start, FixedArrayBase to,
                             ElementsKind from_kind, uint32_t to_start,
                             int packed_size, int copy_size) {
  DisallowGarbageCollection no_gc;
  switch (from_kind) {
    case PACKED_SMI_ELEMENTS:
      CopyPackedSmiToDoubleElements(from, from_start, to, to_start,
                                    packed_size, copy_size);
      break;
    case HOLEY_SMI_ELEMENTS:
      CopySmiToDoubleElements(from, from_start, to, to_start, copy_size);
      break;
    case PACKED_DOUBLE_ELEMENTS:
    case HOLEY_DOUBLE_ELEMENTS:
      CopyDoubleToDoubleElements(from, from_start, to, to_start, copy_size);
      break;
    case PACKED_ELEMENTS:
    case PACKED_FROZEN_ELEMENTS:
    case PACKED_SEALED_ELEMENTS:
    case PACKED_NONEXTENSIBLE_ELEMENTS:
    case HOLEY_ELEMENTS:
    case HOLEY_FROZEN_ELEMENTS:
    case HOLEY_SEALED_ELEMENTS:
    case HOLEY_NONEXTENSIBLE_ELEMENTS:
      CopyObjectToDoubleElements(from, from_start, to, to_start, copy_size);
      break;
    case DICTIONARY_ELEMENTS:
      CopyDictionaryToDoubleElements(isolate, from, from_start, to, to_start,
                                     copy_size);
      break;
    case FAST_SLOPPY_ARGUMENTS_ELEMENTS:
    case SLOW_SLOPPY_ARGUMENTS_ELEMENTS:
    case FAST_STRING_WRAPPER_ELEMENTS:
    case SLOW_STRING_WRAPPER_ELEMENTS:
    case WASM_ARRAY_ELEMENTS:
    case NO_ELEMENTS:
2962#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype) case TYPE##_ELEMENTS:
      TYPED_ARRAYS(TYPED_ARRAY_CASE)TYPED_ARRAY_CASE(Uint8, uint8, UINT8, uint8_t) TYPED_ARRAY_CASE
(Int8, int8, INT8, int8_t) TYPED_ARRAY_CASE(Uint16, uint16, UINT16
, uint16_t) TYPED_ARRAY_CASE(Int16, int16, INT16, int16_t) TYPED_ARRAY_CASE
(Uint32, uint32, UINT32, uint32_t) TYPED_ARRAY_CASE(Int32, int32
, INT32, int32_t) TYPED_ARRAY_CASE(Float32, float32, FLOAT32,
 float) TYPED_ARRAY_CASE(Float64, float64, FLOAT64, double) TYPED_ARRAY_CASE
(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t) TYPED_ARRAY_CASE
(BigUint64, biguint64, BIGUINT64, uint64_t) TYPED_ARRAY_CASE(
BigInt64, bigint64, BIGINT64, int64_t)
      RAB_GSAB_TYPED_ARRAYS(TYPED_ARRAY_CASE)TYPED_ARRAY_CASE(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8
, uint8_t) TYPED_ARRAY_CASE(RabGsabInt8, rab_gsab_int8, RAB_GSAB_INT8
, int8_t) TYPED_ARRAY_CASE(RabGsabUint16, rab_gsab_uint16, RAB_GSAB_UINT16
, uint16_t) TYPED_ARRAY_CASE(RabGsabInt16, rab_gsab_int16, RAB_GSAB_INT16
, int16_t) TYPED_ARRAY_CASE(RabGsabUint32, rab_gsab_uint32, RAB_GSAB_UINT32
, uint32_t) TYPED_ARRAY_CASE(RabGsabInt32, rab_gsab_int32, RAB_GSAB_INT32
, int32_t) TYPED_ARRAY_CASE(RabGsabFloat32, rab_gsab_float32,
 RAB_GSAB_FLOAT32, float) TYPED_ARRAY_CASE(RabGsabFloat64, rab_gsab_float64
, RAB_GSAB_FLOAT64, double) TYPED_ARRAY_CASE(RabGsabUint8Clamped
, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) TYPED_ARRAY_CASE
(RabGsabBigUint64, rab_gsab_biguint64, RAB_GSAB_BIGUINT64, uint64_t
) TYPED_ARRAY_CASE(RabGsabBigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64
, int64_t)
2965#undef TYPED_ARRAY_CASE
      // This function is currently only used for JSArrays with non-zero
      // length.
      UNREACHABLE()V8_Fatal("unreachable code");
  }
}

static Maybe<bool> CollectValuesOrEntriesImpl(
    Isolate* isolate, Handle<JSObject> object,
    Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
    PropertyFilter filter) {
  Handle<FixedDoubleArray> elements(
      FixedDoubleArray::cast(object->elements()), isolate);
  int count = 0;
  uint32_t length = elements->length();
  for (uint32_t index = 0; index < length; ++index) {
    InternalIndex entry(index);
    if (!Subclass::HasEntryImpl(isolate, *elements, entry)) continue;
    Handle<Object> value = Subclass::GetImpl(isolate, *elements, entry);
    if (get_entries) {
      value = MakeEntryPair(isolate, index, value);
    }
    values_or_entries->set(count++, *value);
  }
  *nof_items = count;
  return Just(true);
}

static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                       Handle<JSObject> receiver,
                                       Handle<Object> search_value,
                                       size_t start_from, size_t length) {
  DCHECK(JSObject::PrototypeHasNoElements(isolate, *receiver))((void) 0);
  DisallowGarbageCollection no_gc;
  FixedArrayBase elements_base = receiver->elements();
  Object value = *search_value;

  length = std::min(static_cast<size_t>(elements_base.length()), length);

  if (start_from >= length) return Just<int64_t>(-1);

  if (!value.IsNumber()) {
    return Just<int64_t>(-1);
  }
  if (value.IsNaN()) {
    return Just<int64_t>(-1);
  }
  double numeric_search_value = value.Number();
  FixedDoubleArray elements = FixedDoubleArray::cast(receiver->elements());

  STATIC_ASSERT(FixedDoubleArray::kMaxLength <=static_assert(FixedDoubleArray::kMaxLength <= std::numeric_limits
<int>::max(), "FixedDoubleArray::kMaxLength <= std::numeric_limits<int>::max()"
)
                std::numeric_limits<int>::max())static_assert(FixedDoubleArray::kMaxLength <= std::numeric_limits
<int>::max(), "FixedDoubleArray::kMaxLength <= std::numeric_limits<int>::max()"
);
  for (size_t k = start_from; k < length; ++k) {
    int k_int = static_cast<int>(k);
    if (elements.is_the_hole(k_int)) {
      continue;
    }
    if (elements.get_scalar(k_int) == numeric_search_value) {
      return Just<int64_t>(k);
    }
  }
  return Just<int64_t>(-1);
}
3028};

3030class FastPackedDoubleElementsAccessor
  : public FastDoubleElementsAccessor<
        FastPackedDoubleElementsAccessor,
        ElementsKindTraits<PACKED_DOUBLE_ELEMENTS>> {};

3035class FastHoleyDoubleElementsAccessor
  : public FastDoubleElementsAccessor<
        FastHoleyDoubleElementsAccessor,
        ElementsKindTraits<HOLEY_DOUBLE_ELEMENTS>> {};

3040enum IsSharedBuffer : bool { kShared = true, kUnshared = false };

3042// Super class for all external element arrays.
3043template <ElementsKind Kind, typename ElementType>
3044class TypedElementsAccessor
  : public ElementsAccessorBase<TypedElementsAccessor<Kind, ElementType>,
                                ElementsKindTraits<Kind>> {
public:
using BackingStore = typename ElementsKindTraits<Kind>::BackingStore;
using AccessorClass = TypedElementsAccessor<Kind, ElementType>;

// Conversions from (other) scalar values.
static ElementType FromScalar(int value) {
  return static_cast<ElementType>(value);
}
static ElementType FromScalar(uint32_t value) {
  return static_cast<ElementType>(value);
}
static ElementType FromScalar(double value) {
  return FromScalar(DoubleToInt32(value));
}
static ElementType FromScalar(int64_t value) { UNREACHABLE()V8_Fatal("unreachable code"); }
static ElementType FromScalar(uint64_t value) { UNREACHABLE()V8_Fatal("unreachable code"); }

// Conversions from objects / handles.
static ElementType FromObject(Object value, bool* lossless = nullptr) {
  if (value.IsSmi()) {
12
←
Taking false branch→
    return FromScalar(Smi::ToInt(value));
  } else if (value.IsHeapNumber()) {
13
←
Taking false branch→
    return FromScalar(HeapNumber::cast(value).value());
  } else {
    // Clamp undefined here as well. All other types have been
    // converted to a number type further up in the call chain.
    DCHECK(value.IsUndefined())((void) 0);
    return FromScalar(Oddball::cast(value).to_number_raw());
14
←
Returning without writing to '*lossless'→
  }
}
static ElementType FromHandle(Handle<Object> value,
                              bool* lossless = nullptr) {
  return FromObject(*value, lossless);
11
←
Calling 'TypedElementsAccessor::FromObject'→
15
←
Returning from 'TypedElementsAccessor::FromObject'→
16
←
Returning without writing to '*lossless'→
}

// Conversion of scalar value to handlified object.
static Handle<Object> ToHandle(Isolate* isolate, ElementType value);

static void SetImpl(Handle<JSObject> holder, InternalIndex entry,
                    Object value) {
  Handle<JSTypedArray> typed_array = Handle<JSTypedArray>::cast(holder);
  DCHECK_LE(entry.raw_value(), typed_array->GetLength())((void) 0);
  auto* entry_ptr =
      static_cast<ElementType*>(typed_array->DataPtr()) + entry.raw_value();
  auto is_shared = typed_array->buffer().is_shared() ? kShared : kUnshared;
  SetImpl(entry_ptr, FromObject(value), is_shared);
}

static void SetImpl(ElementType* data_ptr, ElementType value,
                    IsSharedBuffer is_shared) {
  // TODO(ishell, v8:8875): Independent of pointer compression, 8-byte size
  // fields (external pointers, doubles and BigInt data) are not always 8-byte
  // aligned. This is relying on undefined behaviour in C++, since {data_ptr}
  // is not aligned to {alignof(ElementType)}.
  if (!is_shared) {
    base::WriteUnalignedValue(reinterpret_cast<Address>(data_ptr), value);
    return;
  }

  // The JavaScript memory model allows for racy reads and writes to a
  // SharedArrayBuffer's backing store. Using relaxed atomics is not strictly
  // required for JavaScript, but will avoid undefined behaviour in C++ and is
  // unlikely to introduce noticable overhead.
  if (IsAligned(reinterpret_cast<uintptr_t>(data_ptr),
                alignof(std::atomic<ElementType>))) {
    // Use a single relaxed atomic store.
    STATIC_ASSERT(sizeof(std::atomic<ElementType>) == sizeof(ElementType))static_assert(sizeof(std::atomic<ElementType>) == sizeof
(ElementType), "sizeof(std::atomic<ElementType>) == sizeof(ElementType)"
);
    reinterpret_cast<std::atomic<ElementType>*>(data_ptr)->store(
        value, std::memory_order_relaxed);
    return;
  }

  // Some static CHECKs (are optimized out if succeeding) to ensure that
  // {data_ptr} is at least four byte aligned, and {std::atomic<uint32_t>}
  // has size and alignment of four bytes, such that we can cast the
  // {data_ptr} to it.
  CHECK_LE(kInt32Size, alignof(ElementType))do { bool _cmp = ::v8::base::CmpLEImpl< typename ::v8::base
::pass_value_or_ref<decltype(kInt32Size)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(alignof(ElementType
))>::type>((kInt32Size), (alignof(ElementType))); do { if
 ((__builtin_expect(!!(!(_cmp)), 0))) { V8_Fatal("Check failed: %s."
, "kInt32Size" " " "<=" " " "alignof(ElementType)"); } } while
 (false); } while (false);
  CHECK_EQ(kInt32Size, alignof(std::atomic<uint32_t>))do { bool _cmp = ::v8::base::CmpEQImpl< typename ::v8::base
::pass_value_or_ref<decltype(kInt32Size)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(alignof(std::atomic
<uint32_t>))>::type>((kInt32Size), (alignof(std::
atomic<uint32_t>))); do { if ((__builtin_expect(!!(!(_cmp
)), 0))) { V8_Fatal("Check failed: %s.", "kInt32Size" " " "=="
 " " "alignof(std::atomic<uint32_t>)"); } } while (false
); } while (false);
  CHECK_EQ(kInt32Size, sizeof(std::atomic<uint32_t>))do { bool _cmp = ::v8::base::CmpEQImpl< typename ::v8::base
::pass_value_or_ref<decltype(kInt32Size)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(sizeof(std::atomic
<uint32_t>))>::type>((kInt32Size), (sizeof(std::atomic
<uint32_t>))); do { if ((__builtin_expect(!!(!(_cmp)), 0
))) { V8_Fatal("Check failed: %s.", "kInt32Size" " " "==" " "
 "sizeof(std::atomic<uint32_t>)"); } } while (false); }
 while (false);
  // And dynamically check that we indeed have at least four byte alignment.
  DCHECK(IsAligned(reinterpret_cast<uintptr_t>(data_ptr), kInt32Size))((void) 0);
  // Store as multiple 32-bit words. Make {kNumWords} >= 1 to avoid compiler
  // warnings for the empty array or memcpy to an empty object.
  constexpr size_t kNumWords =
      std::max(size_t{1}, sizeof(ElementType) / kInt32Size);
  uint32_t words[kNumWords];
  CHECK_EQ(sizeof(words), sizeof(value))do { bool _cmp = ::v8::base::CmpEQImpl< typename ::v8::base
::pass_value_or_ref<decltype(sizeof(words))>::type, typename
 ::v8::base::pass_value_or_ref<decltype(sizeof(value))>
::type>((sizeof(words)), (sizeof(value))); do { if ((__builtin_expect
(!!(!(_cmp)), 0))) { V8_Fatal("Check failed: %s.", "sizeof(words)"
 " " "==" " " "sizeof(value)"); } } while (false); } while (false
);
  memcpy(words, &value, sizeof(value));
  for (size_t word = 0; word < kNumWords; ++word) {
    STATIC_ASSERT(sizeof(std::atomic<uint32_t>) == sizeof(uint32_t))static_assert(sizeof(std::atomic<uint32_t>) == sizeof(uint32_t
), "sizeof(std::atomic<uint32_t>) == sizeof(uint32_t)");
    reinterpret_cast<std::atomic<uint32_t>*>(data_ptr)[word].store(
        words[word], std::memory_order_relaxed);
  }
}

static Handle<Object> GetInternalImpl(Handle<JSObject> holder,
                                      InternalIndex entry) {
  Handle<JSTypedArray> typed_array = Handle<JSTypedArray>::cast(holder);
  Isolate* isolate = typed_array->GetIsolate();
  DCHECK_LT(entry.raw_value(), typed_array->GetLength())((void) 0);
  DCHECK(!typed_array->IsDetachedOrOutOfBounds())((void) 0);
  auto* element_ptr =
      static_cast<ElementType*>(typed_array->DataPtr()) + entry.raw_value();
  auto is_shared = typed_array->buffer().is_shared() ? kShared : kUnshared;
  ElementType elem = GetImpl(element_ptr, is_shared);
  return ToHandle(isolate, elem);
}

static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase backing_store,
                              InternalIndex entry) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static ElementType GetImpl(ElementType* data_ptr, IsSharedBuffer is_shared) {
  // TODO(ishell, v8:8875): Independent of pointer compression, 8-byte size
  // fields (external pointers, doubles and BigInt data) are not always
  // 8-byte aligned.
  if (!is_shared) {
    return base::ReadUnalignedValue<ElementType>(
        reinterpret_cast<Address>(data_ptr));
  }

