LCOV - code coverage report
Current view: top level - src - bootstrapper.cc (source / functions) Hit Total Coverage
Test: app.info Lines: 2136 2176 98.2 %
Date: 2019-01-20 Functions: 107 122 87.7 %

          Line data    Source code
       1             : // Copyright 2014 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #include "src/bootstrapper.h"
       6             : 
       7             : #include "src/accessors.h"
       8             : #include "src/api-inl.h"
       9             : #include "src/api-natives.h"
      10             : #include "src/base/ieee754.h"
      11             : #include "src/compiler.h"
      12             : #include "src/counters.h"
      13             : #include "src/debug/debug.h"
      14             : #include "src/extensions/externalize-string-extension.h"
      15             : #include "src/extensions/free-buffer-extension.h"
      16             : #include "src/extensions/gc-extension.h"
      17             : #include "src/extensions/ignition-statistics-extension.h"
      18             : #include "src/extensions/statistics-extension.h"
      19             : #include "src/extensions/trigger-failure-extension.h"
      20             : #include "src/heap/heap.h"
      21             : #include "src/isolate-inl.h"
      22             : #include "src/math-random.h"
      23             : #include "src/objects/api-callbacks.h"
      24             : #include "src/objects/arguments.h"
      25             : #include "src/objects/builtin-function-id.h"
      26             : #include "src/objects/hash-table-inl.h"
      27             : #ifdef V8_INTL_SUPPORT
      28             : #include "src/objects/intl-objects.h"
      29             : #endif  // V8_INTL_SUPPORT
      30             : #include "src/objects/js-array-buffer-inl.h"
      31             : #include "src/objects/js-array-inl.h"
      32             : #ifdef V8_INTL_SUPPORT
      33             : #include "src/objects/js-break-iterator.h"
      34             : #include "src/objects/js-collator.h"
      35             : #include "src/objects/js-date-time-format.h"
      36             : #include "src/objects/js-list-format.h"
      37             : #include "src/objects/js-locale.h"
      38             : #include "src/objects/js-number-format.h"
      39             : #include "src/objects/js-plural-rules.h"
      40             : #endif  // V8_INTL_SUPPORT
      41             : #include "src/objects/js-regexp-string-iterator.h"
      42             : #include "src/objects/js-regexp.h"
      43             : #ifdef V8_INTL_SUPPORT
      44             : #include "src/objects/js-relative-time-format.h"
      45             : #include "src/objects/js-segment-iterator.h"
      46             : #include "src/objects/js-segmenter.h"
      47             : #endif  // V8_INTL_SUPPORT
      48             : #include "src/objects/js-weak-refs.h"
      49             : #include "src/objects/property-cell.h"
      50             : #include "src/objects/slots-inl.h"
      51             : #include "src/objects/templates.h"
      52             : #include "src/snapshot/natives.h"
      53             : #include "src/snapshot/snapshot.h"
      54             : #include "src/wasm/wasm-js.h"
      55             : 
      56             : namespace v8 {
      57             : namespace internal {
      58             : 
      59      125750 : void SourceCodeCache::Initialize(Isolate* isolate, bool create_heap_objects) {
      60             :   cache_ = create_heap_objects ? ReadOnlyRoots(isolate).empty_fixed_array()
      61      125806 :                                : FixedArray();
      62      125750 : }
      63             : 
      64           0 : void SourceCodeCache::Iterate(RootVisitor* v) {
      65      614500 :   v->VisitRootPointer(Root::kExtensions, nullptr, FullObjectSlot(&cache_));
      66           0 : }
      67             : 
      68        4537 : bool SourceCodeCache::Lookup(Isolate* isolate, Vector<const char> name,
      69             :                              Handle<SharedFunctionInfo>* handle) {
      70       20769 :   for (int i = 0; i < cache_->length(); i += 2) {
      71        7152 :     SeqOneByteString str = SeqOneByteString::cast(cache_->get(i));
      72        7152 :     if (str->IsUtf8EqualTo(name)) {
      73             :       *handle = Handle<SharedFunctionInfo>(
      74        2612 :           SharedFunctionInfo::cast(cache_->get(i + 1)), isolate);
      75        1306 :       return true;
      76             :     }
      77             :   }
      78             :   return false;
      79             : }
      80             : 
      81        3194 : void SourceCodeCache::Add(Isolate* isolate, Vector<const char> name,
      82             :                           Handle<SharedFunctionInfo> shared) {
      83             :   Factory* factory = isolate->factory();
      84             :   HandleScope scope(isolate);
      85             :   int length = cache_->length();
      86        3197 :   Handle<FixedArray> new_array = factory->NewFixedArray(length + 2, TENURED);
      87        3189 :   cache_->CopyTo(0, *new_array, 0, cache_->length());
      88        3206 :   cache_ = *new_array;
      89             :   Handle<String> str =
      90             :       factory->NewStringFromOneByte(Vector<const uint8_t>::cast(name), TENURED)
      91        6409 :           .ToHandleChecked();
      92             :   DCHECK(!str.is_null());
      93        3204 :   cache_->set(length, *str);
      94        3204 :   cache_->set(length + 1, *shared);
      95        9607 :   Script::cast(shared->script())->set_type(type_);
      96        3197 : }
      97             : 
      98       62883 : Bootstrapper::Bootstrapper(Isolate* isolate)
      99             :     : isolate_(isolate),
     100             :       nesting_(0),
     101      125766 :       extensions_cache_(Script::TYPE_EXTENSION) {}
     102             : 
     103         111 : Handle<String> Bootstrapper::GetNativeSource(NativeType type, int index) {
     104             :   NativesExternalStringResource* resource =
     105         111 :       new NativesExternalStringResource(type, index);
     106             :   Handle<ExternalOneByteString> source_code =
     107         111 :       isolate_->factory()->NewNativeSourceString(resource);
     108             :   DCHECK(source_code->is_uncached());
     109         111 :   return source_code;
     110             : }
     111             : 
     112       62883 : void Bootstrapper::Initialize(bool create_heap_objects) {
     113       62883 :   extensions_cache_.Initialize(isolate_, create_heap_objects);
     114       62883 : }
     115             : 
     116             : 
     117             : static const char* GCFunctionName() {
     118             :   bool flag_given =
     119       61281 :       FLAG_expose_gc_as != nullptr && strlen(FLAG_expose_gc_as) != 0;
     120       61281 :   return flag_given ? FLAG_expose_gc_as : "gc";
     121             : }
     122             : 
     123             : v8::Extension* Bootstrapper::free_buffer_extension_ = nullptr;
     124             : v8::Extension* Bootstrapper::gc_extension_ = nullptr;
     125             : v8::Extension* Bootstrapper::externalize_string_extension_ = nullptr;
     126             : v8::Extension* Bootstrapper::statistics_extension_ = nullptr;
     127             : v8::Extension* Bootstrapper::trigger_failure_extension_ = nullptr;
     128             : v8::Extension* Bootstrapper::ignition_statistics_extension_ = nullptr;
     129             : 
     130       61281 : void Bootstrapper::InitializeOncePerProcess() {
     131       61281 :   free_buffer_extension_ = new FreeBufferExtension;
     132       61281 :   v8::RegisterExtension(free_buffer_extension_);
     133       61281 :   gc_extension_ = new GCExtension(GCFunctionName());
     134       61281 :   v8::RegisterExtension(gc_extension_);
     135       61281 :   externalize_string_extension_ = new ExternalizeStringExtension;
     136       61281 :   v8::RegisterExtension(externalize_string_extension_);
     137       61281 :   statistics_extension_ = new StatisticsExtension;
     138       61281 :   v8::RegisterExtension(statistics_extension_);
     139       61281 :   trigger_failure_extension_ = new TriggerFailureExtension;
     140       61281 :   v8::RegisterExtension(trigger_failure_extension_);
     141       61281 :   ignition_statistics_extension_ = new IgnitionStatisticsExtension;
     142       61281 :   v8::RegisterExtension(ignition_statistics_extension_);
     143       61281 : }
     144             : 
     145             : 
     146       31878 : void Bootstrapper::TearDownExtensions() {
     147       31878 :   delete free_buffer_extension_;
     148       31878 :   free_buffer_extension_ = nullptr;
     149       31878 :   delete gc_extension_;
     150       31878 :   gc_extension_ = nullptr;
     151       31878 :   delete externalize_string_extension_;
     152       31878 :   externalize_string_extension_ = nullptr;
     153       31878 :   delete statistics_extension_;
     154       31878 :   statistics_extension_ = nullptr;
     155       31878 :   delete trigger_failure_extension_;
     156       31878 :   trigger_failure_extension_ = nullptr;
     157       31878 :   delete ignition_statistics_extension_;
     158       31878 :   ignition_statistics_extension_ = nullptr;
     159       31878 : }
     160             : 
     161       62867 : void Bootstrapper::TearDown() {
     162       62867 :   extensions_cache_.Initialize(isolate_, false);  // Yes, symmetrical
     163       62867 : }
     164             : 
     165             : class Genesis {
     166             :  public:
     167             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     168             :           v8::Local<v8::ObjectTemplate> global_proxy_template,
     169             :           size_t context_snapshot_index,
     170             :           v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer);
     171             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     172             :           v8::Local<v8::ObjectTemplate> global_proxy_template);
     173             :   ~Genesis() = default;
     174             : 
     175             :   Isolate* isolate() const { return isolate_; }
     176             :   Factory* factory() const { return isolate_->factory(); }
     177             :   Builtins* builtins() const { return isolate_->builtins(); }
     178             :   Heap* heap() const { return isolate_->heap(); }
     179             : 
     180             :   Handle<Context> result() { return result_; }
     181             : 
     182             :   Handle<JSGlobalProxy> global_proxy() { return global_proxy_; }
     183             : 
     184             :  private:
     185             :   Handle<NativeContext> native_context() { return native_context_; }
     186             : 
     187             :   // Creates some basic objects. Used for creating a context from scratch.
     188             :   void CreateRoots();
     189             :   // Creates the empty function.  Used for creating a context from scratch.
     190             :   Handle<JSFunction> CreateEmptyFunction();
     191             :   // Returns the %ThrowTypeError% intrinsic function.
     192             :   // See ES#sec-%throwtypeerror% for details.
     193             :   Handle<JSFunction> GetThrowTypeErrorIntrinsic();
     194             : 
     195             :   void CreateSloppyModeFunctionMaps(Handle<JSFunction> empty);
     196             :   void CreateStrictModeFunctionMaps(Handle<JSFunction> empty);
     197             :   void CreateObjectFunction(Handle<JSFunction> empty);
     198             :   void CreateIteratorMaps(Handle<JSFunction> empty);
     199             :   void CreateAsyncIteratorMaps(Handle<JSFunction> empty);
     200             :   void CreateAsyncFunctionMaps(Handle<JSFunction> empty);
     201             :   void CreateJSProxyMaps();
     202             : 
     203             :   // Make the "arguments" and "caller" properties throw a TypeError on access.
     204             :   void AddRestrictedFunctionProperties(Handle<JSFunction> empty);
     205             : 
     206             :   // Creates the global objects using the global proxy and the template passed
     207             :   // in through the API.  We call this regardless of whether we are building a
     208             :   // context from scratch or using a deserialized one from the partial snapshot
     209             :   // but in the latter case we don't use the objects it produces directly, as
     210             :   // we have to use the deserialized ones that are linked together with the
     211             :   // rest of the context snapshot. At the end we link the global proxy and the
     212             :   // context to each other.
     213             :   Handle<JSGlobalObject> CreateNewGlobals(
     214             :       v8::Local<v8::ObjectTemplate> global_proxy_template,
     215             :       Handle<JSGlobalProxy> global_proxy);
     216             :   // Similarly, we want to use the global that has been created by the templates
     217             :   // passed through the API.  The global from the snapshot is detached from the
     218             :   // other objects in the snapshot.
     219             :   void HookUpGlobalObject(Handle<JSGlobalObject> global_object);
     220             :   // Hooks the given global proxy into the context in the case we do not
     221             :   // replace the global object from the deserialized native context.
     222             :   void HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy);
     223             :   // The native context has a ScriptContextTable that store declarative bindings
     224             :   // made in script scopes.  Add a "this" binding to that table pointing to the
     225             :   // global proxy.
     226             :   void InstallGlobalThisBinding();
     227             :   // New context initialization.  Used for creating a context from scratch.
     228             :   void InitializeGlobal(Handle<JSGlobalObject> global_object,
     229             :                         Handle<JSFunction> empty_function);
     230             :   void InitializeExperimentalGlobal();
     231             :   void InitializeIteratorFunctions();
     232             :   void InitializeCallSiteBuiltins();
     233             :   // Depending on the situation, expose and/or get rid of the utils object.
     234             :   void ConfigureUtilsObject();
     235             : 
     236             : #define DECLARE_FEATURE_INITIALIZATION(id, descr) \
     237             :   void InitializeGlobal_##id();
     238             : 
     239             :   HARMONY_INPROGRESS(DECLARE_FEATURE_INITIALIZATION)
     240             :   HARMONY_STAGED(DECLARE_FEATURE_INITIALIZATION)
     241             :   HARMONY_SHIPPING(DECLARE_FEATURE_INITIALIZATION)
     242             : #undef DECLARE_FEATURE_INITIALIZATION
     243             : 
     244             :   enum ArrayBufferKind {
     245             :     ARRAY_BUFFER,
     246             :     SHARED_ARRAY_BUFFER,
     247             :   };
     248             :   Handle<JSFunction> CreateArrayBuffer(Handle<String> name,
     249             :                                        ArrayBufferKind array_buffer_kind);
     250             :   void InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
     251             :                                           const char* name);
     252             :   void InstallInternalPackedArray(Handle<JSObject> target, const char* name);
     253             :   bool InstallNatives();
     254             : 
     255             :   Handle<JSFunction> InstallTypedArray(const char* name,
     256             :                                        ElementsKind elements_kind);
     257             :   bool InstallExtraNatives();
     258             :   void InstallBuiltinFunctionIds();
     259             :   void InitializeNormalizedMapCaches();
     260             : 
     261             :   enum ExtensionTraversalState {
     262             :     UNVISITED, VISITED, INSTALLED
     263             :   };
     264             : 
     265             :   class ExtensionStates {
     266             :    public:
     267             :     ExtensionStates();
     268             :     ExtensionTraversalState get_state(RegisteredExtension* extension);
     269             :     void set_state(RegisteredExtension* extension,
     270             :                    ExtensionTraversalState state);
     271             :    private:
     272             :     base::HashMap map_;
     273             :     DISALLOW_COPY_AND_ASSIGN(ExtensionStates);
     274             :   };
     275             : 
     276             :   // Used both for deserialized and from-scratch contexts to add the extensions
     277             :   // provided.
     278             :   static bool InstallExtensions(Isolate* isolate,
     279             :                                 Handle<Context> native_context,
     280             :                                 v8::ExtensionConfiguration* extensions);
     281             :   static bool InstallAutoExtensions(Isolate* isolate,
     282             :                                     ExtensionStates* extension_states);
     283             :   static bool InstallRequestedExtensions(Isolate* isolate,
     284             :                                          v8::ExtensionConfiguration* extensions,
     285             :                                          ExtensionStates* extension_states);
     286             :   static bool InstallExtension(Isolate* isolate,
     287             :                                const char* name,
     288             :                                ExtensionStates* extension_states);
     289             :   static bool InstallExtension(Isolate* isolate,
     290             :                                v8::RegisteredExtension* current,
     291             :                                ExtensionStates* extension_states);
     292             :   static bool InstallSpecialObjects(Isolate* isolate,
     293             :                                     Handle<Context> native_context);
     294             :   bool ConfigureApiObject(Handle<JSObject> object,
     295             :                           Handle<ObjectTemplateInfo> object_template);
     296             :   bool ConfigureGlobalObjects(
     297             :       v8::Local<v8::ObjectTemplate> global_proxy_template);
     298             : 
     299             :   // Migrates all properties from the 'from' object to the 'to'
     300             :   // object and overrides the prototype in 'to' with the one from
     301             :   // 'from'.
     302             :   void TransferObject(Handle<JSObject> from, Handle<JSObject> to);
     303             :   void TransferNamedProperties(Handle<JSObject> from, Handle<JSObject> to);
     304             :   void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);
     305             : 
     306             :   static bool CompileExtension(Isolate* isolate, v8::Extension* extension);
     307             : 
     308             :   Isolate* isolate_;
     309             :   Handle<Context> result_;
     310             :   Handle<NativeContext> native_context_;
     311             :   Handle<JSGlobalProxy> global_proxy_;
     312             : 
     313             :   // Temporary function maps needed only during bootstrapping.
     314             :   Handle<Map> strict_function_with_home_object_map_;
     315             :   Handle<Map> strict_function_with_name_and_home_object_map_;
     316             : 
     317             :   // %ThrowTypeError%. See ES#sec-%throwtypeerror% for details.
     318             :   Handle<JSFunction> restricted_properties_thrower_;
     319             : 
     320             :   BootstrapperActive active_;
     321             :   friend class Bootstrapper;
     322             : };
     323             : 
     324      307250 : void Bootstrapper::Iterate(RootVisitor* v) {
     325             :   extensions_cache_.Iterate(v);
     326      307250 :   v->Synchronize(VisitorSynchronization::kExtensions);
     327      307250 : }
     328             : 
     329       91890 : Handle<Context> Bootstrapper::CreateEnvironment(
     330             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     331             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
     332             :     v8::ExtensionConfiguration* extensions, size_t context_snapshot_index,
     333             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer) {
     334       91890 :   HandleScope scope(isolate_);
     335             :   Handle<Context> env;
     336             :   {
     337             :     Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template,
     338       91890 :                     context_snapshot_index, embedder_fields_deserializer);
     339             :     env = genesis.result();
     340       91890 :     if (env.is_null() || !InstallExtensions(env, extensions)) {
     341          40 :       return Handle<Context>();
     342             :     }
     343             :   }
     344       91851 :   LogAllMaps();
     345       91851 :   return scope.CloseAndEscape(env);
     346             : }
     347             : 
     348          18 : Handle<JSGlobalProxy> Bootstrapper::NewRemoteContext(
     349             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     350             :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
     351          18 :   HandleScope scope(isolate_);
     352             :   Handle<JSGlobalProxy> global_proxy;
     353             :   {
     354          18 :     Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template);
     355             :     global_proxy = genesis.global_proxy();
     356          18 :     if (global_proxy.is_null()) return Handle<JSGlobalProxy>();
     357             :   }
     358          18 :   LogAllMaps();
     359          18 :   return scope.CloseAndEscape(global_proxy);
     360             : }
     361             : 
     362       91869 : void Bootstrapper::LogAllMaps() {
     363      183738 :   if (!FLAG_trace_maps || isolate_->initialized_from_snapshot()) return;
     364             :   // Log all created Map objects that are on the heap. For snapshots the Map
     365             :   // logging happens during deserialization in order to avoid printing Maps
     366             :   // multiple times during partial deserialization.
     367           0 :   LOG(isolate_, LogAllMaps());
     368             : }
     369             : 
     370         107 : void Bootstrapper::DetachGlobal(Handle<Context> env) {
     371             :   isolate_->counters()->errors_thrown_per_context()->AddSample(
     372         214 :       env->GetErrorsThrown());
     373             : 
     374         107 :   ReadOnlyRoots roots(isolate_);
     375         214 :   Handle<JSGlobalProxy> global_proxy(JSGlobalProxy::cast(env->global_proxy()),
     376         214 :                                      isolate_);
     377         214 :   global_proxy->set_native_context(roots.null_value());
     378         214 :   JSObject::ForceSetPrototype(global_proxy, isolate_->factory()->null_value());
     379         214 :   global_proxy->map()->SetConstructor(roots.null_value());
     380         107 :   if (FLAG_track_detached_contexts) {
     381         107 :     isolate_->AddDetachedContext(env);
     382             :   }
     383         107 : }
     384             : 
     385             : namespace {
     386             : 
     387        1887 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
     388             :     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len,
     389             :     FunctionKind kind = FunctionKind::kNormalFunction) {
     390             :   Handle<SharedFunctionInfo> shared =
     391             :       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
     392        3774 :                                                           kind);
     393             :   shared->set_internal_formal_parameter_count(len);
     394             :   shared->set_length(len);
     395        1887 :   return shared;
     396             : }
     397             : 
     398         111 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateBuiltinSharedFunctionInfo(
     399             :     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len) {
     400             :   Handle<SharedFunctionInfo> shared =
     401             :       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
     402         111 :                                                           kNormalFunction);
     403             :   shared->set_internal_formal_parameter_count(len);
     404             :   shared->set_length(len);
     405         111 :   return shared;
     406             : }
     407             : 
     408      283121 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     409             :     Isolate* isolate, Handle<String> name, InstanceType type, int instance_size,
     410             :     int inobject_properties, Handle<Object> prototype,
     411             :     Builtins::Name builtin_id) {
     412             :   Handle<JSFunction> result;
     413             : 
     414             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
     415             :       name, prototype, type, instance_size, inobject_properties, builtin_id,
     416      283121 :       IMMUTABLE);
     417             : 
     418      283121 :   result = isolate->factory()->NewFunction(args);
     419             :   // Make the JSFunction's prototype object fast.
     420             :   JSObject::MakePrototypesFast(handle(result->prototype(), isolate),
     421      566240 :                                kStartAtReceiver, isolate);
     422             : 
     423             :   // Make the resulting JSFunction object fast.
     424      283121 :   JSObject::MakePrototypesFast(result, kStartAtReceiver, isolate);
     425      283122 :   result->shared()->set_native(true);
     426      283122 :   return result;
     427             : }
     428             : 
     429       92260 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     430             :     Isolate* isolate, const char* name, InstanceType type, int instance_size,
     431             :     int inobject_properties, Handle<Object> prototype,
     432             :     Builtins::Name builtin_id) {
     433             :   return CreateFunction(
     434             :       isolate, isolate->factory()->InternalizeUtf8String(name), type,
     435       92260 :       instance_size, inobject_properties, prototype, builtin_id);
     436             : }
     437             : 
     438      188598 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     439             :     Isolate* isolate, Handle<JSObject> target, Handle<String> name,
     440             :     InstanceType type, int instance_size, int inobject_properties,
     441             :     Handle<Object> prototype, Builtins::Name call) {
     442             :   Handle<JSFunction> function = CreateFunction(
     443      188598 :       isolate, name, type, instance_size, inobject_properties, prototype, call);
     444      188599 :   JSObject::AddProperty(isolate, target, name, function, DONT_ENUM);
     445      188598 :   return function;
     446             : }
     447             : 
     448      187488 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     449             :     Isolate* isolate, Handle<JSObject> target, const char* name,
     450             :     InstanceType type, int instance_size, int inobject_properties,
     451             :     Handle<Object> prototype, Builtins::Name call) {
     452             :   return InstallFunction(isolate, target,
     453             :                          isolate->factory()->InternalizeUtf8String(name), type,
     454      187488 :                          instance_size, inobject_properties, prototype, call);
     455             : }
     456             : 
     457     1439291 : V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,
     458             :                                                     Handle<String> name,
     459             :                                                     Builtins::Name call,
     460             :                                                     int len, bool adapt) {
     461             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
     462     1439291 :       name, call, LanguageMode::kStrict);
     463     1439290 :   Handle<JSFunction> fun = isolate->factory()->NewFunction(args);
     464             :   // Make the resulting JSFunction object fast.
     465     1439293 :   JSObject::MakePrototypesFast(fun, kStartAtReceiver, isolate);
     466     1439292 :   fun->shared()->set_native(true);
     467             : 
     468     1439292 :   if (adapt) {
     469      796072 :     fun->shared()->set_internal_formal_parameter_count(len);
     470             :   } else {
     471     2082514 :     fun->shared()->DontAdaptArguments();
     472             :   }
     473     2878587 :   fun->shared()->set_length(len);
     474     1439294 :   return fun;
     475             : }
     476             : 
     477        3108 : V8_NOINLINE Handle<JSFunction> InstallFunctionWithBuiltinId(
     478             :     Isolate* isolate, Handle<JSObject> base, const char* name,
     479             :     Builtins::Name call, int len, bool adapt, BuiltinFunctionId id) {
     480             :   DCHECK_NE(BuiltinFunctionId::kInvalidBuiltinFunctionId, id);
     481             :   Handle<String> internalized_name =
     482        3108 :       isolate->factory()->InternalizeUtf8String(name);
     483             :   Handle<JSFunction> fun =
     484        3108 :       SimpleCreateFunction(isolate, internalized_name, call, len, adapt);
     485        6216 :   fun->shared()->set_builtin_function_id(id);
     486        3108 :   JSObject::AddProperty(isolate, base, internalized_name, fun, DONT_ENUM);
     487        3108 :   return fun;
     488             : }
     489             : 
     490     1239798 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
     491             :     Isolate* isolate, Handle<JSObject> base, const char* name,
     492             :     Builtins::Name call, int len, bool adapt,
     493             :     PropertyAttributes attrs = DONT_ENUM) {
     494             :   // Although function name does not have to be internalized the property name
     495             :   // will be internalized during property addition anyway, so do it here now.
     496             :   Handle<String> internalized_name =
     497     1239798 :       isolate->factory()->InternalizeUtf8String(name);
     498             :   Handle<JSFunction> fun =
     499     1239799 :       SimpleCreateFunction(isolate, internalized_name, call, len, adapt);
     500     1239801 :   JSObject::AddProperty(isolate, base, internalized_name, fun, attrs);
     501     1239799 :   return fun;
     502             : }
     503             : 
     504       92705 : V8_NOINLINE Handle<JSFunction> InstallFunctionAtSymbol(
     505             :     Isolate* isolate, Handle<JSObject> base, Handle<Symbol> symbol,
     506             :     const char* symbol_string, Builtins::Name call, int len, bool adapt,
     507             :     PropertyAttributes attrs = DONT_ENUM,
     508             :     BuiltinFunctionId id = BuiltinFunctionId::kInvalidBuiltinFunctionId) {
     509             :   Handle<String> internalized_symbol =
     510       92705 :       isolate->factory()->InternalizeUtf8String(symbol_string);
     511             :   Handle<JSFunction> fun =
     512       92705 :       SimpleCreateFunction(isolate, internalized_symbol, call, len, adapt);
     513       92705 :   if (id != BuiltinFunctionId::kInvalidBuiltinFunctionId) {
     514         444 :     fun->shared()->set_builtin_function_id(id);
     515             :   }
     516       92705 :   JSObject::AddProperty(isolate, base, symbol, fun, attrs);
     517       92705 :   return fun;
     518             : }
     519             : 
     520        2220 : V8_NOINLINE void SimpleInstallGetterSetter(Isolate* isolate,
     521             :                                            Handle<JSObject> base,
     522             :                                            Handle<String> name,
     523             :                                            Builtins::Name call_getter,
     524             :                                            Builtins::Name call_setter) {
     525             :   Handle<String> getter_name =
     526        2220 :       Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
     527        4440 :           .ToHandleChecked();
     528             :   Handle<JSFunction> getter =
     529        2220 :       SimpleCreateFunction(isolate, getter_name, call_getter, 0, true);
     530             : 
     531             :   Handle<String> setter_name =
     532        2220 :       Name::ToFunctionName(isolate, name, isolate->factory()->set_string())
     533        4440 :           .ToHandleChecked();
     534             :   Handle<JSFunction> setter =
     535        2220 :       SimpleCreateFunction(isolate, setter_name, call_setter, 1, true);
     536             : 
     537        4440 :   JSObject::DefineAccessor(base, name, getter, setter, DONT_ENUM).Check();
     538        2220 : }
     539             : 
     540        1998 : void SimpleInstallGetterSetter(Isolate* isolate, Handle<JSObject> base,
     541             :                                const char* name, Builtins::Name call_getter,
     542             :                                Builtins::Name call_setter) {
     543             :   SimpleInstallGetterSetter(isolate, base,
     544             :                             isolate->factory()->InternalizeUtf8String(name),
     545        1998 :                             call_getter, call_setter);
     546        1998 : }
     547             : 
     548       98240 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
     549             :     Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
     550             :     Handle<Name> property_name, Builtins::Name call, bool adapt) {
     551             :   Handle<String> getter_name =
     552             :       Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
     553      196480 :           .ToHandleChecked();
     554             :   Handle<JSFunction> getter =
     555       98240 :       SimpleCreateFunction(isolate, getter_name, call, 0, adapt);
     556             : 
     557             :   Handle<Object> setter = isolate->factory()->undefined_value();
     558             : 
     559       98240 :   JSObject::DefineAccessor(base, property_name, getter, setter, DONT_ENUM)
     560      196480 :       .Check();
     561             : 
     562       98240 :   return getter;
     563             : }
     564             : 
     565       97352 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Isolate* isolate,
     566             :                                                    Handle<JSObject> base,
     567             :                                                    Handle<Name> name,
     568             :                                                    Builtins::Name call,
     569             :                                                    bool adapt) {
     570       97352 :   return SimpleInstallGetter(isolate, base, name, name, call, adapt);
     571             : }
     572             : 
     573        1221 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
     574             :     Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
     575             :     Builtins::Name call, bool adapt, BuiltinFunctionId id) {
     576             :   Handle<JSFunction> fun =
     577        1221 :       SimpleInstallGetter(isolate, base, name, call, adapt);
     578        2442 :   fun->shared()->set_builtin_function_id(id);
     579        1221 :   return fun;
     580             : }
     581             : 
     582       97478 : V8_NOINLINE void InstallConstant(Isolate* isolate, Handle<JSObject> holder,
     583             :                                  const char* name, Handle<Object> value) {
     584             :   JSObject::AddProperty(
     585             :       isolate, holder, isolate->factory()->InternalizeUtf8String(name), value,
     586      194956 :       static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     587       97478 : }
     588             : 
     589        1110 : V8_NOINLINE void InstallTrueValuedProperty(Isolate* isolate,
     590             :                                            Handle<JSObject> holder,
     591             :                                            const char* name) {
     592             :   JSObject::AddProperty(isolate, holder,
     593             :                         isolate->factory()->InternalizeUtf8String(name),
     594        2220 :                         isolate->factory()->true_value(), NONE);
     595        1110 : }
     596             : 
     597         888 : V8_NOINLINE void InstallSpeciesGetter(Isolate* isolate,
     598             :                                       Handle<JSFunction> constructor) {
     599             :   Factory* factory = isolate->factory();
     600             :   // TODO(adamk): We should be able to share a SharedFunctionInfo
     601             :   // between all these JSFunctins.
     602             :   SimpleInstallGetter(isolate, constructor, factory->symbol_species_string(),
     603             :                       factory->species_symbol(), Builtins::kReturnReceiver,
     604         888 :                       true);
     605         888 : }
     606             : 
     607      372334 : V8_NOINLINE void InstallToStringTag(Isolate* isolate, Handle<JSObject> holder,
     608             :                                     Handle<String> value) {
     609             :   JSObject::AddProperty(isolate, holder,
     610             :                         isolate->factory()->to_string_tag_symbol(), value,
     611      372334 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     612      372333 : }
     613             : 
     614      368932 : void InstallToStringTag(Isolate* isolate, Handle<JSObject> holder,
     615             :                         const char* value) {
     616             :   InstallToStringTag(isolate, holder,
     617      368932 :                      isolate->factory()->InternalizeUtf8String(value));
     618      368931 : }
     619             : 
     620             : }  // namespace
     621             : 
     622         999 : Handle<JSFunction> Genesis::CreateEmptyFunction() {
     623             :   // Allocate the function map first and then patch the prototype later.
     624             :   Handle<Map> empty_function_map = factory()->CreateSloppyFunctionMap(
     625         222 :       FUNCTION_WITHOUT_PROTOTYPE, MaybeHandle<JSFunction>());
     626             :   empty_function_map->set_is_prototype_map(true);
     627             :   DCHECK(!empty_function_map->is_dictionary_map());
     628             : 
     629             :   // Allocate ScopeInfo for the empty function.
     630         111 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateForEmptyFunction(isolate());
     631             : 
     632             :   // Allocate the empty function as the prototype for function according to
     633             :   // ES#sec-properties-of-the-function-prototype-object
     634             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
     635         111 :       factory()->empty_string(), empty_function_map, Builtins::kEmptyFunction);
     636         111 :   Handle<JSFunction> empty_function = factory()->NewFunction(args);
     637         111 :   native_context()->set_empty_function(*empty_function);
     638             : 
     639             :   // --- E m p t y ---
     640         111 :   Handle<String> source = factory()->NewStringFromStaticChars("() {}");
     641         111 :   Handle<Script> script = factory()->NewScript(source);
     642             :   script->set_type(Script::TYPE_NATIVE);
     643         111 :   Handle<WeakFixedArray> infos = factory()->NewWeakFixedArray(2);
     644         111 :   script->set_shared_function_infos(*infos);
     645         111 :   empty_function->shared()->set_scope_info(*scope_info);
     646         222 :   empty_function->shared()->DontAdaptArguments();
     647             :   SharedFunctionInfo::SetScript(handle(empty_function->shared(), isolate()),
     648         222 :                                 script, 1);
     649             : 
     650         111 :   return empty_function;
     651             : }
     652             : 
     653         111 : void Genesis::CreateSloppyModeFunctionMaps(Handle<JSFunction> empty) {
     654         111 :   Factory* factory = isolate_->factory();
     655             :   Handle<Map> map;
     656             : 
     657             :   //
     658             :   // Allocate maps for sloppy functions without prototype.
     659             :   //
     660         111 :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     661         111 :   native_context()->set_sloppy_function_without_prototype_map(*map);
     662             : 
     663             :   //
     664             :   // Allocate maps for sloppy functions with readonly prototype.
     665             :   //
     666             :   map =
     667         111 :       factory->CreateSloppyFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     668         111 :   native_context()->set_sloppy_function_with_readonly_prototype_map(*map);
     669             : 
     670             :   //
     671             :   // Allocate maps for sloppy functions with writable prototype.
     672             :   //
     673             :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     674         111 :                                          empty);
     675         111 :   native_context()->set_sloppy_function_map(*map);
     676             : 
     677             :   map = factory->CreateSloppyFunctionMap(
     678         111 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     679         111 :   native_context()->set_sloppy_function_with_name_map(*map);
     680         111 : }
     681             : 
     682         777 : Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {
     683         222 :   if (!restricted_properties_thrower_.is_null()) {
     684         111 :     return restricted_properties_thrower_;
     685             :   }
     686         111 :   Handle<String> name = factory()->empty_string();
     687             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
     688         111 :       name, Builtins::kStrictPoisonPillThrower, i::LanguageMode::kStrict);
     689         111 :   Handle<JSFunction> function = factory()->NewFunction(args);
     690         222 :   function->shared()->DontAdaptArguments();
     691             : 
     692             :   // %ThrowTypeError% must not have a name property.
     693         111 :   if (JSReceiver::DeleteProperty(function, factory()->name_string())
     694         111 :           .IsNothing()) {
     695             :     DCHECK(false);
     696             :   }
     697             : 
     698             :   // length needs to be non configurable.
     699         222 :   Handle<Object> value(Smi::FromInt(function->shared()->GetLength()),
     700             :                        isolate());
     701             :   JSObject::SetOwnPropertyIgnoreAttributes(
     702             :       function, factory()->length_string(), value,
     703         111 :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))
     704         111 :       .Assert();
     705             : 
     706         111 :   if (JSObject::PreventExtensions(function, kThrowOnError).IsNothing()) {
     707             :     DCHECK(false);
     708             :   }
     709             : 
     710         111 :   JSObject::MigrateSlowToFast(function, 0, "Bootstrapping");
     711             : 
     712         111 :   restricted_properties_thrower_ = function;
     713         111 :   return function;
     714             : }
     715             : 
     716         111 : void Genesis::CreateStrictModeFunctionMaps(Handle<JSFunction> empty) {
     717         111 :   Factory* factory = isolate_->factory();
     718             :   Handle<Map> map;
     719             : 
     720             :   //
     721             :   // Allocate maps for strict functions without prototype.
     722             :   //
     723         111 :   map = factory->CreateStrictFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     724         111 :   native_context()->set_strict_function_without_prototype_map(*map);
     725             : 
     726         111 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_NAME, empty);
     727         111 :   native_context()->set_method_with_name_map(*map);
     728             : 
     729         111 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_HOME_OBJECT, empty);
     730         111 :   native_context()->set_method_with_home_object_map(*map);
     731             : 
     732             :   map =
     733         111 :       factory->CreateStrictFunctionMap(METHOD_WITH_NAME_AND_HOME_OBJECT, empty);
     734         111 :   native_context()->set_method_with_name_and_home_object_map(*map);
     735             : 
     736             :   //
     737             :   // Allocate maps for strict functions with writable prototype.
     738             :   //
     739             :   map = factory->CreateStrictFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     740         111 :                                          empty);
     741         111 :   native_context()->set_strict_function_map(*map);
     742             : 
     743             :   map = factory->CreateStrictFunctionMap(
     744         111 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     745         111 :   native_context()->set_strict_function_with_name_map(*map);
     746             : 
     747             :   strict_function_with_home_object_map_ = factory->CreateStrictFunctionMap(
     748         111 :       FUNCTION_WITH_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     749             :   strict_function_with_name_and_home_object_map_ =
     750             :       factory->CreateStrictFunctionMap(
     751         111 :           FUNCTION_WITH_NAME_AND_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     752             : 
     753             :   //
     754             :   // Allocate maps for strict functions with readonly prototype.
     755             :   //
     756             :   map =
     757         111 :       factory->CreateStrictFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     758         111 :   native_context()->set_strict_function_with_readonly_prototype_map(*map);
     759             : 
     760             :   //
     761             :   // Allocate map for class functions.
     762             :   //
     763         111 :   map = factory->CreateClassFunctionMap(empty);
     764         111 :   native_context()->set_class_function_map(*map);
     765             : 
     766             :   // Now that the strict mode function map is available, set up the
     767             :   // restricted "arguments" and "caller" getters.
     768         111 :   AddRestrictedFunctionProperties(empty);
     769         111 : }
     770             : 
     771         888 : void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
     772         111 :   Factory* factory = isolate_->factory();
     773             : 
     774             :   // --- O b j e c t ---
     775             :   int inobject_properties = JSObject::kInitialGlobalObjectUnusedPropertiesCount;
     776             :   int instance_size = JSObject::kHeaderSize + kTaggedSize * inobject_properties;
     777             : 
     778             :   Handle<JSFunction> object_fun = CreateFunction(
     779             :       isolate_, factory->Object_string(), JS_OBJECT_TYPE, instance_size,
     780         111 :       inobject_properties, factory->null_value(), Builtins::kObjectConstructor);
     781         222 :   object_fun->shared()->set_length(1);
     782         222 :   object_fun->shared()->DontAdaptArguments();
     783         111 :   native_context()->set_object_function(*object_fun);
     784             : 
     785             :   {
     786             :     // Finish setting up Object function's initial map.
     787         111 :     Map initial_map = object_fun->initial_map();
     788         111 :     initial_map->set_elements_kind(HOLEY_ELEMENTS);
     789             :   }
     790             : 
     791             :   // Allocate a new prototype for the object function.
     792             :   Handle<JSObject> object_function_prototype =
     793         111 :       factory->NewFunctionPrototype(object_fun);
     794             : 
     795             :   Handle<Map> map =
     796             :       Map::Copy(isolate(), handle(object_function_prototype->map(), isolate()),
     797         111 :                 "EmptyObjectPrototype");
     798             :   map->set_is_prototype_map(true);
     799             :   // Ban re-setting Object.prototype.__proto__ to prevent Proxy security bug
     800         111 :   map->set_is_immutable_proto(true);
     801         111 :   object_function_prototype->set_map(*map);
     802             : 
     803             :   // Complete setting up empty function.
     804             :   {
     805         111 :     Handle<Map> empty_function_map(empty_function->map(), isolate_);
     806         111 :     Map::SetPrototype(isolate(), empty_function_map, object_function_prototype);
     807             :   }
     808             : 
     809         111 :   native_context()->set_initial_object_prototype(*object_function_prototype);
     810         111 :   JSFunction::SetPrototype(object_fun, object_function_prototype);
     811             : 
     812             :   {
     813             :     // Set up slow map for Object.create(null) instances without in-object
     814             :     // properties.
     815         333 :     Handle<Map> map(object_fun->initial_map(), isolate_);
     816         111 :     map = Map::CopyInitialMapNormalized(isolate(), map);
     817         111 :     Map::SetPrototype(isolate(), map, factory->null_value());
     818         111 :     native_context()->set_slow_object_with_null_prototype_map(*map);
     819             : 
     820             :     // Set up slow map for literals with too many properties.
