LCOV - code coverage report
Current view: top level - src - bootstrapper.cc (source / functions) Hit Total Coverage
Test: app.info Lines: 1496 1544 96.9 %
Date: 2017-04-26 Functions: 95 113 84.1 %

          Line data    Source code
       1             : // Copyright 2014 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #include "src/bootstrapper.h"
       6             : 
       7             : #include "src/accessors.h"
       8             : #include "src/api-natives.h"
       9             : #include "src/base/ieee754.h"
      10             : #include "src/code-stubs.h"
      11             : #include "src/compiler.h"
      12             : #include "src/debug/debug.h"
      13             : #include "src/extensions/externalize-string-extension.h"
      14             : #include "src/extensions/free-buffer-extension.h"
      15             : #include "src/extensions/gc-extension.h"
      16             : #include "src/extensions/ignition-statistics-extension.h"
      17             : #include "src/extensions/statistics-extension.h"
      18             : #include "src/extensions/trigger-failure-extension.h"
      19             : #include "src/ffi/ffi-compiler.h"
      20             : #include "src/heap/heap.h"
      21             : #include "src/isolate-inl.h"
      22             : #include "src/snapshot/natives.h"
      23             : #include "src/snapshot/snapshot.h"
      24             : #include "src/wasm/wasm-js.h"
      25             : 
      26             : #if V8_INTL_SUPPORT
      27             : #include "src/objects/intl-objects.h"
      28             : #endif  // V8_INTL_SUPPORT
      29             : 
      30             : namespace v8 {
      31             : namespace internal {
      32             : 
      33       60782 : Bootstrapper::Bootstrapper(Isolate* isolate)
      34             :     : isolate_(isolate),
      35             :       nesting_(0),
      36      121564 :       extensions_cache_(Script::TYPE_EXTENSION) {}
      37             : 
      38       18689 : Handle<String> Bootstrapper::GetNativeSource(NativeType type, int index) {
      39             :   NativesExternalStringResource* resource =
      40       18689 :       new NativesExternalStringResource(type, index);
      41             :   Handle<ExternalOneByteString> source_code =
      42       18689 :       isolate_->factory()->NewNativeSourceString(resource);
      43       18689 :   isolate_->heap()->RegisterExternalString(*source_code);
      44             :   DCHECK(source_code->is_short());
      45       18689 :   return source_code;
      46             : }
      47             : 
      48       60782 : void Bootstrapper::Initialize(bool create_heap_objects) {
      49       60782 :   extensions_cache_.Initialize(isolate_, create_heap_objects);
      50       60782 : }
      51             : 
      52             : 
      53             : static const char* GCFunctionName() {
      54       59461 :   bool flag_given = FLAG_expose_gc_as != NULL && strlen(FLAG_expose_gc_as) != 0;
      55       59461 :   return flag_given ? FLAG_expose_gc_as : "gc";
      56             : }
      57             : 
      58             : 
      59             : v8::Extension* Bootstrapper::free_buffer_extension_ = NULL;
      60             : v8::Extension* Bootstrapper::gc_extension_ = NULL;
      61             : v8::Extension* Bootstrapper::externalize_string_extension_ = NULL;
      62             : v8::Extension* Bootstrapper::statistics_extension_ = NULL;
      63             : v8::Extension* Bootstrapper::trigger_failure_extension_ = NULL;
      64             : v8::Extension* Bootstrapper::ignition_statistics_extension_ = NULL;
      65             : 
      66       59461 : void Bootstrapper::InitializeOncePerProcess() {
      67       59461 :   free_buffer_extension_ = new FreeBufferExtension;
      68       59461 :   v8::RegisterExtension(free_buffer_extension_);
      69       59461 :   gc_extension_ = new GCExtension(GCFunctionName());
      70       59461 :   v8::RegisterExtension(gc_extension_);
      71       59461 :   externalize_string_extension_ = new ExternalizeStringExtension;
      72       59461 :   v8::RegisterExtension(externalize_string_extension_);
      73       59461 :   statistics_extension_ = new StatisticsExtension;
      74       59461 :   v8::RegisterExtension(statistics_extension_);
      75       59461 :   trigger_failure_extension_ = new TriggerFailureExtension;
      76       59461 :   v8::RegisterExtension(trigger_failure_extension_);
      77       59461 :   ignition_statistics_extension_ = new IgnitionStatisticsExtension;
      78       59461 :   v8::RegisterExtension(ignition_statistics_extension_);
      79       59461 : }
      80             : 
      81             : 
      82       32496 : void Bootstrapper::TearDownExtensions() {
      83       32496 :   delete free_buffer_extension_;
      84       32496 :   free_buffer_extension_ = NULL;
      85       32496 :   delete gc_extension_;
      86       32496 :   gc_extension_ = NULL;
      87       32496 :   delete externalize_string_extension_;
      88       32496 :   externalize_string_extension_ = NULL;
      89       32496 :   delete statistics_extension_;
      90       32496 :   statistics_extension_ = NULL;
      91       32496 :   delete trigger_failure_extension_;
      92       32496 :   trigger_failure_extension_ = NULL;
      93       32496 :   delete ignition_statistics_extension_;
      94       32496 :   ignition_statistics_extension_ = NULL;
      95       32496 : }
      96             : 
      97       59285 : void Bootstrapper::TearDown() {
      98             :   extensions_cache_.Initialize(isolate_, false);  // Yes, symmetrical
      99       59285 : }
     100             : 
     101             : 
     102             : class Genesis BASE_EMBEDDED {
     103             :  public:
     104             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     105             :           v8::Local<v8::ObjectTemplate> global_proxy_template,
     106             :           size_t context_snapshot_index,
     107             :           v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
     108             :           GlobalContextType context_type);
     109             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     110             :           v8::Local<v8::ObjectTemplate> global_proxy_template);
     111             :   ~Genesis() { }
     112             : 
     113             :   Isolate* isolate() const { return isolate_; }
     114             :   Factory* factory() const { return isolate_->factory(); }
     115             :   Heap* heap() const { return isolate_->heap(); }
     116             : 
     117             :   Handle<Context> result() { return result_; }
     118             : 
     119             :   Handle<JSGlobalProxy> global_proxy() { return global_proxy_; }
     120             : 
     121             :  private:
     122             :   Handle<Context> native_context() { return native_context_; }
     123             : 
     124             :   // Creates some basic objects. Used for creating a context from scratch.
     125             :   void CreateRoots();
     126             :   // Creates the empty function.  Used for creating a context from scratch.
     127             :   Handle<JSFunction> CreateEmptyFunction(Isolate* isolate);
     128             :   // Creates the ThrowTypeError function. ECMA 5th Ed. 13.2.3
     129             :   Handle<JSFunction> GetRestrictedFunctionPropertiesThrower();
     130             :   Handle<JSFunction> GetStrictArgumentsPoisonFunction();
     131             :   Handle<JSFunction> GetThrowTypeErrorIntrinsic(Builtins::Name builtin_name);
     132             : 
     133             :   void CreateStrictModeFunctionMaps(Handle<JSFunction> empty);
     134             :   void CreateIteratorMaps(Handle<JSFunction> empty);
     135             :   void CreateAsyncIteratorMaps(Handle<JSFunction> empty);
     136             :   void CreateAsyncFunctionMaps(Handle<JSFunction> empty);
     137             :   void CreateJSProxyMaps();
     138             : 
     139             :   // Make the "arguments" and "caller" properties throw a TypeError on access.
     140             :   void AddRestrictedFunctionProperties(Handle<JSFunction> empty);
     141             : 
     142             :   // Creates the global objects using the global proxy and the template passed
     143             :   // in through the API.  We call this regardless of whether we are building a
     144             :   // context from scratch or using a deserialized one from the partial snapshot
     145             :   // but in the latter case we don't use the objects it produces directly, as
     146             :   // we have to use the deserialized ones that are linked together with the
     147             :   // rest of the context snapshot. At the end we link the global proxy and the
     148             :   // context to each other.
     149             :   Handle<JSGlobalObject> CreateNewGlobals(
     150             :       v8::Local<v8::ObjectTemplate> global_proxy_template,
     151             :       Handle<JSGlobalProxy> global_proxy);
     152             :   // Similarly, we want to use the global that has been created by the templates
     153             :   // passed through the API.  The global from the snapshot is detached from the
     154             :   // other objects in the snapshot.
     155             :   void HookUpGlobalObject(Handle<JSGlobalObject> global_object);
     156             :   // Hooks the given global proxy into the context in the case we do not
     157             :   // replace the global object from the deserialized native context.
     158             :   void HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy);
     159             :   // The native context has a ScriptContextTable that store declarative bindings
     160             :   // made in script scopes.  Add a "this" binding to that table pointing to the
     161             :   // global proxy.
     162             :   void InstallGlobalThisBinding();
     163             :   // New context initialization.  Used for creating a context from scratch.
     164             :   void InitializeGlobal(Handle<JSGlobalObject> global_object,
     165             :                         Handle<JSFunction> empty_function,
     166             :                         GlobalContextType context_type);
     167             :   void InitializeExperimentalGlobal();
     168             :   // Depending on the situation, expose and/or get rid of the utils object.
     169             :   void ConfigureUtilsObject(GlobalContextType context_type);
     170             : 
     171             : #define DECLARE_FEATURE_INITIALIZATION(id, descr) \
     172             :   void InitializeGlobal_##id();
     173             : 
     174             :   HARMONY_INPROGRESS(DECLARE_FEATURE_INITIALIZATION)
     175             :   HARMONY_STAGED(DECLARE_FEATURE_INITIALIZATION)
     176             :   HARMONY_SHIPPING(DECLARE_FEATURE_INITIALIZATION)
     177             : #undef DECLARE_FEATURE_INITIALIZATION
     178             : 
     179             :   void InstallOneBuiltinFunction(Handle<Object> prototype, const char* method,
     180             :                                  Builtins::Name name);
     181             :   void InitializeGlobal_experimental_fast_array_builtins();
     182             : 
     183             :   Handle<JSFunction> InstallArrayBuffer(Handle<JSObject> target,
     184             :                                         const char* name,
     185             :                                         Builtins::Name call_byteLength,
     186             :                                         BuiltinFunctionId byteLength_id,
     187             :                                         Builtins::Name call_slice);
     188             :   Handle<JSFunction> InstallInternalArray(Handle<JSObject> target,
     189             :                                           const char* name,
     190             :                                           ElementsKind elements_kind);
     191             :   bool InstallNatives(GlobalContextType context_type);
     192             : 
     193             :   void InstallTypedArray(const char* name, ElementsKind elements_kind,
     194             :                          Handle<JSFunction>* fun);
     195             :   bool InstallExtraNatives();
     196             :   bool InstallExperimentalExtraNatives();
     197             :   bool InstallDebuggerNatives();
     198             :   void InstallBuiltinFunctionIds();
     199             :   void InstallExperimentalBuiltinFunctionIds();
     200             :   void InitializeNormalizedMapCaches();
     201             : 
     202             :   enum ExtensionTraversalState {
     203             :     UNVISITED, VISITED, INSTALLED
     204             :   };
     205             : 
     206             :   class ExtensionStates {
     207             :    public:
     208             :     ExtensionStates();
     209             :     ExtensionTraversalState get_state(RegisteredExtension* extension);
     210             :     void set_state(RegisteredExtension* extension,
     211             :                    ExtensionTraversalState state);
     212             :    private:
     213             :     base::HashMap map_;
     214             :     DISALLOW_COPY_AND_ASSIGN(ExtensionStates);
     215             :   };
     216             : 
     217             :   // Used both for deserialized and from-scratch contexts to add the extensions
     218             :   // provided.
     219             :   static bool InstallExtensions(Handle<Context> native_context,
     220             :                                 v8::ExtensionConfiguration* extensions);
     221             :   static bool InstallAutoExtensions(Isolate* isolate,
     222             :                                     ExtensionStates* extension_states);
     223             :   static bool InstallRequestedExtensions(Isolate* isolate,
     224             :                                          v8::ExtensionConfiguration* extensions,
     225             :                                          ExtensionStates* extension_states);
     226             :   static bool InstallExtension(Isolate* isolate,
     227             :                                const char* name,
     228             :                                ExtensionStates* extension_states);
     229             :   static bool InstallExtension(Isolate* isolate,
     230             :                                v8::RegisteredExtension* current,
     231             :                                ExtensionStates* extension_states);
     232             :   static bool InstallSpecialObjects(Handle<Context> native_context);
     233             :   bool ConfigureApiObject(Handle<JSObject> object,
     234             :                           Handle<ObjectTemplateInfo> object_template);
     235             :   bool ConfigureGlobalObjects(
     236             :       v8::Local<v8::ObjectTemplate> global_proxy_template);
     237             : 
     238             :   // Migrates all properties from the 'from' object to the 'to'
     239             :   // object and overrides the prototype in 'to' with the one from
     240             :   // 'from'.
     241             :   void TransferObject(Handle<JSObject> from, Handle<JSObject> to);
     242             :   void TransferNamedProperties(Handle<JSObject> from, Handle<JSObject> to);
     243             :   void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);
     244             : 
     245             :   void MakeFunctionInstancePrototypeWritable();
     246             : 
     247             :   void SetStrictFunctionInstanceDescriptor(Handle<Map> map,
     248             :                                            FunctionMode function_mode);
     249             : 
     250             :   static bool CallUtilsFunction(Isolate* isolate, const char* name);
     251             : 
     252             :   static bool CompileExtension(Isolate* isolate, v8::Extension* extension);
     253             : 
     254             :   Isolate* isolate_;
     255             :   Handle<Context> result_;
     256             :   Handle<Context> native_context_;
     257             :   Handle<JSGlobalProxy> global_proxy_;
     258             : 
     259             :   // Function maps. Function maps are created initially with a read only
     260             :   // prototype for the processing of JS builtins. Later the function maps are
     261             :   // replaced in order to make prototype writable. These are the final, writable
     262             :   // prototype, maps.
     263             :   Handle<Map> sloppy_function_map_writable_prototype_;
     264             :   Handle<Map> strict_function_map_writable_prototype_;
     265             :   Handle<Map> class_function_map_;
     266             :   Handle<JSFunction> strict_poison_function_;
     267             :   Handle<JSFunction> restricted_function_properties_thrower_;
     268             : 
     269             :   BootstrapperActive active_;
     270             :   friend class Bootstrapper;
     271             : };
     272             : 
     273      241585 : void Bootstrapper::Iterate(RootVisitor* v) {
     274             :   extensions_cache_.Iterate(v);
     275      241585 :   v->Synchronize(VisitorSynchronization::kExtensions);
     276      241585 : }
     277             : 
     278      107248 : Handle<Context> Bootstrapper::CreateEnvironment(
     279             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     280             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
     281             :     v8::ExtensionConfiguration* extensions, size_t context_snapshot_index,
     282             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
     283             :     GlobalContextType context_type) {
     284      107248 :   HandleScope scope(isolate_);
     285             :   Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template,
     286             :                   context_snapshot_index, embedder_fields_deserializer,
     287      107248 :                   context_type);
     288             :   Handle<Context> env = genesis.result();
     289      107248 :   if (env.is_null() || !InstallExtensions(env, extensions)) {
     290        1678 :     return Handle<Context>();
     291             :   }
     292      105570 :   return scope.CloseAndEscape(env);
     293             : }
     294             : 
     295          24 : Handle<JSGlobalProxy> Bootstrapper::NewRemoteContext(
     296             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     297             :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
     298          24 :   HandleScope scope(isolate_);
     299          24 :   Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template);
     300             :   Handle<JSGlobalProxy> global_proxy = genesis.global_proxy();
     301          24 :   if (global_proxy.is_null()) return Handle<JSGlobalProxy>();
     302          24 :   return scope.CloseAndEscape(global_proxy);
     303             : }
     304             : 
     305          65 : void Bootstrapper::DetachGlobal(Handle<Context> env) {
     306          65 :   Isolate* isolate = env->GetIsolate();
     307             :   isolate->counters()->errors_thrown_per_context()->AddSample(
     308         130 :       env->GetErrorsThrown());
     309             : 
     310         130 :   Heap* heap = isolate->heap();
     311          65 :   Handle<JSGlobalProxy> global_proxy(JSGlobalProxy::cast(env->global_proxy()));
     312          65 :   global_proxy->set_native_context(heap->null_value());
     313          65 :   JSObject::ForceSetPrototype(global_proxy, isolate->factory()->null_value());
     314             :   global_proxy->map()->SetConstructor(heap->null_value());
     315          65 :   if (FLAG_track_detached_contexts) {
     316          65 :     env->GetIsolate()->AddDetachedContext(env);
     317             :   }
     318          65 : }
     319             : 
     320             : namespace {
     321             : 
     322       38025 : void InstallFunction(Handle<JSObject> target, Handle<Name> property_name,
     323             :                      Handle<JSFunction> function, Handle<String> function_name,
     324             :                      PropertyAttributes attributes = DONT_ENUM) {
     325       38025 :   JSObject::AddProperty(target, property_name, function, attributes);
     326       38025 :   if (target->IsJSGlobalObject()) {
     327        3935 :     function->shared()->set_instance_class_name(*function_name);
     328             :   }
     329       38025 : }
     330             : 
     331       32905 : void InstallFunction(Handle<JSObject> target, Handle<JSFunction> function,
     332             :                      Handle<Name> name,
     333             :                      PropertyAttributes attributes = DONT_ENUM) {
     334       65810 :   Handle<String> name_string = Name::ToFunctionName(name).ToHandleChecked();
     335       32905 :   InstallFunction(target, name, function, name_string, attributes);
     336       32905 : }
     337             : 
     338      259085 : Handle<JSFunction> CreateFunction(Isolate* isolate, Handle<String> name,
     339             :                                   InstanceType type, int instance_size,
     340             :                                   MaybeHandle<JSObject> maybe_prototype,
     341             :                                   Builtins::Name call,
     342             :                                   bool strict_function_map = false) {
     343             :   Factory* factory = isolate->factory();
     344             :   Handle<Code> call_code(isolate->builtins()->builtin(call));
     345             :   Handle<JSObject> prototype;
     346             :   Handle<JSFunction> result =
     347             :       maybe_prototype.ToHandle(&prototype)
     348             :           ? factory->NewFunction(name, call_code, prototype, type,
     349      268535 :                                  instance_size, strict_function_map)
     350             :           : factory->NewFunctionWithoutPrototype(name, call_code,
     351      518170 :                                                  strict_function_map);
     352             :   result->shared()->set_native(true);
     353      259085 :   return result;
     354             : }
     355             : 
     356        5041 : Handle<JSFunction> InstallFunction(Handle<JSObject> target, Handle<Name> name,
     357             :                                    InstanceType type, int instance_size,
     358             :                                    MaybeHandle<JSObject> maybe_prototype,
     359             :                                    Builtins::Name call,
     360             :                                    PropertyAttributes attributes,
     361             :                                    bool strict_function_map = false) {
     362       10082 :   Handle<String> name_string = Name::ToFunctionName(name).ToHandleChecked();
     363             :   Handle<JSFunction> function =
     364             :       CreateFunction(target->GetIsolate(), name_string, type, instance_size,
     365       10082 :                      maybe_prototype, call, strict_function_map);
     366        5041 :   InstallFunction(target, name, function, name_string, attributes);
     367        5041 :   return function;
     368             : }
     369             : 
     370        4014 : Handle<JSFunction> InstallFunction(Handle<JSObject> target, const char* name,
     371             :                                    InstanceType type, int instance_size,
     372             :                                    MaybeHandle<JSObject> maybe_prototype,
     373             :                                    Builtins::Name call,
     374             :                                    bool strict_function_map = false) {
     375             :   Factory* const factory = target->GetIsolate()->factory();
     376             :   PropertyAttributes attributes = DONT_ENUM;
     377             :   return InstallFunction(target, factory->InternalizeUtf8String(name), type,
     378             :                          instance_size, maybe_prototype, call, attributes,
     379        8028 :                          strict_function_map);
     380             : }
     381             : 
     382      253254 : Handle<JSFunction> SimpleCreateFunction(Isolate* isolate, Handle<String> name,
     383             :                                         Builtins::Name call, int len,
     384             :                                         bool adapt) {
     385             :   Handle<JSFunction> fun =
     386             :       CreateFunction(isolate, name, JS_OBJECT_TYPE, JSObject::kHeaderSize,
     387      253254 :                      MaybeHandle<JSObject>(), call);
     388      253254 :   if (adapt) {
     389             :     fun->shared()->set_internal_formal_parameter_count(len);
     390             :   } else {
     391             :     fun->shared()->DontAdaptArguments();
     392             :   }
     393             :   fun->shared()->set_length(len);
     394      253254 :   return fun;
     395             : }
     396             : 
     397         553 : Handle<JSFunction> InstallArrayBuiltinFunction(Handle<JSObject> base,
     398             :                                                const char* name,
     399             :                                                Builtins::Name call,
     400             :                                                int argument_count) {
     401             :   Isolate* isolate = base->GetIsolate();
     402         553 :   Handle<String> str_name = isolate->factory()->InternalizeUtf8String(name);
     403             :   Handle<JSFunction> fun =
     404             :       CreateFunction(isolate, str_name, JS_OBJECT_TYPE, JSObject::kHeaderSize,
     405         553 :                      MaybeHandle<JSObject>(), call, true);
     406             :   fun->shared()->set_internal_formal_parameter_count(argument_count);
     407             : 
     408             :   // Set the length to 1 to satisfy ECMA-262.
     409             :   fun->shared()->set_length(1);
     410             :   fun->shared()->set_language_mode(STRICT);
     411         553 :   InstallFunction(base, fun, str_name);
     412         553 :   return fun;
     413             : }
     414             : 
     415       31009 : Handle<JSFunction> SimpleInstallFunction(Handle<JSObject> base,
     416             :                                          Handle<String> name,
     417             :                                          Builtins::Name call, int len,
     418             :                                          bool adapt,
     419             :                                          PropertyAttributes attrs = DONT_ENUM) {
     420             :   Handle<JSFunction> fun =
     421       62018 :       SimpleCreateFunction(base->GetIsolate(), name, call, len, adapt);
     422       31009 :   InstallFunction(base, fun, name, attrs);
     423       31009 :   return fun;
     424             : }
     425             : 
     426       19038 : Handle<JSFunction> SimpleInstallFunction(Handle<JSObject> base,
     427             :                                          const char* name, Builtins::Name call,
     428             :                                          int len, bool adapt,
     429             :                                          PropertyAttributes attrs = DONT_ENUM) {
     430             :   Factory* const factory = base->GetIsolate()->factory();
     431             :   return SimpleInstallFunction(base, factory->InternalizeUtf8String(name), call,
     432       19038 :                                len, adapt, attrs);
     433             : }
     434             : 
     435         632 : Handle<JSFunction> SimpleInstallFunction(Handle<JSObject> base,
     436             :                                          const char* name, Builtins::Name call,
     437             :                                          int len, bool adapt,
     438             :                                          BuiltinFunctionId id) {
     439         632 :   Handle<JSFunction> fun = SimpleInstallFunction(base, name, call, len, adapt);
     440             :   fun->shared()->set_builtin_function_id(id);
     441         632 :   return fun;
     442             : }
     443             : 
     444        1580 : void SimpleInstallGetterSetter(Handle<JSObject> base, Handle<String> name,
     445             :                                Builtins::Name call_getter,
     446             :                                Builtins::Name call_setter,
     447             :                                PropertyAttributes attribs) {
     448             :   Isolate* const isolate = base->GetIsolate();
     449             : 
     450             :   Handle<String> getter_name =
     451             :       Name::ToFunctionName(name, isolate->factory()->get_string())
     452        3160 :           .ToHandleChecked();
     453             :   Handle<JSFunction> getter =
     454        1580 :       SimpleCreateFunction(isolate, getter_name, call_getter, 0, true);
     455             : 
     456             :   Handle<String> setter_name =
     457             :       Name::ToFunctionName(name, isolate->factory()->set_string())
     458        3160 :           .ToHandleChecked();
     459             :   Handle<JSFunction> setter =
     460        1580 :       SimpleCreateFunction(isolate, setter_name, call_setter, 1, true);
     461             : 
     462        3160 :   JSObject::DefineAccessor(base, name, getter, setter, attribs).Check();
     463        1580 : }
     464             : 
     465        3654 : Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
     466             :                                        Handle<String> name,
     467             :                                        Handle<Name> property_name,
     468             :                                        Builtins::Name call, bool adapt) {
     469             :   Isolate* const isolate = base->GetIsolate();
     470             : 
     471             :   Handle<String> getter_name =
     472             :       Name::ToFunctionName(name, isolate->factory()->get_string())
     473        7308 :           .ToHandleChecked();
     474             :   Handle<JSFunction> getter =
     475        3654 :       SimpleCreateFunction(isolate, getter_name, call, 0, adapt);
     476             : 
     477             :   Handle<Object> setter = isolate->factory()->undefined_value();
     478             : 
     479             :   JSObject::DefineAccessor(base, property_name, getter, setter, DONT_ENUM)
     480        7308 :       .Check();
     481             : 
     482        3654 :   return getter;
     483             : }
     484             : 
     485             : Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
     486             :                                        Handle<String> name, Builtins::Name call,
     487             :                                        bool adapt) {
     488        3654 :   return SimpleInstallGetter(base, name, name, call, adapt);
     489             : }
     490             : 
     491        1249 : Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
     492             :                                        Handle<String> name, Builtins::Name call,
     493             :                                        bool adapt, BuiltinFunctionId id) {
     494             :   Handle<JSFunction> fun = SimpleInstallGetter(base, name, call, adapt);
     495             :   fun->shared()->set_builtin_function_id(id);
     496        1249 :   return fun;
     497             : }
     498             : 
     499        1606 : void InstallConstant(Isolate* isolate, Handle<JSObject> holder,
     500             :                      const char* name, Handle<Object> value) {
     501             :   JSObject::AddProperty(
     502             :       holder, isolate->factory()->NewStringFromAsciiChecked(name), value,
     503        3212 :       static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     504        1606 : }
     505             : 
     506        1249 : void InstallSpeciesGetter(Handle<JSFunction> constructor) {
     507             :   Factory* factory = constructor->GetIsolate()->factory();
     508             :   // TODO(adamk): We should be able to share a SharedFunctionInfo
     509             :   // between all these JSFunctins.
     510             :   SimpleInstallGetter(constructor, factory->symbol_species_string(),
     511             :                       factory->species_symbol(), Builtins::kReturnReceiver,
     512        1249 :                       true);
     513        1249 : }
     514             : 
     515             : }  // namespace
     516             : 
     517         237 : Handle<JSFunction> Genesis::CreateEmptyFunction(Isolate* isolate) {
     518             :   // Allocate the map for function instances. Maps are allocated first and their
     519             :   // prototypes patched later, once empty function is created.
     520             : 
     521             :   // Functions with this map will not have a 'prototype' property, and
     522             :   // can not be used as constructors.
     523             :   Handle<Map> function_without_prototype_map =
     524          79 :       factory()->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE);
     525             :   native_context()->set_sloppy_function_without_prototype_map(
     526             :       *function_without_prototype_map);
     527             : 
     528             :   // Allocate the function map. This map is temporary, used only for processing
     529             :   // of builtins.
     530             :   // Later the map is replaced with writable prototype map, allocated below.
     531             :   Handle<Map> function_map =
     532          79 :       factory()->CreateSloppyFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE);
     533             :   native_context()->set_sloppy_function_map(*function_map);
     534             :   native_context()->set_sloppy_function_with_readonly_prototype_map(
     535             :       *function_map);
     536             : 
     537             :   // The final map for functions. Writeable prototype.
     538             :   // This map is installed in MakeFunctionInstancePrototypeWritable.
     539             :   sloppy_function_map_writable_prototype_ =
     540          79 :       factory()->CreateSloppyFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE);
     541             :   Factory* factory = isolate->factory();
     542             : 
     543          79 :   Handle<String> object_name = factory->Object_string();
     544             : 
     545             :   Handle<JSObject> object_function_prototype;
     546             : 
     547             :   {  // --- O b j e c t ---
     548          79 :     Handle<JSFunction> object_fun = factory->NewFunction(object_name);
     549             :     int unused = JSObject::kInitialGlobalObjectUnusedPropertiesCount;
     550             :     int instance_size = JSObject::kHeaderSize + kPointerSize * unused;
     551             :     Handle<Map> object_function_map =
     552          79 :         factory->NewMap(JS_OBJECT_TYPE, instance_size);
     553             :     object_function_map->SetInObjectProperties(unused);
     554             :     JSFunction::SetInitialMap(object_fun, object_function_map,
     555          79 :                               isolate->factory()->null_value());
     556             :     object_function_map->set_unused_property_fields(unused);
     557             : 
     558             :     native_context()->set_object_function(*object_fun);
     559             : 
     560             :     // Allocate a new prototype for the object function.
     561             :     object_function_prototype =
     562          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
     563             :     Handle<Map> map = Map::Copy(handle(object_function_prototype->map()),
     564          79 :                                 "EmptyObjectPrototype");
     565             :     map->set_is_prototype_map(true);
     566             :     // Ban re-setting Object.prototype.__proto__ to prevent Proxy security bug
     567             :     map->set_immutable_proto(true);
     568          79 :     object_function_prototype->set_map(*map);
     569             : 
     570             :     native_context()->set_initial_object_prototype(*object_function_prototype);
     571          79 :     JSFunction::SetPrototype(object_fun, object_function_prototype);
     572             :   }
     573             : 
     574             :   // Allocate the empty function as the prototype for function - ES6 19.2.3
     575          79 :   Handle<Code> code(isolate->builtins()->EmptyFunction());
     576             :   Handle<JSFunction> empty_function =
     577          79 :       factory->NewFunctionWithoutPrototype(factory->empty_string(), code);
     578             : 
     579             :   // Allocate the function map first and then patch the prototype later
     580             :   Handle<Map> empty_function_map =
     581          79 :       factory->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE);
     582             :   DCHECK(!empty_function_map->is_dictionary_map());
     583          79 :   Map::SetPrototype(empty_function_map, object_function_prototype);
     584             :   empty_function_map->set_is_prototype_map(true);
     585             : 
     586          79 :   empty_function->set_map(*empty_function_map);
     587             : 
     588             :   // --- E m p t y ---
     589          79 :   Handle<String> source = factory->NewStringFromStaticChars("() {}");
     590          79 :   Handle<Script> script = factory->NewScript(source);
     591             :   script->set_type(Script::TYPE_NATIVE);
     592          79 :   Handle<FixedArray> infos = factory->NewFixedArray(2);
     593          79 :   script->set_shared_function_infos(*infos);
     594             :   empty_function->shared()->set_start_position(0);
     595             :   empty_function->shared()->set_end_position(source->length());
     596             :   empty_function->shared()->set_function_literal_id(1);
     597             :   empty_function->shared()->DontAdaptArguments();
     598          79 :   SharedFunctionInfo::SetScript(handle(empty_function->shared()), script);
     599             : 
     600             :   // Set prototypes for the function maps.
     601             :   Handle<Map> sloppy_function_map(native_context()->sloppy_function_map(),
     602             :                                   isolate);
     603             :   Handle<Map> sloppy_function_without_prototype_map(
     604             :       native_context()->sloppy_function_without_prototype_map(), isolate);
     605          79 :   Map::SetPrototype(sloppy_function_map, empty_function);
     606          79 :   Map::SetPrototype(sloppy_function_without_prototype_map, empty_function);
     607          79 :   Map::SetPrototype(sloppy_function_map_writable_prototype_, empty_function);
     608             : 
     609          79 :   return empty_function;
     610             : }
     611             : 
     612             : 
     613             : // Creates the %ThrowTypeError% function.
     614         158 : Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic(
     615         948 :     Builtins::Name builtin_name) {
     616             :   Handle<String> name =
     617         158 :       factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("ThrowTypeError"));
     618             :   Handle<Code> code(isolate()->builtins()->builtin(builtin_name));
     619             :   Handle<JSFunction> function =
     620         158 :       factory()->NewFunctionWithoutPrototype(name, code, true);
     621             :   function->shared()->DontAdaptArguments();
     622             : 
     623             :   // %ThrowTypeError% must not have a name property.
     624         158 :   if (JSReceiver::DeleteProperty(function, factory()->name_string())
     625         158 :           .IsNothing()) {
     626             :     DCHECK(false);
     627             :   }
     628             : 
     629             :   // length needs to be non configurable.
     630             :   Handle<Object> value(Smi::FromInt(function->shared()->GetLength()),
     631             :                        isolate());
     632             :   JSObject::SetOwnPropertyIgnoreAttributes(
     633             :       function, factory()->length_string(), value,
     634             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))
     635         158 :       .Assert();
     636             : 
     637         158 :   if (JSObject::PreventExtensions(function, Object::THROW_ON_ERROR)
     638         158 :           .IsNothing()) {
     639             :     DCHECK(false);
     640             :   }
     641             : 
     642         158 :   return function;
     643             : }
     644             : 
     645             : 
     646             : // ECMAScript 5th Edition, 13.2.3
     647          79 : Handle<JSFunction> Genesis::GetRestrictedFunctionPropertiesThrower() {
     648          79 :   if (restricted_function_properties_thrower_.is_null()) {
     649             :     restricted_function_properties_thrower_ = GetThrowTypeErrorIntrinsic(
     650          79 :         Builtins::kRestrictedFunctionPropertiesThrower);
     651             :   }
     652          79 :   return restricted_function_properties_thrower_;
     653             : }
     654             : 
     655             : 
     656          79 : Handle<JSFunction> Genesis::GetStrictArgumentsPoisonFunction() {
     657          79 :   if (strict_poison_function_.is_null()) {
     658             :     strict_poison_function_ = GetThrowTypeErrorIntrinsic(
     659          79 :         Builtins::kRestrictedStrictArgumentsPropertiesThrower);
     660             :   }
     661          79 :   return strict_poison_function_;
     662             : }
     663             : 
     664             : 
     665         316 : void Genesis::CreateStrictModeFunctionMaps(Handle<JSFunction> empty) {
     666             :   // Allocate map for the prototype-less strict mode instances.
     667             :   Handle<Map> strict_function_without_prototype_map =
     668          79 :       factory()->CreateStrictFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     669             :   native_context()->set_strict_function_without_prototype_map(
     670             :       *strict_function_without_prototype_map);
     671             : 
     672             :   // Allocate map for the strict mode functions. This map is temporary, used
     673             :   // only for processing of builtins.
     674             :   // Later the map is replaced with writable prototype map, allocated below.
     675             :   Handle<Map> strict_function_map = factory()->CreateStrictFunctionMap(
     676          79 :       FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     677             :   native_context()->set_strict_function_map(*strict_function_map);
     678             : 
     679             :   // The final map for the strict mode functions. Writeable prototype.
     680             :   // This map is installed in MakeFunctionInstancePrototypeWritable.
     681             :   strict_function_map_writable_prototype_ = factory()->CreateStrictFunctionMap(
     682          79 :       FUNCTION_WITH_WRITEABLE_PROTOTYPE, empty);
     683             : 
     684             :   // Allocate map for classes
     685          79 :   class_function_map_ = factory()->CreateClassFunctionMap(empty);
     686             :   native_context()->set_class_function_map(*class_function_map_);
     687             : 
     688             :   // Now that the strict mode function map is available, set up the
     689             :   // restricted "arguments" and "caller" getters.
     690          79 :   AddRestrictedFunctionProperties(empty);
     691          79 : }
     692             : 
     693        1343 : void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
     694             :   // Create iterator-related meta-objects.
     695             :   Handle<JSObject> iterator_prototype =
     696         158 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     697             : 
     698             :   Handle<JSFunction> iterator_prototype_iterator = SimpleCreateFunction(
     699             :       isolate(), factory()->NewStringFromAsciiChecked("[Symbol.iterator]"),
     700         158 :       Builtins::kReturnReceiver, 0, true);
     701             : 
     702             :   JSObject::AddProperty(iterator_prototype, factory()->iterator_symbol(),
     703          79 :                         iterator_prototype_iterator, DONT_ENUM);
     704             :   native_context()->set_initial_iterator_prototype(*iterator_prototype);
     705             : 
     706             :   Handle<JSObject> generator_object_prototype =
     707         158 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     708             :   native_context()->set_initial_generator_prototype(
     709             :       *generator_object_prototype);
     710          79 :   JSObject::ForceSetPrototype(generator_object_prototype, iterator_prototype);
     711             :   Handle<JSObject> generator_function_prototype =
     712         158 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     713          79 :   JSObject::ForceSetPrototype(generator_function_prototype, empty);
     714             : 
     715             :   JSObject::AddProperty(
     716             :       generator_function_prototype, factory()->to_string_tag_symbol(),
     717             :       factory()->NewStringFromAsciiChecked("GeneratorFunction"),
     718         158 :       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     719             :   JSObject::AddProperty(generator_function_prototype,
     720             :                         factory()->prototype_string(),
     721             :                         generator_object_prototype,
     722          79 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     723             : 
     724             :   JSObject::AddProperty(generator_object_prototype,
     725             :                         factory()->constructor_string(),
     726             :                         generator_function_prototype,
     727          79 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     728             :   JSObject::AddProperty(generator_object_prototype,
     729             :                         factory()->to_string_tag_symbol(),
     730             :                         factory()->NewStringFromAsciiChecked("Generator"),
     731         158 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     732             :   SimpleInstallFunction(generator_object_prototype, "next",
     733          79 :                         Builtins::kGeneratorPrototypeNext, 1, true);
     734             :   SimpleInstallFunction(generator_object_prototype, "return",
     735          79 :                         Builtins::kGeneratorPrototypeReturn, 1, true);
     736             :   SimpleInstallFunction(generator_object_prototype, "throw",
     737          79 :                         Builtins::kGeneratorPrototypeThrow, 1, true);
     738             : 
     739             :   // Internal version of generator_prototype_next, flagged as non-native such
     740             :   // that it doesn't show up in Error traces.
