LCOV - code coverage report
Current view: top level - src - bootstrapper.cc (source / functions) Hit Total Coverage
Test: app.info Lines: 1614 1654 97.6 %
Date: 2017-10-20 Functions: 101 118 85.6 %

          Line data    Source code
       1             : // Copyright 2014 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #include "src/bootstrapper.h"
       6             : 
       7             : #include "src/accessors.h"
       8             : #include "src/api-natives.h"
       9             : #include "src/api.h"
      10             : #include "src/base/ieee754.h"
      11             : #include "src/code-stubs.h"
      12             : #include "src/compiler.h"
      13             : #include "src/debug/debug.h"
      14             : #include "src/extensions/externalize-string-extension.h"
      15             : #include "src/extensions/free-buffer-extension.h"
      16             : #include "src/extensions/gc-extension.h"
      17             : #include "src/extensions/ignition-statistics-extension.h"
      18             : #include "src/extensions/statistics-extension.h"
      19             : #include "src/extensions/trigger-failure-extension.h"
      20             : #include "src/heap/heap.h"
      21             : #include "src/isolate-inl.h"
      22             : #include "src/objects/js-regexp.h"
      23             : #include "src/snapshot/natives.h"
      24             : #include "src/snapshot/snapshot.h"
      25             : #include "src/wasm/wasm-js.h"
      26             : 
      27             : #if V8_INTL_SUPPORT
      28             : #include "src/objects/intl-objects.h"
      29             : #endif  // V8_INTL_SUPPORT
      30             : 
      31             : namespace v8 {
      32             : namespace internal {
      33             : 
      34           0 : void SourceCodeCache::Initialize(Isolate* isolate, bool create_heap_objects) {
      35      108364 :   cache_ = create_heap_objects ? isolate->heap()->empty_fixed_array() : nullptr;
      36           0 : }
      37             : 
      38        4219 : bool SourceCodeCache::Lookup(Vector<const char> name,
      39             :                              Handle<SharedFunctionInfo>* handle) {
      40       20174 :   for (int i = 0; i < cache_->length(); i += 2) {
      41             :     SeqOneByteString* str = SeqOneByteString::cast(cache_->get(i));
      42        6951 :     if (str->IsUtf8EqualTo(name)) {
      43             :       *handle = Handle<SharedFunctionInfo>(
      44        2164 :           SharedFunctionInfo::cast(cache_->get(i + 1)));
      45        1082 :       return true;
      46             :     }
      47             :   }
      48             :   return false;
      49             : }
      50             : 
      51        3108 : void SourceCodeCache::Add(Vector<const char> name,
      52             :                           Handle<SharedFunctionInfo> shared) {
      53             :   Isolate* isolate = shared->GetIsolate();
      54             :   Factory* factory = isolate->factory();
      55             :   HandleScope scope(isolate);
      56        3108 :   int length = cache_->length();
      57        3108 :   Handle<FixedArray> new_array = factory->NewFixedArray(length + 2, TENURED);
      58        6216 :   cache_->CopyTo(0, *new_array, 0, cache_->length());
      59        3108 :   cache_ = *new_array;
      60             :   Handle<String> str =
      61             :       factory->NewStringFromOneByte(Vector<const uint8_t>::cast(name), TENURED)
      62        6216 :           .ToHandleChecked();
      63             :   DCHECK(!str.is_null());
      64        3108 :   cache_->set(length, *str);
      65        3108 :   cache_->set(length + 1, *shared);
      66        3108 :   Script::cast(shared->script())->set_type(type_);
      67        3108 : }
      68             : 
      69       54999 : Bootstrapper::Bootstrapper(Isolate* isolate)
      70             :     : isolate_(isolate),
      71             :       nesting_(0),
      72      109998 :       extensions_cache_(Script::TYPE_EXTENSION) {}
      73             : 
      74       13230 : Handle<String> Bootstrapper::GetNativeSource(NativeType type, int index) {
      75             :   NativesExternalStringResource* resource =
      76       13230 :       new NativesExternalStringResource(type, index);
      77             :   Handle<ExternalOneByteString> source_code =
      78       13230 :       isolate_->factory()->NewNativeSourceString(resource);
      79       13230 :   isolate_->heap()->RegisterExternalString(*source_code);
      80             :   DCHECK(source_code->is_short());
      81       13230 :   return source_code;
      82             : }
      83             : 
      84       54999 : void Bootstrapper::Initialize(bool create_heap_objects) {
      85       54999 :   extensions_cache_.Initialize(isolate_, create_heap_objects);
      86       54999 : }
      87             : 
      88             : 
      89             : static const char* GCFunctionName() {
      90             :   bool flag_given =
      91       53977 :       FLAG_expose_gc_as != nullptr && strlen(FLAG_expose_gc_as) != 0;
      92       53977 :   return flag_given ? FLAG_expose_gc_as : "gc";
      93             : }
      94             : 
      95             : v8::Extension* Bootstrapper::free_buffer_extension_ = nullptr;
      96             : v8::Extension* Bootstrapper::gc_extension_ = nullptr;
      97             : v8::Extension* Bootstrapper::externalize_string_extension_ = nullptr;
      98             : v8::Extension* Bootstrapper::statistics_extension_ = nullptr;
      99             : v8::Extension* Bootstrapper::trigger_failure_extension_ = nullptr;
     100             : v8::Extension* Bootstrapper::ignition_statistics_extension_ = nullptr;
     101             : 
     102       53977 : void Bootstrapper::InitializeOncePerProcess() {
     103       53977 :   free_buffer_extension_ = new FreeBufferExtension;
     104       53977 :   v8::RegisterExtension(free_buffer_extension_);
     105       53977 :   gc_extension_ = new GCExtension(GCFunctionName());
     106       53977 :   v8::RegisterExtension(gc_extension_);
     107       53977 :   externalize_string_extension_ = new ExternalizeStringExtension;
     108       53977 :   v8::RegisterExtension(externalize_string_extension_);
     109       53977 :   statistics_extension_ = new StatisticsExtension;
     110       53977 :   v8::RegisterExtension(statistics_extension_);
     111       53977 :   trigger_failure_extension_ = new TriggerFailureExtension;
     112       53977 :   v8::RegisterExtension(trigger_failure_extension_);
     113       53977 :   ignition_statistics_extension_ = new IgnitionStatisticsExtension;
     114       53977 :   v8::RegisterExtension(ignition_statistics_extension_);
     115       53977 : }
     116             : 
     117             : 
     118       29500 : void Bootstrapper::TearDownExtensions() {
     119       29500 :   delete free_buffer_extension_;
     120       29500 :   free_buffer_extension_ = nullptr;
     121       29500 :   delete gc_extension_;
     122       29500 :   gc_extension_ = nullptr;
     123       29500 :   delete externalize_string_extension_;
     124       29500 :   externalize_string_extension_ = nullptr;
     125       29500 :   delete statistics_extension_;
     126       29500 :   statistics_extension_ = nullptr;
     127       29500 :   delete trigger_failure_extension_;
     128       29500 :   trigger_failure_extension_ = nullptr;
     129       29500 :   delete ignition_statistics_extension_;
     130       29500 :   ignition_statistics_extension_ = nullptr;
     131       29500 : }
     132             : 
     133       53365 : void Bootstrapper::TearDown() {
     134             :   extensions_cache_.Initialize(isolate_, false);  // Yes, symmetrical
     135       53365 : }
     136             : 
     137             : 
     138             : class Genesis BASE_EMBEDDED {
     139             :  public:
     140             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     141             :           v8::Local<v8::ObjectTemplate> global_proxy_template,
     142             :           size_t context_snapshot_index,
     143             :           v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
     144             :           GlobalContextType context_type);
     145             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     146             :           v8::Local<v8::ObjectTemplate> global_proxy_template);
     147             :   ~Genesis() { }
     148             : 
     149             :   Isolate* isolate() const { return isolate_; }
     150             :   Factory* factory() const { return isolate_->factory(); }
     151             :   Builtins* builtins() const { return isolate_->builtins(); }
     152             :   Heap* heap() const { return isolate_->heap(); }
     153             : 
     154             :   Handle<Context> result() { return result_; }
     155             : 
     156             :   Handle<JSGlobalProxy> global_proxy() { return global_proxy_; }
     157             : 
     158             :  private:
     159             :   Handle<Context> native_context() { return native_context_; }
     160             : 
     161             :   // Creates some basic objects. Used for creating a context from scratch.