     821         111 :     map = Map::Copy(isolate(), map, "slow_object_with_object_prototype_map");
     822         111 :     Map::SetPrototype(isolate(), map, object_function_prototype);
     823         111 :     native_context()->set_slow_object_with_object_prototype_map(*map);
     824             :   }
     825         111 : }
     826             : 
     827             : namespace {
     828             : 
     829         888 : Handle<Map> CreateNonConstructorMap(Isolate* isolate, Handle<Map> source_map,
     830             :                                     Handle<JSObject> prototype,
     831             :                                     const char* reason) {
     832         888 :   Handle<Map> map = Map::Copy(isolate, source_map, reason);
     833             :   // Ensure the resulting map has prototype slot (it is necessary for storing
     834             :   // inital map even when the prototype property is not required).
     835         888 :   if (!map->has_prototype_slot()) {
     836             :     // Re-set the unused property fields after changing the instance size.
     837             :     // TODO(ulan): Do not change instance size after map creation.
     838           0 :     int unused_property_fields = map->UnusedPropertyFields();
     839           0 :     map->set_instance_size(map->instance_size() + kTaggedSize);
     840             :     // The prototype slot shifts the in-object properties area by one slot.
     841             :     map->SetInObjectPropertiesStartInWords(
     842           0 :         map->GetInObjectPropertiesStartInWords() + 1);
     843             :     map->set_has_prototype_slot(true);
     844           0 :     map->SetInObjectUnusedPropertyFields(unused_property_fields);
     845             :   }
     846             :   map->set_is_constructor(false);
     847         888 :   Map::SetPrototype(isolate, map, prototype);
     848         888 :   return map;
     849             : }
     850             : 
     851             : }  // namespace
     852             : 
     853        2664 : void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
     854             :   // Create iterator-related meta-objects.
     855             :   Handle<JSObject> iterator_prototype =
     856         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     857             : 
     858             :   InstallFunctionAtSymbol(isolate(), iterator_prototype,
     859             :                           factory()->iterator_symbol(), "[Symbol.iterator]",
     860         111 :                           Builtins::kReturnReceiver, 0, true);
     861         111 :   native_context()->set_initial_iterator_prototype(*iterator_prototype);
     862             : 
     863             :   Handle<JSObject> generator_object_prototype =
     864         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     865         222 :   native_context()->set_initial_generator_prototype(
     866         111 :       *generator_object_prototype);
     867         111 :   JSObject::ForceSetPrototype(generator_object_prototype, iterator_prototype);
     868             :   Handle<JSObject> generator_function_prototype =
     869         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     870         111 :   JSObject::ForceSetPrototype(generator_function_prototype, empty);
     871             : 
     872             :   InstallToStringTag(isolate(), generator_function_prototype,
     873         111 :                      "GeneratorFunction");
     874             :   JSObject::AddProperty(isolate(), generator_function_prototype,
     875             :                         factory()->prototype_string(),
     876             :                         generator_object_prototype,
     877         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     878             : 
     879             :   JSObject::AddProperty(isolate(), generator_object_prototype,
     880             :                         factory()->constructor_string(),
     881             :                         generator_function_prototype,
     882         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     883         111 :   InstallToStringTag(isolate(), generator_object_prototype, "Generator");
     884             :   SimpleInstallFunction(isolate(), generator_object_prototype, "next",
     885         111 :                         Builtins::kGeneratorPrototypeNext, 1, false);
     886             :   SimpleInstallFunction(isolate(), generator_object_prototype, "return",
     887         111 :                         Builtins::kGeneratorPrototypeReturn, 1, false);
     888             :   SimpleInstallFunction(isolate(), generator_object_prototype, "throw",
     889         111 :                         Builtins::kGeneratorPrototypeThrow, 1, false);
     890             : 
     891             :   // Internal version of generator_prototype_next, flagged as non-native such
     892             :   // that it doesn't show up in Error traces.
     893             :   Handle<JSFunction> generator_next_internal =
     894             :       SimpleCreateFunction(isolate(), factory()->next_string(),
     895         111 :                            Builtins::kGeneratorPrototypeNext, 1, false);
     896         111 :   generator_next_internal->shared()->set_native(false);
     897         111 :   native_context()->set_generator_next_internal(*generator_next_internal);
     898             : 
     899             :   // Create maps for generator functions and their prototypes.  Store those
     900             :   // maps in the native context. The "prototype" property descriptor is
     901             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     902             :   // 04-14-15, section 25.2.4.3).
     903             :   // Generator functions do not have "caller" or "arguments" accessors.
     904             :   Handle<Map> map;
     905             :   map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
     906             :                                 generator_function_prototype,
     907         222 :                                 "GeneratorFunction");
     908         111 :   native_context()->set_generator_function_map(*map);
     909             : 
     910             :   map = CreateNonConstructorMap(
     911             :       isolate(), isolate()->strict_function_with_name_map(),
     912         222 :       generator_function_prototype, "GeneratorFunction with name");
     913         111 :   native_context()->set_generator_function_with_name_map(*map);
     914             : 
     915             :   map = CreateNonConstructorMap(
     916             :       isolate(), strict_function_with_home_object_map_,
     917         111 :       generator_function_prototype, "GeneratorFunction with home object");
     918         111 :   native_context()->set_generator_function_with_home_object_map(*map);
     919             : 
     920             :   map = CreateNonConstructorMap(isolate(),
     921             :                                 strict_function_with_name_and_home_object_map_,
     922             :                                 generator_function_prototype,
     923         111 :                                 "GeneratorFunction with name and home object");
     924         111 :   native_context()->set_generator_function_with_name_and_home_object_map(*map);
     925             : 
     926         222 :   Handle<JSFunction> object_function(native_context()->object_function(),
     927         111 :                                      isolate());
     928         111 :   Handle<Map> generator_object_prototype_map = Map::Create(isolate(), 0);
     929             :   Map::SetPrototype(isolate(), generator_object_prototype_map,
     930         111 :                     generator_object_prototype);
     931         222 :   native_context()->set_generator_object_prototype_map(
     932         111 :       *generator_object_prototype_map);
     933         111 : }
     934             : 
     935        3441 : void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
     936             :   // %AsyncIteratorPrototype%
     937             :   // proposal-async-iteration/#sec-asynciteratorprototype
     938             :   Handle<JSObject> async_iterator_prototype =
     939         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     940             : 
     941             :   InstallFunctionAtSymbol(
     942             :       isolate(), async_iterator_prototype, factory()->async_iterator_symbol(),
     943         111 :       "[Symbol.asyncIterator]", Builtins::kReturnReceiver, 0, true);
     944             : 
     945             :   // %AsyncFromSyncIteratorPrototype%
     946             :   // proposal-async-iteration/#sec-%asyncfromsynciteratorprototype%-object
     947             :   Handle<JSObject> async_from_sync_iterator_prototype =
     948         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     949             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "next",
     950         111 :                         Builtins::kAsyncFromSyncIteratorPrototypeNext, 1, true);
     951             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "return",
     952             :                         Builtins::kAsyncFromSyncIteratorPrototypeReturn, 1,
     953         111 :                         true);
     954             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "throw",
     955             :                         Builtins::kAsyncFromSyncIteratorPrototypeThrow, 1,
     956         111 :                         true);
     957             : 
     958             :   InstallToStringTag(isolate(), async_from_sync_iterator_prototype,
     959         111 :                      "Async-from-Sync Iterator");
     960             : 
     961             :   JSObject::ForceSetPrototype(async_from_sync_iterator_prototype,
     962         111 :                               async_iterator_prototype);
     963             : 
     964             :   Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
     965         111 :       JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
     966             :   Map::SetPrototype(isolate(), async_from_sync_iterator_map,
     967         111 :                     async_from_sync_iterator_prototype);
     968         222 :   native_context()->set_async_from_sync_iterator_map(
     969         111 :       *async_from_sync_iterator_map);
     970             : 
     971             :   // Async Generators
     972             :   Handle<JSObject> async_generator_object_prototype =
     973         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     974             :   Handle<JSObject> async_generator_function_prototype =
     975         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     976             : 
     977             :   // %AsyncGenerator% / %AsyncGeneratorFunction%.prototype
     978         111 :   JSObject::ForceSetPrototype(async_generator_function_prototype, empty);
     979             : 
     980             :   // The value of AsyncGeneratorFunction.prototype.prototype is the
     981             :   //     %AsyncGeneratorPrototype% intrinsic object.
     982             :   // This property has the attributes
     983             :   //     { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
     984             :   JSObject::AddProperty(isolate(), async_generator_function_prototype,
     985             :                         factory()->prototype_string(),
     986             :                         async_generator_object_prototype,
     987         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     988             :   JSObject::AddProperty(isolate(), async_generator_object_prototype,
     989             :                         factory()->constructor_string(),
     990             :                         async_generator_function_prototype,
     991         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     992             :   InstallToStringTag(isolate(), async_generator_function_prototype,
     993         111 :                      "AsyncGeneratorFunction");
     994             : 
     995             :   // %AsyncGeneratorPrototype%
     996             :   JSObject::ForceSetPrototype(async_generator_object_prototype,
     997         111 :                               async_iterator_prototype);
     998         222 :   native_context()->set_initial_async_generator_prototype(
     999         111 :       *async_generator_object_prototype);
    1000             : 
    1001             :   InstallToStringTag(isolate(), async_generator_object_prototype,
    1002         111 :                      "AsyncGenerator");
    1003             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "next",
    1004         111 :                         Builtins::kAsyncGeneratorPrototypeNext, 1, false);
    1005             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "return",
    1006         111 :                         Builtins::kAsyncGeneratorPrototypeReturn, 1, false);
    1007             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "throw",
    1008         111 :                         Builtins::kAsyncGeneratorPrototypeThrow, 1, false);
    1009             : 
    1010             :   // Create maps for generator functions and their prototypes.  Store those
    1011             :   // maps in the native context. The "prototype" property descriptor is
    1012             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
    1013             :   // 04-14-15, section 25.2.4.3).
    1014             :   // Async Generator functions do not have "caller" or "arguments" accessors.
    1015             :   Handle<Map> map;
    1016             :   map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
    1017             :                                 async_generator_function_prototype,
    1018         222 :                                 "AsyncGeneratorFunction");
    1019         111 :   native_context()->set_async_generator_function_map(*map);
    1020             : 
    1021             :   map = CreateNonConstructorMap(
    1022             :       isolate(), isolate()->strict_function_with_name_map(),
    1023         222 :       async_generator_function_prototype, "AsyncGeneratorFunction with name");
    1024         111 :   native_context()->set_async_generator_function_with_name_map(*map);
    1025             : 
    1026             :   map =
    1027             :       CreateNonConstructorMap(isolate(), strict_function_with_home_object_map_,
    1028             :                               async_generator_function_prototype,
    1029         111 :                               "AsyncGeneratorFunction with home object");
    1030         111 :   native_context()->set_async_generator_function_with_home_object_map(*map);
    1031             : 
    1032             :   map = CreateNonConstructorMap(
    1033             :       isolate(), strict_function_with_name_and_home_object_map_,
    1034             :       async_generator_function_prototype,
    1035         111 :       "AsyncGeneratorFunction with name and home object");
    1036         222 :   native_context()->set_async_generator_function_with_name_and_home_object_map(
    1037         111 :       *map);
    1038             : 
    1039         222 :   Handle<JSFunction> object_function(native_context()->object_function(),
    1040         111 :                                      isolate());
    1041         111 :   Handle<Map> async_generator_object_prototype_map = Map::Create(isolate(), 0);
    1042             :   Map::SetPrototype(isolate(), async_generator_object_prototype_map,
    1043         111 :                     async_generator_object_prototype);
    1044         222 :   native_context()->set_async_generator_object_prototype_map(
    1045         111 :       *async_generator_object_prototype_map);
    1046         111 : }
    1047             : 
    1048        1665 : void Genesis::CreateAsyncFunctionMaps(Handle<JSFunction> empty) {
    1049             :   // %AsyncFunctionPrototype% intrinsic
    1050             :   Handle<JSObject> async_function_prototype =
    1051         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    1052         111 :   JSObject::ForceSetPrototype(async_function_prototype, empty);
    1053             : 
    1054         111 :   InstallToStringTag(isolate(), async_function_prototype, "AsyncFunction");
    1055             : 
    1056             :   Handle<Map> map =
    1057             :       Map::Copy(isolate(), isolate()->strict_function_without_prototype_map(),
    1058         222 :                 "AsyncFunction");
    1059         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1060         111 :   native_context()->set_async_function_map(*map);
    1061             : 
    1062             :   map = Map::Copy(isolate(), isolate()->method_with_name_map(),
    1063         222 :                   "AsyncFunction with name");
    1064         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1065         111 :   native_context()->set_async_function_with_name_map(*map);
    1066             : 
    1067             :   map = Map::Copy(isolate(), isolate()->method_with_home_object_map(),
    1068         222 :                   "AsyncFunction with home object");
    1069         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1070         111 :   native_context()->set_async_function_with_home_object_map(*map);
    1071             : 
    1072             :   map = Map::Copy(isolate(), isolate()->method_with_name_and_home_object_map(),
    1073         222 :                   "AsyncFunction with name and home object");
    1074         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1075         111 :   native_context()->set_async_function_with_name_and_home_object_map(*map);
    1076         111 : }
    1077             : 
    1078         888 : void Genesis::CreateJSProxyMaps() {
    1079             :   // Allocate maps for all Proxy types.
    1080             :   // Next to the default proxy, we need maps indicating callable and
    1081             :   // constructable proxies.
    1082             :   Handle<Map> proxy_map = factory()->NewMap(JS_PROXY_TYPE, JSProxy::kSize,
    1083         111 :                                             TERMINAL_FAST_ELEMENTS_KIND);
    1084         111 :   proxy_map->set_is_dictionary_map(true);
    1085         111 :   proxy_map->set_may_have_interesting_symbols(true);
    1086         111 :   native_context()->set_proxy_map(*proxy_map);
    1087             : 
    1088             :   Handle<Map> proxy_callable_map =
    1089         111 :       Map::Copy(isolate_, proxy_map, "callable Proxy");
    1090             :   proxy_callable_map->set_is_callable(true);
    1091         111 :   native_context()->set_proxy_callable_map(*proxy_callable_map);
    1092         222 :   proxy_callable_map->SetConstructor(native_context()->function_function());
    1093             : 
    1094             :   Handle<Map> proxy_constructor_map =
    1095         111 :       Map::Copy(isolate_, proxy_callable_map, "constructor Proxy");
    1096             :   proxy_constructor_map->set_is_constructor(true);
    1097         111 :   native_context()->set_proxy_constructor_map(*proxy_constructor_map);
    1098             : 
    1099             :   {
    1100             :     Handle<Map> map =
    1101             :         factory()->NewMap(JS_OBJECT_TYPE, JSProxyRevocableResult::kSize,
    1102         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 2);
    1103         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    1104             : 
    1105             :     {  // proxy
    1106             :       Descriptor d = Descriptor::DataField(isolate(), factory()->proxy_string(),
    1107             :                                            JSProxyRevocableResult::kProxyIndex,
    1108         111 :                                            NONE, Representation::Tagged());
    1109         111 :       map->AppendDescriptor(isolate(), &d);
    1110             :     }
    1111             :     {  // revoke
    1112             :       Descriptor d = Descriptor::DataField(
    1113             :           isolate(), factory()->revoke_string(),
    1114         111 :           JSProxyRevocableResult::kRevokeIndex, NONE, Representation::Tagged());
    1115         111 :       map->AppendDescriptor(isolate(), &d);
    1116             :     }
    1117             : 
    1118         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    1119         222 :     map->SetConstructor(native_context()->object_function());
    1120             : 
    1121         111 :     native_context()->set_proxy_revocable_result_map(*map);
    1122             :   }
    1123         111 : }
    1124             : 
    1125             : namespace {
    1126         222 : void ReplaceAccessors(Isolate* isolate, Handle<Map> map, Handle<String> name,
    1127             :                       PropertyAttributes attributes,
    1128             :                       Handle<AccessorPair> accessor_pair) {
    1129         222 :   DescriptorArray descriptors = map->instance_descriptors();
    1130             :   int idx = descriptors->SearchWithCache(isolate, *name, *map);
    1131         222 :   Descriptor d = Descriptor::AccessorConstant(name, accessor_pair, attributes);
    1132         222 :   descriptors->Replace(idx, &d);
    1133         222 : }
    1134             : }  // namespace
    1135             : 
    1136         555 : void Genesis::AddRestrictedFunctionProperties(Handle<JSFunction> empty) {
    1137             :   PropertyAttributes rw_attribs = static_cast<PropertyAttributes>(DONT_ENUM);
    1138         111 :   Handle<JSFunction> thrower = GetThrowTypeErrorIntrinsic();
    1139         111 :   Handle<AccessorPair> accessors = factory()->NewAccessorPair();
    1140         222 :   accessors->set_getter(*thrower);
    1141         222 :   accessors->set_setter(*thrower);
    1142             : 
    1143             :   Handle<Map> map(empty->map(), isolate());
    1144             :   ReplaceAccessors(isolate(), map, factory()->arguments_string(), rw_attribs,
    1145         111 :                    accessors);
    1146             :   ReplaceAccessors(isolate(), map, factory()->caller_string(), rw_attribs,
    1147         111 :                    accessors);
    1148         111 : }
    1149             : 
    1150       91891 : static void AddToWeakNativeContextList(Isolate* isolate, Context context) {
    1151             :   DCHECK(context->IsNativeContext());
    1152             :   Heap* heap = isolate->heap();
    1153             : #ifdef DEBUG
    1154             :   { // NOLINT
    1155             :     DCHECK(context->next_context_link()->IsUndefined(isolate));
    1156             :     // Check that context is not in the list yet.
    1157             :     for (Object current = heap->native_contexts_list();
    1158             :          !current->IsUndefined(isolate);
    1159             :          current = Context::cast(current)->next_context_link()) {
    1160             :       DCHECK(current != context);
    1161             :     }
    1162             :   }
    1163             : #endif
    1164             :   context->set(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list(),
    1165             :                UPDATE_WEAK_WRITE_BARRIER);
    1166             :   heap->set_native_contexts_list(context);
    1167       91891 : }
    1168             : 
    1169             : 
    1170         444 : void Genesis::CreateRoots() {
    1171             :   // Allocate the native context FixedArray first and then patch the
    1172             :   // closure and extension object later (we need the empty function
    1173             :   // and the global object, but in order to create those, we need the
    1174             :   // native context).
    1175         111 :   native_context_ = factory()->NewNativeContext();
    1176         222 :   AddToWeakNativeContextList(isolate(), *native_context());
    1177             :   isolate()->set_context(*native_context());
    1178             : 
    1179             :   // Allocate the message listeners object.
    1180             :   {
    1181         111 :     Handle<TemplateList> list = TemplateList::New(isolate(), 1);
    1182         111 :     native_context()->set_message_listeners(*list);
    1183             :   }
    1184         111 : }
    1185             : 
    1186             : 
    1187         333 : void Genesis::InstallGlobalThisBinding() {
    1188             :   Handle<ScriptContextTable> script_contexts(
    1189         222 :       native_context()->script_context_table(), isolate());
    1190         111 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateGlobalThisBinding(isolate());
    1191             :   Handle<Context> context =
    1192         111 :       factory()->NewScriptContext(native_context(), scope_info);
    1193             : 
    1194             :   // Go ahead and hook it up while we're at it.
    1195         111 :   int slot = scope_info->ReceiverContextSlotIndex();
    1196             :   DCHECK_EQ(slot, Context::MIN_CONTEXT_SLOTS);
    1197         333 :   context->set(slot, native_context()->global_proxy());
    1198             : 
    1199             :   Handle<ScriptContextTable> new_script_contexts =
    1200         111 :       ScriptContextTable::Extend(script_contexts, context);
    1201         111 :   native_context()->set_script_context_table(*new_script_contexts);
    1202         111 : }
    1203             : 
    1204             : 
    1205       91851 : Handle<JSGlobalObject> Genesis::CreateNewGlobals(
    1206             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    1207      751585 :     Handle<JSGlobalProxy> global_proxy) {
    1208             :   // The argument global_proxy_template aka data is an ObjectTemplateInfo.
    1209             :   // It has a constructor pointer that points at global_constructor which is a
    1210             :   // FunctionTemplateInfo.
    1211             :   // The global_proxy_constructor is used to (re)initialize the
    1212             :   // global_proxy. The global_proxy_constructor also has a prototype_template
    1213             :   // pointer that points at js_global_object_template which is an
    1214             :   // ObjectTemplateInfo.
    1215             :   // That in turn has a constructor pointer that points at
    1216             :   // js_global_object_constructor which is a FunctionTemplateInfo.
    1217             :   // js_global_object_constructor is used to make js_global_object_function
    1218             :   // js_global_object_function is used to make the new global_object.
    1219             :   //
    1220             :   // --- G l o b a l ---
    1221             :   // Step 1: Create a fresh JSGlobalObject.
    1222             :   Handle<JSFunction> js_global_object_function;
    1223             :   Handle<ObjectTemplateInfo> js_global_object_template;
    1224       91851 :   if (!global_proxy_template.IsEmpty()) {
    1225             :     // Get prototype template of the global_proxy_template.
    1226             :     Handle<ObjectTemplateInfo> data =
    1227             :         v8::Utils::OpenHandle(*global_proxy_template);
    1228             :     Handle<FunctionTemplateInfo> global_constructor =
    1229             :         Handle<FunctionTemplateInfo>(
    1230      108628 :             FunctionTemplateInfo::cast(data->constructor()), isolate());
    1231             :     Handle<Object> proto_template(global_constructor->GetPrototypeTemplate(),
    1232      108628 :                                   isolate());
    1233      108628 :     if (!proto_template->IsUndefined(isolate())) {
    1234             :       js_global_object_template =
    1235       54314 :           Handle<ObjectTemplateInfo>::cast(proto_template);
    1236             :     }
    1237             :   }
    1238             : 
    1239       91851 :   if (js_global_object_template.is_null()) {
    1240       37537 :     Handle<String> name = factory()->empty_string();
    1241             :     Handle<JSObject> prototype =
    1242       75074 :         factory()->NewFunctionPrototype(isolate()->object_function());
    1243             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1244             :         name, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize, 0,
    1245       37537 :         Builtins::kIllegal, MUTABLE);
    1246       37537 :     js_global_object_function = factory()->NewFunction(args);
    1247             : #ifdef DEBUG
    1248             :     LookupIterator it(isolate(), prototype, factory()->constructor_string(),
    1249             :                       LookupIterator::OWN_SKIP_INTERCEPTOR);
    1250             :     Handle<Object> value = Object::GetProperty(&it).ToHandleChecked();
    1251             :     DCHECK(it.IsFound());
    1252             :     DCHECK_EQ(*isolate()->object_function(), *value);
    1253             : #endif
    1254             :   } else {
    1255             :     Handle<FunctionTemplateInfo> js_global_object_constructor(
    1256             :         FunctionTemplateInfo::cast(js_global_object_template->constructor()),
    1257      108628 :         isolate());
    1258             :     js_global_object_function = ApiNatives::CreateApiFunction(
    1259             :         isolate(), js_global_object_constructor, factory()->the_hole_value(),
    1260      108628 :         JS_GLOBAL_OBJECT_TYPE);
    1261             :   }
    1262             : 
    1263      183702 :   js_global_object_function->initial_map()->set_is_prototype_map(true);
    1264       91851 :   js_global_object_function->initial_map()->set_is_dictionary_map(true);
    1265      183702 :   js_global_object_function->initial_map()->set_may_have_interesting_symbols(
    1266       91851 :       true);
    1267             :   Handle<JSGlobalObject> global_object =
    1268       91851 :       factory()->NewJSGlobalObject(js_global_object_function);
    1269             : 
    1270             :   // Step 2: (re)initialize the global proxy object.
    1271             :   Handle<JSFunction> global_proxy_function;
    1272       91851 :   if (global_proxy_template.IsEmpty()) {
    1273       37537 :     Handle<String> name = factory()->empty_string();
    1274             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1275             :         name, factory()->the_hole_value(), JS_GLOBAL_PROXY_TYPE,
    1276             :         JSGlobalProxy::SizeWithEmbedderFields(0), 0, Builtins::kIllegal,
    1277       37537 :         MUTABLE);
    1278       37537 :     global_proxy_function = factory()->NewFunction(args);
    1279             :   } else {
    1280             :     Handle<ObjectTemplateInfo> data =
    1281             :         v8::Utils::OpenHandle(*global_proxy_template);
    1282             :     Handle<FunctionTemplateInfo> global_constructor(
    1283      108628 :         FunctionTemplateInfo::cast(data->constructor()), isolate());
    1284             :     global_proxy_function = ApiNatives::CreateApiFunction(
    1285             :         isolate(), global_constructor, factory()->the_hole_value(),
    1286      108628 :         JS_GLOBAL_PROXY_TYPE);
    1287             :   }
    1288      183702 :   global_proxy_function->initial_map()->set_is_access_check_needed(true);
    1289       91851 :   global_proxy_function->initial_map()->set_has_hidden_prototype(true);
    1290       91851 :   global_proxy_function->initial_map()->set_may_have_interesting_symbols(true);
    1291       91851 :   native_context()->set_global_proxy_function(*global_proxy_function);
    1292             : 
    1293             :   // Set global_proxy.__proto__ to js_global after ConfigureGlobalObjects
    1294             :   // Return the global proxy.
    1295             : 
    1296       91851 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1297             : 
    1298             :   // Set the native context for the global object.
    1299      183702 :   global_object->set_native_context(*native_context());
    1300      183702 :   global_object->set_global_proxy(*global_proxy);
    1301             :   // Set the native context of the global proxy.
    1302      183702 :   global_proxy->set_native_context(*native_context());
    1303             :   // Set the global proxy of the native context. If the native context has been
    1304             :   // deserialized, the global proxy is already correctly set up by the
    1305             :   // deserializer. Otherwise it's undefined.
    1306             :   DCHECK(native_context()
    1307             :              ->get(Context::GLOBAL_PROXY_INDEX)
    1308             :              ->IsUndefined(isolate()) ||
    1309             :          native_context()->global_proxy() == *global_proxy);
    1310       91851 :   native_context()->set_global_proxy(*global_proxy);
    1311             : 
    1312       91851 :   return global_object;
    1313             : }
    1314             : 
    1315         120 : void Genesis::HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy) {
    1316             :   // Re-initialize the global proxy with the global proxy function from the
    1317             :   // snapshot, and then set up the link to the native context.
    1318             :   Handle<JSFunction> global_proxy_function(
    1319          80 :       native_context()->global_proxy_function(), isolate());
    1320          40 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1321             :   Handle<JSObject> global_object(
    1322          80 :       JSObject::cast(native_context()->global_object()), isolate());
    1323          40 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    1324          80 :   global_proxy->set_native_context(*native_context());
    1325             :   DCHECK(native_context()->global_proxy() == *global_proxy);
    1326          40 : }
    1327             : 
    1328       91740 : void Genesis::HookUpGlobalObject(Handle<JSGlobalObject> global_object) {
    1329             :   Handle<JSGlobalObject> global_object_from_snapshot(
    1330      183480 :       JSGlobalObject::cast(native_context()->extension()), isolate());
    1331      183480 :   native_context()->set_extension(*global_object);
    1332      183480 :   native_context()->set_security_token(*global_object);
    1333             : 
    1334       91740 :   TransferNamedProperties(global_object_from_snapshot, global_object);
    1335       91740 :   TransferIndexedProperties(global_object_from_snapshot, global_object);
    1336       91740 : }
    1337             : 
    1338        4761 : static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
    1339             :                                              Handle<JSFunction> function,
    1340             :                                              int context_index) {
    1341             :   Handle<Smi> index(Smi::FromInt(context_index), isolate);
    1342             :   JSObject::AddProperty(isolate, function,
    1343             :                         isolate->factory()->native_context_index_symbol(),
    1344        4761 :                         index, NONE);
    1345       14283 :   isolate->native_context()->set(context_index, *function);
    1346        4761 : }
    1347             : 
    1348        1110 : static void InstallError(Isolate* isolate, Handle<JSObject> global,
    1349             :                          Handle<String> name, int context_index) {
    1350             :   Factory* factory = isolate->factory();
    1351             : 
    1352             :   Handle<JSFunction> error_fun = InstallFunction(
    1353             :       isolate, global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
    1354        1110 :       factory->the_hole_value(), Builtins::kErrorConstructor);
    1355        2220 :   error_fun->shared()->DontAdaptArguments();
    1356        2220 :   error_fun->shared()->set_length(1);
    1357             : 
    1358        1110 :   if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1359             :     SimpleInstallFunction(isolate, error_fun, "captureStackTrace",
    1360         111 :                           Builtins::kErrorCaptureStackTrace, 2, false);
    1361             :   }
    1362             : 
    1363        1110 :   InstallWithIntrinsicDefaultProto(isolate, error_fun, context_index);
    1364             : 
    1365             :   {
    1366             :     // Setup %XXXErrorPrototype%.
    1367             :     Handle<JSObject> prototype(JSObject::cast(error_fun->instance_prototype()),
    1368        2220 :                                isolate);
    1369             : 
    1370             :     JSObject::AddProperty(isolate, prototype, factory->name_string(), name,
    1371        1110 :                           DONT_ENUM);
    1372             :     JSObject::AddProperty(isolate, prototype, factory->message_string(),
    1373        1110 :                           factory->empty_string(), DONT_ENUM);
    1374             : 
    1375        1110 :     if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1376             :       Handle<JSFunction> to_string_fun =
    1377             :           SimpleInstallFunction(isolate, prototype, "toString",
    1378         111 :                                 Builtins::kErrorPrototypeToString, 0, true);
    1379         222 :       isolate->native_context()->set_error_to_string(*to_string_fun);
    1380         222 :       isolate->native_context()->set_initial_error_prototype(*prototype);
    1381             :     } else {
    1382             :       DCHECK(isolate->native_context()->error_to_string()->IsJSFunction());
    1383             : 
    1384             :       JSObject::AddProperty(isolate, prototype, factory->toString_string(),
    1385        1998 :                             isolate->error_to_string(), DONT_ENUM);
    1386             : 
    1387         999 :       Handle<JSFunction> global_error = isolate->error_function();
    1388        1998 :       CHECK(JSReceiver::SetPrototype(error_fun, global_error, false,
    1389             :                                      kThrowOnError)
    1390             :                 .FromMaybe(false));
    1391        2997 :       CHECK(JSReceiver::SetPrototype(prototype,
    1392             :                                      handle(global_error->prototype(), isolate),
    1393             :                                      false, kThrowOnError)
    1394             :                 .FromMaybe(false));
    1395             :     }
    1396             :   }
    1397             : 
    1398        2220 :   Handle<Map> initial_map(error_fun->initial_map(), isolate);
    1399        1110 :   Map::EnsureDescriptorSlack(isolate, initial_map, 1);
    1400             : 
    1401             :   {
    1402             :     Handle<AccessorInfo> info = factory->error_stack_accessor();
    1403             :     Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
    1404        2220 :                                                 info, DONT_ENUM);
    1405        1110 :     initial_map->AppendDescriptor(isolate, &d);
    1406             :   }
    1407        1110 : }
    1408             : 
    1409             : namespace {
    1410             : 
    1411         555 : void InstallMakeError(Isolate* isolate, int builtin_id, int context_index) {
    1412             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1413             :       isolate->factory()->empty_string(), isolate->factory()->the_hole_value(),
    1414         555 :       JS_OBJECT_TYPE, JSObject::kHeaderSize, 0, builtin_id, MUTABLE);
    1415             : 
    1416         555 :   Handle<JSFunction> function = isolate->factory()->NewFunction(args);
    1417        1110 :   function->shared()->DontAdaptArguments();
    1418        1665 :   isolate->native_context()->set(context_index, *function);
    1419         555 : }
    1420             : 
    1421             : }  // namespace
    1422             : 
    1423             : // This is only called if we are not using snapshots.  The equivalent
    1424             : // work in the snapshot case is done in HookUpGlobalObject.
    1425         111 : void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
    1426        5106 :                                Handle<JSFunction> empty_function) {
    1427             :   // --- N a t i v e   C o n t e x t ---
    1428             :   // Use the empty scope info.
    1429         222 :   native_context()->set_scope_info(empty_function->shared()->scope_info());
    1430         111 :   native_context()->set_previous(Context());
    1431             :   // Set extension and global object.
    1432         222 :   native_context()->set_extension(*global_object);
    1433             :   // Security setup: Set the security token of the native context to the global
    1434             :   // object. This makes the security check between two different contexts fail
    1435             :   // by default even in case of global object reinitialization.
    1436         222 :   native_context()->set_security_token(*global_object);
    1437             : 
    1438         111 :   Factory* factory = isolate_->factory();
    1439             : 
    1440             :   Handle<ScriptContextTable> script_context_table =
    1441         111 :       factory->NewScriptContextTable();
    1442         111 :   native_context()->set_script_context_table(*script_context_table);
    1443         111 :   InstallGlobalThisBinding();
    1444             : 
    1445             :   {  // --- O b j e c t ---
    1446             :     Handle<String> object_name = factory->Object_string();
    1447         111 :     Handle<JSFunction> object_function = isolate_->object_function();
    1448             :     JSObject::AddProperty(isolate_, global_object, object_name, object_function,
    1449         111 :                           DONT_ENUM);
    1450             : 
    1451             :     SimpleInstallFunction(isolate_, object_function, "assign",
    1452         111 :                           Builtins::kObjectAssign, 2, false);
    1453             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertyDescriptor",
    1454         111 :                           Builtins::kObjectGetOwnPropertyDescriptor, 2, false);
    1455             :     SimpleInstallFunction(isolate_, object_function,
    1456             :                           "getOwnPropertyDescriptors",
    1457         111 :                           Builtins::kObjectGetOwnPropertyDescriptors, 1, false);
    1458             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertyNames",
    1459         111 :                           Builtins::kObjectGetOwnPropertyNames, 1, true);
    1460             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertySymbols",
    1461         111 :                           Builtins::kObjectGetOwnPropertySymbols, 1, false);
    1462             :     SimpleInstallFunction(isolate_, object_function, "is", Builtins::kObjectIs,
    1463         111 :                           2, true);
    1464             :     SimpleInstallFunction(isolate_, object_function, "preventExtensions",
    1465         111 :                           Builtins::kObjectPreventExtensions, 1, false);
    1466             :     SimpleInstallFunction(isolate_, object_function, "seal",
    1467         111 :                           Builtins::kObjectSeal, 1, false);
    1468             : 
    1469             :     Handle<JSFunction> object_create = SimpleInstallFunction(
    1470         111 :         isolate_, object_function, "create", Builtins::kObjectCreate, 2, false);
    1471         111 :     native_context()->set_object_create(*object_create);
    1472             : 
    1473             :     Handle<JSFunction> object_define_properties =
    1474             :         SimpleInstallFunction(isolate_, object_function, "defineProperties",
    1475         111 :                               Builtins::kObjectDefineProperties, 2, true);
    1476         111 :     native_context()->set_object_define_properties(*object_define_properties);
    1477             : 
    1478             :     Handle<JSFunction> object_define_property =
    1479             :         SimpleInstallFunction(isolate_, object_function, "defineProperty",
    1480         111 :                               Builtins::kObjectDefineProperty, 3, true);
    1481         111 :     native_context()->set_object_define_property(*object_define_property);
    1482             : 
    1483             :     SimpleInstallFunction(isolate_, object_function, "freeze",
    1484         111 :                           Builtins::kObjectFreeze, 1, false);
    1485             : 
    1486             :     Handle<JSFunction> object_get_prototype_of =
    1487             :         SimpleInstallFunction(isolate_, object_function, "getPrototypeOf",
    1488         111 :                               Builtins::kObjectGetPrototypeOf, 1, false);
    1489         111 :     native_context()->set_object_get_prototype_of(*object_get_prototype_of);
    1490             :     SimpleInstallFunction(isolate_, object_function, "setPrototypeOf",
    1491         111 :                           Builtins::kObjectSetPrototypeOf, 2, false);
    1492             : 
    1493             :     SimpleInstallFunction(isolate_, object_function, "isExtensible",
    1494         111 :                           Builtins::kObjectIsExtensible, 1, false);
    1495             :     SimpleInstallFunction(isolate_, object_function, "isFrozen",
    1496         111 :                           Builtins::kObjectIsFrozen, 1, false);
    1497             : 
    1498             :     Handle<JSFunction> object_is_sealed =
    1499             :         SimpleInstallFunction(isolate_, object_function, "isSealed",
    1500         111 :                               Builtins::kObjectIsSealed, 1, false);
    1501         111 :     native_context()->set_object_is_sealed(*object_is_sealed);
    1502             : 
    1503             :     Handle<JSFunction> object_keys = SimpleInstallFunction(
    1504         111 :         isolate_, object_function, "keys", Builtins::kObjectKeys, 1, true);
    1505         111 :     native_context()->set_object_keys(*object_keys);
    1506             :     SimpleInstallFunction(isolate_, object_function, "entries",
    1507         111 :                           Builtins::kObjectEntries, 1, true);
    1508             :     SimpleInstallFunction(isolate_, object_function, "values",
    1509         111 :                           Builtins::kObjectValues, 1, true);
    1510             : 
    1511             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1512             :                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
    1513         111 :                           true);
    1514             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1515             :                           "__defineSetter__", Builtins::kObjectDefineSetter, 2,
    1516         111 :                           true);
    1517             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1518             :                           "hasOwnProperty",
    1519         111 :                           Builtins::kObjectPrototypeHasOwnProperty, 1, true);
    1520             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1521             :                           "__lookupGetter__", Builtins::kObjectLookupGetter, 1,
    1522         111 :                           true);
    1523             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1524             :                           "__lookupSetter__", Builtins::kObjectLookupSetter, 1,
    1525         111 :                           true);
    1526             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1527             :                           "isPrototypeOf",
    1528         111 :                           Builtins::kObjectPrototypeIsPrototypeOf, 1, true);
    1529             :     SimpleInstallFunction(
    1530             :         isolate_, isolate_->initial_object_prototype(), "propertyIsEnumerable",
    1531         111 :         Builtins::kObjectPrototypePropertyIsEnumerable, 1, false);
    1532             :     Handle<JSFunction> object_to_string = SimpleInstallFunction(
    1533             :         isolate_, isolate_->initial_object_prototype(), "toString",
    1534         111 :         Builtins::kObjectPrototypeToString, 0, true);
    1535         111 :     native_context()->set_object_to_string(*object_to_string);
    1536             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1537             :                           "valueOf", Builtins::kObjectPrototypeValueOf, 0,
    1538         111 :                           true);
    1539             : 
    1540             :     SimpleInstallGetterSetter(
    1541             :         isolate_, isolate_->initial_object_prototype(), factory->proto_string(),
    1542         111 :         Builtins::kObjectPrototypeGetProto, Builtins::kObjectPrototypeSetProto);
    1543             : 
    1544             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1545             :                           "toLocaleString",
    1546         111 :                           Builtins::kObjectPrototypeToLocaleString, 0, true);
    1547             :   }
    1548             : 
    1549         222 :   Handle<JSObject> global(native_context()->global_object(), isolate());
    1550             : 
    1551             :   {  // --- F u n c t i o n ---
    1552         111 :     Handle<JSFunction> prototype = empty_function;
    1553             :     Handle<JSFunction> function_fun =
    1554             :         InstallFunction(isolate_, global, "Function", JS_FUNCTION_TYPE,
    1555             :                         JSFunction::kSizeWithPrototype, 0, prototype,
    1556         111 :                         Builtins::kFunctionConstructor);
    1557             :     // Function instances are sloppy by default.
    1558             :     function_fun->set_prototype_or_initial_map(
    1559         333 :         *isolate_->sloppy_function_map());
    1560         222 :     function_fun->shared()->DontAdaptArguments();
    1561         222 :     function_fun->shared()->set_length(1);
    1562             :     InstallWithIntrinsicDefaultProto(isolate_, function_fun,
    1563         111 :                                      Context::FUNCTION_FUNCTION_INDEX);
    1564             : 
    1565             :     // Setup the methods on the %FunctionPrototype%.
    1566             :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1567         111 :                           function_fun, DONT_ENUM);
    1568             :     SimpleInstallFunction(isolate_, prototype, "apply",
    1569         111 :                           Builtins::kFunctionPrototypeApply, 2, false);
    1570             :     SimpleInstallFunction(isolate_, prototype, "bind",
    1571         111 :                           Builtins::kFastFunctionPrototypeBind, 1, false);
    1572             :     SimpleInstallFunction(isolate_, prototype, "call",
    1573         111 :                           Builtins::kFunctionPrototypeCall, 1, false);
    1574             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1575         111 :                           Builtins::kFunctionPrototypeToString, 0, false);
    1576             : 
    1577             :     // Install the @@hasInstance function.