     741             :   Handle<JSFunction> generator_next_internal =
     742             :       SimpleCreateFunction(isolate(), factory()->next_string(),
     743          79 :                            Builtins::kGeneratorPrototypeNext, 1, true);
     744             :   generator_next_internal->shared()->set_native(false);
     745             :   native_context()->set_generator_next_internal(*generator_next_internal);
     746             : 
     747             :   // Create maps for generator functions and their prototypes.  Store those
     748             :   // maps in the native context. The "prototype" property descriptor is
     749             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     750             :   // 04-14-15, section 25.2.4.3).
     751          79 :   Handle<Map> strict_function_map(strict_function_map_writable_prototype_);
     752             :   // Generator functions do not have "caller" or "arguments" accessors.
     753             :   Handle<Map> generator_function_map =
     754          79 :       Map::Copy(strict_function_map, "GeneratorFunction");
     755             :   generator_function_map->set_is_constructor(false);
     756          79 :   Map::SetPrototype(generator_function_map, generator_function_prototype);
     757             :   native_context()->set_generator_function_map(*generator_function_map);
     758             : 
     759             :   Handle<JSFunction> object_function(native_context()->object_function());
     760          79 :   Handle<Map> generator_object_prototype_map = Map::Create(isolate(), 0);
     761          79 :   Map::SetPrototype(generator_object_prototype_map, generator_object_prototype);
     762             :   native_context()->set_generator_object_prototype_map(
     763             :       *generator_object_prototype_map);
     764          79 : }
     765             : 
     766        1817 : void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
     767             :   // %AsyncIteratorPrototype%
     768             :   // proposal-async-iteration/#sec-asynciteratorprototype
     769             :   Handle<JSObject> async_iterator_prototype =
     770         158 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     771             : 
     772             :   Handle<JSFunction> async_iterator_prototype_iterator = SimpleCreateFunction(
     773             :       isolate(), factory()->NewStringFromAsciiChecked("[Symbol.asyncIterator]"),
     774         158 :       Builtins::kReturnReceiver, 0, true);
     775             : 
     776             :   JSObject::AddProperty(async_iterator_prototype,
     777             :                         factory()->async_iterator_symbol(),
     778          79 :                         async_iterator_prototype_iterator, DONT_ENUM);
     779             : 
     780             :   // %AsyncFromSyncIteratorPrototype%
     781             :   // proposal-async-iteration/#sec-%asyncfromsynciteratorprototype%-object
     782             :   Handle<JSObject> async_from_sync_iterator_prototype =
     783         158 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     784             :   SimpleInstallFunction(async_from_sync_iterator_prototype,
     785             :                         factory()->next_string(),
     786          79 :                         Builtins::kAsyncFromSyncIteratorPrototypeNext, 1, true);
     787             :   SimpleInstallFunction(
     788             :       async_from_sync_iterator_prototype, factory()->return_string(),
     789          79 :       Builtins::kAsyncFromSyncIteratorPrototypeReturn, 1, true);
     790             :   SimpleInstallFunction(
     791             :       async_from_sync_iterator_prototype, factory()->throw_string(),
     792          79 :       Builtins::kAsyncFromSyncIteratorPrototypeThrow, 1, true);
     793             : 
     794             :   JSObject::AddProperty(
     795             :       async_from_sync_iterator_prototype, factory()->to_string_tag_symbol(),
     796             :       factory()->NewStringFromAsciiChecked("Async-from-Sync Iterator"),
     797         158 :       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     798             : 
     799             :   JSObject::ForceSetPrototype(async_from_sync_iterator_prototype,
     800          79 :                               async_iterator_prototype);
     801             : 
     802             :   Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
     803          79 :       JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
     804             :   Map::SetPrototype(async_from_sync_iterator_map,
     805          79 :                     async_from_sync_iterator_prototype);
     806             :   native_context()->set_async_from_sync_iterator_map(
     807             :       *async_from_sync_iterator_map);
     808             : 
     809             :   // Async Generators
     810             :   Handle<String> AsyncGeneratorFunction_string =
     811          79 :       factory()->NewStringFromAsciiChecked("AsyncGeneratorFunction", TENURED);
     812             : 
     813             :   Handle<JSObject> async_generator_object_prototype =
     814         158 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     815             :   Handle<JSObject> async_generator_function_prototype =
     816         158 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     817             : 
     818             :   // %AsyncGenerator% / %AsyncGeneratorFunction%.prototype
     819          79 :   JSObject::ForceSetPrototype(async_generator_function_prototype, empty);
     820             : 
     821             :   // The value of AsyncGeneratorFunction.prototype.prototype is the
     822             :   //     %AsyncGeneratorPrototype% intrinsic object.
     823             :   // This property has the attributes
     824             :   //     { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
     825             :   JSObject::AddProperty(async_generator_function_prototype,
     826             :                         factory()->prototype_string(),
     827             :                         async_generator_object_prototype,
     828          79 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     829             :   JSObject::AddProperty(async_generator_function_prototype,
     830             :                         factory()->to_string_tag_symbol(),
     831             :                         AsyncGeneratorFunction_string,
     832          79 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     833             : 
     834             :   // %AsyncGeneratorPrototype%
     835             :   JSObject::ForceSetPrototype(async_generator_object_prototype,
     836          79 :                               async_iterator_prototype);
     837             : 
     838             :   JSObject::AddProperty(async_generator_object_prototype,
     839             :                         factory()->to_string_tag_symbol(),
     840             :                         factory()->NewStringFromAsciiChecked("AsyncGenerator"),
     841         158 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     842             :   SimpleInstallFunction(async_generator_object_prototype, "next",
     843          79 :                         Builtins::kAsyncGeneratorPrototypeNext, 1, true);
     844             :   SimpleInstallFunction(async_generator_object_prototype, "return",
     845          79 :                         Builtins::kAsyncGeneratorPrototypeReturn, 1, true);
     846             :   SimpleInstallFunction(async_generator_object_prototype, "throw",
     847          79 :                         Builtins::kAsyncGeneratorPrototypeThrow, 1, true);
     848             : 
     849             :   // Create maps for generator functions and their prototypes.  Store those
     850             :   // maps in the native context. The "prototype" property descriptor is
     851             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     852             :   // 04-14-15, section 25.2.4.3).
     853          79 :   Handle<Map> strict_function_map(strict_function_map_writable_prototype_);
     854             :   // Async Generator functions do not have "caller" or "arguments" accessors.
     855             :   Handle<Map> async_generator_function_map =
     856          79 :       Map::Copy(strict_function_map, "AsyncGeneratorFunction");
     857             :   async_generator_function_map->set_is_constructor(false);
     858             :   Map::SetPrototype(async_generator_function_map,
     859          79 :                     async_generator_function_prototype);
     860             :   native_context()->set_async_generator_function_map(
     861             :       *async_generator_function_map);
     862             : 
     863             :   Handle<JSFunction> object_function(native_context()->object_function());
     864          79 :   Handle<Map> async_generator_object_prototype_map = Map::Create(isolate(), 0);
     865             :   Map::SetPrototype(async_generator_object_prototype_map,
     866          79 :                     async_generator_object_prototype);
     867             :   native_context()->set_async_generator_object_prototype_map(
     868             :       *async_generator_object_prototype_map);
     869          79 : }
     870             : 
     871         316 : void Genesis::CreateAsyncFunctionMaps(Handle<JSFunction> empty) {
     872             :   // %AsyncFunctionPrototype% intrinsic
     873             :   Handle<JSObject> async_function_prototype =
     874         158 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     875          79 :   JSObject::ForceSetPrototype(async_function_prototype, empty);
     876             : 
     877             :   JSObject::AddProperty(async_function_prototype,
     878             :                         factory()->to_string_tag_symbol(),
     879             :                         factory()->NewStringFromAsciiChecked("AsyncFunction"),
     880         158 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     881             : 
     882             :   Handle<Map> strict_function_map(
     883             :       native_context()->strict_function_without_prototype_map());
     884             :   Handle<Map> async_function_map =
     885          79 :       Map::Copy(strict_function_map, "AsyncFunction");
     886             :   async_function_map->set_is_constructor(false);
     887          79 :   Map::SetPrototype(async_function_map, async_function_prototype);
     888             :   native_context()->set_async_function_map(*async_function_map);
     889          79 : }
     890             : 
     891         158 : void Genesis::CreateJSProxyMaps() {
     892             :   // Allocate the different maps for all Proxy types.
     893             :   // Next to the default proxy, we need maps indicating callable and
     894             :   // constructable proxies.
     895             :   Handle<Map> proxy_function_map =
     896          79 :       Map::Copy(isolate()->sloppy_function_without_prototype_map(), "Proxy");
     897             :   proxy_function_map->set_is_constructor(true);
     898             :   native_context()->set_proxy_function_map(*proxy_function_map);
     899             : 
     900             :   Handle<Map> proxy_map =
     901          79 :       factory()->NewMap(JS_PROXY_TYPE, JSProxy::kSize, FAST_ELEMENTS);
     902             :   proxy_map->set_dictionary_map(true);
     903             :   native_context()->set_proxy_map(*proxy_map);
     904             : 
     905          79 :   Handle<Map> proxy_callable_map = Map::Copy(proxy_map, "callable Proxy");
     906             :   proxy_callable_map->set_is_callable();
     907             :   native_context()->set_proxy_callable_map(*proxy_callable_map);
     908             :   proxy_callable_map->SetConstructor(native_context()->function_function());
     909             : 
     910             :   Handle<Map> proxy_constructor_map =
     911          79 :       Map::Copy(proxy_callable_map, "constructor Proxy");
     912             :   proxy_constructor_map->set_is_constructor(true);
     913             :   native_context()->set_proxy_constructor_map(*proxy_constructor_map);
     914          79 : }
     915             : 
     916         158 : static void ReplaceAccessors(Handle<Map> map,
     917             :                              Handle<String> name,
     918             :                              PropertyAttributes attributes,
     919             :                              Handle<AccessorPair> accessor_pair) {
     920             :   DescriptorArray* descriptors = map->instance_descriptors();
     921             :   int idx = descriptors->SearchWithCache(map->GetIsolate(), *name, *map);
     922             :   Descriptor d = Descriptor::AccessorConstant(name, accessor_pair, attributes);
     923         158 :   descriptors->Replace(idx, &d);
     924         158 : }
     925             : 
     926         316 : void Genesis::AddRestrictedFunctionProperties(Handle<JSFunction> empty) {
     927             :   PropertyAttributes rw_attribs = static_cast<PropertyAttributes>(DONT_ENUM);
     928          79 :   Handle<JSFunction> thrower = GetRestrictedFunctionPropertiesThrower();
     929          79 :   Handle<AccessorPair> accessors = factory()->NewAccessorPair();
     930          79 :   accessors->set_getter(*thrower);
     931          79 :   accessors->set_setter(*thrower);
     932             : 
     933             :   Handle<Map> map(empty->map());
     934          79 :   ReplaceAccessors(map, factory()->arguments_string(), rw_attribs, accessors);
     935          79 :   ReplaceAccessors(map, factory()->caller_string(), rw_attribs, accessors);
     936          79 : }
     937             : 
     938             : 
     939      106927 : static void AddToWeakNativeContextList(Context* context) {
     940             :   DCHECK(context->IsNativeContext());
     941             :   Isolate* isolate = context->GetIsolate();
     942      106927 :   Heap* heap = isolate->heap();
     943             : #ifdef DEBUG
     944             :   { // NOLINT
     945             :     DCHECK(context->next_context_link()->IsUndefined(isolate));
     946             :     // Check that context is not in the list yet.
     947             :     for (Object* current = heap->native_contexts_list();
     948             :          !current->IsUndefined(isolate);
     949             :          current = Context::cast(current)->next_context_link()) {
     950             :       DCHECK(current != context);
     951             :     }
     952             :   }
     953             : #endif
     954             :   context->set(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list(),
     955      106927 :                UPDATE_WEAK_WRITE_BARRIER);
     956             :   heap->set_native_contexts_list(context);
     957      106927 : }
     958             : 
     959             : 
     960         237 : void Genesis::CreateRoots() {
     961             :   // Allocate the native context FixedArray first and then patch the
     962             :   // closure and extension object later (we need the empty function
     963             :   // and the global object, but in order to create those, we need the
     964             :   // native context).
     965          79 :   native_context_ = factory()->NewNativeContext();
     966          79 :   AddToWeakNativeContextList(*native_context());
     967             :   isolate()->set_context(*native_context());
     968             : 
     969             :   // Allocate the message listeners object.
     970             :   {
     971          79 :     Handle<TemplateList> list = TemplateList::New(isolate(), 1);
     972             :     native_context()->set_message_listeners(*list);
     973             :   }
     974          79 : }
     975             : 
     976             : 
     977         237 : void Genesis::InstallGlobalThisBinding() {
     978             :   Handle<ScriptContextTable> script_contexts(
     979             :       native_context()->script_context_table());
     980          79 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateGlobalThisBinding(isolate());
     981             :   Handle<JSFunction> closure(native_context()->closure());
     982          79 :   Handle<Context> context = factory()->NewScriptContext(closure, scope_info);
     983             : 
     984             :   // Go ahead and hook it up while we're at it.
     985          79 :   int slot = scope_info->ReceiverContextSlotIndex();
     986             :   DCHECK_EQ(slot, Context::MIN_CONTEXT_SLOTS);
     987         158 :   context->set(slot, native_context()->global_proxy());
     988             : 
     989             :   Handle<ScriptContextTable> new_script_contexts =
     990          79 :       ScriptContextTable::Extend(script_contexts, context);
     991             :   native_context()->set_script_context_table(*new_script_contexts);
     992          79 : }
     993             : 
     994             : 
     995      106897 : Handle<JSGlobalObject> Genesis::CreateNewGlobals(
     996             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
     997      916887 :     Handle<JSGlobalProxy> global_proxy) {
     998             :   // The argument global_proxy_template aka data is an ObjectTemplateInfo.
     999             :   // It has a constructor pointer that points at global_constructor which is a
    1000             :   // FunctionTemplateInfo.
    1001             :   // The global_proxy_constructor is used to (re)initialize the
    1002             :   // global_proxy. The global_proxy_constructor also has a prototype_template
    1003             :   // pointer that points at js_global_object_template which is an
    1004             :   // ObjectTemplateInfo.
    1005             :   // That in turn has a constructor pointer that points at
    1006             :   // js_global_object_constructor which is a FunctionTemplateInfo.
    1007             :   // js_global_object_constructor is used to make js_global_object_function
    1008             :   // js_global_object_function is used to make the new global_object.
    1009             :   //
    1010             :   // --- G l o b a l ---
    1011             :   // Step 1: Create a fresh JSGlobalObject.
    1012             :   Handle<JSFunction> js_global_object_function;
    1013             :   Handle<ObjectTemplateInfo> js_global_object_template;
    1014      106897 :   if (!global_proxy_template.IsEmpty()) {
    1015             :     // Get prototype template of the global_proxy_template.
    1016             :     Handle<ObjectTemplateInfo> data =
    1017             :         v8::Utils::OpenHandle(*global_proxy_template);
    1018             :     Handle<FunctionTemplateInfo> global_constructor =
    1019             :         Handle<FunctionTemplateInfo>(
    1020             :             FunctionTemplateInfo::cast(data->constructor()));
    1021             :     Handle<Object> proto_template(global_constructor->prototype_template(),
    1022             :                                   isolate());
    1023       64745 :     if (!proto_template->IsUndefined(isolate())) {
    1024             :       js_global_object_template =
    1025             :           Handle<ObjectTemplateInfo>::cast(proto_template);
    1026             :     }
    1027             :   }
    1028             : 
    1029      106897 :   if (js_global_object_template.is_null()) {
    1030       42152 :     Handle<String> name = Handle<String>(heap()->empty_string());
    1031       42152 :     Handle<Code> code = isolate()->builtins()->Illegal();
    1032             :     Handle<JSObject> prototype =
    1033       84304 :         factory()->NewFunctionPrototype(isolate()->object_function());
    1034             :     js_global_object_function = factory()->NewFunction(
    1035       42152 :         name, code, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize);
    1036             : #ifdef DEBUG
    1037             :     LookupIterator it(prototype, factory()->constructor_string(),
    1038             :                       LookupIterator::OWN_SKIP_INTERCEPTOR);
    1039             :     Handle<Object> value = Object::GetProperty(&it).ToHandleChecked();
    1040             :     DCHECK(it.IsFound());
    1041             :     DCHECK_EQ(*isolate()->object_function(), *value);
    1042             : #endif
    1043             :   } else {
    1044             :     Handle<FunctionTemplateInfo> js_global_object_constructor(
    1045             :         FunctionTemplateInfo::cast(js_global_object_template->constructor()));
    1046             :     js_global_object_function = ApiNatives::CreateApiFunction(
    1047             :         isolate(), js_global_object_constructor, factory()->the_hole_value(),
    1048       64745 :         ApiNatives::GlobalObjectType);
    1049             :   }
    1050             : 
    1051             :   js_global_object_function->initial_map()->set_is_prototype_map(true);
    1052             :   js_global_object_function->initial_map()->set_dictionary_map(true);
    1053             :   Handle<JSGlobalObject> global_object =
    1054      106897 :       factory()->NewJSGlobalObject(js_global_object_function);
    1055             : 
    1056             :   // Step 2: (re)initialize the global proxy object.
    1057             :   Handle<JSFunction> global_proxy_function;
    1058      106897 :   if (global_proxy_template.IsEmpty()) {
    1059       42152 :     Handle<String> name = Handle<String>(heap()->empty_string());
    1060       42152 :     Handle<Code> code = isolate()->builtins()->Illegal();
    1061             :     global_proxy_function =
    1062             :         factory()->NewFunction(name, code, JS_GLOBAL_PROXY_TYPE,
    1063       42152 :                                JSGlobalProxy::SizeWithEmbedderFields(0));
    1064             :   } else {
    1065             :     Handle<ObjectTemplateInfo> data =
    1066             :         v8::Utils::OpenHandle(*global_proxy_template);
    1067             :     Handle<FunctionTemplateInfo> global_constructor(
    1068             :             FunctionTemplateInfo::cast(data->constructor()));
    1069             :     global_proxy_function = ApiNatives::CreateApiFunction(
    1070             :         isolate(), global_constructor, factory()->the_hole_value(),
    1071       64745 :         ApiNatives::GlobalProxyType);
    1072             :   }
    1073             :   Handle<String> global_name = factory()->global_string();
    1074      106897 :   global_proxy_function->shared()->set_instance_class_name(*global_name);
    1075             :   global_proxy_function->initial_map()->set_is_access_check_needed(true);
    1076             :   global_proxy_function->initial_map()->set_has_hidden_prototype(true);
    1077             :   native_context()->set_global_proxy_function(*global_proxy_function);
    1078             : 
    1079             :   // Set global_proxy.__proto__ to js_global after ConfigureGlobalObjects
    1080             :   // Return the global proxy.
    1081             : 
    1082      106897 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1083             : 
    1084             :   // Set the native context for the global object.
    1085      106897 :   global_object->set_native_context(*native_context());
    1086      106897 :   global_object->set_global_proxy(*global_proxy);
    1087             :   // Set the native context of the global proxy.
    1088      106897 :   global_proxy->set_native_context(*native_context());
    1089             :   // Set the global proxy of the native context. If the native context has been
    1090             :   // deserialized, the global proxy is already correctly set up by the
    1091             :   // deserializer. Otherwise it's undefined.
    1092             :   DCHECK(native_context()
    1093             :              ->get(Context::GLOBAL_PROXY_INDEX)
    1094             :              ->IsUndefined(isolate()) ||
    1095             :          native_context()->global_proxy() == *global_proxy);
    1096      106897 :   native_context()->set_global_proxy(*global_proxy);
    1097             : 
    1098      106897 :   return global_object;
    1099             : }
    1100             : 
    1101          60 : void Genesis::HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy) {
    1102             :   // Re-initialize the global proxy with the global proxy function from the
    1103             :   // snapshot, and then set up the link to the native context.
    1104             :   Handle<JSFunction> global_proxy_function(
    1105             :       native_context()->global_proxy_function());
    1106          30 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1107             :   Handle<JSObject> global_object(
    1108          30 :       JSObject::cast(native_context()->global_object()));
    1109          30 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    1110          30 :   global_proxy->set_native_context(*native_context());
    1111             :   DCHECK(native_context()->global_proxy() == *global_proxy);
    1112          30 : }
    1113             : 
    1114      106818 : void Genesis::HookUpGlobalObject(Handle<JSGlobalObject> global_object) {
    1115             :   Handle<JSGlobalObject> global_object_from_snapshot(
    1116             :       JSGlobalObject::cast(native_context()->extension()));
    1117             :   native_context()->set_extension(*global_object);
    1118             :   native_context()->set_security_token(*global_object);
    1119             : 
    1120      106818 :   TransferNamedProperties(global_object_from_snapshot, global_object);
    1121      106818 :   TransferIndexedProperties(global_object_from_snapshot, global_object);
    1122      106818 : }
    1123             : 
    1124        5041 : static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
    1125             :                                              Handle<JSFunction> function,
    1126             :                                              int context_index) {
    1127             :   Handle<Smi> index(Smi::FromInt(context_index), isolate);
    1128             :   JSObject::AddProperty(
    1129        5041 :       function, isolate->factory()->native_context_index_symbol(), index, NONE);
    1130       10082 :   isolate->native_context()->set(context_index, *function);
    1131        5041 : }
    1132             : 
    1133         790 : static void InstallError(Isolate* isolate, Handle<JSObject> global,
    1134             :                          Handle<String> name, int context_index) {
    1135             :   Factory* factory = isolate->factory();
    1136             : 
    1137             :   Handle<JSFunction> error_fun =
    1138             :       InstallFunction(global, name, JS_ERROR_TYPE, JSObject::kHeaderSize,
    1139             :                       isolate->initial_object_prototype(),
    1140        1580 :                       Builtins::kErrorConstructor, DONT_ENUM);
    1141         790 :   error_fun->shared()->set_instance_class_name(*factory->Error_string());
    1142             :   error_fun->shared()->DontAdaptArguments();
    1143             :   error_fun->shared()->set_construct_stub(
    1144        1580 :       *isolate->builtins()->ErrorConstructor());
    1145             :   error_fun->shared()->set_length(1);
    1146             : 
    1147         790 :   if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1148             :     SimpleInstallFunction(error_fun, "captureStackTrace",
    1149          79 :                           Builtins::kErrorCaptureStackTrace, 2, false);
    1150             :   }
    1151             : 
    1152         790 :   InstallWithIntrinsicDefaultProto(isolate, error_fun, context_index);
    1153             : 
    1154             :   {
    1155             :     Handle<JSObject> prototype =
    1156         790 :         factory->NewJSObject(isolate->object_function(), TENURED);
    1157             : 
    1158         790 :     JSObject::AddProperty(prototype, factory->name_string(), name, DONT_ENUM);
    1159             :     JSObject::AddProperty(prototype, factory->message_string(),
    1160         790 :                           factory->empty_string(), DONT_ENUM);
    1161             :     JSObject::AddProperty(prototype, factory->constructor_string(), error_fun,
    1162         790 :                           DONT_ENUM);
    1163             : 
    1164         790 :     if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1165             :       Handle<JSFunction> to_string_fun =
    1166             :           SimpleInstallFunction(prototype, factory->toString_string(),
    1167          79 :                                 Builtins::kErrorPrototypeToString, 0, true);
    1168         158 :       isolate->native_context()->set_error_to_string(*to_string_fun);
    1169             :     } else {
    1170             :       DCHECK(isolate->native_context()->error_to_string()->IsJSFunction());
    1171             : 
    1172             :       InstallFunction(prototype, isolate->error_to_string(),
    1173         711 :                       factory->toString_string(), DONT_ENUM);
    1174             : 
    1175         711 :       Handle<JSFunction> global_error = isolate->error_function();
    1176        1422 :       CHECK(JSReceiver::SetPrototype(error_fun, global_error, false,
    1177             :                                      Object::THROW_ON_ERROR)
    1178             :                 .FromMaybe(false));
    1179        2133 :       CHECK(JSReceiver::SetPrototype(prototype,
    1180             :                                      handle(global_error->prototype(), isolate),
    1181             :                                      false, Object::THROW_ON_ERROR)
    1182             :                 .FromMaybe(false));
    1183             :     }
    1184             : 
    1185         790 :     JSFunction::SetPrototype(error_fun, prototype);
    1186             :   }
    1187             : 
    1188             :   Handle<Map> initial_map(error_fun->initial_map());
    1189         790 :   Map::EnsureDescriptorSlack(initial_map, 1);
    1190             : 
    1191             :   PropertyAttributes attribs = DONT_ENUM;
    1192             :   Handle<AccessorInfo> error_stack =
    1193         790 :       Accessors::ErrorStackInfo(isolate, attribs);
    1194             :   {
    1195             :     Descriptor d = Descriptor::AccessorConstant(
    1196             :         Handle<Name>(Name::cast(error_stack->name())), error_stack, attribs);
    1197         790 :     initial_map->AppendDescriptor(&d);
    1198             :   }
    1199         790 : }
    1200             : 
    1201         395 : static void InstallMakeError(Isolate* isolate, Handle<Code> code,
    1202             :                              int context_index) {
    1203             :   Handle<JSFunction> function =
    1204             :       isolate->factory()->NewFunction(isolate->factory()->empty_string(), code,
    1205         395 :                                       JS_OBJECT_TYPE, JSObject::kHeaderSize);
    1206             :   function->shared()->DontAdaptArguments();
    1207         790 :   isolate->native_context()->set(context_index, *function);
    1208         395 : }
    1209             : 
    1210             : // This is only called if we are not using snapshots.  The equivalent
    1211             : // work in the snapshot case is done in HookUpGlobalObject.
    1212          79 : void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
    1213             :                                Handle<JSFunction> empty_function,
    1214             :                                GlobalContextType context_type) {
    1215             :   // --- N a t i v e   C o n t e x t ---
    1216             :   // Use the empty function as closure (no scope info).
    1217             :   native_context()->set_closure(*empty_function);
    1218             :   native_context()->set_previous(NULL);
    1219             :   // Set extension and global object.
    1220             :   native_context()->set_extension(*global_object);
    1221             :   // Security setup: Set the security token of the native context to the global
    1222             :   // object. This makes the security check between two different contexts fail
    1223             :   // by default even in case of global object reinitialization.
    1224             :   native_context()->set_security_token(*global_object);
    1225             : 
    1226             :   Isolate* isolate = global_object->GetIsolate();
    1227             :   Factory* factory = isolate->factory();
    1228             : 
    1229             :   native_context()->set_osr_code_table(*factory->empty_fixed_array());
    1230             : 
    1231             :   Handle<ScriptContextTable> script_context_table =
    1232          79 :       factory->NewScriptContextTable();
    1233             :   native_context()->set_script_context_table(*script_context_table);
    1234          79 :   InstallGlobalThisBinding();
    1235             : 
    1236             :   {  // --- O b j e c t ---
    1237             :     Handle<String> object_name = factory->Object_string();
    1238          79 :     Handle<JSFunction> object_function = isolate->object_function();
    1239             :     JSObject::AddProperty(global_object, object_name, object_function,
    1240          79 :                           DONT_ENUM);
    1241             : 
    1242             :     SimpleInstallFunction(object_function, factory->assign_string(),
    1243          79 :                           Builtins::kObjectAssign, 2, false);
    1244             :     SimpleInstallFunction(object_function, "getOwnPropertyDescriptor",
    1245          79 :                           Builtins::kObjectGetOwnPropertyDescriptor, 2, false);
    1246             :     SimpleInstallFunction(object_function,
    1247             :                           factory->getOwnPropertyDescriptors_string(),
    1248          79 :                           Builtins::kObjectGetOwnPropertyDescriptors, 1, false);
    1249             :     SimpleInstallFunction(object_function, "getOwnPropertyNames",
    1250          79 :                           Builtins::kObjectGetOwnPropertyNames, 1, false);
    1251             :     SimpleInstallFunction(object_function, "getOwnPropertySymbols",
    1252          79 :                           Builtins::kObjectGetOwnPropertySymbols, 1, false);
    1253             :     SimpleInstallFunction(object_function, "is",
    1254          79 :                           Builtins::kObjectIs, 2, true);
    1255             :     SimpleInstallFunction(object_function, "preventExtensions",
    1256          79 :                           Builtins::kObjectPreventExtensions, 1, false);
    1257             :     SimpleInstallFunction(object_function, "seal",
    1258          79 :                           Builtins::kObjectSeal, 1, false);
    1259             : 
    1260             :     Handle<JSFunction> object_create =
    1261             :         SimpleInstallFunction(object_function, factory->create_string(),
    1262          79 :                               Builtins::kObjectCreate, 2, true);
    1263             :     native_context()->set_object_create(*object_create);
    1264             : 
    1265             :     Handle<JSFunction> object_define_properties = SimpleInstallFunction(
    1266             :         object_function, "defineProperties",
    1267          79 :         Builtins::kObjectDefineProperties, 2, true);
    1268             :     native_context()->set_object_define_properties(*object_define_properties);
    1269             : 
    1270             :     Handle<JSFunction> object_define_property = SimpleInstallFunction(
    1271             :         object_function, factory->defineProperty_string(),
    1272          79 :         Builtins::kObjectDefineProperty, 3, true);
    1273             :     native_context()->set_object_define_property(*object_define_property);
    1274             : 
    1275             :     Handle<JSFunction> object_freeze = SimpleInstallFunction(
    1276          79 :         object_function, "freeze", Builtins::kObjectFreeze, 1, false);
    1277             :     native_context()->set_object_freeze(*object_freeze);
    1278             : 
    1279             :     Handle<JSFunction> object_get_prototype_of = SimpleInstallFunction(
    1280             :         object_function, "getPrototypeOf", Builtins::kObjectGetPrototypeOf,
    1281          79 :         1, false);
    1282             :     native_context()->set_object_get_prototype_of(*object_get_prototype_of);
    1283             :     SimpleInstallFunction(object_function, "setPrototypeOf",
    1284          79 :                           Builtins::kObjectSetPrototypeOf, 2, false);
    1285             : 
    1286             :     Handle<JSFunction> object_is_extensible = SimpleInstallFunction(
    1287             :         object_function, "isExtensible", Builtins::kObjectIsExtensible,
    1288          79 :         1, false);
    1289             :     native_context()->set_object_is_extensible(*object_is_extensible);
    1290             : 
    1291             :     Handle<JSFunction> object_is_frozen = SimpleInstallFunction(
    1292          79 :         object_function, "isFrozen", Builtins::kObjectIsFrozen, 1, false);
    1293             :     native_context()->set_object_is_frozen(*object_is_frozen);
    1294             : 
    1295             :     Handle<JSFunction> object_is_sealed = SimpleInstallFunction(
    1296          79 :         object_function, "isSealed", Builtins::kObjectIsSealed, 1, false);
    1297             :     native_context()->set_object_is_sealed(*object_is_sealed);
    1298             : 
    1299             :     Handle<JSFunction> object_keys = SimpleInstallFunction(
    1300          79 :         object_function, "keys", Builtins::kObjectKeys, 1, false);
    1301             :     native_context()->set_object_keys(*object_keys);
    1302             :     SimpleInstallFunction(object_function, factory->entries_string(),
    1303          79 :                           Builtins::kObjectEntries, 1, false);
    1304             :     SimpleInstallFunction(object_function, factory->values_string(),
    1305          79 :                           Builtins::kObjectValues, 1, false);
    1306             : 
    1307             :     SimpleInstallFunction(isolate->initial_object_prototype(),
    1308             :                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
    1309          79 :                           true);
    1310             :     SimpleInstallFunction(isolate->initial_object_prototype(),
    1311             :                           "__defineSetter__", Builtins::kObjectDefineSetter, 2,
    1312          79 :                           true);
    1313             :     SimpleInstallFunction(isolate->initial_object_prototype(), "hasOwnProperty",
    1314          79 :                           Builtins::kObjectHasOwnProperty, 1, true);
    1315             :     SimpleInstallFunction(isolate->initial_object_prototype(),
    1316             :                           "__lookupGetter__", Builtins::kObjectLookupGetter, 1,
    1317          79 :                           true);
    1318             :     SimpleInstallFunction(isolate->initial_object_prototype(),
    1319             :                           "__lookupSetter__", Builtins::kObjectLookupSetter, 1,
    1320          79 :                           true);
    1321             :     SimpleInstallFunction(
    1322             :         isolate->initial_object_prototype(), "propertyIsEnumerable",
    1323          79 :         Builtins::kObjectPrototypePropertyIsEnumerable, 1, false);
    1324             :     Handle<JSFunction> object_to_string = SimpleInstallFunction(
    1325             :         isolate->initial_object_prototype(), factory->toString_string(),
    1326          79 :         Builtins::kObjectProtoToString, 0, true);
    1327             :     native_context()->set_object_to_string(*object_to_string);
    1328             :     Handle<JSFunction> object_value_of = SimpleInstallFunction(
    1329             :         isolate->initial_object_prototype(), "valueOf",
    1330          79 :         Builtins::kObjectPrototypeValueOf, 0, true);
    1331             :     native_context()->set_object_value_of(*object_value_of);
    1332             : 
    1333             :     SimpleInstallGetterSetter(isolate->initial_object_prototype(),
    1334             :                               factory->proto_string(),
    1335             :                               Builtins::kObjectPrototypeGetProto,
    1336          79 :                               Builtins::kObjectPrototypeSetProto, DONT_ENUM);
    1337             :   }
    1338             : 
    1339          79 :   Handle<JSObject> global(native_context()->global_object());
    1340             : 
    1341             :   {  // --- F u n c t i o n ---
    1342          79 :     Handle<JSFunction> prototype = empty_function;
    1343             :     Handle<JSFunction> function_fun =
    1344             :         InstallFunction(global, "Function", JS_FUNCTION_TYPE, JSFunction::kSize,
    1345          79 :                         prototype, Builtins::kFunctionConstructor);
    1346             :     function_fun->set_prototype_or_initial_map(
    1347          79 :         *sloppy_function_map_writable_prototype_);
    1348             :     function_fun->shared()->DontAdaptArguments();
    1349             :     function_fun->shared()->SetConstructStub(
    1350         158 :         *isolate->builtins()->FunctionConstructor());
    1351             :     function_fun->shared()->set_length(1);
    1352             :     InstallWithIntrinsicDefaultProto(isolate, function_fun,
    1353          79 :                                      Context::FUNCTION_FUNCTION_INDEX);
    1354             : 
    1355             :     // Setup the methods on the %FunctionPrototype%.
    1356             :     SimpleInstallFunction(prototype, factory->apply_string(),
    1357          79 :                           Builtins::kFunctionPrototypeApply, 2, false);
    1358             :     SimpleInstallFunction(prototype, factory->bind_string(),
    1359          79 :                           Builtins::kFastFunctionPrototypeBind, 1, false);
    1360             :     SimpleInstallFunction(prototype, factory->call_string(),
    1361          79 :                           Builtins::kFunctionPrototypeCall, 1, false);
    1362             :     SimpleInstallFunction(prototype, factory->toString_string(),
    1363          79 :                           Builtins::kFunctionPrototypeToString, 0, false);
    1364             : 
    1365             :     // Install the @@hasInstance function.
    1366             :     Handle<JSFunction> has_instance = InstallFunction(
    1367             :         prototype, factory->has_instance_symbol(), JS_OBJECT_TYPE,
    1368             :         JSObject::kHeaderSize, MaybeHandle<JSObject>(),
    1369             :         Builtins::kFunctionPrototypeHasInstance,
    1370          79 :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY));
    1371             :     has_instance->shared()->set_builtin_function_id(kFunctionHasInstance);
    1372             :     native_context()->set_function_has_instance(*has_instance);
    1373             : 
    1374             :     // Set the expected parameters for @@hasInstance to 1; required by builtin.