     162             :   void CreateRoots();
     163             :   // Creates the empty function.  Used for creating a context from scratch.
     164             :   Handle<JSFunction> CreateEmptyFunction(Isolate* isolate);
     165             :   // Returns the %ThrowTypeError% intrinsic function.
     166             :   // See ES#sec-%throwtypeerror% for details.
     167             :   Handle<JSFunction> GetThrowTypeErrorIntrinsic();
     168             : 
     169             :   void CreateSloppyModeFunctionMaps(Handle<JSFunction> empty);
     170             :   void CreateStrictModeFunctionMaps(Handle<JSFunction> empty);
     171             :   void CreateObjectFunction(Handle<JSFunction> empty);
     172             :   void CreateIteratorMaps(Handle<JSFunction> empty);
     173             :   void CreateAsyncIteratorMaps(Handle<JSFunction> empty);
     174             :   void CreateAsyncFunctionMaps(Handle<JSFunction> empty);
     175             :   void CreateJSProxyMaps();
     176             : 
     177             :   // Make the "arguments" and "caller" properties throw a TypeError on access.
     178             :   void AddRestrictedFunctionProperties(Handle<JSFunction> empty);
     179             : 
     180             :   // Creates the global objects using the global proxy and the template passed
     181             :   // in through the API.  We call this regardless of whether we are building a
     182             :   // context from scratch or using a deserialized one from the partial snapshot
     183             :   // but in the latter case we don't use the objects it produces directly, as
     184             :   // we have to use the deserialized ones that are linked together with the
     185             :   // rest of the context snapshot. At the end we link the global proxy and the
     186             :   // context to each other.
     187             :   Handle<JSGlobalObject> CreateNewGlobals(
     188             :       v8::Local<v8::ObjectTemplate> global_proxy_template,
     189             :       Handle<JSGlobalProxy> global_proxy);
     190             :   // Similarly, we want to use the global that has been created by the templates
     191             :   // passed through the API.  The global from the snapshot is detached from the
     192             :   // other objects in the snapshot.
     193             :   void HookUpGlobalObject(Handle<JSGlobalObject> global_object);
     194             :   // Hooks the given global proxy into the context in the case we do not
     195             :   // replace the global object from the deserialized native context.
     196             :   void HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy);
     197             :   // The native context has a ScriptContextTable that store declarative bindings
     198             :   // made in script scopes.  Add a "this" binding to that table pointing to the
     199             :   // global proxy.
     200             :   void InstallGlobalThisBinding();
     201             :   // New context initialization.  Used for creating a context from scratch.
     202             :   void InitializeGlobal(Handle<JSGlobalObject> global_object,
     203             :                         Handle<JSFunction> empty_function,
     204             :                         GlobalContextType context_type);
     205             :   void InitializeExperimentalGlobal();
     206             :   // Depending on the situation, expose and/or get rid of the utils object.
     207             :   void ConfigureUtilsObject(GlobalContextType context_type);
     208             : 
     209             : #define DECLARE_FEATURE_INITIALIZATION(id, descr) \
     210             :   void InitializeGlobal_##id();
     211             : 
     212             :   HARMONY_INPROGRESS(DECLARE_FEATURE_INITIALIZATION)
     213             :   HARMONY_STAGED(DECLARE_FEATURE_INITIALIZATION)
     214             :   HARMONY_SHIPPING(DECLARE_FEATURE_INITIALIZATION)
     215             : #undef DECLARE_FEATURE_INITIALIZATION
     216             : 
     217             :   Handle<JSFunction> CreateArrayBuffer(Handle<String> name,
     218             :                                        Builtins::Name call_byteLength,
     219             :                                        BuiltinFunctionId byteLength_id,
     220             :                                        Builtins::Name call_slice);
     221             :   Handle<JSFunction> InstallInternalArray(Handle<JSObject> target,
     222             :                                           const char* name,
     223             :                                           ElementsKind elements_kind);
     224             :   bool InstallNatives(GlobalContextType context_type);
     225             : 
     226             :   void InstallTypedArray(const char* name, ElementsKind elements_kind,
     227             :                          Handle<JSFunction>* fun);
     228             :   bool InstallExtraNatives();
     229             :   bool InstallExperimentalExtraNatives();
     230             :   bool InstallDebuggerNatives();
     231             :   void InstallBuiltinFunctionIds();
     232             :   void InstallExperimentalBuiltinFunctionIds();
     233             :   void InitializeNormalizedMapCaches();
     234             : 
     235             :   enum ExtensionTraversalState {
     236             :     UNVISITED, VISITED, INSTALLED
     237             :   };
     238             : 
     239             :   class ExtensionStates {
     240             :    public:
     241             :     ExtensionStates();
     242             :     ExtensionTraversalState get_state(RegisteredExtension* extension);
     243             :     void set_state(RegisteredExtension* extension,
     244             :                    ExtensionTraversalState state);
     245             :    private:
     246             :     base::HashMap map_;
     247             :     DISALLOW_COPY_AND_ASSIGN(ExtensionStates);
     248             :   };
     249             : 
     250             :   // Used both for deserialized and from-scratch contexts to add the extensions
     251             :   // provided.
     252             :   static bool InstallExtensions(Handle<Context> native_context,
     253             :                                 v8::ExtensionConfiguration* extensions);
     254             :   static bool InstallAutoExtensions(Isolate* isolate,
     255             :                                     ExtensionStates* extension_states);
     256             :   static bool InstallRequestedExtensions(Isolate* isolate,
     257             :                                          v8::ExtensionConfiguration* extensions,
     258             :                                          ExtensionStates* extension_states);
     259             :   static bool InstallExtension(Isolate* isolate,
     260             :                                const char* name,
     261             :                                ExtensionStates* extension_states);
     262             :   static bool InstallExtension(Isolate* isolate,
     263             :                                v8::RegisteredExtension* current,
     264             :                                ExtensionStates* extension_states);
     265             :   static bool InstallSpecialObjects(Handle<Context> native_context);
     266             :   bool ConfigureApiObject(Handle<JSObject> object,
     267             :                           Handle<ObjectTemplateInfo> object_template);
     268             :   bool ConfigureGlobalObjects(
     269             :       v8::Local<v8::ObjectTemplate> global_proxy_template);
     270             : 
     271             :   // Migrates all properties from the 'from' object to the 'to'
     272             :   // object and overrides the prototype in 'to' with the one from
     273             :   // 'from'.