    1578             :     Handle<JSFunction> has_instance = InstallFunctionAtSymbol(
    1579             :         isolate_, prototype, factory->has_instance_symbol(),
    1580             :         "[Symbol.hasInstance]", Builtins::kFunctionPrototypeHasInstance, 1,
    1581             :         true,
    1582             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY),
    1583         111 :         BuiltinFunctionId::kFunctionHasInstance);
    1584         111 :     native_context()->set_function_has_instance(*has_instance);
    1585             : 
    1586             :     // Complete setting up function maps.
    1587             :     {
    1588         222 :       isolate_->sloppy_function_map()->SetConstructor(*function_fun);
    1589         222 :       isolate_->sloppy_function_with_name_map()->SetConstructor(*function_fun);
    1590         222 :       isolate_->sloppy_function_with_readonly_prototype_map()->SetConstructor(
    1591         333 :           *function_fun);
    1592             : 
    1593         222 :       isolate_->strict_function_map()->SetConstructor(*function_fun);
    1594         222 :       isolate_->strict_function_with_name_map()->SetConstructor(*function_fun);
    1595         222 :       strict_function_with_home_object_map_->SetConstructor(*function_fun);
    1596             :       strict_function_with_name_and_home_object_map_->SetConstructor(
    1597         222 :           *function_fun);
    1598         222 :       isolate_->strict_function_with_readonly_prototype_map()->SetConstructor(
    1599         333 :           *function_fun);
    1600             : 
    1601         222 :       isolate_->class_function_map()->SetConstructor(*function_fun);
    1602             :     }
    1603             :   }
    1604             : 
    1605             :   {  // --- A s y n c F r o m S y n c I t e r a t o r
    1606             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1607             :         isolate_, Builtins::kAsyncIteratorValueUnwrap, factory->empty_string(),
    1608         111 :         1);
    1609         111 :     native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
    1610             :   }
    1611             : 
    1612             :   {  // --- A s y n c G e n e r a t o r ---
    1613             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1614             :         isolate_, Builtins::kAsyncGeneratorAwaitResolveClosure,
    1615         111 :         factory->empty_string(), 1);
    1616         111 :     native_context()->set_async_generator_await_resolve_shared_fun(*info);
    1617             : 
    1618             :     info = SimpleCreateSharedFunctionInfo(
    1619             :         isolate_, Builtins::kAsyncGeneratorAwaitRejectClosure,
    1620         111 :         factory->empty_string(), 1);
    1621         111 :     native_context()->set_async_generator_await_reject_shared_fun(*info);
    1622             : 
    1623             :     info = SimpleCreateSharedFunctionInfo(
    1624             :         isolate_, Builtins::kAsyncGeneratorYieldResolveClosure,
    1625         111 :         factory->empty_string(), 1);
    1626         111 :     native_context()->set_async_generator_yield_resolve_shared_fun(*info);
    1627             : 
    1628             :     info = SimpleCreateSharedFunctionInfo(
    1629             :         isolate_, Builtins::kAsyncGeneratorReturnResolveClosure,
    1630         111 :         factory->empty_string(), 1);
    1631         111 :     native_context()->set_async_generator_return_resolve_shared_fun(*info);
    1632             : 
    1633             :     info = SimpleCreateSharedFunctionInfo(
    1634             :         isolate_, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
    1635         111 :         factory->empty_string(), 1);
    1636         222 :     native_context()->set_async_generator_return_closed_resolve_shared_fun(
    1637         111 :         *info);
    1638             : 
    1639             :     info = SimpleCreateSharedFunctionInfo(
    1640             :         isolate_, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
    1641         111 :         factory->empty_string(), 1);
    1642         222 :     native_context()->set_async_generator_return_closed_reject_shared_fun(
    1643         111 :         *info);
    1644             :   }
    1645             : 
    1646             :   Handle<JSFunction> array_prototype_to_string_fun;
    1647             :   {  // --- A r r a y ---
    1648             :     Handle<JSFunction> array_function = InstallFunction(
    1649             :         isolate_, global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
    1650         222 :         isolate_->initial_object_prototype(), Builtins::kArrayConstructor);
    1651         222 :     array_function->shared()->DontAdaptArguments();
    1652         222 :     array_function->shared()->set_builtin_function_id(
    1653         222 :         BuiltinFunctionId::kArrayConstructor);
    1654             : 
    1655             :     // This seems a bit hackish, but we need to make sure Array.length
    1656             :     // is 1.
    1657         222 :     array_function->shared()->set_length(1);
    1658             : 
    1659         222 :     Handle<Map> initial_map(array_function->initial_map(), isolate());
    1660             : 
    1661             :     // This assert protects an optimization in
    1662             :     // HGraphBuilder::JSArrayBuilder::EmitMapCode()
    1663             :     DCHECK(initial_map->elements_kind() == GetInitialFastElementsKind());
    1664         111 :     Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
    1665             : 
    1666             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1667             :         DONT_ENUM | DONT_DELETE);
    1668             : 
    1669             :     STATIC_ASSERT(JSArray::kLengthDescriptorIndex == 0);
    1670             :     {  // Add length.
    1671             :       Descriptor d = Descriptor::AccessorConstant(
    1672         111 :           factory->length_string(), factory->array_length_accessor(), attribs);
    1673         111 :       initial_map->AppendDescriptor(isolate(), &d);
    1674             :     }
    1675             : 
    1676             :     InstallWithIntrinsicDefaultProto(isolate_, array_function,
    1677         111 :                                      Context::ARRAY_FUNCTION_INDEX);
    1678         111 :     InstallSpeciesGetter(isolate_, array_function);
    1679             : 
    1680             :     // Cache the array maps, needed by ArrayConstructorStub
    1681         111 :     CacheInitialJSArrayMaps(native_context(), initial_map);
    1682             : 
    1683             :     // Set up %ArrayPrototype%.
    1684             :     // The %ArrayPrototype% has TERMINAL_FAST_ELEMENTS_KIND in order to ensure
    1685             :     // that constant functions stay constant after turning prototype to setup
    1686             :     // mode and back when constant field tracking is enabled.
    1687             :     Handle<JSArray> proto =
    1688         111 :         factory->NewJSArray(0, TERMINAL_FAST_ELEMENTS_KIND, TENURED);
    1689         111 :     JSFunction::SetPrototype(array_function, proto);
    1690         222 :     native_context()->set_initial_array_prototype(*proto);
    1691             : 
    1692             :     Handle<JSFunction> is_arraylike = SimpleInstallFunction(
    1693         111 :         isolate_, array_function, "isArray", Builtins::kArrayIsArray, 1, true);
    1694         111 :     native_context()->set_is_arraylike(*is_arraylike);
    1695             : 
    1696             :     SimpleInstallFunction(isolate_, array_function, "from",
    1697         111 :                           Builtins::kArrayFrom, 1, false);
    1698             :     SimpleInstallFunction(isolate_, array_function, "of", Builtins::kArrayOf, 0,
    1699         111 :                           false);
    1700             : 
    1701             :     JSObject::AddProperty(isolate_, proto, factory->constructor_string(),
    1702         111 :                           array_function, DONT_ENUM);
    1703             : 
    1704             :     SimpleInstallFunction(isolate_, proto, "concat", Builtins::kArrayConcat, 1,
    1705         111 :                           false);
    1706             :     SimpleInstallFunction(isolate_, proto, "copyWithin",
    1707         111 :                           Builtins::kArrayPrototypeCopyWithin, 2, false);
    1708             :     SimpleInstallFunction(isolate_, proto, "fill",
    1709         111 :                           Builtins::kArrayPrototypeFill, 1, false);
    1710             :     SimpleInstallFunction(isolate_, proto, "find",
    1711         111 :                           Builtins::kArrayPrototypeFind, 1, false);
    1712             :     SimpleInstallFunction(isolate_, proto, "findIndex",
    1713         111 :                           Builtins::kArrayPrototypeFindIndex, 1, false);
    1714             :     SimpleInstallFunction(isolate_, proto, "lastIndexOf",
    1715         111 :                           Builtins::kArrayPrototypeLastIndexOf, 1, false);
    1716             :     SimpleInstallFunction(isolate_, proto, "pop", Builtins::kArrayPrototypePop,
    1717         111 :                           0, false);
    1718             :     SimpleInstallFunction(isolate_, proto, "push",
    1719         111 :                           Builtins::kArrayPrototypePush, 1, false);
    1720             :     SimpleInstallFunction(isolate_, proto, "reverse",
    1721         111 :                           Builtins::kArrayPrototypeReverse, 0, false);
    1722             :     SimpleInstallFunction(isolate_, proto, "shift",
    1723         111 :                           Builtins::kArrayPrototypeShift, 0, false);
    1724             :     SimpleInstallFunction(isolate_, proto, "unshift",
    1725         111 :                           Builtins::kArrayPrototypeUnshift, 1, false);
    1726             :     SimpleInstallFunction(isolate_, proto, "slice",
    1727         111 :                           Builtins::kArrayPrototypeSlice, 2, false);
    1728             :     SimpleInstallFunction(isolate_, proto, "sort",
    1729         111 :                           Builtins::kArrayPrototypeSort, 1, false);
    1730             :     SimpleInstallFunction(isolate_, proto, "splice",
    1731         111 :                           Builtins::kArrayPrototypeSplice, 2, false);
    1732             :     SimpleInstallFunction(isolate_, proto, "includes", Builtins::kArrayIncludes,
    1733         111 :                           1, false);
    1734             :     SimpleInstallFunction(isolate_, proto, "indexOf", Builtins::kArrayIndexOf,
    1735         111 :                           1, false);
    1736             :     SimpleInstallFunction(isolate_, proto, "join",
    1737         111 :                           Builtins::kArrayPrototypeJoin, 1, false);
    1738             : 
    1739             :     {  // Set up iterator-related properties.
    1740             :       Handle<JSFunction> keys = InstallFunctionWithBuiltinId(
    1741             :           isolate_, proto, "keys", Builtins::kArrayPrototypeKeys, 0, true,
    1742         111 :           BuiltinFunctionId::kArrayKeys);
    1743         111 :       native_context()->set_array_keys_iterator(*keys);
    1744             : 
    1745             :       Handle<JSFunction> entries = InstallFunctionWithBuiltinId(
    1746             :           isolate_, proto, "entries", Builtins::kArrayPrototypeEntries, 0, true,
    1747         111 :           BuiltinFunctionId::kArrayEntries);
    1748         111 :       native_context()->set_array_entries_iterator(*entries);
    1749             : 
    1750             :       Handle<JSFunction> values = InstallFunctionWithBuiltinId(
    1751             :           isolate_, proto, "values", Builtins::kArrayPrototypeValues, 0, true,
    1752         111 :           BuiltinFunctionId::kArrayValues);
    1753             :       JSObject::AddProperty(isolate_, proto, factory->iterator_symbol(), values,
    1754         111 :                             DONT_ENUM);
    1755         111 :       native_context()->set_array_values_iterator(*values);
    1756             :     }
    1757             : 
    1758             :     Handle<JSFunction> for_each_fun = SimpleInstallFunction(
    1759         111 :         isolate_, proto, "forEach", Builtins::kArrayForEach, 1, false);
    1760         111 :     native_context()->set_array_for_each_iterator(*for_each_fun);
    1761             :     SimpleInstallFunction(isolate_, proto, "filter", Builtins::kArrayFilter, 1,
    1762         111 :                           false);
    1763             :     SimpleInstallFunction(isolate_, proto, "map", Builtins::kArrayMap, 1,
    1764         111 :                           false);
    1765             :     SimpleInstallFunction(isolate_, proto, "every", Builtins::kArrayEvery, 1,
    1766         111 :                           false);
    1767             :     SimpleInstallFunction(isolate_, proto, "some", Builtins::kArraySome, 1,
    1768         111 :                           false);
    1769             :     SimpleInstallFunction(isolate_, proto, "reduce", Builtins::kArrayReduce, 1,
    1770         111 :                           false);
    1771             :     SimpleInstallFunction(isolate_, proto, "reduceRight",
    1772         111 :                           Builtins::kArrayReduceRight, 1, false);
    1773             :     SimpleInstallFunction(isolate_, proto, "toLocaleString",
    1774         111 :                           Builtins::kArrayPrototypeToLocaleString, 0, false);
    1775             :     array_prototype_to_string_fun =
    1776             :         SimpleInstallFunction(isolate_, proto, "toString",
    1777         111 :                               Builtins::kArrayPrototypeToString, 0, false);
    1778             : 
    1779         111 :     Handle<JSObject> unscopables = factory->NewJSObjectWithNullProto();
    1780         111 :     InstallTrueValuedProperty(isolate_, unscopables, "copyWithin");
    1781         111 :     InstallTrueValuedProperty(isolate_, unscopables, "entries");
    1782         111 :     InstallTrueValuedProperty(isolate_, unscopables, "fill");
    1783         111 :     InstallTrueValuedProperty(isolate_, unscopables, "find");
    1784         111 :     InstallTrueValuedProperty(isolate_, unscopables, "findIndex");
    1785         111 :     InstallTrueValuedProperty(isolate_, unscopables, "flat");
    1786         111 :     InstallTrueValuedProperty(isolate_, unscopables, "flatMap");
    1787         111 :     InstallTrueValuedProperty(isolate_, unscopables, "includes");
    1788         111 :     InstallTrueValuedProperty(isolate_, unscopables, "keys");
    1789         111 :     InstallTrueValuedProperty(isolate_, unscopables, "values");
    1790         111 :     JSObject::MigrateSlowToFast(unscopables, 0, "Bootstrapping");
    1791             :     JSObject::AddProperty(
    1792             :         isolate_, proto, factory->unscopables_symbol(), unscopables,
    1793         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1794             : 
    1795         111 :     Handle<Map> map(proto->map(), isolate_);
    1796         111 :     Map::SetShouldBeFastPrototypeMap(map, true, isolate_);
    1797             :   }
    1798             : 
    1799             :   {  // --- A r r a y I t e r a t o r ---
    1800             :     Handle<JSObject> iterator_prototype(
    1801         222 :         native_context()->initial_iterator_prototype(), isolate());
    1802             : 
    1803             :     Handle<JSObject> array_iterator_prototype =
    1804         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    1805         111 :     JSObject::ForceSetPrototype(array_iterator_prototype, iterator_prototype);
    1806             : 
    1807             :     InstallToStringTag(isolate_, array_iterator_prototype,
    1808         111 :                        factory->ArrayIterator_string());
    1809             : 
    1810             :     InstallFunctionWithBuiltinId(isolate_, array_iterator_prototype, "next",
    1811             :                                  Builtins::kArrayIteratorPrototypeNext, 0, true,
    1812         111 :                                  BuiltinFunctionId::kArrayIteratorNext);
    1813             : 
    1814             :     Handle<JSFunction> array_iterator_function =
    1815             :         CreateFunction(isolate_, factory->ArrayIterator_string(),
    1816             :                        JS_ARRAY_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
    1817         111 :                        array_iterator_prototype, Builtins::kIllegal);
    1818         111 :     array_iterator_function->shared()->set_native(false);
    1819             : 
    1820         222 :     native_context()->set_initial_array_iterator_map(
    1821         333 :         array_iterator_function->initial_map());
    1822         222 :     native_context()->set_initial_array_iterator_prototype(
    1823         111 :         *array_iterator_prototype);
    1824             :   }
    1825             : 
    1826             :   {  // --- N u m b e r ---
    1827             :     Handle<JSFunction> number_fun = InstallFunction(
    1828             :         isolate_, global, "Number", JS_VALUE_TYPE, JSValue::kSize, 0,
    1829         222 :         isolate_->initial_object_prototype(), Builtins::kNumberConstructor);
    1830         222 :     number_fun->shared()->set_builtin_function_id(
    1831         222 :         BuiltinFunctionId::kNumberConstructor);
    1832         222 :     number_fun->shared()->DontAdaptArguments();
    1833         222 :     number_fun->shared()->set_length(1);
    1834             :     InstallWithIntrinsicDefaultProto(isolate_, number_fun,
    1835         111 :                                      Context::NUMBER_FUNCTION_INDEX);
    1836             : 
    1837             :     // Create the %NumberPrototype%
    1838             :     Handle<JSValue> prototype =
    1839         111 :         Handle<JSValue>::cast(factory->NewJSObject(number_fun, TENURED));
    1840         111 :     prototype->set_value(Smi::kZero);
    1841         111 :     JSFunction::SetPrototype(number_fun, prototype);
    1842             : 
    1843             :     // Install the "constructor" property on the {prototype}.
    1844             :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1845         111 :                           number_fun, DONT_ENUM);
    1846             : 
    1847             :     // Install the Number.prototype methods.
    1848             :     SimpleInstallFunction(isolate_, prototype, "toExponential",
    1849         111 :                           Builtins::kNumberPrototypeToExponential, 1, false);
    1850             :     SimpleInstallFunction(isolate_, prototype, "toFixed",
    1851         111 :                           Builtins::kNumberPrototypeToFixed, 1, false);
    1852             :     SimpleInstallFunction(isolate_, prototype, "toPrecision",
    1853         111 :                           Builtins::kNumberPrototypeToPrecision, 1, false);
    1854             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1855         111 :                           Builtins::kNumberPrototypeToString, 1, false);
    1856             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    1857         111 :                           Builtins::kNumberPrototypeValueOf, 0, true);
    1858             : 
    1859             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    1860         111 :                           Builtins::kNumberPrototypeToLocaleString, 0, false);
    1861             : 
    1862             :     // Install the Number functions.
    1863             :     SimpleInstallFunction(isolate_, number_fun, "isFinite",
    1864         111 :                           Builtins::kNumberIsFinite, 1, true);
    1865             :     SimpleInstallFunction(isolate_, number_fun, "isInteger",
    1866         111 :                           Builtins::kNumberIsInteger, 1, true);
    1867             :     SimpleInstallFunction(isolate_, number_fun, "isNaN", Builtins::kNumberIsNaN,
    1868         111 :                           1, true);
    1869             :     SimpleInstallFunction(isolate_, number_fun, "isSafeInteger",
    1870         111 :                           Builtins::kNumberIsSafeInteger, 1, true);
    1871             : 
    1872             :     // Install Number.parseFloat and Global.parseFloat.
    1873             :     Handle<JSFunction> parse_float_fun =
    1874             :         SimpleInstallFunction(isolate_, number_fun, "parseFloat",
    1875         111 :                               Builtins::kNumberParseFloat, 1, true);
    1876             :     JSObject::AddProperty(isolate_, global_object, "parseFloat",
    1877         111 :                           parse_float_fun, DONT_ENUM);
    1878             : 
    1879             :     // Install Number.parseInt and Global.parseInt.
    1880             :     Handle<JSFunction> parse_int_fun = SimpleInstallFunction(
    1881         111 :         isolate_, number_fun, "parseInt", Builtins::kNumberParseInt, 2, true);
    1882             :     JSObject::AddProperty(isolate_, global_object, "parseInt", parse_int_fun,
    1883         111 :                           DONT_ENUM);
    1884             : 
    1885             :     // Install Number constants
    1886             :     const double kMaxValue = 1.7976931348623157e+308;
    1887             :     const double kMinValue = 5e-324;
    1888             :     const double kMinSafeInteger = -kMaxSafeInteger;
    1889             :     const double kEPS = 2.220446049250313e-16;
    1890             : 
    1891             :     InstallConstant(isolate_, number_fun, "MAX_VALUE",
    1892         222 :                     factory->NewNumber(kMaxValue));
    1893             :     InstallConstant(isolate_, number_fun, "MIN_VALUE",
    1894         222 :                     factory->NewNumber(kMinValue));
    1895         111 :     InstallConstant(isolate_, number_fun, "NaN", factory->nan_value());
    1896             :     InstallConstant(isolate_, number_fun, "NEGATIVE_INFINITY",
    1897         222 :                     factory->NewNumber(-V8_INFINITY));
    1898             :     InstallConstant(isolate_, number_fun, "POSITIVE_INFINITY",
    1899         111 :                     factory->infinity_value());
    1900             :     InstallConstant(isolate_, number_fun, "MAX_SAFE_INTEGER",
    1901         222 :                     factory->NewNumber(kMaxSafeInteger));
    1902             :     InstallConstant(isolate_, number_fun, "MIN_SAFE_INTEGER",
    1903         222 :                     factory->NewNumber(kMinSafeInteger));
    1904         222 :     InstallConstant(isolate_, number_fun, "EPSILON", factory->NewNumber(kEPS));
    1905             : 
    1906         111 :     InstallConstant(isolate_, global, "Infinity", factory->infinity_value());
    1907         111 :     InstallConstant(isolate_, global, "NaN", factory->nan_value());
    1908         111 :     InstallConstant(isolate_, global, "undefined", factory->undefined_value());
    1909             :   }
    1910             : 
    1911             :   {  // --- B o o l e a n ---
    1912             :     Handle<JSFunction> boolean_fun = InstallFunction(
    1913             :         isolate_, global, "Boolean", JS_VALUE_TYPE, JSValue::kSize, 0,
    1914         222 :         isolate_->initial_object_prototype(), Builtins::kBooleanConstructor);
    1915         222 :     boolean_fun->shared()->DontAdaptArguments();
    1916         222 :     boolean_fun->shared()->set_length(1);
    1917             :     InstallWithIntrinsicDefaultProto(isolate_, boolean_fun,
    1918         111 :                                      Context::BOOLEAN_FUNCTION_INDEX);
    1919             : 
    1920             :     // Create the %BooleanPrototype%
    1921             :     Handle<JSValue> prototype =
    1922         111 :         Handle<JSValue>::cast(factory->NewJSObject(boolean_fun, TENURED));
    1923         333 :     prototype->set_value(ReadOnlyRoots(isolate_).false_value());
    1924         111 :     JSFunction::SetPrototype(boolean_fun, prototype);
    1925             : 
    1926             :     // Install the "constructor" property on the {prototype}.
    1927             :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1928         111 :                           boolean_fun, DONT_ENUM);
    1929             : 
    1930             :     // Install the Boolean.prototype methods.
    1931             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1932         111 :                           Builtins::kBooleanPrototypeToString, 0, true);
    1933             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    1934         111 :                           Builtins::kBooleanPrototypeValueOf, 0, true);
    1935             :   }
    1936             : 
    1937             :   {  // --- S t r i n g ---
    1938             :     Handle<JSFunction> string_fun = InstallFunction(
    1939             :         isolate_, global, "String", JS_VALUE_TYPE, JSValue::kSize, 0,
    1940         222 :         isolate_->initial_object_prototype(), Builtins::kStringConstructor);
    1941         222 :     string_fun->shared()->set_builtin_function_id(
    1942         222 :         BuiltinFunctionId::kStringConstructor);
    1943         222 :     string_fun->shared()->DontAdaptArguments();
    1944         222 :     string_fun->shared()->set_length(1);
    1945             :     InstallWithIntrinsicDefaultProto(isolate_, string_fun,
    1946         111 :                                      Context::STRING_FUNCTION_INDEX);
    1947             : 
    1948             :     Handle<Map> string_map = Handle<Map>(
    1949         222 :         native_context()->string_function()->initial_map(), isolate());
    1950         111 :     string_map->set_elements_kind(FAST_STRING_WRAPPER_ELEMENTS);
    1951         111 :     Map::EnsureDescriptorSlack(isolate_, string_map, 1);
    1952             : 
    1953             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1954             :         DONT_ENUM | DONT_DELETE | READ_ONLY);
    1955             : 
    1956             :     {  // Add length.
    1957             :       Descriptor d = Descriptor::AccessorConstant(
    1958         111 :           factory->length_string(), factory->string_length_accessor(), attribs);
    1959         111 :       string_map->AppendDescriptor(isolate(), &d);
    1960             :     }
    1961             : 
    1962             :     // Install the String.fromCharCode function.
    1963             :     SimpleInstallFunction(isolate_, string_fun, "fromCharCode",
    1964         111 :                           Builtins::kStringFromCharCode, 1, false);
    1965             : 
    1966             :     // Install the String.fromCodePoint function.
    1967             :     SimpleInstallFunction(isolate_, string_fun, "fromCodePoint",
    1968         111 :                           Builtins::kStringFromCodePoint, 1, false);
    1969             : 
    1970             :     // Install the String.raw function.
    1971             :     SimpleInstallFunction(isolate_, string_fun, "raw", Builtins::kStringRaw, 1,
    1972         111 :                           false);
    1973             : 
    1974             :     // Create the %StringPrototype%
    1975             :     Handle<JSValue> prototype =
    1976         111 :         Handle<JSValue>::cast(factory->NewJSObject(string_fun, TENURED));
    1977         333 :     prototype->set_value(ReadOnlyRoots(isolate_).empty_string());
    1978         111 :     JSFunction::SetPrototype(string_fun, prototype);
    1979         222 :     native_context()->set_initial_string_prototype(*prototype);
    1980             : 
    1981             :     // Install the "constructor" property on the {prototype}.
    1982             :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1983         111 :                           string_fun, DONT_ENUM);
    1984             : 
    1985             :     // Install the String.prototype methods.
    1986             :     SimpleInstallFunction(isolate_, prototype, "anchor",
    1987         111 :                           Builtins::kStringPrototypeAnchor, 1, true);
    1988             :     SimpleInstallFunction(isolate_, prototype, "big",
    1989         111 :                           Builtins::kStringPrototypeBig, 0, true);
    1990             :     SimpleInstallFunction(isolate_, prototype, "blink",
    1991         111 :                           Builtins::kStringPrototypeBlink, 0, true);
    1992             :     SimpleInstallFunction(isolate_, prototype, "bold",
    1993         111 :                           Builtins::kStringPrototypeBold, 0, true);
    1994             :     SimpleInstallFunction(isolate_, prototype, "charAt",
    1995         111 :                           Builtins::kStringPrototypeCharAt, 1, true);
    1996             :     SimpleInstallFunction(isolate_, prototype, "charCodeAt",
    1997         111 :                           Builtins::kStringPrototypeCharCodeAt, 1, true);
    1998             :     SimpleInstallFunction(isolate_, prototype, "codePointAt",
    1999         111 :                           Builtins::kStringPrototypeCodePointAt, 1, true);
    2000             :     SimpleInstallFunction(isolate_, prototype, "concat",
    2001         111 :                           Builtins::kStringPrototypeConcat, 1, false);
    2002             :     SimpleInstallFunction(isolate_, prototype, "endsWith",
    2003         111 :                           Builtins::kStringPrototypeEndsWith, 1, false);
    2004             :     SimpleInstallFunction(isolate_, prototype, "fontcolor",
    2005         111 :                           Builtins::kStringPrototypeFontcolor, 1, true);
    2006             :     SimpleInstallFunction(isolate_, prototype, "fontsize",
    2007         111 :                           Builtins::kStringPrototypeFontsize, 1, true);
    2008             :     SimpleInstallFunction(isolate_, prototype, "fixed",
    2009         111 :                           Builtins::kStringPrototypeFixed, 0, true);
    2010             :     SimpleInstallFunction(isolate_, prototype, "includes",
    2011         111 :                           Builtins::kStringPrototypeIncludes, 1, false);
    2012             :     SimpleInstallFunction(isolate_, prototype, "indexOf",
    2013         111 :                           Builtins::kStringPrototypeIndexOf, 1, false);
    2014             :     SimpleInstallFunction(isolate_, prototype, "italics",
    2015         111 :                           Builtins::kStringPrototypeItalics, 0, true);
    2016             :     SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
    2017         111 :                           Builtins::kStringPrototypeLastIndexOf, 1, false);
    2018             :     SimpleInstallFunction(isolate_, prototype, "link",
    2019         111 :                           Builtins::kStringPrototypeLink, 1, true);
    2020             : #ifdef V8_INTL_SUPPORT
    2021             :     SimpleInstallFunction(isolate_, prototype, "localeCompare",
    2022         111 :                           Builtins::kStringPrototypeLocaleCompare, 1, false);
    2023             : #else
    2024             :     SimpleInstallFunction(isolate_, prototype, "localeCompare",
    2025             :                           Builtins::kStringPrototypeLocaleCompare, 1, true);
    2026             : #endif  // V8_INTL_SUPPORT
    2027             :     SimpleInstallFunction(isolate_, prototype, "match",
    2028         111 :                           Builtins::kStringPrototypeMatch, 1, true);
    2029             : #ifdef V8_INTL_SUPPORT
    2030             :     SimpleInstallFunction(isolate_, prototype, "normalize",
    2031         111 :                           Builtins::kStringPrototypeNormalizeIntl, 0, false);
    2032             : #else
    2033             :     SimpleInstallFunction(isolate_, prototype, "normalize",
    2034             :                           Builtins::kStringPrototypeNormalize, 0, false);
    2035             : #endif  // V8_INTL_SUPPORT
    2036             :     SimpleInstallFunction(isolate_, prototype, "padEnd",
    2037         111 :                           Builtins::kStringPrototypePadEnd, 1, false);
    2038             :     SimpleInstallFunction(isolate_, prototype, "padStart",
    2039         111 :                           Builtins::kStringPrototypePadStart, 1, false);
    2040             :     SimpleInstallFunction(isolate_, prototype, "repeat",
    2041         111 :                           Builtins::kStringPrototypeRepeat, 1, true);
    2042             :     SimpleInstallFunction(isolate_, prototype, "replace",
    2043         111 :                           Builtins::kStringPrototypeReplace, 2, true);
    2044             :     SimpleInstallFunction(isolate_, prototype, "search",
    2045         111 :                           Builtins::kStringPrototypeSearch, 1, true);
    2046             :     SimpleInstallFunction(isolate_, prototype, "slice",
    2047         111 :                           Builtins::kStringPrototypeSlice, 2, false);
    2048             :     SimpleInstallFunction(isolate_, prototype, "small",
    2049         111 :                           Builtins::kStringPrototypeSmall, 0, true);
    2050             :     SimpleInstallFunction(isolate_, prototype, "split",
    2051         111 :                           Builtins::kStringPrototypeSplit, 2, false);
    2052             :     SimpleInstallFunction(isolate_, prototype, "strike",
    2053         111 :                           Builtins::kStringPrototypeStrike, 0, true);
    2054             :     SimpleInstallFunction(isolate_, prototype, "sub",
    2055         111 :                           Builtins::kStringPrototypeSub, 0, true);
    2056             :     SimpleInstallFunction(isolate_, prototype, "substr",
    2057         111 :                           Builtins::kStringPrototypeSubstr, 2, false);
    2058             :     SimpleInstallFunction(isolate_, prototype, "substring",
    2059         111 :                           Builtins::kStringPrototypeSubstring, 2, false);
    2060             :     SimpleInstallFunction(isolate_, prototype, "sup",
    2061         111 :                           Builtins::kStringPrototypeSup, 0, true);
    2062             :     SimpleInstallFunction(isolate_, prototype, "startsWith",
    2063         111 :                           Builtins::kStringPrototypeStartsWith, 1, false);
    2064             :     SimpleInstallFunction(isolate_, prototype, "toString",
    2065         111 :                           Builtins::kStringPrototypeToString, 0, true);
    2066             :     SimpleInstallFunction(isolate_, prototype, "trim",
    2067         111 :                           Builtins::kStringPrototypeTrim, 0, false);
    2068             : 
    2069             :     // Install `String.prototype.trimStart` with `trimLeft` alias.
    2070             :     Handle<JSFunction> trim_start_fun =
    2071             :         SimpleInstallFunction(isolate_, prototype, "trimStart",
    2072         111 :                               Builtins::kStringPrototypeTrimStart, 0, false);
    2073             :     JSObject::AddProperty(isolate_, prototype, "trimLeft", trim_start_fun,
    2074         111 :                           DONT_ENUM);
    2075             : 
    2076             :     // Install `String.prototype.trimEnd` with `trimRight` alias.
    2077             :     Handle<JSFunction> trim_end_fun =
    2078             :         SimpleInstallFunction(isolate_, prototype, "trimEnd",
    2079         111 :                               Builtins::kStringPrototypeTrimEnd, 0, false);
    2080             :     JSObject::AddProperty(isolate_, prototype, "trimRight", trim_end_fun,
    2081         111 :                           DONT_ENUM);
    2082             : 
    2083             :     SimpleInstallFunction(isolate_, prototype, "toLocaleLowerCase",
    2084             :                           Builtins::kStringPrototypeToLocaleLowerCase, 0,
    2085         111 :                           false);
    2086             :     SimpleInstallFunction(isolate_, prototype, "toLocaleUpperCase",
    2087             :                           Builtins::kStringPrototypeToLocaleUpperCase, 0,
    2088         111 :                           false);
    2089             : #ifdef V8_INTL_SUPPORT
    2090             :     SimpleInstallFunction(isolate_, prototype, "toLowerCase",
    2091         111 :                           Builtins::kStringPrototypeToLowerCaseIntl, 0, true);
    2092             :     SimpleInstallFunction(isolate_, prototype, "toUpperCase",
    2093         111 :                           Builtins::kStringPrototypeToUpperCaseIntl, 0, false);
    2094             : #else
    2095             :     SimpleInstallFunction(isolate_, prototype, "toLowerCase",
    2096             :                           Builtins::kStringPrototypeToLowerCase, 0, false);
    2097             :     SimpleInstallFunction(isolate_, prototype, "toUpperCase",
    2098             :                           Builtins::kStringPrototypeToUpperCase, 0, false);
    2099             : #endif
    2100             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    2101         111 :                           Builtins::kStringPrototypeValueOf, 0, true);
    2102             : 
    2103             :     InstallFunctionAtSymbol(isolate_, prototype, factory->iterator_symbol(),
    2104             :                             "[Symbol.iterator]",
    2105             :                             Builtins::kStringPrototypeIterator, 0, true,
    2106         111 :                             DONT_ENUM, BuiltinFunctionId::kStringIterator);
    2107             :   }
    2108             : 
    2109             :   {  // --- S t r i n g I t e r a t o r ---
    2110             :     Handle<JSObject> iterator_prototype(
    2111         222 :         native_context()->initial_iterator_prototype(), isolate());
    2112             : 
    2113             :     Handle<JSObject> string_iterator_prototype =
    2114         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    2115         111 :     JSObject::ForceSetPrototype(string_iterator_prototype, iterator_prototype);
    2116             : 
    2117         111 :     InstallToStringTag(isolate_, string_iterator_prototype, "String Iterator");
    2118             : 
    2119             :     InstallFunctionWithBuiltinId(isolate_, string_iterator_prototype, "next",
    2120             :                                  Builtins::kStringIteratorPrototypeNext, 0,
    2121         111 :                                  true, BuiltinFunctionId::kStringIteratorNext);
    2122             : 
    2123             :     Handle<JSFunction> string_iterator_function = CreateFunction(
    2124             :         isolate_, factory->InternalizeUtf8String("StringIterator"),
    2125             :         JS_STRING_ITERATOR_TYPE, JSStringIterator::kSize, 0,
    2126         111 :         string_iterator_prototype, Builtins::kIllegal);
    2127         111 :     string_iterator_function->shared()->set_native(false);
    2128         222 :     native_context()->set_initial_string_iterator_map(
    2129         333 :         string_iterator_function->initial_map());
    2130         222 :     native_context()->set_initial_string_iterator_prototype(
    2131         111 :         *string_iterator_prototype);
    2132             :   }
    2133             : 
    2134             :   {  // --- S y m b o l ---
    2135             :     Handle<JSFunction> symbol_fun = InstallFunction(
    2136             :         isolate_, global, "Symbol", JS_VALUE_TYPE, JSValue::kSize, 0,
    2137         111 :         factory->the_hole_value(), Builtins::kSymbolConstructor);
    2138         222 :     symbol_fun->shared()->set_builtin_function_id(
    2139         222 :         BuiltinFunctionId::kSymbolConstructor);
    2140         222 :     symbol_fun->shared()->set_length(0);
    2141         222 :     symbol_fun->shared()->DontAdaptArguments();
    2142         111 :     native_context()->set_symbol_function(*symbol_fun);
    2143             : 
    2144             :     // Install the Symbol.for and Symbol.keyFor functions.
    2145             :     SimpleInstallFunction(isolate_, symbol_fun, "for", Builtins::kSymbolFor, 1,
    2146         111 :                           false);
    2147             :     SimpleInstallFunction(isolate_, symbol_fun, "keyFor",
    2148         111 :                           Builtins::kSymbolKeyFor, 1, false);
    2149             : 
    2150             :     // Install well-known symbols.
    2151             :     InstallConstant(isolate_, symbol_fun, "asyncIterator",
    2152         111 :                     factory->async_iterator_symbol());
    2153             :     InstallConstant(isolate_, symbol_fun, "hasInstance",
    2154         111 :                     factory->has_instance_symbol());
    2155             :     InstallConstant(isolate_, symbol_fun, "isConcatSpreadable",
    2156         111 :                     factory->is_concat_spreadable_symbol());
    2157             :     InstallConstant(isolate_, symbol_fun, "iterator",
    2158         111 :                     factory->iterator_symbol());
    2159         111 :     InstallConstant(isolate_, symbol_fun, "match", factory->match_symbol());
    2160         111 :     InstallConstant(isolate_, symbol_fun, "replace", factory->replace_symbol());
    2161         111 :     InstallConstant(isolate_, symbol_fun, "search", factory->search_symbol());
    2162         111 :     InstallConstant(isolate_, symbol_fun, "species", factory->species_symbol());
    2163         111 :     InstallConstant(isolate_, symbol_fun, "split", factory->split_symbol());
    2164             :     InstallConstant(isolate_, symbol_fun, "toPrimitive",
    2165         111 :                     factory->to_primitive_symbol());
    2166             :     InstallConstant(isolate_, symbol_fun, "toStringTag",
    2167         111 :                     factory->to_string_tag_symbol());
    2168             :     InstallConstant(isolate_, symbol_fun, "unscopables",
    2169         111 :                     factory->unscopables_symbol());
    2170             : 
    2171             :     // Setup %SymbolPrototype%.
    2172             :     Handle<JSObject> prototype(JSObject::cast(symbol_fun->instance_prototype()),
    2173         222 :                                isolate());
    2174             : 
    2175         111 :     InstallToStringTag(isolate_, prototype, "Symbol");
    2176             : 
    2177             :     // Install the Symbol.prototype methods.
    2178             :     InstallFunctionWithBuiltinId(isolate_, prototype, "toString",
    2179             :                                  Builtins::kSymbolPrototypeToString, 0, true,
    2180         111 :                                  BuiltinFunctionId::kSymbolPrototypeToString);
    2181             :     InstallFunctionWithBuiltinId(isolate_, prototype, "valueOf",
    2182             :                                  Builtins::kSymbolPrototypeValueOf, 0, true,
    2183         111 :                                  BuiltinFunctionId::kSymbolPrototypeValueOf);
    2184             : 
    2185             :     // Install the @@toPrimitive function.
    2186             :     InstallFunctionAtSymbol(
    2187             :         isolate_, prototype, factory->to_primitive_symbol(),
    2188             :         "[Symbol.toPrimitive]", Builtins::kSymbolPrototypeToPrimitive, 1, true,
    2189         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2190             :   }
    2191             : 
    2192             :   {  // --- D a t e ---
    2193             :     Handle<JSFunction> date_fun = InstallFunction(
    2194             :         isolate_, global, "Date", JS_DATE_TYPE, JSDate::kSize, 0,
    2195         111 :         factory->the_hole_value(), Builtins::kDateConstructor);
    2196             :     InstallWithIntrinsicDefaultProto(isolate_, date_fun,
    2197         111 :                                      Context::DATE_FUNCTION_INDEX);
    2198         222 :     date_fun->shared()->set_length(7);
    2199         222 :     date_fun->shared()->DontAdaptArguments();
    2200             : 
    2201             :     // Install the Date.now, Date.parse and Date.UTC functions.
    2202             :     SimpleInstallFunction(isolate_, date_fun, "now", Builtins::kDateNow, 0,
    2203         111 :                           false);
    2204             :     SimpleInstallFunction(isolate_, date_fun, "parse", Builtins::kDateParse, 1,
    2205         111 :                           false);
    2206             :     SimpleInstallFunction(isolate_, date_fun, "UTC", Builtins::kDateUTC, 7,
    2207         111 :                           false);
    2208             : 
    2209             :     // Setup %DatePrototype%.