    1375             :     has_instance->shared()->set_internal_formal_parameter_count(1);
    1376             : 
    1377             :     // Set the length for the function to satisfy ECMA-262.
    1378             :     has_instance->shared()->set_length(1);
    1379             : 
    1380             :     // Install the "constructor" property on the %FunctionPrototype%.
    1381             :     JSObject::AddProperty(prototype, factory->constructor_string(),
    1382          79 :                           function_fun, DONT_ENUM);
    1383             : 
    1384             :     sloppy_function_map_writable_prototype_->SetConstructor(*function_fun);
    1385             :     strict_function_map_writable_prototype_->SetConstructor(*function_fun);
    1386             :     class_function_map_->SetConstructor(*function_fun);
    1387             :   }
    1388             : 
    1389             :   {
    1390             :     // --- A s y n c F r o m S y n c I t e r a t o r
    1391          79 :     Handle<Code> code = isolate->builtins()->AsyncIteratorValueUnwrap();
    1392             :     Handle<SharedFunctionInfo> info =
    1393          79 :         factory->NewSharedFunctionInfo(factory->empty_string(), code, false);
    1394             :     info->set_internal_formal_parameter_count(1);
    1395             :     info->set_length(1);
    1396             :     native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
    1397             :   }
    1398             : 
    1399             :   {  // --- A s y n c G e n e r a t o r ---
    1400             :     Handle<JSFunction> await_caught =
    1401             :         SimpleCreateFunction(isolate, factory->empty_string(),
    1402          79 :                              Builtins::kAsyncGeneratorAwaitCaught, 2, false);
    1403             :     InstallWithIntrinsicDefaultProto(isolate, await_caught,
    1404          79 :                                      Context::ASYNC_GENERATOR_AWAIT_CAUGHT);
    1405             : 
    1406             :     Handle<JSFunction> await_uncaught =
    1407             :         SimpleCreateFunction(isolate, factory->empty_string(),
    1408          79 :                              Builtins::kAsyncGeneratorAwaitUncaught, 2, false);
    1409             :     InstallWithIntrinsicDefaultProto(isolate, await_uncaught,
    1410          79 :                                      Context::ASYNC_GENERATOR_AWAIT_UNCAUGHT);
    1411             : 
    1412             :     Handle<Code> code =
    1413          79 :         isolate->builtins()->AsyncGeneratorAwaitResolveClosure();
    1414             :     Handle<SharedFunctionInfo> info =
    1415          79 :         factory->NewSharedFunctionInfo(factory->empty_string(), code, false);
    1416             :     info->set_internal_formal_parameter_count(1);
    1417             :     info->set_length(1);
    1418             :     native_context()->set_async_generator_await_resolve_shared_fun(*info);
    1419             : 
    1420             :     code = handle(isolate->builtins()->builtin(
    1421             :                       Builtins::kAsyncGeneratorAwaitRejectClosure),
    1422             :                   isolate);
    1423          79 :     info = factory->NewSharedFunctionInfo(factory->empty_string(), code, false);
    1424             :     info->set_internal_formal_parameter_count(1);
    1425             :     info->set_length(1);
    1426             :     native_context()->set_async_generator_await_reject_shared_fun(*info);
    1427             :   }
    1428             : 
    1429             :   {  // --- A r r a y ---
    1430             :     Handle<JSFunction> array_function =
    1431             :         InstallFunction(global, "Array", JS_ARRAY_TYPE, JSArray::kSize,
    1432             :                         isolate->initial_object_prototype(),
    1433         158 :                         Builtins::kArrayCode);
    1434             :     array_function->shared()->DontAdaptArguments();
    1435             :     array_function->shared()->set_builtin_function_id(kArrayCode);
    1436             : 
    1437             :     // This seems a bit hackish, but we need to make sure Array.length
    1438             :     // is 1.
    1439             :     array_function->shared()->set_length(1);
    1440             : 
    1441             :     Handle<Map> initial_map(array_function->initial_map());
    1442             : 
    1443             :     // This assert protects an optimization in
    1444             :     // HGraphBuilder::JSArrayBuilder::EmitMapCode()
    1445             :     DCHECK(initial_map->elements_kind() == GetInitialFastElementsKind());
    1446          79 :     Map::EnsureDescriptorSlack(initial_map, 1);
    1447             : 
    1448             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1449             :         DONT_ENUM | DONT_DELETE);
    1450             : 
    1451             :     Handle<AccessorInfo> array_length =
    1452          79 :         Accessors::ArrayLengthInfo(isolate, attribs);
    1453             :     {  // Add length.
    1454             :       Descriptor d = Descriptor::AccessorConstant(
    1455             :           Handle<Name>(Name::cast(array_length->name())), array_length,
    1456             :           attribs);
    1457          79 :       initial_map->AppendDescriptor(&d);
    1458             :     }
    1459             : 
    1460             :     InstallWithIntrinsicDefaultProto(isolate, array_function,
    1461          79 :                                      Context::ARRAY_FUNCTION_INDEX);
    1462          79 :     InstallSpeciesGetter(array_function);
    1463             : 
    1464             :     // Cache the array maps, needed by ArrayConstructorStub
    1465          79 :     CacheInitialJSArrayMaps(native_context(), initial_map);
    1466          79 :     ArrayConstructorStub array_constructor_stub(isolate);
    1467          79 :     Handle<Code> code = array_constructor_stub.GetCode();
    1468          79 :     array_function->shared()->SetConstructStub(*code);
    1469             : 
    1470             :     // Set up %ArrayPrototype%.
    1471             :     Handle<JSArray> array_prototype =
    1472          79 :         Handle<JSArray>::cast(factory->NewJSObject(array_function, TENURED));
    1473          79 :     JSArray::Initialize(array_prototype, 0);
    1474          79 :     JSFunction::SetPrototype(array_function, array_prototype);
    1475             :     native_context()->set_initial_array_prototype(*array_prototype);
    1476             : 
    1477             :     Handle<JSFunction> is_arraylike = SimpleInstallFunction(
    1478             :         array_function, isolate->factory()->InternalizeUtf8String("isArray"),
    1479         158 :         Builtins::kArrayIsArray, 1, true);
    1480             :     native_context()->set_is_arraylike(*is_arraylike);
    1481             :   }
    1482             : 
    1483             :   {  // --- A r r a y I t e r a t o r ---
    1484             :     Handle<JSObject> iterator_prototype(
    1485             :         native_context()->initial_iterator_prototype());
    1486             : 
    1487             :     Handle<JSObject> array_iterator_prototype =
    1488          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    1489          79 :     JSObject::ForceSetPrototype(array_iterator_prototype, iterator_prototype);
    1490             : 
    1491             :     JSObject::AddProperty(
    1492             :         array_iterator_prototype, factory->to_string_tag_symbol(),
    1493             :         factory->ArrayIterator_string(),
    1494          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1495             : 
    1496             :     Handle<JSFunction> next = InstallFunction(
    1497             :         array_iterator_prototype, "next", JS_OBJECT_TYPE, JSObject::kHeaderSize,
    1498          79 :         MaybeHandle<JSObject>(), Builtins::kArrayIteratorPrototypeNext);
    1499             :     next->shared()->set_builtin_function_id(kArrayIteratorNext);
    1500             : 
    1501             :     // Set the expected parameters for %ArrayIteratorPrototype%.next to 0 (not
    1502             :     // including the receiver), as required by the builtin.
    1503             :     next->shared()->set_internal_formal_parameter_count(0);
    1504             : 
    1505             :     // Set the length for the function to satisfy ECMA-262.
    1506             :     next->shared()->set_length(0);
    1507             : 
    1508             :     Handle<JSFunction> array_iterator_function = CreateFunction(
    1509             :         isolate, factory->ArrayIterator_string(),
    1510             :         JS_FAST_ARRAY_VALUE_ITERATOR_TYPE, JSArrayIterator::kSize,
    1511          79 :         array_iterator_prototype, Builtins::kIllegal);
    1512             :     array_iterator_function->shared()->set_native(false);
    1513             :     array_iterator_function->shared()->set_instance_class_name(
    1514          79 :         isolate->heap()->ArrayIterator_string());
    1515             : 
    1516             :     native_context()->set_initial_array_iterator_prototype(
    1517             :         *array_iterator_prototype);
    1518             :     native_context()->set_initial_array_iterator_prototype_map(
    1519             :         array_iterator_prototype->map());
    1520             : 
    1521             :     Handle<Map> initial_map(array_iterator_function->initial_map(), isolate);
    1522             : 
    1523             : #define ARRAY_ITERATOR_LIST(V)                                              \
    1524             :   V(TYPED_ARRAY, KEY, typed_array, key)                                     \
    1525             :   V(FAST_ARRAY, KEY, fast_array, key)                                       \
    1526             :   V(GENERIC_ARRAY, KEY, array, key)                                         \
    1527             :   V(UINT8_ARRAY, KEY_VALUE, uint8_array, key_value)                         \
    1528             :   V(INT8_ARRAY, KEY_VALUE, int8_array, key_value)                           \
    1529             :   V(UINT16_ARRAY, KEY_VALUE, uint16_array, key_value)                       \
    1530             :   V(INT16_ARRAY, KEY_VALUE, int16_array, key_value)                         \
    1531             :   V(UINT32_ARRAY, KEY_VALUE, uint32_array, key_value)                       \
    1532             :   V(INT32_ARRAY, KEY_VALUE, int32_array, key_value)                         \
    1533             :   V(FLOAT32_ARRAY, KEY_VALUE, float32_array, key_value)                     \
    1534             :   V(FLOAT64_ARRAY, KEY_VALUE, float64_array, key_value)                     \
    1535             :   V(UINT8_CLAMPED_ARRAY, KEY_VALUE, uint8_clamped_array, key_value)         \
    1536             :   V(FAST_SMI_ARRAY, KEY_VALUE, fast_smi_array, key_value)                   \
    1537             :   V(FAST_HOLEY_SMI_ARRAY, KEY_VALUE, fast_holey_smi_array, key_value)       \
    1538             :   V(FAST_ARRAY, KEY_VALUE, fast_array, key_value)                           \
    1539             :   V(FAST_HOLEY_ARRAY, KEY_VALUE, fast_holey_array, key_value)               \
    1540             :   V(FAST_DOUBLE_ARRAY, KEY_VALUE, fast_double_array, key_value)             \
    1541             :   V(FAST_HOLEY_DOUBLE_ARRAY, KEY_VALUE, fast_holey_double_array, key_value) \
    1542             :   V(GENERIC_ARRAY, KEY_VALUE, array, key_value)                             \
    1543             :   V(UINT8_ARRAY, VALUE, uint8_array, value)                                 \
    1544             :   V(INT8_ARRAY, VALUE, int8_array, value)                                   \
    1545             :   V(UINT16_ARRAY, VALUE, uint16_array, value)                               \
    1546             :   V(INT16_ARRAY, VALUE, int16_array, value)                                 \
    1547             :   V(UINT32_ARRAY, VALUE, uint32_array, value)                               \
    1548             :   V(INT32_ARRAY, VALUE, int32_array, value)                                 \
    1549             :   V(FLOAT32_ARRAY, VALUE, float32_array, value)                             \
    1550             :   V(FLOAT64_ARRAY, VALUE, float64_array, value)                             \
    1551             :   V(UINT8_CLAMPED_ARRAY, VALUE, uint8_clamped_array, value)                 \
    1552             :   V(FAST_SMI_ARRAY, VALUE, fast_smi_array, value)                           \
    1553             :   V(FAST_HOLEY_SMI_ARRAY, VALUE, fast_holey_smi_array, value)               \
    1554             :   V(FAST_ARRAY, VALUE, fast_array, value)                                   \
    1555             :   V(FAST_HOLEY_ARRAY, VALUE, fast_holey_array, value)                       \
    1556             :   V(FAST_DOUBLE_ARRAY, VALUE, fast_double_array, value)                     \
    1557             :   V(FAST_HOLEY_DOUBLE_ARRAY, VALUE, fast_holey_double_array, value)         \
    1558             :   V(GENERIC_ARRAY, VALUE, array, value)
    1559             : 
    1560             : #define CREATE_ARRAY_ITERATOR_MAP(PREFIX, SUFFIX, prefix, suffix)           \
    1561             :   do {                                                                      \
    1562             :     const InstanceType type = JS_##PREFIX##_##SUFFIX##_ITERATOR_TYPE;       \
    1563             :     Handle<Map> map =                                                       \
    1564             :         Map::Copy(initial_map, "JS_" #PREFIX "_" #SUFFIX "_ITERATOR_TYPE"); \
    1565             :     map->set_instance_type(type);                                           \
    1566             :     native_context()->set_##prefix##_##suffix##_iterator_map(*map);         \
    1567             :   } while (0);
    1568             : 
    1569        2765 :     ARRAY_ITERATOR_LIST(CREATE_ARRAY_ITERATOR_MAP)
    1570             : 
    1571             : #undef CREATE_ARRAY_ITERATOR_MAP
    1572             : #undef ARRAY_ITERATOR_LIST
    1573             :   }
    1574             : 
    1575             :   {  // --- N u m b e r ---
    1576             :     Handle<JSFunction> number_fun = InstallFunction(
    1577             :         global, "Number", JS_VALUE_TYPE, JSValue::kSize,
    1578         158 :         isolate->initial_object_prototype(), Builtins::kNumberConstructor);
    1579             :     number_fun->shared()->DontAdaptArguments();
    1580             :     number_fun->shared()->SetConstructStub(
    1581         158 :         *isolate->builtins()->NumberConstructor_ConstructStub());
    1582             :     number_fun->shared()->set_length(1);
    1583             :     InstallWithIntrinsicDefaultProto(isolate, number_fun,
    1584          79 :                                      Context::NUMBER_FUNCTION_INDEX);
    1585             : 
    1586             :     // Create the %NumberPrototype%
    1587             :     Handle<JSValue> prototype =
    1588          79 :         Handle<JSValue>::cast(factory->NewJSObject(number_fun, TENURED));
    1589          79 :     prototype->set_value(Smi::kZero);
    1590          79 :     JSFunction::SetPrototype(number_fun, prototype);
    1591             : 
    1592             :     // Install the "constructor" property on the {prototype}.
    1593             :     JSObject::AddProperty(prototype, factory->constructor_string(), number_fun,
    1594          79 :                           DONT_ENUM);
    1595             : 
    1596             :     // Install the Number.prototype methods.
    1597             :     SimpleInstallFunction(prototype, "toExponential",
    1598          79 :                           Builtins::kNumberPrototypeToExponential, 1, false);
    1599             :     SimpleInstallFunction(prototype, "toFixed",
    1600          79 :                           Builtins::kNumberPrototypeToFixed, 1, false);
    1601             :     SimpleInstallFunction(prototype, "toPrecision",
    1602          79 :                           Builtins::kNumberPrototypeToPrecision, 1, false);
    1603             :     SimpleInstallFunction(prototype, "toString",
    1604          79 :                           Builtins::kNumberPrototypeToString, 1, false);
    1605             :     SimpleInstallFunction(prototype, "valueOf",
    1606          79 :                           Builtins::kNumberPrototypeValueOf, 0, true);
    1607             : 
    1608             :     // Install Intl fallback functions.
    1609             :     SimpleInstallFunction(prototype, "toLocaleString",
    1610          79 :                           Builtins::kNumberPrototypeToLocaleString, 0, false);
    1611             : 
    1612             :     // Install the Number functions.
    1613             :     SimpleInstallFunction(number_fun, "isFinite", Builtins::kNumberIsFinite, 1,
    1614          79 :                           true);
    1615             :     SimpleInstallFunction(number_fun, "isInteger", Builtins::kNumberIsInteger,
    1616          79 :                           1, true);
    1617          79 :     SimpleInstallFunction(number_fun, "isNaN", Builtins::kNumberIsNaN, 1, true);
    1618             :     SimpleInstallFunction(number_fun, "isSafeInteger",
    1619          79 :                           Builtins::kNumberIsSafeInteger, 1, true);
    1620             : 
    1621             :     // Install Number.parseFloat and Global.parseFloat.
    1622             :     Handle<JSFunction> parse_float_fun = SimpleInstallFunction(
    1623          79 :         number_fun, "parseFloat", Builtins::kNumberParseFloat, 1, true);
    1624             :     JSObject::AddProperty(global_object,
    1625             :                           factory->NewStringFromAsciiChecked("parseFloat"),
    1626         158 :                           parse_float_fun, DONT_ENUM);
    1627             : 
    1628             :     // Install Number.parseInt and Global.parseInt.
    1629             :     Handle<JSFunction> parse_int_fun = SimpleInstallFunction(
    1630          79 :         number_fun, "parseInt", Builtins::kNumberParseInt, 2, true);
    1631             :     JSObject::AddProperty(global_object,
    1632             :                           factory->NewStringFromAsciiChecked("parseInt"),
    1633         158 :                           parse_int_fun, DONT_ENUM);
    1634             : 
    1635             :     // Install Number constants
    1636             :     double kMaxValue = 1.7976931348623157e+308;
    1637             :     double kMinValue = 5e-324;
    1638             : 
    1639             :     double kMaxSafeInt = 9007199254740991;
    1640             :     double kMinSafeInt = -9007199254740991;
    1641             :     double kEPS = 2.220446049250313e-16;
    1642             : 
    1643             :     Handle<Object> infinity = factory->infinity_value();
    1644             :     Handle<Object> nan = factory->nan_value();
    1645          79 :     Handle<String> nan_name = factory->NewStringFromAsciiChecked("NaN");
    1646             : 
    1647             :     JSObject::AddProperty(
    1648             :         number_fun, factory->NewStringFromAsciiChecked("MAX_VALUE"),
    1649             :         factory->NewNumber(kMaxValue),
    1650         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1651             :     JSObject::AddProperty(
    1652             :         number_fun, factory->NewStringFromAsciiChecked("MIN_VALUE"),
    1653             :         factory->NewNumber(kMinValue),
    1654         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1655             :     JSObject::AddProperty(
    1656             :         number_fun, nan_name, nan,
    1657          79 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1658             :     JSObject::AddProperty(
    1659             :         number_fun, factory->NewStringFromAsciiChecked("NEGATIVE_INFINITY"),
    1660             :         factory->NewNumber(-V8_INFINITY),
    1661         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1662             :     JSObject::AddProperty(
    1663             :         number_fun, factory->NewStringFromAsciiChecked("POSITIVE_INFINITY"),
    1664             :         infinity,
    1665         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1666             :     JSObject::AddProperty(
    1667             :         number_fun, factory->NewStringFromAsciiChecked("MAX_SAFE_INTEGER"),
    1668             :         factory->NewNumber(kMaxSafeInt),
    1669         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1670             :     JSObject::AddProperty(
    1671             :         number_fun, factory->NewStringFromAsciiChecked("MIN_SAFE_INTEGER"),
    1672             :         factory->NewNumber(kMinSafeInt),
    1673         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1674             :     JSObject::AddProperty(
    1675             :         number_fun, factory->NewStringFromAsciiChecked("EPSILON"),
    1676             :         factory->NewNumber(kEPS),
    1677         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1678             : 
    1679             :     JSObject::AddProperty(
    1680             :         global, factory->NewStringFromAsciiChecked("Infinity"), infinity,
    1681         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1682             :     JSObject::AddProperty(
    1683             :         global, nan_name, nan,
    1684          79 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1685             :     JSObject::AddProperty(
    1686             :         global, factory->NewStringFromAsciiChecked("undefined"),
    1687             :         factory->undefined_value(),
    1688         158 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1689             :   }
    1690             : 
    1691             :   {  // --- B o o l e a n ---
    1692             :     Handle<JSFunction> boolean_fun =
    1693             :         InstallFunction(global, "Boolean", JS_VALUE_TYPE, JSValue::kSize,
    1694             :                         isolate->initial_object_prototype(),
    1695         158 :                         Builtins::kBooleanConstructor);
    1696             :     boolean_fun->shared()->DontAdaptArguments();
    1697             :     boolean_fun->shared()->SetConstructStub(
    1698         158 :         *isolate->builtins()->BooleanConstructor_ConstructStub());
    1699             :     boolean_fun->shared()->set_length(1);
    1700             :     InstallWithIntrinsicDefaultProto(isolate, boolean_fun,
    1701          79 :                                      Context::BOOLEAN_FUNCTION_INDEX);
    1702             : 
    1703             :     // Create the %BooleanPrototype%
    1704             :     Handle<JSValue> prototype =
    1705          79 :         Handle<JSValue>::cast(factory->NewJSObject(boolean_fun, TENURED));
    1706         158 :     prototype->set_value(isolate->heap()->false_value());
    1707          79 :     JSFunction::SetPrototype(boolean_fun, prototype);
    1708             : 
    1709             :     // Install the "constructor" property on the {prototype}.
    1710             :     JSObject::AddProperty(prototype, factory->constructor_string(), boolean_fun,
    1711          79 :                           DONT_ENUM);
    1712             : 
    1713             :     // Install the Boolean.prototype methods.
    1714             :     SimpleInstallFunction(prototype, "toString",
    1715          79 :                           Builtins::kBooleanPrototypeToString, 0, true);
    1716             :     SimpleInstallFunction(prototype, "valueOf",
    1717          79 :                           Builtins::kBooleanPrototypeValueOf, 0, true);
    1718             :   }
    1719             : 
    1720             :   {  // --- S t r i n g ---
    1721             :     Handle<JSFunction> string_fun = InstallFunction(
    1722             :         global, "String", JS_VALUE_TYPE, JSValue::kSize,
    1723         158 :         isolate->initial_object_prototype(), Builtins::kStringConstructor);
    1724             :     string_fun->shared()->SetConstructStub(
    1725         158 :         *isolate->builtins()->StringConstructor_ConstructStub());
    1726             :     string_fun->shared()->DontAdaptArguments();
    1727             :     string_fun->shared()->set_length(1);
    1728             :     InstallWithIntrinsicDefaultProto(isolate, string_fun,
    1729          79 :                                      Context::STRING_FUNCTION_INDEX);
    1730             : 
    1731             :     Handle<Map> string_map =
    1732             :         Handle<Map>(native_context()->string_function()->initial_map());
    1733             :     string_map->set_elements_kind(FAST_STRING_WRAPPER_ELEMENTS);
    1734          79 :     Map::EnsureDescriptorSlack(string_map, 1);
    1735             : 
    1736             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1737             :         DONT_ENUM | DONT_DELETE | READ_ONLY);
    1738             :     Handle<AccessorInfo> string_length(
    1739          79 :         Accessors::StringLengthInfo(isolate, attribs));
    1740             : 
    1741             :     {  // Add length.
    1742             :       Descriptor d = Descriptor::AccessorConstant(factory->length_string(),
    1743             :                                                   string_length, attribs);
    1744          79 :       string_map->AppendDescriptor(&d);
    1745             :     }
    1746             : 
    1747             :     // Install the String.fromCharCode function.
    1748             :     SimpleInstallFunction(string_fun, "fromCharCode",
    1749          79 :                           Builtins::kStringFromCharCode, 1, false);
    1750             : 
    1751             :     // Install the String.fromCodePoint function.
    1752             :     SimpleInstallFunction(string_fun, "fromCodePoint",
    1753          79 :                           Builtins::kStringFromCodePoint, 1, false);
    1754             : 
    1755             :     // Create the %StringPrototype%
    1756             :     Handle<JSValue> prototype =
    1757          79 :         Handle<JSValue>::cast(factory->NewJSObject(string_fun, TENURED));
    1758         158 :     prototype->set_value(isolate->heap()->empty_string());
    1759          79 :     JSFunction::SetPrototype(string_fun, prototype);
    1760             : 
    1761             :     // Install the "constructor" property on the {prototype}.
    1762             :     JSObject::AddProperty(prototype, factory->constructor_string(), string_fun,
    1763          79 :                           DONT_ENUM);
    1764             : 
    1765             :     // Install the String.prototype methods.
    1766             :     SimpleInstallFunction(prototype, "charAt", Builtins::kStringPrototypeCharAt,
    1767          79 :                           1, true);
    1768             :     SimpleInstallFunction(prototype, "charCodeAt",
    1769          79 :                           Builtins::kStringPrototypeCharCodeAt, 1, true);
    1770             :     SimpleInstallFunction(prototype, "concat", Builtins::kStringPrototypeConcat,
    1771          79 :                           1, false);
    1772             :     SimpleInstallFunction(prototype, "endsWith",
    1773          79 :                           Builtins::kStringPrototypeEndsWith, 1, false);
    1774             :     SimpleInstallFunction(prototype, "includes",
    1775          79 :                           Builtins::kStringPrototypeIncludes, 1, false);
    1776             :     SimpleInstallFunction(prototype, "indexOf",
    1777          79 :                           Builtins::kStringPrototypeIndexOf, 1, false);
    1778             :     SimpleInstallFunction(prototype, "lastIndexOf",
    1779          79 :                           Builtins::kStringPrototypeLastIndexOf, 1, false);
    1780             :     SimpleInstallFunction(prototype, "localeCompare",
    1781          79 :                           Builtins::kStringPrototypeLocaleCompare, 1, true);
    1782             : #ifdef V8_INTL_SUPPORT
    1783             :     SimpleInstallFunction(prototype, "normalize",
    1784          79 :                           Builtins::kStringPrototypeNormalizeIntl, 0, false);
    1785             : #else
    1786             :     SimpleInstallFunction(prototype, "normalize",
    1787             :                           Builtins::kStringPrototypeNormalize, 0, false);
    1788             : #endif  // V8_INTL_SUPPORT
    1789             :     SimpleInstallFunction(prototype, "replace",
    1790          79 :                           Builtins::kStringPrototypeReplace, 2, true);
    1791             :     SimpleInstallFunction(prototype, "split", Builtins::kStringPrototypeSplit,
    1792          79 :                           2, true);
    1793             :     SimpleInstallFunction(prototype, "substr", Builtins::kStringPrototypeSubstr,
    1794          79 :                           2, true);
    1795             :     SimpleInstallFunction(prototype, "substring",
    1796          79 :                           Builtins::kStringPrototypeSubstring, 2, true);
    1797             :     SimpleInstallFunction(prototype, "startsWith",
    1798          79 :                           Builtins::kStringPrototypeStartsWith, 1, false);
    1799             :     SimpleInstallFunction(prototype, "toString",
    1800          79 :                           Builtins::kStringPrototypeToString, 0, true);
    1801             :     SimpleInstallFunction(prototype, "trim", Builtins::kStringPrototypeTrim, 0,
    1802          79 :                           false);
    1803             :     SimpleInstallFunction(prototype, "trimLeft",
    1804          79 :                           Builtins::kStringPrototypeTrimLeft, 0, false);
    1805             :     SimpleInstallFunction(prototype, "trimRight",
    1806          79 :                           Builtins::kStringPrototypeTrimRight, 0, false);
    1807             :     SimpleInstallFunction(prototype, "toLocaleLowerCase",
    1808             :                           Builtins::kStringPrototypeToLocaleLowerCase, 0,
    1809          79 :                           false);
    1810             :     SimpleInstallFunction(prototype, "toLocaleUpperCase",
    1811             :                           Builtins::kStringPrototypeToLocaleUpperCase, 0,
    1812          79 :                           false);
    1813             :     SimpleInstallFunction(prototype, "toLowerCase",
    1814          79 :                           Builtins::kStringPrototypeToLowerCase, 0, false);
    1815             :     SimpleInstallFunction(prototype, "toUpperCase",
    1816          79 :                           Builtins::kStringPrototypeToUpperCase, 0, false);
    1817             :     SimpleInstallFunction(prototype, "valueOf",
    1818          79 :                           Builtins::kStringPrototypeValueOf, 0, true);
    1819             : 
    1820             :     Handle<JSFunction> iterator = SimpleCreateFunction(
    1821             :         isolate, factory->NewStringFromAsciiChecked("[Symbol.iterator]"),
    1822          79 :         Builtins::kStringPrototypeIterator, 0, true);
    1823             :     iterator->shared()->set_builtin_function_id(kStringIterator);
    1824             :     JSObject::AddProperty(prototype, factory->iterator_symbol(), iterator,
    1825          79 :                           static_cast<PropertyAttributes>(DONT_ENUM));
    1826             :   }
    1827             : 
    1828             :   {  // --- S t r i n g I t e r a t o r ---
    1829             :     Handle<JSObject> iterator_prototype(
    1830             :         native_context()->initial_iterator_prototype());
    1831             : 
    1832             :     Handle<JSObject> string_iterator_prototype =
    1833          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    1834          79 :     JSObject::ForceSetPrototype(string_iterator_prototype, iterator_prototype);
    1835             : 
    1836             :     JSObject::AddProperty(
    1837             :         string_iterator_prototype, factory->to_string_tag_symbol(),
    1838             :         factory->NewStringFromAsciiChecked("String Iterator"),
    1839         158 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1840             : 
    1841             :     Handle<JSFunction> next =
    1842             :         InstallFunction(string_iterator_prototype, "next", JS_OBJECT_TYPE,
    1843             :                         JSObject::kHeaderSize, MaybeHandle<JSObject>(),
    1844          79 :                         Builtins::kStringIteratorPrototypeNext);
    1845             :     next->shared()->set_builtin_function_id(kStringIteratorNext);
    1846             : 
    1847             :     // Set the expected parameters for %StringIteratorPrototype%.next to 0 (not
    1848             :     // including the receiver), as required by the builtin.
    1849             :     next->shared()->set_internal_formal_parameter_count(0);
    1850             : 
    1851             :     // Set the length for the function to satisfy ECMA-262.
    1852             :     next->shared()->set_length(0);
    1853             : 
    1854             :     Handle<JSFunction> string_iterator_function = CreateFunction(
    1855             :         isolate, factory->NewStringFromAsciiChecked("StringIterator"),
    1856             :         JS_STRING_ITERATOR_TYPE, JSStringIterator::kSize,
    1857          79 :         string_iterator_prototype, Builtins::kIllegal);
    1858             :     string_iterator_function->shared()->set_native(false);
    1859             :     native_context()->set_string_iterator_map(
    1860             :         string_iterator_function->initial_map());
    1861             :   }
    1862             : 
    1863             :   {
    1864             :     // --- S y m b o l ---
    1865             :     Handle<JSObject> prototype =
    1866          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    1867             :     Handle<JSFunction> symbol_fun =
    1868             :         InstallFunction(global, "Symbol", JS_VALUE_TYPE, JSValue::kSize,
    1869          79 :                         prototype, Builtins::kSymbolConstructor);
    1870             :     symbol_fun->shared()->SetConstructStub(
    1871         158 :         *isolate->builtins()->SymbolConstructor_ConstructStub());
    1872             :     symbol_fun->shared()->set_length(0);
    1873             :     symbol_fun->shared()->DontAdaptArguments();
    1874             :     native_context()->set_symbol_function(*symbol_fun);
    1875             : 
    1876             :     // Install the Symbol.for and Symbol.keyFor functions.
    1877          79 :     SimpleInstallFunction(symbol_fun, "for", Builtins::kSymbolFor, 1, false);
    1878             :     SimpleInstallFunction(symbol_fun, "keyFor", Builtins::kSymbolKeyFor, 1,
    1879          79 :                           false);
    1880             : 
    1881             :     // Install well-known symbols.
    1882             :     InstallConstant(isolate, symbol_fun, "hasInstance",
    1883          79 :                     factory->has_instance_symbol());
    1884             :     InstallConstant(isolate, symbol_fun, "isConcatSpreadable",
    1885          79 :                     factory->is_concat_spreadable_symbol());
    1886             :     InstallConstant(isolate, symbol_fun, "iterator",
    1887          79 :                     factory->iterator_symbol());
    1888          79 :     InstallConstant(isolate, symbol_fun, "match", factory->match_symbol());
    1889          79 :     InstallConstant(isolate, symbol_fun, "replace", factory->replace_symbol());
    1890          79 :     InstallConstant(isolate, symbol_fun, "search", factory->search_symbol());
    1891          79 :     InstallConstant(isolate, symbol_fun, "species", factory->species_symbol());
    1892          79 :     InstallConstant(isolate, symbol_fun, "split", factory->split_symbol());
    1893             :     InstallConstant(isolate, symbol_fun, "toPrimitive",
    1894          79 :                     factory->to_primitive_symbol());
    1895             :     InstallConstant(isolate, symbol_fun, "toStringTag",
    1896          79 :                     factory->to_string_tag_symbol());
    1897             :     InstallConstant(isolate, symbol_fun, "unscopables",
    1898          79 :                     factory->unscopables_symbol());
    1899             : 
    1900             :     // Install the @@toStringTag property on the {prototype}.
    1901             :     JSObject::AddProperty(
    1902             :         prototype, factory->to_string_tag_symbol(),
    1903             :         factory->NewStringFromAsciiChecked("Symbol"),
    1904         158 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1905             : 
    1906             :     // Install the "constructor" property on the {prototype}.
    1907             :     JSObject::AddProperty(prototype, factory->constructor_string(), symbol_fun,
    1908          79 :                           DONT_ENUM);
    1909             : 
    1910             :     // Install the Symbol.prototype methods.
    1911             :     SimpleInstallFunction(prototype, "toString",
    1912          79 :                           Builtins::kSymbolPrototypeToString, 0, true);
    1913             :     SimpleInstallFunction(prototype, "valueOf",
    1914          79 :                           Builtins::kSymbolPrototypeValueOf, 0, true);
    1915             : 
    1916             :     // Install the @@toPrimitive function.
    1917             :     Handle<JSFunction> to_primitive = InstallFunction(
    1918             :         prototype, factory->to_primitive_symbol(), JS_OBJECT_TYPE,
    1919             :         JSObject::kHeaderSize, MaybeHandle<JSObject>(),
    1920             :         Builtins::kSymbolPrototypeToPrimitive,
    1921          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1922             : 
    1923             :     // Set the expected parameters for @@toPrimitive to 1; required by builtin.
    1924             :     to_primitive->shared()->set_internal_formal_parameter_count(1);
    1925             : 
    1926             :     // Set the length for the function to satisfy ECMA-262.
    1927             :     to_primitive->shared()->set_length(1);
    1928             :   }
    1929             : 
    1930             :   {  // --- D a t e ---
    1931             :     // Builtin functions for Date.prototype.
    1932             :     Handle<JSObject> prototype =
    1933          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    1934             :     Handle<JSFunction> date_fun =
    1935             :         InstallFunction(global, "Date", JS_DATE_TYPE, JSDate::kSize, prototype,
    1936          79 :                         Builtins::kDateConstructor);
    1937             :     InstallWithIntrinsicDefaultProto(isolate, date_fun,
    1938          79 :                                      Context::DATE_FUNCTION_INDEX);
    1939             :     date_fun->shared()->SetConstructStub(
    1940         158 :         *isolate->builtins()->DateConstructor_ConstructStub());
    1941             :     date_fun->shared()->set_length(7);
    1942             :     date_fun->shared()->DontAdaptArguments();
    1943             : 
    1944             :     // Install the Date.now, Date.parse and Date.UTC functions.
    1945          79 :     SimpleInstallFunction(date_fun, "now", Builtins::kDateNow, 0, false);
    1946          79 :     SimpleInstallFunction(date_fun, "parse", Builtins::kDateParse, 1, false);
    1947          79 :     SimpleInstallFunction(date_fun, "UTC", Builtins::kDateUTC, 7, false);
    1948             : 
    1949             :     // Install the "constructor" property on the {prototype}.
    1950             :     JSObject::AddProperty(prototype, factory->constructor_string(), date_fun,
    1951          79 :                           DONT_ENUM);
    1952             : 
    1953             :     // Install the Date.prototype methods.