     274             :   void TransferObject(Handle<JSObject> from, Handle<JSObject> to);
     275             :   void TransferNamedProperties(Handle<JSObject> from, Handle<JSObject> to);
     276             :   void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);
     277             : 
     278             :   static bool CallUtilsFunction(Isolate* isolate, const char* name);
     279             : 
     280             :   static bool CompileExtension(Isolate* isolate, v8::Extension* extension);
     281             : 
     282             :   Isolate* isolate_;
     283             :   Handle<Context> result_;
     284             :   Handle<Context> native_context_;
     285             :   Handle<JSGlobalProxy> global_proxy_;
     286             : 
     287             :   // Temporary function maps needed only during bootstrapping.
     288             :   Handle<Map> strict_function_with_home_object_map_;
     289             :   Handle<Map> strict_function_with_name_and_home_object_map_;
     290             : 
     291             :   // %ThrowTypeError%. See ES#sec-%throwtypeerror% for details.
     292             :   Handle<JSFunction> restricted_properties_thrower_;
     293             : 
     294             :   BootstrapperActive active_;
     295             :   friend class Bootstrapper;
     296             : };
     297             : 
     298      232423 : void Bootstrapper::Iterate(RootVisitor* v) {
     299             :   extensions_cache_.Iterate(v);
     300      232423 :   v->Synchronize(VisitorSynchronization::kExtensions);
     301      232423 : }
     302             : 
     303       83880 : Handle<Context> Bootstrapper::CreateEnvironment(
     304             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     305             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
     306             :     v8::ExtensionConfiguration* extensions, size_t context_snapshot_index,
     307             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
     308             :     GlobalContextType context_type) {
     309       83880 :   HandleScope scope(isolate_);
     310             :   Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template,
     311             :                   context_snapshot_index, embedder_fields_deserializer,
     312       83880 :                   context_type);
     313             :   Handle<Context> env = genesis.result();
     314       83880 :   if (env.is_null() || !InstallExtensions(env, extensions)) {
     315        1160 :     return Handle<Context>();
     316             :   }
     317       82720 :   return scope.CloseAndEscape(env);
     318             : }
     319             : 
     320          21 : Handle<JSGlobalProxy> Bootstrapper::NewRemoteContext(
     321             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     322             :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
     323          21 :   HandleScope scope(isolate_);
     324          21 :   Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template);
     325             :   Handle<JSGlobalProxy> global_proxy = genesis.global_proxy();
     326          21 :   if (global_proxy.is_null()) return Handle<JSGlobalProxy>();
     327          21 :   return scope.CloseAndEscape(global_proxy);
     328             : }
     329             : 
     330          55 : void Bootstrapper::DetachGlobal(Handle<Context> env) {
     331             :   Isolate* isolate = env->GetIsolate();
     332             :   isolate->counters()->errors_thrown_per_context()->AddSample(
     333         110 :       env->GetErrorsThrown());
     334             : 
     335         110 :   Heap* heap = isolate->heap();
     336          55 :   Handle<JSGlobalProxy> global_proxy(JSGlobalProxy::cast(env->global_proxy()));
     337          55 :   global_proxy->set_native_context(heap->null_value());
     338          55 :   JSObject::ForceSetPrototype(global_proxy, isolate->factory()->null_value());
     339             :   global_proxy->map()->SetConstructor(heap->null_value());
     340          55 :   if (FLAG_track_detached_contexts) {
     341          55 :     env->GetIsolate()->AddDetachedContext(env);
     342             :   }
     343          55 : }
     344             : 
     345             : namespace {
     346             : 
     347             : // Non-construct case.
     348      334316 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
     349             :     Isolate* isolate, Builtins::Name call, Handle<String> name, int len) {
     350      334316 :   Handle<Code> code = isolate->builtins()->builtin_handle(call);
     351             :   Handle<SharedFunctionInfo> shared =
     352      334316 :       isolate->factory()->NewSharedFunctionInfo(name, code, false);
     353             :   shared->set_lazy_deserialization_builtin_id(call);
     354             :   shared->set_internal_formal_parameter_count(len);
     355             :   shared->set_length(len);
     356      334316 :   return shared;
     357             : }
     358             : 
     359             : // Construct case.
     360          61 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
     361             :     Isolate* isolate, Builtins::Name call, Handle<String> name,
     362             :     Handle<String> instance_class_name, int len) {
     363          61 :   Handle<Code> code = isolate->builtins()->builtin_handle(call);
     364             :   Handle<SharedFunctionInfo> shared =
     365          61 :       isolate->factory()->NewSharedFunctionInfo(name, code, false);
     366         122 :   shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
     367          61 :   shared->set_instance_class_name(*instance_class_name);
     368          61 :   if (Builtins::IsLazy(call)) shared->set_lazy_deserialization_builtin_id(call);
     369             :   shared->set_internal_formal_parameter_count(len);
     370             :   shared->set_length(len);
     371          61 :   return shared;
     372             : }
     373             : 
     374      109918 : V8_NOINLINE void InstallFunction(Handle<JSObject> target,
     375             :                                  Handle<Name> property_name,
     376             :                                  Handle<JSFunction> function,
     377             :                                  Handle<String> function_name,
     378             :                                  PropertyAttributes attributes = DONT_ENUM) {
     379      109918 :   JSObject::AddProperty(target, property_name, function, attributes);
     380      109918 :   if (target->IsJSGlobalObject()) {
     381        2458 :     function->shared()->set_instance_class_name(*function_name);
     382             :   }
     383      109918 : }
     384             : 
     385      106850 : V8_NOINLINE void InstallFunction(Handle<JSObject> target,
     386             :                                  Handle<JSFunction> function, Handle<Name> name,
     387             :                                  PropertyAttributes attributes = DONT_ENUM) {
     388      213700 :   Handle<String> name_string = Name::ToFunctionName(name).ToHandleChecked();
     389      106850 :   InstallFunction(target, name, function, name_string, attributes);
     390      106850 : }
     391             : 
     392      198316 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     393             :     Isolate* isolate, Handle<String> name, InstanceType type, int instance_size,
     394             :     int inobject_properties, MaybeHandle<Object> maybe_prototype,
     395             :     Builtins::Name call) {
     396             :   Factory* factory = isolate->factory();
     397             :   Handle<Code> call_code(isolate->builtins()->builtin(call));
     398             :   Handle<Object> prototype;
     399             :   Handle<JSFunction> result =
     400             :       maybe_prototype.ToHandle(&prototype)
     401             :           ? factory->NewFunction(name, call_code, prototype, type,
     402             :                                  instance_size, inobject_properties,
     403        3373 :                                  LanguageMode::kStrict, IMMUTABLE)
     404             :           : factory->NewFunctionWithoutPrototype(name, call_code,
     405      201689 :                                                  LanguageMode::kStrict);
     406      198316 :   if (Builtins::IsLazy(call)) {
     407             :     result->shared()->set_lazy_deserialization_builtin_id(call);
     408             :   }
     409             :   result->shared()->set_native(true);
     410      198316 :   return result;
     411             : }
     412             : 
     413        3007 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     414             :     Handle<JSObject> target, Handle<Name> name, InstanceType type,
     415             :     int instance_size, int inobject_properties,
     416             :     MaybeHandle<Object> maybe_prototype, Builtins::Name call,
     417             :     PropertyAttributes attributes) {
     418        6014 :   Handle<String> name_string = Name::ToFunctionName(name).ToHandleChecked();
     419             :   Handle<JSFunction> function =
     420             :       CreateFunction(target->GetIsolate(), name_string, type, instance_size,
     421        6014 :                      inobject_properties, maybe_prototype, call);
     422        3007 :   InstallFunction(target, name, function, name_string, attributes);
     423        3007 :   return function;
     424             : }
     425             : 
     426        2214 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     427             :     Handle<JSObject> target, const char* name, InstanceType type,
     428             :     int instance_size, int inobject_properties,