    2210             :     Handle<JSObject> prototype(JSObject::cast(date_fun->instance_prototype()),
    2211         222 :                                isolate());
    2212             : 
    2213             :     // Install the Date.prototype methods.
    2214             :     SimpleInstallFunction(isolate_, prototype, "toString",
    2215         111 :                           Builtins::kDatePrototypeToString, 0, false);
    2216             :     SimpleInstallFunction(isolate_, prototype, "toDateString",
    2217         111 :                           Builtins::kDatePrototypeToDateString, 0, false);
    2218             :     SimpleInstallFunction(isolate_, prototype, "toTimeString",
    2219         111 :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2220             :     SimpleInstallFunction(isolate_, prototype, "toISOString",
    2221         111 :                           Builtins::kDatePrototypeToISOString, 0, false);
    2222             :     Handle<JSFunction> to_utc_string =
    2223             :         SimpleInstallFunction(isolate_, prototype, "toUTCString",
    2224         111 :                               Builtins::kDatePrototypeToUTCString, 0, false);
    2225             :     JSObject::AddProperty(isolate_, prototype, "toGMTString", to_utc_string,
    2226         111 :                           DONT_ENUM);
    2227             :     SimpleInstallFunction(isolate_, prototype, "getDate",
    2228         111 :                           Builtins::kDatePrototypeGetDate, 0, true);
    2229             :     SimpleInstallFunction(isolate_, prototype, "setDate",
    2230         111 :                           Builtins::kDatePrototypeSetDate, 1, false);
    2231             :     SimpleInstallFunction(isolate_, prototype, "getDay",
    2232         111 :                           Builtins::kDatePrototypeGetDay, 0, true);
    2233             :     SimpleInstallFunction(isolate_, prototype, "getFullYear",
    2234         111 :                           Builtins::kDatePrototypeGetFullYear, 0, true);
    2235             :     SimpleInstallFunction(isolate_, prototype, "setFullYear",
    2236         111 :                           Builtins::kDatePrototypeSetFullYear, 3, false);
    2237             :     SimpleInstallFunction(isolate_, prototype, "getHours",
    2238         111 :                           Builtins::kDatePrototypeGetHours, 0, true);
    2239             :     SimpleInstallFunction(isolate_, prototype, "setHours",
    2240         111 :                           Builtins::kDatePrototypeSetHours, 4, false);
    2241             :     SimpleInstallFunction(isolate_, prototype, "getMilliseconds",
    2242         111 :                           Builtins::kDatePrototypeGetMilliseconds, 0, true);
    2243             :     SimpleInstallFunction(isolate_, prototype, "setMilliseconds",
    2244         111 :                           Builtins::kDatePrototypeSetMilliseconds, 1, false);
    2245             :     SimpleInstallFunction(isolate_, prototype, "getMinutes",
    2246         111 :                           Builtins::kDatePrototypeGetMinutes, 0, true);
    2247             :     SimpleInstallFunction(isolate_, prototype, "setMinutes",
    2248         111 :                           Builtins::kDatePrototypeSetMinutes, 3, false);
    2249             :     SimpleInstallFunction(isolate_, prototype, "getMonth",
    2250         111 :                           Builtins::kDatePrototypeGetMonth, 0, true);
    2251             :     SimpleInstallFunction(isolate_, prototype, "setMonth",
    2252         111 :                           Builtins::kDatePrototypeSetMonth, 2, false);
    2253             :     SimpleInstallFunction(isolate_, prototype, "getSeconds",
    2254         111 :                           Builtins::kDatePrototypeGetSeconds, 0, true);
    2255             :     SimpleInstallFunction(isolate_, prototype, "setSeconds",
    2256         111 :                           Builtins::kDatePrototypeSetSeconds, 2, false);
    2257             :     SimpleInstallFunction(isolate_, prototype, "getTime",
    2258         111 :                           Builtins::kDatePrototypeGetTime, 0, true);
    2259             :     SimpleInstallFunction(isolate_, prototype, "setTime",
    2260         111 :                           Builtins::kDatePrototypeSetTime, 1, false);
    2261             :     SimpleInstallFunction(isolate_, prototype, "getTimezoneOffset",
    2262         111 :                           Builtins::kDatePrototypeGetTimezoneOffset, 0, true);
    2263             :     SimpleInstallFunction(isolate_, prototype, "getUTCDate",
    2264         111 :                           Builtins::kDatePrototypeGetUTCDate, 0, true);
    2265             :     SimpleInstallFunction(isolate_, prototype, "setUTCDate",
    2266         111 :                           Builtins::kDatePrototypeSetUTCDate, 1, false);
    2267             :     SimpleInstallFunction(isolate_, prototype, "getUTCDay",
    2268         111 :                           Builtins::kDatePrototypeGetUTCDay, 0, true);
    2269             :     SimpleInstallFunction(isolate_, prototype, "getUTCFullYear",
    2270         111 :                           Builtins::kDatePrototypeGetUTCFullYear, 0, true);
    2271             :     SimpleInstallFunction(isolate_, prototype, "setUTCFullYear",
    2272         111 :                           Builtins::kDatePrototypeSetUTCFullYear, 3, false);
    2273             :     SimpleInstallFunction(isolate_, prototype, "getUTCHours",
    2274         111 :                           Builtins::kDatePrototypeGetUTCHours, 0, true);
    2275             :     SimpleInstallFunction(isolate_, prototype, "setUTCHours",
    2276         111 :                           Builtins::kDatePrototypeSetUTCHours, 4, false);
    2277             :     SimpleInstallFunction(isolate_, prototype, "getUTCMilliseconds",
    2278         111 :                           Builtins::kDatePrototypeGetUTCMilliseconds, 0, true);
    2279             :     SimpleInstallFunction(isolate_, prototype, "setUTCMilliseconds",
    2280         111 :                           Builtins::kDatePrototypeSetUTCMilliseconds, 1, false);
    2281             :     SimpleInstallFunction(isolate_, prototype, "getUTCMinutes",
    2282         111 :                           Builtins::kDatePrototypeGetUTCMinutes, 0, true);
    2283             :     SimpleInstallFunction(isolate_, prototype, "setUTCMinutes",
    2284         111 :                           Builtins::kDatePrototypeSetUTCMinutes, 3, false);
    2285             :     SimpleInstallFunction(isolate_, prototype, "getUTCMonth",
    2286         111 :                           Builtins::kDatePrototypeGetUTCMonth, 0, true);
    2287             :     SimpleInstallFunction(isolate_, prototype, "setUTCMonth",
    2288         111 :                           Builtins::kDatePrototypeSetUTCMonth, 2, false);
    2289             :     SimpleInstallFunction(isolate_, prototype, "getUTCSeconds",
    2290         111 :                           Builtins::kDatePrototypeGetUTCSeconds, 0, true);
    2291             :     SimpleInstallFunction(isolate_, prototype, "setUTCSeconds",
    2292         111 :                           Builtins::kDatePrototypeSetUTCSeconds, 2, false);
    2293             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    2294         111 :                           Builtins::kDatePrototypeValueOf, 0, true);
    2295             :     SimpleInstallFunction(isolate_, prototype, "getYear",
    2296         111 :                           Builtins::kDatePrototypeGetYear, 0, true);
    2297             :     SimpleInstallFunction(isolate_, prototype, "setYear",
    2298         111 :                           Builtins::kDatePrototypeSetYear, 1, false);
    2299             :     SimpleInstallFunction(isolate_, prototype, "toJSON",
    2300         111 :                           Builtins::kDatePrototypeToJson, 1, false);
    2301             : 
    2302             : #ifdef V8_INTL_SUPPORT
    2303             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    2304         111 :                           Builtins::kDatePrototypeToLocaleString, 0, false);
    2305             :     SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
    2306         111 :                           Builtins::kDatePrototypeToLocaleDateString, 0, false);
    2307             :     SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
    2308         111 :                           Builtins::kDatePrototypeToLocaleTimeString, 0, false);
    2309             : #else
    2310             :     // Install Intl fallback functions.
    2311             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    2312             :                           Builtins::kDatePrototypeToString, 0, false);
    2313             :     SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
    2314             :                           Builtins::kDatePrototypeToDateString, 0, false);
    2315             :     SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
    2316             :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2317             : #endif  // V8_INTL_SUPPORT
    2318             : 
    2319             :     // Install the @@toPrimitive function.
    2320             :     InstallFunctionAtSymbol(
    2321             :         isolate_, prototype, factory->to_primitive_symbol(),
    2322             :         "[Symbol.toPrimitive]", Builtins::kDatePrototypeToPrimitive, 1, true,
    2323         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2324             :   }
    2325             : 
    2326             :   {
    2327             :     Handle<SharedFunctionInfo> info = SimpleCreateBuiltinSharedFunctionInfo(
    2328             :         isolate_, Builtins::kPromiseGetCapabilitiesExecutor,
    2329         111 :         factory->empty_string(), 2);
    2330         111 :     native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
    2331             :   }
    2332             : 
    2333             :   {  // -- P r o m i s e
    2334             :     Handle<JSFunction> promise_fun = InstallFunction(
    2335             :         isolate_, global, "Promise", JS_PROMISE_TYPE,
    2336             :         JSPromise::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    2337         111 :         Builtins::kPromiseConstructor);
    2338             :     InstallWithIntrinsicDefaultProto(isolate_, promise_fun,
    2339         111 :                                      Context::PROMISE_FUNCTION_INDEX);
    2340             : 
    2341         333 :     Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate_);
    2342             :     shared->set_internal_formal_parameter_count(1);
    2343             :     shared->set_length(1);
    2344             : 
    2345         111 :     InstallSpeciesGetter(isolate_, promise_fun);
    2346             : 
    2347             :     Handle<JSFunction> promise_all = InstallFunctionWithBuiltinId(
    2348             :         isolate_, promise_fun, "all", Builtins::kPromiseAll, 1, true,
    2349         111 :         BuiltinFunctionId::kPromiseAll);
    2350         111 :     native_context()->set_promise_all(*promise_all);
    2351             : 
    2352             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "race",
    2353             :                                  Builtins::kPromiseRace, 1, true,
    2354         111 :                                  BuiltinFunctionId::kPromiseRace);
    2355             : 
    2356             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "resolve",
    2357             :                                  Builtins::kPromiseResolveTrampoline, 1, true,
    2358         111 :                                  BuiltinFunctionId::kPromiseResolve);
    2359             : 
    2360             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "reject",
    2361             :                                  Builtins::kPromiseReject, 1, true,
    2362         111 :                                  BuiltinFunctionId::kPromiseReject);
    2363             : 
    2364             :     // Setup %PromisePrototype%.
    2365             :     Handle<JSObject> prototype(
    2366         222 :         JSObject::cast(promise_fun->instance_prototype()), isolate());
    2367         111 :     native_context()->set_promise_prototype(*prototype);
    2368             : 
    2369         111 :     InstallToStringTag(isolate_, prototype, factory->Promise_string());
    2370             : 
    2371             :     Handle<JSFunction> promise_then = InstallFunctionWithBuiltinId(
    2372             :         isolate_, prototype, "then", Builtins::kPromisePrototypeThen, 2, true,
    2373         111 :         BuiltinFunctionId::kPromisePrototypeThen);
    2374         111 :     native_context()->set_promise_then(*promise_then);
    2375             : 
    2376             :     Handle<JSFunction> promise_catch = InstallFunctionWithBuiltinId(
    2377             :         isolate_, prototype, "catch", Builtins::kPromisePrototypeCatch, 1, true,
    2378         111 :         BuiltinFunctionId::kPromisePrototypeCatch);
    2379         111 :     native_context()->set_promise_catch(*promise_catch);
    2380             : 
    2381             :     InstallFunctionWithBuiltinId(isolate_, prototype, "finally",
    2382             :                                  Builtins::kPromisePrototypeFinally, 1, true,
    2383         111 :                                  BuiltinFunctionId::kPromisePrototypeFinally);
    2384             : 
    2385             :     {
    2386             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2387             :           isolate(), Builtins::kPromiseThenFinally,
    2388         222 :           isolate_->factory()->empty_string(), 1);
    2389         111 :       info->set_native(true);
    2390         111 :       native_context()->set_promise_then_finally_shared_fun(*info);
    2391             :     }
    2392             : 
    2393             :     {
    2394             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2395             :           isolate(), Builtins::kPromiseCatchFinally,
    2396         222 :           isolate_->factory()->empty_string(), 1);
    2397         111 :       info->set_native(true);
    2398         111 :       native_context()->set_promise_catch_finally_shared_fun(*info);
    2399             :     }
    2400             : 
    2401             :     {
    2402             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2403             :           isolate(), Builtins::kPromiseValueThunkFinally,
    2404         222 :           isolate_->factory()->empty_string(), 0);
    2405         111 :       native_context()->set_promise_value_thunk_finally_shared_fun(*info);
    2406             :     }
    2407             : 
    2408             :     {
    2409             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2410             :           isolate(), Builtins::kPromiseThrowerFinally,
    2411         222 :           isolate_->factory()->empty_string(), 0);
    2412         111 :       native_context()->set_promise_thrower_finally_shared_fun(*info);
    2413             :     }
    2414             : 
    2415             :     // Force the Promise constructor to fast properties, so that we can use the
    2416             :     // fast paths for various things like
    2417             :     //
    2418             :     //   x instanceof Promise
    2419             :     //
    2420             :     // etc. We should probably come up with a more principled approach once
    2421             :     // the JavaScript builtins are gone.
    2422             :     JSObject::MigrateSlowToFast(Handle<JSObject>::cast(promise_fun), 0,
    2423         111 :                                 "Bootstrapping");
    2424             : 
    2425             :     Handle<Map> prototype_map(prototype->map(), isolate());
    2426         111 :     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
    2427             : 
    2428             :     {  // Internal: IsPromise
    2429             :       Handle<JSFunction> function = SimpleCreateFunction(
    2430         111 :           isolate_, factory->empty_string(), Builtins::kIsPromise, 1, false);
    2431         111 :       native_context()->set_is_promise(*function);
    2432             :     }
    2433             : 
    2434             :     {
    2435             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2436             :           isolate_, Builtins::kPromiseCapabilityDefaultResolve,
    2437         111 :           factory->empty_string(), 1, FunctionKind::kConciseMethod);
    2438         111 :       info->set_native(true);
    2439             :       info->set_function_map_index(
    2440         111 :           Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
    2441         222 :       native_context()->set_promise_capability_default_resolve_shared_fun(
    2442         111 :           *info);
    2443             : 
    2444             :       info = SimpleCreateSharedFunctionInfo(
    2445             :           isolate_, Builtins::kPromiseCapabilityDefaultReject,
    2446         111 :           factory->empty_string(), 1, FunctionKind::kConciseMethod);
    2447         111 :       info->set_native(true);
    2448             :       info->set_function_map_index(
    2449         111 :           Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
    2450         111 :       native_context()->set_promise_capability_default_reject_shared_fun(*info);
    2451             :     }
    2452             : 
    2453             :     {
    2454             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2455             :           isolate_, Builtins::kPromiseAllResolveElementClosure,
    2456         111 :           factory->empty_string(), 1);
    2457         111 :       native_context()->set_promise_all_resolve_element_shared_fun(*info);
    2458             :     }
    2459             : 
    2460             :     // Force the Promise constructor to fast properties, so that we can use the
    2461             :     // fast paths for various things like
    2462             :     //
    2463             :     //   x instanceof Promise
    2464             :     //
    2465             :     // etc. We should probably come up with a more principled approach once
    2466             :     // the JavaScript builtins are gone.
    2467         111 :     JSObject::MigrateSlowToFast(promise_fun, 0, "Bootstrapping");
    2468             :   }
    2469             : 
    2470             :   {  // -- R e g E x p
    2471             :     // Builtin functions for RegExp.prototype.
    2472             :     Handle<JSFunction> regexp_fun = InstallFunction(
    2473             :         isolate_, global, "RegExp", JS_REGEXP_TYPE,
    2474             :         JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kTaggedSize,
    2475             :         JSRegExp::kInObjectFieldCount, factory->the_hole_value(),
    2476         111 :         Builtins::kRegExpConstructor);
    2477             :     InstallWithIntrinsicDefaultProto(isolate_, regexp_fun,
    2478         111 :                                      Context::REGEXP_FUNCTION_INDEX);
    2479             : 
    2480         333 :     Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate_);
    2481             :     shared->set_internal_formal_parameter_count(2);
    2482             :     shared->set_length(2);
    2483             : 
    2484             :     {
    2485             :       // Setup %RegExpPrototype%.
    2486             :       Handle<JSObject> prototype(
    2487         222 :           JSObject::cast(regexp_fun->instance_prototype()), isolate());
    2488         111 :       native_context()->set_regexp_prototype(*prototype);
    2489             : 
    2490             :       {
    2491             :         Handle<JSFunction> fun =
    2492             :             SimpleInstallFunction(isolate_, prototype, "exec",
    2493         111 :                                   Builtins::kRegExpPrototypeExec, 1, true);
    2494             :         // Check that index of "exec" function in JSRegExp is correct.
    2495             :         DCHECK_EQ(JSRegExp::kExecFunctionDescriptorIndex,
    2496             :                   prototype->map()->LastAdded());
    2497             : 
    2498         111 :         native_context()->set_regexp_exec_function(*fun);
    2499             :       }
    2500             : 
    2501             :       SimpleInstallGetter(isolate_, prototype, factory->dotAll_string(),
    2502         111 :                           Builtins::kRegExpPrototypeDotAllGetter, true);
    2503             :       SimpleInstallGetter(isolate_, prototype, factory->flags_string(),
    2504         111 :                           Builtins::kRegExpPrototypeFlagsGetter, true);
    2505             :       SimpleInstallGetter(isolate_, prototype, factory->global_string(),
    2506         111 :                           Builtins::kRegExpPrototypeGlobalGetter, true);
    2507             :       SimpleInstallGetter(isolate_, prototype, factory->ignoreCase_string(),
    2508         111 :                           Builtins::kRegExpPrototypeIgnoreCaseGetter, true);
    2509             :       SimpleInstallGetter(isolate_, prototype, factory->multiline_string(),
    2510         111 :                           Builtins::kRegExpPrototypeMultilineGetter, true);
    2511             :       SimpleInstallGetter(isolate_, prototype, factory->source_string(),
    2512         111 :                           Builtins::kRegExpPrototypeSourceGetter, true);
    2513             :       SimpleInstallGetter(isolate_, prototype, factory->sticky_string(),
    2514         111 :                           Builtins::kRegExpPrototypeStickyGetter, true);
    2515             :       SimpleInstallGetter(isolate_, prototype, factory->unicode_string(),
    2516         111 :                           Builtins::kRegExpPrototypeUnicodeGetter, true);
    2517             : 
    2518             :       SimpleInstallFunction(isolate_, prototype, "compile",
    2519         111 :                             Builtins::kRegExpPrototypeCompile, 2, true);
    2520             :       SimpleInstallFunction(isolate_, prototype, "toString",
    2521         111 :                             Builtins::kRegExpPrototypeToString, 0, false);
    2522             :       SimpleInstallFunction(isolate_, prototype, "test",
    2523         111 :                             Builtins::kRegExpPrototypeTest, 1, true);
    2524             : 
    2525             :       InstallFunctionAtSymbol(isolate_, prototype, factory->match_symbol(),
    2526             :                               "[Symbol.match]", Builtins::kRegExpPrototypeMatch,
    2527         111 :                               1, true);
    2528             :       DCHECK_EQ(JSRegExp::kSymbolMatchFunctionDescriptorIndex,
    2529             :                 prototype->map()->LastAdded());
    2530             : 
    2531             :       InstallFunctionAtSymbol(isolate_, prototype, factory->replace_symbol(),
    2532             :                               "[Symbol.replace]",
    2533         111 :                               Builtins::kRegExpPrototypeReplace, 2, false);
    2534             :       DCHECK_EQ(JSRegExp::kSymbolReplaceFunctionDescriptorIndex,
    2535             :                 prototype->map()->LastAdded());
    2536             : 
    2537             :       InstallFunctionAtSymbol(isolate_, prototype, factory->search_symbol(),
    2538             :                               "[Symbol.search]",
    2539         111 :                               Builtins::kRegExpPrototypeSearch, 1, true);
    2540             :       DCHECK_EQ(JSRegExp::kSymbolSearchFunctionDescriptorIndex,
    2541             :                 prototype->map()->LastAdded());
    2542             : 
    2543             :       InstallFunctionAtSymbol(isolate_, prototype, factory->split_symbol(),
    2544             :                               "[Symbol.split]", Builtins::kRegExpPrototypeSplit,
    2545         111 :                               2, false);
    2546             :       DCHECK_EQ(JSRegExp::kSymbolSplitFunctionDescriptorIndex,
    2547             :                 prototype->map()->LastAdded());
    2548             : 
    2549             :       Handle<Map> prototype_map(prototype->map(), isolate());
    2550         111 :       Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
    2551             : 
    2552             :       // Store the initial RegExp.prototype map. This is used in fast-path
    2553             :       // checks. Do not alter the prototype after this point.
    2554         111 :       native_context()->set_regexp_prototype_map(*prototype_map);
    2555             :     }
    2556             : 
    2557             :     {
    2558             :       // RegExp getters and setters.
    2559             : 
    2560         111 :       InstallSpeciesGetter(isolate_, regexp_fun);
    2561             : 
    2562             :       // Static properties set by a successful match.
    2563             : 
    2564             :       SimpleInstallGetterSetter(isolate_, regexp_fun, factory->input_string(),
    2565             :                                 Builtins::kRegExpInputGetter,
    2566         111 :                                 Builtins::kRegExpInputSetter);
    2567             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$_",
    2568             :                                 Builtins::kRegExpInputGetter,
    2569         111 :                                 Builtins::kRegExpInputSetter);
    2570             : 
    2571             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "lastMatch",
    2572             :                                 Builtins::kRegExpLastMatchGetter,
    2573         111 :                                 Builtins::kEmptyFunction);
    2574             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$&",
    2575             :                                 Builtins::kRegExpLastMatchGetter,
    2576         111 :                                 Builtins::kEmptyFunction);
    2577             : 
    2578             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "lastParen",
    2579             :                                 Builtins::kRegExpLastParenGetter,
    2580         111 :                                 Builtins::kEmptyFunction);
    2581             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$+",
    2582             :                                 Builtins::kRegExpLastParenGetter,
    2583         111 :                                 Builtins::kEmptyFunction);
    2584             : 
    2585             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "leftContext",
    2586             :                                 Builtins::kRegExpLeftContextGetter,
    2587         111 :                                 Builtins::kEmptyFunction);
    2588             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$`",
    2589             :                                 Builtins::kRegExpLeftContextGetter,
    2590         111 :                                 Builtins::kEmptyFunction);
    2591             : 
    2592             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "rightContext",
    2593             :                                 Builtins::kRegExpRightContextGetter,
    2594         111 :                                 Builtins::kEmptyFunction);
    2595             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$'",
    2596             :                                 Builtins::kRegExpRightContextGetter,
    2597         111 :                                 Builtins::kEmptyFunction);
    2598             : 
    2599             : #define INSTALL_CAPTURE_GETTER(i)                                \
    2600             :   SimpleInstallGetterSetter(isolate_, regexp_fun, "$" #i,        \
    2601             :                             Builtins::kRegExpCapture##i##Getter, \
    2602             :                             Builtins::kEmptyFunction)
    2603         111 :       INSTALL_CAPTURE_GETTER(1);
    2604         111 :       INSTALL_CAPTURE_GETTER(2);
    2605         111 :       INSTALL_CAPTURE_GETTER(3);
    2606         111 :       INSTALL_CAPTURE_GETTER(4);
    2607         111 :       INSTALL_CAPTURE_GETTER(5);
    2608         111 :       INSTALL_CAPTURE_GETTER(6);
    2609         111 :       INSTALL_CAPTURE_GETTER(7);
    2610         111 :       INSTALL_CAPTURE_GETTER(8);
    2611         111 :       INSTALL_CAPTURE_GETTER(9);
    2612             : #undef INSTALL_CAPTURE_GETTER
    2613             :     }
    2614             : 
    2615             :     DCHECK(regexp_fun->has_initial_map());
    2616         222 :     Handle<Map> initial_map(regexp_fun->initial_map(), isolate());
    2617             : 
    2618             :     DCHECK_EQ(1, initial_map->GetInObjectProperties());
    2619             : 
    2620         111 :     Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
    2621             : 
    2622             :     // ECMA-262, section 15.10.7.5.
    2623             :     PropertyAttributes writable =
    2624             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
    2625             :     Descriptor d = Descriptor::DataField(isolate(), factory->lastIndex_string(),
    2626             :                                          JSRegExp::kLastIndexFieldIndex,
    2627         111 :                                          writable, Representation::Tagged());
    2628         111 :     initial_map->AppendDescriptor(isolate(), &d);
    2629             : 
    2630             :     {  // Internal: RegExpInternalMatch
    2631             :       Handle<JSFunction> function =
    2632             :           SimpleCreateFunction(isolate_, isolate_->factory()->empty_string(),
    2633         222 :                                Builtins::kRegExpInternalMatch, 2, true);
    2634         222 :       native_context()->set(Context::REGEXP_INTERNAL_MATCH, *function);
    2635             :     }
    2636             : 
    2637             :     // Create the last match info. One for external use, and one for internal
    2638             :     // use when we don't want to modify the externally visible match info.
    2639         111 :     Handle<RegExpMatchInfo> last_match_info = factory->NewRegExpMatchInfo();
    2640         111 :     native_context()->set_regexp_last_match_info(*last_match_info);
    2641         111 :     Handle<RegExpMatchInfo> internal_match_info = factory->NewRegExpMatchInfo();
    2642         111 :     native_context()->set_regexp_internal_match_info(*internal_match_info);
    2643             : 
    2644             :     // Force the RegExp constructor to fast properties, so that we can use the
    2645             :     // fast paths for various things like
    2646             :     //
    2647             :     //   x instanceof RegExp
    2648             :     //
    2649             :     // etc. We should probably come up with a more principled approach once
    2650             :     // the JavaScript builtins are gone.
    2651         111 :     JSObject::MigrateSlowToFast(regexp_fun, 0, "Bootstrapping");
    2652             :   }
    2653             : 
    2654             :   {  // -- E r r o r
    2655             :     InstallError(isolate_, global, factory->Error_string(),
    2656         111 :                  Context::ERROR_FUNCTION_INDEX);
    2657         111 :     InstallMakeError(isolate_, Builtins::kMakeError, Context::MAKE_ERROR_INDEX);
    2658             :   }
    2659             : 
    2660             :   {  // -- E v a l E r r o r
    2661             :     InstallError(isolate_, global, factory->EvalError_string(),
    2662         111 :                  Context::EVAL_ERROR_FUNCTION_INDEX);
    2663             :   }
    2664             : 
    2665             :   {  // -- R a n g e E r r o r
    2666             :     InstallError(isolate_, global, factory->RangeError_string(),
    2667         111 :                  Context::RANGE_ERROR_FUNCTION_INDEX);
    2668             :     InstallMakeError(isolate_, Builtins::kMakeRangeError,
    2669         111 :                      Context::MAKE_RANGE_ERROR_INDEX);
    2670             :   }
    2671             : 
    2672             :   {  // -- R e f e r e n c e E r r o r
    2673             :     InstallError(isolate_, global, factory->ReferenceError_string(),
    2674         111 :                  Context::REFERENCE_ERROR_FUNCTION_INDEX);
    2675             :   }
    2676             : 
    2677             :   {  // -- S y n t a x E r r o r
    2678             :     InstallError(isolate_, global, factory->SyntaxError_string(),
    2679         111 :                  Context::SYNTAX_ERROR_FUNCTION_INDEX);
    2680             :     InstallMakeError(isolate_, Builtins::kMakeSyntaxError,
    2681         111 :                      Context::MAKE_SYNTAX_ERROR_INDEX);
    2682             :   }
    2683             : 
    2684             :   {  // -- T y p e E r r o r
    2685             :     InstallError(isolate_, global, factory->TypeError_string(),
    2686         111 :                  Context::TYPE_ERROR_FUNCTION_INDEX);
    2687             :     InstallMakeError(isolate_, Builtins::kMakeTypeError,
    2688         111 :                      Context::MAKE_TYPE_ERROR_INDEX);
    2689             :   }
    2690             : 
    2691             :   {  // -- U R I E r r o r
    2692             :     InstallError(isolate_, global, factory->URIError_string(),
    2693         111 :                  Context::URI_ERROR_FUNCTION_INDEX);
    2694             :     InstallMakeError(isolate_, Builtins::kMakeURIError,
    2695         111 :                      Context::MAKE_URI_ERROR_INDEX);
    2696             :   }
    2697             : 
    2698             :   {  // -- C o m p i l e E r r o r
    2699         111 :     Handle<JSObject> dummy = factory->NewJSObject(isolate_->object_function());
    2700             :     InstallError(isolate_, dummy, factory->CompileError_string(),
    2701         111 :                  Context::WASM_COMPILE_ERROR_FUNCTION_INDEX);
    2702             : 
    2703             :     // -- L i n k E r r o r
    2704             :     InstallError(isolate_, dummy, factory->LinkError_string(),
    2705         111 :                  Context::WASM_LINK_ERROR_FUNCTION_INDEX);
    2706             : 
    2707             :     // -- R u n t i m e E r r o r
    2708             :     InstallError(isolate_, dummy, factory->RuntimeError_string(),
    2709         111 :                  Context::WASM_RUNTIME_ERROR_FUNCTION_INDEX);
    2710             :   }
    2711             : 
    2712             :   // Initialize the embedder data slot.
    2713             :   // TODO(ishell): microtask queue pointer will be moved from native context
    2714             :   // to the embedder data array so we don't need an empty embedder data array.
    2715         111 :   Handle<EmbedderDataArray> embedder_data = factory->NewEmbedderDataArray(0);
    2716         222 :   native_context()->set_embedder_data(*embedder_data);
    2717             : 
    2718             :   {  // -- J S O N
    2719             :     Handle<JSObject> json_object =
    2720         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    2721         111 :     JSObject::AddProperty(isolate_, global, "JSON", json_object, DONT_ENUM);
    2722             :     SimpleInstallFunction(isolate_, json_object, "parse", Builtins::kJsonParse,
    2723         111 :                           2, false);
    2724             :     SimpleInstallFunction(isolate_, json_object, "stringify",
    2725         111 :                           Builtins::kJsonStringify, 3, true);
    2726         111 :     InstallToStringTag(isolate_, json_object, "JSON");
    2727             :   }
    2728             : 
    2729             :   {  // -- M a t h
    2730             :     Handle<JSObject> math =
    2731         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    2732         111 :     JSObject::AddProperty(isolate_, global, "Math", math, DONT_ENUM);
    2733         111 :     SimpleInstallFunction(isolate_, math, "abs", Builtins::kMathAbs, 1, true);
    2734         111 :     SimpleInstallFunction(isolate_, math, "acos", Builtins::kMathAcos, 1, true);
    2735             :     SimpleInstallFunction(isolate_, math, "acosh", Builtins::kMathAcosh, 1,
    2736         111 :                           true);
    2737         111 :     SimpleInstallFunction(isolate_, math, "asin", Builtins::kMathAsin, 1, true);
    2738             :     SimpleInstallFunction(isolate_, math, "asinh", Builtins::kMathAsinh, 1,
    2739         111 :                           true);
    2740         111 :     SimpleInstallFunction(isolate_, math, "atan", Builtins::kMathAtan, 1, true);
    2741             :     SimpleInstallFunction(isolate_, math, "atanh", Builtins::kMathAtanh, 1,
    2742         111 :                           true);
    2743             :     SimpleInstallFunction(isolate_, math, "atan2", Builtins::kMathAtan2, 2,
    2744         111 :                           true);
    2745         111 :     SimpleInstallFunction(isolate_, math, "ceil", Builtins::kMathCeil, 1, true);
    2746         111 :     SimpleInstallFunction(isolate_, math, "cbrt", Builtins::kMathCbrt, 1, true);
    2747             :     SimpleInstallFunction(isolate_, math, "expm1", Builtins::kMathExpm1, 1,
    2748         111 :                           true);
    2749             :     SimpleInstallFunction(isolate_, math, "clz32", Builtins::kMathClz32, 1,
    2750         111 :                           true);
    2751         111 :     SimpleInstallFunction(isolate_, math, "cos", Builtins::kMathCos, 1, true);
    2752         111 :     SimpleInstallFunction(isolate_, math, "cosh", Builtins::kMathCosh, 1, true);
    2753         111 :     SimpleInstallFunction(isolate_, math, "exp", Builtins::kMathExp, 1, true);
    2754             :     Handle<JSFunction> math_floor = SimpleInstallFunction(
    2755         111 :         isolate_, math, "floor", Builtins::kMathFloor, 1, true);
    2756         111 :     native_context()->set_math_floor(*math_floor);
    2757             :     SimpleInstallFunction(isolate_, math, "fround", Builtins::kMathFround, 1,
    2758         111 :                           true);
    2759             :     SimpleInstallFunction(isolate_, math, "hypot", Builtins::kMathHypot, 2,
    2760         111 :                           false);
    2761         111 :     SimpleInstallFunction(isolate_, math, "imul", Builtins::kMathImul, 2, true);
    2762         111 :     SimpleInstallFunction(isolate_, math, "log", Builtins::kMathLog, 1, true);
    2763             :     SimpleInstallFunction(isolate_, math, "log1p", Builtins::kMathLog1p, 1,
    2764         111 :                           true);
    2765         111 :     SimpleInstallFunction(isolate_, math, "log2", Builtins::kMathLog2, 1, true);
    2766             :     SimpleInstallFunction(isolate_, math, "log10", Builtins::kMathLog10, 1,
    2767         111 :                           true);
    2768         111 :     SimpleInstallFunction(isolate_, math, "max", Builtins::kMathMax, 2, false);
    2769         111 :     SimpleInstallFunction(isolate_, math, "min", Builtins::kMathMin, 2, false);
    2770             :     Handle<JSFunction> math_pow = SimpleInstallFunction(
    2771         111 :         isolate_, math, "pow", Builtins::kMathPow, 2, true);
    2772         111 :     native_context()->set_math_pow(*math_pow);
    2773             :     SimpleInstallFunction(isolate_, math, "random", Builtins::kMathRandom, 0,
    2774         111 :                           true);
    2775             :     SimpleInstallFunction(isolate_, math, "round", Builtins::kMathRound, 1,
    2776         111 :                           true);
    2777         111 :     SimpleInstallFunction(isolate_, math, "sign", Builtins::kMathSign, 1, true);
    2778         111 :     SimpleInstallFunction(isolate_, math, "sin", Builtins::kMathSin, 1, true);
    2779         111 :     SimpleInstallFunction(isolate_, math, "sinh", Builtins::kMathSinh, 1, true);
    2780         111 :     SimpleInstallFunction(isolate_, math, "sqrt", Builtins::kMathSqrt, 1, true);
    2781         111 :     SimpleInstallFunction(isolate_, math, "tan", Builtins::kMathTan, 1, true);
    2782         111 :     SimpleInstallFunction(isolate_, math, "tanh", Builtins::kMathTanh, 1, true);
    2783             :     SimpleInstallFunction(isolate_, math, "trunc", Builtins::kMathTrunc, 1,
    2784         111 :                           true);
    2785             : 
    2786             :     // Install math constants.