  // The JavaScript memory model allows for racy reads and writes to a
  // SharedArrayBuffer's backing store. Using relaxed atomics is not strictly
  // required for JavaScript, but will avoid undefined behaviour in C++ and is
  // unlikely to introduce noticable overhead.
  if (IsAligned(reinterpret_cast<uintptr_t>(data_ptr),
                alignof(std::atomic<ElementType>))) {
    // Use a single relaxed atomic load.
    STATIC_ASSERT(sizeof(std::atomic<ElementType>) == sizeof(ElementType))static_assert(sizeof(std::atomic<ElementType>) == sizeof
(ElementType), "sizeof(std::atomic<ElementType>) == sizeof(ElementType)"
);
    // Note: acquire semantics are not needed here, but clang seems to merge
    // this atomic load with the non-atomic load above if we use relaxed
    // semantics. This will result in TSan failures.
    return reinterpret_cast<std::atomic<ElementType>*>(data_ptr)->load(
        std::memory_order_acquire);
  }

  // Some static CHECKs (are optimized out if succeeding) to ensure that
  // {data_ptr} is at least four byte aligned, and {std::atomic<uint32_t>}
  // has size and alignment of four bytes, such that we can cast the
  // {data_ptr} to it.
  CHECK_LE(kInt32Size, alignof(ElementType))do { bool _cmp = ::v8::base::CmpLEImpl< typename ::v8::base
::pass_value_or_ref<decltype(kInt32Size)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(alignof(ElementType
))>::type>((kInt32Size), (alignof(ElementType))); do { if
 ((__builtin_expect(!!(!(_cmp)), 0))) { V8_Fatal("Check failed: %s."
, "kInt32Size" " " "<=" " " "alignof(ElementType)"); } } while
 (false); } while (false);
  CHECK_EQ(kInt32Size, alignof(std::atomic<uint32_t>))do { bool _cmp = ::v8::base::CmpEQImpl< typename ::v8::base
::pass_value_or_ref<decltype(kInt32Size)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(alignof(std::atomic
<uint32_t>))>::type>((kInt32Size), (alignof(std::
atomic<uint32_t>))); do { if ((__builtin_expect(!!(!(_cmp
)), 0))) { V8_Fatal("Check failed: %s.", "kInt32Size" " " "=="
 " " "alignof(std::atomic<uint32_t>)"); } } while (false
); } while (false);
  CHECK_EQ(kInt32Size, sizeof(std::atomic<uint32_t>))do { bool _cmp = ::v8::base::CmpEQImpl< typename ::v8::base
::pass_value_or_ref<decltype(kInt32Size)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(sizeof(std::atomic
<uint32_t>))>::type>((kInt32Size), (sizeof(std::atomic
<uint32_t>))); do { if ((__builtin_expect(!!(!(_cmp)), 0
))) { V8_Fatal("Check failed: %s.", "kInt32Size" " " "==" " "
 "sizeof(std::atomic<uint32_t>)"); } } while (false); }
 while (false);
  // And dynamically check that we indeed have at least four byte alignment.
  DCHECK(IsAligned(reinterpret_cast<uintptr_t>(data_ptr), kInt32Size))((void) 0);
  // Load in multiple 32-bit words. Make {kNumWords} >= 1 to avoid compiler
  // warnings for the empty array or memcpy to an empty object.
  constexpr size_t kNumWords =
      std::max(size_t{1}, sizeof(ElementType) / kInt32Size);
  uint32_t words[kNumWords];
  for (size_t word = 0; word < kNumWords; ++word) {
    STATIC_ASSERT(sizeof(std::atomic<uint32_t>) == sizeof(uint32_t))static_assert(sizeof(std::atomic<uint32_t>) == sizeof(uint32_t
), "sizeof(std::atomic<uint32_t>) == sizeof(uint32_t)");
    words[word] =
        reinterpret_cast<std::atomic<uint32_t>*>(data_ptr)[word].load(
            std::memory_order_relaxed);
  }
  ElementType result;
  CHECK_EQ(sizeof(words), sizeof(result))do { bool _cmp = ::v8::base::CmpEQImpl< typename ::v8::base
::pass_value_or_ref<decltype(sizeof(words))>::type, typename
 ::v8::base::pass_value_or_ref<decltype(sizeof(result))>
::type>((sizeof(words)), (sizeof(result))); do { if ((__builtin_expect
(!!(!(_cmp)), 0))) { V8_Fatal("Check failed: %s.", "sizeof(words)"
 " " "==" " " "sizeof(result)"); } } while (false); } while (
false);
  memcpy(&result, words, sizeof(result));
  return result;
}

static PropertyDetails GetDetailsImpl(JSObject holder, InternalIndex entry) {
  return PropertyDetails(PropertyKind::kData, NONE,
                         PropertyCellType::kNoCell);
}

static PropertyDetails GetDetailsImpl(FixedArrayBase backing_store,
                                      InternalIndex entry) {
  return PropertyDetails(PropertyKind::kData, NONE,
                         PropertyCellType::kNoCell);
}

static bool HasElementImpl(Isolate* isolate, JSObject holder, size_t index,
                           FixedArrayBase backing_store,
                           PropertyFilter filter) {
  return index < AccessorClass::GetCapacityImpl(holder, backing_store);
}

static bool HasAccessorsImpl(JSObject holder, FixedArrayBase backing_store) {
  return false;
}

static Maybe<bool> SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
                                 uint32_t length,
                                 Handle<FixedArrayBase> backing_store) {
  // External arrays do not support changing their length.
  UNREACHABLE()V8_Fatal("unreachable code");
}

static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
  // Do nothing.
  //
  // TypedArray elements are configurable to explain detaching, but cannot be
  // deleted otherwise.
}

static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                          FixedArrayBase backing_store,
                                          size_t index,
                                          PropertyFilter filter) {
  return index < AccessorClass::GetCapacityImpl(holder, backing_store)
             ? InternalIndex(index)
             : InternalIndex::NotFound();
}

static size_t GetCapacityImpl(JSObject holder, FixedArrayBase backing_store) {
  JSTypedArray typed_array = JSTypedArray::cast(holder);
  return typed_array.GetLength();
}

static size_t NumberOfElementsImpl(JSObject receiver,
                                   FixedArrayBase backing_store) {
  return AccessorClass::GetCapacityImpl(receiver, backing_store);
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus AddElementsToKeyAccumulatorImpl(
    Handle<JSObject> receiver, KeyAccumulator* accumulator,
    AddKeyConversion convert) {
  Isolate* isolate = receiver->GetIsolate();
  Handle<FixedArrayBase> elements(receiver->elements(), isolate);
  size_t length = AccessorClass::GetCapacityImpl(*receiver, *elements);
  for (size_t i = 0; i < length; i++) {
    Handle<Object> value =
        AccessorClass::GetInternalImpl(receiver, InternalIndex(i));
    RETURN_FAILURE_IF_NOT_SUCCESSFUL(accumulator->AddKey(value, convert));
  }
  return ExceptionStatus::kSuccess;
}

static Maybe<bool> CollectValuesOrEntriesImpl(
    Isolate* isolate, Handle<JSObject> object,
    Handle<FixedArray> values_or_entries, bool get_entries, int* nof_items,
    PropertyFilter filter) {
  int count = 0;
  if ((filter & ONLY_CONFIGURABLE) == 0) {
    Handle<FixedArrayBase> elements(object->elements(), isolate);
    size_t length = AccessorClass::GetCapacityImpl(*object, *elements);
    for (size_t index = 0; index < length; ++index) {
      Handle<Object> value =
          AccessorClass::GetInternalImpl(object, InternalIndex(index));
      if (get_entries) {
        value = MakeEntryPair(isolate, index, value);
      }
      values_or_entries->set(count++, *value);
    }
  }
  *nof_items = count;
  return Just(true);
}

static MaybeHandle<Object> FillImpl(Handle<JSObject> receiver,
                                    Handle<Object> value, size_t start,
                                    size_t end) {
  Handle<JSTypedArray> typed_array = Handle<JSTypedArray>::cast(receiver);
  DCHECK(!typed_array->IsDetachedOrOutOfBounds())((void) 0);
  DCHECK_LE(start, end)((void) 0);
  DCHECK_LE(end, typed_array->GetLength())((void) 0);
  DisallowGarbageCollection no_gc;
  ElementType scalar = FromHandle(value);
  ElementType* data = static_cast<ElementType*>(typed_array->DataPtr());
  if (typed_array->buffer().is_shared()) {
    // TypedArrays backed by shared buffers need to be filled using atomic
    // operations. Since 8-byte data are not currently always 8-byte aligned,
    // manually fill using SetImpl, which abstracts over alignment and atomic
    // complexities.
    ElementType* first = data + start;
    ElementType* last = data + end;
    for (; first != last; ++first) {
      AccessorClass::SetImpl(first, scalar, kShared);
    }
  } else if (COMPRESS_POINTERS_BOOLfalse && alignof(ElementType) > kTaggedSize) {
    // TODO(ishell, v8:8875): See UnalignedSlot<T> for details.
    std::fill(UnalignedSlot<ElementType>(data + start),
              UnalignedSlot<ElementType>(data + end), scalar);
  } else {
    std::fill(data + start, data + end, scalar);
  }
  return MaybeHandle<Object>(typed_array);
}

static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                     Handle<JSObject> receiver,
                                     Handle<Object> value, size_t start_from,
                                     size_t length) {
  DisallowGarbageCollection no_gc;
  JSTypedArray typed_array = JSTypedArray::cast(*receiver);

  if (typed_array.WasDetached()) {
    return Just(value->IsUndefined(isolate) && length > start_from);
  }

  bool out_of_bounds = false;
  size_t new_length = typed_array.GetLengthOrOutOfBounds(out_of_bounds);
  if (V8_UNLIKELY(out_of_bounds)(__builtin_expect(!!(out_of_bounds), 0))) {
    return Just(value->IsUndefined(isolate) && length > start_from);
  }

  if (value->IsUndefined(isolate) && length > new_length) {
    return Just(true);
  }

  // Prototype has no elements, and not searching for the hole --- limit
  // search to backing store length.
  if (new_length < length) {
    length = new_length;
  }

  ElementType typed_search_value;
  ElementType* data_ptr =
      reinterpret_cast<ElementType*>(typed_array.DataPtr());
  auto is_shared = typed_array.buffer().is_shared() ? kShared : kUnshared;
  if (Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS ||
      Kind == RAB_GSAB_BIGINT64_ELEMENTS ||
      Kind == RAB_GSAB_BIGUINT64_ELEMENTS) {
    if (!value->IsBigInt()) return Just(false);
    bool lossless;
    typed_search_value = FromHandle(value, &lossless);
    if (!lossless) return Just(false);
  } else {
    if (!value->IsNumber()) return Just(false);
    double search_value = value->Number();
    if (!std::isfinite(search_value)) {
      // Integral types cannot represent +Inf or NaN.
      if (!(Kind == FLOAT32_ELEMENTS || Kind == FLOAT64_ELEMENTS ||
            Kind == RAB_GSAB_FLOAT32_ELEMENTS ||
            Kind == RAB_GSAB_FLOAT64_ELEMENTS)) {
        return Just(false);
      }
      if (std::isnan(search_value)) {
        for (size_t k = start_from; k < length; ++k) {
          double elem_k = static_cast<double>(
              AccessorClass::GetImpl(data_ptr + k, is_shared));
          if (std::isnan(elem_k)) return Just(true);
        }
        return Just(false);
      }
    } else if (!base::IsValueInRangeForNumericType<ElementType>(
                   search_value)) {
      // Return false if value can't be represented in this space.
      return Just(false);
    }
    typed_search_value = static_cast<ElementType>(search_value);
    if (static_cast<double>(typed_search_value) != search_value) {
      return Just(false);  // Loss of precision.
    }
  }

  for (size_t k = start_from; k < length; ++k) {
    ElementType elem_k = AccessorClass::GetImpl(data_ptr + k, is_shared);
    if (elem_k == typed_search_value) return Just(true);
  }
  return Just(false);
}

static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                       Handle<JSObject> receiver,
                                       Handle<Object> value,
                                       size_t start_from, size_t length) {
  DisallowGarbageCollection no_gc;
  JSTypedArray typed_array = JSTypedArray::cast(*receiver);

  // If this is called via Array.prototype.indexOf (not
  // TypedArray.prototype.indexOf), it's possible that the TypedArray is
  // detached / out of bounds here.
  if V8_UNLIKELY (typed_array.WasDetached())(__builtin_expect(!!(typed_array.WasDetached()), 0)) return Just<int64_t>(-1);
2
←
Assuming the condition is true→
3
←
Taking false branch→
  bool out_of_bounds = false;
  size_t typed_array_length =
      typed_array.GetLengthOrOutOfBounds(out_of_bounds);
  if V8_UNLIKELY (out_of_bounds)(__builtin_expect(!!(out_of_bounds), 0)) {
4
←
Taking false branch→
    return Just<int64_t>(-1);
  }

  // Prototype has no elements, and not searching for the hole --- limit
  // search to backing store length.
  if (typed_array_length < length) {
5
←
Assuming 'typed_array_length' is >= 'length'→
6
←
Taking false branch→
    length = typed_array_length;
  }

  ElementType typed_search_value;

  ElementType* data_ptr =
      reinterpret_cast<ElementType*>(typed_array.DataPtr());

  if (IsBigIntTypedArrayElementsKind(Kind)) {
7
←
Taking true branch→
    if (!value->IsBigInt()) return Just<int64_t>(-1);
8
←
Taking false branch→
    bool lossless;
9
←
'lossless' declared without an initial value→
    typed_search_value = FromHandle(value, &lossless);
10
←
Calling 'TypedElementsAccessor::FromHandle'→
17
←
Returning from 'TypedElementsAccessor::FromHandle'→
    if (!lossless) return Just<int64_t>(-1);
18
←
Branch condition evaluates to a garbage value
  } else {
    if (!value->IsNumber()) return Just<int64_t>(-1);
    double search_value = value->Number();
    if (!std::isfinite(search_value)) {
      // Integral types cannot represent +Inf or NaN.
      if (!IsFloatTypedArrayElementsKind(Kind)) {
        return Just<int64_t>(-1);
      }
      if (std::isnan(search_value)) {
        return Just<int64_t>(-1);
      }
    } else if (!base::IsValueInRangeForNumericType<ElementType>(
                   search_value)) {
      // Return false if value can't be represented in this ElementsKind.
      return Just<int64_t>(-1);
    }
    typed_search_value = static_cast<ElementType>(search_value);
    if (static_cast<double>(typed_search_value) != search_value) {
      return Just<int64_t>(-1);  // Loss of precision.
    }
  }

  auto is_shared = typed_array.buffer().is_shared() ? kShared : kUnshared;
  for (size_t k = start_from; k < length; ++k) {
    ElementType elem_k = AccessorClass::GetImpl(data_ptr + k, is_shared);
    if (elem_k == typed_search_value) return Just<int64_t>(k);
  }
  return Just<int64_t>(-1);
}

static Maybe<int64_t> LastIndexOfValueImpl(Handle<JSObject> receiver,
                                           Handle<Object> value,
                                           size_t start_from) {
  DisallowGarbageCollection no_gc;
  JSTypedArray typed_array = JSTypedArray::cast(*receiver);

  DCHECK(!typed_array.IsDetachedOrOutOfBounds())((void) 0);

  ElementType typed_search_value;

  ElementType* data_ptr =
      reinterpret_cast<ElementType*>(typed_array.DataPtr());
  if (IsBigIntTypedArrayElementsKind(Kind)) {
    if (!value->IsBigInt()) return Just<int64_t>(-1);
    bool lossless;
    typed_search_value = FromHandle(value, &lossless);
    if (!lossless) return Just<int64_t>(-1);
  } else {
    if (!value->IsNumber()) return Just<int64_t>(-1);
    double search_value = value->Number();
    if (!std::isfinite(search_value)) {
      if (std::is_integral<ElementType>::value) {
        // Integral types cannot represent +Inf or NaN.
        return Just<int64_t>(-1);
      } else if (std::isnan(search_value)) {
        // Strict Equality Comparison of NaN is always false.
        return Just<int64_t>(-1);
      }
    } else if (!base::IsValueInRangeForNumericType<ElementType>(
                   search_value)) {
      // Return -1 if value can't be represented in this ElementsKind.
      return Just<int64_t>(-1);
    }
    typed_search_value = static_cast<ElementType>(search_value);
    if (static_cast<double>(typed_search_value) != search_value) {
      return Just<int64_t>(-1);  // Loss of precision.
    }
  }

  size_t typed_array_length = typed_array.GetLength();
  if (start_from >= typed_array_length) {
    // This can happen if the TypedArray got resized when we did ToInteger
    // on the last parameter of lastIndexOf.
    DCHECK(typed_array.IsVariableLength())((void) 0);
    start_from = typed_array_length - 1;
  }

  size_t k = start_from;
  auto is_shared = typed_array.buffer().is_shared() ? kShared : kUnshared;
  do {
    ElementType elem_k = AccessorClass::GetImpl(data_ptr + k, is_shared);
    if (elem_k == typed_search_value) return Just<int64_t>(k);
  } while (k-- != 0);
  return Just<int64_t>(-1);
}

static void ReverseImpl(JSObject receiver) {
  DisallowGarbageCollection no_gc;
  JSTypedArray typed_array = JSTypedArray::cast(receiver);