     429             :     MaybeHandle<Object> maybe_prototype, Builtins::Name call) {
     430             :   Factory* const factory = target->GetIsolate()->factory();
     431             :   PropertyAttributes attributes = DONT_ENUM;
     432             :   return InstallFunction(target, factory->InternalizeUtf8String(name), type,
     433             :                          instance_size, inobject_properties, maybe_prototype,
     434        4428 :                          call, attributes);
     435             : }
     436             : 
     437      194821 : V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,
     438             :                                                     Handle<String> name,
     439             :                                                     Builtins::Name call,
     440             :                                                     int len, bool adapt) {
     441             :   Handle<JSFunction> fun =
     442             :       CreateFunction(isolate, name, JS_OBJECT_TYPE, JSObject::kHeaderSize, 0,
     443      194821 :                      MaybeHandle<JSObject>(), call);
     444      194821 :   if (adapt) {
     445             :     fun->shared()->set_internal_formal_parameter_count(len);
     446             :   } else {
     447             :     fun->shared()->DontAdaptArguments();
     448             :   }
     449             :   fun->shared()->set_length(len);
     450      194821 :   return fun;
     451             : }
     452             : 
     453      105708 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
     454             :     Handle<JSObject> base, Handle<Name> property_name,
     455             :     Handle<String> function_name, Builtins::Name call, int len, bool adapt,
     456             :     PropertyAttributes attrs = DONT_ENUM,
     457             :     BuiltinFunctionId id = kInvalidBuiltinFunctionId) {
     458             :   Handle<JSFunction> fun =
     459      211416 :       SimpleCreateFunction(base->GetIsolate(), function_name, call, len, adapt);
     460      105708 :   if (id != kInvalidBuiltinFunctionId) {
     461             :     fun->shared()->set_builtin_function_id(id);
     462             :   }
     463      105708 :   InstallFunction(base, fun, property_name, attrs);
     464      105708 :   return fun;
     465             : }
     466             : 
     467      105159 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
     468             :     Handle<JSObject> base, Handle<String> name, Builtins::Name call, int len,
     469             :     bool adapt, PropertyAttributes attrs = DONT_ENUM,
     470             :     BuiltinFunctionId id = kInvalidBuiltinFunctionId) {
     471      210318 :   return SimpleInstallFunction(base, name, name, call, len, adapt, attrs, id);
     472             : }
     473             : 
     474         549 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
     475             :     Handle<JSObject> base, Handle<Name> property_name,
     476             :     const char* function_name, Builtins::Name call, int len, bool adapt,
     477             :     PropertyAttributes attrs = DONT_ENUM,
     478             :     BuiltinFunctionId id = kInvalidBuiltinFunctionId) {
     479             :   Factory* const factory = base->GetIsolate()->factory();
     480             :   // Function name does not have to be internalized.
     481             :   return SimpleInstallFunction(
     482             :       base, property_name, factory->NewStringFromAsciiChecked(function_name),
     483         549 :       call, len, adapt, attrs, id);
     484             : }
     485             : 
     486      103085 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
     487             :     Handle<JSObject> base, const char* name, Builtins::Name call, int len,
     488             :     bool adapt, PropertyAttributes attrs = DONT_ENUM,
     489             :     BuiltinFunctionId id = kInvalidBuiltinFunctionId) {
     490             :   Factory* const factory = base->GetIsolate()->factory();
     491             :   // Although function name does not have to be internalized the property name
     492             :   // will be internalized during property addition anyway, so do it here now.
     493             :   return SimpleInstallFunction(base, factory->InternalizeUtf8String(name), call,
     494      103085 :                                len, adapt, attrs, id);
     495             : }
     496             : 
     497        1037 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(Handle<JSObject> base,
     498             :                                                      const char* name,
     499             :                                                      Builtins::Name call,
     500             :                                                      int len, bool adapt,
     501             :                                                      BuiltinFunctionId id) {
     502        1037 :   return SimpleInstallFunction(base, name, call, len, adapt, DONT_ENUM, id);
     503             : }
     504             : 
     505        1220 : V8_NOINLINE void SimpleInstallGetterSetter(Handle<JSObject> base,
     506             :                                            Handle<String> name,
     507             :                                            Builtins::Name call_getter,
     508             :                                            Builtins::Name call_setter,
     509             :                                            PropertyAttributes attribs) {
     510             :   Isolate* const isolate = base->GetIsolate();
     511             : 
     512             :   Handle<String> getter_name =
     513        1220 :       Name::ToFunctionName(name, isolate->factory()->get_string())
     514        2440 :           .ToHandleChecked();
     515             :   Handle<JSFunction> getter =
     516        1220 :       SimpleCreateFunction(isolate, getter_name, call_getter, 0, true);
     517             : 
     518             :   Handle<String> setter_name =
     519        1220 :       Name::ToFunctionName(name, isolate->factory()->set_string())
     520        2440 :           .ToHandleChecked();
     521             :   Handle<JSFunction> setter =
     522        1220 :       SimpleCreateFunction(isolate, setter_name, call_setter, 1, true);
     523             : 
     524        2440 :   JSObject::DefineAccessor(base, name, getter, setter, attribs).Check();
     525        1220 : }
     526             : 
     527       85043 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
     528             :                                                    Handle<Name> name,
     529             :                                                    Handle<Name> property_name,
     530             :                                                    Builtins::Name call,
     531             :                                                    bool adapt) {
     532             :   Isolate* const isolate = base->GetIsolate();
     533             : 
     534             :   Handle<String> getter_name =
     535             :       Name::ToFunctionName(name, isolate->factory()->get_string())
     536      170086 :           .ToHandleChecked();
     537             :   Handle<JSFunction> getter =
     538       85043 :       SimpleCreateFunction(isolate, getter_name, call, 0, adapt);
     539             : 
     540             :   Handle<Object> setter = isolate->factory()->undefined_value();
     541             : 
     542       85043 :   JSObject::DefineAccessor(base, property_name, getter, setter, DONT_ENUM)
     543      170086 :       .Check();
     544             : 
     545       85043 :   return getter;
     546             : }
     547             : 
     548       84555 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
     549             :                                                    Handle<Name> name,
     550             :                                                    Builtins::Name call,
     551             :                                                    bool adapt) {
     552       84555 :   return SimpleInstallGetter(base, name, name, call, adapt);
     553             : }
     554             : 
     555         671 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Handle<JSObject> base,
     556             :                                                    Handle<Name> name,
     557             :                                                    Builtins::Name call,
     558             :                                                    bool adapt,
     559             :                                                    BuiltinFunctionId id) {
     560         671 :   Handle<JSFunction> fun = SimpleInstallGetter(base, name, call, adapt);
     561             :   fun->shared()->set_builtin_function_id(id);
     562         671 :   return fun;
     563             : }
     564             : 
     565       84045 : V8_NOINLINE void InstallConstant(Isolate* isolate, Handle<JSObject> holder,
     566             :                                  const char* name, Handle<Object> value) {
     567             :   JSObject::AddProperty(
     568             :       holder, isolate->factory()->NewStringFromAsciiChecked(name), value,
     569      168090 :       static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     570       84045 : }
     571             : 
     572         488 : V8_NOINLINE void InstallSpeciesGetter(Handle<JSFunction> constructor) {
     573             :   Factory* factory = constructor->GetIsolate()->factory();
     574             :   // TODO(adamk): We should be able to share a SharedFunctionInfo
     575             :   // between all these JSFunctins.