    1954             :     SimpleInstallFunction(prototype, "toString",
    1955          79 :                           Builtins::kDatePrototypeToString, 0, false);
    1956             :     SimpleInstallFunction(prototype, "toDateString",
    1957          79 :                           Builtins::kDatePrototypeToDateString, 0, false);
    1958             :     SimpleInstallFunction(prototype, "toTimeString",
    1959          79 :                           Builtins::kDatePrototypeToTimeString, 0, false);
    1960             :     SimpleInstallFunction(prototype, "toISOString",
    1961          79 :                           Builtins::kDatePrototypeToISOString, 0, false);
    1962             :     Handle<JSFunction> to_utc_string =
    1963             :         SimpleInstallFunction(prototype, "toUTCString",
    1964          79 :                               Builtins::kDatePrototypeToUTCString, 0, false);
    1965             :     InstallFunction(prototype, to_utc_string,
    1966         158 :                     factory->InternalizeUtf8String("toGMTString"), DONT_ENUM);
    1967             :     SimpleInstallFunction(prototype, "getDate", Builtins::kDatePrototypeGetDate,
    1968          79 :                           0, true);
    1969             :     SimpleInstallFunction(prototype, "setDate", Builtins::kDatePrototypeSetDate,
    1970          79 :                           1, false);
    1971             :     SimpleInstallFunction(prototype, "getDay", Builtins::kDatePrototypeGetDay,
    1972          79 :                           0, true);
    1973             :     SimpleInstallFunction(prototype, "getFullYear",
    1974          79 :                           Builtins::kDatePrototypeGetFullYear, 0, true);
    1975             :     SimpleInstallFunction(prototype, "setFullYear",
    1976          79 :                           Builtins::kDatePrototypeSetFullYear, 3, false);
    1977             :     SimpleInstallFunction(prototype, "getHours",
    1978          79 :                           Builtins::kDatePrototypeGetHours, 0, true);
    1979             :     SimpleInstallFunction(prototype, "setHours",
    1980          79 :                           Builtins::kDatePrototypeSetHours, 4, false);
    1981             :     SimpleInstallFunction(prototype, "getMilliseconds",
    1982          79 :                           Builtins::kDatePrototypeGetMilliseconds, 0, true);
    1983             :     SimpleInstallFunction(prototype, "setMilliseconds",
    1984          79 :                           Builtins::kDatePrototypeSetMilliseconds, 1, false);
    1985             :     SimpleInstallFunction(prototype, "getMinutes",
    1986          79 :                           Builtins::kDatePrototypeGetMinutes, 0, true);
    1987             :     SimpleInstallFunction(prototype, "setMinutes",
    1988          79 :                           Builtins::kDatePrototypeSetMinutes, 3, false);
    1989             :     SimpleInstallFunction(prototype, "getMonth",
    1990          79 :                           Builtins::kDatePrototypeGetMonth, 0, true);
    1991             :     SimpleInstallFunction(prototype, "setMonth",
    1992          79 :                           Builtins::kDatePrototypeSetMonth, 2, false);
    1993             :     SimpleInstallFunction(prototype, "getSeconds",
    1994          79 :                           Builtins::kDatePrototypeGetSeconds, 0, true);
    1995             :     SimpleInstallFunction(prototype, "setSeconds",
    1996          79 :                           Builtins::kDatePrototypeSetSeconds, 2, false);
    1997             :     SimpleInstallFunction(prototype, "getTime", Builtins::kDatePrototypeGetTime,
    1998          79 :                           0, true);
    1999             :     SimpleInstallFunction(prototype, "setTime", Builtins::kDatePrototypeSetTime,
    2000          79 :                           1, false);
    2001             :     SimpleInstallFunction(prototype, "getTimezoneOffset",
    2002          79 :                           Builtins::kDatePrototypeGetTimezoneOffset, 0, true);
    2003             :     SimpleInstallFunction(prototype, "getUTCDate",
    2004          79 :                           Builtins::kDatePrototypeGetUTCDate, 0, true);
    2005             :     SimpleInstallFunction(prototype, "setUTCDate",
    2006          79 :                           Builtins::kDatePrototypeSetUTCDate, 1, false);
    2007             :     SimpleInstallFunction(prototype, "getUTCDay",
    2008          79 :                           Builtins::kDatePrototypeGetUTCDay, 0, true);
    2009             :     SimpleInstallFunction(prototype, "getUTCFullYear",
    2010          79 :                           Builtins::kDatePrototypeGetUTCFullYear, 0, true);
    2011             :     SimpleInstallFunction(prototype, "setUTCFullYear",
    2012          79 :                           Builtins::kDatePrototypeSetUTCFullYear, 3, false);
    2013             :     SimpleInstallFunction(prototype, "getUTCHours",
    2014          79 :                           Builtins::kDatePrototypeGetUTCHours, 0, true);
    2015             :     SimpleInstallFunction(prototype, "setUTCHours",
    2016          79 :                           Builtins::kDatePrototypeSetUTCHours, 4, false);
    2017             :     SimpleInstallFunction(prototype, "getUTCMilliseconds",
    2018          79 :                           Builtins::kDatePrototypeGetUTCMilliseconds, 0, true);
    2019             :     SimpleInstallFunction(prototype, "setUTCMilliseconds",
    2020          79 :                           Builtins::kDatePrototypeSetUTCMilliseconds, 1, false);
    2021             :     SimpleInstallFunction(prototype, "getUTCMinutes",
    2022          79 :                           Builtins::kDatePrototypeGetUTCMinutes, 0, true);
    2023             :     SimpleInstallFunction(prototype, "setUTCMinutes",
    2024          79 :                           Builtins::kDatePrototypeSetUTCMinutes, 3, false);
    2025             :     SimpleInstallFunction(prototype, "getUTCMonth",
    2026          79 :                           Builtins::kDatePrototypeGetUTCMonth, 0, true);
    2027             :     SimpleInstallFunction(prototype, "setUTCMonth",
    2028          79 :                           Builtins::kDatePrototypeSetUTCMonth, 2, false);
    2029             :     SimpleInstallFunction(prototype, "getUTCSeconds",
    2030          79 :                           Builtins::kDatePrototypeGetUTCSeconds, 0, true);
    2031             :     SimpleInstallFunction(prototype, "setUTCSeconds",
    2032          79 :                           Builtins::kDatePrototypeSetUTCSeconds, 2, false);
    2033             :     SimpleInstallFunction(prototype, "valueOf", Builtins::kDatePrototypeValueOf,
    2034          79 :                           0, true);
    2035             :     SimpleInstallFunction(prototype, "getYear", Builtins::kDatePrototypeGetYear,
    2036          79 :                           0, true);
    2037             :     SimpleInstallFunction(prototype, "setYear", Builtins::kDatePrototypeSetYear,
    2038          79 :                           1, false);
    2039             :     SimpleInstallFunction(prototype, "toJSON", Builtins::kDatePrototypeToJson,
    2040          79 :                           1, false);
    2041             : 
    2042             :     // Install Intl fallback functions.
    2043             :     SimpleInstallFunction(prototype, "toLocaleString",
    2044          79 :                           Builtins::kDatePrototypeToString, 0, false);
    2045             :     SimpleInstallFunction(prototype, "toLocaleDateString",
    2046          79 :                           Builtins::kDatePrototypeToDateString, 0, false);
    2047             :     SimpleInstallFunction(prototype, "toLocaleTimeString",
    2048          79 :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2049             : 
    2050             :     // Install the @@toPrimitive function.
    2051             :     Handle<JSFunction> to_primitive = InstallFunction(
    2052             :         prototype, factory->to_primitive_symbol(), JS_OBJECT_TYPE,
    2053             :         JSObject::kHeaderSize, MaybeHandle<JSObject>(),
    2054             :         Builtins::kDatePrototypeToPrimitive,
    2055          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2056             : 
    2057             :     // Set the expected parameters for @@toPrimitive to 1; required by builtin.
    2058             :     to_primitive->shared()->set_internal_formal_parameter_count(1);
    2059             : 
    2060             :     // Set the length for the function to satisfy ECMA-262.
    2061             :     to_primitive->shared()->set_length(1);
    2062             :   }
    2063             : 
    2064             :   {
    2065          79 :     Handle<Code> code = isolate->builtins()->PromiseGetCapabilitiesExecutor();
    2066             :     Handle<SharedFunctionInfo> info =
    2067          79 :         factory->NewSharedFunctionInfo(factory->empty_string(), code, true);
    2068         158 :     info->SetConstructStub(*isolate->builtins()->JSBuiltinsConstructStub());
    2069         158 :     info->set_instance_class_name(isolate->heap()->Object_string());
    2070             :     info->set_internal_formal_parameter_count(2);
    2071             :     info->set_length(2);
    2072             :     native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
    2073             : 
    2074             :     // %new_promise_capability(C, debugEvent)
    2075             :     Handle<JSFunction> new_promise_capability =
    2076             :         SimpleCreateFunction(isolate, factory->empty_string(),
    2077          79 :                              Builtins::kNewPromiseCapability, 2, false);
    2078             :     InstallWithIntrinsicDefaultProto(isolate, new_promise_capability,
    2079          79 :                                      Context::NEW_PROMISE_CAPABILITY_INDEX);
    2080             :   }
    2081             : 
    2082             :   {  // -- P r o m i s e
    2083             :     Handle<JSObject> prototype =
    2084          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2085             :     Handle<JSFunction> promise_fun =
    2086             :         InstallFunction(global, "Promise", JS_PROMISE_TYPE, JSPromise::kSize,
    2087          79 :                         prototype, Builtins::kPromiseConstructor);
    2088             :     InstallWithIntrinsicDefaultProto(isolate, promise_fun,
    2089          79 :                                      Context::PROMISE_FUNCTION_INDEX);
    2090             : 
    2091             :     Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate);
    2092         158 :     shared->SetConstructStub(*isolate->builtins()->JSBuiltinsConstructStub());
    2093         158 :     shared->set_instance_class_name(isolate->heap()->Object_string());
    2094             :     shared->set_internal_formal_parameter_count(1);
    2095             :     shared->set_length(1);
    2096             : 
    2097             :     // Install the "constructor" property on the {prototype}.
    2098             :     JSObject::AddProperty(prototype, factory->constructor_string(), promise_fun,
    2099          79 :                           DONT_ENUM);
    2100             : 
    2101             :     // Install the @@toStringTag property on the {prototype}.
    2102             :     JSObject::AddProperty(
    2103             :         prototype, factory->to_string_tag_symbol(), factory->Promise_string(),
    2104          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2105             : 
    2106             :     Handle<JSFunction> promise_then =
    2107             :         SimpleInstallFunction(prototype, isolate->factory()->then_string(),
    2108          79 :                               Builtins::kPromiseThen, 2, true);
    2109             :     InstallWithIntrinsicDefaultProto(isolate, promise_then,
    2110          79 :                                      Context::PROMISE_THEN_INDEX);
    2111             : 
    2112             :     Handle<JSFunction> promise_catch = SimpleInstallFunction(
    2113          79 :         prototype, "catch", Builtins::kPromiseCatch, 1, true, DONT_ENUM);
    2114             :     InstallWithIntrinsicDefaultProto(isolate, promise_catch,
    2115          79 :                                      Context::PROMISE_CATCH_INDEX);
    2116             : 
    2117          79 :     InstallSpeciesGetter(promise_fun);
    2118             : 
    2119             :     SimpleInstallFunction(promise_fun, "resolve", Builtins::kPromiseResolve, 1,
    2120          79 :                           true, DONT_ENUM);
    2121             : 
    2122             :     SimpleInstallFunction(promise_fun, "reject", Builtins::kPromiseReject, 1,
    2123          79 :                           true, DONT_ENUM);
    2124             : 
    2125             :     Handle<Map> prototype_map(prototype->map());
    2126          79 :     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate);
    2127             : 
    2128             :     // Store the initial Promise.prototype map. This is used in fast-path
    2129             :     // checks. Do not alter the prototype after this point.
    2130             :     native_context()->set_promise_prototype_map(*prototype_map);
    2131             : 
    2132             :     {  // Internal: PromiseInternalConstructor
    2133             :        // Also exposed as extrasUtils.createPromise.
    2134             :       Handle<JSFunction> function =
    2135             :           SimpleCreateFunction(isolate, factory->empty_string(),
    2136          79 :                                Builtins::kPromiseInternalConstructor, 1, true);
    2137             :       function->shared()->set_native(false);
    2138             :       InstallWithIntrinsicDefaultProto(
    2139          79 :           isolate, function, Context::PROMISE_INTERNAL_CONSTRUCTOR_INDEX);
    2140             :     }
    2141             : 
    2142             :     {  // Internal: IsPromise
    2143             :       Handle<JSFunction> function = SimpleCreateFunction(
    2144          79 :           isolate, factory->empty_string(), Builtins::kIsPromise, 1, false);
    2145             :       InstallWithIntrinsicDefaultProto(isolate, function,
    2146          79 :                                        Context::IS_PROMISE_INDEX);
    2147             :     }
    2148             : 
    2149             :     {  // Internal: ResolvePromise
    2150             :        // Also exposed as extrasUtils.resolvePromise.
    2151             :       Handle<JSFunction> function = SimpleCreateFunction(
    2152          79 :           isolate, factory->empty_string(), Builtins::kResolvePromise, 2, true);
    2153             :       function->shared()->set_native(false);
    2154             :       InstallWithIntrinsicDefaultProto(isolate, function,
    2155          79 :                                        Context::PROMISE_RESOLVE_INDEX);
    2156             :     }
    2157             : 
    2158             :     {  // Internal: PromiseHandle
    2159             :       Handle<JSFunction> function = SimpleCreateFunction(
    2160          79 :           isolate, factory->empty_string(), Builtins::kPromiseHandle, 5, false);
    2161             :       InstallWithIntrinsicDefaultProto(isolate, function,
    2162          79 :                                        Context::PROMISE_HANDLE_INDEX);
    2163             :     }
    2164             : 
    2165             :     {  // Internal: PromiseHandleReject
    2166             :       Handle<JSFunction> function =
    2167             :           SimpleCreateFunction(isolate, factory->empty_string(),
    2168          79 :                                Builtins::kPromiseHandleReject, 3, false);
    2169             :       InstallWithIntrinsicDefaultProto(isolate, function,
    2170          79 :                                        Context::PROMISE_HANDLE_REJECT_INDEX);
    2171             :     }
    2172             : 
    2173             :     {  // Internal: InternalPromiseReject
    2174             :       Handle<JSFunction> function =
    2175             :           SimpleCreateFunction(isolate, factory->empty_string(),
    2176          79 :                                Builtins::kInternalPromiseReject, 3, true);
    2177             :       function->shared()->set_native(false);
    2178             :       InstallWithIntrinsicDefaultProto(isolate, function,
    2179          79 :                                        Context::PROMISE_INTERNAL_REJECT_INDEX);
    2180             :     }
    2181             : 
    2182             :     {
    2183             :       Handle<Code> code =
    2184             :           handle(isolate->builtins()->builtin(Builtins::kPromiseResolveClosure),
    2185             :                  isolate);
    2186             :       Handle<SharedFunctionInfo> info =
    2187          79 :           factory->NewSharedFunctionInfo(factory->empty_string(), code, false);
    2188             :       info->set_internal_formal_parameter_count(1);
    2189             :       info->set_length(1);
    2190             :       native_context()->set_promise_resolve_shared_fun(*info);
    2191             : 
    2192             :       code =
    2193             :           handle(isolate->builtins()->builtin(Builtins::kPromiseRejectClosure),
    2194             :                  isolate);
    2195             :       info =
    2196          79 :           factory->NewSharedFunctionInfo(factory->empty_string(), code, false);
    2197             :       info->set_internal_formal_parameter_count(1);
    2198             :       info->set_length(1);
    2199             :       native_context()->set_promise_reject_shared_fun(*info);
    2200             :     }
    2201             :   }
    2202             : 
    2203             :   {  // -- R e g E x p
    2204             :     // Builtin functions for RegExp.prototype.
    2205             :     Handle<JSObject> prototype =
    2206          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2207             :     Handle<JSFunction> regexp_fun =
    2208             :         InstallFunction(global, "RegExp", JS_REGEXP_TYPE, JSRegExp::kSize,
    2209          79 :                         prototype, Builtins::kRegExpConstructor);
    2210             :     InstallWithIntrinsicDefaultProto(isolate, regexp_fun,
    2211          79 :                                      Context::REGEXP_FUNCTION_INDEX);
    2212             : 
    2213             :     Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate);
    2214         158 :     shared->SetConstructStub(*isolate->builtins()->JSBuiltinsConstructStub());
    2215         158 :     shared->set_instance_class_name(isolate->heap()->RegExp_string());
    2216             :     shared->set_internal_formal_parameter_count(2);
    2217             :     shared->set_length(2);
    2218             : 
    2219             :     {
    2220             :       // RegExp.prototype setup.
    2221             : 
    2222             :       // Install the "constructor" property on the {prototype}.
    2223             :       JSObject::AddProperty(prototype, factory->constructor_string(),
    2224          79 :                             regexp_fun, DONT_ENUM);
    2225             : 
    2226             :       {
    2227             :         Handle<JSFunction> fun = SimpleInstallFunction(
    2228             :             prototype, factory->exec_string(), Builtins::kRegExpPrototypeExec,
    2229          79 :             1, true, DONT_ENUM);
    2230             :         native_context()->set_regexp_exec_function(*fun);
    2231             :       }
    2232             : 
    2233             :       SimpleInstallGetter(prototype, factory->flags_string(),
    2234             :                           Builtins::kRegExpPrototypeFlagsGetter, true);
    2235             :       SimpleInstallGetter(prototype, factory->global_string(),
    2236             :                           Builtins::kRegExpPrototypeGlobalGetter, true);
    2237             :       SimpleInstallGetter(prototype, factory->ignoreCase_string(),
    2238             :                           Builtins::kRegExpPrototypeIgnoreCaseGetter, true);
    2239             :       SimpleInstallGetter(prototype, factory->multiline_string(),
    2240             :                           Builtins::kRegExpPrototypeMultilineGetter, true);
    2241             :       SimpleInstallGetter(prototype, factory->source_string(),
    2242             :                           Builtins::kRegExpPrototypeSourceGetter, true);
    2243             :       SimpleInstallGetter(prototype, factory->sticky_string(),
    2244             :                           Builtins::kRegExpPrototypeStickyGetter, true);
    2245             :       SimpleInstallGetter(prototype, factory->unicode_string(),
    2246             :                           Builtins::kRegExpPrototypeUnicodeGetter, true);
    2247             : 
    2248             :       SimpleInstallFunction(prototype, "compile",
    2249             :                             Builtins::kRegExpPrototypeCompile, 2, true,
    2250          79 :                             DONT_ENUM);
    2251             :       SimpleInstallFunction(prototype, factory->toString_string(),
    2252             :                             Builtins::kRegExpPrototypeToString, 0, false,
    2253          79 :                             DONT_ENUM);
    2254             :       SimpleInstallFunction(prototype, "test", Builtins::kRegExpPrototypeTest,
    2255          79 :                             1, true, DONT_ENUM);
    2256             : 
    2257             :       {
    2258             :         Handle<JSFunction> fun = SimpleCreateFunction(
    2259             :             isolate, factory->InternalizeUtf8String("[Symbol.match]"),
    2260          79 :             Builtins::kRegExpPrototypeMatch, 1, true);
    2261          79 :         InstallFunction(prototype, fun, factory->match_symbol(), DONT_ENUM);
    2262             :       }
    2263             : 
    2264             :       {
    2265             :         Handle<JSFunction> fun = SimpleCreateFunction(
    2266             :             isolate, factory->InternalizeUtf8String("[Symbol.replace]"),
    2267          79 :             Builtins::kRegExpPrototypeReplace, 2, true);
    2268          79 :         InstallFunction(prototype, fun, factory->replace_symbol(), DONT_ENUM);
    2269             :       }
    2270             : 
    2271             :       {
    2272             :         Handle<JSFunction> fun = SimpleCreateFunction(
    2273             :             isolate, factory->InternalizeUtf8String("[Symbol.search]"),
    2274          79 :             Builtins::kRegExpPrototypeSearch, 1, true);
    2275          79 :         InstallFunction(prototype, fun, factory->search_symbol(), DONT_ENUM);
    2276             :       }
    2277             : 
    2278             :       {
    2279             :         Handle<JSFunction> fun = SimpleCreateFunction(
    2280             :             isolate, factory->InternalizeUtf8String("[Symbol.split]"),
    2281          79 :             Builtins::kRegExpPrototypeSplit, 2, true);
    2282          79 :         InstallFunction(prototype, fun, factory->split_symbol(), DONT_ENUM);
    2283             :       }
    2284             : 
    2285             :       Handle<Map> prototype_map(prototype->map());
    2286          79 :       Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate);
    2287             : 
    2288             :       // Store the initial RegExp.prototype map. This is used in fast-path
    2289             :       // checks. Do not alter the prototype after this point.
    2290             :       native_context()->set_regexp_prototype_map(*prototype_map);
    2291             :     }
    2292             : 
    2293             :     {
    2294             :       // RegExp getters and setters.
    2295             : 
    2296          79 :       InstallSpeciesGetter(regexp_fun);
    2297             : 
    2298             :       // Static properties set by a successful match.
    2299             : 
    2300             :       const PropertyAttributes no_enum = DONT_ENUM;
    2301             :       SimpleInstallGetterSetter(regexp_fun, factory->input_string(),
    2302             :                                 Builtins::kRegExpInputGetter,
    2303          79 :                                 Builtins::kRegExpInputSetter, no_enum);
    2304             :       SimpleInstallGetterSetter(
    2305             :           regexp_fun, factory->InternalizeUtf8String("$_"),
    2306         158 :           Builtins::kRegExpInputGetter, Builtins::kRegExpInputSetter, no_enum);
    2307             : 
    2308             :       SimpleInstallGetterSetter(
    2309             :           regexp_fun, factory->InternalizeUtf8String("lastMatch"),
    2310         158 :           Builtins::kRegExpLastMatchGetter, Builtins::kEmptyFunction, no_enum);
    2311             :       SimpleInstallGetterSetter(
    2312             :           regexp_fun, factory->InternalizeUtf8String("$&"),
    2313         158 :           Builtins::kRegExpLastMatchGetter, Builtins::kEmptyFunction, no_enum);
    2314             : 
    2315             :       SimpleInstallGetterSetter(
    2316             :           regexp_fun, factory->InternalizeUtf8String("lastParen"),
    2317         158 :           Builtins::kRegExpLastParenGetter, Builtins::kEmptyFunction, no_enum);
    2318             :       SimpleInstallGetterSetter(
    2319             :           regexp_fun, factory->InternalizeUtf8String("$+"),
    2320         158 :           Builtins::kRegExpLastParenGetter, Builtins::kEmptyFunction, no_enum);
    2321             : 
    2322             :       SimpleInstallGetterSetter(regexp_fun,
    2323             :                                 factory->InternalizeUtf8String("leftContext"),
    2324             :                                 Builtins::kRegExpLeftContextGetter,
    2325         158 :                                 Builtins::kEmptyFunction, no_enum);
    2326             :       SimpleInstallGetterSetter(regexp_fun,
    2327             :                                 factory->InternalizeUtf8String("$`"),
    2328             :                                 Builtins::kRegExpLeftContextGetter,
    2329         158 :                                 Builtins::kEmptyFunction, no_enum);
    2330             : 
    2331             :       SimpleInstallGetterSetter(regexp_fun,
    2332             :                                 factory->InternalizeUtf8String("rightContext"),
    2333             :                                 Builtins::kRegExpRightContextGetter,
    2334         158 :                                 Builtins::kEmptyFunction, no_enum);
    2335             :       SimpleInstallGetterSetter(regexp_fun,
    2336             :                                 factory->InternalizeUtf8String("$'"),
    2337             :                                 Builtins::kRegExpRightContextGetter,
    2338         158 :                                 Builtins::kEmptyFunction, no_enum);
    2339             : 
    2340             : #define INSTALL_CAPTURE_GETTER(i)                         \
    2341             :   SimpleInstallGetterSetter(                              \
    2342             :       regexp_fun, factory->InternalizeUtf8String("$" #i), \
    2343             :       Builtins::kRegExpCapture##i##Getter, Builtins::kEmptyFunction, no_enum)
    2344         158 :       INSTALL_CAPTURE_GETTER(1);
    2345         158 :       INSTALL_CAPTURE_GETTER(2);
    2346         158 :       INSTALL_CAPTURE_GETTER(3);
    2347         158 :       INSTALL_CAPTURE_GETTER(4);
    2348         158 :       INSTALL_CAPTURE_GETTER(5);
    2349         158 :       INSTALL_CAPTURE_GETTER(6);
    2350         158 :       INSTALL_CAPTURE_GETTER(7);
    2351         158 :       INSTALL_CAPTURE_GETTER(8);
    2352         158 :       INSTALL_CAPTURE_GETTER(9);
    2353             : #undef INSTALL_CAPTURE_GETTER
    2354             :     }
    2355             : 
    2356             :     DCHECK(regexp_fun->has_initial_map());
    2357             :     Handle<Map> initial_map(regexp_fun->initial_map());
    2358             : 
    2359             :     DCHECK_EQ(0, initial_map->GetInObjectProperties());
    2360             : 
    2361          79 :     Map::EnsureDescriptorSlack(initial_map, 1);
    2362             : 
    2363             :     // ECMA-262, section 15.10.7.5.
    2364             :     PropertyAttributes writable =
    2365             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
    2366             :     Descriptor d = Descriptor::DataField(factory->lastIndex_string(),
    2367             :                                          JSRegExp::kLastIndexFieldIndex,
    2368          79 :                                          writable, Representation::Tagged());
    2369          79 :     initial_map->AppendDescriptor(&d);
    2370             : 
    2371             :     static const int num_fields = JSRegExp::kInObjectFieldCount;
    2372             :     initial_map->SetInObjectProperties(num_fields);
    2373             :     initial_map->set_unused_property_fields(0);
    2374             :     initial_map->set_instance_size(initial_map->instance_size() +
    2375          79 :                                    num_fields * kPointerSize);
    2376             : 
    2377             :     {  // Internal: RegExpInternalMatch
    2378             :       Handle<JSFunction> function =
    2379             :           factory->NewFunction(isolate->factory()->empty_string(),
    2380             :                                isolate->builtins()->RegExpInternalMatch(),
    2381          79 :                                JS_OBJECT_TYPE, JSObject::kHeaderSize);
    2382             :       function->shared()->set_internal_formal_parameter_count(2);
    2383             :       function->shared()->set_length(2);
    2384             :       function->shared()->set_native(true);
    2385          79 :       native_context()->set(Context::REGEXP_INTERNAL_MATCH, *function);
    2386             :     }
    2387             : 
    2388             :     // Create the last match info. One for external use, and one for internal
    2389             :     // use when we don't want to modify the externally visible match info.
    2390          79 :     Handle<RegExpMatchInfo> last_match_info = factory->NewRegExpMatchInfo();
    2391             :     native_context()->set_regexp_last_match_info(*last_match_info);
    2392          79 :     Handle<RegExpMatchInfo> internal_match_info = factory->NewRegExpMatchInfo();
    2393             :     native_context()->set_regexp_internal_match_info(*internal_match_info);
    2394             : 
    2395             :     // Force the RegExp constructor to fast properties, so that we can use the
    2396             :     // fast paths for various things like
    2397             :     //
    2398             :     //   x instanceof RegExp
    2399             :     //
    2400             :     // etc. We should probably come up with a more principled approach once
    2401             :     // the JavaScript builtins are gone.
    2402          79 :     JSObject::MigrateSlowToFast(regexp_fun, 0, "Bootstrapping");
    2403             :   }
    2404             : 
    2405             :   {  // -- E r r o r
    2406             :     InstallError(isolate, global, factory->Error_string(),
    2407          79 :                  Context::ERROR_FUNCTION_INDEX);
    2408             :     InstallMakeError(isolate, isolate->builtins()->MakeError(),
    2409          79 :                      Context::MAKE_ERROR_INDEX);
    2410             :   }
    2411             : 
    2412             :   {  // -- E v a l E r r o r
    2413             :     InstallError(isolate, global, factory->EvalError_string(),
    2414          79 :                  Context::EVAL_ERROR_FUNCTION_INDEX);
    2415             :   }
    2416             : 
    2417             :   {  // -- R a n g e E r r o r
    2418             :     InstallError(isolate, global, factory->RangeError_string(),
    2419          79 :                  Context::RANGE_ERROR_FUNCTION_INDEX);
    2420             :     InstallMakeError(isolate, isolate->builtins()->MakeRangeError(),
    2421          79 :                      Context::MAKE_RANGE_ERROR_INDEX);
    2422             :   }
    2423             : 
    2424             :   {  // -- R e f e r e n c e E r r o r
    2425             :     InstallError(isolate, global, factory->ReferenceError_string(),
    2426          79 :                  Context::REFERENCE_ERROR_FUNCTION_INDEX);
    2427             :   }
    2428             : 
    2429             :   {  // -- S y n t a x E r r o r
    2430             :     InstallError(isolate, global, factory->SyntaxError_string(),
    2431          79 :                  Context::SYNTAX_ERROR_FUNCTION_INDEX);
    2432             :     InstallMakeError(isolate, isolate->builtins()->MakeSyntaxError(),
    2433          79 :                      Context::MAKE_SYNTAX_ERROR_INDEX);
    2434             :   }
    2435             : 
    2436             :   {  // -- T y p e E r r o r
    2437             :     InstallError(isolate, global, factory->TypeError_string(),
    2438          79 :                  Context::TYPE_ERROR_FUNCTION_INDEX);
    2439             :     InstallMakeError(isolate, isolate->builtins()->MakeTypeError(),
    2440          79 :                      Context::MAKE_TYPE_ERROR_INDEX);
    2441             :   }
    2442             : 
    2443             :   {  // -- U R I E r r o r
    2444             :     InstallError(isolate, global, factory->URIError_string(),
    2445          79 :                  Context::URI_ERROR_FUNCTION_INDEX);
    2446             :     InstallMakeError(isolate, isolate->builtins()->MakeURIError(),
    2447          79 :                      Context::MAKE_URI_ERROR_INDEX);
    2448             :   }
    2449             : 
    2450             :   {  // -- C o m p i l e E r r o r
    2451          79 :     Handle<JSObject> dummy = factory->NewJSObject(isolate->object_function());
    2452             :     InstallError(isolate, dummy, factory->CompileError_string(),
    2453          79 :                  Context::WASM_COMPILE_ERROR_FUNCTION_INDEX);
    2454             : 
    2455             :     // -- L i n k E r r o r
    2456             :     InstallError(isolate, dummy, factory->LinkError_string(),
    2457          79 :                  Context::WASM_LINK_ERROR_FUNCTION_INDEX);
    2458             : 
    2459             :     // -- R u n t i m e E r r o r
    2460             :     InstallError(isolate, dummy, factory->RuntimeError_string(),
    2461          79 :                  Context::WASM_RUNTIME_ERROR_FUNCTION_INDEX);
    2462             :   }
    2463             : 
    2464             :   // Initialize the embedder data slot.
    2465          79 :   Handle<FixedArray> embedder_data = factory->NewFixedArray(3);
    2466             :   native_context()->set_embedder_data(*embedder_data);
    2467             : 
    2468             :   {  // -- J S O N
    2469          79 :     Handle<String> name = factory->InternalizeUtf8String("JSON");
    2470          79 :     Handle<JSFunction> cons = factory->NewFunction(name);
    2471         158 :     JSFunction::SetPrototype(cons, isolate->initial_object_prototype());
    2472          79 :     Handle<JSObject> json_object = factory->NewJSObject(cons, TENURED);
    2473             :     DCHECK(json_object->IsJSObject());
    2474          79 :     JSObject::AddProperty(global, name, json_object, DONT_ENUM);
    2475          79 :     SimpleInstallFunction(json_object, "parse", Builtins::kJsonParse, 2, false);
    2476             :     SimpleInstallFunction(json_object, "stringify", Builtins::kJsonStringify, 3,
    2477          79 :                           true);
    2478             :     JSObject::AddProperty(
    2479             :         json_object, factory->to_string_tag_symbol(),
    2480             :         factory->NewStringFromAsciiChecked("JSON"),
    2481         158 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2482             :   }
    2483             : 
    2484             :   {  // -- M a t h
    2485          79 :     Handle<String> name = factory->InternalizeUtf8String("Math");
    2486          79 :     Handle<JSFunction> cons = factory->NewFunction(name);
    2487         158 :     JSFunction::SetPrototype(cons, isolate->initial_object_prototype());
    2488          79 :     Handle<JSObject> math = factory->NewJSObject(cons, TENURED);
    2489             :     DCHECK(math->IsJSObject());
    2490          79 :     JSObject::AddProperty(global, name, math, DONT_ENUM);
    2491          79 :     SimpleInstallFunction(math, "abs", Builtins::kMathAbs, 1, true);
    2492          79 :     SimpleInstallFunction(math, "acos", Builtins::kMathAcos, 1, true);
    2493          79 :     SimpleInstallFunction(math, "acosh", Builtins::kMathAcosh, 1, true);
    2494          79 :     SimpleInstallFunction(math, "asin", Builtins::kMathAsin, 1, true);
    2495          79 :     SimpleInstallFunction(math, "asinh", Builtins::kMathAsinh, 1, true);
    2496          79 :     SimpleInstallFunction(math, "atan", Builtins::kMathAtan, 1, true);
    2497          79 :     SimpleInstallFunction(math, "atanh", Builtins::kMathAtanh, 1, true);
    2498          79 :     SimpleInstallFunction(math, "atan2", Builtins::kMathAtan2, 2, true);
    2499          79 :     SimpleInstallFunction(math, "ceil", Builtins::kMathCeil, 1, true);
    2500          79 :     SimpleInstallFunction(math, "cbrt", Builtins::kMathCbrt, 1, true);
    2501          79 :     SimpleInstallFunction(math, "expm1", Builtins::kMathExpm1, 1, true);
    2502          79 :     SimpleInstallFunction(math, "clz32", Builtins::kMathClz32, 1, true);
    2503          79 :     SimpleInstallFunction(math, "cos", Builtins::kMathCos, 1, true);
    2504          79 :     SimpleInstallFunction(math, "cosh", Builtins::kMathCosh, 1, true);
    2505          79 :     SimpleInstallFunction(math, "exp", Builtins::kMathExp, 1, true);
    2506             :     Handle<JSFunction> math_floor =
    2507          79 :         SimpleInstallFunction(math, "floor", Builtins::kMathFloor, 1, true);
    2508             :     native_context()->set_math_floor(*math_floor);
    2509          79 :     SimpleInstallFunction(math, "fround", Builtins::kMathFround, 1, true);
    2510          79 :     SimpleInstallFunction(math, "hypot", Builtins::kMathHypot, 2, false);
    2511          79 :     SimpleInstallFunction(math, "imul", Builtins::kMathImul, 2, true);
    2512          79 :     SimpleInstallFunction(math, "log", Builtins::kMathLog, 1, true);
    2513          79 :     SimpleInstallFunction(math, "log1p", Builtins::kMathLog1p, 1, true);
    2514          79 :     SimpleInstallFunction(math, "log2", Builtins::kMathLog2, 1, true);
    2515          79 :     SimpleInstallFunction(math, "log10", Builtins::kMathLog10, 1, true);
    2516          79 :     SimpleInstallFunction(math, "max", Builtins::kMathMax, 2, false);
    2517          79 :     SimpleInstallFunction(math, "min", Builtins::kMathMin, 2, false);
    2518             :     Handle<JSFunction> math_pow =
    2519          79 :         SimpleInstallFunction(math, "pow", Builtins::kMathPow, 2, true);
    2520             :     native_context()->set_math_pow(*math_pow);
    2521          79 :     SimpleInstallFunction(math, "random", Builtins::kMathRandom, 0, true);
    2522          79 :     SimpleInstallFunction(math, "round", Builtins::kMathRound, 1, true);
    2523          79 :     SimpleInstallFunction(math, "sign", Builtins::kMathSign, 1, true);
    2524          79 :     SimpleInstallFunction(math, "sin", Builtins::kMathSin, 1, true);
    2525          79 :     SimpleInstallFunction(math, "sinh", Builtins::kMathSinh, 1, true);
    2526          79 :     SimpleInstallFunction(math, "sqrt", Builtins::kMathSqrt, 1, true);
    2527          79 :     SimpleInstallFunction(math, "tan", Builtins::kMathTan, 1, true);
    2528          79 :     SimpleInstallFunction(math, "tanh", Builtins::kMathTanh, 1, true);
    2529          79 :     SimpleInstallFunction(math, "trunc", Builtins::kMathTrunc, 1, true);
    2530             : 
    2531             :     // Install math constants.