  DCHECK(!typed_array.IsDetachedOrOutOfBounds())((void) 0);

  size_t len = typed_array.GetLength();
  if (len == 0) return;

  ElementType* data = static_cast<ElementType*>(typed_array.DataPtr());
  if (typed_array.buffer().is_shared()) {
    // TypedArrays backed by shared buffers need to be reversed using atomic
    // operations. Since 8-byte data are not currently always 8-byte aligned,
    // manually reverse using GetImpl and SetImpl, which abstract over
    // alignment and atomic complexities.
    for (ElementType *first = data, *last = data + len - 1; first < last;
         ++first, --last) {
      ElementType first_value = AccessorClass::GetImpl(first, kShared);
      ElementType last_value = AccessorClass::GetImpl(last, kShared);
      AccessorClass::SetImpl(first, last_value, kShared);
      AccessorClass::SetImpl(last, first_value, kShared);
    }
  } else if (COMPRESS_POINTERS_BOOLfalse && alignof(ElementType) > kTaggedSize) {
    // TODO(ishell, v8:8875): See UnalignedSlot<T> for details.
    std::reverse(UnalignedSlot<ElementType>(data),
                 UnalignedSlot<ElementType>(data + len));
  } else {
    std::reverse(data, data + len);
  }
}

static Handle<FixedArray> CreateListFromArrayLikeImpl(Isolate* isolate,
                                                      Handle<JSObject> object,
                                                      uint32_t length) {
  Handle<JSTypedArray> typed_array = Handle<JSTypedArray>::cast(object);
  Handle<FixedArray> result = isolate->factory()->NewFixedArray(length);
  for (uint32_t i = 0; i < length; i++) {
    Handle<Object> value =
        AccessorClass::GetInternalImpl(typed_array, InternalIndex(i));
    result->set(i, *value);
  }
  return result;
}

static void CopyTypedArrayElementsSliceImpl(JSTypedArray source,
                                            JSTypedArray destination,
                                            size_t start, size_t end) {
  DisallowGarbageCollection no_gc;
  DCHECK_EQ(destination.GetElementsKind(), AccessorClass::kind())((void) 0);
  CHECK(!source.IsDetachedOrOutOfBounds())do { if ((__builtin_expect(!!(!(!source.IsDetachedOrOutOfBounds
())), 0))) { V8_Fatal("Check failed: %s.", "!source.IsDetachedOrOutOfBounds()"
); } } while (false);
  CHECK(!destination.IsDetachedOrOutOfBounds())do { if ((__builtin_expect(!!(!(!destination.IsDetachedOrOutOfBounds
())), 0))) { V8_Fatal("Check failed: %s.", "!destination.IsDetachedOrOutOfBounds()"
); } } while (false);
  DCHECK_LE(start, end)((void) 0);
  DCHECK_LE(end, source.GetLength())((void) 0);
  size_t count = end - start;
  DCHECK_LE(count, destination.length())((void) 0);
  ElementType* dest_data = static_cast<ElementType*>(destination.DataPtr());
  auto is_shared =
      source.buffer().is_shared() || destination.buffer().is_shared()
          ? kShared
          : kUnshared;
  switch (source.GetElementsKind()) {
3584#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype)                            \
case TYPE##_ELEMENTS: {                                                    \
  ctype* source_data = reinterpret_cast<ctype*>(source.DataPtr()) + start; \
  CopyBetweenBackingStores<TYPE##_ELEMENTS, ctype>(source_data, dest_data, \
                                                   count, is_shared);      \
  break;                                                                   \
}
    TYPED_ARRAYS(TYPED_ARRAY_CASE)TYPED_ARRAY_CASE(Uint8, uint8, UINT8, uint8_t) TYPED_ARRAY_CASE
(Int8, int8, INT8, int8_t) TYPED_ARRAY_CASE(Uint16, uint16, UINT16
, uint16_t) TYPED_ARRAY_CASE(Int16, int16, INT16, int16_t) TYPED_ARRAY_CASE
(Uint32, uint32, UINT32, uint32_t) TYPED_ARRAY_CASE(Int32, int32
, INT32, int32_t) TYPED_ARRAY_CASE(Float32, float32, FLOAT32,
 float) TYPED_ARRAY_CASE(Float64, float64, FLOAT64, double) TYPED_ARRAY_CASE
(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t) TYPED_ARRAY_CASE
(BigUint64, biguint64, BIGUINT64, uint64_t) TYPED_ARRAY_CASE(
BigInt64, bigint64, BIGINT64, int64_t)
3592#undef TYPED_ARRAY_CASE

3594#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, NON_RAB_GSAB_TYPE)         \
case TYPE##_ELEMENTS: {                                                    \
  ctype* source_data = reinterpret_cast<ctype*>(source.DataPtr()) + start; \
  CopyBetweenBackingStores<NON_RAB_GSAB_TYPE##_ELEMENTS, ctype>(           \
      source_data, dest_data, count, is_shared);                           \
  break;                                                                   \
}
    RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND(TYPED_ARRAY_CASE)TYPED_ARRAY_CASE(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8
, uint8_t, UINT8) TYPED_ARRAY_CASE(RabGsabInt8, rab_gsab_int8
, RAB_GSAB_INT8, int8_t, INT8) TYPED_ARRAY_CASE(RabGsabUint16
, rab_gsab_uint16, RAB_GSAB_UINT16, uint16_t, UINT16) TYPED_ARRAY_CASE
(RabGsabInt16, rab_gsab_int16, RAB_GSAB_INT16, int16_t, INT16
) TYPED_ARRAY_CASE(RabGsabUint32, rab_gsab_uint32, RAB_GSAB_UINT32
, uint32_t, UINT32) TYPED_ARRAY_CASE(RabGsabInt32, rab_gsab_int32
, RAB_GSAB_INT32, int32_t, INT32) TYPED_ARRAY_CASE(RabGsabFloat32
, rab_gsab_float32, RAB_GSAB_FLOAT32, float, FLOAT32) TYPED_ARRAY_CASE
(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64
) TYPED_ARRAY_CASE(RabGsabUint8Clamped, rab_gsab_uint8_clamped
, RAB_GSAB_UINT8_CLAMPED, uint8_t, UINT8_CLAMPED) TYPED_ARRAY_CASE
(RabGsabBigUint64, rab_gsab_biguint64, RAB_GSAB_BIGUINT64, uint64_t
, BIGUINT64) TYPED_ARRAY_CASE(RabGsabBigInt64, rab_gsab_bigint64
, RAB_GSAB_BIGINT64, int64_t, BIGINT64)
3602#undef TYPED_ARRAY_CASE
    default:
      UNREACHABLE()V8_Fatal("unreachable code");
      break;
  }
}

// TODO(v8:11111): Update this once we have external RAB / GSAB array types.
static bool HasSimpleRepresentation(ExternalArrayType type) {
  return !(type == kExternalFloat32Array || type == kExternalFloat64Array ||
           type == kExternalUint8ClampedArray);
}

template <ElementsKind SourceKind, typename SourceElementType>
static void CopyBetweenBackingStores(SourceElementType* source_data_ptr,
                                     ElementType* dest_data_ptr,
                                     size_t length,
                                     IsSharedBuffer is_shared) {
  for (; length > 0; --length, ++source_data_ptr, ++dest_data_ptr) {
    // We use scalar accessors to avoid boxing/unboxing, so there are no
    // allocations.
    SourceElementType source_elem =
        TypedElementsAccessor<SourceKind, SourceElementType>::GetImpl(
            source_data_ptr, is_shared);
    ElementType dest_elem = FromScalar(source_elem);
    SetImpl(dest_data_ptr, dest_elem, is_shared);
  }
}

static void CopyElementsFromTypedArray(JSTypedArray source,
                                       JSTypedArray destination,
                                       size_t length, size_t offset) {
  // The source is a typed array, so we know we don't need to do ToNumber
  // side-effects, as the source elements will always be a number.
  DisallowGarbageCollection no_gc;

  CHECK(!source.IsDetachedOrOutOfBounds())do { if ((__builtin_expect(!!(!(!source.IsDetachedOrOutOfBounds
())), 0))) { V8_Fatal("Check failed: %s.", "!source.IsDetachedOrOutOfBounds()"
); } } while (false);
  CHECK(!destination.IsDetachedOrOutOfBounds())do { if ((__builtin_expect(!!(!(!destination.IsDetachedOrOutOfBounds
())), 0))) { V8_Fatal("Check failed: %s.", "!destination.IsDetachedOrOutOfBounds()"
); } } while (false);

  DCHECK_LE(offset, destination.GetLength())((void) 0);
  DCHECK_LE(length, destination.GetLength() - offset)((void) 0);
  DCHECK_LE(length, source.GetLength())((void) 0);

  ExternalArrayType source_type = source.type();
  ExternalArrayType destination_type = destination.type();

  bool same_type = source_type == destination_type;
  bool same_size = source.element_size() == destination.element_size();
  bool both_are_simple = HasSimpleRepresentation(source_type) &&
                         HasSimpleRepresentation(destination_type);

  uint8_t* source_data = static_cast<uint8_t*>(source.DataPtr());
  uint8_t* dest_data = static_cast<uint8_t*>(destination.DataPtr());
  size_t source_byte_length = source.byte_length();
  size_t dest_byte_length = destination.byte_length();

  bool source_shared = source.buffer().is_shared();
  bool destination_shared = destination.buffer().is_shared();

  // We can simply copy the backing store if the types are the same, or if
  // we are converting e.g. Uint8 <-> Int8, as the binary representation
  // will be the same. This is not the case for floats or clamped Uint8,
  // which have special conversion operations.
  if (same_type || (same_size && both_are_simple)) {
    size_t element_size = source.element_size();
    if (source_shared || destination_shared) {
      base::Relaxed_Memcpy(
          reinterpret_cast<base::Atomic8*>(dest_data + offset * element_size),
          reinterpret_cast<base::Atomic8*>(source_data),
          length * element_size);
    } else {
      std::memmove(dest_data + offset * element_size, source_data,
                   length * element_size);
    }
  } else {
    std::unique_ptr<uint8_t[]> cloned_source_elements;

    // If the typedarrays are overlapped, clone the source.
    if (dest_data + dest_byte_length > source_data &&
        source_data + source_byte_length > dest_data) {
      cloned_source_elements.reset(new uint8_t[source_byte_length]);
      if (source_shared) {
        base::Relaxed_Memcpy(
            reinterpret_cast<base::Atomic8*>(cloned_source_elements.get()),
            reinterpret_cast<base::Atomic8*>(source_data),
            source_byte_length);
      } else {
        std::memcpy(cloned_source_elements.get(), source_data,
                    source_byte_length);
      }
      source_data = cloned_source_elements.get();
    }

    switch (source.GetElementsKind()) {
3696#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype)                   \
case TYPE##_ELEMENTS:                                             \
  CopyBetweenBackingStores<TYPE##_ELEMENTS, ctype>(               \
      reinterpret_cast<ctype*>(source_data),                      \
      reinterpret_cast<ElementType*>(dest_data) + offset, length, \
      source_shared || destination_shared ? kShared : kUnshared); \
  break;
      TYPED_ARRAYS(TYPED_ARRAY_CASE)TYPED_ARRAY_CASE(Uint8, uint8, UINT8, uint8_t) TYPED_ARRAY_CASE
(Int8, int8, INT8, int8_t) TYPED_ARRAY_CASE(Uint16, uint16, UINT16
, uint16_t) TYPED_ARRAY_CASE(Int16, int16, INT16, int16_t) TYPED_ARRAY_CASE
(Uint32, uint32, UINT32, uint32_t) TYPED_ARRAY_CASE(Int32, int32
, INT32, int32_t) TYPED_ARRAY_CASE(Float32, float32, FLOAT32,
 float) TYPED_ARRAY_CASE(Float64, float64, FLOAT64, double) TYPED_ARRAY_CASE
(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t) TYPED_ARRAY_CASE
(BigUint64, biguint64, BIGUINT64, uint64_t) TYPED_ARRAY_CASE(
BigInt64, bigint64, BIGINT64, int64_t)
      RAB_GSAB_TYPED_ARRAYS(TYPED_ARRAY_CASE)TYPED_ARRAY_CASE(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8
, uint8_t) TYPED_ARRAY_CASE(RabGsabInt8, rab_gsab_int8, RAB_GSAB_INT8
, int8_t) TYPED_ARRAY_CASE(RabGsabUint16, rab_gsab_uint16, RAB_GSAB_UINT16
, uint16_t) TYPED_ARRAY_CASE(RabGsabInt16, rab_gsab_int16, RAB_GSAB_INT16
, int16_t) TYPED_ARRAY_CASE(RabGsabUint32, rab_gsab_uint32, RAB_GSAB_UINT32
, uint32_t) TYPED_ARRAY_CASE(RabGsabInt32, rab_gsab_int32, RAB_GSAB_INT32
, int32_t) TYPED_ARRAY_CASE(RabGsabFloat32, rab_gsab_float32,
 RAB_GSAB_FLOAT32, float) TYPED_ARRAY_CASE(RabGsabFloat64, rab_gsab_float64
, RAB_GSAB_FLOAT64, double) TYPED_ARRAY_CASE(RabGsabUint8Clamped
, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) TYPED_ARRAY_CASE
(RabGsabBigUint64, rab_gsab_biguint64, RAB_GSAB_BIGUINT64, uint64_t
) TYPED_ARRAY_CASE(RabGsabBigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64
, int64_t)
      default:
        UNREACHABLE()V8_Fatal("unreachable code");
        break;
    }
3709#undef TYPED_ARRAY_CASE
  }
}

static bool HoleyPrototypeLookupRequired(Isolate* isolate, Context context,
                                         JSArray source) {
  DisallowGarbageCollection no_gc;
  DisallowJavascriptExecution no_js(isolate);

3718#ifdef V8_ENABLE_FORCE_SLOW_PATH
  if (isolate->force_slow_path()) return true;
3720#endif

  Object source_proto = source.map().prototype();

  // Null prototypes are OK - we don't need to do prototype chain lookups on
  // them.
  if (source_proto.IsNull(isolate)) return false;
  if (source_proto.IsJSProxy()) return true;
  if (!context.native_context().is_initial_array_prototype(
          JSObject::cast(source_proto))) {
    return true;
  }

  return !Protectors::IsNoElementsIntact(isolate);
}

static bool TryCopyElementsFastNumber(Context context, JSArray source,
                                      JSTypedArray destination, size_t length,
                                      size_t offset) {
  if (IsBigIntTypedArrayElementsKind(Kind)) return false;
  Isolate* isolate = source.GetIsolate();
  DisallowGarbageCollection no_gc;
  DisallowJavascriptExecution no_js(isolate);