     576             :   SimpleInstallGetter(constructor, factory->symbol_species_string(),
     577             :                       factory->species_symbol(), Builtins::kReturnReceiver,
     578         488 :                       true);
     579         488 : }
     580             : 
     581             : }  // namespace
     582             : 
     583          61 : Handle<JSFunction> Genesis::CreateEmptyFunction(Isolate* isolate) {
     584             :   Factory* factory = isolate->factory();
     585             : 
     586             :   // Allocate the function map first and then patch the prototype later.
     587             :   Handle<Map> empty_function_map = factory->CreateSloppyFunctionMap(
     588          61 :       FUNCTION_WITHOUT_PROTOTYPE, MaybeHandle<JSFunction>());
     589             :   empty_function_map->set_is_prototype_map(true);
     590             :   DCHECK(!empty_function_map->is_dictionary_map());
     591             : 
     592             :   // Allocate the empty function as the prototype for function according to
     593             :   // ES#sec-properties-of-the-function-prototype-object
     594          61 :   Handle<Code> code(BUILTIN_CODE(isolate, EmptyFunction));
     595             :   Handle<JSFunction> empty_function =
     596          61 :       factory->NewFunction(empty_function_map, factory->empty_string(), code);
     597             :   empty_function->shared()->set_language_mode(LanguageMode::kStrict);
     598             : 
     599             :   // --- E m p t y ---
     600          61 :   Handle<String> source = factory->NewStringFromStaticChars("() {}");
     601          61 :   Handle<Script> script = factory->NewScript(source);
     602             :   script->set_type(Script::TYPE_NATIVE);
     603          61 :   Handle<FixedArray> infos = factory->NewFixedArray(2);
     604          61 :   script->set_shared_function_infos(*infos);
     605             :   empty_function->shared()->set_start_position(0);
     606             :   empty_function->shared()->set_end_position(source->length());
     607             :   empty_function->shared()->set_function_literal_id(1);
     608             :   empty_function->shared()->DontAdaptArguments();
     609          61 :   SharedFunctionInfo::SetScript(handle(empty_function->shared()), script);
     610             : 
     611          61 :   return empty_function;
     612             : }
     613             : 
     614          61 : void Genesis::CreateSloppyModeFunctionMaps(Handle<JSFunction> empty) {
     615          61 :   Factory* factory = isolate_->factory();
     616             :   Handle<Map> map;
     617             : 
     618             :   //
     619             :   // Allocate maps for sloppy functions without prototype.
     620             :   //
     621          61 :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     622             :   native_context()->set_sloppy_function_without_prototype_map(*map);
     623             : 
     624             :   //
     625             :   // Allocate maps for sloppy functions with readonly prototype.
     626             :   //
     627             :   map =
     628          61 :       factory->CreateSloppyFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     629             :   native_context()->set_sloppy_function_with_readonly_prototype_map(*map);
     630             : 
     631             :   //
     632             :   // Allocate maps for sloppy functions with writable prototype.
     633             :   //
     634             :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     635          61 :                                          empty);
     636             :   native_context()->set_sloppy_function_map(*map);
     637             : 
     638             :   map = factory->CreateSloppyFunctionMap(
     639          61 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     640             :   native_context()->set_sloppy_function_with_name_map(*map);
     641          61 : }
     642             : 
     643         427 : Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {
     644         122 :   if (!restricted_properties_thrower_.is_null()) {
     645          61 :     return restricted_properties_thrower_;
     646             :   }
     647          61 :   Handle<String> name(factory()->empty_string());
     648          61 :   Handle<Code> code = BUILTIN_CODE(isolate(), StrictPoisonPillThrower);
     649             :   Handle<JSFunction> function =
     650          61 :       factory()->NewFunctionWithoutPrototype(name, code, LanguageMode::kStrict);
     651             :   function->shared()->DontAdaptArguments();
     652             : 
     653             :   // %ThrowTypeError% must not have a name property.
     654          61 :   if (JSReceiver::DeleteProperty(function, factory()->name_string())
     655          61 :           .IsNothing()) {
     656             :     DCHECK(false);
     657             :   }
     658             : 
     659             :   // length needs to be non configurable.
     660             :   Handle<Object> value(Smi::FromInt(function->shared()->GetLength()),
     661             :                        isolate());
     662             :   JSObject::SetOwnPropertyIgnoreAttributes(
     663             :       function, factory()->length_string(), value,
     664          61 :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))
     665          61 :       .Assert();
     666             : 
     667          61 :   if (JSObject::PreventExtensions(function, Object::THROW_ON_ERROR)
     668          61 :           .IsNothing()) {
     669             :     DCHECK(false);
     670             :   }
     671             : 
     672          61 :   JSObject::MigrateSlowToFast(function, 0, "Bootstrapping");
     673             : 
     674          61 :   restricted_properties_thrower_ = function;
     675          61 :   return function;
     676             : }
     677             : 
     678          61 : void Genesis::CreateStrictModeFunctionMaps(Handle<JSFunction> empty) {
     679          61 :   Factory* factory = isolate_->factory();
     680             :   Handle<Map> map;
     681             : 
     682             :   //
     683             :   // Allocate maps for strict functions without prototype.
     684             :   //
     685          61 :   map = factory->CreateStrictFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     686             :   native_context()->set_strict_function_without_prototype_map(*map);
     687             : 
     688          61 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_NAME, empty);
     689             :   native_context()->set_method_with_name_map(*map);
     690             : 
     691          61 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_HOME_OBJECT, empty);
     692             :   native_context()->set_method_with_home_object_map(*map);
     693             : 
     694             :   map =
     695          61 :       factory->CreateStrictFunctionMap(METHOD_WITH_NAME_AND_HOME_OBJECT, empty);
     696             :   native_context()->set_method_with_name_and_home_object_map(*map);
     697             : 
     698             :   //
     699             :   // Allocate maps for strict functions with writable prototype.