    2787         111 :     double const kE = base::ieee754::exp(1.0);
    2788             :     double const kPI = 3.1415926535897932;
    2789         111 :     InstallConstant(isolate_, math, "E", factory->NewNumber(kE));
    2790             :     InstallConstant(isolate_, math, "LN10",
    2791         111 :                     factory->NewNumber(base::ieee754::log(10.0)));
    2792             :     InstallConstant(isolate_, math, "LN2",
    2793         111 :                     factory->NewNumber(base::ieee754::log(2.0)));
    2794             :     InstallConstant(isolate_, math, "LOG10E",
    2795         111 :                     factory->NewNumber(base::ieee754::log10(kE)));
    2796             :     InstallConstant(isolate_, math, "LOG2E",
    2797         111 :                     factory->NewNumber(base::ieee754::log2(kE)));
    2798         111 :     InstallConstant(isolate_, math, "PI", factory->NewNumber(kPI));
    2799             :     InstallConstant(isolate_, math, "SQRT1_2",
    2800         111 :                     factory->NewNumber(std::sqrt(0.5)));
    2801             :     InstallConstant(isolate_, math, "SQRT2",
    2802         111 :                     factory->NewNumber(std::sqrt(2.0)));
    2803         111 :     InstallToStringTag(isolate_, math, "Math");
    2804             :   }
    2805             : 
    2806             :   {  // -- C o n s o l e
    2807         111 :     Handle<String> name = factory->InternalizeUtf8String("console");
    2808             :     NewFunctionArgs args = NewFunctionArgs::ForFunctionWithoutCode(
    2809         111 :         name, isolate_->strict_function_map(), LanguageMode::kStrict);
    2810         111 :     Handle<JSFunction> cons = factory->NewFunction(args);
    2811             : 
    2812         111 :     Handle<JSObject> empty = factory->NewJSObject(isolate_->object_function());
    2813         111 :     JSFunction::SetPrototype(cons, empty);
    2814             : 
    2815         111 :     Handle<JSObject> console = factory->NewJSObject(cons, TENURED);
    2816             :     DCHECK(console->IsJSObject());
    2817         111 :     JSObject::AddProperty(isolate_, global, name, console, DONT_ENUM);
    2818             :     SimpleInstallFunction(isolate_, console, "debug", Builtins::kConsoleDebug,
    2819         111 :                           1, false, NONE);
    2820             :     SimpleInstallFunction(isolate_, console, "error", Builtins::kConsoleError,
    2821         111 :                           1, false, NONE);
    2822             :     SimpleInstallFunction(isolate_, console, "info", Builtins::kConsoleInfo, 1,
    2823         111 :                           false, NONE);
    2824             :     SimpleInstallFunction(isolate_, console, "log", Builtins::kConsoleLog, 1,
    2825         111 :                           false, NONE);
    2826             :     SimpleInstallFunction(isolate_, console, "warn", Builtins::kConsoleWarn, 1,
    2827         111 :                           false, NONE);
    2828             :     SimpleInstallFunction(isolate_, console, "dir", Builtins::kConsoleDir, 1,
    2829         111 :                           false, NONE);
    2830             :     SimpleInstallFunction(isolate_, console, "dirxml", Builtins::kConsoleDirXml,
    2831         111 :                           1, false, NONE);
    2832             :     SimpleInstallFunction(isolate_, console, "table", Builtins::kConsoleTable,
    2833         111 :                           1, false, NONE);
    2834             :     SimpleInstallFunction(isolate_, console, "trace", Builtins::kConsoleTrace,
    2835         111 :                           1, false, NONE);
    2836             :     SimpleInstallFunction(isolate_, console, "group", Builtins::kConsoleGroup,
    2837         111 :                           1, false, NONE);
    2838             :     SimpleInstallFunction(isolate_, console, "groupCollapsed",
    2839         111 :                           Builtins::kConsoleGroupCollapsed, 1, false, NONE);
    2840             :     SimpleInstallFunction(isolate_, console, "groupEnd",
    2841         111 :                           Builtins::kConsoleGroupEnd, 1, false, NONE);
    2842             :     SimpleInstallFunction(isolate_, console, "clear", Builtins::kConsoleClear,
    2843         111 :                           1, false, NONE);
    2844             :     SimpleInstallFunction(isolate_, console, "count", Builtins::kConsoleCount,
    2845         111 :                           1, false, NONE);
    2846             :     SimpleInstallFunction(isolate_, console, "countReset",
    2847         111 :                           Builtins::kConsoleCountReset, 1, false, NONE);
    2848             :     SimpleInstallFunction(isolate_, console, "assert",
    2849         111 :                           Builtins::kFastConsoleAssert, 1, false, NONE);
    2850             :     SimpleInstallFunction(isolate_, console, "profile",
    2851         111 :                           Builtins::kConsoleProfile, 1, false, NONE);
    2852             :     SimpleInstallFunction(isolate_, console, "profileEnd",
    2853         111 :                           Builtins::kConsoleProfileEnd, 1, false, NONE);
    2854             :     SimpleInstallFunction(isolate_, console, "time", Builtins::kConsoleTime, 1,
    2855         111 :                           false, NONE);
    2856             :     SimpleInstallFunction(isolate_, console, "timeLog",
    2857         111 :                           Builtins::kConsoleTimeLog, 1, false, NONE);
    2858             :     SimpleInstallFunction(isolate_, console, "timeEnd",
    2859         111 :                           Builtins::kConsoleTimeEnd, 1, false, NONE);
    2860             :     SimpleInstallFunction(isolate_, console, "timeStamp",
    2861         111 :                           Builtins::kConsoleTimeStamp, 1, false, NONE);
    2862             :     SimpleInstallFunction(isolate_, console, "context",
    2863         111 :                           Builtins::kConsoleContext, 1, true, NONE);
    2864         111 :     InstallToStringTag(isolate_, console, "Object");
    2865             :   }
    2866             : 
    2867             : #ifdef V8_INTL_SUPPORT
    2868             :   {  // -- I n t l
    2869             :     Handle<JSObject> intl =
    2870         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    2871         111 :     JSObject::AddProperty(isolate_, global, "Intl", intl, DONT_ENUM);
    2872             : 
    2873             :     SimpleInstallFunction(isolate(), intl, "getCanonicalLocales",
    2874         111 :                           Builtins::kIntlGetCanonicalLocales, 1, false);
    2875             : 
    2876             :     {
    2877             :       Handle<JSFunction> date_time_format_constructor = InstallFunction(
    2878             :           isolate_, intl, "DateTimeFormat", JS_INTL_DATE_TIME_FORMAT_TYPE,
    2879             :           JSDateTimeFormat::kSize, 0, factory->the_hole_value(),
    2880         111 :           Builtins::kDateTimeFormatConstructor);
    2881         222 :       date_time_format_constructor->shared()->set_length(0);
    2882         222 :       date_time_format_constructor->shared()->DontAdaptArguments();
    2883             :       InstallWithIntrinsicDefaultProto(
    2884             :           isolate_, date_time_format_constructor,
    2885         111 :           Context::INTL_DATE_TIME_FORMAT_FUNCTION_INDEX);
    2886             : 
    2887             :       SimpleInstallFunction(
    2888             :           isolate(), date_time_format_constructor, "supportedLocalesOf",
    2889         111 :           Builtins::kDateTimeFormatSupportedLocalesOf, 1, false);
    2890             : 
    2891             :       Handle<JSObject> prototype(
    2892         333 :           JSObject::cast(date_time_format_constructor->prototype()), isolate_);
    2893             : 
    2894         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2895             : 
    2896             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2897             :                             Builtins::kDateTimeFormatPrototypeResolvedOptions,
    2898         111 :                             0, false);
    2899             : 
    2900             :       SimpleInstallFunction(isolate_, prototype, "formatToParts",
    2901             :                             Builtins::kDateTimeFormatPrototypeFormatToParts, 1,
    2902         111 :                             false);
    2903             : 
    2904             :       SimpleInstallGetter(isolate_, prototype,
    2905             :                           factory->InternalizeUtf8String("format"),
    2906         222 :                           Builtins::kDateTimeFormatPrototypeFormat, false);
    2907             :     }
    2908             : 
    2909             :     {
    2910             :       Handle<JSFunction> number_format_constructor = InstallFunction(
    2911             :           isolate_, intl, "NumberFormat", JS_INTL_NUMBER_FORMAT_TYPE,
    2912             :           JSNumberFormat::kSize, 0, factory->the_hole_value(),
    2913         111 :           Builtins::kNumberFormatConstructor);
    2914         222 :       number_format_constructor->shared()->set_length(0);
    2915         222 :       number_format_constructor->shared()->DontAdaptArguments();
    2916             :       InstallWithIntrinsicDefaultProto(
    2917             :           isolate_, number_format_constructor,
    2918         111 :           Context::INTL_NUMBER_FORMAT_FUNCTION_INDEX);
    2919             : 
    2920             :       SimpleInstallFunction(
    2921             :           isolate(), number_format_constructor, "supportedLocalesOf",
    2922         111 :           Builtins::kNumberFormatSupportedLocalesOf, 1, false);
    2923             : 
    2924             :       Handle<JSObject> prototype(
    2925         333 :           JSObject::cast(number_format_constructor->prototype()), isolate_);
    2926             : 
    2927         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2928             : 
    2929             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2930             :                             Builtins::kNumberFormatPrototypeResolvedOptions, 0,
    2931         111 :                             false);
    2932             : 
    2933             :       SimpleInstallFunction(isolate_, prototype, "formatToParts",
    2934             :                             Builtins::kNumberFormatPrototypeFormatToParts, 1,
    2935         111 :                             false);
    2936             :       SimpleInstallGetter(isolate_, prototype,
    2937             :                           factory->InternalizeUtf8String("format"),
    2938         222 :                           Builtins::kNumberFormatPrototypeFormatNumber, false);
    2939             :     }
    2940             : 
    2941             :     {
    2942             :       Handle<JSFunction> collator_constructor = InstallFunction(
    2943             :           isolate_, intl, "Collator", JS_INTL_COLLATOR_TYPE, JSCollator::kSize,
    2944         111 :           0, factory->the_hole_value(), Builtins::kCollatorConstructor);
    2945         222 :       collator_constructor->shared()->DontAdaptArguments();
    2946             :       InstallWithIntrinsicDefaultProto(isolate_, collator_constructor,
    2947         111 :                                        Context::INTL_COLLATOR_FUNCTION_INDEX);
    2948             : 
    2949             :       SimpleInstallFunction(isolate(), collator_constructor,
    2950             :                             "supportedLocalesOf",
    2951         111 :                             Builtins::kCollatorSupportedLocalesOf, 1, false);
    2952             : 
    2953             :       Handle<JSObject> prototype(
    2954         333 :           JSObject::cast(collator_constructor->prototype()), isolate_);
    2955             : 
    2956         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2957             : 
    2958             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2959             :                             Builtins::kCollatorPrototypeResolvedOptions, 0,
    2960         111 :                             false);
    2961             : 
    2962             :       SimpleInstallGetter(isolate_, prototype,
    2963             :                           factory->InternalizeUtf8String("compare"),
    2964         222 :                           Builtins::kCollatorPrototypeCompare, false);
    2965             :     }
    2966             : 
    2967             :     {
    2968             :       Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
    2969             :           isolate_, intl, "v8BreakIterator", JS_INTL_V8_BREAK_ITERATOR_TYPE,
    2970             :           JSV8BreakIterator::kSize, 0, factory->the_hole_value(),
    2971         111 :           Builtins::kV8BreakIteratorConstructor);
    2972         222 :       v8_break_iterator_constructor->shared()->DontAdaptArguments();
    2973             : 
    2974             :       SimpleInstallFunction(
    2975             :           isolate_, v8_break_iterator_constructor, "supportedLocalesOf",
    2976         111 :           Builtins::kV8BreakIteratorSupportedLocalesOf, 1, false);
    2977             : 
    2978             :       Handle<JSObject> prototype(
    2979         333 :           JSObject::cast(v8_break_iterator_constructor->prototype()), isolate_);
    2980             : 
    2981         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2982             : 
    2983             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2984             :                             Builtins::kV8BreakIteratorPrototypeResolvedOptions,
    2985         111 :                             0, false);
    2986             : 
    2987             :       SimpleInstallGetter(isolate_, prototype,
    2988             :                           factory->InternalizeUtf8String("adoptText"),
    2989         222 :                           Builtins::kV8BreakIteratorPrototypeAdoptText, false);
    2990             : 
    2991             :       SimpleInstallGetter(isolate_, prototype,
    2992             :                           factory->InternalizeUtf8String("first"),
    2993         222 :                           Builtins::kV8BreakIteratorPrototypeFirst, false);
    2994             : 
    2995             :       SimpleInstallGetter(isolate_, prototype,
    2996             :                           factory->InternalizeUtf8String("next"),
    2997         222 :                           Builtins::kV8BreakIteratorPrototypeNext, false);
    2998             : 
    2999             :       SimpleInstallGetter(isolate_, prototype,
    3000             :                           factory->InternalizeUtf8String("current"),
    3001         222 :                           Builtins::kV8BreakIteratorPrototypeCurrent, false);
    3002             : 
    3003             :       SimpleInstallGetter(isolate_, prototype,
    3004             :                           factory->InternalizeUtf8String("breakType"),
    3005         222 :                           Builtins::kV8BreakIteratorPrototypeBreakType, false);
    3006             :     }
    3007             : 
    3008             :     {
    3009             :       Handle<JSFunction> plural_rules_constructor = InstallFunction(
    3010             :           isolate_, intl, "PluralRules", JS_INTL_PLURAL_RULES_TYPE,
    3011             :           JSPluralRules::kSize, 0, factory->the_hole_value(),
    3012         111 :           Builtins::kPluralRulesConstructor);
    3013         222 :       plural_rules_constructor->shared()->DontAdaptArguments();
    3014             : 
    3015             :       SimpleInstallFunction(isolate(), plural_rules_constructor,
    3016             :                             "supportedLocalesOf",
    3017         111 :                             Builtins::kPluralRulesSupportedLocalesOf, 1, false);
    3018             : 
    3019             :       Handle<JSObject> prototype(
    3020         333 :           JSObject::cast(plural_rules_constructor->prototype()), isolate_);
    3021             : 
    3022         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    3023             : 
    3024             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    3025             :                             Builtins::kPluralRulesPrototypeResolvedOptions, 0,
    3026         111 :                             false);
    3027             : 
    3028             :       SimpleInstallFunction(isolate_, prototype, "select",
    3029         111 :                             Builtins::kPluralRulesPrototypeSelect, 1, false);
    3030             :     }
    3031             :   }
    3032             : #endif  // V8_INTL_SUPPORT
    3033             : 
    3034             :   {  // -- A r r a y B u f f e r
    3035             :     Handle<String> name = factory->ArrayBuffer_string();
    3036         111 :     Handle<JSFunction> array_buffer_fun = CreateArrayBuffer(name, ARRAY_BUFFER);
    3037         111 :     JSObject::AddProperty(isolate_, global, name, array_buffer_fun, DONT_ENUM);
    3038             :     InstallWithIntrinsicDefaultProto(isolate_, array_buffer_fun,
    3039         111 :                                      Context::ARRAY_BUFFER_FUN_INDEX);
    3040         111 :     InstallSpeciesGetter(isolate_, array_buffer_fun);
    3041             : 
    3042             :     Handle<JSFunction> array_buffer_noinit_fun = SimpleCreateFunction(
    3043             :         isolate_,
    3044             :         factory->InternalizeUtf8String(
    3045             :             "arrayBufferConstructor_DoNotInitialize"),
    3046         111 :         Builtins::kArrayBufferConstructor_DoNotInitialize, 1, false);
    3047         111 :     native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun);
    3048             :   }
    3049             : 
    3050             :   {  // -- S h a r e d A r r a y B u f f e r
    3051         111 :     Handle<String> name = factory->SharedArrayBuffer_string();
    3052             :     Handle<JSFunction> shared_array_buffer_fun =
    3053         111 :         CreateArrayBuffer(name, SHARED_ARRAY_BUFFER);
    3054             :     InstallWithIntrinsicDefaultProto(isolate_, shared_array_buffer_fun,
    3055         111 :                                      Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
    3056         111 :     InstallSpeciesGetter(isolate_, shared_array_buffer_fun);
    3057             :   }
    3058             : 
    3059             :   {  // -- A t o m i c s
    3060             :     Handle<JSObject> atomics_object =
    3061         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    3062         111 :     native_context()->set_atomics_object(*atomics_object);
    3063             : 
    3064             :     SimpleInstallFunction(isolate_, atomics_object, "load",
    3065         111 :                           Builtins::kAtomicsLoad, 2, true);
    3066             :     SimpleInstallFunction(isolate_, atomics_object, "store",
    3067         111 :                           Builtins::kAtomicsStore, 3, true);
    3068             :     SimpleInstallFunction(isolate_, atomics_object, "add",
    3069         111 :                           Builtins::kAtomicsAdd, 3, true);
    3070             :     SimpleInstallFunction(isolate_, atomics_object, "sub",
    3071         111 :                           Builtins::kAtomicsSub, 3, true);
    3072             :     SimpleInstallFunction(isolate_, atomics_object, "and",
    3073         111 :                           Builtins::kAtomicsAnd, 3, true);
    3074             :     SimpleInstallFunction(isolate_, atomics_object, "or", Builtins::kAtomicsOr,
    3075         111 :                           3, true);
    3076             :     SimpleInstallFunction(isolate_, atomics_object, "xor",
    3077         111 :                           Builtins::kAtomicsXor, 3, true);
    3078             :     SimpleInstallFunction(isolate_, atomics_object, "exchange",
    3079         111 :                           Builtins::kAtomicsExchange, 3, true);
    3080             :     SimpleInstallFunction(isolate_, atomics_object, "compareExchange",
    3081         111 :                           Builtins::kAtomicsCompareExchange, 4, true);
    3082             :     SimpleInstallFunction(isolate_, atomics_object, "isLockFree",
    3083         111 :                           Builtins::kAtomicsIsLockFree, 1, true);
    3084             :     SimpleInstallFunction(isolate_, atomics_object, "wait",
    3085         111 :                           Builtins::kAtomicsWait, 4, true);
    3086             :     SimpleInstallFunction(isolate_, atomics_object, "wake",
    3087         111 :                           Builtins::kAtomicsWake, 3, true);
    3088             :     SimpleInstallFunction(isolate_, atomics_object, "notify",
    3089         111 :                           Builtins::kAtomicsNotify, 3, true);
    3090             :   }
    3091             : 
    3092             :   {  // -- T y p e d A r r a y
    3093             :     Handle<JSFunction> typed_array_fun = CreateFunction(
    3094             :         isolate_, factory->InternalizeUtf8String("TypedArray"),
    3095             :         JS_TYPED_ARRAY_TYPE, JSTypedArray::kHeaderSize, 0,
    3096         111 :         factory->the_hole_value(), Builtins::kTypedArrayBaseConstructor);
    3097         111 :     typed_array_fun->shared()->set_native(false);
    3098         222 :     typed_array_fun->shared()->set_length(0);
    3099         111 :     InstallSpeciesGetter(isolate_, typed_array_fun);
    3100         111 :     native_context()->set_typed_array_function(*typed_array_fun);
    3101             : 
    3102             :     SimpleInstallFunction(isolate_, typed_array_fun, "of",
    3103         111 :                           Builtins::kTypedArrayOf, 0, false);
    3104             :     SimpleInstallFunction(isolate_, typed_array_fun, "from",
    3105         111 :                           Builtins::kTypedArrayFrom, 1, false);
    3106             : 
    3107             :     // Setup %TypedArrayPrototype%.
    3108             :     Handle<JSObject> prototype(
    3109         222 :         JSObject::cast(typed_array_fun->instance_prototype()), isolate());
    3110         111 :     native_context()->set_typed_array_prototype(*prototype);
    3111             : 
    3112             :     // Install the "buffer", "byteOffset", "byteLength", "length"
    3113             :     // and @@toStringTag getters on the {prototype}.
    3114             :     SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
    3115         111 :                         Builtins::kTypedArrayPrototypeBuffer, false);
    3116             :     SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
    3117             :                         Builtins::kTypedArrayPrototypeByteLength, true,
    3118         111 :                         BuiltinFunctionId::kTypedArrayByteLength);
    3119             :     SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
    3120             :                         Builtins::kTypedArrayPrototypeByteOffset, true,
    3121         111 :                         BuiltinFunctionId::kTypedArrayByteOffset);
    3122             :     SimpleInstallGetter(isolate_, prototype, factory->length_string(),
    3123             :                         Builtins::kTypedArrayPrototypeLength, true,
    3124         111 :                         BuiltinFunctionId::kTypedArrayLength);
    3125             :     SimpleInstallGetter(isolate_, prototype, factory->to_string_tag_symbol(),
    3126             :                         Builtins::kTypedArrayPrototypeToStringTag, true,
    3127         111 :                         BuiltinFunctionId::kTypedArrayToStringTag);
    3128             : 
    3129             :     // Install "keys", "values" and "entries" methods on the {prototype}.
    3130             :     InstallFunctionWithBuiltinId(isolate_, prototype, "entries",
    3131             :                                  Builtins::kTypedArrayPrototypeEntries, 0, true,
    3132         111 :                                  BuiltinFunctionId::kTypedArrayEntries);
    3133             : 
    3134             :     InstallFunctionWithBuiltinId(isolate_, prototype, "keys",
    3135             :                                  Builtins::kTypedArrayPrototypeKeys, 0, true,
    3136         111 :                                  BuiltinFunctionId::kTypedArrayKeys);
    3137             : 
    3138             :     Handle<JSFunction> values = InstallFunctionWithBuiltinId(
    3139             :         isolate_, prototype, "values", Builtins::kTypedArrayPrototypeValues, 0,
    3140         111 :         true, BuiltinFunctionId::kTypedArrayValues);
    3141             :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3142         111 :                           values, DONT_ENUM);
    3143             : 
    3144             :     // TODO(caitp): alphasort accessors/methods
    3145             :     SimpleInstallFunction(isolate_, prototype, "copyWithin",
    3146         111 :                           Builtins::kTypedArrayPrototypeCopyWithin, 2, false);
    3147             :     SimpleInstallFunction(isolate_, prototype, "every",
    3148         111 :                           Builtins::kTypedArrayPrototypeEvery, 1, false);
    3149             :     SimpleInstallFunction(isolate_, prototype, "fill",
    3150         111 :                           Builtins::kTypedArrayPrototypeFill, 1, false);
    3151             :     SimpleInstallFunction(isolate_, prototype, "filter",
    3152         111 :                           Builtins::kTypedArrayPrototypeFilter, 1, false);
    3153             :     SimpleInstallFunction(isolate_, prototype, "find",
    3154         111 :                           Builtins::kTypedArrayPrototypeFind, 1, false);
    3155             :     SimpleInstallFunction(isolate_, prototype, "findIndex",
    3156         111 :                           Builtins::kTypedArrayPrototypeFindIndex, 1, false);
    3157             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3158         111 :                           Builtins::kTypedArrayPrototypeForEach, 1, false);
    3159             :     SimpleInstallFunction(isolate_, prototype, "includes",
    3160         111 :                           Builtins::kTypedArrayPrototypeIncludes, 1, false);
    3161             :     SimpleInstallFunction(isolate_, prototype, "indexOf",
    3162         111 :                           Builtins::kTypedArrayPrototypeIndexOf, 1, false);
    3163             :     SimpleInstallFunction(isolate_, prototype, "join",
    3164         111 :                           Builtins::kTypedArrayPrototypeJoin, 1, false);
    3165             :     SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
    3166         111 :                           Builtins::kTypedArrayPrototypeLastIndexOf, 1, false);
    3167             :     SimpleInstallFunction(isolate_, prototype, "map",
    3168         111 :                           Builtins::kTypedArrayPrototypeMap, 1, false);
    3169             :     SimpleInstallFunction(isolate_, prototype, "reverse",
    3170         111 :                           Builtins::kTypedArrayPrototypeReverse, 0, false);
    3171             :     SimpleInstallFunction(isolate_, prototype, "reduce",
    3172         111 :                           Builtins::kTypedArrayPrototypeReduce, 1, false);
    3173             :     SimpleInstallFunction(isolate_, prototype, "reduceRight",
    3174         111 :                           Builtins::kTypedArrayPrototypeReduceRight, 1, false);
    3175             :     SimpleInstallFunction(isolate_, prototype, "set",
    3176         111 :                           Builtins::kTypedArrayPrototypeSet, 1, false);
    3177             :     SimpleInstallFunction(isolate_, prototype, "slice",
    3178         111 :                           Builtins::kTypedArrayPrototypeSlice, 2, false);
    3179             :     SimpleInstallFunction(isolate_, prototype, "some",
    3180         111 :                           Builtins::kTypedArrayPrototypeSome, 1, false);
    3181             :     SimpleInstallFunction(isolate_, prototype, "sort",
    3182         111 :                           Builtins::kTypedArrayPrototypeSort, 1, false);
    3183             :     SimpleInstallFunction(isolate_, prototype, "subarray",
    3184         111 :                           Builtins::kTypedArrayPrototypeSubArray, 2, false);
    3185             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    3186             :                           Builtins::kTypedArrayPrototypeToLocaleString, 0,
    3187         111 :                           false);
    3188             :     JSObject::AddProperty(isolate_, prototype, factory->toString_string(),
    3189         111 :                           array_prototype_to_string_fun, DONT_ENUM);
    3190             :   }
    3191             : 
    3192             :   {  // -- T y p e d A r r a y s
    3193             : #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype)                   \
    3194             :   {                                                                    \
    3195             :     Handle<JSFunction> fun =                                           \
    3196             :         InstallTypedArray(#Type "Array", TYPE##_ELEMENTS);             \
    3197             :     InstallWithIntrinsicDefaultProto(isolate_, fun,                    \
    3198             :                                      Context::TYPE##_ARRAY_FUN_INDEX); \
    3199             :   }
    3200         111 :     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
    3201             : #undef INSTALL_TYPED_ARRAY
    3202             :   }
    3203             : 
    3204             :   {  // -- D a t a V i e w
    3205             :     Handle<JSFunction> data_view_fun = InstallFunction(
    3206             :         isolate_, global, "DataView", JS_DATA_VIEW_TYPE,
    3207             :         JSDataView::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    3208         111 :         Builtins::kDataViewConstructor);
    3209             :     InstallWithIntrinsicDefaultProto(isolate_, data_view_fun,
    3210         111 :                                      Context::DATA_VIEW_FUN_INDEX);
    3211         222 :     data_view_fun->shared()->set_length(1);
    3212         222 :     data_view_fun->shared()->DontAdaptArguments();
    3213             : 
    3214             :     // Setup %DataViewPrototype%.
    3215             :     Handle<JSObject> prototype(
    3216         222 :         JSObject::cast(data_view_fun->instance_prototype()), isolate());
    3217             : 
    3218         111 :     InstallToStringTag(isolate_, prototype, "DataView");
    3219             : 
    3220             :     // Install the "buffer", "byteOffset" and "byteLength" getters
    3221             :     // on the {prototype}.
    3222             :     SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
    3223             :                         Builtins::kDataViewPrototypeGetBuffer, false,
    3224         111 :                         BuiltinFunctionId::kDataViewBuffer);
    3225             :     SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
    3226             :                         Builtins::kDataViewPrototypeGetByteLength, false,
    3227         111 :                         BuiltinFunctionId::kDataViewByteLength);
    3228             :     SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
    3229             :                         Builtins::kDataViewPrototypeGetByteOffset, false,
    3230         111 :                         BuiltinFunctionId::kDataViewByteOffset);
    3231             : 
    3232             :     SimpleInstallFunction(isolate_, prototype, "getInt8",
    3233         111 :                           Builtins::kDataViewPrototypeGetInt8, 1, false);
    3234             :     SimpleInstallFunction(isolate_, prototype, "setInt8",
    3235         111 :                           Builtins::kDataViewPrototypeSetInt8, 2, false);
    3236             :     SimpleInstallFunction(isolate_, prototype, "getUint8",
    3237         111 :                           Builtins::kDataViewPrototypeGetUint8, 1, false);
    3238             :     SimpleInstallFunction(isolate_, prototype, "setUint8",
    3239         111 :                           Builtins::kDataViewPrototypeSetUint8, 2, false);
    3240             :     SimpleInstallFunction(isolate_, prototype, "getInt16",
    3241         111 :                           Builtins::kDataViewPrototypeGetInt16, 1, false);
    3242             :     SimpleInstallFunction(isolate_, prototype, "setInt16",
    3243         111 :                           Builtins::kDataViewPrototypeSetInt16, 2, false);
    3244             :     SimpleInstallFunction(isolate_, prototype, "getUint16",
    3245         111 :                           Builtins::kDataViewPrototypeGetUint16, 1, false);
    3246             :     SimpleInstallFunction(isolate_, prototype, "setUint16",
    3247         111 :                           Builtins::kDataViewPrototypeSetUint16, 2, false);
    3248             :     SimpleInstallFunction(isolate_, prototype, "getInt32",
    3249         111 :                           Builtins::kDataViewPrototypeGetInt32, 1, false);
    3250             :     SimpleInstallFunction(isolate_, prototype, "setInt32",
    3251         111 :                           Builtins::kDataViewPrototypeSetInt32, 2, false);
    3252             :     SimpleInstallFunction(isolate_, prototype, "getUint32",
    3253         111 :                           Builtins::kDataViewPrototypeGetUint32, 1, false);
    3254             :     SimpleInstallFunction(isolate_, prototype, "setUint32",
    3255         111 :                           Builtins::kDataViewPrototypeSetUint32, 2, false);
    3256             :     SimpleInstallFunction(isolate_, prototype, "getFloat32",
    3257         111 :                           Builtins::kDataViewPrototypeGetFloat32, 1, false);
    3258             :     SimpleInstallFunction(isolate_, prototype, "setFloat32",
    3259         111 :                           Builtins::kDataViewPrototypeSetFloat32, 2, false);
    3260             :     SimpleInstallFunction(isolate_, prototype, "getFloat64",
    3261         111 :                           Builtins::kDataViewPrototypeGetFloat64, 1, false);
    3262             :     SimpleInstallFunction(isolate_, prototype, "setFloat64",
    3263         111 :                           Builtins::kDataViewPrototypeSetFloat64, 2, false);
    3264             :     SimpleInstallFunction(isolate_, prototype, "getBigInt64",
    3265         111 :                           Builtins::kDataViewPrototypeGetBigInt64, 1, false);
    3266             :     SimpleInstallFunction(isolate_, prototype, "setBigInt64",
    3267         111 :                           Builtins::kDataViewPrototypeSetBigInt64, 2, false);
    3268             :     SimpleInstallFunction(isolate_, prototype, "getBigUint64",
    3269         111 :                           Builtins::kDataViewPrototypeGetBigUint64, 1, false);
    3270             :     SimpleInstallFunction(isolate_, prototype, "setBigUint64",
    3271         111 :                           Builtins::kDataViewPrototypeSetBigUint64, 2, false);
    3272             :   }
    3273             : 
    3274             :   {  // -- M a p
    3275             :     Handle<JSFunction> js_map_fun =
    3276             :         InstallFunction(isolate_, global, "Map", JS_MAP_TYPE, JSMap::kSize, 0,
    3277         111 :                         factory->the_hole_value(), Builtins::kMapConstructor);
    3278             :     InstallWithIntrinsicDefaultProto(isolate_, js_map_fun,
    3279         111 :                                      Context::JS_MAP_FUN_INDEX);
    3280             : 
    3281         333 :     Handle<SharedFunctionInfo> shared(js_map_fun->shared(), isolate_);
    3282             :     shared->DontAdaptArguments();
    3283             :     shared->set_length(0);
    3284             : 
    3285             :     // Setup %MapPrototype%.
    3286             :     Handle<JSObject> prototype(JSObject::cast(js_map_fun->instance_prototype()),
    3287         222 :                                isolate());
    3288             : 
    3289         111 :     InstallToStringTag(isolate_, prototype, factory->Map_string());
    3290             : 
    3291             :     Handle<JSFunction> map_get = SimpleInstallFunction(
    3292         111 :         isolate_, prototype, "get", Builtins::kMapPrototypeGet, 1, true);
    3293         111 :     native_context()->set_map_get(*map_get);
    3294             : 
    3295             :     Handle<JSFunction> map_set = SimpleInstallFunction(
    3296         111 :         isolate_, prototype, "set", Builtins::kMapPrototypeSet, 2, true);
    3297             :     // Check that index of "set" function in JSCollection is correct.
    3298             :     DCHECK_EQ(JSCollection::kAddFunctionDescriptorIndex,
    3299             :               prototype->map()->LastAdded());
    3300         111 :     native_context()->set_map_set(*map_set);
    3301             : 
    3302             :     Handle<JSFunction> map_has = SimpleInstallFunction(
    3303         111 :         isolate_, prototype, "has", Builtins::kMapPrototypeHas, 1, true);
    3304         111 :     native_context()->set_map_has(*map_has);
    3305             : 
    3306             :     Handle<JSFunction> map_delete = SimpleInstallFunction(
    3307         111 :         isolate_, prototype, "delete", Builtins::kMapPrototypeDelete, 1, true);
    3308         111 :     native_context()->set_map_delete(*map_delete);
    3309             : 
    3310             :     SimpleInstallFunction(isolate_, prototype, "clear",
    3311         111 :                           Builtins::kMapPrototypeClear, 0, true);
    3312             :     Handle<JSFunction> entries =
    3313             :         SimpleInstallFunction(isolate_, prototype, "entries",
    3314         111 :                               Builtins::kMapPrototypeEntries, 0, true);
    3315             :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3316         111 :                           entries, DONT_ENUM);
    3317             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3318         111 :                           Builtins::kMapPrototypeForEach, 1, false);
    3319             :     SimpleInstallFunction(isolate_, prototype, "keys",
    3320         111 :                           Builtins::kMapPrototypeKeys, 0, true);
    3321             :     SimpleInstallGetter(
    3322             :         isolate_, prototype, factory->InternalizeUtf8String("size"),
    3323         222 :         Builtins::kMapPrototypeGetSize, true, BuiltinFunctionId::kMapSize);
    3324             :     SimpleInstallFunction(isolate_, prototype, "values",
    3325         111 :                           Builtins::kMapPrototypeValues, 0, true);
    3326             : 
    3327         111 :     native_context()->set_initial_map_prototype_map(prototype->map());
    3328             : 
    3329         111 :     InstallSpeciesGetter(isolate_, js_map_fun);
    3330             :   }
    3331             : 
    3332             :   {  // -- B i g I n t
    3333             :     Handle<JSFunction> bigint_fun = InstallFunction(
    3334             :         isolate_, global, "BigInt", JS_VALUE_TYPE, JSValue::kSize, 0,
    3335         111 :         factory->the_hole_value(), Builtins::kBigIntConstructor);
    3336         222 :     bigint_fun->shared()->set_builtin_function_id(
    3337         222 :         BuiltinFunctionId::kBigIntConstructor);
    3338         222 :     bigint_fun->shared()->DontAdaptArguments();
    3339         222 :     bigint_fun->shared()->set_length(1);
    3340             :     InstallWithIntrinsicDefaultProto(isolate_, bigint_fun,
    3341         111 :                                      Context::BIGINT_FUNCTION_INDEX);
    3342             : 
    3343             :     // Install the properties of the BigInt constructor.
    3344             :     // asUintN(bits, bigint)
    3345             :     SimpleInstallFunction(isolate_, bigint_fun, "asUintN",
    3346         111 :                           Builtins::kBigIntAsUintN, 2, false);
    3347             :     // asIntN(bits, bigint)
    3348             :     SimpleInstallFunction(isolate_, bigint_fun, "asIntN",
    3349         111 :                           Builtins::kBigIntAsIntN, 2, false);
    3350             : 
    3351             :     // Set up the %BigIntPrototype%.
    3352             :     Handle<JSObject> prototype(JSObject::cast(bigint_fun->instance_prototype()),
    3353         333 :                                isolate_);
    3354         111 :     JSFunction::SetPrototype(bigint_fun, prototype);
    3355             : 
    3356             :     // Install the properties of the BigInt.prototype.
    3357             :     // "constructor" is created implicitly by InstallFunction() above.
    3358             :     // toLocaleString([reserved1 [, reserved2]])
    3359             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    3360         111 :                           Builtins::kBigIntPrototypeToLocaleString, 0, false);
    3361             :     // toString([radix])
    3362             :     SimpleInstallFunction(isolate_, prototype, "toString",
    3363         111 :                           Builtins::kBigIntPrototypeToString, 0, false);
    3364             :     // valueOf()
    3365             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    3366         111 :                           Builtins::kBigIntPrototypeValueOf, 0, false);
    3367             :     // @@toStringTag
    3368         111 :     InstallToStringTag(isolate_, prototype, factory->BigInt_string());
    3369             :   }
    3370             : 
    3371             :   {  // -- S e t
    3372             :     Handle<JSFunction> js_set_fun =
    3373             :         InstallFunction(isolate_, global, "Set", JS_SET_TYPE, JSSet::kSize, 0,
    3374         111 :                         factory->the_hole_value(), Builtins::kSetConstructor);
    3375             :     InstallWithIntrinsicDefaultProto(isolate_, js_set_fun,
    3376         111 :                                      Context::JS_SET_FUN_INDEX);
    3377             : 
    3378         333 :     Handle<SharedFunctionInfo> shared(js_set_fun->shared(), isolate_);
    3379             :     shared->DontAdaptArguments();
    3380             :     shared->set_length(0);
    3381             : 
    3382             :     // Setup %SetPrototype%.
    3383             :     Handle<JSObject> prototype(JSObject::cast(js_set_fun->instance_prototype()),
    3384         222 :                                isolate());
    3385             : 
    3386         111 :     InstallToStringTag(isolate_, prototype, factory->Set_string());
    3387             : 
    3388             :     Handle<JSFunction> set_has = SimpleInstallFunction(
    3389         111 :         isolate_, prototype, "has", Builtins::kSetPrototypeHas, 1, true);
    3390         111 :     native_context()->set_set_has(*set_has);
    3391             : 
    3392             :     Handle<JSFunction> set_add = SimpleInstallFunction(
    3393         111 :         isolate_, prototype, "add", Builtins::kSetPrototypeAdd, 1, true);
    3394             :     // Check that index of "add" function in JSCollection is correct.
    3395             :     DCHECK_EQ(JSCollection::kAddFunctionDescriptorIndex,
    3396             :               prototype->map()->LastAdded());
    3397         111 :     native_context()->set_set_add(*set_add);
    3398             : 
    3399             :     Handle<JSFunction> set_delete = SimpleInstallFunction(
    3400         111 :         isolate_, prototype, "delete", Builtins::kSetPrototypeDelete, 1, true);
    3401         111 :     native_context()->set_set_delete(*set_delete);
    3402             : 
    3403             :     SimpleInstallFunction(isolate_, prototype, "clear",
    3404         111 :                           Builtins::kSetPrototypeClear, 0, true);
    3405             :     SimpleInstallFunction(isolate_, prototype, "entries",
    3406         111 :                           Builtins::kSetPrototypeEntries, 0, true);
    3407             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3408         111 :                           Builtins::kSetPrototypeForEach, 1, false);
    3409             :     SimpleInstallGetter(
    3410             :         isolate_, prototype, factory->InternalizeUtf8String("size"),
    3411         222 :         Builtins::kSetPrototypeGetSize, true, BuiltinFunctionId::kSetSize);
    3412             :     Handle<JSFunction> values = SimpleInstallFunction(
    3413         111 :         isolate_, prototype, "values", Builtins::kSetPrototypeValues, 0, true);
    3414             :     JSObject::AddProperty(isolate_, prototype, factory->keys_string(), values,
    3415         111 :                           DONT_ENUM);
    3416             :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3417         111 :                           values, DONT_ENUM);
    3418             : 
    3419         111 :     native_context()->set_initial_set_prototype_map(prototype->map());
    3420         111 :     native_context()->set_initial_set_prototype(*prototype);
    3421             : 
    3422         111 :     InstallSpeciesGetter(isolate_, js_set_fun);
    3423             :   }
    3424             : 
    3425             :   {  // -- J S M o d u l e N a m e s p a c e
    3426             :     Handle<Map> map = factory->NewMap(
    3427             :         JS_MODULE_NAMESPACE_TYPE, JSModuleNamespace::kSize,
    3428         111 :         TERMINAL_FAST_ELEMENTS_KIND, JSModuleNamespace::kInObjectFieldCount);
    3429         222 :     Map::SetPrototype(isolate(), map, isolate_->factory()->null_value());
    3430         111 :     Map::EnsureDescriptorSlack(isolate_, map, 1);
    3431         111 :     native_context()->set_js_module_namespace_map(*map);
    3432             : 
    3433             :     {  // Install @@toStringTag.
    3434             :       PropertyAttributes attribs =
    3435             :           static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY);
    3436             :       Descriptor d =
    3437             :           Descriptor::DataField(isolate(), factory->to_string_tag_symbol(),
    3438             :                                 JSModuleNamespace::kToStringTagFieldIndex,
    3439         111 :                                 attribs, Representation::Tagged());
    3440         111 :       map->AppendDescriptor(isolate(), &d);
    3441             :     }
    3442             :   }
    3443             : 
    3444             :   {  // -- I t e r a t o r R e s u l t
    3445             :     Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSIteratorResult::kSize,
    3446         111 :                                       TERMINAL_FAST_ELEMENTS_KIND, 2);
    3447         222 :     Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
    3448         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3449             : 
    3450             :     {  // value
    3451             :       Descriptor d = Descriptor::DataField(isolate(), factory->value_string(),
    3452             :                                            JSIteratorResult::kValueIndex, NONE,
    3453         111 :                                            Representation::Tagged());
    3454         111 :       map->AppendDescriptor(isolate(), &d);
    3455             :     }
    3456             : 
    3457             :     {  // done
    3458             :       Descriptor d = Descriptor::DataField(isolate(), factory->done_string(),
    3459             :                                            JSIteratorResult::kDoneIndex, NONE,
    3460         111 :                                            Representation::Tagged());
    3461         111 :       map->AppendDescriptor(isolate(), &d);
    3462             :     }
    3463             : 
    3464         222 :     map->SetConstructor(native_context()->object_function());
    3465         111 :     native_context()->set_iterator_result_map(*map);
    3466             :   }
    3467             : 
    3468             :   {  // -- W e a k M a p
    3469             :     Handle<JSFunction> cons = InstallFunction(
    3470             :         isolate_, global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize, 0,
    3471         111 :         factory->the_hole_value(), Builtins::kWeakMapConstructor);
    3472             :     InstallWithIntrinsicDefaultProto(isolate_, cons,
    3473         111 :                                      Context::JS_WEAK_MAP_FUN_INDEX);
    3474             : 
    3475         333 :     Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
    3476             :     shared->DontAdaptArguments();
    3477             :     shared->set_length(0);
    3478             : 
    3479             :     // Setup %WeakMapPrototype%.
    3480             :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
    3481         222 :                                isolate());
    3482             : 
    3483             :     SimpleInstallFunction(isolate_, prototype, "delete",
    3484         111 :                           Builtins::kWeakMapPrototypeDelete, 1, true);
    3485             :     Handle<JSFunction> weakmap_get = SimpleInstallFunction(
    3486         111 :         isolate_, prototype, "get", Builtins::kWeakMapGet, 1, true);
    3487         111 :     native_context()->set_weakmap_get(*weakmap_get);
    3488             : 
    3489             :     Handle<JSFunction> weakmap_set = SimpleInstallFunction(
    3490         111 :         isolate_, prototype, "set", Builtins::kWeakMapPrototypeSet, 2, true);
    3491             :     // Check that index of "set" function in JSWeakCollection is correct.
    3492             :     DCHECK_EQ(JSWeakCollection::kAddFunctionDescriptorIndex,
    3493             :               prototype->map()->LastAdded());
    3494             : 
    3495         111 :     native_context()->set_weakmap_set(*weakmap_set);
    3496             :     SimpleInstallFunction(isolate_, prototype, "has", Builtins::kWeakMapHas, 1,
    3497         111 :                           true);
    3498             : 
    3499         111 :     InstallToStringTag(isolate_, prototype, "WeakMap");
    3500             : 
    3501         111 :     native_context()->set_initial_weakmap_prototype_map(prototype->map());
    3502             :   }
    3503             : 
    3504             :   {  // -- W e a k S e t
    3505             :     Handle<JSFunction> cons = InstallFunction(
    3506             :         isolate_, global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize, 0,
    3507         111 :         factory->the_hole_value(), Builtins::kWeakSetConstructor);
    3508             :     InstallWithIntrinsicDefaultProto(isolate_, cons,
    3509         111 :                                      Context::JS_WEAK_SET_FUN_INDEX);
    3510             : 
    3511         333 :     Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
    3512             :     shared->DontAdaptArguments();
    3513             :     shared->set_length(0);
    3514             : 
    3515             :     // Setup %WeakSetPrototype%.
    3516             :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
    3517         222 :                                isolate());
    3518             : 
    3519             :     SimpleInstallFunction(isolate_, prototype, "delete",
    3520         111 :                           Builtins::kWeakSetPrototypeDelete, 1, true);
    3521             :     SimpleInstallFunction(isolate_, prototype, "has", Builtins::kWeakSetHas, 1,
    3522         111 :                           true);
    3523             : 
    3524             :     Handle<JSFunction> weakset_add = SimpleInstallFunction(
    3525         111 :         isolate_, prototype, "add", Builtins::kWeakSetPrototypeAdd, 1, true);
    3526             :     // Check that index of "add" function in JSWeakCollection is correct.