  CHECK(!destination.WasDetached())do { if ((__builtin_expect(!!(!(!destination.WasDetached())),
 0))) { V8_Fatal("Check failed: %s.", "!destination.WasDetached()"
); } } while (false);
  bool out_of_bounds = false;
  CHECK_GE(destination.GetLengthOrOutOfBounds(out_of_bounds), length)do { bool _cmp = ::v8::base::CmpGEImpl< typename ::v8::base
::pass_value_or_ref<decltype(destination.GetLengthOrOutOfBounds
(out_of_bounds))>::type, typename ::v8::base::pass_value_or_ref
<decltype(length)>::type>((destination.GetLengthOrOutOfBounds
(out_of_bounds)), (length)); do { if ((__builtin_expect(!!(!(
_cmp)), 0))) { V8_Fatal("Check failed: %s.", "destination.GetLengthOrOutOfBounds(out_of_bounds)"
 " " ">=" " " "length"); } } while (false); } while (false
);
  CHECK(!out_of_bounds)do { if ((__builtin_expect(!!(!(!out_of_bounds)), 0))) { V8_Fatal
("Check failed: %s.", "!out_of_bounds"); } } while (false);

  size_t current_length;
  DCHECK(source.length().IsNumber() &&((void) 0)
         TryNumberToSize(source.length(), &current_length) &&((void) 0)
         length <= current_length)((void) 0);
  USE(current_length)do { ::v8::base::Use unused_tmp_array_for_use_macro[]{current_length
}; (void)unused_tmp_array_for_use_macro; } while (false);

  size_t dest_length = destination.GetLength();
  DCHECK(length + offset <= dest_length)((void) 0);
  USE(dest_length)do { ::v8::base::Use unused_tmp_array_for_use_macro[]{dest_length
}; (void)unused_tmp_array_for_use_macro; } while (false);

  ElementsKind kind = source.GetElementsKind();

  auto destination_shared =
      destination.buffer().is_shared() ? kShared : kUnshared;

  // When we find the hole, we normally have to look up the element on the
  // prototype chain, which is not handled here and we return false instead.
  // When the array has the original array prototype, and that prototype has
  // not been changed in a way that would affect lookups, we can just convert
  // the hole into undefined.
  if (HoleyPrototypeLookupRequired(isolate, context, source)) return false;

  Oddball undefined = ReadOnlyRoots(isolate).undefined_value();
  ElementType* dest_data =
      reinterpret_cast<ElementType*>(destination.DataPtr()) + offset;

  // Fast-path for packed Smi kind.
  if (kind == PACKED_SMI_ELEMENTS) {
    FixedArray source_store = FixedArray::cast(source.elements());

    for (size_t i = 0; i < length; i++) {
      Object elem = source_store.get(static_cast<int>(i));
      SetImpl(dest_data + i, FromScalar(Smi::ToInt(elem)),
              destination_shared);
    }
    return true;
  } else if (kind == HOLEY_SMI_ELEMENTS) {
    FixedArray source_store = FixedArray::cast(source.elements());
    for (size_t i = 0; i < length; i++) {
      if (source_store.is_the_hole(isolate, static_cast<int>(i))) {
        SetImpl(dest_data + i, FromObject(undefined), destination_shared);
      } else {
        Object elem = source_store.get(static_cast<int>(i));
        SetImpl(dest_data + i, FromScalar(Smi::ToInt(elem)),
                destination_shared);
      }
    }
    return true;
  } else if (kind == PACKED_DOUBLE_ELEMENTS) {
    // Fast-path for packed double kind. We avoid boxing and then immediately
    // unboxing the double here by using get_scalar.
    FixedDoubleArray source_store = FixedDoubleArray::cast(source.elements());

    for (size_t i = 0; i < length; i++) {
      // Use the from_double conversion for this specific TypedArray type,
      // rather than relying on C++ to convert elem.
      double elem = source_store.get_scalar(static_cast<int>(i));
      SetImpl(dest_data + i, FromScalar(elem), destination_shared);
    }
    return true;
  } else if (kind == HOLEY_DOUBLE_ELEMENTS) {
    FixedDoubleArray source_store = FixedDoubleArray::cast(source.elements());
    for (size_t i = 0; i < length; i++) {
      if (source_store.is_the_hole(static_cast<int>(i))) {
        SetImpl(dest_data + i, FromObject(undefined), destination_shared);
      } else {
        double elem = source_store.get_scalar(static_cast<int>(i));
        SetImpl(dest_data + i, FromScalar(elem), destination_shared);
      }
    }
    return true;
  }
  return false;
}

// ES#sec-settypedarrayfromarraylike
static Object CopyElementsHandleSlow(Handle<Object> source,
                                     Handle<JSTypedArray> destination,
                                     size_t length, size_t offset) {
  Isolate* isolate = destination->GetIsolate();
  // 8. Let k be 0.
  // 9. Repeat, while k < srcLength,
  for (size_t i = 0; i < length; i++) {
    Handle<Object> elem;
    // a. Let Pk be ! ToString(𝔽(k)).
    // b. Let value be ? Get(src, Pk).
    LookupIterator it(isolate, source, i);
    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,do { auto* __isolate__ = (isolate); do { if (!(Object::GetProperty
(&it)).ToHandle(&elem)) { ((void) 0); return ReadOnlyRoots
(__isolate__).exception(); } } while (false); } while (false)
                                       Object::GetProperty(&it))do { auto* __isolate__ = (isolate); do { if (!(Object::GetProperty
(&it)).ToHandle(&elem)) { ((void) 0); return ReadOnlyRoots
(__isolate__).exception(); } } while (false); } while (false);
    // c. Let targetIndex be 𝔽(targetOffset + k).
    // d. Perform ? IntegerIndexedElementSet(target, targetIndex, value).
    //
    // Rest of loop body inlines ES#IntegerIndexedElementSet
    if (IsBigIntTypedArrayElementsKind(Kind)) {
      // 1. If O.[[ContentType]] is BigInt, let numValue be ? ToBigInt(value).
      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,do { auto* __isolate__ = (isolate); do { if (!(BigInt::FromObject
(isolate, elem)).ToHandle(&elem)) { ((void) 0); return ReadOnlyRoots
(__isolate__).exception(); } } while (false); } while (false)
                                         BigInt::FromObject(isolate, elem))do { auto* __isolate__ = (isolate); do { if (!(BigInt::FromObject
(isolate, elem)).ToHandle(&elem)) { ((void) 0); return ReadOnlyRoots
(__isolate__).exception(); } } while (false); } while (false);
    } else {
      // 2. Otherwise, let numValue be ? ToNumber(value).
      ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, elem,do { auto* __isolate__ = (isolate); do { if (!(Object::ToNumber
(isolate, elem)).ToHandle(&elem)) { ((void) 0); return ReadOnlyRoots
(__isolate__).exception(); } } while (false); } while (false)
                                         Object::ToNumber(isolate, elem))do { auto* __isolate__ = (isolate); do { if (!(Object::ToNumber
(isolate, elem)).ToHandle(&elem)) { ((void) 0); return ReadOnlyRoots
(__isolate__).exception(); } } while (false); } while (false);
    }
    // 3. If IsValidIntegerIndex(O, index) is true, then
    //   a. Let offset be O.[[ByteOffset]].
    //   b. Let elementSize be TypedArrayElementSize(O).
    //   c. Let indexedPosition be (ℝ(index) × elementSize) + offset.
    //   d. Let elementType be TypedArrayElementType(O).
    //   e. Perform SetValueInBuffer(O.[[ViewedArrayBuffer]],
    //      indexedPosition, elementType, numValue, true, Unordered).
    bool out_of_bounds = false;
    size_t new_length = destination->GetLengthOrOutOfBounds(out_of_bounds);
    if (V8_UNLIKELY(out_of_bounds || destination->WasDetached() ||(__builtin_expect(!!(out_of_bounds || destination->WasDetached
() || new_length <= offset + i), 0))
                    new_length <= offset + i)(__builtin_expect(!!(out_of_bounds || destination->WasDetached
() || new_length <= offset + i), 0))) {
      // Proceed with the loop so that we call get getters for the source even
      // though we don't set the values in the target.
      continue;
    }
    SetImpl(destination, InternalIndex(offset + i), *elem);
    // e. Set k to k + 1.
  }
  // 10. Return unused.
  return *isolate->factory()->undefined_value();
}

// This doesn't guarantee that the destination array will be completely
// filled. The caller must do this by passing a source with equal length, if
// that is required.
static Object CopyElementsHandleImpl(Handle<Object> source,
                                     Handle<JSObject> destination,
                                     size_t length, size_t offset) {
  Isolate* isolate = destination->GetIsolate();
  if (length == 0) return *isolate->factory()->undefined_value();

  Handle<JSTypedArray> destination_ta =
      Handle<JSTypedArray>::cast(destination);

  // All conversions from TypedArrays can be done without allocation.
  if (source->IsJSTypedArray()) {
    CHECK(!destination_ta->WasDetached())do { if ((__builtin_expect(!!(!(!destination_ta->WasDetached
())), 0))) { V8_Fatal("Check failed: %s.", "!destination_ta->WasDetached()"
); } } while (false);
    bool out_of_bounds = false;
    CHECK_LE(offset + length,do { bool _cmp = ::v8::base::CmpLEImpl< typename ::v8::base
::pass_value_or_ref<decltype(offset + length)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(destination_ta->
GetLengthOrOutOfBounds(out_of_bounds))>::type>((offset +
 length), (destination_ta->GetLengthOrOutOfBounds(out_of_bounds
))); do { if ((__builtin_expect(!!(!(_cmp)), 0))) { V8_Fatal(
"Check failed: %s.", "offset + length" " " "<=" " " "destination_ta->GetLengthOrOutOfBounds(out_of_bounds)"
); } } while (false); } while (false)
             destination_ta->GetLengthOrOutOfBounds(out_of_bounds))do { bool _cmp = ::v8::base::CmpLEImpl< typename ::v8::base
::pass_value_or_ref<decltype(offset + length)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(destination_ta->
GetLengthOrOutOfBounds(out_of_bounds))>::type>((offset +
 length), (destination_ta->GetLengthOrOutOfBounds(out_of_bounds
))); do { if ((__builtin_expect(!!(!(_cmp)), 0))) { V8_Fatal(
"Check failed: %s.", "offset + length" " " "<=" " " "destination_ta->GetLengthOrOutOfBounds(out_of_bounds)"
); } } while (false); } while (false);
    CHECK(!out_of_bounds)do { if ((__builtin_expect(!!(!(!out_of_bounds)), 0))) { V8_Fatal
("Check failed: %s.", "!out_of_bounds"); } } while (false);
    Handle<JSTypedArray> source_ta = Handle<JSTypedArray>::cast(source);
    ElementsKind source_kind = source_ta->GetElementsKind();
    bool source_is_bigint =
        source_kind == BIGINT64_ELEMENTS || source_kind == BIGUINT64_ELEMENTS;
    bool target_is_bigint =
        Kind == BIGINT64_ELEMENTS || Kind == BIGUINT64_ELEMENTS;
    // If we have to copy more elements than we have in the source, we need to
    // do special handling and conversion; that happens in the slow case.
    if (source_is_bigint == target_is_bigint && !source_ta->WasDetached() &&
        length + offset <= source_ta->GetLength()) {
      CopyElementsFromTypedArray(*source_ta, *destination_ta, length, offset);
      return *isolate->factory()->undefined_value();
    }
  } else if (source->IsJSArray()) {
    CHECK(!destination_ta->WasDetached())do { if ((__builtin_expect(!!(!(!destination_ta->WasDetached
())), 0))) { V8_Fatal("Check failed: %s.", "!destination_ta->WasDetached()"
); } } while (false);
    bool out_of_bounds = false;
    CHECK_LE(offset + length,do { bool _cmp = ::v8::base::CmpLEImpl< typename ::v8::base
::pass_value_or_ref<decltype(offset + length)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(destination_ta->
GetLengthOrOutOfBounds(out_of_bounds))>::type>((offset +
 length), (destination_ta->GetLengthOrOutOfBounds(out_of_bounds
))); do { if ((__builtin_expect(!!(!(_cmp)), 0))) { V8_Fatal(
"Check failed: %s.", "offset + length" " " "<=" " " "destination_ta->GetLengthOrOutOfBounds(out_of_bounds)"
); } } while (false); } while (false)
             destination_ta->GetLengthOrOutOfBounds(out_of_bounds))do { bool _cmp = ::v8::base::CmpLEImpl< typename ::v8::base
::pass_value_or_ref<decltype(offset + length)>::type, typename
 ::v8::base::pass_value_or_ref<decltype(destination_ta->
GetLengthOrOutOfBounds(out_of_bounds))>::type>((offset +
 length), (destination_ta->GetLengthOrOutOfBounds(out_of_bounds
))); do { if ((__builtin_expect(!!(!(_cmp)), 0))) { V8_Fatal(
"Check failed: %s.", "offset + length" " " "<=" " " "destination_ta->GetLengthOrOutOfBounds(out_of_bounds)"
); } } while (false); } while (false);
    CHECK(!out_of_bounds)do { if ((__builtin_expect(!!(!(!out_of_bounds)), 0))) { V8_Fatal
("Check failed: %s.", "!out_of_bounds"); } } while (false);
    // Fast cases for packed numbers kinds where we don't need to allocate.
    Handle<JSArray> source_js_array = Handle<JSArray>::cast(source);
    size_t current_length;
    DCHECK(source_js_array->length().IsNumber())((void) 0);
    if (TryNumberToSize(source_js_array->length(), &current_length) &&
        length <= current_length) {
      Handle<JSArray> source_array = Handle<JSArray>::cast(source);
      if (TryCopyElementsFastNumber(isolate->context(), *source_array,
                                    *destination_ta, length, offset)) {
        return *isolate->factory()->undefined_value();
      }
    }
  }
  // Final generic case that handles prototype chain lookups, getters, proxies
  // and observable side effects via valueOf, etc. In this case, it's possible
  // that the length getter detached / resized the underlying buffer.
  return CopyElementsHandleSlow(source, destination_ta, length, offset);
}
3929};

3931// static
3932template <>
3933Handle<Object> TypedElementsAccessor<INT8_ELEMENTS, int8_t>::ToHandle(
  Isolate* isolate, int8_t value) {
return handle(Smi::FromInt(value), isolate);
3936}

3938// static
3939template <>
3940Handle<Object> TypedElementsAccessor<UINT8_ELEMENTS, uint8_t>::ToHandle(
  Isolate* isolate, uint8_t value) {
return handle(Smi::FromInt(value), isolate);
3943}

3945// static
3946template <>
3947Handle<Object> TypedElementsAccessor<INT16_ELEMENTS, int16_t>::ToHandle(
  Isolate* isolate, int16_t value) {
return handle(Smi::FromInt(value), isolate);
3950}

3952// static
3953template <>
3954Handle<Object> TypedElementsAccessor<UINT16_ELEMENTS, uint16_t>::ToHandle(
  Isolate* isolate, uint16_t value) {
return handle(Smi::FromInt(value), isolate);
3957}

3959// static
3960template <>
3961Handle<Object> TypedElementsAccessor<INT32_ELEMENTS, int32_t>::ToHandle(
  Isolate* isolate, int32_t value) {
return isolate->factory()->NewNumberFromInt(value);
3964}

3966// static
3967template <>
3968Handle<Object> TypedElementsAccessor<UINT32_ELEMENTS, uint32_t>::ToHandle(
  Isolate* isolate, uint32_t value) {
return isolate->factory()->NewNumberFromUint(value);
3971}

3973// static
3974template <>
3975float TypedElementsAccessor<FLOAT32_ELEMENTS, float>::FromScalar(double value) {
return DoubleToFloat32(value);
3977}

3979// static
3980template <>
3981Handle<Object> TypedElementsAccessor<FLOAT32_ELEMENTS, float>::ToHandle(
  Isolate* isolate, float value) {
return isolate->factory()->NewNumber(value);
3984}

3986// static
3987template <>
3988double TypedElementsAccessor<FLOAT64_ELEMENTS, double>::FromScalar(
  double value) {
return value;
3991}

3993// static
3994template <>
3995Handle<Object> TypedElementsAccessor<FLOAT64_ELEMENTS, double>::ToHandle(
  Isolate* isolate, double value) {
return isolate->factory()->NewNumber(value);
3998}

4000// static
4001template <>
4002uint8_t TypedElementsAccessor<UINT8_CLAMPED_ELEMENTS, uint8_t>::FromScalar(
  int value) {
if (value < 0x00) return 0x00;
if (value > 0xFF) return 0xFF;
return static_cast<uint8_t>(value);
4007}