    2532          79 :     double const kE = base::ieee754::exp(1.0);
    2533             :     double const kPI = 3.1415926535897932;
    2534          79 :     InstallConstant(isolate, math, "E", factory->NewNumber(kE));
    2535             :     InstallConstant(isolate, math, "LN10",
    2536          79 :                     factory->NewNumber(base::ieee754::log(10.0)));
    2537             :     InstallConstant(isolate, math, "LN2",
    2538          79 :                     factory->NewNumber(base::ieee754::log(2.0)));
    2539             :     InstallConstant(isolate, math, "LOG10E",
    2540          79 :                     factory->NewNumber(base::ieee754::log10(kE)));
    2541             :     InstallConstant(isolate, math, "LOG2E",
    2542          79 :                     factory->NewNumber(base::ieee754::log2(kE)));
    2543          79 :     InstallConstant(isolate, math, "PI", factory->NewNumber(kPI));
    2544             :     InstallConstant(isolate, math, "SQRT1_2",
    2545          79 :                     factory->NewNumber(std::sqrt(0.5)));
    2546          79 :     InstallConstant(isolate, math, "SQRT2", factory->NewNumber(std::sqrt(2.0)));
    2547             :     JSObject::AddProperty(
    2548             :         math, factory->to_string_tag_symbol(),
    2549             :         factory->NewStringFromAsciiChecked("Math"),
    2550         158 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2551             :   }
    2552             : 
    2553             :   {  // -- C o n s o l e
    2554          79 :     Handle<String> name = factory->InternalizeUtf8String("console");
    2555          79 :     Handle<JSFunction> cons = factory->NewFunction(name);
    2556          79 :     Handle<JSObject> empty = factory->NewJSObject(isolate->object_function());
    2557          79 :     JSFunction::SetPrototype(cons, empty);
    2558          79 :     Handle<JSObject> console = factory->NewJSObject(cons, TENURED);
    2559             :     DCHECK(console->IsJSObject());
    2560          79 :     JSObject::AddProperty(global, name, console, DONT_ENUM);
    2561             :     SimpleInstallFunction(console, "debug", Builtins::kConsoleDebug, 1, false,
    2562          79 :                           NONE);
    2563             :     SimpleInstallFunction(console, "error", Builtins::kConsoleError, 1, false,
    2564          79 :                           NONE);
    2565             :     SimpleInstallFunction(console, "info", Builtins::kConsoleInfo, 1, false,
    2566          79 :                           NONE);
    2567             :     SimpleInstallFunction(console, "log", Builtins::kConsoleLog, 1, false,
    2568          79 :                           NONE);
    2569             :     SimpleInstallFunction(console, "warn", Builtins::kConsoleWarn, 1, false,
    2570          79 :                           NONE);
    2571             :     SimpleInstallFunction(console, "dir", Builtins::kConsoleDir, 1, false,
    2572          79 :                           NONE);
    2573             :     SimpleInstallFunction(console, "dirxml", Builtins::kConsoleDirXml, 1, false,
    2574          79 :                           NONE);
    2575             :     SimpleInstallFunction(console, "table", Builtins::kConsoleTable, 1, false,
    2576          79 :                           NONE);
    2577             :     SimpleInstallFunction(console, "trace", Builtins::kConsoleTrace, 1, false,
    2578          79 :                           NONE);
    2579             :     SimpleInstallFunction(console, "group", Builtins::kConsoleGroup, 1, false,
    2580          79 :                           NONE);
    2581             :     SimpleInstallFunction(console, "groupCollapsed",
    2582          79 :                           Builtins::kConsoleGroupCollapsed, 1, false, NONE);
    2583             :     SimpleInstallFunction(console, "groupEnd", Builtins::kConsoleGroupEnd, 1,
    2584          79 :                           false, NONE);
    2585             :     SimpleInstallFunction(console, "clear", Builtins::kConsoleClear, 1, false,
    2586          79 :                           NONE);
    2587             :     SimpleInstallFunction(console, "count", Builtins::kConsoleCount, 1, false,
    2588          79 :                           NONE);
    2589             :     SimpleInstallFunction(console, "assert", Builtins::kFastConsoleAssert, 1,
    2590          79 :                           false, NONE);
    2591             :     SimpleInstallFunction(console, "markTimeline",
    2592          79 :                           Builtins::kConsoleMarkTimeline, 1, false, NONE);
    2593             :     SimpleInstallFunction(console, "profile", Builtins::kConsoleProfile, 1,
    2594          79 :                           false, NONE);
    2595             :     SimpleInstallFunction(console, "profileEnd", Builtins::kConsoleProfileEnd,
    2596          79 :                           1, false, NONE);
    2597             :     SimpleInstallFunction(console, "timeline", Builtins::kConsoleTimeline, 1,
    2598          79 :                           false, NONE);
    2599             :     SimpleInstallFunction(console, "timelineEnd", Builtins::kConsoleTimelineEnd,
    2600          79 :                           1, false, NONE);
    2601             :     SimpleInstallFunction(console, "time", Builtins::kConsoleTime, 1, false,
    2602          79 :                           NONE);
    2603             :     SimpleInstallFunction(console, "timeEnd", Builtins::kConsoleTimeEnd, 1,
    2604          79 :                           false, NONE);
    2605             :     SimpleInstallFunction(console, "timeStamp", Builtins::kConsoleTimeStamp, 1,
    2606          79 :                           false, NONE);
    2607             :     JSObject::AddProperty(
    2608             :         console, factory->to_string_tag_symbol(),
    2609             :         factory->NewStringFromAsciiChecked("Object"),
    2610         158 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2611             :   }
    2612             : 
    2613             : #ifdef V8_INTL_SUPPORT
    2614             :   {  // -- I n t l
    2615          79 :     Handle<String> name = factory->InternalizeUtf8String("Intl");
    2616          79 :     Handle<JSFunction> cons = factory->NewFunction(name);
    2617         158 :     JSFunction::SetPrototype(cons, isolate->initial_object_prototype());
    2618          79 :     Handle<JSObject> intl = factory->NewJSObject(cons, TENURED);
    2619             :     DCHECK(intl->IsJSObject());
    2620          79 :     JSObject::AddProperty(global, name, intl, DONT_ENUM);
    2621             : 
    2622             :     Handle<JSObject> date_time_format_prototype =
    2623          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2624             :     // Install the @@toStringTag property on the {prototype}.
    2625             :     JSObject::AddProperty(
    2626             :         date_time_format_prototype, factory->to_string_tag_symbol(),
    2627             :         factory->Object_string(),
    2628          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2629             :     Handle<JSFunction> date_time_format_constructor = InstallFunction(
    2630             :         intl, "DateTimeFormat", JS_OBJECT_TYPE, JSIntlDateTimeFormat::kSize,
    2631          79 :         date_time_format_prototype, Builtins::kIllegal);
    2632             :     JSObject::AddProperty(date_time_format_prototype,
    2633             :                           factory->constructor_string(),
    2634          79 :                           date_time_format_constructor, DONT_ENUM);
    2635             :     InstallWithIntrinsicDefaultProto(
    2636             :         isolate, date_time_format_constructor,
    2637          79 :         Context::INTL_DATE_TIME_FORMAT_FUNCTION_INDEX);
    2638             : 
    2639             :     Handle<JSObject> number_format_prototype =
    2640          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2641             :     // Install the @@toStringTag property on the {prototype}.
    2642             :     JSObject::AddProperty(
    2643             :         number_format_prototype, factory->to_string_tag_symbol(),
    2644             :         factory->Object_string(),
    2645          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2646             :     Handle<JSFunction> number_format_constructor = InstallFunction(
    2647             :         intl, "NumberFormat", JS_OBJECT_TYPE, JSIntlNumberFormat::kSize,
    2648          79 :         number_format_prototype, Builtins::kIllegal);
    2649             :     JSObject::AddProperty(number_format_prototype,
    2650             :                           factory->constructor_string(),
    2651          79 :                           number_format_constructor, DONT_ENUM);
    2652             :     InstallWithIntrinsicDefaultProto(
    2653             :         isolate, number_format_constructor,
    2654          79 :         Context::INTL_NUMBER_FORMAT_FUNCTION_INDEX);
    2655             : 
    2656             :     Handle<JSObject> collator_prototype =
    2657          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2658             :     // Install the @@toStringTag property on the {prototype}.
    2659             :     JSObject::AddProperty(
    2660             :         collator_prototype, factory->to_string_tag_symbol(),
    2661             :         factory->Object_string(),
    2662          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2663             :     Handle<JSFunction> collator_constructor =
    2664             :         InstallFunction(intl, "Collator", JS_OBJECT_TYPE, JSIntlCollator::kSize,
    2665          79 :                         collator_prototype, Builtins::kIllegal);
    2666             :     JSObject::AddProperty(collator_prototype, factory->constructor_string(),
    2667          79 :                           collator_constructor, DONT_ENUM);
    2668             :     InstallWithIntrinsicDefaultProto(isolate, collator_constructor,
    2669          79 :                                      Context::INTL_COLLATOR_FUNCTION_INDEX);
    2670             : 
    2671             :     Handle<JSObject> v8_break_iterator_prototype =
    2672          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2673             :     // Install the @@toStringTag property on the {prototype}.
    2674             :     JSObject::AddProperty(
    2675             :         v8_break_iterator_prototype, factory->to_string_tag_symbol(),
    2676             :         factory->Object_string(),
    2677          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2678             :     Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
    2679             :         intl, "v8BreakIterator", JS_OBJECT_TYPE, JSIntlV8BreakIterator::kSize,
    2680          79 :         v8_break_iterator_prototype, Builtins::kIllegal);
    2681             :     JSObject::AddProperty(v8_break_iterator_prototype,
    2682             :                           factory->constructor_string(),
    2683          79 :                           v8_break_iterator_constructor, DONT_ENUM);
    2684             :     InstallWithIntrinsicDefaultProto(
    2685             :         isolate, v8_break_iterator_constructor,
    2686          79 :         Context::INTL_V8_BREAK_ITERATOR_FUNCTION_INDEX);
    2687             :   }
    2688             : #endif  // V8_INTL_SUPPORT
    2689             : 
    2690             :   {  // -- A r r a y B u f f e r
    2691             :     Handle<JSFunction> array_buffer_fun = InstallArrayBuffer(
    2692             :         global, "ArrayBuffer", Builtins::kArrayBufferPrototypeGetByteLength,
    2693             :         BuiltinFunctionId::kArrayBufferByteLength,
    2694          79 :         Builtins::kArrayBufferPrototypeSlice);
    2695             :     InstallWithIntrinsicDefaultProto(isolate, array_buffer_fun,
    2696          79 :                                      Context::ARRAY_BUFFER_FUN_INDEX);
    2697          79 :     InstallSpeciesGetter(array_buffer_fun);
    2698             : 
    2699             :     Handle<JSFunction> array_buffer_noinit_fun = SimpleCreateFunction(
    2700             :         isolate,
    2701             :         factory->NewStringFromAsciiChecked(
    2702             :             "arrayBufferConstructor_DoNotInitialize"),
    2703          79 :         Builtins::kArrayBufferConstructor_DoNotInitialize, 1, false);
    2704             :     native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun);
    2705             :   }
    2706             : 
    2707             :   {  // -- T y p e d A r r a y
    2708             :     Handle<JSObject> prototype =
    2709          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2710             :     native_context()->set_typed_array_prototype(*prototype);
    2711             : 
    2712             :     Handle<JSFunction> typed_array_fun =
    2713             :         CreateFunction(isolate, factory->InternalizeUtf8String("TypedArray"),
    2714             :                        JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize, prototype,
    2715          79 :                        Builtins::kIllegal);
    2716             :     typed_array_fun->shared()->set_native(false);
    2717          79 :     InstallSpeciesGetter(typed_array_fun);
    2718             : 
    2719             :     // Install the "constructor" property on the {prototype}.
    2720             :     JSObject::AddProperty(prototype, factory->constructor_string(),
    2721          79 :                           typed_array_fun, DONT_ENUM);
    2722             :     native_context()->set_typed_array_function(*typed_array_fun);
    2723             : 
    2724             :     // Install the "buffer", "byteOffset", "byteLength" and "length"
    2725             :     // getters on the {prototype}.
    2726             :     SimpleInstallGetter(prototype, factory->buffer_string(),
    2727             :                         Builtins::kTypedArrayPrototypeBuffer, false);
    2728             :     SimpleInstallGetter(prototype, factory->byte_length_string(),
    2729             :                         Builtins::kTypedArrayPrototypeByteLength, true,
    2730          79 :                         kTypedArrayByteLength);
    2731             :     SimpleInstallGetter(prototype, factory->byte_offset_string(),
    2732             :                         Builtins::kTypedArrayPrototypeByteOffset, true,
    2733          79 :                         kTypedArrayByteOffset);
    2734             :     SimpleInstallGetter(prototype, factory->length_string(),
    2735             :                         Builtins::kTypedArrayPrototypeLength, true,
    2736          79 :                         kTypedArrayLength);
    2737             : 
    2738             :     // Install "keys", "values" and "entries" methods on the {prototype}.
    2739             :     Handle<JSFunction> entries =
    2740             :         SimpleInstallFunction(prototype, factory->entries_string(),
    2741          79 :                               Builtins::kTypedArrayPrototypeEntries, 0, true);
    2742             :     entries->shared()->set_builtin_function_id(kTypedArrayEntries);
    2743             : 
    2744             :     Handle<JSFunction> keys =
    2745             :         SimpleInstallFunction(prototype, factory->keys_string(),
    2746          79 :                               Builtins::kTypedArrayPrototypeKeys, 0, true);
    2747             :     keys->shared()->set_builtin_function_id(kTypedArrayKeys);
    2748             : 
    2749             :     Handle<JSFunction> values =
    2750             :         SimpleInstallFunction(prototype, factory->values_string(),
    2751          79 :                               Builtins::kTypedArrayPrototypeValues, 0, true);
    2752             :     values->shared()->set_builtin_function_id(kTypedArrayValues);
    2753             :     JSObject::AddProperty(prototype, factory->iterator_symbol(), values,
    2754          79 :                           DONT_ENUM);
    2755             : 
    2756             :     // TODO(caitp): alphasort accessors/methods
    2757             :     SimpleInstallFunction(prototype, "copyWithin",
    2758          79 :                           Builtins::kTypedArrayPrototypeCopyWithin, 2, false);
    2759             :     SimpleInstallFunction(prototype, "fill",
    2760          79 :                           Builtins::kTypedArrayPrototypeFill, 1, false);
    2761             :     SimpleInstallFunction(prototype, "includes",
    2762          79 :                           Builtins::kTypedArrayPrototypeIncludes, 1, false);
    2763             :     SimpleInstallFunction(prototype, "indexOf",
    2764          79 :                           Builtins::kTypedArrayPrototypeIndexOf, 1, false);
    2765             :     SimpleInstallFunction(prototype, "lastIndexOf",
    2766          79 :                           Builtins::kTypedArrayPrototypeLastIndexOf, 1, false);
    2767             :     SimpleInstallFunction(prototype, "reverse",
    2768          79 :                           Builtins::kTypedArrayPrototypeReverse, 0, false);
    2769             :     SimpleInstallFunction(prototype, "slice",
    2770          79 :                           Builtins::kTypedArrayPrototypeSlice, 2, false);
    2771             :   }
    2772             : 
    2773             :   {  // -- T y p e d A r r a y s
    2774             : #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype, size)             \
    2775             :   {                                                                    \
    2776             :     Handle<JSFunction> fun;                                            \
    2777             :     InstallTypedArray(#Type "Array", TYPE##_ELEMENTS, &fun);           \
    2778             :     InstallWithIntrinsicDefaultProto(isolate, fun,                     \
    2779             :                                      Context::TYPE##_ARRAY_FUN_INDEX); \
    2780             :   }
    2781         711 :     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
    2782             : #undef INSTALL_TYPED_ARRAY
    2783             : 
    2784             :     // %typed_array_construct_by_length
    2785             :     Handle<JSFunction> construct_by_length = SimpleCreateFunction(
    2786             :         isolate,
    2787             :         factory->NewStringFromAsciiChecked("typedArrayConstructByLength"),
    2788          79 :         Builtins::kTypedArrayConstructByLength, 3, false);
    2789             :     native_context()->set_typed_array_construct_by_length(*construct_by_length);
    2790             : 
    2791             :     // %typed_array_construct_by_array_buffer
    2792             :     Handle<JSFunction> construct_by_buffer = SimpleCreateFunction(
    2793             :         isolate,
    2794             :         factory->NewStringFromAsciiChecked("typedArrayConstructByArrayBuffer"),
    2795          79 :         Builtins::kTypedArrayConstructByArrayBuffer, 5, false);
    2796             :     native_context()->set_typed_array_construct_by_array_buffer(
    2797             :         *construct_by_buffer);
    2798             : 
    2799             :     // %typed_array_construct_by_array_like
    2800             :     Handle<JSFunction> construct_by_array_like = SimpleCreateFunction(
    2801             :         isolate,
    2802             :         factory->NewStringFromAsciiChecked("typedArrayConstructByArrayLike"),
    2803          79 :         Builtins::kTypedArrayConstructByArrayLike, 4, false);
    2804             :     native_context()->set_typed_array_construct_by_array_like(
    2805             :         *construct_by_array_like);
    2806             :   }
    2807             : 
    2808             :   {  // -- D a t a V i e w
    2809             :     Handle<JSObject> prototype =
    2810          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2811             :     Handle<JSFunction> data_view_fun =
    2812             :         InstallFunction(global, "DataView", JS_DATA_VIEW_TYPE,
    2813             :                         JSDataView::kSizeWithEmbedderFields, prototype,
    2814          79 :                         Builtins::kDataViewConstructor);
    2815             :     InstallWithIntrinsicDefaultProto(isolate, data_view_fun,
    2816          79 :                                      Context::DATA_VIEW_FUN_INDEX);
    2817             :     data_view_fun->shared()->SetConstructStub(
    2818         158 :         *isolate->builtins()->DataViewConstructor_ConstructStub());
    2819             :     data_view_fun->shared()->set_length(3);
    2820             :     data_view_fun->shared()->DontAdaptArguments();
    2821             : 
    2822             :     // Install the @@toStringTag property on the {prototype}.
    2823             :     JSObject::AddProperty(
    2824             :         prototype, factory->to_string_tag_symbol(),
    2825             :         factory->NewStringFromAsciiChecked("DataView"),
    2826         158 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2827             : 
    2828             :     // Install the "constructor" property on the {prototype}.
    2829             :     JSObject::AddProperty(prototype, factory->constructor_string(),
    2830          79 :                           data_view_fun, DONT_ENUM);
    2831             : 
    2832             :     // Install the "buffer", "byteOffset" and "byteLength" getters
    2833             :     // on the {prototype}.
    2834             :     SimpleInstallGetter(prototype, factory->buffer_string(),
    2835             :                         Builtins::kDataViewPrototypeGetBuffer, false,
    2836          79 :                         kDataViewBuffer);
    2837             :     SimpleInstallGetter(prototype, factory->byte_length_string(),
    2838             :                         Builtins::kDataViewPrototypeGetByteLength, false,
    2839          79 :                         kDataViewByteLength);
    2840             :     SimpleInstallGetter(prototype, factory->byte_offset_string(),
    2841             :                         Builtins::kDataViewPrototypeGetByteOffset, false,
    2842          79 :                         kDataViewByteOffset);
    2843             : 
    2844             :     SimpleInstallFunction(prototype, "getInt8",
    2845          79 :                           Builtins::kDataViewPrototypeGetInt8, 1, false);
    2846             :     SimpleInstallFunction(prototype, "setInt8",
    2847          79 :                           Builtins::kDataViewPrototypeSetInt8, 2, false);
    2848             :     SimpleInstallFunction(prototype, "getUint8",
    2849          79 :                           Builtins::kDataViewPrototypeGetUint8, 1, false);
    2850             :     SimpleInstallFunction(prototype, "setUint8",
    2851          79 :                           Builtins::kDataViewPrototypeSetUint8, 2, false);
    2852             :     SimpleInstallFunction(prototype, "getInt16",
    2853          79 :                           Builtins::kDataViewPrototypeGetInt16, 1, false);
    2854             :     SimpleInstallFunction(prototype, "setInt16",
    2855          79 :                           Builtins::kDataViewPrototypeSetInt16, 2, false);
    2856             :     SimpleInstallFunction(prototype, "getUint16",
    2857          79 :                           Builtins::kDataViewPrototypeGetUint16, 1, false);
    2858             :     SimpleInstallFunction(prototype, "setUint16",
    2859          79 :                           Builtins::kDataViewPrototypeSetUint16, 2, false);
    2860             :     SimpleInstallFunction(prototype, "getInt32",
    2861          79 :                           Builtins::kDataViewPrototypeGetInt32, 1, false);
    2862             :     SimpleInstallFunction(prototype, "setInt32",
    2863          79 :                           Builtins::kDataViewPrototypeSetInt32, 2, false);
    2864             :     SimpleInstallFunction(prototype, "getUint32",
    2865          79 :                           Builtins::kDataViewPrototypeGetUint32, 1, false);
    2866             :     SimpleInstallFunction(prototype, "setUint32",
    2867          79 :                           Builtins::kDataViewPrototypeSetUint32, 2, false);
    2868             :     SimpleInstallFunction(prototype, "getFloat32",
    2869          79 :                           Builtins::kDataViewPrototypeGetFloat32, 1, false);
    2870             :     SimpleInstallFunction(prototype, "setFloat32",
    2871          79 :                           Builtins::kDataViewPrototypeSetFloat32, 2, false);
    2872             :     SimpleInstallFunction(prototype, "getFloat64",
    2873          79 :                           Builtins::kDataViewPrototypeGetFloat64, 1, false);
    2874             :     SimpleInstallFunction(prototype, "setFloat64",
    2875          79 :                           Builtins::kDataViewPrototypeSetFloat64, 2, false);
    2876             :   }
    2877             : 
    2878             :   {  // -- M a p
    2879             :     Handle<JSFunction> js_map_fun = InstallFunction(
    2880             :         global, "Map", JS_MAP_TYPE, JSMap::kSize,
    2881         158 :         isolate->initial_object_prototype(), Builtins::kIllegal);
    2882             :     InstallWithIntrinsicDefaultProto(isolate, js_map_fun,
    2883          79 :                                      Context::JS_MAP_FUN_INDEX);
    2884          79 :     InstallSpeciesGetter(js_map_fun);
    2885             :   }
    2886             : 
    2887             :   {  // -- S e t
    2888             :     Handle<JSFunction> js_set_fun = InstallFunction(
    2889             :         global, "Set", JS_SET_TYPE, JSSet::kSize,
    2890         158 :         isolate->initial_object_prototype(), Builtins::kIllegal);
    2891             :     InstallWithIntrinsicDefaultProto(isolate, js_set_fun,
    2892          79 :                                      Context::JS_SET_FUN_INDEX);
    2893          79 :     InstallSpeciesGetter(js_set_fun);
    2894             :   }
    2895             : 
    2896             :   {  // -- J S M o d u l e N a m e s p a c e
    2897             :     Handle<Map> map =
    2898          79 :         factory->NewMap(JS_MODULE_NAMESPACE_TYPE, JSModuleNamespace::kSize);
    2899          79 :     Map::SetPrototype(map, isolate->factory()->null_value());
    2900          79 :     Map::EnsureDescriptorSlack(map, 1);
    2901             :     native_context()->set_js_module_namespace_map(*map);
    2902             : 
    2903             :     {  // Install @@toStringTag.
    2904             :       PropertyAttributes attribs =
    2905             :           static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY);
    2906             :       Descriptor d =
    2907             :           Descriptor::DataField(factory->to_string_tag_symbol(),
    2908             :                                 JSModuleNamespace::kToStringTagFieldIndex,
    2909          79 :                                 attribs, Representation::Tagged());
    2910          79 :       map->AppendDescriptor(&d);
    2911             :     }
    2912             : 
    2913             :     map->SetInObjectProperties(JSModuleNamespace::kInObjectFieldCount);
    2914             :   }
    2915             : 
    2916             :   {  // -- I t e r a t o r R e s u l t
    2917             :     Handle<Map> map =
    2918          79 :         factory->NewMap(JS_OBJECT_TYPE, JSIteratorResult::kSize);
    2919         158 :     Map::SetPrototype(map, isolate->initial_object_prototype());
    2920          79 :     Map::EnsureDescriptorSlack(map, 2);
    2921             : 
    2922             :     {  // value
    2923             :       Descriptor d = Descriptor::DataField(factory->value_string(),
    2924             :                                            JSIteratorResult::kValueIndex, NONE,
    2925          79 :                                            Representation::Tagged());
    2926          79 :       map->AppendDescriptor(&d);
    2927             :     }
    2928             : 
    2929             :     {  // done
    2930             :       Descriptor d = Descriptor::DataField(factory->done_string(),
    2931             :                                            JSIteratorResult::kDoneIndex, NONE,
    2932          79 :                                            Representation::Tagged());
    2933          79 :       map->AppendDescriptor(&d);
    2934             :     }
    2935             : 
    2936             :     map->SetConstructor(native_context()->object_function());
    2937             :     map->SetInObjectProperties(2);
    2938             :     native_context()->set_iterator_result_map(*map);
    2939             :   }
    2940             : 
    2941             :   {  // -- W e a k M a p
    2942             :     Handle<JSFunction> js_weak_map_fun = InstallFunction(
    2943             :         global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize,
    2944         158 :         isolate->initial_object_prototype(), Builtins::kIllegal);
    2945             :     InstallWithIntrinsicDefaultProto(isolate, js_weak_map_fun,
    2946          79 :                                      Context::JS_WEAK_MAP_FUN_INDEX);
    2947             :   }
    2948             : 
    2949             :   {  // -- W e a k S e t
    2950             :     Handle<JSFunction> js_weak_set_fun = InstallFunction(
    2951             :         global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize,
    2952         158 :         isolate->initial_object_prototype(), Builtins::kIllegal);
    2953             :     InstallWithIntrinsicDefaultProto(isolate, js_weak_set_fun,
    2954          79 :                                      Context::JS_WEAK_SET_FUN_INDEX);
    2955             :   }
    2956             : 
    2957             :   {  // -- P r o x y
    2958          79 :     CreateJSProxyMaps();
    2959             : 
    2960             :     Handle<String> name = factory->Proxy_string();
    2961          79 :     Handle<Code> code(isolate->builtins()->ProxyConstructor());
    2962             : 
    2963             :     Handle<JSFunction> proxy_function =
    2964             :         factory->NewFunction(isolate->proxy_function_map(),
    2965          79 :                              factory->Proxy_string(), MaybeHandle<Code>(code));
    2966             : 
    2967             :     JSFunction::SetInitialMap(
    2968             :         proxy_function, Handle<Map>(native_context()->proxy_map(), isolate),
    2969          79 :         factory->null_value());
    2970             : 
    2971             :     proxy_function->shared()->SetConstructStub(
    2972         158 :         *isolate->builtins()->ProxyConstructor_ConstructStub());
    2973             :     proxy_function->shared()->set_internal_formal_parameter_count(2);
    2974             :     proxy_function->shared()->set_length(2);
    2975             : 
    2976             :     native_context()->set_proxy_function(*proxy_function);
    2977          79 :     InstallFunction(global, name, proxy_function, factory->Object_string());
    2978             :   }
    2979             : 
    2980             :   {  // -- R e f l e c t
    2981          79 :     Handle<String> reflect_string = factory->InternalizeUtf8String("Reflect");
    2982             :     Handle<JSObject> reflect =
    2983          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2984          79 :     JSObject::AddProperty(global, reflect_string, reflect, DONT_ENUM);
    2985             : 
    2986             :     Handle<JSFunction> define_property =
    2987             :         SimpleInstallFunction(reflect, factory->defineProperty_string(),
    2988          79 :                               Builtins::kReflectDefineProperty, 3, true);
    2989             :     native_context()->set_reflect_define_property(*define_property);
    2990             : 
    2991             :     Handle<JSFunction> delete_property =
    2992             :         SimpleInstallFunction(reflect, factory->deleteProperty_string(),
    2993          79 :                               Builtins::kReflectDeleteProperty, 2, true);
    2994             :     native_context()->set_reflect_delete_property(*delete_property);
    2995             : 
    2996             :     Handle<JSFunction> apply = SimpleInstallFunction(
    2997          79 :         reflect, factory->apply_string(), Builtins::kReflectApply, 3, false);
    2998             :     native_context()->set_reflect_apply(*apply);
    2999             : 
    3000             :     Handle<JSFunction> construct =
    3001             :         SimpleInstallFunction(reflect, factory->construct_string(),
    3002          79 :                               Builtins::kReflectConstruct, 2, false);
    3003             :     native_context()->set_reflect_construct(*construct);
    3004             : 
    3005             :     SimpleInstallFunction(reflect, factory->get_string(), Builtins::kReflectGet,
    3006          79 :                           2, false);
    3007             :     SimpleInstallFunction(reflect, factory->getOwnPropertyDescriptor_string(),
    3008          79 :                           Builtins::kReflectGetOwnPropertyDescriptor, 2, true);
    3009             :     SimpleInstallFunction(reflect, factory->getPrototypeOf_string(),
    3010          79 :                           Builtins::kReflectGetPrototypeOf, 1, true);
    3011             :     SimpleInstallFunction(reflect, factory->has_string(), Builtins::kReflectHas,
    3012          79 :                           2, true);
    3013             :     SimpleInstallFunction(reflect, factory->isExtensible_string(),
    3014          79 :                           Builtins::kReflectIsExtensible, 1, true);
    3015             :     SimpleInstallFunction(reflect, factory->ownKeys_string(),
    3016          79 :                           Builtins::kReflectOwnKeys, 1, true);
    3017             :     SimpleInstallFunction(reflect, factory->preventExtensions_string(),
    3018          79 :                           Builtins::kReflectPreventExtensions, 1, true);
    3019             :     SimpleInstallFunction(reflect, factory->set_string(), Builtins::kReflectSet,
    3020          79 :                           3, false);
    3021             :     SimpleInstallFunction(reflect, factory->setPrototypeOf_string(),
    3022          79 :                           Builtins::kReflectSetPrototypeOf, 2, true);
    3023             :   }
    3024             : 
    3025             :   {  // --- B o u n d F u n c t i o n
    3026             :     Handle<Map> map =
    3027          79 :         factory->NewMap(JS_BOUND_FUNCTION_TYPE, JSBoundFunction::kSize);
    3028             :     map->set_is_callable();
    3029          79 :     Map::SetPrototype(map, empty_function);
    3030             : 
    3031             :     PropertyAttributes roc_attribs =
    3032             :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
    3033          79 :     Map::EnsureDescriptorSlack(map, 2);
    3034             : 
    3035             :     Handle<AccessorInfo> bound_length =
    3036          79 :         Accessors::BoundFunctionLengthInfo(isolate, roc_attribs);
    3037             :     {  // length
    3038             :       Descriptor d = Descriptor::AccessorConstant(factory->length_string(),
    3039             :                                                   bound_length, roc_attribs);
    3040          79 :       map->AppendDescriptor(&d);
    3041             :     }
    3042             :     Handle<AccessorInfo> bound_name =
    3043          79 :         Accessors::BoundFunctionNameInfo(isolate, roc_attribs);
    3044             :     {  // name
    3045             :       Descriptor d = Descriptor::AccessorConstant(factory->name_string(),
    3046             :                                                   bound_name, roc_attribs);
    3047          79 :       map->AppendDescriptor(&d);
    3048             :     }
    3049             :     map->SetInObjectProperties(0);
    3050             :     native_context()->set_bound_function_without_constructor_map(*map);
    3051             : 
    3052          79 :     map = Map::Copy(map, "IsConstructor");
    3053             :     map->set_is_constructor(true);
    3054             :     native_context()->set_bound_function_with_constructor_map(*map);
    3055             :   }
    3056             : 
    3057             :   {  // --- sloppy arguments map
    3058             :     // Make sure we can recognize argument objects at runtime.
    3059             :     // This is done by introducing an anonymous function with
    3060             :     // class_name equals 'Arguments'.
    3061             :     Handle<String> arguments_string = factory->Arguments_string();
    3062          79 :     Handle<Code> code = isolate->builtins()->Illegal();
    3063             :     Handle<JSFunction> function = factory->NewFunctionWithoutPrototype(
    3064          79 :         arguments_string, code);
    3065          79 :     function->shared()->set_instance_class_name(*arguments_string);
    3066             : 
    3067             :     Handle<Map> map = factory->NewMap(
    3068          79 :         JS_ARGUMENTS_TYPE, JSSloppyArgumentsObject::kSize, FAST_ELEMENTS);
    3069             :     // Create the descriptor array for the arguments object.
    3070          79 :     Map::EnsureDescriptorSlack(map, 2);
    3071             : 
    3072             :     {  // length
    3073             :       Descriptor d = Descriptor::DataField(
    3074             :           factory->length_string(), JSSloppyArgumentsObject::kLengthIndex,
    3075          79 :           DONT_ENUM, Representation::Tagged());
    3076          79 :       map->AppendDescriptor(&d);
    3077             :     }
    3078             :     {  // callee
    3079             :       Descriptor d = Descriptor::DataField(
    3080             :           factory->callee_string(), JSSloppyArgumentsObject::kCalleeIndex,
    3081          79 :           DONT_ENUM, Representation::Tagged());
    3082          79 :       map->AppendDescriptor(&d);
    3083             :     }
    3084             :     // @@iterator method is added later.
    3085             : 
    3086             :     map->SetInObjectProperties(2);
    3087             :     native_context()->set_sloppy_arguments_map(*map);
    3088             : 
    3089             :     DCHECK(!function->has_initial_map());
    3090             :     JSFunction::SetInitialMap(function, map,
    3091         158 :                               isolate->initial_object_prototype());
    3092             : 
    3093             :     DCHECK(!map->is_dictionary_map());
    3094             :     DCHECK(IsFastObjectElementsKind(map->elements_kind()));
    3095             :   }
    3096             : 
    3097             :   {  // --- fast and slow aliased arguments map
    3098          79 :     Handle<Map> map = isolate->sloppy_arguments_map();
    3099          79 :     map = Map::Copy(map, "FastAliasedArguments");
    3100             :     map->set_elements_kind(FAST_SLOPPY_ARGUMENTS_ELEMENTS);
    3101             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3102             :     native_context()->set_fast_aliased_arguments_map(*map);
    3103             : 
    3104          79 :     map = Map::Copy(map, "SlowAliasedArguments");
    3105             :     map->set_elements_kind(SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
    3106             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3107             :     native_context()->set_slow_aliased_arguments_map(*map);
    3108             :   }
    3109             : 
    3110             :   {  // --- strict mode arguments map
    3111             :     const PropertyAttributes attributes =
    3112             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3113             : 
    3114             :     // Create the ThrowTypeError function.
    3115          79 :     Handle<AccessorPair> callee = factory->NewAccessorPair();
    3116             : 
    3117          79 :     Handle<JSFunction> poison = GetStrictArgumentsPoisonFunction();
    3118             : 
    3119             :     // Install the ThrowTypeError function.
    3120          79 :     callee->set_getter(*poison);
    3121          79 :     callee->set_setter(*poison);
    3122             : 
    3123             :     // Create the map. Allocate one in-object field for length.
    3124             :     Handle<Map> map = factory->NewMap(
    3125          79 :         JS_ARGUMENTS_TYPE, JSStrictArgumentsObject::kSize, FAST_ELEMENTS);
    3126             :     // Create the descriptor array for the arguments object.
    3127          79 :     Map::EnsureDescriptorSlack(map, 2);
    3128             : 
    3129             :     {  // length
    3130             :       Descriptor d = Descriptor::DataField(
    3131             :           factory->length_string(), JSStrictArgumentsObject::kLengthIndex,
    3132          79 :           DONT_ENUM, Representation::Tagged());
    3133          79 :       map->AppendDescriptor(&d);
    3134             :     }
    3135             :     {  // callee
    3136             :       Descriptor d = Descriptor::AccessorConstant(factory->callee_string(),
    3137             :                                                   callee, attributes);
    3138          79 :       map->AppendDescriptor(&d);
    3139             :     }
    3140             :     // @@iterator method is added later.
    3141             : 
    3142             :     DCHECK_EQ(native_context()->object_function()->prototype(),
    3143             :               *isolate->initial_object_prototype());
    3144         158 :     Map::SetPrototype(map, isolate->initial_object_prototype());
    3145             :     map->SetInObjectProperties(1);
    3146             : 
    3147             :     // Copy constructor from the sloppy arguments boilerplate.
    3148             :     map->SetConstructor(
    3149          79 :         native_context()->sloppy_arguments_map()->GetConstructor());
    3150             : 
    3151             :     native_context()->set_strict_arguments_map(*map);
    3152             : 
    3153             :     DCHECK(!map->is_dictionary_map());
    3154             :     DCHECK(IsFastObjectElementsKind(map->elements_kind()));
    3155             :   }
    3156             : 
    3157             :   {  // --- context extension
    3158             :     // Create a function for the context extension objects.
    3159          79 :     Handle<Code> code = isolate->builtins()->Illegal();
    3160             :     Handle<JSFunction> context_extension_fun = factory->NewFunction(
    3161             :         factory->empty_string(), code, JS_CONTEXT_EXTENSION_OBJECT_TYPE,
    3162          79 :         JSObject::kHeaderSize);
    3163             : 
    3164             :     Handle<String> name = factory->InternalizeOneByteString(
    3165          79 :         STATIC_CHAR_VECTOR("context_extension"));
    3166          79 :     context_extension_fun->shared()->set_instance_class_name(*name);
    3167             :     native_context()->set_context_extension_function(*context_extension_fun);
    3168             :   }
    3169             : 
    3170             : 
    3171             :   {
    3172             :     // Set up the call-as-function delegate.
    3173          79 :     Handle<Code> code = isolate->builtins()->HandleApiCallAsFunction();
    3174             :     Handle<JSFunction> delegate = factory->NewFunction(
    3175          79 :         factory->empty_string(), code, JS_OBJECT_TYPE, JSObject::kHeaderSize);
    3176             :     native_context()->set_call_as_function_delegate(*delegate);
    3177             :     delegate->shared()->DontAdaptArguments();
    3178             :   }
    3179             : 
    3180             :   {
    3181             :     // Set up the call-as-constructor delegate.