    3527             :     DCHECK_EQ(JSWeakCollection::kAddFunctionDescriptorIndex,
    3528             :               prototype->map()->LastAdded());
    3529             : 
    3530         111 :     native_context()->set_weakset_add(*weakset_add);
    3531             : 
    3532             :     InstallToStringTag(isolate_, prototype,
    3533         111 :                        factory->InternalizeUtf8String("WeakSet"));
    3534             : 
    3535         111 :     native_context()->set_initial_weakset_prototype_map(prototype->map());
    3536             :   }
    3537             : 
    3538             :   {  // -- P r o x y
    3539         111 :     CreateJSProxyMaps();
    3540             :     // Proxy function map has prototype slot for storing initial map but does
    3541             :     // not have a prototype property.
    3542             :     Handle<Map> proxy_function_map = Map::Copy(
    3543         111 :         isolate_, isolate_->strict_function_without_prototype_map(), "Proxy");
    3544             :     proxy_function_map->set_is_constructor(true);
    3545             : 
    3546             :     Handle<String> name = factory->Proxy_string();
    3547             : 
    3548             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
    3549         111 :         name, proxy_function_map, Builtins::kProxyConstructor);
    3550         111 :     Handle<JSFunction> proxy_function = factory->NewFunction(args);
    3551             : 
    3552         222 :     isolate_->proxy_map()->SetConstructor(*proxy_function);
    3553             : 
    3554         222 :     proxy_function->shared()->set_internal_formal_parameter_count(2);
    3555         222 :     proxy_function->shared()->set_length(2);
    3556             : 
    3557         111 :     native_context()->set_proxy_function(*proxy_function);
    3558         111 :     JSObject::AddProperty(isolate_, global, name, proxy_function, DONT_ENUM);
    3559             : 
    3560             :     DCHECK(!proxy_function->has_prototype_property());
    3561             : 
    3562             :     SimpleInstallFunction(isolate_, proxy_function, "revocable",
    3563         111 :                           Builtins::kProxyRevocable, 2, true);
    3564             : 
    3565             :     {  // Internal: ProxyRevoke
    3566             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    3567         111 :           isolate_, Builtins::kProxyRevoke, factory->empty_string(), 0);
    3568         111 :       native_context()->set_proxy_revoke_shared_fun(*info);
    3569             :     }
    3570             :   }
    3571             : 
    3572             :   {  // -- R e f l e c t
    3573         111 :     Handle<String> reflect_string = factory->InternalizeUtf8String("Reflect");
    3574             :     Handle<JSObject> reflect =
    3575         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    3576         111 :     JSObject::AddProperty(isolate_, global, reflect_string, reflect, DONT_ENUM);
    3577             : 
    3578             :     Handle<JSFunction> define_property =
    3579             :         SimpleInstallFunction(isolate_, reflect, "defineProperty",
    3580         111 :                               Builtins::kReflectDefineProperty, 3, true);
    3581         111 :     native_context()->set_reflect_define_property(*define_property);
    3582             : 
    3583             :     Handle<JSFunction> delete_property =
    3584             :         SimpleInstallFunction(isolate_, reflect, "deleteProperty",
    3585         111 :                               Builtins::kReflectDeleteProperty, 2, true);
    3586         111 :     native_context()->set_reflect_delete_property(*delete_property);
    3587             : 
    3588             :     Handle<JSFunction> apply = SimpleInstallFunction(
    3589         111 :         isolate_, reflect, "apply", Builtins::kReflectApply, 3, false);
    3590         111 :     native_context()->set_reflect_apply(*apply);
    3591             : 
    3592             :     Handle<JSFunction> construct = SimpleInstallFunction(
    3593         111 :         isolate_, reflect, "construct", Builtins::kReflectConstruct, 2, false);
    3594         111 :     native_context()->set_reflect_construct(*construct);
    3595             : 
    3596             :     SimpleInstallFunction(isolate_, reflect, "get", Builtins::kReflectGet, 2,
    3597         111 :                           false);
    3598             :     SimpleInstallFunction(isolate_, reflect, "getOwnPropertyDescriptor",
    3599         111 :                           Builtins::kReflectGetOwnPropertyDescriptor, 2, true);
    3600             :     SimpleInstallFunction(isolate_, reflect, "getPrototypeOf",
    3601         111 :                           Builtins::kReflectGetPrototypeOf, 1, true);
    3602             :     SimpleInstallFunction(isolate_, reflect, "has", Builtins::kReflectHas, 2,
    3603         111 :                           true);
    3604             :     SimpleInstallFunction(isolate_, reflect, "isExtensible",
    3605         111 :                           Builtins::kReflectIsExtensible, 1, true);
    3606             :     SimpleInstallFunction(isolate_, reflect, "ownKeys",
    3607         111 :                           Builtins::kReflectOwnKeys, 1, true);
    3608             :     SimpleInstallFunction(isolate_, reflect, "preventExtensions",
    3609         111 :                           Builtins::kReflectPreventExtensions, 1, true);
    3610             :     SimpleInstallFunction(isolate_, reflect, "set", Builtins::kReflectSet, 3,
    3611         111 :                           false);
    3612             :     SimpleInstallFunction(isolate_, reflect, "setPrototypeOf",
    3613         111 :                           Builtins::kReflectSetPrototypeOf, 2, true);
    3614             :   }
    3615             : 
    3616             :   {  // --- B o u n d F u n c t i o n
    3617             :     Handle<Map> map =
    3618             :         factory->NewMap(JS_BOUND_FUNCTION_TYPE, JSBoundFunction::kSize,
    3619         111 :                         TERMINAL_FAST_ELEMENTS_KIND, 0);
    3620         222 :     map->SetConstructor(native_context()->object_function());
    3621             :     map->set_is_callable(true);
    3622         111 :     Map::SetPrototype(isolate(), map, empty_function);
    3623             : 
    3624             :     PropertyAttributes roc_attribs =
    3625             :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
    3626         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3627             : 
    3628             :     {  // length
    3629             :       Descriptor d = Descriptor::AccessorConstant(
    3630             :           factory->length_string(), factory->bound_function_length_accessor(),
    3631         111 :           roc_attribs);
    3632         111 :       map->AppendDescriptor(isolate(), &d);
    3633             :     }
    3634             : 
    3635             :     {  // name
    3636             :       Descriptor d = Descriptor::AccessorConstant(
    3637             :           factory->name_string(), factory->bound_function_name_accessor(),
    3638         111 :           roc_attribs);
    3639         111 :       map->AppendDescriptor(isolate(), &d);
    3640             :     }
    3641         111 :     native_context()->set_bound_function_without_constructor_map(*map);
    3642             : 
    3643         111 :     map = Map::Copy(isolate_, map, "IsConstructor");
    3644             :     map->set_is_constructor(true);
    3645         111 :     native_context()->set_bound_function_with_constructor_map(*map);
    3646             :   }
    3647             : 
    3648             :   {  // --- sloppy arguments map
    3649         111 :     Handle<String> arguments_string = factory->Arguments_string();
    3650             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    3651             :         arguments_string, isolate_->initial_object_prototype(),
    3652             :         JS_ARGUMENTS_TYPE, JSSloppyArgumentsObject::kSize, 2,
    3653         222 :         Builtins::kIllegal, MUTABLE);
    3654         111 :     Handle<JSFunction> function = factory->NewFunction(args);
    3655         222 :     Handle<Map> map(function->initial_map(), isolate());
    3656             : 
    3657             :     // Create the descriptor array for the arguments object.
    3658         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3659             : 
    3660             :     {  // length
    3661             :       Descriptor d =
    3662             :           Descriptor::DataField(isolate(), factory->length_string(),
    3663             :                                 JSSloppyArgumentsObject::kLengthIndex,
    3664         111 :                                 DONT_ENUM, Representation::Tagged());
    3665         111 :       map->AppendDescriptor(isolate(), &d);
    3666             :     }
    3667             :     {  // callee
    3668             :       Descriptor d =
    3669             :           Descriptor::DataField(isolate(), factory->callee_string(),
    3670             :                                 JSSloppyArgumentsObject::kCalleeIndex,
    3671         111 :                                 DONT_ENUM, Representation::Tagged());
    3672         111 :       map->AppendDescriptor(isolate(), &d);
    3673             :     }
    3674             :     // @@iterator method is added later.
    3675             : 
    3676         111 :     native_context()->set_sloppy_arguments_map(*map);
    3677             : 
    3678             :     DCHECK(!map->is_dictionary_map());
    3679             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3680             :   }
    3681             : 
    3682             :   {  // --- fast and slow aliased arguments map
    3683         111 :     Handle<Map> map = isolate_->sloppy_arguments_map();
    3684         111 :     map = Map::Copy(isolate_, map, "FastAliasedArguments");
    3685         111 :     map->set_elements_kind(FAST_SLOPPY_ARGUMENTS_ELEMENTS);
    3686             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3687         111 :     native_context()->set_fast_aliased_arguments_map(*map);
    3688             : 
    3689         111 :     map = Map::Copy(isolate_, map, "SlowAliasedArguments");
    3690         111 :     map->set_elements_kind(SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
    3691             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3692         111 :     native_context()->set_slow_aliased_arguments_map(*map);
    3693             :   }
    3694             : 
    3695             :   {  // --- strict mode arguments map
    3696             :     const PropertyAttributes attributes =
    3697             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3698             : 
    3699             :     // Create the ThrowTypeError function.
    3700         111 :     Handle<AccessorPair> callee = factory->NewAccessorPair();
    3701             : 
    3702         111 :     Handle<JSFunction> poison = GetThrowTypeErrorIntrinsic();
    3703             : 
    3704             :     // Install the ThrowTypeError function.
    3705         222 :     callee->set_getter(*poison);
    3706         222 :     callee->set_setter(*poison);
    3707             : 
    3708             :     // Create the map. Allocate one in-object field for length.
    3709             :     Handle<Map> map = factory->NewMap(
    3710         111 :         JS_ARGUMENTS_TYPE, JSStrictArgumentsObject::kSize, PACKED_ELEMENTS, 1);
    3711             :     // Create the descriptor array for the arguments object.
    3712         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3713             : 
    3714             :     {  // length
    3715             :       Descriptor d =
    3716             :           Descriptor::DataField(isolate(), factory->length_string(),
    3717             :                                 JSStrictArgumentsObject::kLengthIndex,
    3718         111 :                                 DONT_ENUM, Representation::Tagged());
    3719         111 :       map->AppendDescriptor(isolate(), &d);
    3720             :     }
    3721             :     {  // callee
    3722             :       Descriptor d = Descriptor::AccessorConstant(factory->callee_string(),
    3723         111 :                                                   callee, attributes);
    3724         111 :       map->AppendDescriptor(isolate(), &d);
    3725             :     }
    3726             :     // @@iterator method is added later.
    3727             : 
    3728             :     DCHECK_EQ(native_context()->object_function()->prototype(),
    3729             :               *isolate_->initial_object_prototype());
    3730         222 :     Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
    3731             : 
    3732             :     // Copy constructor from the sloppy arguments boilerplate.
    3733             :     map->SetConstructor(
    3734         222 :         native_context()->sloppy_arguments_map()->GetConstructor());
    3735             : 
    3736         111 :     native_context()->set_strict_arguments_map(*map);
    3737             : 
    3738             :     DCHECK(!map->is_dictionary_map());
    3739             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3740             :   }
    3741             : 
    3742             :   {  // --- context extension
    3743             :     // Create a function for the context extension objects.
    3744             :     Handle<JSFunction> context_extension_fun =
    3745             :         CreateFunction(isolate_, factory->empty_string(),
    3746             :                        JS_CONTEXT_EXTENSION_OBJECT_TYPE, JSObject::kHeaderSize,
    3747         111 :                        0, factory->the_hole_value(), Builtins::kIllegal);
    3748         111 :     native_context()->set_context_extension_function(*context_extension_fun);
    3749             :   }
    3750             : 
    3751             :   {
    3752             :     // Set up the call-as-function delegate.
    3753             :     Handle<JSFunction> delegate =
    3754             :         SimpleCreateFunction(isolate_, factory->empty_string(),
    3755         111 :                              Builtins::kHandleApiCallAsFunction, 0, false);
    3756         111 :     native_context()->set_call_as_function_delegate(*delegate);
    3757             :   }
    3758             : 
    3759             :   {
    3760             :     // Set up the call-as-constructor delegate.
    3761             :     Handle<JSFunction> delegate =
    3762             :         SimpleCreateFunction(isolate_, factory->empty_string(),
    3763         111 :                              Builtins::kHandleApiCallAsConstructor, 0, false);
    3764         111 :     native_context()->set_call_as_constructor_delegate(*delegate);
    3765             :   }
    3766         111 : }  // NOLINT(readability/fn_size)
    3767             : 
    3768        1221 : Handle<JSFunction> Genesis::InstallTypedArray(const char* name,
    3769        9768 :                                               ElementsKind elements_kind) {
    3770             :   Handle<JSObject> global =
    3771        2442 :       Handle<JSObject>(native_context()->global_object(), isolate());
    3772             : 
    3773        1221 :   Handle<JSObject> typed_array_prototype = isolate()->typed_array_prototype();
    3774        1221 :   Handle<JSFunction> typed_array_function = isolate()->typed_array_function();
    3775             : 
    3776             :   Handle<JSFunction> result = InstallFunction(
    3777             :       isolate(), global, name, JS_TYPED_ARRAY_TYPE,
    3778             :       JSTypedArray::kSizeWithEmbedderFields, 0, factory()->the_hole_value(),
    3779        1221 :       Builtins::kTypedArrayConstructor);
    3780        2442 :   result->initial_map()->set_elements_kind(elements_kind);
    3781             : 
    3782        2442 :   result->shared()->DontAdaptArguments();
    3783        2442 :   result->shared()->set_length(3);
    3784             : 
    3785        2442 :   CHECK(JSObject::SetPrototype(result, typed_array_function, false, kDontThrow)
    3786             :             .FromJust());
    3787             : 
    3788             :   Handle<Smi> bytes_per_element(
    3789        1221 :       Smi::FromInt(1 << ElementsKindToShiftSize(elements_kind)), isolate());
    3790             : 
    3791        1221 :   InstallConstant(isolate(), result, "BYTES_PER_ELEMENT", bytes_per_element);
    3792             : 
    3793             :   // Setup prototype object.
    3794             :   DCHECK(result->prototype()->IsJSObject());
    3795        2442 :   Handle<JSObject> prototype(JSObject::cast(result->prototype()), isolate());
    3796             : 
    3797        2442 :   CHECK(JSObject::SetPrototype(prototype, typed_array_prototype, false,
    3798             :                                kDontThrow)
    3799             :             .FromJust());
    3800             : 
    3801        1221 :   InstallConstant(isolate(), prototype, "BYTES_PER_ELEMENT", bytes_per_element);
    3802        1221 :   return result;
    3803             : }
    3804             : 
    3805             : 
    3806       91595 : void Genesis::InitializeExperimentalGlobal() {
    3807             : #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
    3808             : 
    3809       91595 :   HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
    3810       91595 :   HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
    3811       91595 :   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
    3812             : #undef FEATURE_INITIALIZE_GLOBAL
    3813       91595 : }
    3814             : 
    3815         222 : bool Bootstrapper::CompileExtraBuiltin(Isolate* isolate, int index) {
    3816             :   HandleScope scope(isolate);
    3817         111 :   Vector<const char> name = ExtraNatives::GetScriptName(index);
    3818             :   Handle<String> source_code =
    3819         111 :       isolate->bootstrapper()->GetNativeSource(EXTRAS, index);
    3820         111 :   Handle<Object> global = isolate->global_object();
    3821         111 :   Handle<Object> binding = isolate->extras_binding_object();
    3822         111 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3823         111 :   Handle<Object> args[] = {global, binding, extras_utils};
    3824             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3825         222 :                                      arraysize(args), args, EXTENSION_CODE);
    3826             : }
    3827             : 
    3828             : 
    3829         111 : bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
    3830             :                                  Handle<String> source, int argc,
    3831             :                                  Handle<Object> argv[],
    3832             :                                  NativesFlag natives_flag) {
    3833             :   SuppressDebug compiling_natives(isolate->debug());
    3834             : 
    3835             :   Handle<Context> context(isolate->context(), isolate);
    3836             :   Handle<String> script_name =
    3837         222 :       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
    3838             :   MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3839             :       Compiler::GetSharedFunctionInfoForScript(
    3840             :           isolate, source, Compiler::ScriptDetails(script_name),
    3841             :           ScriptOriginOptions(), nullptr, nullptr,
    3842             :           ScriptCompiler::kNoCompileOptions, ScriptCompiler::kNoCacheNoReason,
    3843         111 :           natives_flag);
    3844             :   Handle<SharedFunctionInfo> function_info;
    3845         111 :   if (!maybe_function_info.ToHandle(&function_info)) return false;
    3846             : 
    3847             :   DCHECK(context->IsNativeContext());
    3848             : 
    3849             :   Handle<JSFunction> fun =
    3850             :       isolate->factory()->NewFunctionFromSharedFunctionInfo(function_info,
    3851         111 :                                                             context);
    3852             :   Handle<Object> receiver = isolate->factory()->undefined_value();
    3853             : 
    3854             :   // For non-extension scripts, run script to get the function wrapper.
    3855             :   Handle<Object> wrapper;
    3856         111 :   if (!Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3857         111 :                           Execution::MessageHandling::kKeepPending, nullptr)
    3858         222 :            .ToHandle(&wrapper)) {
    3859             :     return false;
    3860             :   }
    3861             :   // Then run the function wrapper.
    3862             :   return !Execution::TryCall(isolate, Handle<JSFunction>::cast(wrapper),
    3863             :                              receiver, argc, argv,
    3864         222 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3865         222 :               .is_null();
    3866             : }
    3867             : 
    3868             : 
    3869       18144 : bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
    3870             :   Factory* factory = isolate->factory();
    3871             :   HandleScope scope(isolate);
    3872             :   Handle<SharedFunctionInfo> function_info;
    3873             : 
    3874             :   Handle<String> source =
    3875             :       isolate->factory()
    3876             :           ->NewExternalStringFromOneByte(extension->source())
    3877        9072 :           .ToHandleChecked();
    3878             :   DCHECK(source->IsOneByteRepresentation());
    3879             : 
    3880             :   // If we can't find the function in the cache, we compile a new
    3881             :   // function and insert it into the cache.
    3882        4539 :   Vector<const char> name = CStrVector(extension->name());
    3883        4539 :   SourceCodeCache* cache = isolate->bootstrapper()->extensions_cache();
    3884             :   Handle<Context> context(isolate->context(), isolate);
    3885             :   DCHECK(context->IsNativeContext());
    3886             : 
    3887        4539 :   if (!cache->Lookup(isolate, name, &function_info)) {
    3888             :     Handle<String> script_name =
    3889        6469 :         factory->NewStringFromUtf8(name).ToHandleChecked();
    3890             :     MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3891             :         Compiler::GetSharedFunctionInfoForScript(
    3892             :             isolate, source, Compiler::ScriptDetails(script_name),
    3893             :             ScriptOriginOptions(), extension, nullptr,
    3894             :             ScriptCompiler::kNoCompileOptions,
    3895        3233 :             ScriptCompiler::kNoCacheBecauseV8Extension, EXTENSION_CODE);
    3896        3230 :     if (!maybe_function_info.ToHandle(&function_info)) return false;
    3897        3200 :     cache->Add(isolate, name, function_info);
    3898             :   }
    3899             : 
    3900             :   // Set up the function context. Conceptually, we should clone the
    3901             :   // function before overwriting the context but since we're in a
    3902             :   // single-threaded environment it is not strictly necessary.
    3903             :   Handle<JSFunction> fun =
    3904        4502 :       factory->NewFunctionFromSharedFunctionInfo(function_info, context);
    3905             : 
    3906             :   // Call function using either the runtime object or the global
    3907             :   // object as the receiver. Provide no parameters.
    3908        4504 :   Handle<Object> receiver = isolate->global_object();
    3909             :   return !Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3910        4505 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3911        9005 :               .is_null();
    3912             : }
    3913             : 
    3914       14319 : static Handle<JSObject> ResolveBuiltinIdHolder(Isolate* isolate,
    3915             :                                                Handle<Context> native_context,
    3916             :                                                const char* holder_expr) {
    3917             :   Factory* factory = isolate->factory();
    3918       28638 :   Handle<JSGlobalObject> global(native_context->global_object(), isolate);
    3919             :   const char* period_pos = strchr(holder_expr, '.');
    3920       14319 :   if (period_pos == nullptr) {
    3921             :     return Handle<JSObject>::cast(
    3922             :         Object::GetPropertyOrElement(
    3923       10656 :             isolate, global, factory->InternalizeUtf8String(holder_expr))
    3924       10656 :             .ToHandleChecked());
    3925             :   }
    3926        8991 :   const char* inner = period_pos + 1;
    3927             :   DCHECK(!strchr(inner, '.'));
    3928             :   Vector<const char> property(holder_expr,
    3929        8991 :                               static_cast<int>(period_pos - holder_expr));
    3930        8991 :   Handle<String> property_string = factory->InternalizeUtf8String(property);
    3931             :   DCHECK(!property_string.is_null());
    3932             :   Handle<JSObject> object = Handle<JSObject>::cast(
    3933        8991 :       JSReceiver::GetProperty(isolate, global, property_string)
    3934       17982 :           .ToHandleChecked());
    3935        8991 :   if (strcmp("prototype", inner) == 0) {
    3936        8991 :     Handle<JSFunction> function = Handle<JSFunction>::cast(object);
    3937       17982 :     return Handle<JSObject>(JSObject::cast(function->prototype()), isolate);
    3938             :   }
    3939           0 :   Handle<String> inner_string = factory->InternalizeUtf8String(inner);
    3940             :   DCHECK(!inner_string.is_null());
    3941             :   Handle<Object> value =
    3942           0 :       JSReceiver::GetProperty(isolate, object, inner_string).ToHandleChecked();
    3943           0 :   return Handle<JSObject>::cast(value);
    3944             : }
    3945             : 
    3946       91891 : void Genesis::ConfigureUtilsObject() {
    3947             :   // We still need the utils object after deserialization.
    3948       92187 :   if (isolate()->serializer_enabled()) return;
    3949             : 
    3950             :   // The utils object can be removed for cases that reach this point.
    3951      183190 :   HeapObject undefined = ReadOnlyRoots(heap()).undefined_value();
    3952       91595 :   native_context()->set_extras_utils_object(undefined);
    3953             : }
    3954             : 
    3955         111 : void Genesis::InitializeIteratorFunctions() {
    3956         111 :   Isolate* isolate = isolate_;
    3957             :   Factory* factory = isolate->factory();
    3958             :   HandleScope scope(isolate);
    3959         111 :   Handle<NativeContext> native_context = isolate->native_context();
    3960             :   Handle<JSObject> iterator_prototype(
    3961         222 :       native_context->initial_iterator_prototype(), isolate);
    3962             : 
    3963             :   {  // -- G e n e r a t o r
    3964         111 :     PrototypeIterator iter(isolate, native_context->generator_function_map());
    3965             :     Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>(),
    3966         111 :                                                   isolate);
    3967             :     Handle<JSFunction> generator_function_function = CreateFunction(
    3968             :         isolate, "GeneratorFunction", JS_FUNCTION_TYPE,
    3969             :         JSFunction::kSizeWithPrototype, 0, generator_function_prototype,
    3970         111 :         Builtins::kGeneratorFunctionConstructor);
    3971             :     generator_function_function->set_prototype_or_initial_map(
    3972         222 :         native_context->generator_function_map());
    3973         222 :     generator_function_function->shared()->DontAdaptArguments();
    3974         222 :     generator_function_function->shared()->set_length(1);
    3975             :     InstallWithIntrinsicDefaultProto(
    3976             :         isolate, generator_function_function,
    3977         111 :         Context::GENERATOR_FUNCTION_FUNCTION_INDEX);
    3978             : 
    3979             :     JSObject::ForceSetPrototype(generator_function_function,
    3980         222 :                                 isolate->function_function());
    3981             :     JSObject::AddProperty(
    3982             :         isolate, generator_function_prototype, factory->constructor_string(),
    3983             :         generator_function_function,
    3984         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3985             : 
    3986         222 :     native_context->generator_function_map()->SetConstructor(
    3987         333 :         *generator_function_function);
    3988             :   }
    3989             : 
    3990             :   {  // -- A s y n c G e n e r a t o r
    3991             :     PrototypeIterator iter(isolate,
    3992         111 :                            native_context->async_generator_function_map());
    3993             :     Handle<JSObject> async_generator_function_prototype(
    3994         111 :         iter.GetCurrent<JSObject>(), isolate);
    3995             : 
    3996             :     Handle<JSFunction> async_generator_function_function = CreateFunction(
    3997             :         isolate, "AsyncGeneratorFunction", JS_FUNCTION_TYPE,
    3998             :         JSFunction::kSizeWithPrototype, 0, async_generator_function_prototype,
    3999         111 :         Builtins::kAsyncGeneratorFunctionConstructor);
    4000             :     async_generator_function_function->set_prototype_or_initial_map(
    4001         222 :         native_context->async_generator_function_map());
    4002         222 :     async_generator_function_function->shared()->DontAdaptArguments();
    4003         222 :     async_generator_function_function->shared()->set_length(1);
    4004             :     InstallWithIntrinsicDefaultProto(
    4005             :         isolate, async_generator_function_function,
    4006         111 :         Context::ASYNC_GENERATOR_FUNCTION_FUNCTION_INDEX);
    4007             : 
    4008             :     JSObject::ForceSetPrototype(async_generator_function_function,
    4009         222 :                                 isolate->function_function());
    4010             : 
    4011             :     JSObject::AddProperty(
    4012             :         isolate, async_generator_function_prototype,
    4013             :         factory->constructor_string(), async_generator_function_function,
    4014         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4015             : 
    4016         222 :     native_context->async_generator_function_map()->SetConstructor(
    4017         333 :         *async_generator_function_function);
    4018             :   }
    4019             : 
    4020             :   {  // -- S e t I t e r a t o r
    4021             :     // Setup %SetIteratorPrototype%.
    4022             :     Handle<JSObject> prototype =
    4023         111 :         factory->NewJSObject(isolate->object_function(), TENURED);
    4024         111 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4025             : 
    4026         111 :     InstallToStringTag(isolate, prototype, factory->SetIterator_string());
    4027             : 
    4028             :     // Install the next function on the {prototype}.
    4029             :     InstallFunctionWithBuiltinId(isolate, prototype, "next",
    4030             :                                  Builtins::kSetIteratorPrototypeNext, 0, true,
    4031         111 :                                  BuiltinFunctionId::kSetIteratorNext);
    4032         111 :     native_context->set_initial_set_iterator_prototype(*prototype);
    4033             : 
    4034             :     // Setup SetIterator constructor.
    4035             :     Handle<JSFunction> set_iterator_function =
    4036             :         CreateFunction(isolate, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
    4037         111 :                        JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
    4038         111 :     set_iterator_function->shared()->set_native(false);
    4039             : 
    4040             :     Handle<Map> set_value_iterator_map(set_iterator_function->initial_map(),
    4041         222 :                                        isolate);
    4042         111 :     native_context->set_set_value_iterator_map(*set_value_iterator_map);
    4043             : 
    4044             :     Handle<Map> set_key_value_iterator_map = Map::Copy(
    4045         111 :         isolate, set_value_iterator_map, "JS_SET_KEY_VALUE_ITERATOR_TYPE");
    4046             :     set_key_value_iterator_map->set_instance_type(
    4047             :         JS_SET_KEY_VALUE_ITERATOR_TYPE);
    4048         111 :     native_context->set_set_key_value_iterator_map(*set_key_value_iterator_map);
    4049             :   }
    4050             : 
    4051             :   {  // -- M a p I t e r a t o r
    4052             :     // Setup %MapIteratorPrototype%.
    4053             :     Handle<JSObject> prototype =
    4054         111 :         factory->NewJSObject(isolate->object_function(), TENURED);
    4055         111 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4056             : 
    4057         111 :     InstallToStringTag(isolate, prototype, factory->MapIterator_string());
    4058             : 
    4059             :     // Install the next function on the {prototype}.
    4060             :     InstallFunctionWithBuiltinId(isolate, prototype, "next",
    4061             :                                  Builtins::kMapIteratorPrototypeNext, 0, true,
    4062         111 :                                  BuiltinFunctionId::kMapIteratorNext);
    4063         111 :     native_context->set_initial_map_iterator_prototype(*prototype);
    4064             : 
    4065             :     // Setup MapIterator constructor.
    4066             :     Handle<JSFunction> map_iterator_function =
    4067             :         CreateFunction(isolate, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
    4068         111 :                        JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
    4069         111 :     map_iterator_function->shared()->set_native(false);
    4070             : 
    4071             :     Handle<Map> map_key_iterator_map(map_iterator_function->initial_map(),
    4072         222 :                                      isolate);
    4073         111 :     native_context->set_map_key_iterator_map(*map_key_iterator_map);
    4074             : 
    4075             :     Handle<Map> map_key_value_iterator_map = Map::Copy(
    4076         111 :         isolate, map_key_iterator_map, "JS_MAP_KEY_VALUE_ITERATOR_TYPE");
    4077             :     map_key_value_iterator_map->set_instance_type(
    4078             :         JS_MAP_KEY_VALUE_ITERATOR_TYPE);
    4079         111 :     native_context->set_map_key_value_iterator_map(*map_key_value_iterator_map);
    4080             : 
    4081             :     Handle<Map> map_value_iterator_map =
    4082         111 :         Map::Copy(isolate, map_key_iterator_map, "JS_MAP_VALUE_ITERATOR_TYPE");
    4083             :     map_value_iterator_map->set_instance_type(JS_MAP_VALUE_ITERATOR_TYPE);
    4084         111 :     native_context->set_map_value_iterator_map(*map_value_iterator_map);
    4085             :   }
    4086             : 
    4087             :   {  // -- A s y n c F u n c t i o n
    4088             :     // Builtin functions for AsyncFunction.
    4089         111 :     PrototypeIterator iter(isolate, native_context->async_function_map());
    4090             :     Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>(),
    4091         111 :                                               isolate);
    4092             : 
    4093             :     Handle<JSFunction> async_function_constructor = CreateFunction(
    4094             :         isolate, "AsyncFunction", JS_FUNCTION_TYPE,
    4095             :         JSFunction::kSizeWithPrototype, 0, async_function_prototype,
    4096         111 :         Builtins::kAsyncFunctionConstructor);
    4097             :     async_function_constructor->set_prototype_or_initial_map(
    4098         222 :         native_context->async_function_map());
    4099         222 :     async_function_constructor->shared()->DontAdaptArguments();
    4100         222 :     async_function_constructor->shared()->set_length(1);
    4101         111 :     native_context->set_async_function_constructor(*async_function_constructor);
    4102             :     JSObject::ForceSetPrototype(async_function_constructor,
    4103         222 :                                 isolate->function_function());
    4104             : 
    4105             :     JSObject::AddProperty(
    4106             :         isolate, async_function_prototype, factory->constructor_string(),
    4107             :         async_function_constructor,
    4108         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4109             : 
    4110             :     JSFunction::SetPrototype(async_function_constructor,
    4111         111 :                              async_function_prototype);
    4112             : 
    4113             :     // Async functions don't have a prototype, but they use generator objects
    4114             :     // under the hood to model the suspend/resume (in await). Instead of using
    4115             :     // the "prototype" / initial_map machinery (like for (async) generators),
    4116             :     // there's one global (per native context) map here that is used for the
    4117             :     // async function generator objects. These objects never escape to user
    4118             :     // JavaScript anyways.
    4119             :     Handle<Map> async_function_object_map = factory->NewMap(
    4120         111 :         JS_ASYNC_FUNCTION_OBJECT_TYPE, JSAsyncFunctionObject::kSize);
    4121         111 :     native_context->set_async_function_object_map(*async_function_object_map);
    4122             : 
    4123             :     {
    4124             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4125             :           isolate, Builtins::kAsyncFunctionAwaitRejectClosure,
    4126         111 :           factory->empty_string(), 1);
    4127         111 :       native_context->set_async_function_await_reject_shared_fun(*info);
    4128             :     }
    4129             : 
    4130             :     {
    4131             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4132             :           isolate, Builtins::kAsyncFunctionAwaitResolveClosure,
    4133         111 :           factory->empty_string(), 1);
    4134         111 :       native_context->set_async_function_await_resolve_shared_fun(*info);
    4135             :     }
    4136             :   }
    4137         111 : }
    4138             : 
    4139        2553 : void Genesis::InitializeCallSiteBuiltins() {
    4140             :   Factory* factory = isolate()->factory();
    4141             :   HandleScope scope(isolate());
    4142             :   // -- C a l l S i t e
    4143             :   // Builtin functions for CallSite.
    4144             : 
    4145             :   // CallSites are a special case; the constructor is for our private use
    4146             :   // only, therefore we set it up as a builtin that throws. Internally, we use
    4147             :   // CallSiteUtils::Construct to create CallSite objects.
    4148             : 
    4149             :   Handle<JSFunction> callsite_fun = CreateFunction(
    4150             :       isolate(), "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize, 0,
    4151         111 :       factory->the_hole_value(), Builtins::kUnsupportedThrower);
    4152         222 :   callsite_fun->shared()->DontAdaptArguments();
    4153         222 :   isolate()->native_context()->set_callsite_function(*callsite_fun);
    4154             : 
    4155             :   // Setup CallSite.prototype.
    4156             :   Handle<JSObject> prototype(JSObject::cast(callsite_fun->instance_prototype()),
    4157         222 :                              isolate());
    4158             : 
    4159             :   struct FunctionInfo {
    4160             :     const char* name;
    4161             :     Builtins::Name id;
    4162             :   };
    4163             : 
    4164             :   FunctionInfo infos[] = {
    4165             :       {"getColumnNumber", Builtins::kCallSitePrototypeGetColumnNumber},
    4166             :       {"getEvalOrigin", Builtins::kCallSitePrototypeGetEvalOrigin},
    4167             :       {"getFileName", Builtins::kCallSitePrototypeGetFileName},
    4168             :       {"getFunction", Builtins::kCallSitePrototypeGetFunction},
    4169             :       {"getFunctionName", Builtins::kCallSitePrototypeGetFunctionName},
    4170             :       {"getLineNumber", Builtins::kCallSitePrototypeGetLineNumber},
    4171             :       {"getMethodName", Builtins::kCallSitePrototypeGetMethodName},
    4172             :       {"getPosition", Builtins::kCallSitePrototypeGetPosition},
    4173             :       {"getPromiseIndex", Builtins::kCallSitePrototypeGetPromiseIndex},
    4174             :       {"getScriptNameOrSourceURL",
    4175             :        Builtins::kCallSitePrototypeGetScriptNameOrSourceURL},
    4176             :       {"getThis", Builtins::kCallSitePrototypeGetThis},
    4177             :       {"getTypeName", Builtins::kCallSitePrototypeGetTypeName},
    4178             :       {"isAsync", Builtins::kCallSitePrototypeIsAsync},
    4179             :       {"isConstructor", Builtins::kCallSitePrototypeIsConstructor},
    4180             :       {"isEval", Builtins::kCallSitePrototypeIsEval},
    4181             :       {"isNative", Builtins::kCallSitePrototypeIsNative},
    4182             :       {"isPromiseAll", Builtins::kCallSitePrototypeIsPromiseAll},
    4183             :       {"isToplevel", Builtins::kCallSitePrototypeIsToplevel},
    4184         111 :       {"toString", Builtins::kCallSitePrototypeToString}};
    4185             : 
    4186             :   PropertyAttributes attrs =
    4187             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    4188             : 
    4189             :   Handle<JSFunction> fun;
    4190        2220 :   for (const FunctionInfo& info : infos) {
    4191             :     SimpleInstallFunction(isolate(), prototype, info.name, info.id, 0, true,
    4192        4218 :                           attrs);
    4193             :   }
    4194         111 : }
    4195             : 
    4196             : #define EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(id) \
    4197             :   void Genesis::InitializeGlobal_##id() {}
    4198             : 
    4199           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_namespace_exports)
    4200           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_public_fields)
    4201           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_fields)
    4202           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_methods)
    4203           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_static_fields)
    4204           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_class_fields)
    4205           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
    4206           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_meta)
    4207           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_numeric_separator)
    4208           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_json_stringify)
    4209           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_sequence)
    4210           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_await_optimization)
    4211           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_hashbang)
    4212             : 
    4213             : #undef EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE
    4214             : 
    4215      274785 : void Genesis::InitializeGlobal_harmony_global() {
    4216      183190 :   if (!FLAG_harmony_global) return;
    4217             : 
    4218             :   Factory* factory = isolate()->factory();
    4219      183190 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4220      183190 :   Handle<JSGlobalProxy> global_proxy(native_context()->global_proxy(),
    4221       91595 :                                      isolate());
    4222             :   JSObject::AddProperty(isolate_, global, factory->globalThis_string(),
    4223       91595 :                         global_proxy, DONT_ENUM);
    4224             : }
    4225             : 
    4226      457975 : void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
    4227      183190 :   if (!FLAG_harmony_sharedarraybuffer) return;
    4228             : 
    4229      183190 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4230             : 
    4231             :   JSObject::AddProperty(isolate_, global, "SharedArrayBuffer",
    4232      183190 :                         isolate()->shared_array_buffer_fun(), DONT_ENUM);
    4233             : 
    4234             :   JSObject::AddProperty(isolate_, global, "Atomics",
    4235      183190 :                         isolate()->atomics_object(), DONT_ENUM);
    4236       91595 :   InstallToStringTag(isolate_, isolate()->atomics_object(), "Atomics");
    4237             : }
    4238             : 
    4239      457975 : void Genesis::InitializeGlobal_harmony_array_flat() {
    4240       91595 :   if (!FLAG_harmony_array_flat) return;
    4241      183190 :   Handle<JSFunction> array_constructor(native_context()->array_function(),
    4242       91595 :                                        isolate());
    4243             :   Handle<JSObject> array_prototype(
    4244      183190 :       JSObject::cast(array_constructor->instance_prototype()), isolate());
    4245             :   SimpleInstallFunction(isolate(), array_prototype, "flat",
    4246       91595 :                         Builtins::kArrayPrototypeFlat, 0, false);
    4247             :   SimpleInstallFunction(isolate(), array_prototype, "flatMap",
    4248       91595 :                         Builtins::kArrayPrototypeFlatMap, 1, false);
    4249             : }
    4250             : 
    4251      457975 : void Genesis::InitializeGlobal_harmony_symbol_description() {
    4252       91595 :   if (!FLAG_harmony_symbol_description) return;
    4253             : 
    4254             :   // Symbol.prototype.description
    4255      183190 :   Handle<JSFunction> symbol_fun(native_context()->symbol_function(), isolate());
    4256             :   Handle<JSObject> symbol_prototype(
    4257      183190 :       JSObject::cast(symbol_fun->instance_prototype()), isolate());
    4258             :   SimpleInstallGetter(isolate(), symbol_prototype,
    4259             :                       factory()->InternalizeUtf8String("description"),
    4260      183190 :                       Builtins::kSymbolPrototypeDescriptionGetter, true);
    4261             : }
    4262             : 
    4263     1557115 : void Genesis::InitializeGlobal_harmony_string_matchall() {
    4264      183190 :   if (!FLAG_harmony_string_matchall) return;
    4265             : 
    4266             :   {  // String.prototype.matchAll
    4267      183190 :     Handle<JSFunction> string_fun(native_context()->string_function(),
    4268       91595 :                                   isolate());
    4269             :     Handle<JSObject> string_prototype(
    4270      183190 :         JSObject::cast(string_fun->instance_prototype()), isolate());
    4271             : 
    4272             :     SimpleInstallFunction(isolate(), string_prototype, "matchAll",
    4273       91595 :                           Builtins::kStringPrototypeMatchAll, 1, true);
    4274             :   }
    4275             : 
    4276             :   {  // RegExp.prototype[@@matchAll]
    4277      183190 :     Handle<JSFunction> regexp_fun(native_context()->regexp_function(),
    4278       91595 :                                   isolate());
    4279             :     Handle<JSObject> regexp_prototype(
    4280      183190 :         JSObject::cast(regexp_fun->instance_prototype()), isolate());
    4281             :     InstallFunctionAtSymbol(isolate(), regexp_prototype,
    4282             :                             factory()->match_all_symbol(), "[Symbol.matchAll]",
    4283       91595 :                             Builtins::kRegExpPrototypeMatchAll, 1, true);
    4284             :     Handle<Map> regexp_prototype_map(regexp_prototype->map(), isolate());
    4285       91595 :     Map::SetShouldBeFastPrototypeMap(regexp_prototype_map, true, isolate());
    4286       91595 :     native_context()->set_regexp_prototype_map(*regexp_prototype_map);
    4287             :     DCHECK_EQ(JSRegExp::kSymbolMatchAllFunctionDescriptorIndex,
    4288             :               regexp_prototype->map()->LastAdded());
    4289             :   }
    4290             : 
    4291             :   {  // --- R e g E x p S t r i n g  I t e r a t o r ---
    4292             :     Handle<JSObject> iterator_prototype(
    4293      183190 :         native_context()->initial_iterator_prototype(), isolate());
    4294             : 
    4295             :     Handle<JSObject> regexp_string_iterator_prototype =
    4296      183190 :         factory()->NewJSObject(isolate()->object_function(), TENURED);
    4297             :     JSObject::ForceSetPrototype(regexp_string_iterator_prototype,
    4298       91595 :                                 iterator_prototype);
    4299             : 
    4300             :     InstallToStringTag(isolate(), regexp_string_iterator_prototype,
    4301       91595 :                        "RegExp String Iterator");
    4302             : 
    4303             :     SimpleInstallFunction(isolate(), regexp_string_iterator_prototype, "next",
    4304             :                           Builtins::kRegExpStringIteratorPrototypeNext, 0,
    4305       91595 :                           true);
    4306             : 
    4307             :     Handle<JSFunction> regexp_string_iterator_function = CreateFunction(
    4308             :         isolate(), "RegExpStringIterator", JS_REGEXP_STRING_ITERATOR_TYPE,
    4309             :         JSRegExpStringIterator::kSize, 0, regexp_string_iterator_prototype,
    4310       91595 :         Builtins::kIllegal);
    4311       91595 :     regexp_string_iterator_function->shared()->set_native(false);
    4312      183190 :     native_context()->set_initial_regexp_string_iterator_prototype_map(
    4313      274785 :         regexp_string_iterator_function->initial_map());
    4314             :   }
    4315             : 
    4316             :   {  // @@matchAll Symbol
    4317      183190 :     Handle<JSFunction> symbol_fun(native_context()->symbol_function(),
    4318       91595 :                                   isolate());
    4319             :     InstallConstant(isolate(), symbol_fun, "matchAll",
    4320       91595 :                     factory()->match_all_symbol());
    4321             :   }
    4322             : }
    4323             : 
    4324      100670 : void Genesis::InitializeGlobal_harmony_weak_refs() {
    4325      183190 :   if (!FLAG_harmony_weak_refs) return;
    4326             : 
    4327             :   Factory* factory = isolate()->factory();
    4328         726 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4329             : 
    4330             :   {
    4331             :     // Create %WeakFactoryPrototype%
    4332             :     Handle<String> weak_factory_name = factory->WeakFactory_string();
    4333             :     Handle<JSObject> weak_factory_prototype =
    4334         363 :         factory->NewJSObject(isolate()->object_function(), TENURED);
    4335             : 
    4336             :     // Create %WeakFactory%
    4337             :     Handle<JSFunction> weak_factory_fun =
    4338             :         CreateFunction(isolate(), weak_factory_name, JS_WEAK_FACTORY_TYPE,
    4339             :                        JSWeakFactory::kSize, 0, weak_factory_prototype,
    4340         363 :                        Builtins::kWeakFactoryConstructor);
    4341             : 
    4342         726 :     weak_factory_fun->shared()->DontAdaptArguments();
    4343         726 :     weak_factory_fun->shared()->set_length(1);
    4344             : 
    4345             :     // Install the "constructor" property on the prototype.