4009// static
4010template <>
4011uint8_t TypedElementsAccessor<UINT8_CLAMPED_ELEMENTS, uint8_t>::FromScalar(
  uint32_t value) {
// We need this special case for Uint32 -> Uint8Clamped, because the highest
// Uint32 values will be negative as an int, clamping to 0, rather than 255.
if (value > 0xFF) return 0xFF;
return static_cast<uint8_t>(value);
4017}

4019// static
4020template <>
4021uint8_t TypedElementsAccessor<UINT8_CLAMPED_ELEMENTS, uint8_t>::FromScalar(
  double value) {
// Handle NaNs and less than zero values which clamp to zero.
if (!(value > 0)) return 0;
if (value > 0xFF) return 0xFF;
return static_cast<uint8_t>(lrint(value));
4027}

4029// static
4030template <>
4031Handle<Object> TypedElementsAccessor<UINT8_CLAMPED_ELEMENTS, uint8_t>::ToHandle(
  Isolate* isolate, uint8_t value) {
return handle(Smi::FromInt(value), isolate);
4034}

4036// static
4037template <>
4038int64_t TypedElementsAccessor<BIGINT64_ELEMENTS, int64_t>::FromScalar(
  int value) {
UNREACHABLE()V8_Fatal("unreachable code");
4041}

4043// static
4044template <>
4045int64_t TypedElementsAccessor<BIGINT64_ELEMENTS, int64_t>::FromScalar(
  uint32_t value) {
UNREACHABLE()V8_Fatal("unreachable code");
4048}

4050// static
4051template <>
4052int64_t TypedElementsAccessor<BIGINT64_ELEMENTS, int64_t>::FromScalar(
  double value) {
UNREACHABLE()V8_Fatal("unreachable code");
4055}

4057// static
4058template <>
4059int64_t TypedElementsAccessor<BIGINT64_ELEMENTS, int64_t>::FromScalar(
  int64_t value) {
return value;
4062}

4064// static
4065template <>
4066int64_t TypedElementsAccessor<BIGINT64_ELEMENTS, int64_t>::FromScalar(
  uint64_t value) {
return static_cast<int64_t>(value);
4069}

4071// static
4072template <>
4073int64_t TypedElementsAccessor<BIGINT64_ELEMENTS, int64_t>::FromObject(
  Object value, bool* lossless) {
return BigInt::cast(value).AsInt64(lossless);
4076}

4078// static
4079template <>
4080Handle<Object> TypedElementsAccessor<BIGINT64_ELEMENTS, int64_t>::ToHandle(
  Isolate* isolate, int64_t value) {
return BigInt::FromInt64(isolate, value);
4083}

4085// static
4086template <>
4087uint64_t TypedElementsAccessor<BIGUINT64_ELEMENTS, uint64_t>::FromScalar(
  int value) {
UNREACHABLE()V8_Fatal("unreachable code");
4090}

4092// static
4093template <>
4094uint64_t TypedElementsAccessor<BIGUINT64_ELEMENTS, uint64_t>::FromScalar(
  uint32_t value) {
UNREACHABLE()V8_Fatal("unreachable code");
4097}

4099// static
4100template <>
4101uint64_t TypedElementsAccessor<BIGUINT64_ELEMENTS, uint64_t>::FromScalar(
  double value) {
UNREACHABLE()V8_Fatal("unreachable code");
4104}

4106// static
4107template <>
4108uint64_t TypedElementsAccessor<BIGUINT64_ELEMENTS, uint64_t>::FromScalar(
  int64_t value) {
return static_cast<uint64_t>(value);
4111}

4113// static
4114template <>
4115uint64_t TypedElementsAccessor<BIGUINT64_ELEMENTS, uint64_t>::FromScalar(
  uint64_t value) {
return value;
4118}

4120// static
4121template <>
4122uint64_t TypedElementsAccessor<BIGUINT64_ELEMENTS, uint64_t>::FromObject(
  Object value, bool* lossless) {
return BigInt::cast(value).AsUint64(lossless);
4125}

4127// static
4128template <>
4129Handle<Object> TypedElementsAccessor<BIGUINT64_ELEMENTS, uint64_t>::ToHandle(
  Isolate* isolate, uint64_t value) {
return BigInt::FromUint64(isolate, value);
4132}

4134// static
4135template <>
4136Handle<Object> TypedElementsAccessor<RAB_GSAB_INT8_ELEMENTS, int8_t>::ToHandle(
  Isolate* isolate, int8_t value) {
return handle(Smi::FromInt(value), isolate);
4139}

4141// static
4142template <>
4143Handle<Object> TypedElementsAccessor<RAB_GSAB_UINT8_ELEMENTS,
                                   uint8_t>::ToHandle(Isolate* isolate,
                                                      uint8_t value) {
return handle(Smi::FromInt(value), isolate);
4147}

4149// static
4150template <>
4151Handle<Object> TypedElementsAccessor<RAB_GSAB_INT16_ELEMENTS,
                                   int16_t>::ToHandle(Isolate* isolate,
                                                      int16_t value) {
return handle(Smi::FromInt(value), isolate);
4155}

4157// static
4158template <>
4159Handle<Object> TypedElementsAccessor<RAB_GSAB_UINT16_ELEMENTS,
                                   uint16_t>::ToHandle(Isolate* isolate,
                                                       uint16_t value) {
return handle(Smi::FromInt(value), isolate);
4163}

4165// static
4166template <>
4167Handle<Object> TypedElementsAccessor<RAB_GSAB_INT32_ELEMENTS,
                                   int32_t>::ToHandle(Isolate* isolate,
                                                      int32_t value) {
return isolate->factory()->NewNumberFromInt(value);
4171}

4173// static
4174template <>
4175Handle<Object> TypedElementsAccessor<RAB_GSAB_UINT32_ELEMENTS,
                                   uint32_t>::ToHandle(Isolate* isolate,
                                                       uint32_t value) {
return isolate->factory()->NewNumberFromUint(value);
4179}

4181// static
4182template <>
4183float TypedElementsAccessor<RAB_GSAB_FLOAT32_ELEMENTS, float>::FromScalar(
  double value) {
return DoubleToFloat32(value);
4186}

4188// static
4189template <>
4190Handle<Object> TypedElementsAccessor<RAB_GSAB_FLOAT32_ELEMENTS,
                                   float>::ToHandle(Isolate* isolate,
                                                    float value) {
return isolate->factory()->NewNumber(value);
4194}

4196// static
4197template <>
4198double TypedElementsAccessor<RAB_GSAB_FLOAT64_ELEMENTS, double>::FromScalar(
  double value) {
return value;
4201}

4203// static
4204template <>
4205Handle<Object> TypedElementsAccessor<RAB_GSAB_FLOAT64_ELEMENTS,
                                   double>::ToHandle(Isolate* isolate,
                                                     double value) {
return isolate->factory()->NewNumber(value);
4209}

4211// static
4212template <>
4213uint8_t TypedElementsAccessor<RAB_GSAB_UINT8_CLAMPED_ELEMENTS,
                            uint8_t>::FromScalar(int value) {
if (value < 0x00) return 0x00;
if (value > 0xFF) return 0xFF;
return static_cast<uint8_t>(value);
4218}

4220// static
4221template <>
4222uint8_t TypedElementsAccessor<RAB_GSAB_UINT8_CLAMPED_ELEMENTS,
                            uint8_t>::FromScalar(uint32_t value) {
// We need this special case for Uint32 -> Uint8Clamped, because the highest
// Uint32 values will be negative as an int, clamping to 0, rather than 255.
if (value > 0xFF) return 0xFF;
return static_cast<uint8_t>(value);
4228}

4230// static
4231template <>
4232uint8_t TypedElementsAccessor<RAB_GSAB_UINT8_CLAMPED_ELEMENTS,
                            uint8_t>::FromScalar(double value) {
// Handle NaNs and less than zero values which clamp to zero.
if (!(value > 0)) return 0;
if (value > 0xFF) return 0xFF;
return static_cast<uint8_t>(lrint(value));
4238}

4240// static
4241template <>
4242Handle<Object> TypedElementsAccessor<RAB_GSAB_UINT8_CLAMPED_ELEMENTS,
                                   uint8_t>::ToHandle(Isolate* isolate,
                                                      uint8_t value) {
return handle(Smi::FromInt(value), isolate);
4246}

4248// static
4249template <>
4250int64_t TypedElementsAccessor<RAB_GSAB_BIGINT64_ELEMENTS, int64_t>::FromScalar(
  int value) {
UNREACHABLE()V8_Fatal("unreachable code");
4253}

4255// static
4256template <>
4257int64_t TypedElementsAccessor<RAB_GSAB_BIGINT64_ELEMENTS, int64_t>::FromScalar(
  uint32_t value) {
UNREACHABLE()V8_Fatal("unreachable code");
4260}

4262// static
4263template <>
4264int64_t TypedElementsAccessor<RAB_GSAB_BIGINT64_ELEMENTS, int64_t>::FromScalar(
  double value) {
UNREACHABLE()V8_Fatal("unreachable code");
4267}

4269// static
4270template <>
4271int64_t TypedElementsAccessor<RAB_GSAB_BIGINT64_ELEMENTS, int64_t>::FromScalar(
  int64_t value) {
return value;
4274}

4276// static
4277template <>
4278int64_t TypedElementsAccessor<RAB_GSAB_BIGINT64_ELEMENTS, int64_t>::FromScalar(
  uint64_t value) {
return static_cast<int64_t>(value);
4281}

4283// static
4284template <>
4285int64_t TypedElementsAccessor<RAB_GSAB_BIGINT64_ELEMENTS, int64_t>::FromObject(
  Object value, bool* lossless) {
return BigInt::cast(value).AsInt64(lossless);
4288}

4290// static
4291template <>
4292Handle<Object> TypedElementsAccessor<RAB_GSAB_BIGINT64_ELEMENTS,
                                   int64_t>::ToHandle(Isolate* isolate,
                                                      int64_t value) {
return BigInt::FromInt64(isolate, value);
4296}

4298// static
4299template <>
4300uint64_t TypedElementsAccessor<RAB_GSAB_BIGUINT64_ELEMENTS,
                             uint64_t>::FromScalar(int value) {
UNREACHABLE()V8_Fatal("unreachable code");
4303}

4305// static
4306template <>
4307uint64_t TypedElementsAccessor<RAB_GSAB_BIGUINT64_ELEMENTS,
                             uint64_t>::FromScalar(uint32_t value) {
UNREACHABLE()V8_Fatal("unreachable code");
4310}

4312// static
4313template <>
4314uint64_t TypedElementsAccessor<RAB_GSAB_BIGUINT64_ELEMENTS,
                             uint64_t>::FromScalar(double value) {
UNREACHABLE()V8_Fatal("unreachable code");
4317}

4319// static
4320template <>
4321uint64_t TypedElementsAccessor<RAB_GSAB_BIGUINT64_ELEMENTS,
                             uint64_t>::FromScalar(int64_t value) {
return static_cast<uint64_t>(value);
4324}

4326// static
4327template <>
4328uint64_t TypedElementsAccessor<RAB_GSAB_BIGUINT64_ELEMENTS,
                             uint64_t>::FromScalar(uint64_t value) {
return value;
4331}

4333// static
4334template <>
4335uint64_t TypedElementsAccessor<RAB_GSAB_BIGUINT64_ELEMENTS,
                             uint64_t>::FromObject(Object value,
                                                   bool* lossless) {
return BigInt::cast(value).AsUint64(lossless);
4339}

4341// static
4342template <>
4343Handle<Object> TypedElementsAccessor<RAB_GSAB_BIGUINT64_ELEMENTS,
                                   uint64_t>::ToHandle(Isolate* isolate,
                                                       uint64_t value) {
return BigInt::FromUint64(isolate, value);
4347}

4349#define FIXED_ELEMENTS_ACCESSOR(Type, type, TYPE, ctype) \
using Type##ElementsAccessor = TypedElementsAccessor<TYPE##_ELEMENTS, ctype>;
4351TYPED_ARRAYS(FIXED_ELEMENTS_ACCESSOR)FIXED_ELEMENTS_ACCESSOR(Uint8, uint8, UINT8, uint8_t) FIXED_ELEMENTS_ACCESSOR
(Int8, int8, INT8, int8_t) FIXED_ELEMENTS_ACCESSOR(Uint16, uint16
, UINT16, uint16_t) FIXED_ELEMENTS_ACCESSOR(Int16, int16, INT16
, int16_t) FIXED_ELEMENTS_ACCESSOR(Uint32, uint32, UINT32, uint32_t
) FIXED_ELEMENTS_ACCESSOR(Int32, int32, INT32, int32_t) FIXED_ELEMENTS_ACCESSOR
(Float32, float32, FLOAT32, float) FIXED_ELEMENTS_ACCESSOR(Float64
, float64, FLOAT64, double) FIXED_ELEMENTS_ACCESSOR(Uint8Clamped
, uint8_clamped, UINT8_CLAMPED, uint8_t) FIXED_ELEMENTS_ACCESSOR
(BigUint64, biguint64, BIGUINT64, uint64_t) FIXED_ELEMENTS_ACCESSOR
(BigInt64, bigint64, BIGINT64, int64_t)
4352RAB_GSAB_TYPED_ARRAYS(FIXED_ELEMENTS_ACCESSOR)FIXED_ELEMENTS_ACCESSOR(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8
, uint8_t) FIXED_ELEMENTS_ACCESSOR(RabGsabInt8, rab_gsab_int8
, RAB_GSAB_INT8, int8_t) FIXED_ELEMENTS_ACCESSOR(RabGsabUint16
, rab_gsab_uint16, RAB_GSAB_UINT16, uint16_t) FIXED_ELEMENTS_ACCESSOR
(RabGsabInt16, rab_gsab_int16, RAB_GSAB_INT16, int16_t) FIXED_ELEMENTS_ACCESSOR
(RabGsabUint32, rab_gsab_uint32, RAB_GSAB_UINT32, uint32_t) FIXED_ELEMENTS_ACCESSOR
(RabGsabInt32, rab_gsab_int32, RAB_GSAB_INT32, int32_t) FIXED_ELEMENTS_ACCESSOR
(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float) FIXED_ELEMENTS_ACCESSOR
(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double) FIXED_ELEMENTS_ACCESSOR
(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED
, uint8_t) FIXED_ELEMENTS_ACCESSOR(RabGsabBigUint64, rab_gsab_biguint64
, RAB_GSAB_BIGUINT64, uint64_t) FIXED_ELEMENTS_ACCESSOR(RabGsabBigInt64
, rab_gsab_bigint64, RAB_GSAB_BIGINT64, int64_t)
4353#undef FIXED_ELEMENTS_ACCESSOR