     700             :   //
     701             :   map = factory->CreateStrictFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     702          61 :                                          empty);
     703             :   native_context()->set_strict_function_map(*map);
     704             : 
     705             :   map = factory->CreateStrictFunctionMap(
     706          61 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     707             :   native_context()->set_strict_function_with_name_map(*map);
     708             : 
     709             :   strict_function_with_home_object_map_ = factory->CreateStrictFunctionMap(
     710          61 :       FUNCTION_WITH_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     711             :   strict_function_with_name_and_home_object_map_ =
     712             :       factory->CreateStrictFunctionMap(
     713          61 :           FUNCTION_WITH_NAME_AND_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     714             : 
     715             :   //
     716             :   // Allocate maps for strict functions with readonly prototype.
     717             :   //
     718             :   map =
     719          61 :       factory->CreateStrictFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     720             :   native_context()->set_strict_function_with_readonly_prototype_map(*map);
     721             : 
     722             :   //
     723             :   // Allocate map for class functions.
     724             :   //
     725          61 :   map = factory->CreateClassFunctionMap(empty);
     726             :   native_context()->set_class_function_map(*map);
     727             : 
     728             :   // Now that the strict mode function map is available, set up the
     729             :   // restricted "arguments" and "caller" getters.
     730          61 :   AddRestrictedFunctionProperties(empty);
     731          61 : }
     732             : 
     733          61 : void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
     734          61 :   Factory* factory = isolate_->factory();
     735             : 
     736             :   // --- O b j e c t ---
     737             :   int inobject_properties = JSObject::kInitialGlobalObjectUnusedPropertiesCount;
     738             :   int instance_size =
     739             :       JSObject::kHeaderSize + kPointerSize * inobject_properties;
     740             : 
     741             :   Handle<JSFunction> object_fun = CreateFunction(
     742             :       isolate_, factory->Object_string(), JS_OBJECT_TYPE, instance_size,
     743          61 :       inobject_properties, factory->null_value(), Builtins::kObjectConstructor);
     744             :   object_fun->shared()->set_length(1);
     745             :   object_fun->shared()->DontAdaptArguments();
     746             :   object_fun->shared()->SetConstructStub(
     747         122 :       *BUILTIN_CODE(isolate_, ObjectConstructor_ConstructStub));
     748             :   native_context()->set_object_function(*object_fun);
     749             : 
     750             :   {
     751             :     // Finish setting up Object function's initial map.
     752             :     Map* initial_map = object_fun->initial_map();
     753             :     initial_map->set_elements_kind(HOLEY_ELEMENTS);
     754             :   }
     755             : 
     756             :   // Allocate a new prototype for the object function.
     757             :   Handle<JSObject> object_function_prototype =
     758          61 :       factory->NewFunctionPrototype(object_fun);
     759             : 
     760             :   Handle<Map> map = Map::Copy(handle(object_function_prototype->map()),
     761          61 :                               "EmptyObjectPrototype");
     762             :   map->set_is_prototype_map(true);
     763             :   // Ban re-setting Object.prototype.__proto__ to prevent Proxy security bug
     764             :   map->set_immutable_proto(true);
     765          61 :   object_function_prototype->set_map(*map);
     766             : 
     767             :   // Complete setting up empty function.
     768             :   {
     769          61 :     Handle<Map> empty_function_map(empty_function->map(), isolate_);
     770          61 :     Map::SetPrototype(empty_function_map, object_function_prototype);
     771             :   }
     772             : 
     773             :   native_context()->set_initial_object_prototype(*object_function_prototype);
     774          61 :   JSFunction::SetPrototype(object_fun, object_function_prototype);
     775             : 
     776             :   {
     777             :     // Set up slow map for Object.create(null) instances without in-object
     778             :     // properties.
     779          61 :     Handle<Map> map(object_fun->initial_map(), isolate_);
     780          61 :     map = Map::CopyInitialMapNormalized(map);
     781          61 :     Map::SetPrototype(map, factory->null_value());
     782             :     native_context()->set_slow_object_with_null_prototype_map(*map);
     783             : 
     784             :     // Set up slow map for literals with too many properties.
     785          61 :     map = Map::Copy(map, "slow_object_with_object_prototype_map");
     786          61 :     Map::SetPrototype(map, object_function_prototype);
     787             :     native_context()->set_slow_object_with_object_prototype_map(*map);
     788             :   }
     789          61 : }
     790             : 
     791             : namespace {
     792             : 
     793         732 : Handle<Map> CreateNonConstructorMap(Handle<Map> source_map,
     794             :                                     Handle<JSObject> prototype,
     795             :                                     const char* reason) {
     796         732 :   Handle<Map> map = Map::Copy(source_map, reason);
     797             :   // Ensure the resulting map has prototype slot (it is necessary for storing
     798             :   // inital map even when the prototype property is not required).
     799         732 :   if (!map->has_prototype_slot()) {
     800             :     // Re-set the unused property fields after changing the instance size.
     801             :     // TODO(ulan): Do not change instance size after map creation.
     802             :     int unused_property_fields = map->UnusedPropertyFields();
     803         244 :     map->set_instance_size(map->instance_size() + kPointerSize);
     804             :     map->set_has_prototype_slot(true);
     805         244 :     map->SetInObjectUnusedPropertyFields(unused_property_fields);
     806             :   }
     807             :   map->set_is_constructor(false);
     808         732 :   Map::SetPrototype(map, prototype);
     809         732 :   return map;
     810             : }
     811             : 
     812             : }  // namespace
     813             : 
     814        1037 : void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
     815             :   // Create iterator-related meta-objects.
     816             :   Handle<JSObject> iterator_prototype =
     817         122 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     818             : 
     819             :   SimpleInstallFunction(iterator_prototype, factory()->iterator_symbol(),
     820             :                         "[Symbol.iterator]", Builtins::kReturnReceiver, 0,
     821          61 :                         true);
     822             :   native_context()->set_initial_iterator_prototype(*iterator_prototype);
     823             : 
     824             :   Handle<JSObject> generator_object_prototype =
     825         122 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     826             :   native_context()->set_initial_generator_prototype(
     827             :       *generator_object_prototype);
     828          61 :   JSObject::ForceSetPrototype(generator_object_prototype, iterator_prototype);
     829             :   Handle<JSObject> generator_function_prototype =
     830         122 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     831          61 :   JSObject::ForceSetPrototype(generator_function_prototype, empty);
     832             : 
     833             :   JSObject::AddProperty(
     834             :       generator_function_prototype, factory()->to_string_tag_symbol(),
     835             :       factory()->NewStringFromAsciiChecked("GeneratorFunction"),
     836         122 :       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     837             :   JSObject::AddProperty(generator_function_prototype,
     838             :                         factory()->prototype_string(),
     839             :                         generator_object_prototype,
     840          61 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     841             : 
     842             :   JSObject::AddProperty(generator_object_prototype,
     843             :                         factory()->constructor_string(),
     844             :                         generator_function_prototype,
     845          61 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     846             :   JSObject::AddProperty(generator_object_prototype,
     847             :                         factory()->to_string_tag_symbol(),
     848             :                         factory()->NewStringFromAsciiChecked("Generator"),
     849         122 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     850             :   SimpleInstallFunction(generator_object_prototype, "next",
     851          61 :                         Builtins::kGeneratorPrototypeNext, 1, false);
     852             :   SimpleInstallFunction(generator_object_prototype, "return",
     853          61 :                         Builtins::kGeneratorPrototypeReturn, 1, false);
     854             :   SimpleInstallFunction(generator_object_prototype, "throw",
     855          61 :                         Builtins::kGeneratorPrototypeThrow, 1, false);
     856             : 
     857             :   // Internal version of generator_prototype_next, flagged as non-native such
     858             :   // that it doesn't show up in Error traces.