    3182          79 :     Handle<Code> code = isolate->builtins()->HandleApiCallAsConstructor();
    3183             :     Handle<JSFunction> delegate = factory->NewFunction(
    3184          79 :         factory->empty_string(), code, JS_OBJECT_TYPE, JSObject::kHeaderSize);
    3185             :     native_context()->set_call_as_constructor_delegate(*delegate);
    3186             :     delegate->shared()->DontAdaptArguments();
    3187             :   }
    3188          79 : }  // NOLINT(readability/fn_size)
    3189             : 
    3190         711 : void Genesis::InstallTypedArray(const char* name, ElementsKind elements_kind,
    3191        2844 :                                 Handle<JSFunction>* fun) {
    3192         711 :   Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());
    3193             : 
    3194             :   Handle<JSObject> typed_array_prototype =
    3195         711 :       Handle<JSObject>(isolate()->typed_array_prototype());
    3196             :   Handle<JSFunction> typed_array_function =
    3197         711 :       Handle<JSFunction>(isolate()->typed_array_function());
    3198             : 
    3199             :   Handle<JSObject> prototype =
    3200        1422 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    3201             :   Handle<JSFunction> result = InstallFunction(
    3202             :       global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSizeWithEmbedderFields,
    3203         711 :       prototype, Builtins::kIllegal);
    3204             :   result->initial_map()->set_elements_kind(elements_kind);
    3205             : 
    3206        1422 :   CHECK(JSObject::SetPrototype(result, typed_array_function, false,
    3207             :                                Object::DONT_THROW)
    3208             :             .FromJust());
    3209             : 
    3210        1422 :   CHECK(JSObject::SetPrototype(prototype, typed_array_prototype, false,
    3211             :                                Object::DONT_THROW)
    3212             :             .FromJust());
    3213         711 :   *fun = result;
    3214         711 : }
    3215             : 
    3216             : 
    3217      106740 : void Genesis::InitializeExperimentalGlobal() {
    3218             : #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
    3219             : 
    3220      106740 :   HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
    3221      106740 :   HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
    3222      106740 :   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
    3223             : #undef FEATURE_INITIALIZE_GLOBAL
    3224             : 
    3225      106740 :   InitializeGlobal_experimental_fast_array_builtins();
    3226      106740 : }
    3227             : 
    3228       37208 : bool Bootstrapper::CompileBuiltin(Isolate* isolate, int index) {
    3229       18604 :   Vector<const char> name = Natives::GetScriptName(index);
    3230             :   Handle<String> source_code =
    3231       18604 :       isolate->bootstrapper()->GetNativeSource(CORE, index);
    3232             : 
    3233             :   // We pass in extras_utils so that builtin code can set it up for later use
    3234             :   // by actual extras code, compiled with CompileExtraBuiltin.
    3235       18604 :   Handle<Object> global = isolate->global_object();
    3236       18604 :   Handle<Object> utils = isolate->natives_utils_object();
    3237       18604 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3238       18604 :   Handle<Object> args[] = {global, utils, extras_utils};
    3239             : 
    3240             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3241       18604 :                                      arraysize(args), args, NATIVES_CODE);
    3242             : }
    3243             : 
    3244             : 
    3245         158 : bool Bootstrapper::CompileExtraBuiltin(Isolate* isolate, int index) {
    3246             :   HandleScope scope(isolate);
    3247          79 :   Vector<const char> name = ExtraNatives::GetScriptName(index);
    3248             :   Handle<String> source_code =
    3249          79 :       isolate->bootstrapper()->GetNativeSource(EXTRAS, index);
    3250          79 :   Handle<Object> global = isolate->global_object();
    3251          79 :   Handle<Object> binding = isolate->extras_binding_object();
    3252          79 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3253          79 :   Handle<Object> args[] = {global, binding, extras_utils};
    3254             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3255         158 :                                      arraysize(args), args, EXTENSION_CODE);
    3256             : }
    3257             : 
    3258             : 
    3259          12 : bool Bootstrapper::CompileExperimentalExtraBuiltin(Isolate* isolate,
    3260             :                                                    int index) {
    3261             :   HandleScope scope(isolate);
    3262           6 :   Vector<const char> name = ExperimentalExtraNatives::GetScriptName(index);
    3263             :   Handle<String> source_code =
    3264           6 :       isolate->bootstrapper()->GetNativeSource(EXPERIMENTAL_EXTRAS, index);
    3265           6 :   Handle<Object> global = isolate->global_object();
    3266           6 :   Handle<Object> binding = isolate->extras_binding_object();
    3267           6 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3268           6 :   Handle<Object> args[] = {global, binding, extras_utils};
    3269             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3270          12 :                                      arraysize(args), args, EXTENSION_CODE);
    3271             : }
    3272             : 
    3273       36689 : bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
    3274             :                                  Handle<String> source, int argc,
    3275             :                                  Handle<Object> argv[],
    3276             :                                  NativesFlag natives_flag) {
    3277             :   SuppressDebug compiling_natives(isolate->debug());
    3278             :   // During genesis, the boilerplate for stack overflow won't work until the
    3279             :   // environment has been at least partially initialized. Add a stack check
    3280             :   // before entering JS code to catch overflow early.
    3281             :   StackLimitCheck check(isolate);
    3282       18689 :   if (check.JsHasOverflowed(4 * KB)) {
    3283         689 :     isolate->StackOverflow();
    3284         689 :     return false;
    3285             :   }
    3286             : 
    3287             :   Handle<Context> context(isolate->context());
    3288             : 
    3289             :   Handle<String> script_name =
    3290       36000 :       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
    3291             :   Handle<SharedFunctionInfo> function_info =
    3292             :       Compiler::GetSharedFunctionInfoForScript(
    3293             :           source, script_name, 0, 0, ScriptOriginOptions(), Handle<Object>(),
    3294       18000 :           context, NULL, NULL, ScriptCompiler::kNoCompileOptions, natives_flag);
    3295       18000 :   if (function_info.is_null()) return false;
    3296             : 
    3297             :   DCHECK(context->IsNativeContext());
    3298             : 
    3299             :   Handle<JSFunction> fun =
    3300             :       isolate->factory()->NewFunctionFromSharedFunctionInfo(function_info,
    3301       17380 :                                                             context);
    3302             :   Handle<Object> receiver = isolate->factory()->undefined_value();
    3303             : 
    3304             :   // For non-extension scripts, run script to get the function wrapper.
    3305             :   Handle<Object> wrapper;
    3306       17380 :   if (!Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3307             :                           Execution::MessageHandling::kKeepPending, nullptr)
    3308       34760 :            .ToHandle(&wrapper)) {
    3309             :     return false;
    3310             :   }
    3311             :   // Then run the function wrapper.
    3312             :   return !Execution::TryCall(isolate, Handle<JSFunction>::cast(wrapper),
    3313             :                              receiver, argc, argv,
    3314             :                              Execution::MessageHandling::kKeepPending, nullptr)
    3315       34760 :               .is_null();
    3316             : }
    3317             : 
    3318             : 
    3319          79 : bool Genesis::CallUtilsFunction(Isolate* isolate, const char* name) {
    3320             :   Handle<JSObject> utils =
    3321          79 :       Handle<JSObject>::cast(isolate->natives_utils_object());
    3322             :   Handle<String> name_string =
    3323          79 :       isolate->factory()->NewStringFromAsciiChecked(name);
    3324          79 :   Handle<Object> fun = JSObject::GetDataProperty(utils, name_string);
    3325             :   Handle<Object> receiver = isolate->factory()->undefined_value();
    3326             :   Handle<Object> args[] = {utils};
    3327             :   return !Execution::TryCall(isolate, fun, receiver, 1, args,
    3328             :                              Execution::MessageHandling::kKeepPending, nullptr)
    3329         158 :               .is_null();
    3330             : }
    3331             : 
    3332             : 
    3333       25729 : bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
    3334             :   Factory* factory = isolate->factory();
    3335             :   HandleScope scope(isolate);
    3336             :   Handle<SharedFunctionInfo> function_info;
    3337             : 
    3338             :   Handle<String> source =
    3339             :       isolate->factory()
    3340             :           ->NewExternalStringFromOneByte(extension->source())
    3341       12865 :           .ToHandleChecked();
    3342             :   DCHECK(source->IsOneByteRepresentation());
    3343             : 
    3344             :   // If we can't find the function in the cache, we compile a new
    3345             :   // function and insert it into the cache.
    3346        6432 :   Vector<const char> name = CStrVector(extension->name());
    3347        6432 :   SourceCodeCache* cache = isolate->bootstrapper()->extensions_cache();
    3348             :   Handle<Context> context(isolate->context());
    3349             :   DCHECK(context->IsNativeContext());
    3350             : 
    3351        6436 :   if (!cache->Lookup(name, &function_info)) {
    3352             :     Handle<String> script_name =
    3353        9483 :         factory->NewStringFromUtf8(name).ToHandleChecked();
    3354             :     function_info = Compiler::GetSharedFunctionInfoForScript(
    3355             :         source, script_name, 0, 0, ScriptOriginOptions(), Handle<Object>(),
    3356             :         context, extension, NULL, ScriptCompiler::kNoCompileOptions,
    3357        4742 :         EXTENSION_CODE);
    3358        4732 :     if (function_info.is_null()) return false;
    3359        4697 :     cache->Add(name, function_info);
    3360             :   }
    3361             : 
    3362             :   // Set up the function context. Conceptually, we should clone the
    3363             :   // function before overwriting the context but since we're in a
    3364             :   // single-threaded environment it is not strictly necessary.
    3365             :   Handle<JSFunction> fun =
    3366        6385 :       factory->NewFunctionFromSharedFunctionInfo(function_info, context);
    3367             : 
    3368             :   // Call function using either the runtime object or the global
    3369             :   // object as the receiver. Provide no parameters.
    3370        6399 :   Handle<Object> receiver = isolate->global_object();
    3371             :   return !Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3372             :                              Execution::MessageHandling::kKeepPending, nullptr)
    3373       12802 :               .is_null();
    3374             : }
    3375             : 
    3376             : 
    3377        9954 : static Handle<JSObject> ResolveBuiltinIdHolder(Handle<Context> native_context,
    3378             :                                                const char* holder_expr) {
    3379             :   Isolate* isolate = native_context->GetIsolate();
    3380             :   Factory* factory = isolate->factory();
    3381        9954 :   Handle<JSGlobalObject> global(native_context->global_object());
    3382             :   const char* period_pos = strchr(holder_expr, '.');
    3383        9954 :   if (period_pos == NULL) {
    3384             :     return Handle<JSObject>::cast(
    3385             :         Object::GetPropertyOrElement(
    3386             :             global, factory->InternalizeUtf8String(holder_expr))
    3387       11139 :             .ToHandleChecked());
    3388             :   }
    3389        6241 :   const char* inner = period_pos + 1;
    3390             :   DCHECK(!strchr(inner, '.'));
    3391             :   Vector<const char> property(holder_expr,
    3392        6241 :                               static_cast<int>(period_pos - holder_expr));
    3393        6241 :   Handle<String> property_string = factory->InternalizeUtf8String(property);
    3394             :   DCHECK(!property_string.is_null());
    3395             :   Handle<JSObject> object = Handle<JSObject>::cast(
    3396       12482 :       JSReceiver::GetProperty(global, property_string).ToHandleChecked());
    3397        6241 :   if (strcmp("prototype", inner) == 0) {
    3398             :     Handle<JSFunction> function = Handle<JSFunction>::cast(object);
    3399       12482 :     return Handle<JSObject>(JSObject::cast(function->prototype()));
    3400             :   }
    3401           0 :   Handle<String> inner_string = factory->InternalizeUtf8String(inner);
    3402             :   DCHECK(!inner_string.is_null());
    3403             :   Handle<Object> value =
    3404           0 :       JSReceiver::GetProperty(object, inner_string).ToHandleChecked();
    3405             :   return Handle<JSObject>::cast(value);
    3406             : }
    3407             : 
    3408      506115 : void Genesis::ConfigureUtilsObject(GlobalContextType context_type) {
    3409      105618 :   switch (context_type) {
    3410             :     // We still need the utils object to find debug functions.
    3411             :     case DEBUG_CONTEXT:
    3412             :       return;
    3413             :     // Expose the natives in global if a valid name for it is specified.
    3414             :     case FULL_CONTEXT: {
    3415             :       // We still need the utils object after deserialization.
    3416      100435 :       if (isolate()->serializer_enabled()) return;
    3417      100061 :       if (FLAG_expose_natives_as == NULL) break;
    3418          48 :       if (strlen(FLAG_expose_natives_as) == 0) break;
    3419             :       HandleScope scope(isolate());
    3420             :       Handle<String> natives_key =
    3421          48 :           factory()->InternalizeUtf8String(FLAG_expose_natives_as);
    3422             :       uint32_t dummy_index;
    3423          48 :       if (natives_key->AsArrayIndex(&dummy_index)) break;
    3424          33 :       Handle<Object> utils = isolate()->natives_utils_object();
    3425          33 :       Handle<JSObject> global = isolate()->global_object();
    3426          33 :       JSObject::AddProperty(global, natives_key, utils, DONT_ENUM);
    3427          33 :       break;
    3428             :     }
    3429             :   }
    3430             : 
    3431             :   // The utils object can be removed for cases that reach this point.
    3432      100061 :   native_context()->set_natives_utils_object(heap()->undefined_value());
    3433      100061 :   native_context()->set_extras_utils_object(heap()->undefined_value());
    3434      100061 :   native_context()->set_exports_container(heap()->undefined_value());
    3435             : }
    3436             : 
    3437             : 
    3438          79 : void Bootstrapper::ExportFromRuntime(Isolate* isolate,
    3439             :                                      Handle<JSObject> container) {
    3440             :   Factory* factory = isolate->factory();
    3441             :   HandleScope scope(isolate);
    3442          79 :   Handle<Context> native_context = isolate->native_context();
    3443             : #define EXPORT_PRIVATE_SYMBOL(NAME)                                       \
    3444             :   Handle<String> NAME##_name = factory->NewStringFromAsciiChecked(#NAME); \
    3445             :   JSObject::AddProperty(container, NAME##_name, factory->NAME(), NONE);
    3446        2765 :   PRIVATE_SYMBOL_LIST(EXPORT_PRIVATE_SYMBOL)
    3447             : #undef EXPORT_PRIVATE_SYMBOL
    3448             : 
    3449             : #define EXPORT_PUBLIC_SYMBOL(NAME, DESCRIPTION)                           \
    3450             :   Handle<String> NAME##_name = factory->NewStringFromAsciiChecked(#NAME); \
    3451             :   JSObject::AddProperty(container, NAME##_name, factory->NAME(), NONE);
    3452         869 :   PUBLIC_SYMBOL_LIST(EXPORT_PUBLIC_SYMBOL)
    3453         316 :   WELL_KNOWN_SYMBOL_LIST(EXPORT_PUBLIC_SYMBOL)
    3454             : #undef EXPORT_PUBLIC_SYMBOL
    3455             : 
    3456             :   Handle<JSObject> iterator_prototype(
    3457             :       native_context->initial_iterator_prototype());
    3458             : 
    3459             :   JSObject::AddProperty(container,
    3460             :                         factory->InternalizeUtf8String("IteratorPrototype"),
    3461         158 :                         iterator_prototype, NONE);
    3462             : 
    3463             :   {
    3464          79 :     PrototypeIterator iter(native_context->generator_function_map());
    3465          79 :     Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>());
    3466             : 
    3467             :     JSObject::AddProperty(
    3468             :         container, factory->InternalizeUtf8String("GeneratorFunctionPrototype"),
    3469         158 :         generator_function_prototype, NONE);
    3470             : 
    3471             :     static const bool kUseStrictFunctionMap = true;
    3472             :     Handle<JSFunction> generator_function_function = InstallFunction(
    3473             :         container, "GeneratorFunction", JS_FUNCTION_TYPE, JSFunction::kSize,
    3474             :         generator_function_prototype, Builtins::kGeneratorFunctionConstructor,
    3475          79 :         kUseStrictFunctionMap);
    3476             :     generator_function_function->set_prototype_or_initial_map(
    3477          79 :         native_context->generator_function_map());
    3478             :     generator_function_function->shared()->DontAdaptArguments();
    3479             :     generator_function_function->shared()->SetConstructStub(
    3480         158 :         *isolate->builtins()->GeneratorFunctionConstructor());
    3481             :     generator_function_function->shared()->set_length(1);
    3482             :     InstallWithIntrinsicDefaultProto(
    3483             :         isolate, generator_function_function,
    3484          79 :         Context::GENERATOR_FUNCTION_FUNCTION_INDEX);
    3485             : 
    3486             :     JSObject::ForceSetPrototype(generator_function_function,
    3487         158 :                                 isolate->function_function());
    3488             :     JSObject::AddProperty(
    3489             :         generator_function_prototype, factory->constructor_string(),
    3490             :         generator_function_function,
    3491          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3492             : 
    3493             :     native_context->generator_function_map()->SetConstructor(
    3494             :         *generator_function_function);
    3495             :   }
    3496             : 
    3497             :   {
    3498          79 :     PrototypeIterator iter(native_context->async_generator_function_map());
    3499             :     Handle<JSObject> async_generator_function_prototype(
    3500          79 :         iter.GetCurrent<JSObject>());
    3501             : 
    3502             :     static const bool kUseStrictFunctionMap = true;
    3503             :     Handle<JSFunction> async_generator_function_function = InstallFunction(
    3504             :         container, "AsyncGeneratorFunction", JS_FUNCTION_TYPE,
    3505             :         JSFunction::kSize, async_generator_function_prototype,
    3506          79 :         Builtins::kAsyncGeneratorFunctionConstructor, kUseStrictFunctionMap);
    3507             :     async_generator_function_function->set_prototype_or_initial_map(
    3508          79 :         native_context->async_generator_function_map());
    3509             :     async_generator_function_function->shared()->DontAdaptArguments();
    3510             :     async_generator_function_function->shared()->SetConstructStub(
    3511         158 :         *isolate->builtins()->AsyncGeneratorFunctionConstructor());
    3512             :     async_generator_function_function->shared()->set_length(1);
    3513             :     InstallWithIntrinsicDefaultProto(
    3514             :         isolate, async_generator_function_function,
    3515          79 :         Context::ASYNC_GENERATOR_FUNCTION_FUNCTION_INDEX);
    3516             : 
    3517             :     JSObject::ForceSetPrototype(async_generator_function_function,
    3518         158 :                                 isolate->function_function());
    3519             : 
    3520             :     JSObject::AddProperty(
    3521             :         async_generator_function_prototype, factory->constructor_string(),
    3522             :         async_generator_function_function,
    3523          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3524             : 
    3525             :     native_context->async_generator_function_map()->SetConstructor(
    3526             :         *async_generator_function_function);
    3527             :   }
    3528             : 
    3529             :   {  // -- S e t I t e r a t o r
    3530             :     Handle<JSObject> set_iterator_prototype =
    3531          79 :         isolate->factory()->NewJSObject(isolate->object_function(), TENURED);
    3532          79 :     JSObject::ForceSetPrototype(set_iterator_prototype, iterator_prototype);
    3533             :     Handle<JSFunction> set_iterator_function = InstallFunction(
    3534             :         container, "SetIterator", JS_SET_ITERATOR_TYPE, JSSetIterator::kSize,
    3535          79 :         set_iterator_prototype, Builtins::kIllegal);
    3536             :     native_context->set_set_iterator_map(set_iterator_function->initial_map());
    3537             :   }
    3538             : 
    3539             :   {  // -- M a p I t e r a t o r
    3540             :     Handle<JSObject> map_iterator_prototype =
    3541          79 :         isolate->factory()->NewJSObject(isolate->object_function(), TENURED);
    3542          79 :     JSObject::ForceSetPrototype(map_iterator_prototype, iterator_prototype);
    3543             :     Handle<JSFunction> map_iterator_function = InstallFunction(
    3544             :         container, "MapIterator", JS_MAP_ITERATOR_TYPE, JSMapIterator::kSize,
    3545          79 :         map_iterator_prototype, Builtins::kIllegal);
    3546             :     native_context->set_map_iterator_map(map_iterator_function->initial_map());
    3547             :   }
    3548             : 
    3549             :   {  // -- S c r i p t
    3550             :     // Builtin functions for Script.
    3551             :     Handle<JSFunction> script_fun = InstallFunction(
    3552             :         container, "Script", JS_VALUE_TYPE, JSValue::kSize,
    3553         158 :         isolate->initial_object_prototype(), Builtins::kUnsupportedThrower);
    3554             :     Handle<JSObject> prototype =
    3555          79 :         factory->NewJSObject(isolate->object_function(), TENURED);
    3556          79 :     JSFunction::SetPrototype(script_fun, prototype);
    3557             :     native_context->set_script_function(*script_fun);
    3558             : 
    3559             :     Handle<Map> script_map = Handle<Map>(script_fun->initial_map());
    3560          79 :     Map::EnsureDescriptorSlack(script_map, 15);
    3561             : 
    3562             :     PropertyAttributes attribs =
    3563             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3564             : 
    3565             :     Handle<AccessorInfo> script_column =
    3566          79 :         Accessors::ScriptColumnOffsetInfo(isolate, attribs);
    3567             :     {
    3568             :       Descriptor d = Descriptor::AccessorConstant(
    3569             :           Handle<Name>(Name::cast(script_column->name())), script_column,
    3570             :           attribs);
    3571          79 :       script_map->AppendDescriptor(&d);
    3572             :     }
    3573             : 
    3574          79 :     Handle<AccessorInfo> script_id = Accessors::ScriptIdInfo(isolate, attribs);
    3575             :     {
    3576             :       Descriptor d = Descriptor::AccessorConstant(
    3577             :           Handle<Name>(Name::cast(script_id->name())), script_id, attribs);
    3578          79 :       script_map->AppendDescriptor(&d);
    3579             :     }
    3580             : 
    3581             : 
    3582             :     Handle<AccessorInfo> script_name =
    3583          79 :         Accessors::ScriptNameInfo(isolate, attribs);
    3584             :     {
    3585             :       Descriptor d = Descriptor::AccessorConstant(
    3586             :           Handle<Name>(Name::cast(script_name->name())), script_name, attribs);
    3587          79 :       script_map->AppendDescriptor(&d);
    3588             :     }
    3589             : 
    3590             :     Handle<AccessorInfo> script_line =
    3591          79 :         Accessors::ScriptLineOffsetInfo(isolate, attribs);
    3592             :     {
    3593             :       Descriptor d = Descriptor::AccessorConstant(
    3594             :           Handle<Name>(Name::cast(script_line->name())), script_line, attribs);
    3595          79 :       script_map->AppendDescriptor(&d);
    3596             :     }
    3597             : 
    3598             :     Handle<AccessorInfo> script_source =
    3599          79 :         Accessors::ScriptSourceInfo(isolate, attribs);
    3600             :     {
    3601             :       Descriptor d = Descriptor::AccessorConstant(
    3602             :           Handle<Name>(Name::cast(script_source->name())), script_source,
    3603             :           attribs);
    3604          79 :       script_map->AppendDescriptor(&d);
    3605             :     }
    3606             : 
    3607             :     Handle<AccessorInfo> script_type =
    3608          79 :         Accessors::ScriptTypeInfo(isolate, attribs);
    3609             :     {
    3610             :       Descriptor d = Descriptor::AccessorConstant(
    3611             :           Handle<Name>(Name::cast(script_type->name())), script_type, attribs);
    3612          79 :       script_map->AppendDescriptor(&d);
    3613             :     }
    3614             : 
    3615             :     Handle<AccessorInfo> script_compilation_type =
    3616          79 :         Accessors::ScriptCompilationTypeInfo(isolate, attribs);
    3617             :     {
    3618             :       Descriptor d = Descriptor::AccessorConstant(
    3619             :           Handle<Name>(Name::cast(script_compilation_type->name())),
    3620             :           script_compilation_type, attribs);
    3621          79 :       script_map->AppendDescriptor(&d);
    3622             :     }
    3623             : 
    3624             :     Handle<AccessorInfo> script_context_data =
    3625          79 :         Accessors::ScriptContextDataInfo(isolate, attribs);
    3626             :     {
    3627             :       Descriptor d = Descriptor::AccessorConstant(
    3628             :           Handle<Name>(Name::cast(script_context_data->name())),
    3629             :           script_context_data, attribs);
    3630          79 :       script_map->AppendDescriptor(&d);
    3631             :     }
    3632             : 
    3633             :     Handle<AccessorInfo> script_eval_from_script =
    3634          79 :         Accessors::ScriptEvalFromScriptInfo(isolate, attribs);
    3635             :     {
    3636             :       Descriptor d = Descriptor::AccessorConstant(
    3637             :           Handle<Name>(Name::cast(script_eval_from_script->name())),
    3638             :           script_eval_from_script, attribs);
    3639          79 :       script_map->AppendDescriptor(&d);
    3640             :     }
    3641             : 
    3642             :     Handle<AccessorInfo> script_eval_from_script_position =
    3643          79 :         Accessors::ScriptEvalFromScriptPositionInfo(isolate, attribs);
    3644             :     {
    3645             :       Descriptor d = Descriptor::AccessorConstant(
    3646             :           Handle<Name>(Name::cast(script_eval_from_script_position->name())),
    3647             :           script_eval_from_script_position, attribs);
    3648          79 :       script_map->AppendDescriptor(&d);
    3649             :     }
    3650             : 
    3651             :     Handle<AccessorInfo> script_eval_from_function_name =
    3652          79 :         Accessors::ScriptEvalFromFunctionNameInfo(isolate, attribs);
    3653             :     {
    3654             :       Descriptor d = Descriptor::AccessorConstant(
    3655             :           Handle<Name>(Name::cast(script_eval_from_function_name->name())),
    3656             :           script_eval_from_function_name, attribs);
    3657          79 :       script_map->AppendDescriptor(&d);
    3658             :     }
    3659             : 
    3660             :     Handle<AccessorInfo> script_source_url =
    3661          79 :         Accessors::ScriptSourceUrlInfo(isolate, attribs);
    3662             :     {
    3663             :       Descriptor d = Descriptor::AccessorConstant(
    3664             :           Handle<Name>(Name::cast(script_source_url->name())),
    3665             :           script_source_url, attribs);
    3666          79 :       script_map->AppendDescriptor(&d);
    3667             :     }
    3668             : 
    3669             :     Handle<AccessorInfo> script_source_mapping_url =
    3670          79 :         Accessors::ScriptSourceMappingUrlInfo(isolate, attribs);
    3671             :     {
    3672             :       Descriptor d = Descriptor::AccessorConstant(
    3673             :           Handle<Name>(Name::cast(script_source_mapping_url->name())),
    3674             :           script_source_mapping_url, attribs);
    3675          79 :       script_map->AppendDescriptor(&d);
    3676             :     }
    3677             :   }
    3678             : 
    3679             :   {  // -- A s y n c F u n c t i o n
    3680             :     // Builtin functions for AsyncFunction.
    3681          79 :     PrototypeIterator iter(native_context->async_function_map());
    3682          79 :     Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>());
    3683             : 
    3684             :     static const bool kUseStrictFunctionMap = true;
    3685             :     Handle<JSFunction> async_function_constructor = InstallFunction(
    3686             :         container, "AsyncFunction", JS_FUNCTION_TYPE, JSFunction::kSize,
    3687             :         async_function_prototype, Builtins::kAsyncFunctionConstructor,
    3688          79 :         kUseStrictFunctionMap);
    3689             :     async_function_constructor->shared()->DontAdaptArguments();
    3690             :     async_function_constructor->shared()->SetConstructStub(
    3691         158 :         *isolate->builtins()->AsyncFunctionConstructor());
    3692             :     async_function_constructor->shared()->set_length(1);
    3693             :     InstallWithIntrinsicDefaultProto(isolate, async_function_constructor,
    3694          79 :                                      Context::ASYNC_FUNCTION_FUNCTION_INDEX);
    3695             :     JSObject::ForceSetPrototype(async_function_constructor,
    3696         158 :                                 isolate->function_function());
    3697             : 
    3698             :     JSObject::AddProperty(
    3699             :         async_function_prototype, factory->constructor_string(),
    3700             :         async_function_constructor,
    3701          79 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3702             : 
    3703             :     JSFunction::SetPrototype(async_function_constructor,
    3704          79 :                              async_function_prototype);
    3705             : 
    3706             :     {
    3707             :       Handle<JSFunction> function =
    3708             :           SimpleCreateFunction(isolate, factory->empty_string(),
    3709          79 :                                Builtins::kAsyncFunctionAwaitCaught, 3, false);
    3710             :       InstallWithIntrinsicDefaultProto(
    3711          79 :           isolate, function, Context::ASYNC_FUNCTION_AWAIT_CAUGHT_INDEX);
    3712             :     }
    3713             : 
    3714             :     {
    3715             :       Handle<JSFunction> function =
    3716             :           SimpleCreateFunction(isolate, factory->empty_string(),
    3717          79 :                                Builtins::kAsyncFunctionAwaitUncaught, 3, false);
    3718             :       InstallWithIntrinsicDefaultProto(
    3719          79 :           isolate, function, Context::ASYNC_FUNCTION_AWAIT_UNCAUGHT_INDEX);
    3720             :     }
    3721             : 
    3722             :     {
    3723             :       Handle<Code> code =
    3724          79 :           isolate->builtins()->AsyncFunctionAwaitRejectClosure();
    3725             :       Handle<SharedFunctionInfo> info =
    3726          79 :           factory->NewSharedFunctionInfo(factory->empty_string(), code, false);
    3727             :       info->set_internal_formal_parameter_count(1);
    3728             :       info->set_length(1);
    3729             :       native_context->set_async_function_await_reject_shared_fun(*info);
    3730             :     }
    3731             : 
    3732             :     {
    3733             :       Handle<Code> code =
    3734          79 :           isolate->builtins()->AsyncFunctionAwaitResolveClosure();
    3735             :       Handle<SharedFunctionInfo> info =
    3736          79 :           factory->NewSharedFunctionInfo(factory->empty_string(), code, false);
    3737             :       info->set_internal_formal_parameter_count(1);
    3738             :       info->set_length(1);
    3739             :       native_context->set_async_function_await_resolve_shared_fun(*info);
    3740             :     }
    3741             : 
    3742             :     {
    3743             :       Handle<JSFunction> function =
    3744             :           SimpleCreateFunction(isolate, factory->empty_string(),
    3745          79 :                                Builtins::kAsyncFunctionPromiseCreate, 0, false);
    3746             :       InstallWithIntrinsicDefaultProto(
    3747          79 :           isolate, function, Context::ASYNC_FUNCTION_PROMISE_CREATE_INDEX);
    3748             :     }
    3749             : 
    3750             :     {
    3751             :       Handle<JSFunction> function = SimpleCreateFunction(
    3752             :           isolate, factory->empty_string(),
    3753          79 :           Builtins::kAsyncFunctionPromiseRelease, 1, false);
    3754             :       InstallWithIntrinsicDefaultProto(
    3755          79 :           isolate, function, Context::ASYNC_FUNCTION_PROMISE_RELEASE_INDEX);
    3756             :     }
    3757             :   }
    3758             : 
    3759             :   {  // -- C a l l S i t e
    3760             :     // Builtin functions for CallSite.
    3761             : 
    3762             :     // CallSites are a special case; the constructor is for our private use
    3763             :     // only, therefore we set it up as a builtin that throws. Internally, we use
    3764             :     // CallSiteUtils::Construct to create CallSite objects.
    3765             : 
    3766             :     Handle<JSFunction> callsite_fun = InstallFunction(
    3767             :         container, "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize,
    3768         158 :         isolate->initial_object_prototype(), Builtins::kUnsupportedThrower);
    3769             :     callsite_fun->shared()->DontAdaptArguments();
    3770         158 :     isolate->native_context()->set_callsite_function(*callsite_fun);
    3771             : 
    3772             :     {
    3773             :       Handle<JSObject> proto =
    3774          79 :           factory->NewJSObject(isolate->object_function(), TENURED);
    3775             :       JSObject::AddProperty(proto, factory->constructor_string(), callsite_fun,
    3776          79 :                             DONT_ENUM);
    3777             : 
    3778             :       struct FunctionInfo {
    3779             :         const char* name;
    3780             :         Builtins::Name id;
    3781             :       };
    3782             : 
    3783             :       FunctionInfo infos[] = {
    3784             :           {"getColumnNumber", Builtins::kCallSitePrototypeGetColumnNumber},
    3785             :           {"getEvalOrigin", Builtins::kCallSitePrototypeGetEvalOrigin},
    3786             :           {"getFileName", Builtins::kCallSitePrototypeGetFileName},
    3787             :           {"getFunction", Builtins::kCallSitePrototypeGetFunction},
    3788             :           {"getFunctionName", Builtins::kCallSitePrototypeGetFunctionName},
    3789             :           {"getLineNumber", Builtins::kCallSitePrototypeGetLineNumber},
    3790             :           {"getMethodName", Builtins::kCallSitePrototypeGetMethodName},
    3791             :           {"getPosition", Builtins::kCallSitePrototypeGetPosition},
    3792             :           {"getScriptNameOrSourceURL",
    3793             :            Builtins::kCallSitePrototypeGetScriptNameOrSourceURL},
    3794             :           {"getThis", Builtins::kCallSitePrototypeGetThis},
    3795             :           {"getTypeName", Builtins::kCallSitePrototypeGetTypeName},
    3796             :           {"isConstructor", Builtins::kCallSitePrototypeIsConstructor},
    3797             :           {"isEval", Builtins::kCallSitePrototypeIsEval},
    3798             :           {"isNative", Builtins::kCallSitePrototypeIsNative},
    3799             :           {"isToplevel", Builtins::kCallSitePrototypeIsToplevel},
    3800          79 :           {"toString", Builtins::kCallSitePrototypeToString}};
    3801             : 
    3802             :       PropertyAttributes attrs =
    3803             :           static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3804             : 
    3805             :       Handle<JSFunction> fun;
    3806        1343 :       for (const FunctionInfo& info : infos) {
    3807        1264 :         SimpleInstallFunction(proto, info.name, info.id, 0, true, attrs);
    3808             :       }
    3809             : 
    3810          79 :       JSFunction::SetPrototype(callsite_fun, proto);
    3811             :     }
    3812             :   }
    3813         158 :   isolate->native_context()->set_exports_container(*container);
    3814          79 : }
    3815             : 
    3816             : 
    3817             : #define EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(id) \
    3818             :   void Genesis::InitializeGlobal_##id() {}
    3819             : 
    3820           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_do_expressions)
    3821           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_lookbehind)
    3822           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_named_captures)
    3823           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_property)
    3824           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_function_sent)
    3825           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_tailcalls)
    3826           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_restrictive_generators)
    3827           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_trailing_commas)
    3828           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_function_tostring)
    3829           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_class_fields)
    3830           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_object_rest_spread)
    3831           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
    3832           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_template_escapes)
    3833           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_restrict_constructor_return)
    3834           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_strict_legacy_accessor_builtins)
    3835             : 
    3836           0 : void InstallPublicSymbol(Factory* factory, Handle<Context> native_context,
    3837             :                          const char* name, Handle<Symbol> value) {
    3838             :   Handle<JSGlobalObject> global(
    3839           0 :       JSGlobalObject::cast(native_context->global_object()));
    3840           0 :   Handle<String> symbol_string = factory->InternalizeUtf8String("Symbol");
    3841             :   Handle<JSObject> symbol = Handle<JSObject>::cast(
    3842           0 :       JSObject::GetProperty(global, symbol_string).ToHandleChecked());
    3843           0 :   Handle<String> name_string = factory->InternalizeUtf8String(name);
    3844             :   PropertyAttributes attributes =
    3845             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3846           0 :   JSObject::AddProperty(symbol, name_string, value, attributes);
    3847           0 : }
    3848             : 
    3849           0 : void Genesis::InstallOneBuiltinFunction(Handle<Object> prototype,
    3850             :                                         const char* method_name,
    3851           0 :                                         Builtins::Name builtin_name) {
    3852             :   LookupIterator it(
    3853             :       prototype, isolate()->factory()->NewStringFromAsciiChecked(method_name),
    3854           0 :       LookupIterator::OWN_SKIP_INTERCEPTOR);
    3855           0 :   Handle<Object> function = Object::GetProperty(&it).ToHandleChecked();
    3856             :   Handle<JSFunction>::cast(function)->set_code(
    3857           0 :       isolate()->builtins()->builtin(builtin_name));
    3858             :   Handle<JSFunction>::cast(function)->shared()->set_code(
    3859           0 :       isolate()->builtins()->builtin(builtin_name));
    3860           0 : }
    3861             : 
    3862      106740 : void Genesis::InitializeGlobal_experimental_fast_array_builtins() {
    3863      213480 :   if (!FLAG_experimental_fast_array_builtins) return;
    3864             :   {
    3865             :     Handle<Object> typed_array_prototype(
    3866             :         native_context()->typed_array_prototype(), isolate());
    3867             :     // Insert experimental fast TypedArray builtins here.