    4346             :     JSObject::AddProperty(isolate(), weak_factory_prototype,
    4347             :                           factory->constructor_string(), weak_factory_fun,
    4348         363 :                           DONT_ENUM);
    4349             : 
    4350         363 :     InstallToStringTag(isolate(), weak_factory_prototype, weak_factory_name);
    4351             : 
    4352             :     JSObject::AddProperty(isolate(), global, weak_factory_name,
    4353         363 :                           weak_factory_fun, DONT_ENUM);
    4354             : 
    4355             :     SimpleInstallFunction(isolate(), weak_factory_prototype, "makeCell",
    4356         363 :                           Builtins::kWeakFactoryMakeCell, 2, false);
    4357             : 
    4358             :     SimpleInstallFunction(isolate(), weak_factory_prototype, "cleanupSome",
    4359         363 :                           Builtins::kWeakFactoryCleanupSome, 0, false);
    4360             :   }
    4361             :   {
    4362             :     // Create %WeakCellPrototype%
    4363             :     Handle<Map> weak_cell_map =
    4364         363 :         factory->NewMap(JS_WEAK_CELL_TYPE, JSWeakCell::kSize);
    4365         363 :     native_context()->set_js_weak_cell_map(*weak_cell_map);
    4366             : 
    4367             :     Handle<JSObject> weak_cell_prototype =
    4368         363 :         factory->NewJSObject(isolate()->object_function(), TENURED);
    4369         363 :     Map::SetPrototype(isolate(), weak_cell_map, weak_cell_prototype);
    4370             : 
    4371             :     InstallToStringTag(isolate(), weak_cell_prototype,
    4372         363 :                        factory->WeakCell_string());
    4373             : 
    4374             :     SimpleInstallGetter(isolate(), weak_cell_prototype,
    4375             :                         factory->InternalizeUtf8String("holdings"),
    4376         726 :                         Builtins::kWeakCellHoldingsGetter, false);
    4377             :     SimpleInstallFunction(isolate(), weak_cell_prototype, "clear",
    4378         363 :                           Builtins::kWeakCellClear, 0, false);
    4379             : 
    4380             :     // Create %WeakRefPrototype%
    4381             :     Handle<Map> weak_ref_map =
    4382         363 :         factory->NewMap(JS_WEAK_REF_TYPE, JSWeakRef::kSize);
    4383             :     DCHECK(weak_ref_map->IsJSObjectMap());
    4384         363 :     native_context()->set_js_weak_ref_map(*weak_ref_map);
    4385             : 
    4386             :     Handle<JSObject> weak_ref_prototype =
    4387         363 :         factory->NewJSObject(isolate()->object_function(), TENURED);
    4388         363 :     Map::SetPrototype(isolate(), weak_ref_map, weak_ref_prototype);
    4389         363 :     JSObject::ForceSetPrototype(weak_ref_prototype, weak_cell_prototype);
    4390             : 
    4391             :     InstallToStringTag(isolate(), weak_ref_prototype,
    4392         363 :                        factory->WeakRef_string());
    4393             : 
    4394             :     SimpleInstallFunction(isolate(), weak_ref_prototype, "deref",
    4395         363 :                           Builtins::kWeakRefDeref, 0, false);
    4396             : 
    4397             :     // Create %WeakRef%
    4398         363 :     Handle<String> weak_ref_name = factory->InternalizeUtf8String("WeakRef");
    4399             :     Handle<JSFunction> weak_ref_fun = CreateFunction(
    4400             :         isolate(), weak_ref_name, JS_WEAK_REF_TYPE, JSWeakRef::kSize, 0,
    4401         363 :         weak_ref_prototype, Builtins::kWeakRefConstructor);
    4402             : 
    4403         726 :     weak_ref_fun->shared()->DontAdaptArguments();
    4404         726 :     weak_ref_fun->shared()->set_length(1);
    4405             : 
    4406             :     // Install the "constructor" property on the prototype.
    4407             :     JSObject::AddProperty(isolate(), weak_ref_prototype,
    4408             :                           factory->constructor_string(), weak_ref_fun,
    4409         363 :                           DONT_ENUM);
    4410             : 
    4411             :     JSObject::AddProperty(isolate(), global, weak_ref_name, weak_ref_fun,
    4412         363 :                           DONT_ENUM);
    4413             :   }
    4414             : 
    4415             :   {
    4416             :     // Create cleanup iterator for JSWeakFactory.
    4417             :     Handle<JSObject> iterator_prototype(
    4418         726 :         native_context()->initial_iterator_prototype(), isolate());
    4419             : 
    4420             :     Handle<JSObject> cleanup_iterator_prototype =
    4421         363 :         factory->NewJSObject(isolate()->object_function(), TENURED);
    4422         363 :     JSObject::ForceSetPrototype(cleanup_iterator_prototype, iterator_prototype);
    4423             : 
    4424             :     InstallToStringTag(isolate(), cleanup_iterator_prototype,
    4425         363 :                        "JSWeakFactoryCleanupIterator");
    4426             : 
    4427             :     SimpleInstallFunction(isolate(), cleanup_iterator_prototype, "next",
    4428         363 :                           Builtins::kWeakFactoryCleanupIteratorNext, 0, true);
    4429             :     Handle<Map> cleanup_iterator_map =
    4430             :         factory->NewMap(JS_WEAK_FACTORY_CLEANUP_ITERATOR_TYPE,
    4431         363 :                         JSWeakFactoryCleanupIterator::kSize);
    4432             :     Map::SetPrototype(isolate(), cleanup_iterator_map,
    4433         363 :                       cleanup_iterator_prototype);
    4434         726 :     native_context()->set_js_weak_factory_cleanup_iterator_map(
    4435         363 :         *cleanup_iterator_map);
    4436             :   }
    4437             : }
    4438             : 
    4439             : #ifdef V8_INTL_SUPPORT
    4440     1007542 : void Genesis::InitializeGlobal_harmony_intl_list_format() {
    4441       91595 :   if (!FLAG_harmony_intl_list_format) return;
    4442             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4443             :       JSReceiver::GetProperty(
    4444             :           isolate(),
    4445      183190 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4446      366380 :           factory()->InternalizeUtf8String("Intl"))
    4447      183190 :           .ToHandleChecked());
    4448             : 
    4449             :   Handle<JSFunction> list_format_fun =
    4450             :       InstallFunction(isolate(), intl, "ListFormat", JS_INTL_LIST_FORMAT_TYPE,
    4451             :                       JSListFormat::kSize, 0, factory()->the_hole_value(),
    4452       91595 :                       Builtins::kListFormatConstructor);
    4453      183190 :   list_format_fun->shared()->set_length(0);
    4454      183190 :   list_format_fun->shared()->DontAdaptArguments();
    4455             : 
    4456             :   SimpleInstallFunction(isolate(), list_format_fun, "supportedLocalesOf",
    4457       91595 :                         Builtins::kListFormatSupportedLocalesOf, 1, false);
    4458             : 
    4459             :   // Setup %ListFormatPrototype%.
    4460             :   Handle<JSObject> prototype(
    4461      183190 :       JSObject::cast(list_format_fun->instance_prototype()), isolate());
    4462             : 
    4463       91595 :   InstallToStringTag(isolate(), prototype, "Intl.ListFormat");
    4464             : 
    4465             :   SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    4466             :                         Builtins::kListFormatPrototypeResolvedOptions, 0,
    4467       91594 :                         false);
    4468             :   SimpleInstallFunction(isolate(), prototype, "format",
    4469       91594 :                         Builtins::kListFormatPrototypeFormat, 1, false);
    4470             :   SimpleInstallFunction(isolate(), prototype, "formatToParts",
    4471       91594 :                         Builtins::kListFormatPrototypeFormatToParts, 1, false);
    4472             : }
    4473             : 
    4474       94565 : void Genesis::InitializeGlobal_harmony_locale() {
    4475      183091 :   if (!FLAG_harmony_locale) return;
    4476             : 
    4477             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4478             :       JSReceiver::GetProperty(
    4479             :           isolate(),
    4480         198 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4481         396 :           factory()->InternalizeUtf8String("Intl"))
    4482         198 :           .ToHandleChecked());
    4483             : 
    4484             :   Handle<JSFunction> locale_fun = InstallFunction(
    4485             :       isolate(), intl, "Locale", JS_INTL_LOCALE_TYPE, JSLocale::kSize, 0,
    4486          99 :       factory()->the_hole_value(), Builtins::kLocaleConstructor);
    4487             :   InstallWithIntrinsicDefaultProto(isolate(), locale_fun,
    4488          99 :                                    Context::INTL_LOCALE_FUNCTION_INDEX);
    4489         198 :   locale_fun->shared()->set_length(1);
    4490         198 :   locale_fun->shared()->DontAdaptArguments();
    4491             : 
    4492             :   // Setup %LocalePrototype%.
    4493             :   Handle<JSObject> prototype(JSObject::cast(locale_fun->instance_prototype()),
    4494         198 :                              isolate());
    4495             : 
    4496          99 :   InstallToStringTag(isolate(), prototype, "Intl.Locale");
    4497             : 
    4498             :   SimpleInstallFunction(isolate(), prototype, "toString",
    4499          99 :                         Builtins::kLocalePrototypeToString, 0, false);
    4500             :   SimpleInstallFunction(isolate(), prototype, "maximize",
    4501          99 :                         Builtins::kLocalePrototypeMaximize, 0, false);
    4502             :   SimpleInstallFunction(isolate(), prototype, "minimize",
    4503          99 :                         Builtins::kLocalePrototypeMinimize, 0, false);
    4504             :   // Base locale getters.
    4505             :   SimpleInstallGetter(isolate(), prototype,
    4506             :                       factory()->InternalizeUtf8String("language"),
    4507         198 :                       Builtins::kLocalePrototypeLanguage, true);
    4508             :   SimpleInstallGetter(isolate(), prototype,
    4509             :                       factory()->InternalizeUtf8String("script"),
    4510         198 :                       Builtins::kLocalePrototypeScript, true);
    4511             :   SimpleInstallGetter(isolate(), prototype,
    4512             :                       factory()->InternalizeUtf8String("region"),
    4513         198 :                       Builtins::kLocalePrototypeRegion, true);
    4514             :   SimpleInstallGetter(isolate(), prototype,
    4515             :                       factory()->InternalizeUtf8String("baseName"),
    4516         198 :                       Builtins::kLocalePrototypeBaseName, true);
    4517             :   // Unicode extension getters.
    4518             :   SimpleInstallGetter(isolate(), prototype,
    4519             :                       factory()->InternalizeUtf8String("calendar"),
    4520         198 :                       Builtins::kLocalePrototypeCalendar, true);
    4521             :   SimpleInstallGetter(isolate(), prototype,
    4522             :                       factory()->InternalizeUtf8String("caseFirst"),
    4523         198 :                       Builtins::kLocalePrototypeCaseFirst, true);
    4524             :   SimpleInstallGetter(isolate(), prototype,
    4525             :                       factory()->InternalizeUtf8String("collation"),
    4526         198 :                       Builtins::kLocalePrototypeCollation, true);
    4527             :   SimpleInstallGetter(isolate(), prototype,
    4528             :                       factory()->InternalizeUtf8String("hourCycle"),
    4529         198 :                       Builtins::kLocalePrototypeHourCycle, true);
    4530             :   SimpleInstallGetter(isolate(), prototype,
    4531             :                       factory()->InternalizeUtf8String("numeric"),
    4532         198 :                       Builtins::kLocalePrototypeNumeric, true);
    4533             :   SimpleInstallGetter(isolate(), prototype,
    4534             :                       factory()->InternalizeUtf8String("numberingSystem"),
    4535         198 :                       Builtins::kLocalePrototypeNumberingSystem, true);
    4536             : }
    4537             : 
    4538     1007535 : void Genesis::InitializeGlobal_harmony_intl_relative_time_format() {
    4539       91594 :   if (!FLAG_harmony_intl_relative_time_format) return;
    4540             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4541             :       JSReceiver::GetProperty(
    4542             :           isolate(),
    4543      183188 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4544      366376 :           factory()->InternalizeUtf8String("Intl"))
    4545      183189 :           .ToHandleChecked());
    4546             : 
    4547             :   Handle<JSFunction> relative_time_format_fun = InstallFunction(
    4548             :       isolate(), intl, "RelativeTimeFormat", JS_INTL_RELATIVE_TIME_FORMAT_TYPE,
    4549             :       JSRelativeTimeFormat::kSize, 0, factory()->the_hole_value(),
    4550       91594 :       Builtins::kRelativeTimeFormatConstructor);
    4551      183188 :   relative_time_format_fun->shared()->set_length(0);
    4552      183188 :   relative_time_format_fun->shared()->DontAdaptArguments();
    4553             : 
    4554             :   SimpleInstallFunction(
    4555             :       isolate(), relative_time_format_fun, "supportedLocalesOf",
    4556       91594 :       Builtins::kRelativeTimeFormatSupportedLocalesOf, 1, false);
    4557             : 
    4558             :   // Setup %RelativeTimeFormatPrototype%.
    4559             :   Handle<JSObject> prototype(
    4560             :       JSObject::cast(relative_time_format_fun->instance_prototype()),
    4561      183188 :       isolate());
    4562             : 
    4563       91594 :   InstallToStringTag(isolate(), prototype, "Intl.RelativeTimeFormat");
    4564             : 
    4565             :   SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    4566             :                         Builtins::kRelativeTimeFormatPrototypeResolvedOptions,
    4567       91594 :                         0, false);
    4568             :   SimpleInstallFunction(isolate(), prototype, "format",
    4569       91594 :                         Builtins::kRelativeTimeFormatPrototypeFormat, 2, false);
    4570             :   SimpleInstallFunction(isolate(), prototype, "formatToParts",
    4571             :                         Builtins::kRelativeTimeFormatPrototypeFormatToParts, 2,
    4572       91595 :                         false);
    4573             : }
    4574             : 
    4575      107147 : void Genesis::InitializeGlobal_harmony_intl_segmenter() {
    4576      182542 :   if (!FLAG_harmony_intl_segmenter) return;
    4577             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4578             :       JSReceiver::GetProperty(
    4579             :           isolate(),
    4580        1296 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4581        2592 :           factory()->InternalizeUtf8String("Intl"))
    4582        1296 :           .ToHandleChecked());
    4583             : 
    4584             :   Handle<JSFunction> segmenter_fun = InstallFunction(
    4585             :       isolate(), intl, "Segmenter", JS_INTL_SEGMENTER_TYPE, JSSegmenter::kSize,
    4586         648 :       0, factory()->the_hole_value(), Builtins::kSegmenterConstructor);
    4587        1296 :   segmenter_fun->shared()->set_length(0);
    4588        1296 :   segmenter_fun->shared()->DontAdaptArguments();
    4589             : 
    4590             :   SimpleInstallFunction(isolate(), segmenter_fun, "supportedLocalesOf",
    4591         648 :                         Builtins::kSegmenterSupportedLocalesOf, 1, false);
    4592             : 
    4593             :   {
    4594             :     // Setup %SegmenterPrototype%.
    4595             :     Handle<JSObject> prototype(
    4596        1296 :         JSObject::cast(segmenter_fun->instance_prototype()), isolate());
    4597             : 
    4598         648 :     InstallToStringTag(isolate(), prototype, "Intl.Segmenter");
    4599             : 
    4600             :     SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    4601             :                           Builtins::kSegmenterPrototypeResolvedOptions, 0,
    4602         648 :                           false);
    4603             : 
    4604             :     SimpleInstallFunction(isolate(), prototype, "segment",
    4605         648 :                           Builtins::kSegmenterPrototypeSegment, 1, false);
    4606             :   }
    4607             : 
    4608             :   {
    4609             :     // Setup %SegmentIteratorPrototype%.
    4610             :     Handle<JSObject> iterator_prototype(
    4611        1296 :         native_context()->initial_iterator_prototype(), isolate());
    4612             : 
    4613             :     Handle<JSObject> prototype =
    4614        1296 :         factory()->NewJSObject(isolate()->object_function(), TENURED);
    4615         648 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4616             : 
    4617             :     InstallToStringTag(isolate(), prototype,
    4618         648 :                        factory()->SegmentIterator_string());
    4619             : 
    4620             :     SimpleInstallFunction(isolate(), prototype, "next",
    4621         648 :                           Builtins::kSegmentIteratorPrototypeNext, 0, false);
    4622             : 
    4623             :     SimpleInstallFunction(isolate(), prototype, "following",
    4624             :                           Builtins::kSegmentIteratorPrototypeFollowing, 0,
    4625         648 :                           false);
    4626             : 
    4627             :     SimpleInstallFunction(isolate(), prototype, "preceding",
    4628             :                           Builtins::kSegmentIteratorPrototypePreceding, 0,
    4629         648 :                           false);
    4630             : 
    4631             :     SimpleInstallGetter(isolate(), prototype,
    4632             :                         factory()->InternalizeUtf8String("index"),
    4633        1296 :                         Builtins::kSegmentIteratorPrototypeIndex, false);
    4634             : 
    4635             :     SimpleInstallGetter(isolate(), prototype,
    4636             :                         factory()->InternalizeUtf8String("breakType"),
    4637        1296 :                         Builtins::kSegmentIteratorPrototypeBreakType, false);
    4638             : 
    4639             :     // Setup SegmentIterator constructor.
    4640             :     Handle<String> name_string =
    4641             :         Name::ToFunctionName(
    4642             :             isolate(),
    4643        1296 :             isolate()->factory()->InternalizeUtf8String("SegmentIterator"))
    4644        1296 :             .ToHandleChecked();
    4645             :     Handle<JSFunction> segment_iterator_fun = CreateFunction(
    4646             :         isolate(), name_string, JS_INTL_SEGMENT_ITERATOR_TYPE,
    4647         648 :         JSSegmentIterator::kSize, 0, prototype, Builtins::kIllegal);
    4648         648 :     segment_iterator_fun->shared()->set_native(false);
    4649             : 
    4650             :     Handle<Map> segment_iterator_map(segment_iterator_fun->initial_map(),
    4651        1296 :                                      isolate());
    4652         648 :     native_context()->set_intl_segment_iterator_map(*segment_iterator_map);
    4653             :   }
    4654             : }
    4655             : 
    4656             : #endif  // V8_INTL_SUPPORT
    4657             : 
    4658      274785 : void Genesis::InitializeGlobal_harmony_object_from_entries() {
    4659      183190 :   if (!FLAG_harmony_object_from_entries) return;
    4660             :   SimpleInstallFunction(isolate(), isolate()->object_function(), "fromEntries",
    4661      183190 :                         Builtins::kObjectFromEntries, 1, false);
    4662             : }
    4663             : 
    4664         222 : Handle<JSFunction> Genesis::CreateArrayBuffer(
    4665        1665 :     Handle<String> name, ArrayBufferKind array_buffer_kind) {
    4666             :   // Create the %ArrayBufferPrototype%
    4667             :   // Setup the {prototype} with the given {name} for @@toStringTag.
    4668             :   Handle<JSObject> prototype =
    4669         444 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    4670         222 :   InstallToStringTag(isolate(), prototype, name);
    4671             : 
    4672             :   // Allocate the constructor with the given {prototype}.
    4673             :   Handle<JSFunction> array_buffer_fun =
    4674             :       CreateFunction(isolate(), name, JS_ARRAY_BUFFER_TYPE,
    4675             :                      JSArrayBuffer::kSizeWithEmbedderFields, 0, prototype,
    4676         222 :                      Builtins::kArrayBufferConstructor);
    4677         444 :   array_buffer_fun->shared()->DontAdaptArguments();
    4678         444 :   array_buffer_fun->shared()->set_length(1);
    4679             : 
    4680             :   // Install the "constructor" property on the {prototype}.
    4681             :   JSObject::AddProperty(isolate(), prototype, factory()->constructor_string(),
    4682         222 :                         array_buffer_fun, DONT_ENUM);
    4683             : 
    4684         222 :   switch (array_buffer_kind) {
    4685             :     case ARRAY_BUFFER:
    4686             :       InstallFunctionWithBuiltinId(isolate(), array_buffer_fun, "isView",
    4687             :                                    Builtins::kArrayBufferIsView, 1, true,
    4688         111 :                                    BuiltinFunctionId::kArrayBufferIsView);
    4689             : 
    4690             :       // Install the "byteLength" getter on the {prototype}.
    4691             :       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
    4692             :                           Builtins::kArrayBufferPrototypeGetByteLength, false,
    4693         111 :                           BuiltinFunctionId::kArrayBufferByteLength);
    4694             : 
    4695             :       SimpleInstallFunction(isolate(), prototype, "slice",
    4696         111 :                             Builtins::kArrayBufferPrototypeSlice, 2, true);
    4697         111 :       break;
    4698             : 
    4699             :     case SHARED_ARRAY_BUFFER:
    4700             :       // Install the "byteLength" getter on the {prototype}.
    4701             :       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
    4702             :                           Builtins::kSharedArrayBufferPrototypeGetByteLength,
    4703             :                           false,
    4704         111 :                           BuiltinFunctionId::kSharedArrayBufferByteLength);
    4705             : 
    4706             :       SimpleInstallFunction(isolate(), prototype, "slice",
    4707             :                             Builtins::kSharedArrayBufferPrototypeSlice, 2,
    4708         111 :                             true);
    4709         111 :       break;
    4710             :   }
    4711             : 
    4712         222 :   return array_buffer_fun;
    4713             : }
    4714             : 
    4715         666 : void Genesis::InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
    4716        1998 :                                                  const char* function_name) {
    4717        1332 :   Handle<JSObject> array_prototype(native_context()->initial_array_prototype(),
    4718         666 :                                    isolate());
    4719             :   Handle<Object> func =
    4720         666 :       JSReceiver::GetProperty(isolate(), array_prototype, function_name)
    4721        1332 :           .ToHandleChecked();
    4722             :   JSObject::AddProperty(isolate(), prototype, function_name, func,
    4723         666 :                         ALL_ATTRIBUTES_MASK);
    4724         666 : }
    4725             : 
    4726         111 : void Genesis::InstallInternalPackedArray(Handle<JSObject> target,
    4727         999 :                                          const char* name) {
    4728             :   // --- I n t e r n a l   A r r a y ---
    4729             :   // An array constructor on the builtins object that works like
    4730             :   // the public Array constructor, except that its prototype
    4731             :   // doesn't inherit from Object.prototype.
    4732             :   // To be used only for internal work by builtins. Instances
    4733             :   // must not be leaked to user code.
    4734             :   Handle<JSObject> prototype =
    4735         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    4736             :   Handle<JSFunction> array_function =
    4737             :       InstallFunction(isolate(), target, name, JS_ARRAY_TYPE, JSArray::kSize, 0,
    4738         111 :                       prototype, Builtins::kInternalArrayConstructor);
    4739             : 
    4740         222 :   array_function->shared()->DontAdaptArguments();
    4741             : 
    4742         222 :   Handle<Map> original_map(array_function->initial_map(), isolate());
    4743         111 :   Handle<Map> initial_map = Map::Copy(isolate(), original_map, "InternalArray");
    4744         111 :   initial_map->set_elements_kind(PACKED_ELEMENTS);
    4745         111 :   JSFunction::SetInitialMap(array_function, initial_map, prototype);
    4746             : 
    4747             :   // Make "length" magic on instances.
    4748         111 :   Map::EnsureDescriptorSlack(isolate(), initial_map, 1);
    4749             : 
    4750             :   PropertyAttributes attribs = static_cast<PropertyAttributes>(
    4751             :       DONT_ENUM | DONT_DELETE);
    4752             : 
    4753             :   {  // Add length.
    4754             :     Descriptor d = Descriptor::AccessorConstant(
    4755             :         factory()->length_string(), factory()->array_length_accessor(),
    4756         111 :         attribs);
    4757         111 :     initial_map->AppendDescriptor(isolate(), &d);
    4758             :   }
    4759             : 
    4760             :   JSObject::NormalizeProperties(
    4761             :       prototype, KEEP_INOBJECT_PROPERTIES, 6,
    4762         111 :       "OptimizeInternalPackedArrayPrototypeForAdding");
    4763         111 :   InstallInternalPackedArrayFunction(prototype, "push");
    4764         111 :   InstallInternalPackedArrayFunction(prototype, "pop");
    4765         111 :   InstallInternalPackedArrayFunction(prototype, "shift");
    4766         111 :   InstallInternalPackedArrayFunction(prototype, "unshift");
    4767         111 :   InstallInternalPackedArrayFunction(prototype, "splice");
    4768         111 :   InstallInternalPackedArrayFunction(prototype, "slice");
    4769             : 
    4770         111 :   JSObject::ForceSetPrototype(prototype, factory()->null_value());
    4771         111 :   JSObject::MigrateSlowToFast(prototype, 0, "Bootstrapping");
    4772         111 : }
    4773             : 
    4774       10323 : bool Genesis::InstallNatives() {
    4775             :   HandleScope scope(isolate());
    4776             : 
    4777             :   // Set up the extras utils object as a shared container between native
    4778             :   // scripts and extras. (Extras consume things added there by native scripts.)
    4779             :   Handle<JSObject> extras_utils =
    4780         222 :       factory()->NewJSObject(isolate()->object_function());
    4781         222 :   native_context()->set_extras_utils_object(*extras_utils);
    4782             : 
    4783         111 :   InstallInternalPackedArray(extras_utils, "InternalPackedArray");
    4784             : 
    4785             :   // Extras need the ability to store private state on their objects without
    4786             :   // exposing it to the outside world.
    4787             :   SimpleInstallFunction(isolate_, extras_utils, "createPrivateSymbol",
    4788         111 :                         Builtins::kExtrasUtilsCreatePrivateSymbol, 1, false);
    4789             : 
    4790             :   SimpleInstallFunction(isolate_, extras_utils, "uncurryThis",
    4791         111 :                         Builtins::kExtrasUtilsUncurryThis, 1, false);
    4792             : 
    4793             :   SimpleInstallFunction(isolate_, extras_utils, "markPromiseAsHandled",
    4794         111 :                         Builtins::kExtrasUtilsMarkPromiseAsHandled, 1, false);
    4795             : 
    4796             :   SimpleInstallFunction(isolate_, extras_utils, "promiseState",
    4797         111 :                         Builtins::kExtrasUtilsPromiseState, 1, false);
    4798             : 
    4799             :   // [[PromiseState]] values (for extrasUtils.promiseState())
    4800             :   // These values should be kept in sync with PromiseStatus in globals.h
    4801             :   JSObject::AddProperty(
    4802             :       isolate(), extras_utils, "kPROMISE_PENDING",
    4803             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kPending)),
    4804         222 :       DONT_ENUM);
    4805             :   JSObject::AddProperty(
    4806             :       isolate(), extras_utils, "kPROMISE_FULFILLED",
    4807             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kFulfilled)),
    4808         222 :       DONT_ENUM);
    4809             :   JSObject::AddProperty(
    4810             :       isolate(), extras_utils, "kPROMISE_REJECTED",
    4811             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kRejected)),
    4812         222 :       DONT_ENUM);
    4813             : 
    4814             :   // v8.createPromise(parent)
    4815             :   Handle<JSFunction> promise_internal_constructor =
    4816             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4817         111 :                            Builtins::kPromiseInternalConstructor, 1, true);
    4818         111 :   promise_internal_constructor->shared()->set_native(false);
    4819             :   JSObject::AddProperty(isolate(), extras_utils, "createPromise",
    4820         111 :                         promise_internal_constructor, DONT_ENUM);
    4821             : 
    4822             :   // v8.rejectPromise(promise, reason)
    4823             :   Handle<JSFunction> promise_internal_reject =
    4824             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4825         111 :                            Builtins::kPromiseInternalReject, 2, true);
    4826         111 :   promise_internal_reject->shared()->set_native(false);
    4827             :   JSObject::AddProperty(isolate(), extras_utils, "rejectPromise",
    4828         111 :                         promise_internal_reject, DONT_ENUM);
    4829             : 
    4830             :   // v8.resolvePromise(promise, resolution)
    4831             :   Handle<JSFunction> promise_internal_resolve =
    4832             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4833         111 :                            Builtins::kPromiseInternalResolve, 2, true);
    4834         111 :   promise_internal_resolve->shared()->set_native(false);
    4835             :   JSObject::AddProperty(isolate(), extras_utils, "resolvePromise",
    4836         111 :                         promise_internal_resolve, DONT_ENUM);
    4837             : 
    4838             :   JSObject::AddProperty(isolate(), extras_utils, "isPromise",
    4839         222 :                         isolate()->is_promise(), DONT_ENUM);
    4840             : 
    4841             :   JSObject::MigrateSlowToFast(Handle<JSObject>::cast(extras_utils), 0,
    4842         111 :                               "Bootstrapping");
    4843             : 
    4844             :   {
    4845             :     // Builtin function for OpaqueReference -- a JSValue-based object,
    4846             :     // that keeps its field isolated from JavaScript code. It may store
    4847             :     // objects, that JavaScript code may not access.
    4848             :     Handle<JSObject> prototype =
    4849         222 :         factory()->NewJSObject(isolate()->object_function(), TENURED);
    4850             :     Handle<JSFunction> opaque_reference_fun =
    4851             :         CreateFunction(isolate(), factory()->empty_string(), JS_VALUE_TYPE,
    4852         111 :                        JSValue::kSize, 0, prototype, Builtins::kIllegal);
    4853         111 :     native_context()->set_opaque_reference_function(*opaque_reference_fun);
    4854             :   }
    4855             : 
    4856             :   auto fast_template_instantiations_cache = isolate()->factory()->NewFixedArray(
    4857         111 :       TemplateInfo::kFastTemplateInstantiationsCacheSize);
    4858         222 :   native_context()->set_fast_template_instantiations_cache(
    4859         111 :       *fast_template_instantiations_cache);
    4860             : 
    4861             :   auto slow_template_instantiations_cache = SimpleNumberDictionary::New(
    4862         111 :       isolate(), ApiNatives::kInitialFunctionCacheSize);
    4863         222 :   native_context()->set_slow_template_instantiations_cache(
    4864         111 :       *slow_template_instantiations_cache);
    4865             : 
    4866             :   // Store the map for the %ObjectPrototype% after the natives has been compiled
    4867             :   // and the Object function has been set up.
    4868             :   {
    4869         222 :     Handle<JSFunction> object_function(native_context()->object_function(),
    4870         111 :                                        isolate());
    4871             :     DCHECK(JSObject::cast(object_function->initial_map()->prototype())
    4872             :                ->HasFastProperties());
    4873         222 :     native_context()->set_object_function_prototype_map(
    4874         333 :         HeapObject::cast(object_function->initial_map()->prototype())->map());
    4875             :   }
    4876             : 
    4877             :   // Store the map for the %StringPrototype% after the natives has been compiled
    4878             :   // and the String function has been set up.
    4879         222 :   Handle<JSFunction> string_function(native_context()->string_function(),
    4880         111 :                                      isolate());
    4881             :   JSObject string_function_prototype =
    4882         222 :       JSObject::cast(string_function->initial_map()->prototype());
    4883             :   DCHECK(string_function_prototype->HasFastProperties());
    4884         222 :   native_context()->set_string_function_prototype_map(
    4885         111 :       string_function_prototype->map());
    4886             : 
    4887             :   Handle<JSGlobalObject> global_object =
    4888         222 :       handle(native_context()->global_object(), isolate());
    4889             : 
    4890             :   // Install Global.decodeURI.
    4891             :   InstallFunctionWithBuiltinId(isolate(), global_object, "decodeURI",
    4892             :                                Builtins::kGlobalDecodeURI, 1, false,
    4893         111 :                                BuiltinFunctionId::kGlobalDecodeURI);
    4894             : 
    4895             :   // Install Global.decodeURIComponent.
    4896             :   InstallFunctionWithBuiltinId(isolate(), global_object, "decodeURIComponent",
    4897             :                                Builtins::kGlobalDecodeURIComponent, 1, false,
    4898         111 :                                BuiltinFunctionId::kGlobalDecodeURIComponent);
    4899             : 
    4900             :   // Install Global.encodeURI.
    4901             :   InstallFunctionWithBuiltinId(isolate(), global_object, "encodeURI",
    4902             :                                Builtins::kGlobalEncodeURI, 1, false,
    4903         111 :                                BuiltinFunctionId::kGlobalEncodeURI);
    4904             : 
    4905             :   // Install Global.encodeURIComponent.
    4906             :   InstallFunctionWithBuiltinId(isolate(), global_object, "encodeURIComponent",
    4907             :                                Builtins::kGlobalEncodeURIComponent, 1, false,
    4908         111 :                                BuiltinFunctionId::kGlobalEncodeURIComponent);
    4909             : 
    4910             :   // Install Global.escape.
    4911             :   InstallFunctionWithBuiltinId(isolate(), global_object, "escape",
    4912             :                                Builtins::kGlobalEscape, 1, false,
    4913         111 :                                BuiltinFunctionId::kGlobalEscape);
    4914             : 
    4915             :   // Install Global.unescape.
    4916             :   InstallFunctionWithBuiltinId(isolate(), global_object, "unescape",
    4917             :                                Builtins::kGlobalUnescape, 1, false,
    4918         111 :                                BuiltinFunctionId::kGlobalUnescape);
    4919             : 
    4920             :   // Install Global.eval.
    4921             :   {
    4922             :     Handle<JSFunction> eval = SimpleInstallFunction(
    4923         111 :         isolate(), global_object, "eval", Builtins::kGlobalEval, 1, false);
    4924         111 :     native_context()->set_global_eval_fun(*eval);
    4925             :   }
    4926             : 
    4927             :   // Install Global.isFinite
    4928             :   InstallFunctionWithBuiltinId(isolate(), global_object, "isFinite",
    4929             :                                Builtins::kGlobalIsFinite, 1, true,
    4930         111 :                                BuiltinFunctionId::kGlobalIsFinite);
    4931             : 
    4932             :   // Install Global.isNaN
    4933             :   InstallFunctionWithBuiltinId(isolate(), global_object, "isNaN",
    4934             :                                Builtins::kGlobalIsNaN, 1, true,
    4935         111 :                                BuiltinFunctionId::kGlobalIsNaN);
    4936             : 
    4937             :   // Install Array builtin functions.
    4938             :   {
    4939         222 :     Handle<JSFunction> array_constructor(native_context()->array_function(),
    4940         111 :                                          isolate());
    4941             :     Handle<JSArray> proto(JSArray::cast(array_constructor->prototype()),
    4942         222 :                           isolate());
    4943             : 
    4944             :     // Verification of important array prototype properties.
    4945         111 :     Object length = proto->length();
    4946         111 :     CHECK(length->IsSmi());
    4947         111 :     CHECK_EQ(Smi::ToInt(length), 0);
    4948         222 :     CHECK(proto->HasSmiOrObjectElements());
    4949             :     // This is necessary to enable fast checks for absence of elements
    4950             :     // on Array.prototype and below.
    4951         333 :     proto->set_elements(ReadOnlyRoots(heap()).empty_fixed_array());
    4952             :   }
    4953             : 
    4954         111 :   InstallBuiltinFunctionIds();
    4955             : 
    4956             :   // Create a map for accessor property descriptors (a variant of JSObject
    4957             :   // that predefines four properties get, set, configurable and enumerable).
    4958             :   {
    4959             :     // AccessorPropertyDescriptor initial map.
    4960             :     Handle<Map> map =
    4961             :         factory()->NewMap(JS_OBJECT_TYPE, JSAccessorPropertyDescriptor::kSize,
    4962         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4963             :     // Create the descriptor array for the property descriptor object.
    4964         111 :     Map::EnsureDescriptorSlack(isolate(), map, 4);
    4965             : 
    4966             :     {  // get
    4967             :       Descriptor d =
    4968             :           Descriptor::DataField(isolate(), factory()->get_string(),
    4969             :                                 JSAccessorPropertyDescriptor::kGetIndex, NONE,
    4970         111 :                                 Representation::Tagged());
    4971         111 :       map->AppendDescriptor(isolate(), &d);
    4972             :     }
    4973             :     {  // set
    4974             :       Descriptor d =
    4975             :           Descriptor::DataField(isolate(), factory()->set_string(),
    4976             :                                 JSAccessorPropertyDescriptor::kSetIndex, NONE,
    4977         111 :                                 Representation::Tagged());
    4978         111 :       map->AppendDescriptor(isolate(), &d);
    4979             :     }
    4980             :     {  // enumerable
    4981             :       Descriptor d =
    4982             :           Descriptor::DataField(isolate(), factory()->enumerable_string(),
    4983             :                                 JSAccessorPropertyDescriptor::kEnumerableIndex,
    4984         111 :                                 NONE, Representation::Tagged());
    4985         111 :       map->AppendDescriptor(isolate(), &d);
    4986             :     }
    4987             :     {  // configurable
    4988             :       Descriptor d = Descriptor::DataField(
    4989             :           isolate(), factory()->configurable_string(),
    4990             :           JSAccessorPropertyDescriptor::kConfigurableIndex, NONE,
    4991         111 :           Representation::Tagged());
    4992         111 :       map->AppendDescriptor(isolate(), &d);
    4993             :     }
    4994             : 
    4995         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    4996         222 :     map->SetConstructor(native_context()->object_function());
    4997             : 
    4998         111 :     native_context()->set_accessor_property_descriptor_map(*map);
    4999             :   }
    5000             : 
    5001             :   // Create a map for data property descriptors (a variant of JSObject
    5002             :   // that predefines four properties value, writable, configurable and
    5003             :   // enumerable).