4355template <typename Subclass, typename ArgumentsAccessor, typename KindTraits>
4356class SloppyArgumentsElementsAccessor
  : public ElementsAccessorBase<Subclass, KindTraits> {
public:
static void ConvertArgumentsStoreResult(
    Handle<SloppyArgumentsElements> elements, Handle<Object> result) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase parameters,
                              InternalIndex entry) {
  Handle<SloppyArgumentsElements> elements(
      SloppyArgumentsElements::cast(parameters), isolate);
  uint32_t length = elements->length();
  if (entry.as_uint32() < length) {
    // Read context mapped entry.
    DisallowGarbageCollection no_gc;
    Object probe = elements->mapped_entries(entry.as_uint32(), kRelaxedLoad);
    DCHECK(!probe.IsTheHole(isolate))((void) 0);
    Context context = elements->context();
    int context_entry = Smi::ToInt(probe);
    DCHECK(!context.get(context_entry).IsTheHole(isolate))((void) 0);
    return handle(context.get(context_entry), isolate);
  } else {
    // Entry is not context mapped, defer to the arguments.
    Handle<Object> result = ArgumentsAccessor::GetImpl(
        isolate, elements->arguments(), entry.adjust_down(length));
    return Subclass::ConvertArgumentsStoreResult(isolate, elements, result);
  }
}

static Maybe<bool> TransitionElementsKindImpl(Handle<JSObject> object,
                                              Handle<Map> map) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static Maybe<bool> GrowCapacityAndConvertImpl(Handle<JSObject> object,
                                              uint32_t capacity) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static inline void SetImpl(Handle<JSObject> holder, InternalIndex entry,
                           Object value) {
  SetImpl(holder->elements(), entry, value);
}

static inline void SetImpl(FixedArrayBase store, InternalIndex entry,
                           Object value) {
  SloppyArgumentsElements elements = SloppyArgumentsElements::cast(store);
  uint32_t length = elements.length();
  if (entry.as_uint32() < length) {
    // Store context mapped entry.
    DisallowGarbageCollection no_gc;
    Object probe = elements.mapped_entries(entry.as_uint32(), kRelaxedLoad);
    DCHECK(!probe.IsTheHole())((void) 0);
    Context context = Context::cast(elements.context());
    int context_entry = Smi::ToInt(probe);
    DCHECK(!context.get(context_entry).IsTheHole())((void) 0);
    context.set(context_entry, value);
  } else {
    //  Entry is not context mapped defer to arguments.
    FixedArray arguments = elements.arguments();
    Object current =
        ArgumentsAccessor::GetRaw(arguments, entry.adjust_down(length));
    if (current.IsAliasedArgumentsEntry()) {
      AliasedArgumentsEntry alias = AliasedArgumentsEntry::cast(current);
      Context context = Context::cast(elements.context());
      int context_entry = alias.aliased_context_slot();
      DCHECK(!context.get(context_entry).IsTheHole())((void) 0);
      context.set(context_entry, value);
    } else {
      ArgumentsAccessor::SetImpl(arguments, entry.adjust_down(length), value);
    }
  }
}

static Maybe<bool> SetLengthImpl(Isolate* isolate, Handle<JSArray> array,
                                 uint32_t length,
                                 Handle<FixedArrayBase> parameter_map) {
  // Sloppy arguments objects are not arrays.
  UNREACHABLE()V8_Fatal("unreachable code");
}

static uint32_t GetCapacityImpl(JSObject holder, FixedArrayBase store) {
  SloppyArgumentsElements elements = SloppyArgumentsElements::cast(store);
  FixedArray arguments = elements.arguments();
  return elements.length() +
         ArgumentsAccessor::GetCapacityImpl(holder, arguments);
}

static uint32_t GetMaxNumberOfEntries(JSObject holder,
                                      FixedArrayBase backing_store) {
  SloppyArgumentsElements elements =
      SloppyArgumentsElements::cast(backing_store);
  FixedArrayBase arguments = elements.arguments();
  size_t max_entries =
      ArgumentsAccessor::GetMaxNumberOfEntries(holder, arguments);
  DCHECK_LE(max_entries, std::numeric_limits<uint32_t>::max())((void) 0);
  return elements.length() + static_cast<uint32_t>(max_entries);
}

static uint32_t NumberOfElementsImpl(JSObject receiver,
                                     FixedArrayBase backing_store) {
  Isolate* isolate = receiver.GetIsolate();
  SloppyArgumentsElements elements =
      SloppyArgumentsElements::cast(backing_store);
  FixedArrayBase arguments = elements.arguments();
  uint32_t nof_elements = 0;
  uint32_t length = elements.length();
  for (uint32_t index = 0; index < length; index++) {
    if (HasParameterMapArg(isolate, elements, index)) nof_elements++;
  }
  return nof_elements +
         ArgumentsAccessor::NumberOfElementsImpl(receiver, arguments);
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus AddElementsToKeyAccumulatorImpl(
    Handle<JSObject> receiver, KeyAccumulator* accumulator,
    AddKeyConversion convert) {
  Isolate* isolate = accumulator->isolate();
  Handle<FixedArrayBase> elements(receiver->elements(), isolate);
  uint32_t length = GetCapacityImpl(*receiver, *elements);
  for (uint32_t index = 0; index < length; index++) {
    InternalIndex entry(index);
    if (!HasEntryImpl(isolate, *elements, entry)) continue;
    Handle<Object> value = GetImpl(isolate, *elements, entry);
    RETURN_FAILURE_IF_NOT_SUCCESSFUL(accumulator->AddKey(value, convert));
  }
  return ExceptionStatus::kSuccess;
}

static bool HasEntryImpl(Isolate* isolate, FixedArrayBase parameters,
                         InternalIndex entry) {
  SloppyArgumentsElements elements =
      SloppyArgumentsElements::cast(parameters);
  uint32_t length = elements.length();
  if (entry.raw_value() < length) {
    return HasParameterMapArg(isolate, elements, entry.raw_value());
  }
  FixedArrayBase arguments = elements.arguments();
  return ArgumentsAccessor::HasEntryImpl(isolate, arguments,
                                         entry.adjust_down(length));
}

static bool HasAccessorsImpl(JSObject holder, FixedArrayBase backing_store) {
  SloppyArgumentsElements elements =
      SloppyArgumentsElements::cast(backing_store);
  FixedArray arguments = elements.arguments();
  return ArgumentsAccessor::HasAccessorsImpl(holder, arguments);
}

static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                          FixedArrayBase parameters,
                                          size_t index,
                                          PropertyFilter filter) {
  SloppyArgumentsElements elements =
      SloppyArgumentsElements::cast(parameters);
  if (HasParameterMapArg(isolate, elements, index)) {
    return InternalIndex(index);
  }
  FixedArray arguments = elements.arguments();
  InternalIndex entry = ArgumentsAccessor::GetEntryForIndexImpl(
      isolate, holder, arguments, index, filter);
  if (entry.is_not_found()) return entry;
  // Arguments entries could overlap with the dictionary entries, hence offset
  // them by the number of context mapped entries.
  return entry.adjust_up(elements.length());
}

static PropertyDetails GetDetailsImpl(JSObject holder, InternalIndex entry) {
  SloppyArgumentsElements elements =
      SloppyArgumentsElements::cast(holder.elements());
  uint32_t length = elements.length();
  if (entry.as_uint32() < length) {
    return PropertyDetails(PropertyKind::kData, NONE,
                           PropertyCellType::kNoCell);
  }
  FixedArray arguments = elements.arguments();
  return ArgumentsAccessor::GetDetailsImpl(arguments,
                                           entry.adjust_down(length));
}

static bool HasParameterMapArg(Isolate* isolate,
                               SloppyArgumentsElements elements,
                               size_t index) {
  uint32_t length = elements.length();
  if (index >= length) return false;
  return !elements.mapped_entries(static_cast<uint32_t>(index), kRelaxedLoad)
              .IsTheHole(isolate);
}

static void DeleteImpl(Handle<JSObject> obj, InternalIndex entry) {
  Handle<SloppyArgumentsElements> elements(
      SloppyArgumentsElements::cast(obj->elements()), obj->GetIsolate());
  uint32_t length = elements->length();
  InternalIndex delete_or_entry = entry;
  if (entry.as_uint32() < length) {
    delete_or_entry = InternalIndex::NotFound();
  }
  Subclass::SloppyDeleteImpl(obj, elements, delete_or_entry);
  // SloppyDeleteImpl allocates a new dictionary elements store. For making
  // heap verification happy we postpone clearing out the mapped entry.
  if (entry.as_uint32() < length) {
    elements->set_mapped_entries(entry.as_uint32(),
                                 obj->GetReadOnlyRoots().the_hole_value());
  }
}

static void SloppyDeleteImpl(Handle<JSObject> obj,
                             Handle<SloppyArgumentsElements> elements,
                             InternalIndex entry) {
  // Implemented in subclasses.
  UNREACHABLE()V8_Fatal("unreachable code");
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus CollectElementIndicesImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
    KeyAccumulator* keys) {
  Isolate* isolate = keys->isolate();
  uint32_t nof_indices = 0;
  Handle<FixedArray> indices = isolate->factory()->NewFixedArray(
      GetCapacityImpl(*object, *backing_store));
  DirectCollectElementIndicesImpl(isolate, object, backing_store,
                                  GetKeysConversion::kKeepNumbers,
                                  ENUMERABLE_STRINGS, indices, &nof_indices);
  SortIndices(isolate, indices, nof_indices);
  for (uint32_t i = 0; i < nof_indices; i++) {
    RETURN_FAILURE_IF_NOT_SUCCESSFUL(keys->AddKey(indices->get(i)));
  }
  return ExceptionStatus::kSuccess;
}

static Handle<FixedArray> DirectCollectElementIndicesImpl(
    Isolate* isolate, Handle<JSObject> object,
    Handle<FixedArrayBase> backing_store, GetKeysConversion convert,
    PropertyFilter filter, Handle<FixedArray> list, uint32_t* nof_indices,
    uint32_t insertion_index = 0) {
  Handle<SloppyArgumentsElements> elements =
      Handle<SloppyArgumentsElements>::cast(backing_store);
  uint32_t length = elements->length();

  for (uint32_t i = 0; i < length; ++i) {
    if (elements->mapped_entries(i, kRelaxedLoad).IsTheHole(isolate))
      continue;
    if (convert == GetKeysConversion::kConvertToString) {
      Handle<String> index_string = isolate->factory()->Uint32ToString(i);
      list->set(insertion_index, *index_string);
    } else {
      list->set(insertion_index, Smi::FromInt(i));
    }
    insertion_index++;
  }

  Handle<FixedArray> store(elements->arguments(), isolate);
  return ArgumentsAccessor::DirectCollectElementIndicesImpl(
      isolate, object, store, convert, filter, list, nof_indices,
      insertion_index);
}

static Maybe<bool> IncludesValueImpl(Isolate* isolate,
                                     Handle<JSObject> object,
                                     Handle<Object> value, size_t start_from,
                                     size_t length) {
  DCHECK(JSObject::PrototypeHasNoElements(isolate, *object))((void) 0);
  Handle<Map> original_map(object->map(), isolate);
  Handle<SloppyArgumentsElements> elements(
      SloppyArgumentsElements::cast(object->elements()), isolate);
  bool search_for_hole = value->IsUndefined(isolate);

  for (size_t k = start_from; k < length; ++k) {
    DCHECK_EQ(object->map(), *original_map)((void) 0);
    InternalIndex entry =
        GetEntryForIndexImpl(isolate, *object, *elements, k, ALL_PROPERTIES);
    if (entry.is_not_found()) {
      if (search_for_hole) return Just(true);
      continue;
    }

    Handle<Object> element_k = Subclass::GetImpl(isolate, *elements, entry);

    if (element_k->IsAccessorPair()) {
      LookupIterator it(isolate, object, k, LookupIterator::OWN);
      DCHECK(it.IsFound())((void) 0);
      DCHECK_EQ(it.state(), LookupIterator::ACCESSOR)((void) 0);
      ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, element_k,do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<bool>();
 } } while (false)
                                       Object::GetPropertyWithAccessor(&it),do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<bool>();
 } } while (false)
                                       Nothing<bool>())do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<bool>();
 } } while (false);

      if (value->SameValueZero(*element_k)) return Just(true);

      if (object->map() != *original_map) {
        // Some mutation occurred in accessor. Abort "fast" path
        return IncludesValueSlowPath(isolate, object, value, k + 1, length);
      }
    } else if (value->SameValueZero(*element_k)) {
      return Just(true);
    }
  }
  return Just(false);
}

static Maybe<int64_t> IndexOfValueImpl(Isolate* isolate,
                                       Handle<JSObject> object,
                                       Handle<Object> value,
                                       size_t start_from, size_t length) {
  DCHECK(JSObject::PrototypeHasNoElements(isolate, *object))((void) 0);
  Handle<Map> original_map(object->map(), isolate);
  Handle<SloppyArgumentsElements> elements(
      SloppyArgumentsElements::cast(object->elements()), isolate);

  for (size_t k = start_from; k < length; ++k) {
    DCHECK_EQ(object->map(), *original_map)((void) 0);
    InternalIndex entry =
        GetEntryForIndexImpl(isolate, *object, *elements, k, ALL_PROPERTIES);
    if (entry.is_not_found()) {
      continue;
    }

    Handle<Object> element_k = Subclass::GetImpl(isolate, *elements, entry);

    if (element_k->IsAccessorPair()) {
      LookupIterator it(isolate, object, k, LookupIterator::OWN);
      DCHECK(it.IsFound())((void) 0);
      DCHECK_EQ(it.state(), LookupIterator::ACCESSOR)((void) 0);
      ASSIGN_RETURN_ON_EXCEPTION_VALUE(isolate, element_k,do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<int64_t>
(); } } while (false)
                                       Object::GetPropertyWithAccessor(&it),do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<int64_t>
(); } } while (false)
                                       Nothing<int64_t>())do { if (!(Object::GetPropertyWithAccessor(&it)).ToHandle
(&element_k)) { ((void) 0); return Nothing<int64_t>
(); } } while (false);

      if (value->StrictEquals(*element_k)) {
        return Just<int64_t>(k);
      }

      if (object->map() != *original_map) {
        // Some mutation occurred in accessor. Abort "fast" path.
        return IndexOfValueSlowPath(isolate, object, value, k + 1, length);
      }
    } else if (value->StrictEquals(*element_k)) {
      return Just<int64_t>(k);
    }
  }
  return Just<int64_t>(-1);
}
4697};

4699class SlowSloppyArgumentsElementsAccessor
  : public SloppyArgumentsElementsAccessor<
        SlowSloppyArgumentsElementsAccessor, DictionaryElementsAccessor,
        ElementsKindTraits<SLOW_SLOPPY_ARGUMENTS_ELEMENTS>> {
public:
static Handle<Object> ConvertArgumentsStoreResult(
    Isolate* isolate, Handle<SloppyArgumentsElements> elements,
    Handle<Object> result) {
  // Elements of the arguments object in slow mode might be slow aliases.
  if (result->IsAliasedArgumentsEntry()) {
    DisallowGarbageCollection no_gc;
    AliasedArgumentsEntry alias = AliasedArgumentsEntry::cast(*result);
    Context context = elements->context();
    int context_entry = alias.aliased_context_slot();
    DCHECK(!context.get(context_entry).IsTheHole(isolate))((void) 0);
    return handle(context.get(context_entry), isolate);
  }
  return result;
}
static void SloppyDeleteImpl(Handle<JSObject> obj,
                             Handle<SloppyArgumentsElements> elements,
                             InternalIndex entry) {
  // No need to delete a context mapped entry from the arguments elements.
  if (entry.is_not_found()) return;
  Isolate* isolate = obj->GetIsolate();
  Handle<NumberDictionary> dict(NumberDictionary::cast(elements->arguments()),
                                isolate);
  uint32_t length = elements->length();
  dict =
      NumberDictionary::DeleteEntry(isolate, dict, entry.adjust_down(length));
  elements->set_arguments(*dict);
}
static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  Isolate* isolate = object->GetIsolate();
  Handle<SloppyArgumentsElements> elements(
      SloppyArgumentsElements::cast(object->elements()), isolate);
  Handle<FixedArrayBase> old_arguments(
      FixedArrayBase::cast(elements->arguments()), isolate);
  Handle<NumberDictionary> dictionary =
      old_arguments->IsNumberDictionary()
          ? Handle<NumberDictionary>::cast(old_arguments)
          : JSObject::NormalizeElements(object);
  PropertyDetails details(PropertyKind::kData, attributes,
                          PropertyCellType::kNoCell);
  Handle<NumberDictionary> new_dictionary =
      NumberDictionary::Add(isolate, dictionary, index, value, details);
  if (attributes != NONE) object->RequireSlowElements(*new_dictionary);
  if (*dictionary != *new_dictionary) {
    elements->set_arguments(*new_dictionary);
  }
  return Just(true);
}

static void ReconfigureImpl(Handle<JSObject> object,
                            Handle<FixedArrayBase> store, InternalIndex entry,
                            Handle<Object> value,
                            PropertyAttributes attributes) {
  Isolate* isolate = object->GetIsolate();
  Handle<SloppyArgumentsElements> elements =
      Handle<SloppyArgumentsElements>::cast(store);
  uint32_t length = elements->length();
  if (entry.as_uint32() < length) {
    Object probe = elements->mapped_entries(entry.as_uint32(), kRelaxedLoad);
    DCHECK(!probe.IsTheHole(isolate))((void) 0);
    Context context = elements->context();
    int context_entry = Smi::ToInt(probe);
    DCHECK(!context.get(context_entry).IsTheHole(isolate))((void) 0);
    context.set(context_entry, *value);