    3868             :     InstallOneBuiltinFunction(typed_array_prototype, "every",
    3869           0 :                               Builtins::kTypedArrayPrototypeEvery);
    3870             :     InstallOneBuiltinFunction(typed_array_prototype, "some",
    3871           0 :                               Builtins::kTypedArrayPrototypeSome);
    3872             :     InstallOneBuiltinFunction(typed_array_prototype, "reduce",
    3873           0 :                               Builtins::kTypedArrayPrototypeReduce);
    3874             :     InstallOneBuiltinFunction(typed_array_prototype, "reduceRight",
    3875           0 :                               Builtins::kTypedArrayPrototypeReduceRight);
    3876             :   }
    3877             : }
    3878             : 
    3879      106740 : void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
    3880      212784 :   if (!FLAG_harmony_sharedarraybuffer) return;
    3881             : 
    3882         696 :   Handle<JSGlobalObject> global(native_context()->global_object());
    3883             :   Isolate* isolate = global->GetIsolate();
    3884             :   Factory* factory = isolate->factory();
    3885             : 
    3886             :   Handle<JSFunction> shared_array_buffer_fun =
    3887             :       InstallArrayBuffer(global, "SharedArrayBuffer",
    3888             :                          Builtins::kSharedArrayBufferPrototypeGetByteLength,
    3889             :                          BuiltinFunctionId::kSharedArrayBufferByteLength,
    3890         696 :                          Builtins::kSharedArrayBufferPrototypeSlice);
    3891             :   InstallWithIntrinsicDefaultProto(isolate, shared_array_buffer_fun,
    3892         696 :                                    Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
    3893         696 :   InstallSpeciesGetter(shared_array_buffer_fun);
    3894             : 
    3895         696 :   Handle<String> name = factory->InternalizeUtf8String("Atomics");
    3896         696 :   Handle<JSFunction> cons = factory->NewFunction(name);
    3897        1392 :   JSFunction::SetPrototype(cons, isolate->initial_object_prototype());
    3898         696 :   Handle<JSObject> atomics_object = factory->NewJSObject(cons, TENURED);
    3899             :   DCHECK(atomics_object->IsJSObject());
    3900         696 :   JSObject::AddProperty(global, name, atomics_object, DONT_ENUM);
    3901             :   JSObject::AddProperty(atomics_object, factory->to_string_tag_symbol(), name,
    3902         696 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3903             : 
    3904             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("load"),
    3905         696 :                         Builtins::kAtomicsLoad, 2, true);
    3906             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("store"),
    3907         696 :                         Builtins::kAtomicsStore, 3, true);
    3908             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("add"),
    3909         696 :                         Builtins::kAtomicsAdd, 3, true);
    3910             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("sub"),
    3911         696 :                         Builtins::kAtomicsSub, 3, true);
    3912             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("and"),
    3913         696 :                         Builtins::kAtomicsAnd, 3, true);
    3914             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("or"),
    3915         696 :                         Builtins::kAtomicsOr, 3, true);
    3916             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("xor"),
    3917         696 :                         Builtins::kAtomicsXor, 3, true);
    3918             :   SimpleInstallFunction(atomics_object,
    3919             :                         factory->InternalizeUtf8String("exchange"),
    3920         696 :                         Builtins::kAtomicsExchange, 3, true);
    3921             :   SimpleInstallFunction(atomics_object,
    3922             :                         factory->InternalizeUtf8String("compareExchange"),
    3923         696 :                         Builtins::kAtomicsCompareExchange, 4, true);
    3924             :   SimpleInstallFunction(atomics_object,
    3925             :                         factory->InternalizeUtf8String("isLockFree"),
    3926         696 :                         Builtins::kAtomicsIsLockFree, 1, true);
    3927             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("wait"),
    3928         696 :                         Builtins::kAtomicsWait, 4, true);
    3929             :   SimpleInstallFunction(atomics_object, factory->InternalizeUtf8String("wake"),
    3930         696 :                         Builtins::kAtomicsWake, 3, true);
    3931             : }
    3932             : 
    3933      106796 : void Genesis::InitializeGlobal_harmony_array_prototype_values() {
    3934      213466 :   if (!FLAG_harmony_array_prototype_values) return;
    3935             :   Handle<JSFunction> array_constructor(native_context()->array_function());
    3936             :   Handle<JSObject> array_prototype(
    3937             :       JSObject::cast(array_constructor->instance_prototype()));
    3938             :   Handle<Object> values_iterator =
    3939             :       JSObject::GetProperty(array_prototype, factory()->iterator_symbol())
    3940          28 :           .ToHandleChecked();
    3941             :   DCHECK(values_iterator->IsJSFunction());
    3942             :   JSObject::AddProperty(array_prototype, factory()->values_string(),
    3943          14 :                         values_iterator, DONT_ENUM);
    3944             : 
    3945             :   Handle<Object> unscopables =
    3946             :       JSObject::GetProperty(array_prototype, factory()->unscopables_symbol())
    3947          28 :           .ToHandleChecked();
    3948             :   DCHECK(unscopables->IsJSObject());
    3949             :   JSObject::AddProperty(Handle<JSObject>::cast(unscopables),
    3950             :                         factory()->values_string(), factory()->true_value(),
    3951          14 :                         NONE);
    3952             : }
    3953             : 
    3954      106845 : void Genesis::InitializeGlobal_harmony_async_iteration() {
    3955      213480 :   if (!FLAG_harmony_async_iteration) return;
    3956             :   Handle<JSFunction> symbol_fun(native_context()->symbol_function());
    3957             :   InstallConstant(isolate(), symbol_fun, "asyncIterator",
    3958         105 :                   factory()->async_iterator_symbol());
    3959             : }
    3960             : 
    3961      106866 : void Genesis::InitializeGlobal_harmony_promise_finally() {
    3962      213480 :   if (!FLAG_harmony_promise_finally) return;
    3963             : 
    3964             :   Handle<JSFunction> constructor(native_context()->promise_function());
    3965             :   Handle<JSObject> prototype(JSObject::cast(constructor->instance_prototype()));
    3966             :   SimpleInstallFunction(prototype, "finally", Builtins::kPromiseFinally, 1,
    3967          14 :                         true, DONT_ENUM);
    3968             : 
    3969             :   // The promise prototype map has changed because we added a property
    3970             :   // to prototype, so we update the saved map.
    3971             :   Handle<Map> prototype_map(prototype->map());
    3972          14 :   Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate());
    3973             :   native_context()->set_promise_prototype_map(*prototype_map);
    3974             : 
    3975             :   {
    3976             :     Handle<Code> code =
    3977             :         handle(isolate()->builtins()->builtin(Builtins::kPromiseThenFinally),
    3978             :                isolate());
    3979             :     Handle<SharedFunctionInfo> info = factory()->NewSharedFunctionInfo(
    3980          14 :         factory()->empty_string(), code, false);
    3981             :     info->set_internal_formal_parameter_count(1);
    3982             :     info->set_length(1);
    3983             :     info->set_native(true);
    3984             :     native_context()->set_promise_then_finally_shared_fun(*info);
    3985             :   }
    3986             : 
    3987             :   {
    3988             :     Handle<Code> code =
    3989             :         handle(isolate()->builtins()->builtin(Builtins::kPromiseCatchFinally),
    3990             :                isolate());
    3991             :     Handle<SharedFunctionInfo> info = factory()->NewSharedFunctionInfo(
    3992          14 :         factory()->empty_string(), code, false);
    3993             :     info->set_internal_formal_parameter_count(1);
    3994             :     info->set_length(1);
    3995             :     info->set_native(true);
    3996             :     native_context()->set_promise_catch_finally_shared_fun(*info);
    3997             :   }
    3998             : 
    3999             :   {
    4000             :     Handle<Code> code = handle(
    4001             :         isolate()->builtins()->builtin(Builtins::kPromiseValueThunkFinally),
    4002             :         isolate());
    4003             :     Handle<SharedFunctionInfo> info = factory()->NewSharedFunctionInfo(
    4004          14 :         factory()->empty_string(), code, false);
    4005             :     info->set_internal_formal_parameter_count(0);
    4006             :     info->set_length(0);
    4007             :     native_context()->set_promise_value_thunk_finally_shared_fun(*info);
    4008             :   }
    4009             : 
    4010             :   {
    4011             :     Handle<Code> code =
    4012             :         handle(isolate()->builtins()->builtin(Builtins::kPromiseThrowerFinally),
    4013             :                isolate());
    4014             :     Handle<SharedFunctionInfo> info = factory()->NewSharedFunctionInfo(
    4015          14 :         factory()->empty_string(), code, false);
    4016             :     info->set_internal_formal_parameter_count(0);
    4017             :     info->set_length(0);
    4018             :     native_context()->set_promise_thrower_finally_shared_fun(*info);
    4019             :   }
    4020             : }
    4021             : 
    4022      107788 : void Genesis::InitializeGlobal_harmony_regexp_dotall() {
    4023      213480 :   if (!FLAG_harmony_regexp_dotall) return;
    4024             : 
    4025             :   Handle<JSFunction> constructor(native_context()->regexp_function());
    4026             :   Handle<JSObject> prototype(JSObject::cast(constructor->instance_prototype()));
    4027             : 
    4028             :   SimpleInstallGetter(prototype, isolate()->factory()->dotAll_string(),
    4029             :                       Builtins::kRegExpPrototypeDotAllGetter, true);
    4030             : 
    4031             :   // The regexp prototype map has changed because we added a property
    4032             :   // to it, so we update the saved map.
    4033             :   Handle<Map> prototype_map(prototype->map());
    4034         524 :   Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate());
    4035             :   native_context()->set_regexp_prototype_map(*prototype_map);
    4036             : }
    4037             : 
    4038             : #ifdef V8_INTL_SUPPORT
    4039             : namespace {
    4040             : 
    4041      426911 : void SetFunction(Handle<JSObject> target, Handle<JSFunction> function,
    4042             :                  Handle<Name> name, PropertyAttributes attributes = DONT_ENUM) {
    4043             :   JSObject::SetOwnPropertyIgnoreAttributes(target, name, function, attributes)
    4044      853823 :       .ToHandleChecked();
    4045      426912 : }
    4046             : 
    4047             : }  // namespace
    4048             : 
    4049      960564 : void Genesis::InitializeGlobal_icu_case_mapping() {
    4050      106752 :   if (!FLAG_icu_case_mapping) return;
    4051             : 
    4052             :   Handle<JSReceiver> exports_container(
    4053             :       JSReceiver::cast(native_context()->exports_container()));
    4054             : 
    4055             :   Handle<JSObject> string_prototype(
    4056      106728 :       JSObject::cast(native_context()->string_function()->prototype()));
    4057             : 
    4058             :   {
    4059      106728 :     Handle<String> name = factory()->InternalizeUtf8String("toLowerCase");
    4060             :     SetFunction(string_prototype,
    4061             :                 SimpleCreateFunction(isolate(), name,
    4062             :                                      Builtins::kStringPrototypeToLowerCaseIntl,
    4063             :                                      0, false),
    4064      106728 :                 name);
    4065             :   }
    4066             :   {
    4067      106728 :     Handle<String> name = factory()->InternalizeUtf8String("toUpperCase");
    4068             :     SetFunction(string_prototype,
    4069             :                 SimpleCreateFunction(isolate(), name,
    4070             :                                      Builtins::kStringPrototypeToUpperCaseIntl,
    4071             :                                      0, false),
    4072      106728 :                 name);
    4073             :   }
    4074             : 
    4075             :   Handle<JSFunction> to_locale_lower_case = Handle<JSFunction>::cast(
    4076             :       JSReceiver::GetProperty(
    4077             :           exports_container,
    4078             :           factory()->InternalizeUtf8String("ToLocaleLowerCaseIntl"))
    4079      320184 :           .ToHandleChecked());
    4080             :   SetFunction(string_prototype, to_locale_lower_case,
    4081      213456 :               factory()->InternalizeUtf8String("toLocaleLowerCase"));
    4082             : 
    4083             :   Handle<JSFunction> to_locale_upper_case = Handle<JSFunction>::cast(
    4084             :       JSReceiver::GetProperty(
    4085             :           exports_container,
    4086             :           factory()->InternalizeUtf8String("ToLocaleUpperCaseIntl"))
    4087      320183 :           .ToHandleChecked());
    4088             :   SetFunction(string_prototype, to_locale_upper_case,
    4089      213455 :               factory()->InternalizeUtf8String("toLocaleUpperCase"));
    4090             : }
    4091             : #endif
    4092             : 
    4093         775 : Handle<JSFunction> Genesis::InstallArrayBuffer(Handle<JSObject> target,
    4094             :                                                const char* name,
    4095             :                                                Builtins::Name call_byteLength,
    4096             :                                                BuiltinFunctionId byteLength_id,
    4097        6200 :                                                Builtins::Name call_slice) {
    4098             :   // Create the %ArrayBufferPrototype%
    4099             :   // Setup the {prototype} with the given {name} for @@toStringTag.
    4100             :   Handle<JSObject> prototype =
    4101        1550 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    4102             :   JSObject::AddProperty(prototype, factory()->to_string_tag_symbol(),
    4103             :                         factory()->NewStringFromAsciiChecked(name),
    4104        1550 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4105             : 
    4106             :   // Allocate the constructor with the given {prototype}.
    4107             :   Handle<JSFunction> array_buffer_fun =
    4108             :       InstallFunction(target, name, JS_ARRAY_BUFFER_TYPE,
    4109             :                       JSArrayBuffer::kSizeWithEmbedderFields, prototype,
    4110         775 :                       Builtins::kArrayBufferConstructor);
    4111             :   array_buffer_fun->shared()->SetConstructStub(
    4112        1550 :       *isolate()->builtins()->ArrayBufferConstructor_ConstructStub());
    4113             :   array_buffer_fun->shared()->DontAdaptArguments();
    4114             :   array_buffer_fun->shared()->set_length(1);
    4115             : 
    4116             :   // Install the "constructor" property on the {prototype}.
    4117             :   JSObject::AddProperty(prototype, factory()->constructor_string(),
    4118         775 :                         array_buffer_fun, DONT_ENUM);
    4119             : 
    4120             :   SimpleInstallFunction(array_buffer_fun, factory()->isView_string(),
    4121         775 :                         Builtins::kArrayBufferIsView, 1, true);
    4122             : 
    4123             :   // Install the "byteLength" getter on the {prototype}.
    4124             :   SimpleInstallGetter(prototype, factory()->byte_length_string(),
    4125         775 :                       call_byteLength, false, byteLength_id);
    4126             : 
    4127         775 :   SimpleInstallFunction(prototype, "slice", call_slice, 2, true);
    4128             : 
    4129         775 :   return array_buffer_fun;
    4130             : }
    4131             : 
    4132             : 
    4133         237 : Handle<JSFunction> Genesis::InstallInternalArray(Handle<JSObject> target,
    4134             :                                                  const char* name,
    4135         948 :                                                  ElementsKind elements_kind) {
    4136             :   // --- I n t e r n a l   A r r a y ---
    4137             :   // An array constructor on the builtins object that works like
    4138             :   // the public Array constructor, except that its prototype
    4139             :   // doesn't inherit from Object.prototype.
    4140             :   // To be used only for internal work by builtins. Instances
    4141             :   // must not be leaked to user code.
    4142             :   Handle<JSObject> prototype =
    4143         474 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    4144             :   Handle<JSFunction> array_function =
    4145             :       InstallFunction(target, name, JS_ARRAY_TYPE, JSArray::kSize, prototype,
    4146         237 :                       Builtins::kInternalArrayCode);
    4147             : 
    4148         237 :   InternalArrayConstructorStub internal_array_constructor_stub(isolate());
    4149         237 :   Handle<Code> code = internal_array_constructor_stub.GetCode();
    4150         237 :   array_function->shared()->SetConstructStub(*code);
    4151             :   array_function->shared()->DontAdaptArguments();
    4152             : 
    4153             :   Handle<Map> original_map(array_function->initial_map());
    4154         237 :   Handle<Map> initial_map = Map::Copy(original_map, "InternalArray");
    4155             :   initial_map->set_elements_kind(elements_kind);
    4156         237 :   JSFunction::SetInitialMap(array_function, initial_map, prototype);
    4157             : 
    4158             :   // Make "length" magic on instances.
    4159         237 :   Map::EnsureDescriptorSlack(initial_map, 1);
    4160             : 
    4161             :   PropertyAttributes attribs = static_cast<PropertyAttributes>(
    4162             :       DONT_ENUM | DONT_DELETE);
    4163             : 
    4164             :   Handle<AccessorInfo> array_length =
    4165         237 :       Accessors::ArrayLengthInfo(isolate(), attribs);
    4166             :   {  // Add length.
    4167             :     Descriptor d = Descriptor::AccessorConstant(
    4168             :         Handle<Name>(Name::cast(array_length->name())), array_length, attribs);
    4169         237 :     initial_map->AppendDescriptor(&d);
    4170             :   }
    4171             : 
    4172         237 :   return array_function;
    4173             : }
    4174             : 
    4175        4740 : bool Genesis::InstallNatives(GlobalContextType context_type) {
    4176             :   HandleScope scope(isolate());
    4177             : 
    4178             :   // Set up the utils object as shared container between native scripts.
    4179         158 :   Handle<JSObject> utils = factory()->NewJSObject(isolate()->object_function());
    4180             :   JSObject::NormalizeProperties(utils, CLEAR_INOBJECT_PROPERTIES, 16,
    4181          79 :                                 "utils container for native scripts");
    4182             :   native_context()->set_natives_utils_object(*utils);
    4183             : 
    4184             :   // Set up the extras utils object as a shared container between native
    4185             :   // scripts and extras. (Extras consume things added there by native scripts.)
    4186             :   Handle<JSObject> extras_utils =
    4187         158 :       factory()->NewJSObject(isolate()->object_function());
    4188             :   native_context()->set_extras_utils_object(*extras_utils);
    4189             : 
    4190          79 :   InstallInternalArray(extras_utils, "InternalPackedArray", FAST_ELEMENTS);
    4191             : 
    4192             :   InstallFunction(extras_utils, isolate()->promise_internal_constructor(),
    4193         158 :                   factory()->NewStringFromAsciiChecked("createPromise"));
    4194             :   InstallFunction(extras_utils, isolate()->promise_resolve(),
    4195         158 :                   factory()->NewStringFromAsciiChecked("resolvePromise"));
    4196             :   InstallFunction(extras_utils, isolate()->is_promise(),
    4197         158 :                   factory()->NewStringFromAsciiChecked("isPromise"));
    4198             : 
    4199          79 :   int builtin_index = Natives::GetDebuggerCount();
    4200             :   // Only run prologue.js at this point.
    4201             :   DCHECK_EQ(builtin_index, Natives::GetIndex("prologue"));
    4202         158 :   if (!Bootstrapper::CompileBuiltin(isolate(), builtin_index++)) return false;
    4203             : 
    4204             :   {
    4205             :     // Builtin function for OpaqueReference -- a JSValue-based object,
    4206             :     // that keeps its field isolated from JavaScript code. It may store
    4207             :     // objects, that JavaScript code may not access.
    4208             :     Handle<JSFunction> opaque_reference_fun = factory()->NewFunction(
    4209             :         factory()->empty_string(), isolate()->builtins()->Illegal(),
    4210         237 :         isolate()->initial_object_prototype(), JS_VALUE_TYPE, JSValue::kSize);
    4211             :     Handle<JSObject> prototype =
    4212         158 :         factory()->NewJSObject(isolate()->object_function(), TENURED);
    4213          79 :     JSFunction::SetPrototype(opaque_reference_fun, prototype);
    4214             :     native_context()->set_opaque_reference_function(*opaque_reference_fun);
    4215             :   }
    4216             : 
    4217             :   // InternalArrays should not use Smi-Only array optimizations. There are too
    4218             :   // many places in the C++ runtime code (e.g. RegEx) that assume that
    4219             :   // elements in InternalArrays can be set to non-Smi values without going
    4220             :   // through a common bottleneck that would make the SMI_ONLY -> FAST_ELEMENT
    4221             :   // transition easy to trap. Moreover, they rarely are smi-only.
    4222             :   {
    4223             :     HandleScope scope(isolate());
    4224             :     Handle<JSObject> utils =
    4225          79 :         Handle<JSObject>::cast(isolate()->natives_utils_object());
    4226             :     Handle<JSFunction> array_function =
    4227          79 :         InstallInternalArray(utils, "InternalArray", FAST_HOLEY_ELEMENTS);
    4228             :     native_context()->set_internal_array_function(*array_function);
    4229          79 :     InstallInternalArray(utils, "InternalPackedArray", FAST_ELEMENTS);
    4230             :   }
    4231             : 
    4232             :   // Run the rest of the native scripts.
    4233        1264 :   while (builtin_index < Natives::GetBuiltinsCount()) {
    4234        2212 :     if (!Bootstrapper::CompileBuiltin(isolate(), builtin_index++)) return false;
    4235             :   }
    4236             : 
    4237          79 :   if (!CallUtilsFunction(isolate(), "PostNatives")) return false;
    4238             :   auto fast_template_instantiations_cache = isolate()->factory()->NewFixedArray(
    4239          79 :       TemplateInfo::kFastTemplateInstantiationsCacheSize);
    4240             :   native_context()->set_fast_template_instantiations_cache(
    4241             :       *fast_template_instantiations_cache);
    4242             : 
    4243             :   auto slow_template_instantiations_cache = UnseededNumberDictionary::New(
    4244          79 :       isolate(), ApiNatives::kInitialFunctionCacheSize);
    4245             :   native_context()->set_slow_template_instantiations_cache(
    4246             :       *slow_template_instantiations_cache);
    4247             : 
    4248             :   // Store the map for the %ObjectPrototype% after the natives has been compiled
    4249             :   // and the Object function has been set up.
    4250             :   Handle<JSFunction> object_function(native_context()->object_function());
    4251             :   DCHECK(JSObject::cast(object_function->initial_map()->prototype())
    4252             :              ->HasFastProperties());
    4253             :   native_context()->set_object_function_prototype_map(
    4254             :       HeapObject::cast(object_function->initial_map()->prototype())->map());
    4255             : 
    4256             :   // Set up the map for Object.create(null) instances.
    4257             :   Handle<Map> slow_object_with_null_prototype_map =
    4258          79 :       Map::CopyInitialMap(handle(object_function->initial_map(), isolate()));
    4259             :   slow_object_with_null_prototype_map->set_dictionary_map(true);
    4260             :   Map::SetPrototype(slow_object_with_null_prototype_map,
    4261          79 :                     isolate()->factory()->null_value());
    4262             :   native_context()->set_slow_object_with_null_prototype_map(
    4263             :       *slow_object_with_null_prototype_map);
    4264             : 
    4265             :   // Store the map for the %StringPrototype% after the natives has been compiled
    4266             :   // and the String function has been set up.
    4267             :   Handle<JSFunction> string_function(native_context()->string_function());
    4268             :   JSObject* string_function_prototype =
    4269             :       JSObject::cast(string_function->initial_map()->prototype());
    4270             :   DCHECK(string_function_prototype->HasFastProperties());
    4271             :   native_context()->set_string_function_prototype_map(
    4272             :       string_function_prototype->map());
    4273             : 
    4274             :   Handle<JSGlobalObject> global_object =
    4275          79 :       handle(native_context()->global_object());
    4276             : 
    4277             :   // Install Global.decodeURI.
    4278             :   SimpleInstallFunction(global_object, "decodeURI", Builtins::kGlobalDecodeURI,
    4279          79 :                         1, false, kGlobalDecodeURI);
    4280             : 
    4281             :   // Install Global.decodeURIComponent.
    4282             :   SimpleInstallFunction(global_object, "decodeURIComponent",
    4283             :                         Builtins::kGlobalDecodeURIComponent, 1, false,
    4284          79 :                         kGlobalDecodeURIComponent);
    4285             : 
    4286             :   // Install Global.encodeURI.
    4287             :   SimpleInstallFunction(global_object, "encodeURI", Builtins::kGlobalEncodeURI,
    4288          79 :                         1, false, kGlobalEncodeURI);
    4289             : 
    4290             :   // Install Global.encodeURIComponent.
    4291             :   SimpleInstallFunction(global_object, "encodeURIComponent",
    4292             :                         Builtins::kGlobalEncodeURIComponent, 1, false,
    4293          79 :                         kGlobalEncodeURIComponent);
    4294             : 
    4295             :   // Install Global.escape.
    4296             :   SimpleInstallFunction(global_object, "escape", Builtins::kGlobalEscape, 1,
    4297          79 :                         false, kGlobalEscape);
    4298             : 
    4299             :   // Install Global.unescape.
    4300             :   SimpleInstallFunction(global_object, "unescape", Builtins::kGlobalUnescape, 1,
    4301          79 :                         false, kGlobalUnescape);
    4302             : 
    4303             :   // Install Global.eval.
    4304             :   {
    4305             :     Handle<JSFunction> eval =
    4306             :         SimpleInstallFunction(global_object, factory()->eval_string(),
    4307          79 :                               Builtins::kGlobalEval, 1, false);
    4308             :     native_context()->set_global_eval_fun(*eval);
    4309             :   }
    4310             : 
    4311             :   // Install Global.isFinite
    4312             :   SimpleInstallFunction(global_object, "isFinite", Builtins::kGlobalIsFinite, 1,
    4313          79 :                         true, kGlobalIsFinite);
    4314             : 
    4315             :   // Install Global.isNaN
    4316             :   SimpleInstallFunction(global_object, "isNaN", Builtins::kGlobalIsNaN, 1, true,
    4317          79 :                         kGlobalIsNaN);
    4318             : 
    4319             :   // Install Array builtin functions.
    4320             :   {
    4321             :     Handle<JSFunction> array_constructor(native_context()->array_function());
    4322          79 :     Handle<JSArray> proto(JSArray::cast(array_constructor->prototype()));
    4323             : 
    4324             :     // Verification of important array prototype properties.
    4325             :     Object* length = proto->length();
    4326          79 :     CHECK(length->IsSmi());
    4327          79 :     CHECK(Smi::cast(length)->value() == 0);
    4328          79 :     CHECK(proto->HasFastSmiOrObjectElements());
    4329             :     // This is necessary to enable fast checks for absence of elements
    4330             :     // on Array.prototype and below.
    4331         158 :     proto->set_elements(heap()->empty_fixed_array());
    4332             : 
    4333             :     // Install Array.prototype.concat
    4334             :     Handle<JSFunction> concat =
    4335             :         InstallFunction(proto, "concat", JS_OBJECT_TYPE, JSObject::kHeaderSize,
    4336          79 :                         MaybeHandle<JSObject>(), Builtins::kArrayConcat);
    4337             : 
    4338             :     // Make sure that Array.prototype.concat appears to be compiled.
    4339             :     // The code will never be called, but inline caching for call will
    4340             :     // only work if it appears to be compiled.
    4341             :     concat->shared()->DontAdaptArguments();
    4342             :     DCHECK(concat->is_compiled());
    4343             :     // Set the lengths for the functions to satisfy ECMA-262.
    4344             :     concat->shared()->set_length(1);
    4345             : 
    4346             :     // Install Array.prototype.forEach
    4347             :     Handle<JSFunction> forEach = InstallArrayBuiltinFunction(
    4348          79 :         proto, "forEach", Builtins::kArrayForEach, 2);
    4349             :     // Add forEach to the context.
    4350             :     native_context()->set_array_for_each_iterator(*forEach);
    4351             : 
    4352             :     // Install Array.prototype.filter
    4353          79 :     InstallArrayBuiltinFunction(proto, "filter", Builtins::kArrayFilter, 2);
    4354             : 
    4355             :     // Install Array.prototype.map
    4356          79 :     InstallArrayBuiltinFunction(proto, "map", Builtins::kArrayMap, 2);
    4357             : 
    4358             :     // Install Array.prototype.every
    4359          79 :     InstallArrayBuiltinFunction(proto, "every", Builtins::kArrayEvery, 2);
    4360             : 
    4361             :     // Install Array.prototype.some
    4362          79 :     InstallArrayBuiltinFunction(proto, "some", Builtins::kArraySome, 2);
    4363             : 
    4364             :     // Install Array.prototype.reduce
    4365          79 :     InstallArrayBuiltinFunction(proto, "reduce", Builtins::kArrayReduce, 2);
    4366             : 
    4367             :     // Install Array.prototype.reduceRight
    4368             :     InstallArrayBuiltinFunction(proto, "reduceRight",
    4369          79 :                                 Builtins::kArrayReduceRight, 2);
    4370             :   }
    4371             : 
    4372             :   // Install InternalArray.prototype.concat
    4373             :   {
    4374             :     Handle<JSFunction> array_constructor(
    4375             :         native_context()->internal_array_function());
    4376          79 :     Handle<JSObject> proto(JSObject::cast(array_constructor->prototype()));
    4377             :     Handle<JSFunction> concat =
    4378             :         InstallFunction(proto, "concat", JS_OBJECT_TYPE, JSObject::kHeaderSize,
    4379          79 :                         MaybeHandle<JSObject>(), Builtins::kArrayConcat);
    4380             : 
    4381             :     // Make sure that InternalArray.prototype.concat appears to be compiled.
    4382             :     // The code will never be called, but inline caching for call will
    4383             :     // only work if it appears to be compiled.
    4384             :     concat->shared()->DontAdaptArguments();
    4385             :     DCHECK(concat->is_compiled());
    4386             :     // Set the lengths for the functions to satisfy ECMA-262.
    4387             :     concat->shared()->set_length(1);
    4388             :   }
    4389             : 
    4390          79 :   InstallBuiltinFunctionIds();
    4391             : 
    4392             :   // Create a map for accessor property descriptors (a variant of JSObject
    4393             :   // that predefines four properties get, set, configurable and enumerable).
    4394             :   {
    4395             :     // AccessorPropertyDescriptor initial map.
    4396             :     Handle<Map> map =
    4397          79 :         factory()->NewMap(JS_OBJECT_TYPE, JSAccessorPropertyDescriptor::kSize);
    4398             :     // Create the descriptor array for the property descriptor object.
    4399          79 :     Map::EnsureDescriptorSlack(map, 4);
    4400             : 
    4401             :     {  // get
    4402             :       Descriptor d = Descriptor::DataField(
    4403             :           factory()->get_string(), JSAccessorPropertyDescriptor::kGetIndex,
    4404          79 :           NONE, Representation::Tagged());
    4405          79 :       map->AppendDescriptor(&d);
    4406             :     }
    4407             :     {  // set
    4408             :       Descriptor d = Descriptor::DataField(
    4409             :           factory()->set_string(), JSAccessorPropertyDescriptor::kSetIndex,
    4410          79 :           NONE, Representation::Tagged());
    4411          79 :       map->AppendDescriptor(&d);
    4412             :     }
    4413             :     {  // enumerable
    4414             :       Descriptor d =
    4415             :           Descriptor::DataField(factory()->enumerable_string(),
    4416             :                                 JSAccessorPropertyDescriptor::kEnumerableIndex,
    4417          79 :                                 NONE, Representation::Tagged());
    4418          79 :       map->AppendDescriptor(&d);
    4419             :     }
    4420             :     {  // configurable
    4421             :       Descriptor d = Descriptor::DataField(
    4422             :           factory()->configurable_string(),
    4423             :           JSAccessorPropertyDescriptor::kConfigurableIndex, NONE,
    4424          79 :           Representation::Tagged());
    4425          79 :       map->AppendDescriptor(&d);
    4426             :     }
    4427             : 
    4428         158 :     Map::SetPrototype(map, isolate()->initial_object_prototype());
    4429             :     map->SetConstructor(native_context()->object_function());
    4430             :     map->SetInObjectProperties(4);
    4431             :     map->set_unused_property_fields(0);
    4432             : 
    4433             :     native_context()->set_accessor_property_descriptor_map(*map);
    4434             :   }
    4435             : 
    4436             :   // Create a map for data property descriptors (a variant of JSObject
    4437             :   // that predefines four properties value, writable, configurable and
    4438             :   // enumerable).
    4439             :   {
    4440             :     // DataPropertyDescriptor initial map.
    4441             :     Handle<Map> map =
    4442          79 :         factory()->NewMap(JS_OBJECT_TYPE, JSDataPropertyDescriptor::kSize);
    4443             :     // Create the descriptor array for the property descriptor object.
    4444          79 :     Map::EnsureDescriptorSlack(map, 4);
    4445             : 
    4446             :     {  // value
    4447             :       Descriptor d = Descriptor::DataField(
    4448             :           factory()->value_string(), JSDataPropertyDescriptor::kValueIndex,
    4449          79 :           NONE, Representation::Tagged());
    4450          79 :       map->AppendDescriptor(&d);
    4451             :     }
    4452             :     {  // writable
    4453             :       Descriptor d =
    4454             :           Descriptor::DataField(factory()->writable_string(),
    4455             :                                 JSDataPropertyDescriptor::kWritableIndex, NONE,
    4456          79 :                                 Representation::Tagged());
    4457          79 :       map->AppendDescriptor(&d);
    4458             :     }
    4459             :     {  // enumerable
    4460             :       Descriptor d =
    4461             :           Descriptor::DataField(factory()->enumerable_string(),
    4462             :                                 JSDataPropertyDescriptor::kEnumerableIndex,
    4463          79 :                                 NONE, Representation::Tagged());
    4464          79 :       map->AppendDescriptor(&d);
    4465             :     }
    4466             :     {  // configurable
    4467             :       Descriptor d =
    4468             :           Descriptor::DataField(factory()->configurable_string(),
    4469             :                                 JSDataPropertyDescriptor::kConfigurableIndex,
    4470          79 :                                 NONE, Representation::Tagged());
    4471          79 :       map->AppendDescriptor(&d);
    4472             :     }
    4473             : 
    4474         158 :     Map::SetPrototype(map, isolate()->initial_object_prototype());
    4475             :     map->SetConstructor(native_context()->object_function());
    4476             :     map->SetInObjectProperties(4);
    4477             :     map->set_unused_property_fields(0);
    4478             : 
    4479             :     native_context()->set_data_property_descriptor_map(*map);
    4480             :   }
    4481             : 
    4482             :   // Create a constructor for RegExp results (a variant of Array that
    4483             :   // predefines the two properties index and match).
    4484             :   {
    4485             :     // RegExpResult initial map.
    4486             : 
    4487             :     // Find global.Array.prototype to inherit from.
    4488             :     Handle<JSFunction> array_constructor(native_context()->array_function());
    4489             :     Handle<JSObject> array_prototype(
    4490             :         JSObject::cast(array_constructor->instance_prototype()));
    4491             : 
    4492             :     // Add initial map.
    4493             :     Handle<Map> initial_map =
    4494          79 :         factory()->NewMap(JS_ARRAY_TYPE, JSRegExpResult::kSize);
    4495             :     initial_map->SetConstructor(*array_constructor);
    4496             : 
    4497             :     // Set prototype on map.
    4498             :     initial_map->set_non_instance_prototype(false);
    4499          79 :     Map::SetPrototype(initial_map, array_prototype);
    4500             : 
    4501             :     // Update map with length accessor from Array and add "index" and "input".
    4502          79 :     Map::EnsureDescriptorSlack(initial_map, 3);
    4503             : 
    4504             :     {
    4505             :       JSFunction* array_function = native_context()->array_function();
    4506             :       Handle<DescriptorArray> array_descriptors(
    4507             :           array_function->initial_map()->instance_descriptors());
    4508             :       Handle<String> length = factory()->length_string();
    4509             :       int old = array_descriptors->SearchWithCache(
    4510             :           isolate(), *length, array_function->initial_map());
    4511             :       DCHECK(old != DescriptorArray::kNotFound);
    4512             :       Descriptor d = Descriptor::AccessorConstant(
    4513             :           length, handle(array_descriptors->GetValue(old), isolate()),
    4514         158 :           array_descriptors->GetDetails(old).attributes());
    4515          79 :       initial_map->AppendDescriptor(&d);
    4516             :     }
    4517             :     {
    4518             :       Descriptor d = Descriptor::DataField(factory()->index_string(),
    4519             :                                            JSRegExpResult::kIndexIndex, NONE,
    4520          79 :                                            Representation::Tagged());
    4521          79 :       initial_map->AppendDescriptor(&d);
    4522             :     }
    4523             : 
    4524             :     {
    4525             :       Descriptor d = Descriptor::DataField(factory()->input_string(),
    4526             :                                            JSRegExpResult::kInputIndex, NONE,
    4527          79 :                                            Representation::Tagged());
    4528          79 :       initial_map->AppendDescriptor(&d);
    4529             :     }
    4530             : 
    4531             :     initial_map->SetInObjectProperties(2);
    4532             :     initial_map->set_unused_property_fields(0);
    4533             : 
    4534             :     native_context()->set_regexp_result_map(*initial_map);
    4535             :   }
    4536             : 
    4537             :   // Add @@iterator method to the arguments object maps.