     859             :   Handle<JSFunction> generator_next_internal =
     860             :       SimpleCreateFunction(isolate(), factory()->next_string(),
     861          61 :                            Builtins::kGeneratorPrototypeNext, 1, false);
     862             :   generator_next_internal->shared()->set_native(false);
     863             :   native_context()->set_generator_next_internal(*generator_next_internal);
     864             : 
     865             :   // Create maps for generator functions and their prototypes.  Store those
     866             :   // maps in the native context. The "prototype" property descriptor is
     867             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     868             :   // 04-14-15, section 25.2.4.3).
     869             :   // Generator functions do not have "caller" or "arguments" accessors.
     870             :   Handle<Map> map;
     871             :   map = CreateNonConstructorMap(isolate()->strict_function_map(),
     872             :                                 generator_function_prototype,
     873          61 :                                 "GeneratorFunction");
     874             :   native_context()->set_generator_function_map(*map);
     875             : 
     876             :   map = CreateNonConstructorMap(isolate()->strict_function_with_name_map(),
     877             :                                 generator_function_prototype,
     878          61 :                                 "GeneratorFunction with name");
     879             :   native_context()->set_generator_function_with_name_map(*map);
     880             : 
     881             :   map = CreateNonConstructorMap(strict_function_with_home_object_map_,
     882             :                                 generator_function_prototype,
     883          61 :                                 "GeneratorFunction with home object");
     884             :   native_context()->set_generator_function_with_home_object_map(*map);
     885             : 
     886             :   map = CreateNonConstructorMap(strict_function_with_name_and_home_object_map_,
     887             :                                 generator_function_prototype,
     888          61 :                                 "GeneratorFunction with name and home object");
     889             :   native_context()->set_generator_function_with_name_and_home_object_map(*map);
     890             : 
     891             :   Handle<JSFunction> object_function(native_context()->object_function());
     892          61 :   Handle<Map> generator_object_prototype_map = Map::Create(isolate(), 0);
     893          61 :   Map::SetPrototype(generator_object_prototype_map, generator_object_prototype);
     894             :   native_context()->set_generator_object_prototype_map(
     895             :       *generator_object_prototype_map);
     896          61 : }
     897             : 
     898        1403 : void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
     899             :   // %AsyncIteratorPrototype%
     900             :   // proposal-async-iteration/#sec-asynciteratorprototype
     901             :   Handle<JSObject> async_iterator_prototype =
     902         122 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     903             : 
     904             :   SimpleInstallFunction(
     905             :       async_iterator_prototype, factory()->async_iterator_symbol(),
     906          61 :       "[Symbol.asyncIterator]", Builtins::kReturnReceiver, 0, true);
     907             : 
     908             :   // %AsyncFromSyncIteratorPrototype%
     909             :   // proposal-async-iteration/#sec-%asyncfromsynciteratorprototype%-object
     910             :   Handle<JSObject> async_from_sync_iterator_prototype =
     911         122 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     912             :   SimpleInstallFunction(async_from_sync_iterator_prototype,
     913             :                         factory()->next_string(),
     914          61 :                         Builtins::kAsyncFromSyncIteratorPrototypeNext, 1, true);
     915             :   SimpleInstallFunction(
     916             :       async_from_sync_iterator_prototype, factory()->return_string(),
     917          61 :       Builtins::kAsyncFromSyncIteratorPrototypeReturn, 1, true);
     918             :   SimpleInstallFunction(
     919             :       async_from_sync_iterator_prototype, factory()->throw_string(),
     920          61 :       Builtins::kAsyncFromSyncIteratorPrototypeThrow, 1, true);
     921             : 
     922             :   JSObject::AddProperty(
     923             :       async_from_sync_iterator_prototype, factory()->to_string_tag_symbol(),
     924             :       factory()->NewStringFromAsciiChecked("Async-from-Sync Iterator"),
     925         122 :       static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     926             : 
     927             :   JSObject::ForceSetPrototype(async_from_sync_iterator_prototype,
     928          61 :                               async_iterator_prototype);
     929             : 
     930             :   Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
     931          61 :       JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
     932             :   Map::SetPrototype(async_from_sync_iterator_map,
     933          61 :                     async_from_sync_iterator_prototype);
     934             :   native_context()->set_async_from_sync_iterator_map(
     935             :       *async_from_sync_iterator_map);
     936             : 
     937             :   // Async Generators
     938             :   Handle<String> AsyncGeneratorFunction_string =
     939          61 :       factory()->NewStringFromAsciiChecked("AsyncGeneratorFunction", TENURED);
     940             : 
     941             :   Handle<JSObject> async_generator_object_prototype =
     942         122 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     943             :   Handle<JSObject> async_generator_function_prototype =
     944         122 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     945             : 
     946             :   // %AsyncGenerator% / %AsyncGeneratorFunction%.prototype
     947          61 :   JSObject::ForceSetPrototype(async_generator_function_prototype, empty);
     948             : 
     949             :   // The value of AsyncGeneratorFunction.prototype.prototype is the
     950             :   //     %AsyncGeneratorPrototype% intrinsic object.
     951             :   // This property has the attributes
     952             :   //     { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
     953             :   JSObject::AddProperty(async_generator_function_prototype,
     954             :                         factory()->prototype_string(),
     955             :                         async_generator_object_prototype,
     956          61 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     957             :   JSObject::AddProperty(async_generator_function_prototype,
     958             :                         factory()->to_string_tag_symbol(),
     959             :                         AsyncGeneratorFunction_string,
     960          61 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     961             : 
     962             :   // %AsyncGeneratorPrototype%
     963             :   JSObject::ForceSetPrototype(async_generator_object_prototype,
     964          61 :                               async_iterator_prototype);
     965             :   native_context()->set_initial_async_generator_prototype(
     966             :       *async_generator_object_prototype);
     967             : 
     968             :   JSObject::AddProperty(async_generator_object_prototype,
     969             :                         factory()->to_string_tag_symbol(),
     970             :                         factory()->NewStringFromAsciiChecked("AsyncGenerator"),
     971         122 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     972             :   SimpleInstallFunction(async_generator_object_prototype, "next",
     973          61 :                         Builtins::kAsyncGeneratorPrototypeNext, 1, false);
     974             :   SimpleInstallFunction(async_generator_object_prototype, "return",
     975          61 :                         Builtins::kAsyncGeneratorPrototypeReturn, 1, false);
     976             :   SimpleInstallFunction(async_generator_object_prototype, "throw",
     977          61 :                         Builtins::kAsyncGeneratorPrototypeThrow, 1, false);
     978             : 
     979             :   // Create maps for generator functions and their prototypes.  Store those
     980             :   // maps in the native context. The "prototype" property descriptor is
     981             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     982             :   // 04-14-15, section 25.2.4.3).
     983             :   // Async Generator functions do not have "caller" or "arguments" accessors.