    // Redefining attributes of an aliased element destroys fast aliasing.
    elements->set_mapped_entries(entry.as_uint32(),
                                 ReadOnlyRoots(isolate).the_hole_value());
    // For elements that are still writable we re-establish slow aliasing.
    if ((attributes & READ_ONLY) == 0) {
      value = isolate->factory()->NewAliasedArgumentsEntry(context_entry);
    }

    PropertyDetails details(PropertyKind::kData, attributes,
                            PropertyCellType::kNoCell);
    Handle<NumberDictionary> arguments(
        NumberDictionary::cast(elements->arguments()), isolate);
    arguments = NumberDictionary::Add(isolate, arguments, entry.as_uint32(),
                                      value, details);
    // If the attributes were NONE, we would have called set rather than
    // reconfigure.
    DCHECK_NE(NONE, attributes)((void) 0);
    object->RequireSlowElements(*arguments);
    elements->set_arguments(*arguments);
  } else {
    Handle<FixedArrayBase> arguments(elements->arguments(), isolate);
    DictionaryElementsAccessor::ReconfigureImpl(
        object, arguments, entry.adjust_down(length), value, attributes);
  }
}
4796};

4798class FastSloppyArgumentsElementsAccessor
  : public SloppyArgumentsElementsAccessor<
        FastSloppyArgumentsElementsAccessor, FastHoleyObjectElementsAccessor,
        ElementsKindTraits<FAST_SLOPPY_ARGUMENTS_ELEMENTS>> {
public:
static Handle<Object> ConvertArgumentsStoreResult(
    Isolate* isolate, Handle<SloppyArgumentsElements> paramtere_map,
    Handle<Object> result) {
  DCHECK(!result->IsAliasedArgumentsEntry())((void) 0);
  return result;
}

static Handle<FixedArray> GetArguments(Isolate* isolate,
                                       FixedArrayBase store) {
  SloppyArgumentsElements elements = SloppyArgumentsElements::cast(store);
  return Handle<FixedArray>(elements.arguments(), isolate);
}

static Handle<NumberDictionary> NormalizeImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> elements) {
  Handle<FixedArray> arguments =
      GetArguments(object->GetIsolate(), *elements);
  return FastHoleyObjectElementsAccessor::NormalizeImpl(object, arguments);
}

static Handle<NumberDictionary> NormalizeArgumentsElements(
    Handle<JSObject> object, Handle<SloppyArgumentsElements> elements,
    InternalIndex* entry) {
  Handle<NumberDictionary> dictionary = JSObject::NormalizeElements(object);
  elements->set_arguments(*dictionary);
  // kMaxUInt32 indicates that a context mapped element got deleted. In this
  // case we only normalize the elements (aka. migrate to SLOW_SLOPPY).
  if (entry->is_not_found()) return dictionary;
  uint32_t length = elements->length();
  if (entry->as_uint32() >= length) {
    *entry =
        dictionary
            ->FindEntry(object->GetIsolate(), entry->as_uint32() - length)
            .adjust_up(length);
  }
  return dictionary;
}

static void SloppyDeleteImpl(Handle<JSObject> obj,
                             Handle<SloppyArgumentsElements> elements,
                             InternalIndex entry) {
  // Always normalize element on deleting an entry.
  NormalizeArgumentsElements(obj, elements, &entry);
  SlowSloppyArgumentsElementsAccessor::SloppyDeleteImpl(obj, elements, entry);
}

static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  DCHECK_EQ(NONE, attributes)((void) 0);
  Isolate* isolate = object->GetIsolate();
  Handle<SloppyArgumentsElements> elements(
      SloppyArgumentsElements::cast(object->elements()), isolate);
  Handle<FixedArray> old_arguments(elements->arguments(), isolate);
  if (old_arguments->IsNumberDictionary() ||
      static_cast<uint32_t>(old_arguments->length()) < new_capacity) {
    MAYBE_RETURN(GrowCapacityAndConvertImpl(object, new_capacity),do { if ((GrowCapacityAndConvertImpl(object, new_capacity)).IsNothing
()) return Nothing<bool>(); } while (false)
                 Nothing<bool>())do { if ((GrowCapacityAndConvertImpl(object, new_capacity)).IsNothing
()) return Nothing<bool>(); } while (false);
  }
  FixedArray arguments = elements->arguments();
  // For fast holey objects, the entry equals the index. The code above made
  // sure that there's enough space to store the value. We cannot convert
  // index to entry explicitly since the slot still contains the hole, so the
  // current EntryForIndex would indicate that it is "absent" by returning
  // kMaxUInt32.
  FastHoleyObjectElementsAccessor::SetImpl(arguments, InternalIndex(index),
                                           *value);
  return Just(true);
}

static void ReconfigureImpl(Handle<JSObject> object,
                            Handle<FixedArrayBase> store, InternalIndex entry,
                            Handle<Object> value,
                            PropertyAttributes attributes) {
  DCHECK_EQ(object->elements(), *store)((void) 0);
  Handle<SloppyArgumentsElements> elements(
      SloppyArgumentsElements::cast(*store), object->GetIsolate());
  NormalizeArgumentsElements(object, elements, &entry);
  SlowSloppyArgumentsElementsAccessor::ReconfigureImpl(object, store, entry,
                                                       value, attributes);
}

static void CopyElementsImpl(Isolate* isolate, FixedArrayBase from,
                             uint32_t from_start, FixedArrayBase to,
                             ElementsKind from_kind, uint32_t to_start,
                             int packed_size, int copy_size) {
  DCHECK(!to.IsNumberDictionary())((void) 0);
  if (from_kind == SLOW_SLOPPY_ARGUMENTS_ELEMENTS) {
    CopyDictionaryToObjectElements(isolate, from, from_start, to,
                                   HOLEY_ELEMENTS, to_start, copy_size);
  } else {
    DCHECK_EQ(FAST_SLOPPY_ARGUMENTS_ELEMENTS, from_kind)((void) 0);
    CopyObjectToObjectElements(isolate, from, HOLEY_ELEMENTS, from_start, to,
                               HOLEY_ELEMENTS, to_start, copy_size);
  }
}

static Maybe<bool> GrowCapacityAndConvertImpl(Handle<JSObject> object,
                                              uint32_t capacity) {
  Isolate* isolate = object->GetIsolate();
  Handle<SloppyArgumentsElements> elements(
      SloppyArgumentsElements::cast(object->elements()), isolate);
  Handle<FixedArray> old_arguments(FixedArray::cast(elements->arguments()),
                                   isolate);
  ElementsKind from_kind = object->GetElementsKind();
  // This method should only be called if there's a reason to update the
  // elements.
  DCHECK(from_kind == SLOW_SLOPPY_ARGUMENTS_ELEMENTS ||((void) 0)
         static_cast<uint32_t>(old_arguments->length()) < capacity)((void) 0);
  Handle<FixedArrayBase> arguments;
  ASSIGN_RETURN_ON_EXCEPTION_VALUE(do { if (!(ConvertElementsWithCapacity(object, old_arguments,
 from_kind, capacity)).ToHandle(&arguments)) { ((void) 0)
; return Nothing<bool>(); } } while (false)
      isolate, arguments,do { if (!(ConvertElementsWithCapacity(object, old_arguments,
 from_kind, capacity)).ToHandle(&arguments)) { ((void) 0)
; return Nothing<bool>(); } } while (false)
      ConvertElementsWithCapacity(object, old_arguments, from_kind, capacity),do { if (!(ConvertElementsWithCapacity(object, old_arguments,
 from_kind, capacity)).ToHandle(&arguments)) { ((void) 0)
; return Nothing<bool>(); } } while (false)
      Nothing<bool>())do { if (!(ConvertElementsWithCapacity(object, old_arguments,
 from_kind, capacity)).ToHandle(&arguments)) { ((void) 0)
; return Nothing<bool>(); } } while (false);
  Handle<Map> new_map = JSObject::GetElementsTransitionMap(
      object, FAST_SLOPPY_ARGUMENTS_ELEMENTS);
  JSObject::MigrateToMap(isolate, object, new_map);
  elements->set_arguments(FixedArray::cast(*arguments));
  JSObject::ValidateElements(*object);
  return Just(true);
}
4925};

4927template <typename Subclass, typename BackingStoreAccessor, typename KindTraits>
4928class StringWrapperElementsAccessor
  : public ElementsAccessorBase<Subclass, KindTraits> {
public:
static Handle<Object> GetInternalImpl(Handle<JSObject> holder,
                                      InternalIndex entry) {
  return GetImpl(holder, entry);
}

static Handle<Object> GetImpl(Handle<JSObject> holder, InternalIndex entry) {
  Isolate* isolate = holder->GetIsolate();
  Handle<String> string(GetString(*holder), isolate);
  uint32_t length = static_cast<uint32_t>(string->length());
  if (entry.as_uint32() < length) {
    return isolate->factory()->LookupSingleCharacterStringFromCode(
        String::Flatten(isolate, string)->Get(entry.as_int()));
  }
  return BackingStoreAccessor::GetImpl(isolate, holder->elements(),
                                       entry.adjust_down(length));
}

static Handle<Object> GetImpl(Isolate* isolate, FixedArrayBase elements,
                              InternalIndex entry) {
  UNREACHABLE()V8_Fatal("unreachable code");
}

static PropertyDetails GetDetailsImpl(JSObject holder, InternalIndex entry) {
  uint32_t length = static_cast<uint32_t>(GetString(holder).length());
  if (entry.as_uint32() < length) {
    PropertyAttributes attributes =
        static_cast<PropertyAttributes>(READ_ONLY | DONT_DELETE);
    return PropertyDetails(PropertyKind::kData, attributes,
                           PropertyCellType::kNoCell);
  }
  return BackingStoreAccessor::GetDetailsImpl(holder,
                                              entry.adjust_down(length));
}

static InternalIndex GetEntryForIndexImpl(Isolate* isolate, JSObject holder,
                                          FixedArrayBase backing_store,
                                          size_t index,
                                          PropertyFilter filter) {
  uint32_t length = static_cast<uint32_t>(GetString(holder).length());
  if (index < length) return InternalIndex(index);
  InternalIndex backing_store_entry =
      BackingStoreAccessor::GetEntryForIndexImpl(
          isolate, holder, backing_store, index, filter);
  if (backing_store_entry.is_not_found()) return backing_store_entry;
  return backing_store_entry.adjust_up(length);
}

static void DeleteImpl(Handle<JSObject> holder, InternalIndex entry) {
  uint32_t length = static_cast<uint32_t>(GetString(*holder).length());
  if (entry.as_uint32() < length) {
    return;  // String contents can't be deleted.
  }
  BackingStoreAccessor::DeleteImpl(holder, entry.adjust_down(length));
}

static void SetImpl(Handle<JSObject> holder, InternalIndex entry,
                    Object value) {
  uint32_t length = static_cast<uint32_t>(GetString(*holder).length());
  if (entry.as_uint32() < length) {
    return;  // String contents are read-only.
  }
  BackingStoreAccessor::SetImpl(holder->elements(), entry.adjust_down(length),
                                value);
}

static Maybe<bool> AddImpl(Handle<JSObject> object, uint32_t index,
                           Handle<Object> value,
                           PropertyAttributes attributes,
                           uint32_t new_capacity) {
  DCHECK(index >= static_cast<uint32_t>(GetString(*object).length()))((void) 0);
  // Explicitly grow fast backing stores if needed. Dictionaries know how to
  // extend their capacity themselves.
  if (KindTraits::Kind == FAST_STRING_WRAPPER_ELEMENTS &&
      (object->GetElementsKind() == SLOW_STRING_WRAPPER_ELEMENTS ||
       BackingStoreAccessor::GetCapacityImpl(*object, object->elements()) !=
           new_capacity)) {
    MAYBE_RETURN(GrowCapacityAndConvertImpl(object, new_capacity),do { if ((GrowCapacityAndConvertImpl(object, new_capacity)).IsNothing
()) return Nothing<bool>(); } while (false)
                 Nothing<bool>())do { if ((GrowCapacityAndConvertImpl(object, new_capacity)).IsNothing
()) return Nothing<bool>(); } while (false);
  }
  BackingStoreAccessor::AddImpl(object, index, value, attributes,
                                new_capacity);
  return Just(true);
}

static void ReconfigureImpl(Handle<JSObject> object,
                            Handle<FixedArrayBase> store, InternalIndex entry,
                            Handle<Object> value,
                            PropertyAttributes attributes) {
  uint32_t length = static_cast<uint32_t>(GetString(*object).length());
  if (entry.as_uint32() < length) {
    return;  // String contents can't be reconfigured.
  }
  BackingStoreAccessor::ReconfigureImpl(
      object, store, entry.adjust_down(length), value, attributes);
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus AddElementsToKeyAccumulatorImpl(
    Handle<JSObject> receiver, KeyAccumulator* accumulator,
    AddKeyConversion convert) {
  Isolate* isolate = receiver->GetIsolate();
  Handle<String> string(GetString(*receiver), isolate);
  string = String::Flatten(isolate, string);
  uint32_t length = static_cast<uint32_t>(string->length());
  for (uint32_t i = 0; i < length; i++) {
    Handle<String> key =
        isolate->factory()->LookupSingleCharacterStringFromCode(
            string->Get(i));
    RETURN_FAILURE_IF_NOT_SUCCESSFUL(accumulator->AddKey(key, convert));
  }
  return BackingStoreAccessor::AddElementsToKeyAccumulatorImpl(
      receiver, accumulator, convert);
}

V8_WARN_UNUSED_RESULT__attribute__((warn_unused_result)) static ExceptionStatus CollectElementIndicesImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> backing_store,
    KeyAccumulator* keys) {
  uint32_t length = GetString(*object).length();
  Factory* factory = keys->isolate()->factory();
  for (uint32_t i = 0; i < length; i++) {
    RETURN_FAILURE_IF_NOT_SUCCESSFUL(
        keys->AddKey(factory->NewNumberFromUint(i)));
  }
  return BackingStoreAccessor::CollectElementIndicesImpl(object,
                                                         backing_store, keys);
}

static Maybe<bool> GrowCapacityAndConvertImpl(Handle<JSObject> object,
                                              uint32_t capacity) {
  Handle<FixedArrayBase> old_elements(object->elements(),
                                      object->GetIsolate());
  ElementsKind from_kind = object->GetElementsKind();
  if (from_kind == FAST_STRING_WRAPPER_ELEMENTS) {
    // The optimizing compiler relies on the prototype lookups of String
    // objects always returning undefined. If there's a store to the
    // initial String.prototype object, make sure all the optimizations
    // are invalidated.
    object->GetIsolate()->UpdateNoElementsProtectorOnSetLength(object);
  }
  // This method should only be called if there's a reason to update the
  // elements.
  DCHECK(from_kind == SLOW_STRING_WRAPPER_ELEMENTS ||((void) 0)
         static_cast<uint32_t>(old_elements->length()) < capacity)((void) 0);
  return Subclass::BasicGrowCapacityAndConvertImpl(
      object, old_elements, from_kind, FAST_STRING_WRAPPER_ELEMENTS,
      capacity);
}

static void CopyElementsImpl(Isolate* isolate, FixedArrayBase from,
                             uint32_t from_start, FixedArrayBase to,
                             ElementsKind from_kind, uint32_t to_start,
                             int packed_size, int copy_size) {
  DCHECK(!to.IsNumberDictionary())((void) 0);
  if (from_kind == SLOW_STRING_WRAPPER_ELEMENTS) {
    CopyDictionaryToObjectElements(isolate, from, from_start, to,
                                   HOLEY_ELEMENTS, to_start, copy_size);
  } else {
    DCHECK_EQ(FAST_STRING_WRAPPER_ELEMENTS, from_kind)((void) 0);
    CopyObjectToObjectElements(isolate, from, HOLEY_ELEMENTS, from_start, to,
                               HOLEY_ELEMENTS, to_start, copy_size);
  }
}

static uint32_t NumberOfElementsImpl(JSObject object,
                                     FixedArrayBase backing_store) {
  uint32_t length = GetString(object).length();
  return length +
         BackingStoreAccessor::NumberOfElementsImpl(object, backing_store);
}

private:
static String GetString(JSObject holder) {
  DCHECK(holder.IsJSPrimitiveWrapper())((void) 0);
  JSPrimitiveWrapper js_value = JSPrimitiveWrapper::cast(holder);
  DCHECK(js_value.value().IsString())((void) 0);
  return String::cast(js_value.value());
}
5107};