    5004             :   {
    5005             :     // DataPropertyDescriptor initial map.
    5006             :     Handle<Map> map =
    5007             :         factory()->NewMap(JS_OBJECT_TYPE, JSDataPropertyDescriptor::kSize,
    5008         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    5009             :     // Create the descriptor array for the property descriptor object.
    5010         111 :     Map::EnsureDescriptorSlack(isolate(), map, 4);
    5011             : 
    5012             :     {  // value
    5013             :       Descriptor d =
    5014             :           Descriptor::DataField(isolate(), factory()->value_string(),
    5015             :                                 JSDataPropertyDescriptor::kValueIndex, NONE,
    5016         111 :                                 Representation::Tagged());
    5017         111 :       map->AppendDescriptor(isolate(), &d);
    5018             :     }
    5019             :     {  // writable
    5020             :       Descriptor d =
    5021             :           Descriptor::DataField(isolate(), factory()->writable_string(),
    5022             :                                 JSDataPropertyDescriptor::kWritableIndex, NONE,
    5023         111 :                                 Representation::Tagged());
    5024         111 :       map->AppendDescriptor(isolate(), &d);
    5025             :     }
    5026             :     {  // enumerable
    5027             :       Descriptor d =
    5028             :           Descriptor::DataField(isolate(), factory()->enumerable_string(),
    5029             :                                 JSDataPropertyDescriptor::kEnumerableIndex,
    5030         111 :                                 NONE, Representation::Tagged());
    5031         111 :       map->AppendDescriptor(isolate(), &d);
    5032             :     }
    5033             :     {  // configurable
    5034             :       Descriptor d =
    5035             :           Descriptor::DataField(isolate(), factory()->configurable_string(),
    5036             :                                 JSDataPropertyDescriptor::kConfigurableIndex,
    5037         111 :                                 NONE, Representation::Tagged());
    5038         111 :       map->AppendDescriptor(isolate(), &d);
    5039             :     }
    5040             : 
    5041         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    5042         222 :     map->SetConstructor(native_context()->object_function());
    5043             : 
    5044         111 :     native_context()->set_data_property_descriptor_map(*map);
    5045             :   }
    5046             : 
    5047             :   // Create a constructor for RegExp results (a variant of Array that
    5048             :   // predefines the properties index, input, and groups).
    5049             :   {
    5050             :     // JSRegExpResult initial map.
    5051             : 
    5052             :     // Find global.Array.prototype to inherit from.
    5053         222 :     Handle<JSFunction> array_constructor(native_context()->array_function(),
    5054         111 :                                          isolate());
    5055             :     Handle<JSObject> array_prototype(
    5056         222 :         JSObject::cast(array_constructor->instance_prototype()), isolate());
    5057             : 
    5058             :     // Add initial map.
    5059             :     Handle<Map> initial_map = factory()->NewMap(
    5060             :         JS_ARRAY_TYPE, JSRegExpResult::kSize, TERMINAL_FAST_ELEMENTS_KIND,
    5061         111 :         JSRegExpResult::kInObjectPropertyCount);
    5062         222 :     initial_map->SetConstructor(*array_constructor);
    5063             : 
    5064             :     // Set prototype on map.
    5065             :     initial_map->set_has_non_instance_prototype(false);
    5066         111 :     Map::SetPrototype(isolate(), initial_map, array_prototype);
    5067             : 
    5068             :     // Update map with length accessor from Array and add "index", "input" and
    5069             :     // "groups".
    5070             :     Map::EnsureDescriptorSlack(isolate(), initial_map,
    5071         111 :                                JSRegExpResult::kInObjectPropertyCount + 1);
    5072             : 
    5073             :     // length descriptor.
    5074             :     {
    5075         111 :       JSFunction array_function = native_context()->array_function();
    5076             :       Handle<DescriptorArray> array_descriptors(
    5077         222 :           array_function->initial_map()->instance_descriptors(), isolate());
    5078             :       Handle<String> length = factory()->length_string();
    5079             :       int old = array_descriptors->SearchWithCache(
    5080         333 :           isolate(), *length, array_function->initial_map());
    5081             :       DCHECK_NE(old, DescriptorArray::kNotFound);
    5082             :       Descriptor d = Descriptor::AccessorConstant(
    5083             :           length, handle(array_descriptors->GetStrongValue(old), isolate()),
    5084         333 :           array_descriptors->GetDetails(old).attributes());
    5085         111 :       initial_map->AppendDescriptor(isolate(), &d);
    5086             :     }
    5087             : 
    5088             :     // index descriptor.
    5089             :     {
    5090             :       Descriptor d = Descriptor::DataField(isolate(), factory()->index_string(),
    5091             :                                            JSRegExpResult::kIndexIndex, NONE,
    5092         111 :                                            Representation::Tagged());
    5093         111 :       initial_map->AppendDescriptor(isolate(), &d);
    5094             :     }
    5095             : 
    5096             :     // input descriptor.
    5097             :     {
    5098             :       Descriptor d = Descriptor::DataField(isolate(), factory()->input_string(),
    5099             :                                            JSRegExpResult::kInputIndex, NONE,
    5100         111 :                                            Representation::Tagged());
    5101         111 :       initial_map->AppendDescriptor(isolate(), &d);
    5102             :     }
    5103             : 
    5104             :     // groups descriptor.
    5105             :     {
    5106             :       Descriptor d = Descriptor::DataField(
    5107             :           isolate(), factory()->groups_string(), JSRegExpResult::kGroupsIndex,
    5108         111 :           NONE, Representation::Tagged());
    5109         111 :       initial_map->AppendDescriptor(isolate(), &d);
    5110             :     }
    5111             : 
    5112         111 :     native_context()->set_regexp_result_map(*initial_map);
    5113             :   }
    5114             : 
    5115             :   // Add @@iterator method to the arguments object maps.
    5116             :   {
    5117             :     PropertyAttributes attribs = DONT_ENUM;
    5118             :     Handle<AccessorInfo> arguments_iterator =
    5119             :         factory()->arguments_iterator_accessor();
    5120             :     {
    5121             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5122         111 :                                                   arguments_iterator, attribs);
    5123         222 :       Handle<Map> map(native_context()->sloppy_arguments_map(), isolate());
    5124         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5125         111 :       map->AppendDescriptor(isolate(), &d);
    5126             :     }
    5127             :     {
    5128             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5129         111 :                                                   arguments_iterator, attribs);
    5130         222 :       Handle<Map> map(native_context()->fast_aliased_arguments_map(),
    5131         111 :                       isolate());
    5132         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5133         111 :       map->AppendDescriptor(isolate(), &d);
    5134             :     }
    5135             :     {
    5136             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5137         111 :                                                   arguments_iterator, attribs);
    5138         222 :       Handle<Map> map(native_context()->slow_aliased_arguments_map(),
    5139         111 :                       isolate());
    5140         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5141         111 :       map->AppendDescriptor(isolate(), &d);
    5142             :     }
    5143             :     {
    5144             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5145         111 :                                                   arguments_iterator, attribs);
    5146         222 :       Handle<Map> map(native_context()->strict_arguments_map(), isolate());
    5147         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5148         111 :       map->AppendDescriptor(isolate(), &d);
    5149             :     }
    5150             :   }
    5151             : 
    5152         111 :   return true;
    5153             : }
    5154             : 
    5155         666 : bool Genesis::InstallExtraNatives() {
    5156             :   HandleScope scope(isolate());
    5157             : 
    5158             :   Handle<JSObject> extras_binding =
    5159         222 :       factory()->NewJSObject(isolate()->object_function());
    5160             : 
    5161             :   // binding.isTraceCategoryEnabled(category)
    5162             :   SimpleInstallFunction(isolate(), extras_binding, "isTraceCategoryEnabled",
    5163         111 :                         Builtins::kIsTraceCategoryEnabled, 1, true);
    5164             : 
    5165             :   // binding.trace(phase, category, name, id, data)
    5166             :   SimpleInstallFunction(isolate(), extras_binding, "trace", Builtins::kTrace, 5,
    5167         111 :                         true);
    5168             : 
    5169         111 :   native_context()->set_extras_binding_object(*extras_binding);
    5170             : 
    5171         222 :   for (int i = 0; i < ExtraNatives::GetBuiltinsCount(); i++) {
    5172         111 :     if (!Bootstrapper::CompileExtraBuiltin(isolate(), i)) return false;
    5173             :   }
    5174             : 
    5175             :   return true;
    5176             : }
    5177             : 
    5178             : 
    5179       14319 : static void InstallBuiltinFunctionId(Isolate* isolate, Handle<JSObject> holder,
    5180             :                                      const char* function_name,
    5181             :                                      BuiltinFunctionId id) {
    5182             :   Handle<Object> function_object =
    5183       28638 :       JSReceiver::GetProperty(isolate, holder, function_name).ToHandleChecked();
    5184       14319 :   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
    5185       28638 :   function->shared()->set_builtin_function_id(id);
    5186       14319 : }
    5187             : 
    5188             : #define INSTALL_BUILTIN_ID(holder_expr, fun_name, name) \
    5189             :   {#holder_expr, #fun_name, BuiltinFunctionId::k##name},
    5190             : 
    5191       28749 : void Genesis::InstallBuiltinFunctionIds() {
    5192             :   HandleScope scope(isolate());
    5193             :   struct BuiltinFunctionIds {
    5194             :     const char* holder_expr;
    5195             :     const char* fun_name;
    5196             :     BuiltinFunctionId id;
    5197             :   };
    5198             : 
    5199             :   const BuiltinFunctionIds builtins[] = {
    5200         111 :       FUNCTIONS_WITH_ID_LIST(INSTALL_BUILTIN_ID)};
    5201             : 
    5202       14430 :   for (const BuiltinFunctionIds& builtin : builtins) {
    5203             :     Handle<JSObject> holder = ResolveBuiltinIdHolder(
    5204       28638 :         isolate(), native_context(), builtin.holder_expr);
    5205       28638 :     InstallBuiltinFunctionId(isolate(), holder, builtin.fun_name, builtin.id);
    5206             :   }
    5207         111 : }
    5208             : 
    5209             : #undef INSTALL_BUILTIN_ID
    5210             : 
    5211             : 
    5212         111 : void Genesis::InitializeNormalizedMapCaches() {
    5213         111 :   Handle<NormalizedMapCache> cache = NormalizedMapCache::New(isolate());
    5214         222 :   native_context()->set_normalized_map_cache(*cache);
    5215         111 : }
    5216             : 
    5217             : 
    5218       91890 : bool Bootstrapper::InstallExtensions(Handle<Context> native_context,
    5219             :                                      v8::ExtensionConfiguration* extensions) {
    5220             :   // Don't install extensions into the snapshot.
    5221       91890 :   if (isolate_->serializer_enabled()) return true;
    5222             :   BootstrapperActive active(this);
    5223      183189 :   SaveContext saved_context(isolate_);
    5224       91594 :   isolate_->set_context(*native_context);
    5225      183149 :   return Genesis::InstallExtensions(isolate_, native_context, extensions) &&
    5226       91555 :          Genesis::InstallSpecialObjects(isolate_, native_context);
    5227             : }
    5228             : 
    5229       91555 : bool Genesis::InstallSpecialObjects(Isolate* isolate,
    5230             :                                     Handle<Context> native_context) {
    5231             :   HandleScope scope(isolate);
    5232             : 
    5233       91555 :   Handle<JSObject> Error = isolate->error_function();
    5234             :   Handle<String> name = isolate->factory()->stackTraceLimit_string();
    5235       91555 :   Handle<Smi> stack_trace_limit(Smi::FromInt(FLAG_stack_trace_limit), isolate);
    5236       91555 :   JSObject::AddProperty(isolate, Error, name, stack_trace_limit, NONE);
    5237             : 
    5238       91555 :   if (FLAG_expose_wasm) {
    5239             :     // Install the internal data structures into the isolate and expose on
    5240             :     // the global object.
    5241       91528 :     WasmJs::Install(isolate, true);
    5242          27 :   } else if (FLAG_validate_asm) {
    5243             :     // Install the internal data structures only; these are needed for asm.js
    5244             :     // translated to WASM to work correctly.
    5245          27 :     WasmJs::Install(isolate, false);
    5246             :   }
    5247             : 
    5248       91555 :   return true;
    5249             : }
    5250             : 
    5251             : 
    5252             : static uint32_t Hash(RegisteredExtension* extension) {
    5253             :   return v8::internal::ComputePointerHash(extension);
    5254             : }
    5255             : 
    5256           0 : Genesis::ExtensionStates::ExtensionStates() : map_(8) {}
    5257             : 
    5258        4605 : Genesis::ExtensionTraversalState Genesis::ExtensionStates::get_state(
    5259             :     RegisteredExtension* extension) {
    5260        4605 :   base::HashMap::Entry* entry = map_.Lookup(extension, Hash(extension));
    5261        4606 :   if (entry == nullptr) {
    5262             :     return UNVISITED;
    5263             :   }
    5264             :   return static_cast<ExtensionTraversalState>(
    5265          59 :       reinterpret_cast<intptr_t>(entry->value));
    5266             : }
    5267             : 
    5268        9082 : void Genesis::ExtensionStates::set_state(RegisteredExtension* extension,
    5269             :                                          ExtensionTraversalState state) {
    5270       18166 :   map_.LookupOrInsert(extension, Hash(extension))->value =
    5271        9084 :       reinterpret_cast<void*>(static_cast<intptr_t>(state));
    5272        9084 : }
    5273             : 
    5274       91594 : bool Genesis::InstallExtensions(Isolate* isolate,
    5275             :                                 Handle<Context> native_context,
    5276             :                                 v8::ExtensionConfiguration* extensions) {
    5277             :   ExtensionStates extension_states;  // All extensions have state UNVISITED.
    5278      183189 :   return InstallAutoExtensions(isolate, &extension_states) &&
    5279       91594 :          (!FLAG_expose_free_buffer ||
    5280       91594 :           InstallExtension(isolate, "v8/free-buffer", &extension_states)) &&
    5281       94090 :          (!FLAG_expose_gc ||
    5282       94090 :           InstallExtension(isolate, "v8/gc", &extension_states)) &&
    5283       91716 :          (!FLAG_expose_externalize_string ||
    5284       91716 :           InstallExtension(isolate, "v8/externalize", &extension_states)) &&
    5285       91594 :          (!FLAG_gc_stats ||
    5286       91594 :           InstallExtension(isolate, "v8/statistics", &extension_states)) &&
    5287       91595 :          (!FLAG_expose_trigger_failure ||
    5288       91595 :           InstallExtension(isolate, "v8/trigger-failure", &extension_states)) &&
    5289       91603 :          (!FLAG_trace_ignition_dispatches ||
    5290             :           InstallExtension(isolate, "v8/ignition-statistics",
    5291      183198 :                            &extension_states)) &&
    5292      183189 :          InstallRequestedExtensions(isolate, extensions, &extension_states);
    5293             : }
    5294             : 
    5295             : 
    5296       91595 : bool Genesis::InstallAutoExtensions(Isolate* isolate,
    5297             :                                     ExtensionStates* extension_states) {
    5298      754078 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5299             :        it != nullptr; it = it->next()) {
    5300      662503 :     if (it->extension()->auto_enable() &&
    5301          20 :         !InstallExtension(isolate, it, extension_states)) {
    5302             :       return false;
    5303             :     }
    5304             :   }
    5305             :   return true;
    5306             : }
    5307             : 
    5308             : 
    5309       91595 : bool Genesis::InstallRequestedExtensions(Isolate* isolate,
    5310      185001 :                                          v8::ExtensionConfiguration* extensions,
    5311             :                                          ExtensionStates* extension_states) {
    5312      186812 :   for (const char** it = extensions->begin(); it != extensions->end(); ++it) {
    5313        1852 :     if (!InstallExtension(isolate, *it, extension_states)) return false;
    5314             :   }
    5315             :   return true;
    5316             : }
    5317             : 
    5318             : 
    5319             : // Installs a named extension.  This methods is unoptimized and does
    5320             : // not scale well if we want to support a large number of extensions.
    5321        4563 : bool Genesis::InstallExtension(Isolate* isolate,
    5322             :                                const char* name,
    5323             :                                ExtensionStates* extension_states) {
    5324       21776 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5325             :        it != nullptr; it = it->next()) {
    5326       21776 :     if (strcmp(name, it->extension()->name()) == 0) {
    5327        4563 :       return InstallExtension(isolate, it, extension_states);
    5328             :     }
    5329             :   }
    5330             :   return Utils::ApiCheck(false,
    5331             :                          "v8::Context::New()",
    5332           0 :                          "Cannot find required extension");
    5333             : }
    5334             : 
    5335             : 
    5336        4606 : bool Genesis::InstallExtension(Isolate* isolate,
    5337        4580 :                                v8::RegisteredExtension* current,
    5338             :                                ExtensionStates* extension_states) {
    5339             :   HandleScope scope(isolate);
    5340             : 
    5341        4606 :   if (extension_states->get_state(current) == INSTALLED) return true;
    5342             :   // The current node has already been visited so there must be a
    5343             :   // cycle in the dependency graph; fail.
    5344        4553 :   if (!Utils::ApiCheck(extension_states->get_state(current) != VISITED,
    5345             :                        "v8::Context::New()",
    5346        4552 :                        "Circular extension dependency")) {
    5347             :     return false;
    5348             :   }
    5349             :   DCHECK(extension_states->get_state(current) == UNVISITED);
    5350        4548 :   extension_states->set_state(current, VISITED);
    5351        4747 :   v8::Extension* extension = current->extension();
    5352             :   // Install the extension's dependencies
    5353        9282 :   for (int i = 0; i < extension->dependency_count(); i++) {
    5354         106 :     if (!InstallExtension(isolate,
    5355         106 :                           extension->dependencies()[i],
    5356         106 :                           extension_states)) {
    5357             :       return false;
    5358             :     }
    5359             :   }
    5360             :   // We do not expect this to throw an exception. Change this if it does.
    5361        4535 :   bool result = CompileExtension(isolate, extension);
    5362             :   DCHECK(isolate->has_pending_exception() != result);
    5363        4535 :   if (!result) {
    5364             :     // We print out the name of the extension that fail to install.
    5365             :     // When an error is thrown during bootstrapping we automatically print
    5366             :     // the line number at which this happened to the console in the isolate
    5367             :     // error throwing functionality.
    5368             :     base::OS::PrintError("Error installing extension '%s'.\n",
    5369          35 :                          current->extension()->name());
    5370          35 :     isolate->clear_pending_exception();
    5371             :   }
    5372        4535 :   extension_states->set_state(current, INSTALLED);
    5373        4537 :   return result;
    5374             : }
    5375             : 
    5376             : 
    5377       91851 : bool Genesis::ConfigureGlobalObjects(
    5378      530346 :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
    5379             :   Handle<JSObject> global_proxy(
    5380      183702 :       JSObject::cast(native_context()->global_proxy()), isolate());
    5381             :   Handle<JSObject> global_object(
    5382      183702 :       JSObject::cast(native_context()->global_object()), isolate());
    5383             : 
    5384       91851 :   if (!global_proxy_template.IsEmpty()) {
    5385             :     // Configure the global proxy object.
    5386             :     Handle<ObjectTemplateInfo> global_proxy_data =
    5387             :         v8::Utils::OpenHandle(*global_proxy_template);
    5388       54314 :     if (!ConfigureApiObject(global_proxy, global_proxy_data)) return false;
    5389             : 
    5390             :     // Configure the global object.
    5391             :     Handle<FunctionTemplateInfo> proxy_constructor(
    5392             :         FunctionTemplateInfo::cast(global_proxy_data->constructor()),
    5393      108628 :         isolate());
    5394      108628 :     if (!proxy_constructor->GetPrototypeTemplate()->IsUndefined(isolate())) {
    5395             :       Handle<ObjectTemplateInfo> global_object_data(
    5396             :           ObjectTemplateInfo::cast(proxy_constructor->GetPrototypeTemplate()),
    5397      108628 :           isolate());
    5398       54314 :       if (!ConfigureApiObject(global_object, global_object_data)) return false;
    5399             :     }
    5400             :   }
    5401             : 
    5402       91851 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5403             : 
    5404      183702 :   native_context()->set_array_buffer_map(
    5405      275553 :       native_context()->array_buffer_fun()->initial_map());
    5406             : 
    5407      183702 :   Handle<JSFunction> js_map_fun(native_context()->js_map_fun(), isolate());
    5408      183702 :   Handle<JSFunction> js_set_fun(native_context()->js_set_fun(), isolate());
    5409             :   // Force the Map/Set constructor to fast properties, so that we can use the
    5410             :   // fast paths for various things like
    5411             :   //
    5412             :   //   x instanceof Map
    5413             :   //   x instanceof Set
    5414             :   //
    5415             :   // etc. We should probably come up with a more principled approach once
    5416             :   // the JavaScript builtins are gone.
    5417       91851 :   JSObject::MigrateSlowToFast(js_map_fun, 0, "Bootstrapping");
    5418       91851 :   JSObject::MigrateSlowToFast(js_set_fun, 0, "Bootstrapping");
    5419             : 
    5420      183702 :   native_context()->set_js_map_map(js_map_fun->initial_map());
    5421      183702 :   native_context()->set_js_set_map(js_set_fun->initial_map());
    5422             : 
    5423       91851 :   return true;
    5424             : }
    5425             : 
    5426             : 
    5427      108628 : bool Genesis::ConfigureApiObject(Handle<JSObject> object,
    5428           0 :                                  Handle<ObjectTemplateInfo> object_template) {
    5429             :   DCHECK(!object_template.is_null());
    5430             :   DCHECK(FunctionTemplateInfo::cast(object_template->constructor())
    5431             :              ->IsTemplateFor(object->map()));;
    5432             : 
    5433             :   MaybeHandle<JSObject> maybe_obj =
    5434      108628 :       ApiNatives::InstantiateObject(object->GetIsolate(), object_template);
    5435             :   Handle<JSObject> instantiated_template;
    5436      108628 :   if (!maybe_obj.ToHandle(&instantiated_template)) {
    5437             :     DCHECK(isolate()->has_pending_exception());
    5438           0 :     isolate()->clear_pending_exception();
    5439           0 :     return false;
    5440             :   }
    5441      108628 :   TransferObject(instantiated_template, object);
    5442      108628 :   return true;
    5443             : }
    5444             : 
    5445     5870748 : static bool PropertyAlreadyExists(Isolate* isolate, Handle<JSObject> to,
    5446             :                                   Handle<Name> key) {
    5447     5870748 :   LookupIterator it(isolate, to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    5448     5870748 :   CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    5449     5870748 :   return it.IsFound();
    5450             : }
    5451             : 
    5452      200368 : void Genesis::TransferNamedProperties(Handle<JSObject> from,
    5453    34432883 :                                       Handle<JSObject> to) {
    5454             :   // If JSObject::AddProperty asserts due to already existing property,
    5455             :   // it is likely due to both global objects sharing property name(s).
    5456             :   // Merging those two global objects is impossible.
    5457             :   // The global template must not create properties that already exist
    5458             :   // in the snapshotted global object.
    5459      200368 :   if (from->HasFastProperties()) {
    5460             :     Handle<DescriptorArray> descs =
    5461      217256 :         Handle<DescriptorArray>(from->map()->instance_descriptors(), isolate());
    5462     1866690 :     for (int i = 0; i < from->map()->NumberOfOwnDescriptors(); i++) {
    5463      824717 :       PropertyDetails details = descs->GetDetails(i);
    5464      824717 :       if (details.location() == kField) {
    5465      258809 :         if (details.kind() == kData) {
    5466             :           HandleScope inner(isolate());
    5467      517618 :           Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
    5468             :           // If the property is already there we skip it.
    5469      258809 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5470      258809 :           FieldIndex index = FieldIndex::ForDescriptor(from->map(), i);
    5471             :           Handle<Object> value =
    5472      258809 :               JSObject::FastPropertyAt(from, details.representation(), index);
    5473             :           JSObject::AddProperty(isolate(), to, key, value,
    5474      258809 :                                 details.attributes());
    5475             :         } else {
    5476             :           DCHECK_EQ(kAccessor, details.kind());
    5477           0 :           UNREACHABLE();
    5478             :         }
    5479             : 
    5480             :       } else {
    5481             :         DCHECK_EQ(kDescriptor, details.location());
    5482      565908 :         if (details.kind() == kData) {
    5483             :           DCHECK(!FLAG_track_constant_fields);
    5484             :           HandleScope inner(isolate());
    5485     1131488 :           Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
    5486             :           // If the property is already there we skip it.
    5487      565744 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5488     1131478 :           Handle<Object> value(descs->GetStrongValue(i), isolate());
    5489             :           JSObject::AddProperty(isolate(), to, key, value,
    5490      565739 :                                 details.attributes());
    5491             :         } else {
    5492             :           DCHECK_EQ(kAccessor, details.kind());
    5493         328 :           Handle<Name> key(descs->GetKey(i), isolate());
    5494             :           // If the property is already there we skip it.
    5495         164 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5496             :           HandleScope inner(isolate());
    5497             :           DCHECK(!to->HasFastProperties());
    5498             :           // Add to dictionary.
    5499         328 :           Handle<Object> value(descs->GetStrongValue(i), isolate());
    5500             :           PropertyDetails d(kAccessor, details.attributes(),
    5501             :                             PropertyCellType::kMutable);
    5502         164 :           JSObject::SetNormalizedProperty(to, key, value, d);
    5503             :         }
    5504             :       }
    5505             :     }
    5506      183480 :   } else if (from->IsJSGlobalObject()) {
    5507             :     // Copy all keys and values in enumeration order.
    5508             :     Handle<GlobalDictionary> properties(
    5509      183480 :         JSGlobalObject::cast(*from)->global_dictionary(), isolate());
    5510             :     Handle<FixedArray> indices =
    5511       91740 :         GlobalDictionary::IterationIndices(isolate(), properties);
    5512    10275532 :     for (int i = 0; i < indices->length(); i++) {
    5513     5046025 :       int index = Smi::ToInt(indices->get(i));
    5514    10092051 :       Handle<PropertyCell> cell(properties->CellAt(index), isolate());
    5515    10092054 :       Handle<Name> key(cell->name(), isolate());
    5516             :       // If the property is already there we skip it.
    5517     5046029 :       if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5518             :       // Set the property.
    5519    10092061 :       Handle<Object> value(cell->value(), isolate());
    5520    10092066 :       if (value->IsTheHole(isolate())) continue;
    5521     5046034 :       PropertyDetails details = cell->property_details();
    5522     5046032 :       if (details.kind() != kData) continue;
    5523     5046032 :       JSObject::AddProperty(isolate(), to, key, value, details.attributes());
    5524             :     }
    5525             :   } else {
    5526             :     // Copy all keys and values in enumeration order.
    5527             :     Handle<NameDictionary> properties =
    5528           0 :         Handle<NameDictionary>(from->property_dictionary(), isolate());
    5529             :     Handle<FixedArray> key_indices =
    5530           0 :         NameDictionary::IterationIndices(isolate(), properties);
    5531             :     ReadOnlyRoots roots(isolate());
    5532           0 :     for (int i = 0; i < key_indices->length(); i++) {
    5533           0 :       int key_index = Smi::ToInt(key_indices->get(i));
    5534           0 :       Object raw_key = properties->KeyAt(key_index);
    5535             :       DCHECK(properties->IsKey(roots, raw_key));
    5536             :       DCHECK(raw_key->IsName());
    5537             :       Handle<Name> key(Name::cast(raw_key), isolate());
    5538             :       // If the property is already there we skip it.
    5539           0 :       if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5540             :       // Set the property.
    5541             :       Handle<Object> value =
    5542           0 :           Handle<Object>(properties->ValueAt(key_index), isolate());
    5543             :       DCHECK(!value->IsCell());
    5544             :       DCHECK(!value->IsTheHole(isolate()));
    5545           0 :       PropertyDetails details = properties->DetailsAt(key_index);
    5546             :       DCHECK_EQ(kData, details.kind());
    5547           0 :       JSObject::AddProperty(isolate(), to, key, value, details.attributes());
    5548             :     }
    5549             :   }
    5550      200368 : }
    5551             : 
    5552             : 
    5553      200368 : void Genesis::TransferIndexedProperties(Handle<JSObject> from,
    5554      400736 :                                         Handle<JSObject> to) {
    5555             :   // Cloning the elements array is sufficient.
    5556             :   Handle<FixedArray> from_elements =
    5557      400736 :       Handle<FixedArray>(FixedArray::cast(from->elements()), isolate());
    5558      200368 :   Handle<FixedArray> to_elements = factory()->CopyFixedArray(from_elements);
    5559      400736 :   to->set_elements(*to_elements);
    5560      200368 : }
    5561             : 
    5562             : 
    5563      217256 : void Genesis::TransferObject(Handle<JSObject> from, Handle<JSObject> to) {
    5564             :   HandleScope outer(isolate());
    5565             : 
    5566             :   DCHECK(!from->IsJSArray());
    5567             :   DCHECK(!to->IsJSArray());
    5568             : 
    5569      108628 :   TransferNamedProperties(from, to);
    5570      108628 :   TransferIndexedProperties(from, to);
    5571             : 
    5572             :   // Transfer the prototype (new map is needed).
    5573             :   Handle<Object> proto(from->map()->prototype(), isolate());
    5574      108628 :   JSObject::ForceSetPrototype(to, proto);
    5575      108628 : }
    5576             : 
    5577       91891 : Genesis::Genesis(
    5578      459455 :     Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5579             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    5580             :     size_t context_snapshot_index,
    5581             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer)
    5582       91891 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5583       91891 :   RuntimeCallTimerScope rcs_timer(isolate, RuntimeCallCounterId::kGenesis);
    5584       91891 :   result_ = Handle<Context>::null();
    5585       91891 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5586             : 
    5587             :   // Before creating the roots we must save the context and restore it
    5588             :   // on all function exits.
    5589      183782 :   SaveContext saved_context(isolate);
    5590             : 
    5591             :   // The deserializer needs to hook up references to the global proxy.
    5592             :   // Create an uninitialized global proxy now if we don't have one
    5593             :   // and initialize it later in CreateNewGlobals.
    5594             :   Handle<JSGlobalProxy> global_proxy;
    5595       91891 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5596             :     int instance_size = 0;
    5597       91822 :     if (context_snapshot_index > 0) {
    5598             :       // The global proxy function to reinitialize this global proxy is in the
    5599             :       // context that is yet to be deserialized. We need to prepare a global
    5600             :       // proxy of the correct size.
    5601          35 :       Object size = isolate->heap()->serialized_global_proxy_sizes()->get(
    5602         105 :           static_cast<int>(context_snapshot_index) - 1);
    5603          35 :       instance_size = Smi::ToInt(size);
    5604             :     } else {
    5605             :       instance_size = JSGlobalProxy::SizeWithEmbedderFields(
    5606             :           global_proxy_template.IsEmpty()
    5607             :               ? 0
    5608       91787 :               : global_proxy_template->InternalFieldCount());
    5609             :     }
    5610             :     global_proxy =
    5611       91822 :         isolate->factory()->NewUninitializedJSGlobalProxy(instance_size);
    5612             :   }
    5613             : 
    5614             :   // We can only de-serialize a context if the isolate was initialized from
    5615             :   // a snapshot. Otherwise we have to build the context from scratch.
    5616             :   // Also create a context from scratch to expose natives, if required by flag.
    5617             :   DCHECK(native_context_.is_null());
    5618       91891 :   if (isolate->initialized_from_snapshot()) {
    5619             :     Handle<Context> context;
    5620       91825 :     if (Snapshot::NewContextFromSnapshot(isolate, global_proxy,
    5621             :                                          context_snapshot_index,
    5622             :                                          embedder_fields_deserializer)
    5623      183650 :             .ToHandle(&context)) {
    5624       91780 :       native_context_ = Handle<NativeContext>::cast(context);
    5625             :     }
    5626             :   }
    5627             : 
    5628       91891 :   if (!native_context().is_null()) {
    5629       91780 :     AddToWeakNativeContextList(isolate, *native_context());
    5630             :     isolate->set_context(*native_context());
    5631       91780 :     isolate->counters()->contexts_created_by_snapshot()->Increment();
    5632             : 
    5633       91780 :     if (context_snapshot_index == 0) {
    5634             :       Handle<JSGlobalObject> global_object =
    5635       91740 :           CreateNewGlobals(global_proxy_template, global_proxy);
    5636       91740 :       HookUpGlobalObject(global_object);
    5637             : 
    5638       91740 :       if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5639             :     } else {
    5640             :       // The global proxy needs to be integrated into the native context.
    5641          40 :       HookUpGlobalProxy(global_proxy);
    5642             :     }
    5643             :     DCHECK(!global_proxy->IsDetachedFrom(native_context()->global_object()));
    5644             :   } else {
    5645             :     base::ElapsedTimer timer;
    5646         111 :     if (FLAG_profile_deserialization) timer.Start();
    5647             :     DCHECK_EQ(0u, context_snapshot_index);
    5648             :     // We get here if there was no context snapshot.
    5649         111 :     CreateRoots();
    5650         111 :     MathRandom::InitializeContext(isolate, native_context());
    5651         111 :     Handle<JSFunction> empty_function = CreateEmptyFunction();
    5652         111 :     CreateSloppyModeFunctionMaps(empty_function);
    5653         111 :     CreateStrictModeFunctionMaps(empty_function);
    5654         111 :     CreateObjectFunction(empty_function);
    5655         111 :     CreateIteratorMaps(empty_function);
    5656         111 :     CreateAsyncIteratorMaps(empty_function);
    5657         111 :     CreateAsyncFunctionMaps(empty_function);
    5658             :     Handle<JSGlobalObject> global_object =
    5659         111 :         CreateNewGlobals(global_proxy_template, global_proxy);
    5660         111 :     InitializeGlobal(global_object, empty_function);
    5661         111 :     InitializeNormalizedMapCaches();
    5662         111 :     InitializeIteratorFunctions();
    5663         111 :     InitializeCallSiteBuiltins();
    5664             : 
    5665         111 :     if (!InstallNatives()) return;
    5666         111 :     if (!InstallExtraNatives()) return;
    5667         111 :     if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5668             : 
    5669         111 :     isolate->counters()->contexts_created_from_scratch()->Increment();
    5670             : 
    5671         111 :     if (FLAG_profile_deserialization) {
    5672           0 :       double ms = timer.Elapsed().InMillisecondsF();
    5673           0 :       PrintF("[Initializing context from scratch took %0.3f ms]\n", ms);
    5674             :     }
    5675             :   }
    5676             : 
    5677             :   native_context()->set_microtask_queue(isolate->default_microtask_queue());
    5678             : 
    5679             :   // Install experimental natives. Do not include them into the
    5680             :   // snapshot as we should be able to turn them off at runtime. Re-installing
    5681             :   // them after they have already been deserialized would also fail.
    5682       91891 :     if (!isolate->serializer_enabled()) {
    5683       91595 :       InitializeExperimentalGlobal();
    5684             : 
    5685             :       // Store String.prototype's map again in case it has been changed by
    5686             :       // experimental natives.
    5687      183190 :       Handle<JSFunction> string_function(native_context()->string_function(),
    5688       91595 :                                          isolate);
    5689             :       JSObject string_function_prototype =
    5690      183190 :           JSObject::cast(string_function->initial_map()->prototype());
    5691             :       DCHECK(string_function_prototype->HasFastProperties());
    5692      183190 :       native_context()->set_string_function_prototype_map(
    5693       91595 :           string_function_prototype->map());
    5694             :     }
    5695             : 
    5696       91891 :   if (FLAG_disallow_code_generation_from_strings) {
    5697          18 :     native_context()->set_allow_code_gen_from_strings(
    5698          27 :         ReadOnlyRoots(isolate).false_value());
    5699             :   }
    5700             : 
    5701       91891 :   ConfigureUtilsObject();
    5702             : 
    5703             :   // We created new functions, which may require debug instrumentation.
    5704       91891 :   if (isolate->debug()->is_active()) {
    5705         145 :     isolate->debug()->InstallDebugBreakTrampoline();
    5706             :   }
    5707             : 
    5708       91891 :   native_context()->ResetErrorsThrown();
    5709       91891 :   result_ = native_context();
    5710             : }
    5711             : 
    5712          36 : Genesis::Genesis(Isolate* isolate,
    5713             :                  MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5714          31 :                  v8::Local<v8::ObjectTemplate> global_proxy_template)
    5715          18 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5716          18 :   result_ = Handle<Context>::null();
    5717          18 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5718             : 
    5719             :   // Before creating the roots we must save the context and restore it
    5720             :   // on all function exits.
    5721          18 :   SaveContext saved_context(isolate);
    5722             : 
    5723             :   const int proxy_size = JSGlobalProxy::SizeWithEmbedderFields(
    5724          18 :       global_proxy_template->InternalFieldCount());
    5725             : 
    5726             :   Handle<JSGlobalProxy> global_proxy;
    5727          18 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5728          13 :     global_proxy = factory()->NewUninitializedJSGlobalProxy(proxy_size);
    5729             :   }
    5730             : 
    5731             :   // Create a remote object as the global object.
    5732             :   Handle<ObjectTemplateInfo> global_proxy_data =
    5733             :       Utils::OpenHandle(*global_proxy_template);
    5734             :   Handle<FunctionTemplateInfo> global_constructor(
    5735          36 :       FunctionTemplateInfo::cast(global_proxy_data->constructor()), isolate);
    5736             : 
    5737             :   Handle<ObjectTemplateInfo> global_object_template(
    5738             :       ObjectTemplateInfo::cast(global_constructor->GetPrototypeTemplate()),
    5739          36 :       isolate);
    5740             :   Handle<JSObject> global_object =
    5741             :       ApiNatives::InstantiateRemoteObject(
    5742          36 :           global_object_template).ToHandleChecked();
    5743             : 
    5744             :   // (Re)initialize the global proxy object.
    5745             :   DCHECK_EQ(global_proxy_data->embedder_field_count(),
    5746             :             global_proxy_template->InternalFieldCount());
    5747             :   Handle<Map> global_proxy_map = isolate->factory()->NewMap(
    5748          18 :       JS_GLOBAL_PROXY_TYPE, proxy_size, TERMINAL_FAST_ELEMENTS_KIND);
    5749             :   global_proxy_map->set_is_access_check_needed(true);
    5750          18 :   global_proxy_map->set_has_hidden_prototype(true);
    5751          18 :   global_proxy_map->set_may_have_interesting_symbols(true);
    5752             : 
    5753             :   // A remote global proxy has no native context.
    5754          54 :   global_proxy->set_native_context(ReadOnlyRoots(heap()).null_value());
    5755             : 
    5756             :   // Configure the hidden prototype chain of the global proxy.
    5757          18 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5758          36 :   global_proxy->map()->SetConstructor(*global_constructor);
    5759             :   // TODO(dcheng): This is a hack. Why does this need to be manually called
    5760             :   // here? Line 4812 should have taken care of it?
    5761          18 :   global_proxy->map()->set_has_hidden_prototype(true);
    5762             : 
    5763          18 :   global_proxy_ = global_proxy;
    5764          18 : }
    5765             : 
    5766             : // Support for thread preemption.
    5767             : 
    5768             : // Reserve space for statics needing saving and restoring.
    5769        1111 : int Bootstrapper::ArchiveSpacePerThread() {
    5770        1111 :   return sizeof(NestingCounterType);
    5771             : }
    5772             : 
    5773             : 
    5774             : // Archive statics that are thread-local.
    5775       24256 : char* Bootstrapper::ArchiveState(char* to) {
    5776       24256 :   *reinterpret_cast<NestingCounterType*>(to) = nesting_;
    5777       24256 :   nesting_ = 0;
    5778       24256 :   return to + sizeof(NestingCounterType);
    5779             : }
    5780             : 
    5781             : 
    5782             : // Restore statics that are thread-local.
    5783       24256 : char* Bootstrapper::RestoreState(char* from) {
    5784       24256 :   nesting_ = *reinterpret_cast<NestingCounterType*>(from);
    5785       24256 :   return from + sizeof(NestingCounterType);
    5786             : }
    5787             : 
    5788             : 
    5789             : // Called when the top-level V8 mutex is destroyed.
    5790        5918 : void Bootstrapper::FreeThreadResources() {
    5791             :   DCHECK(!IsActive());
    5792        5918 : }
    5793             : 
    5794             : }  // namespace internal
    5795      183867 : }  // namespace v8

Generated by: LCOV version 1.10