    4538             :   {
    4539             :     PropertyAttributes attribs = DONT_ENUM;
    4540             :     Handle<AccessorInfo> arguments_iterator =
    4541          79 :         Accessors::ArgumentsIteratorInfo(isolate(), attribs);
    4542             :     {
    4543             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4544             :                                                   arguments_iterator, attribs);
    4545             :       Handle<Map> map(native_context()->sloppy_arguments_map());
    4546          79 :       Map::EnsureDescriptorSlack(map, 1);
    4547          79 :       map->AppendDescriptor(&d);
    4548             :     }
    4549             :     {
    4550             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4551             :                                                   arguments_iterator, attribs);
    4552             :       Handle<Map> map(native_context()->fast_aliased_arguments_map());
    4553          79 :       Map::EnsureDescriptorSlack(map, 1);
    4554          79 :       map->AppendDescriptor(&d);
    4555             :     }
    4556             :     {
    4557             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4558             :                                                   arguments_iterator, attribs);
    4559             :       Handle<Map> map(native_context()->slow_aliased_arguments_map());
    4560          79 :       Map::EnsureDescriptorSlack(map, 1);
    4561          79 :       map->AppendDescriptor(&d);
    4562             :     }
    4563             :     {
    4564             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4565             :                                                   arguments_iterator, attribs);
    4566             :       Handle<Map> map(native_context()->strict_arguments_map());
    4567          79 :       Map::EnsureDescriptorSlack(map, 1);
    4568          79 :       map->AppendDescriptor(&d);
    4569             :     }
    4570             :   }
    4571             : 
    4572          79 :   return true;
    4573             : }
    4574             : 
    4575         237 : bool Genesis::InstallExtraNatives() {
    4576             :   HandleScope scope(isolate());
    4577             : 
    4578             :   Handle<JSObject> extras_binding =
    4579         158 :       factory()->NewJSObject(isolate()->object_function());
    4580             :   native_context()->set_extras_binding_object(*extras_binding);
    4581             : 
    4582         316 :   for (int i = ExtraNatives::GetDebuggerCount();
    4583         158 :        i < ExtraNatives::GetBuiltinsCount(); i++) {
    4584          79 :     if (!Bootstrapper::CompileExtraBuiltin(isolate(), i)) return false;
    4585             :   }
    4586             : 
    4587             :   return true;
    4588             : }
    4589             : 
    4590             : 
    4591          12 : bool Genesis::InstallExperimentalExtraNatives() {
    4592          24 :   for (int i = ExperimentalExtraNatives::GetDebuggerCount();
    4593          12 :        i < ExperimentalExtraNatives::GetBuiltinsCount(); i++) {
    4594           6 :     if (!Bootstrapper::CompileExperimentalExtraBuiltin(isolate(), i))
    4595             :       return false;
    4596             :   }
    4597             : 
    4598             :   return true;
    4599             : }
    4600             : 
    4601             : 
    4602       24098 : bool Genesis::InstallDebuggerNatives() {
    4603       22789 :   for (int i = 0; i < Natives::GetDebuggerCount(); ++i) {
    4604       17419 :     if (!Bootstrapper::CompileBuiltin(isolate(), i)) return false;
    4605             :   }
    4606             :   return true;
    4607             : }
    4608             : 
    4609             : 
    4610        9954 : static void InstallBuiltinFunctionId(Handle<JSObject> holder,
    4611             :                                      const char* function_name,
    4612             :                                      BuiltinFunctionId id) {
    4613             :   Isolate* isolate = holder->GetIsolate();
    4614             :   Handle<Object> function_object =
    4615       19908 :       JSReceiver::GetProperty(isolate, holder, function_name).ToHandleChecked();
    4616             :   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
    4617             :   function->shared()->set_builtin_function_id(id);
    4618        9954 : }
    4619             : 
    4620             : 
    4621             : #define INSTALL_BUILTIN_ID(holder_expr, fun_name, name) \
    4622             :   { #holder_expr, #fun_name, k##name }                  \
    4623             :   ,
    4624             : 
    4625             : 
    4626          79 : void Genesis::InstallBuiltinFunctionIds() {
    4627             :   HandleScope scope(isolate());
    4628             :   struct BuiltinFunctionIds {
    4629             :     const char* holder_expr;
    4630             :     const char* fun_name;
    4631             :     BuiltinFunctionId id;
    4632             :   };
    4633             : 
    4634             :   const BuiltinFunctionIds builtins[] = {
    4635          79 :       FUNCTIONS_WITH_ID_LIST(INSTALL_BUILTIN_ID)};
    4636             : 
    4637       10033 :   for (const BuiltinFunctionIds& builtin : builtins) {
    4638             :     Handle<JSObject> holder =
    4639        9954 :         ResolveBuiltinIdHolder(native_context(), builtin.holder_expr);
    4640        9954 :     InstallBuiltinFunctionId(holder, builtin.fun_name, builtin.id);
    4641             :   }
    4642          79 : }
    4643             : 
    4644             : #undef INSTALL_BUILTIN_ID
    4645             : 
    4646             : 
    4647          79 : void Genesis::InitializeNormalizedMapCaches() {
    4648          79 :   Handle<NormalizedMapCache> cache = NormalizedMapCache::New(isolate());
    4649             :   native_context()->set_normalized_map_cache(*cache);
    4650          79 : }
    4651             : 
    4652             : 
    4653      105618 : bool Bootstrapper::InstallExtensions(Handle<Context> native_context,
    4654             :                                      v8::ExtensionConfiguration* extensions) {
    4655             :   BootstrapperActive active(this);
    4656      211236 :   SaveContext saved_context(isolate_);
    4657      105618 :   isolate_->set_context(*native_context);
    4658      211188 :   return Genesis::InstallExtensions(native_context, extensions) &&
    4659      211188 :       Genesis::InstallSpecialObjects(native_context);
    4660             : }
    4661             : 
    4662             : 
    4663      105570 : bool Genesis::InstallSpecialObjects(Handle<Context> native_context) {
    4664      105570 :   Isolate* isolate = native_context->GetIsolate();
    4665             :   // Don't install extensions into the snapshot.
    4666      105570 :   if (isolate->serializer_enabled()) return true;
    4667             : 
    4668             :   Factory* factory = isolate->factory();
    4669             :   HandleScope scope(isolate);
    4670             : 
    4671      105383 :   Handle<JSObject> Error = isolate->error_function();
    4672             :   Handle<String> name =
    4673      105383 :       factory->InternalizeOneByteString(STATIC_CHAR_VECTOR("stackTraceLimit"));
    4674      105383 :   Handle<Smi> stack_trace_limit(Smi::FromInt(FLAG_stack_trace_limit), isolate);
    4675      105383 :   JSObject::AddProperty(Error, name, stack_trace_limit, NONE);
    4676             : 
    4677      105382 :   if (FLAG_expose_wasm || FLAG_validate_asm) {
    4678      105382 :     WasmJs::Install(isolate);
    4679             :   }
    4680             : 
    4681      105382 :   InstallFFIMap(isolate);
    4682             : 
    4683             :   return true;
    4684             : }
    4685             : 
    4686             : 
    4687             : static uint32_t Hash(RegisteredExtension* extension) {
    4688             :   return v8::internal::ComputePointerHash(extension);
    4689             : }
    4690             : 
    4691           0 : Genesis::ExtensionStates::ExtensionStates() : map_(8) {}
    4692             : 
    4693        6512 : Genesis::ExtensionTraversalState Genesis::ExtensionStates::get_state(
    4694             :     RegisteredExtension* extension) {
    4695        6512 :   base::HashMap::Entry* entry = map_.Lookup(extension, Hash(extension));
    4696        6513 :   if (entry == NULL) {
    4697             :     return UNVISITED;
    4698             :   }
    4699             :   return static_cast<ExtensionTraversalState>(
    4700          71 :       reinterpret_cast<intptr_t>(entry->value));
    4701             : }
    4702             : 
    4703       12876 : void Genesis::ExtensionStates::set_state(RegisteredExtension* extension,
    4704             :                                          ExtensionTraversalState state) {
    4705       25764 :   map_.LookupOrInsert(extension, Hash(extension))->value =
    4706       12888 :       reinterpret_cast<void*>(static_cast<intptr_t>(state));
    4707       12888 : }
    4708             : 
    4709             : 
    4710      105618 : bool Genesis::InstallExtensions(Handle<Context> native_context,
    4711             :                                 v8::ExtensionConfiguration* extensions) {
    4712             :   Isolate* isolate = native_context->GetIsolate();
    4713             :   ExtensionStates extension_states;  // All extensions have state UNVISITED.
    4714      211236 :   return InstallAutoExtensions(isolate, &extension_states) &&
    4715      105618 :          (!FLAG_expose_free_buffer ||
    4716      105618 :           InstallExtension(isolate, "v8/free-buffer", &extension_states)) &&
    4717      109585 :          (!FLAG_expose_gc ||
    4718      109585 :           InstallExtension(isolate, "v8/gc", &extension_states)) &&
    4719      105753 :          (!FLAG_expose_externalize_string ||
    4720      105753 :           InstallExtension(isolate, "v8/externalize", &extension_states)) &&
    4721      105618 :          (!FLAG_gc_stats ||
    4722      105618 :           InstallExtension(isolate, "v8/statistics", &extension_states)) &&
    4723      105619 :          (!FLAG_expose_trigger_failure ||
    4724      105619 :           InstallExtension(isolate, "v8/trigger-failure", &extension_states)) &&
    4725      105632 :          (!FLAG_trace_ignition_dispatches ||
    4726             :           InstallExtension(isolate, "v8/ignition-statistics",
    4727      211249 :                            &extension_states)) &&
    4728      211235 :          InstallRequestedExtensions(isolate, extensions, &extension_states);
    4729             : }
    4730             : 
    4731             : 
    4732      105618 : bool Genesis::InstallAutoExtensions(Isolate* isolate,
    4733             :                                     ExtensionStates* extension_states) {
    4734      845946 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    4735             :        it != NULL;
    4736             :        it = it->next()) {
    4737      740352 :     if (it->extension()->auto_enable() &&
    4738          24 :         !InstallExtension(isolate, it, extension_states)) {
    4739             :       return false;
    4740             :     }
    4741             :   }
    4742             :   return true;
    4743             : }
    4744             : 
    4745             : 
    4746      105618 : bool Genesis::InstallRequestedExtensions(Isolate* isolate,
    4747      213442 :                                          v8::ExtensionConfiguration* extensions,
    4748             :                                          ExtensionStates* extension_states) {
    4749      215648 :   for (const char** it = extensions->begin(); it != extensions->end(); ++it) {
    4750        2254 :     if (!InstallExtension(isolate, *it, extension_states)) return false;
    4751             :   }
    4752             :   return true;
    4753             : }
    4754             : 
    4755             : 
    4756             : // Installs a named extension.  This methods is unoptimized and does
    4757             : // not scale well if we want to support a large number of extensions.
    4758        6468 : bool Genesis::InstallExtension(Isolate* isolate,
    4759             :                                const char* name,
    4760             :                                ExtensionStates* extension_states) {
    4761       30862 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    4762             :        it != NULL;
    4763             :        it = it->next()) {
    4764       30862 :     if (strcmp(name, it->extension()->name()) == 0) {
    4765        6468 :       return InstallExtension(isolate, it, extension_states);
    4766             :     }
    4767             :   }
    4768             :   return Utils::ApiCheck(false,
    4769             :                          "v8::Context::New()",
    4770           0 :                          "Cannot find required extension");
    4771             : }
    4772             : 
    4773             : 
    4774        6510 : bool Genesis::InstallExtension(Isolate* isolate,
    4775        6491 :                                v8::RegisteredExtension* current,
    4776             :                                ExtensionStates* extension_states) {
    4777             :   HandleScope scope(isolate);
    4778             : 
    4779        6510 :   if (extension_states->get_state(current) == INSTALLED) return true;
    4780             :   // The current node has already been visited so there must be a
    4781             :   // cycle in the dependency graph; fail.
    4782        6453 :   if (!Utils::ApiCheck(extension_states->get_state(current) != VISITED,
    4783             :                        "v8::Context::New()",
    4784        6453 :                        "Circular extension dependency")) {
    4785             :     return false;
    4786             :   }
    4787             :   DCHECK(extension_states->get_state(current) == UNVISITED);
    4788        6447 :   extension_states->set_state(current, VISITED);
    4789        6685 :   v8::Extension* extension = current->extension();
    4790             :   // Install the extension's dependencies
    4791       13122 :   for (int i = 0; i < extension->dependency_count(); i++) {
    4792         124 :     if (!InstallExtension(isolate,
    4793         124 :                           extension->dependencies()[i],
    4794         124 :                           extension_states)) {
    4795             :       return false;
    4796             :     }
    4797             :   }
    4798             :   // We do not expect this to throw an exception. Change this if it does.
    4799        6437 :   bool result = CompileExtension(isolate, extension);
    4800             :   DCHECK(isolate->has_pending_exception() != result);
    4801        6427 :   if (!result) {
    4802             :     // We print out the name of the extension that fail to install.
    4803             :     // When an error is thrown during bootstrapping we automatically print
    4804             :     // the line number at which this happened to the console in the isolate
    4805             :     // error throwing functionality.
    4806             :     base::OS::PrintError("Error installing extension '%s'.\n",
    4807          42 :                          current->extension()->name());
    4808             :     isolate->clear_pending_exception();
    4809             :   }
    4810        6427 :   extension_states->set_state(current, INSTALLED);
    4811        6437 :   return result;
    4812             : }
    4813             : 
    4814             : 
    4815      106897 : bool Genesis::ConfigureGlobalObjects(
    4816       64745 :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
    4817             :   Handle<JSObject> global_proxy(
    4818      106897 :       JSObject::cast(native_context()->global_proxy()));
    4819             :   Handle<JSObject> global_object(
    4820      106897 :       JSObject::cast(native_context()->global_object()));
    4821             : 
    4822      106897 :   if (!global_proxy_template.IsEmpty()) {
    4823             :     // Configure the global proxy object.
    4824             :     Handle<ObjectTemplateInfo> global_proxy_data =
    4825             :         v8::Utils::OpenHandle(*global_proxy_template);
    4826       64745 :     if (!ConfigureApiObject(global_proxy, global_proxy_data)) return false;
    4827             : 
    4828             :     // Configure the global object.
    4829             :     Handle<FunctionTemplateInfo> proxy_constructor(
    4830             :         FunctionTemplateInfo::cast(global_proxy_data->constructor()));
    4831       64745 :     if (!proxy_constructor->prototype_template()->IsUndefined(isolate())) {
    4832             :       Handle<ObjectTemplateInfo> global_object_data(
    4833             :           ObjectTemplateInfo::cast(proxy_constructor->prototype_template()));
    4834       64745 :       if (!ConfigureApiObject(global_object, global_object_data)) return false;
    4835             :     }
    4836             :   }
    4837             : 
    4838      106897 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    4839             : 
    4840             :   native_context()->set_array_buffer_map(
    4841             :       native_context()->array_buffer_fun()->initial_map());
    4842             :   native_context()->set_js_map_map(
    4843             :       native_context()->js_map_fun()->initial_map());
    4844             :   native_context()->set_js_set_map(
    4845             :       native_context()->js_set_fun()->initial_map());
    4846             : 
    4847      106897 :   return true;
    4848             : }
    4849             : 
    4850             : 
    4851      129490 : bool Genesis::ConfigureApiObject(Handle<JSObject> object,
    4852           0 :                                  Handle<ObjectTemplateInfo> object_template) {
    4853             :   DCHECK(!object_template.is_null());
    4854             :   DCHECK(FunctionTemplateInfo::cast(object_template->constructor())
    4855             :              ->IsTemplateFor(object->map()));;
    4856             : 
    4857             :   MaybeHandle<JSObject> maybe_obj =
    4858      129490 :       ApiNatives::InstantiateObject(object_template);
    4859             :   Handle<JSObject> obj;
    4860      129490 :   if (!maybe_obj.ToHandle(&obj)) {
    4861             :     DCHECK(isolate()->has_pending_exception());
    4862             :     isolate()->clear_pending_exception();
    4863           0 :     return false;
    4864             :   }
    4865      129490 :   TransferObject(obj, object);
    4866      129490 :   return true;
    4867             : }
    4868             : 
    4869             : 
    4870      236308 : void Genesis::TransferNamedProperties(Handle<JSObject> from,
    4871    23974956 :                                       Handle<JSObject> to) {
    4872             :   // If JSObject::AddProperty asserts due to already existing property,
    4873             :   // it is likely due to both global objects sharing property name(s).
    4874             :   // Merging those two global objects is impossible.
    4875             :   // The global template must not create properties that already exist
    4876             :   // in the snapshotted global object.
    4877      236308 :   if (from->HasFastProperties()) {
    4878             :     Handle<DescriptorArray> descs =
    4879             :         Handle<DescriptorArray>(from->map()->instance_descriptors());
    4880     2015326 :     for (int i = 0; i < from->map()->NumberOfOwnDescriptors(); i++) {
    4881      878173 :       PropertyDetails details = descs->GetDetails(i);
    4882      878173 :       if (details.location() == kField) {
    4883      251336 :         if (details.kind() == kData) {
    4884             :           HandleScope inner(isolate());
    4885             :           Handle<Name> key = Handle<Name>(descs->GetKey(i));
    4886      251336 :           FieldIndex index = FieldIndex::ForDescriptor(from->map(), i);
    4887             :           DCHECK(!descs->GetDetails(i).representation().IsDouble());
    4888      251336 :           Handle<Object> value(from->RawFastPropertyAt(index), isolate());
    4889      251336 :           JSObject::AddProperty(to, key, value, details.attributes());
    4890             :         } else {
    4891             :           DCHECK_EQ(kAccessor, details.kind());
    4892           0 :           UNREACHABLE();
    4893             :         }
    4894             : 
    4895             :       } else {
    4896             :         DCHECK_EQ(kDescriptor, details.location());
    4897      626837 :         if (details.kind() == kData) {
    4898             :           DCHECK(!FLAG_track_constant_fields);
    4899             :           HandleScope inner(isolate());
    4900             :           Handle<Name> key = Handle<Name>(descs->GetKey(i));
    4901             :           Handle<Object> value(descs->GetValue(i), isolate());
    4902      626633 :           JSObject::AddProperty(to, key, value, details.attributes());
    4903             : 
    4904             :         } else {
    4905             :           DCHECK_EQ(kAccessor, details.kind());
    4906             :           Handle<Name> key(descs->GetKey(i));
    4907         204 :           LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    4908         204 :           CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    4909             :           // If the property is already there we skip it
    4910         204 :           if (it.IsFound()) continue;
    4911             :           HandleScope inner(isolate());
    4912             :           DCHECK(!to->HasFastProperties());
    4913             :           // Add to dictionary.
    4914             :           Handle<Object> value(descs->GetValue(i), isolate());
    4915             :           PropertyDetails d(kAccessor, details.attributes(), i + 1,
    4916         204 :                             PropertyCellType::kMutable);
    4917         204 :           JSObject::SetNormalizedProperty(to, key, value, d);
    4918             :         }
    4919             :       }
    4920             :     }
    4921      106818 :   } else if (from->IsJSGlobalObject()) {
    4922             :     // Copy all keys and values in enumeration order.
    4923             :     Handle<GlobalDictionary> properties =
    4924             :         Handle<GlobalDictionary>(from->global_dictionary());
    4925             :     Handle<FixedArray> key_indices =
    4926      106818 :         GlobalDictionary::IterationIndices(properties);
    4927    11323044 :     for (int i = 0; i < key_indices->length(); i++) {
    4928             :       int key_index = Smi::cast(key_indices->get(i))->value();
    4929             :       Object* raw_key = properties->KeyAt(key_index);
    4930             :       DCHECK(properties->IsKey(isolate(), raw_key));
    4931             :       DCHECK(raw_key->IsName());
    4932             :       // If the property is already there we skip it.
    4933             :       Handle<Name> key(Name::cast(raw_key), isolate());
    4934     5554704 :       LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    4935     5554703 :       CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    4936     5554703 :       if (it.IsFound()) continue;
    4937             :       // Set the property.
    4938             :       DCHECK(properties->ValueAt(key_index)->IsPropertyCell());
    4939             :       Handle<PropertyCell> cell(
    4940     5554703 :           PropertyCell::cast(properties->ValueAt(key_index)), isolate());
    4941             :       Handle<Object> value(cell->value(), isolate());
    4942     5554702 :       if (value->IsTheHole(isolate())) continue;
    4943             :       PropertyDetails details = cell->property_details();
    4944     5554702 :       if (details.kind() != kData) continue;
    4945     5554702 :       JSObject::AddProperty(to, key, value, details.attributes());
    4946             :     }
    4947             :   } else {
    4948             :     // Copy all keys and values in enumeration order.
    4949             :     Handle<NameDictionary> properties =
    4950             :         Handle<NameDictionary>(from->property_dictionary());
    4951             :     Handle<FixedArray> key_indices =
    4952           0 :         NameDictionary::IterationIndices(properties);
    4953           0 :     for (int i = 0; i < key_indices->length(); i++) {
    4954             :       int key_index = Smi::cast(key_indices->get(i))->value();
    4955             :       Object* raw_key = properties->KeyAt(key_index);
    4956             :       DCHECK(properties->IsKey(isolate(), raw_key));
    4957             :       DCHECK(raw_key->IsName());
    4958             :       // If the property is already there we skip it.
    4959             :       Handle<Name> key(Name::cast(raw_key), isolate());
    4960           0 :       LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    4961           0 :       CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    4962           0 :       if (it.IsFound()) continue;
    4963             :       // Set the property.
    4964             :       Handle<Object> value =
    4965           0 :           Handle<Object>(properties->ValueAt(key_index), isolate());
    4966             :       DCHECK(!value->IsCell());
    4967             :       DCHECK(!value->IsTheHole(isolate()));
    4968             :       PropertyDetails details = properties->DetailsAt(key_index);
    4969             :       DCHECK_EQ(kData, details.kind());
    4970           0 :       JSObject::AddProperty(to, key, value, details.attributes());
    4971             :     }
    4972             :   }
    4973      236308 : }
    4974             : 
    4975             : 
    4976      236308 : void Genesis::TransferIndexedProperties(Handle<JSObject> from,
    4977      236308 :                                         Handle<JSObject> to) {
    4978             :   // Cloning the elements array is sufficient.
    4979             :   Handle<FixedArray> from_elements =
    4980             :       Handle<FixedArray>(FixedArray::cast(from->elements()));
    4981      236308 :   Handle<FixedArray> to_elements = factory()->CopyFixedArray(from_elements);
    4982      236308 :   to->set_elements(*to_elements);
    4983      236308 : }
    4984             : 
    4985             : 
    4986      258980 : void Genesis::TransferObject(Handle<JSObject> from, Handle<JSObject> to) {
    4987             :   HandleScope outer(isolate());
    4988             : 
    4989             :   DCHECK(!from->IsJSArray());
    4990             :   DCHECK(!to->IsJSArray());
    4991             : 
    4992      129490 :   TransferNamedProperties(from, to);
    4993      129490 :   TransferIndexedProperties(from, to);
    4994             : 
    4995             :   // Transfer the prototype (new map is needed).
    4996             :   Handle<Object> proto(from->map()->prototype(), isolate());
    4997      129490 :   JSObject::ForceSetPrototype(to, proto);
    4998      129490 : }
    4999             : 
    5000             : 
    5001          79 : void Genesis::MakeFunctionInstancePrototypeWritable() {
    5002             :   // The maps with writable prototype are created in CreateEmptyFunction
    5003             :   // and CreateStrictModeFunctionMaps respectively. Initially the maps are
    5004             :   // created with read-only prototype for JS builtins processing.
    5005             :   DCHECK(!sloppy_function_map_writable_prototype_.is_null());
    5006             :   DCHECK(!strict_function_map_writable_prototype_.is_null());
    5007             : 
    5008             :   // Replace function instance maps to make prototype writable.
    5009             :   native_context()->set_sloppy_function_map(
    5010             :       *sloppy_function_map_writable_prototype_);
    5011             :   native_context()->set_strict_function_map(
    5012             :       *strict_function_map_writable_prototype_);
    5013          79 : }
    5014             : 
    5015             : 
    5016             : class NoTrackDoubleFieldsForSerializerScope {
    5017             :  public:
    5018      107272 :   explicit NoTrackDoubleFieldsForSerializerScope(Isolate* isolate)
    5019      107272 :       : flag_(FLAG_track_double_fields), enabled_(false) {
    5020      107272 :     if (isolate->serializer_enabled()) {
    5021             :       // Disable tracking double fields because heap numbers treated as
    5022             :       // immutable by the serializer.
    5023         187 :       FLAG_track_double_fields = false;
    5024             :       enabled_ = true;
    5025             :     }
    5026             :   }
    5027             : 
    5028             :   ~NoTrackDoubleFieldsForSerializerScope() {
    5029      107272 :     if (enabled_) {
    5030         187 :       FLAG_track_double_fields = flag_;
    5031             :     }
    5032             :   }
    5033             : 
    5034             :  private:
    5035             :   bool flag_;
    5036             :   bool enabled_;
    5037             : };
    5038             : 
    5039      107248 : Genesis::Genesis(
    5040      421350 :     Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5041             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    5042             :     size_t context_snapshot_index,
    5043             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
    5044             :     GlobalContextType context_type)
    5045      107248 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5046             :   NoTrackDoubleFieldsForSerializerScope disable_scope(isolate);
    5047             :   result_ = Handle<Context>::null();
    5048             :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5049             : 
    5050             :   // Before creating the roots we must save the context and restore it
    5051             :   // on all function exits.
    5052      212866 :   SaveContext saved_context(isolate);
    5053             : 
    5054             :   // During genesis, the boilerplate for stack overflow won't work until the
    5055             :   // environment has been at least partially initialized. Add a stack check
    5056             :   // before entering JS code to catch overflow early.
    5057             :   StackLimitCheck check(isolate);
    5058      107248 :   if (check.HasOverflowed()) {
    5059         321 :     isolate->StackOverflow();
    5060         321 :     return;
    5061             :   }
    5062             : 
    5063             :   // The deserializer needs to hook up references to the global proxy.
    5064             :   // Create an uninitialized global proxy now if we don't have one
    5065             :   // and initialize it later in CreateNewGlobals.
    5066             :   Handle<JSGlobalProxy> global_proxy;
    5067      106927 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5068             :     int instance_size = 0;
    5069      106839 :     if (context_snapshot_index > 0) {
    5070             :       // The global proxy function to reinitialize this global proxy is in the
    5071             :       // context that is yet to be deserialized. We need to prepare a global
    5072             :       // proxy of the correct size.
    5073             :       Object* size = isolate->heap()->serialized_global_proxy_sizes()->get(
    5074          24 :           static_cast<int>(context_snapshot_index) - 1);
    5075             :       instance_size = Smi::cast(size)->value();
    5076             :     } else {
    5077             :       instance_size = JSGlobalProxy::SizeWithEmbedderFields(
    5078             :           global_proxy_template.IsEmpty()
    5079             :               ? 0
    5080      106815 :               : global_proxy_template->InternalFieldCount());
    5081             :     }
    5082             :     global_proxy =
    5083      106839 :         isolate->factory()->NewUninitializedJSGlobalProxy(instance_size);
    5084             :   }
    5085             : 
    5086             :   // We can only de-serialize a context if the isolate was initialized from
    5087             :   // a snapshot. Otherwise we have to build the context from scratch.
    5088             :   // Also create a context from scratch to expose natives, if required by flag.
    5089      320781 :   if (!isolate->initialized_from_snapshot() ||
    5090             :       !Snapshot::NewContextFromSnapshot(isolate, global_proxy,
    5091             :                                         context_snapshot_index,
    5092             :                                         embedder_fields_deserializer)
    5093      320671 :            .ToHandle(&native_context_)) {
    5094          79 :     native_context_ = Handle<Context>();
    5095             :   }
    5096             : 
    5097      106927 :   if (!native_context().is_null()) {
    5098      106848 :     AddToWeakNativeContextList(*native_context());
    5099             :     isolate->set_context(*native_context());
    5100      106848 :     isolate->counters()->contexts_created_by_snapshot()->Increment();
    5101             : #if TRACE_MAPS
    5102             :     if (FLAG_trace_maps) {
    5103             :       Handle<JSFunction> object_fun = isolate->object_function();
    5104             :       PrintF("[TraceMap: InitialMap map= %p SFI= %d_Object ]\n",
    5105             :              reinterpret_cast<void*>(object_fun->initial_map()),
    5106             :              object_fun->shared()->unique_id());
    5107             :       Map::TraceAllTransitions(object_fun->initial_map());
    5108             :     }
    5109             : #endif
    5110             : 
    5111      106848 :     if (context_snapshot_index == 0) {
    5112             :       Handle<JSGlobalObject> global_object =
    5113      106818 :           CreateNewGlobals(global_proxy_template, global_proxy);
    5114      106818 :       HookUpGlobalObject(global_object);
    5115             : 
    5116      106818 :       if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5117             :     } else {
    5118             :       // The global proxy needs to be integrated into the native context.
    5119          30 :       HookUpGlobalProxy(global_proxy);
    5120             :     }
    5121             :     DCHECK(!global_proxy->IsDetachedFrom(native_context()->global_object()));
    5122             :   } else {
    5123             :     DCHECK_EQ(0u, context_snapshot_index);
    5124             :     // We get here if there was no context snapshot.
    5125          79 :     CreateRoots();
    5126          79 :     Handle<JSFunction> empty_function = CreateEmptyFunction(isolate);
    5127          79 :     CreateStrictModeFunctionMaps(empty_function);
    5128          79 :     CreateIteratorMaps(empty_function);
    5129          79 :     CreateAsyncIteratorMaps(empty_function);
    5130          79 :     CreateAsyncFunctionMaps(empty_function);
    5131             :     Handle<JSGlobalObject> global_object =
    5132          79 :         CreateNewGlobals(global_proxy_template, global_proxy);
    5133          79 :     InitializeGlobal(global_object, empty_function, context_type);
    5134          79 :     InitializeNormalizedMapCaches();
    5135             : 
    5136          79 :     if (!InstallNatives(context_type)) return;
    5137             : 
    5138          79 :     MakeFunctionInstancePrototypeWritable();
    5139             : 
    5140          79 :     if (!InstallExtraNatives()) return;
    5141          79 :     if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5142             : 
    5143          79 :     isolate->counters()->contexts_created_from_scratch()->Increment();
    5144             :   }
    5145             : 
    5146             :   // Install experimental natives. Do not include them into the
    5147             :   // snapshot as we should be able to turn them off at runtime. Re-installing
    5148             :   // them after they have already been deserialized would also fail.
    5149      106927 :   if (context_type == FULL_CONTEXT) {
    5150      100248 :     if (!isolate->serializer_enabled()) {
    5151      100061 :       InitializeExperimentalGlobal();
    5152             : 
    5153      100061 :       if (FLAG_experimental_extras) {
    5154           6 :         if (!InstallExperimentalExtraNatives()) return;
    5155             :       }
    5156             : 
    5157             :       // Store String.prototype's map again in case it has been changed by
    5158             :       // experimental natives.
    5159             :       Handle<JSFunction> string_function(native_context()->string_function());
    5160             :       JSObject* string_function_prototype =
    5161             :           JSObject::cast(string_function->initial_map()->prototype());
    5162             :       DCHECK(string_function_prototype->HasFastProperties());
    5163             :       native_context()->set_string_function_prototype_map(
    5164             :           string_function_prototype->map());
    5165             :     }
    5166        6679 :   } else if (context_type == DEBUG_CONTEXT) {
    5167             :     DCHECK(!isolate->serializer_enabled());
    5168        6679 :     InitializeExperimentalGlobal();
    5169        6679 :     if (!InstallDebuggerNatives()) return;
    5170             :   }
    5171             : 
    5172      105618 :   ConfigureUtilsObject(context_type);
    5173             : 
    5174             :   // Check that the script context table is empty except for the 'this' binding.
    5175             :   // We do not need script contexts for native scripts.
    5176             :   DCHECK_EQ(1, native_context()->script_context_table()->used());
    5177             : 
    5178      105618 :   native_context()->ResetErrorsThrown();
    5179      105618 :   result_ = native_context();
    5180             : }
    5181             : 
    5182          48 : Genesis::Genesis(Isolate* isolate,
    5183             :                  MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5184          41 :                  v8::Local<v8::ObjectTemplate> global_proxy_template)
    5185          24 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5186             :   NoTrackDoubleFieldsForSerializerScope disable_scope(isolate);
    5187             :   result_ = Handle<Context>::null();
    5188             :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5189             : 
    5190             :   // Before creating the roots we must save the context and restore it
    5191             :   // on all function exits.
    5192          48 :   SaveContext saved_context(isolate);
    5193             : 
    5194             :   // During genesis, the boilerplate for stack overflow won't work until the
    5195             :   // environment has been at least partially initialized. Add a stack check
    5196             :   // before entering JS code to catch overflow early.
    5197             :   StackLimitCheck check(isolate);
    5198          24 :   if (check.HasOverflowed()) {
    5199           0 :     isolate->StackOverflow();
    5200          24 :     return;
    5201             :   }
    5202             : 
    5203             :   const int proxy_size = JSGlobalProxy::SizeWithEmbedderFields(
    5204          24 :       global_proxy_template->InternalFieldCount());
    5205             : 
    5206             :   Handle<JSGlobalProxy> global_proxy;
    5207          24 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5208          17 :     global_proxy = factory()->NewUninitializedJSGlobalProxy(proxy_size);
    5209             :   }
    5210             : 
    5211             :   // Create a remote object as the global object.
    5212             :   Handle<ObjectTemplateInfo> global_proxy_data =
    5213             :       Utils::OpenHandle(*global_proxy_template);
    5214             :   Handle<FunctionTemplateInfo> global_constructor(
    5215             :       FunctionTemplateInfo::cast(global_proxy_data->constructor()));
    5216             : 
    5217             :   Handle<ObjectTemplateInfo> global_object_template(
    5218             :       ObjectTemplateInfo::cast(global_constructor->prototype_template()));
    5219             :   Handle<JSObject> global_object =
    5220             :       ApiNatives::InstantiateRemoteObject(
    5221          48 :           global_object_template).ToHandleChecked();
    5222             : 
    5223             :   // (Re)initialize the global proxy object.
    5224             :   DCHECK_EQ(global_proxy_data->embedder_field_count(),
    5225             :             global_proxy_template->InternalFieldCount());
    5226             :   Handle<Map> global_proxy_map = isolate->factory()->NewMap(
    5227          24 :       JS_GLOBAL_PROXY_TYPE, proxy_size, FAST_HOLEY_SMI_ELEMENTS);
    5228             :   global_proxy_map->set_is_access_check_needed(true);
    5229             :   global_proxy_map->set_has_hidden_prototype(true);
    5230             : 
    5231             :   // A remote global proxy has no native context.
    5232          48 :   global_proxy->set_native_context(heap()->null_value());
    5233             : 
    5234             :   // Configure the hidden prototype chain of the global proxy.
    5235          24 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5236             :   global_proxy->map()->SetConstructor(*global_constructor);
    5237             :   // TODO(dcheng): This is a hack. Why does this need to be manually called
    5238             :   // here? Line 4812 should have taken care of it?
    5239             :   global_proxy->map()->set_has_hidden_prototype(true);
    5240             : 
    5241          24 :   global_proxy_ = global_proxy;
    5242             : }
    5243             : 
    5244             : // Support for thread preemption.
    5245             : 
    5246             : // Reserve space for statics needing saving and restoring.
    5247        1280 : int Bootstrapper::ArchiveSpacePerThread() {
    5248        1280 :   return sizeof(NestingCounterType);
    5249             : }
    5250             : 
    5251             : 
    5252             : // Archive statics that are thread-local.
    5253       22574 : char* Bootstrapper::ArchiveState(char* to) {
    5254       22574 :   *reinterpret_cast<NestingCounterType*>(to) = nesting_;
    5255       22574 :   nesting_ = 0;
    5256       22574 :   return to + sizeof(NestingCounterType);
    5257             : }
    5258             : 
    5259             : 
    5260             : // Restore statics that are thread-local.
    5261       22574 : char* Bootstrapper::RestoreState(char* from) {
    5262       22574 :   nesting_ = *reinterpret_cast<NestingCounterType*>(from);
    5263       22574 :   return from + sizeof(NestingCounterType);
    5264             : }
    5265             : 
    5266             : 
    5267             : // Called when the top-level V8 mutex is destroyed.
    5268        6863 : void Bootstrapper::FreeThreadResources() {
    5269             :   DCHECK(!IsActive());
    5270        6863 : }
    5271             : 
    5272             : }  // namespace internal
    5273             : }  // namespace v8

Generated by: LCOV version 1.10