5109class FastStringWrapperElementsAccessor
  : public StringWrapperElementsAccessor<
        FastStringWrapperElementsAccessor, FastHoleyObjectElementsAccessor,
        ElementsKindTraits<FAST_STRING_WRAPPER_ELEMENTS>> {
public:
static Handle<NumberDictionary> NormalizeImpl(
    Handle<JSObject> object, Handle<FixedArrayBase> elements) {
  return FastHoleyObjectElementsAccessor::NormalizeImpl(object, elements);
}
5118};

5120class SlowStringWrapperElementsAccessor
  : public StringWrapperElementsAccessor<
        SlowStringWrapperElementsAccessor, DictionaryElementsAccessor,
        ElementsKindTraits<SLOW_STRING_WRAPPER_ELEMENTS>> {
public:
static bool HasAccessorsImpl(JSObject holder, FixedArrayBase backing_store) {
  return DictionaryElementsAccessor::HasAccessorsImpl(holder, backing_store);
}
5128};

5130}  // namespace

5132MaybeHandle<Object> ArrayConstructInitializeElements(
  Handle<JSArray> array, JavaScriptArguments* args) {
if (args->length() == 0) {
  // Optimize the case where there are no parameters passed.
  JSArray::Initialize(array, JSArray::kPreallocatedArrayElements);
  return array;

} else if (args->length() == 1 && args->at(0)->IsNumber()) {
  uint32_t length;
  if (!args->at(0)->ToArrayLength(&length)) {
    return ThrowArrayLengthRangeError(array->GetIsolate());
  }

  // Optimize the case where there is one argument and the argument is a small
  // smi.
  if (length > 0 && length < JSArray::kInitialMaxFastElementArray) {
    ElementsKind elements_kind = array->GetElementsKind();
    JSArray::Initialize(array, length, length);

    if (!IsHoleyElementsKind(elements_kind)) {
      elements_kind = GetHoleyElementsKind(elements_kind);
      JSObject::TransitionElementsKind(array, elements_kind);
    }
  } else if (length == 0) {
    JSArray::Initialize(array, JSArray::kPreallocatedArrayElements);
  } else {
    // Take the argument as the length.
    JSArray::Initialize(array, 0);
    MAYBE_RETURN_NULL(JSArray::SetLength(array, length))do { if ((JSArray::SetLength(array, length)).IsNothing()) return
 MaybeHandle<Object>(); } while (false);
  }
  return array;
}

Factory* factory = array->GetIsolate()->factory();

// Set length and elements on the array.
int number_of_elements = args->length();
JSObject::EnsureCanContainElements(array, args, number_of_elements,
                                   ALLOW_CONVERTED_DOUBLE_ELEMENTS);

// Allocate an appropriately typed elements array.
ElementsKind elements_kind = array->GetElementsKind();
Handle<FixedArrayBase> elms;
if (IsDoubleElementsKind(elements_kind)) {
  elms = Handle<FixedArrayBase>::cast(
      factory->NewFixedDoubleArray(number_of_elements));
} else {
  elms = Handle<FixedArrayBase>::cast(
      factory->NewFixedArrayWithHoles(number_of_elements));
}

// Fill in the content
switch (elements_kind) {
  case HOLEY_SMI_ELEMENTS:
  case PACKED_SMI_ELEMENTS: {
    Handle<FixedArray> smi_elms = Handle<FixedArray>::cast(elms);
    for (int entry = 0; entry < number_of_elements; entry++) {
      smi_elms->set(entry, (*args)[entry], SKIP_WRITE_BARRIER);
    }
    break;
  }
  case HOLEY_ELEMENTS:
  case PACKED_ELEMENTS: {
    DisallowGarbageCollection no_gc;
    WriteBarrierMode mode = elms->GetWriteBarrierMode(no_gc);
    Handle<FixedArray> object_elms = Handle<FixedArray>::cast(elms);
    for (int entry = 0; entry < number_of_elements; entry++) {
      object_elms->set(entry, (*args)[entry], mode);
    }
    break;
  }
  case HOLEY_DOUBLE_ELEMENTS:
  case PACKED_DOUBLE_ELEMENTS: {
    Handle<FixedDoubleArray> double_elms =
        Handle<FixedDoubleArray>::cast(elms);
    for (int entry = 0; entry < number_of_elements; entry++) {
      double_elms->set(entry, (*args)[entry].Number());
    }
    break;
  }
  default:
    UNREACHABLE()V8_Fatal("unreachable code");
}

array->set_elements(*elms);
array->set_length(Smi::FromInt(number_of_elements));
return array;
5219}

5221void CopyFastNumberJSArrayElementsToTypedArray(Address raw_context,
                                             Address raw_source,
                                             Address raw_destination,
                                             uintptr_t length,
                                             uintptr_t offset) {
Context context = Context::cast(Object(raw_context));
JSArray source = JSArray::cast(Object(raw_source));
JSTypedArray destination = JSTypedArray::cast(Object(raw_destination));

switch (destination.GetElementsKind()) {
5231#define TYPED_ARRAYS_CASE(Type, type, TYPE, ctype)           \
case TYPE##_ELEMENTS:                                      \
  CHECK(Type##ElementsAccessor::TryCopyElementsFastNumber( \do { if ((__builtin_expect(!!(!(Type##ElementsAccessor::TryCopyElementsFastNumber
( context, source, destination, length, offset))), 0))) { V8_Fatal
("Check failed: %s.", "Type##ElementsAccessor::TryCopyElementsFastNumber( context, source, destination, length, offset)"
); } } while (false)
      context, source, destination, length, offset))do { if ((__builtin_expect(!!(!(Type##ElementsAccessor::TryCopyElementsFastNumber
( context, source, destination, length, offset))), 0))) { V8_Fatal
("Check failed: %s.", "Type##ElementsAccessor::TryCopyElementsFastNumber( context, source, destination, length, offset)"
); } } while (false);      \
  break;
  TYPED_ARRAYS(TYPED_ARRAYS_CASE)TYPED_ARRAYS_CASE(Uint8, uint8, UINT8, uint8_t) TYPED_ARRAYS_CASE
(Int8, int8, INT8, int8_t) TYPED_ARRAYS_CASE(Uint16, uint16, UINT16
, uint16_t) TYPED_ARRAYS_CASE(Int16, int16, INT16, int16_t) TYPED_ARRAYS_CASE
(Uint32, uint32, UINT32, uint32_t) TYPED_ARRAYS_CASE(Int32, int32
, INT32, int32_t) TYPED_ARRAYS_CASE(Float32, float32, FLOAT32
, float) TYPED_ARRAYS_CASE(Float64, float64, FLOAT64, double)
 TYPED_ARRAYS_CASE(Uint8Clamped, uint8_clamped, UINT8_CLAMPED
, uint8_t) TYPED_ARRAYS_CASE(BigUint64, biguint64, BIGUINT64,
 uint64_t) TYPED_ARRAYS_CASE(BigInt64, bigint64, BIGINT64, int64_t
)
  RAB_GSAB_TYPED_ARRAYS(TYPED_ARRAYS_CASE)TYPED_ARRAYS_CASE(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8
, uint8_t) TYPED_ARRAYS_CASE(RabGsabInt8, rab_gsab_int8, RAB_GSAB_INT8
, int8_t) TYPED_ARRAYS_CASE(RabGsabUint16, rab_gsab_uint16, RAB_GSAB_UINT16
, uint16_t) TYPED_ARRAYS_CASE(RabGsabInt16, rab_gsab_int16, RAB_GSAB_INT16
, int16_t) TYPED_ARRAYS_CASE(RabGsabUint32, rab_gsab_uint32, RAB_GSAB_UINT32
, uint32_t) TYPED_ARRAYS_CASE(RabGsabInt32, rab_gsab_int32, RAB_GSAB_INT32
, int32_t) TYPED_ARRAYS_CASE(RabGsabFloat32, rab_gsab_float32
, RAB_GSAB_FLOAT32, float) TYPED_ARRAYS_CASE(RabGsabFloat64, rab_gsab_float64
, RAB_GSAB_FLOAT64, double) TYPED_ARRAYS_CASE(RabGsabUint8Clamped
, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) TYPED_ARRAYS_CASE
(RabGsabBigUint64, rab_gsab_biguint64, RAB_GSAB_BIGUINT64, uint64_t
) TYPED_ARRAYS_CASE(RabGsabBigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64
, int64_t)
5238#undef TYPED_ARRAYS_CASE
  default:
    UNREACHABLE()V8_Fatal("unreachable code");
}
5242}

5244void CopyTypedArrayElementsToTypedArray(Address raw_source,
                                      Address raw_destination,
                                      uintptr_t length, uintptr_t offset) {
JSTypedArray source = JSTypedArray::cast(Object(raw_source));
JSTypedArray destination = JSTypedArray::cast(Object(raw_destination));

switch (destination.GetElementsKind()) {
5251#define TYPED_ARRAYS_CASE(Type, type, TYPE, ctype)                          \
case TYPE##_ELEMENTS:                                                     \
  Type##ElementsAccessor::CopyElementsFromTypedArray(source, destination, \
                                                     length, offset);     \
  break;
  TYPED_ARRAYS(TYPED_ARRAYS_CASE)TYPED_ARRAYS_CASE(Uint8, uint8, UINT8, uint8_t) TYPED_ARRAYS_CASE
(Int8, int8, INT8, int8_t) TYPED_ARRAYS_CASE(Uint16, uint16, UINT16
, uint16_t) TYPED_ARRAYS_CASE(Int16, int16, INT16, int16_t) TYPED_ARRAYS_CASE
(Uint32, uint32, UINT32, uint32_t) TYPED_ARRAYS_CASE(Int32, int32
, INT32, int32_t) TYPED_ARRAYS_CASE(Float32, float32, FLOAT32
, float) TYPED_ARRAYS_CASE(Float64, float64, FLOAT64, double)
 TYPED_ARRAYS_CASE(Uint8Clamped, uint8_clamped, UINT8_CLAMPED
, uint8_t) TYPED_ARRAYS_CASE(BigUint64, biguint64, BIGUINT64,
 uint64_t) TYPED_ARRAYS_CASE(BigInt64, bigint64, BIGINT64, int64_t
)
  RAB_GSAB_TYPED_ARRAYS(TYPED_ARRAYS_CASE)TYPED_ARRAYS_CASE(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8
, uint8_t) TYPED_ARRAYS_CASE(RabGsabInt8, rab_gsab_int8, RAB_GSAB_INT8
, int8_t) TYPED_ARRAYS_CASE(RabGsabUint16, rab_gsab_uint16, RAB_GSAB_UINT16
, uint16_t) TYPED_ARRAYS_CASE(RabGsabInt16, rab_gsab_int16, RAB_GSAB_INT16
, int16_t) TYPED_ARRAYS_CASE(RabGsabUint32, rab_gsab_uint32, RAB_GSAB_UINT32
, uint32_t) TYPED_ARRAYS_CASE(RabGsabInt32, rab_gsab_int32, RAB_GSAB_INT32
, int32_t) TYPED_ARRAYS_CASE(RabGsabFloat32, rab_gsab_float32
, RAB_GSAB_FLOAT32, float) TYPED_ARRAYS_CASE(RabGsabFloat64, rab_gsab_float64
, RAB_GSAB_FLOAT64, double) TYPED_ARRAYS_CASE(RabGsabUint8Clamped
, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) TYPED_ARRAYS_CASE
(RabGsabBigUint64, rab_gsab_biguint64, RAB_GSAB_BIGUINT64, uint64_t
) TYPED_ARRAYS_CASE(RabGsabBigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64
, int64_t)
5258#undef TYPED_ARRAYS_CASE
  default:
    UNREACHABLE()V8_Fatal("unreachable code");
}
5262}

5264void CopyTypedArrayElementsSlice(Address raw_source, Address raw_destination,
                               uintptr_t start, uintptr_t end) {
JSTypedArray source = JSTypedArray::cast(Object(raw_source));
JSTypedArray destination = JSTypedArray::cast(Object(raw_destination));

destination.GetElementsAccessor()->CopyTypedArrayElementsSlice(
    source, destination, start, end);
5271}

5273void ElementsAccessor::InitializeOncePerProcess() {
static ElementsAccessor* accessor_array[] = {
5275#define ACCESSOR_ARRAY(Class, Kind, Store) new Class(),
    ELEMENTS_LIST(ACCESSOR_ARRAY)
5277#undef ACCESSOR_ARRAY
};

STATIC_ASSERT((sizeof(accessor_array) / sizeof(*accessor_array)) ==static_assert((sizeof(accessor_array) / sizeof(*accessor_array
)) == kElementsKindCount, "(sizeof(accessor_array) / sizeof(*accessor_array)) == kElementsKindCount"
)
              kElementsKindCount)static_assert((sizeof(accessor_array) / sizeof(*accessor_array
)) == kElementsKindCount, "(sizeof(accessor_array) / sizeof(*accessor_array)) == kElementsKindCount"
);

elements_accessors_ = accessor_array;
5284}

5286void ElementsAccessor::TearDown() {
if (elements_accessors_ == nullptr) return;
5288#define ACCESSOR_DELETE(Class, Kind, Store) delete elements_accessors_[Kind];
ELEMENTS_LIST(ACCESSOR_DELETE)
5290#undef ACCESSOR_DELETE
elements_accessors_ = nullptr;
5292}

5294Handle<JSArray> ElementsAccessor::Concat(Isolate* isolate,
                                       BuiltinArguments* args,
                                       uint32_t concat_size,
                                       uint32_t result_len) {
ElementsKind result_elements_kind = GetInitialFastElementsKind();
bool has_raw_doubles = false;
{
  DisallowGarbageCollection no_gc;
  bool is_holey = false;
  for (uint32_t i = 0; i < concat_size; i++) {
    Object arg = (*args)[i];
    ElementsKind arg_kind = JSArray::cast(arg).GetElementsKind();
    has_raw_doubles = has_raw_doubles || IsDoubleElementsKind(arg_kind);
    is_holey = is_holey || IsHoleyElementsKind(arg_kind);
    result_elements_kind =
        GetMoreGeneralElementsKind(result_elements_kind, arg_kind);
  }
  if (is_holey) {
    result_elements_kind = GetHoleyElementsKind(result_elements_kind);
  }
}

// If a double array is concatted into a fast elements array, the fast
// elements array needs to be initialized to contain proper holes, since
// boxing doubles may cause incremental marking.
bool requires_double_boxing =
    has_raw_doubles && !IsDoubleElementsKind(result_elements_kind);
ArrayStorageAllocationMode mode = requires_double_boxing
                                      ? INITIALIZE_ARRAY_ELEMENTS_WITH_HOLE
                                      : DONT_INITIALIZE_ARRAY_ELEMENTS;
Handle<JSArray> result_array = isolate->factory()->NewJSArray(
    result_elements_kind, result_len, result_len, mode);
if (result_len == 0) return result_array;

uint32_t insertion_index = 0;
Handle<FixedArrayBase> storage(result_array->elements(), isolate);
ElementsAccessor* accessor = ElementsAccessor::ForKind(result_elements_kind);
for (uint32_t i = 0; i < concat_size; i++) {
  // It is crucial to keep |array| in a raw pointer form to avoid
  // performance degradation.
  JSArray array = JSArray::cast((*args)[i]);
  uint32_t len = 0;
  array.length().ToArrayLength(&len);
  if (len == 0) continue;
  ElementsKind from_kind = array.GetElementsKind();
  accessor->CopyElements(array, 0, from_kind, storage, insertion_index, len);
  insertion_index += len;
}

DCHECK_EQ(insertion_index, result_len)((void) 0);
return result_array;
5345}

5347ElementsAccessor** ElementsAccessor::elements_accessors_ = nullptr;

5349#undef ELEMENTS_LIST
5350#undef RETURN_NOTHING_IF_NOT_SUCCESSFUL
5351#undef RETURN_FAILURE_IF_NOT_SUCCESSFUL
5352}  // namespace internal
5353}  // namespace v8