     984             :   Handle<Map> map;
     985             :   map = CreateNonConstructorMap(isolate()->strict_function_map(),
     986             :                                 async_generator_function_prototype,
     987          61 :                                 "AsyncGeneratorFunction");
     988             :   native_context()->set_async_generator_function_map(*map);
     989             : 
     990             :   map = CreateNonConstructorMap(isolate()->strict_function_with_name_map(),
     991             :                                 async_generator_function_prototype,
     992          61 :                                 "AsyncGeneratorFunction with name");
     993             :   native_context()->set_async_generator_function_with_name_map(*map);
     994             : 
     995             :   map = CreateNonConstructorMap(strict_function_with_home_object_map_,
     996             :                                 async_generator_function_prototype,
     997          61 :                                 "AsyncGeneratorFunction with home object");
     998             :   native_context()->set_async_generator_function_with_home_object_map(*map);
     999             : 
    1000             :   map = CreateNonConstructorMap(
    1001             :       strict_function_with_name_and_home_object_map_,
    1002             :       async_generator_function_prototype,
    1003          61 :       "AsyncGeneratorFunction with name and home object");
    1004             :   native_context()->set_async_generator_function_with_name_and_home_object_map(
    1005             :       *map);
    1006             : 
    1007             :   Handle<JSFunction> object_function(native_context()->object_function());
    1008          61 :   Handle<Map> async_generator_object_prototype_map = Map::Create(isolate(), 0);
    1009             :   Map::SetPrototype(async_generator_object_prototype_map,
    1010          61 :                     async_generator_object_prototype);
    1011             :   native_context()->set_async_generator_object_prototype_map(
    1012             :       *async_generator_object_prototype_map);
    1013          61 : }
    1014             : 
    1015         488 : void Genesis::CreateAsyncFunctionMaps(Handle<JSFunction> empty) {
    1016             :   // %AsyncFunctionPrototype% intrinsic
    1017             :   Handle<JSObject> async_function_prototype =
    1018         122 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    1019          61 :   JSObject::ForceSetPrototype(async_function_prototype, empty);
    1020             : 
    1021             :   JSObject::AddProperty(async_function_prototype,
    1022             :                         factory()->to_string_tag_symbol(),
    1023             :                         factory()->NewStringFromAsciiChecked("AsyncFunction"),
    1024         122 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1025             : 
    1026             :   Handle<Map> map;
    1027             :   map = CreateNonConstructorMap(
    1028             :       isolate()->strict_function_without_prototype_map(),
    1029          61 :       async_function_prototype, "AsyncFunction");
    1030             :   native_context()->set_async_function_map(*map);
    1031             : 
    1032             :   map = CreateNonConstructorMap(isolate()->method_with_name_map(),
    1033             :                                 async_function_prototype,
    1034          61 :                                 "AsyncFunction with name");
    1035             :   native_context()->set_async_function_with_name_map(*map);
    1036             : 
    1037             :   map = CreateNonConstructorMap(isolate()->method_with_home_object_map(),
    1038             :                                 async_function_prototype,
    1039          61 :                                 "AsyncFunction with home object");
    1040             :   native_context()->set_async_function_with_home_object_map(*map);
    1041             : 
    1042             :   map = CreateNonConstructorMap(
    1043             :       isolate()->method_with_name_and_home_object_map(),
    1044          61 :       async_function_prototype, "AsyncFunction with name and home object");
    1045             :   native_context()->set_async_function_with_name_and_home_object_map(*map);
    1046          61 : }
    1047             : 
    1048          61 : void Genesis::CreateJSProxyMaps() {
    1049             :   // Allocate maps for all Proxy types.
    1050             :   // Next to the default proxy, we need maps indicating callable and
    1051             :   // constructable proxies.
    1052             :   Handle<Map> proxy_map =
    1053          61 :       factory()->NewMap(JS_PROXY_TYPE, JSProxy::kSize, PACKED_ELEMENTS);
    1054             :   proxy_map->set_dictionary_map(true);
    1055             :   proxy_map->set_may_have_interesting_symbols(true);
    1056             :   native_context()->set_proxy_map(*proxy_map);
    1057             : 
    1058          61 :   Handle<Map> proxy_callable_map = Map::Copy(proxy_map, "callable Proxy");
    1059             :   proxy_callable_map->set_is_callable();
    1060             :   native_context()->set_proxy_callable_map(*proxy_callable_map);
    1061             :   proxy_callable_map->SetConstructor(native_context()->function_function());
    1062             : 
    1063             :   Handle<Map> proxy_constructor_map =
    1064          61 :       Map::Copy(proxy_callable_map, "constructor Proxy");
    1065             :   proxy_constructor_map->set_is_constructor(true);
    1066             :   native_context()->set_proxy_constructor_map(*proxy_constructor_map);
    1067          61 : }
    1068             : 
    1069             : namespace {
    1070         122 : void ReplaceAccessors(Handle<Map> map, Handle<String> name,
    1071             :                       PropertyAttributes attributes,
    1072             :                       Handle<AccessorPair> accessor_pair) {
    1073             :   DescriptorArray* descriptors = map->instance_descriptors();
    1074             :   int idx = descriptors->SearchWithCache(map->GetIsolate(), *name, *map);
    1075             :   Descriptor d = Descriptor::AccessorConstant(name, accessor_pair, attributes);
    1076         122 :   descriptors->Replace(idx, &d);
    1077         122 : }
    1078             : }  // namespace
    1079             : 
    1080         244 : void Genesis::AddRestrictedFunctionProperties(Handle<JSFunction> empty) {
    1081             :   PropertyAttributes rw_attribs = static_cast<PropertyAttributes>(DONT_ENUM);
    1082          61 :   Handle<JSFunction> thrower = GetThrowTypeErrorIntrinsic();
    1083          61 :   Handle<AccessorPair> accessors = factory()->NewAccessorPair();
    1084          61 :   accessors->set_getter(*thrower);
    1085          61 :   accessors->set_setter(*thrower);
    1086             : 
    1087             :   Handle<Map> map(empty->map());
    1088          61 :   ReplaceAccessors(map, factory()->arguments_string(), rw_attribs, accessors);
    1089          61 :   ReplaceAccessors(map, factory()->caller_string(), rw_attribs, accessors);
    1090          61 : }
    1091             : 
    1092             : 
    1093       83597 : static void AddToWeakNativeContextList(Context* context) {
    1094             :   DCHECK(context->IsNativeContext());
    1095             :   Isolate* isolate = context->GetIsolate();
    1096       83597 :   Heap* heap = isolate->heap();
    1097             : #ifdef DEBUG
    1098             :   { // NOLINT
    1099             :     DCHECK(context->next_context_link()->IsUndefined(isolate));
    1100             :     // Check that context is not in the list yet.
    1101             :     for (Object* current = heap->native_contexts_list();
    1102             :          !current->IsUndefined(isolate);
    1103             :          current = Context::cast(current)->next_context_link()) {
    1104             :       DCHECK(current != context);
    1105             :     }
    1106             :   }
    1107             : #endif
    1108             :   context->set(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list(),
    1109       83597 :                UPDATE_WEAK_WRITE_BARRIER);
    1110             :   heap->set_native_contexts_list(context);
    1111       83597 : }
    1112             : 
    1113             : 
    1114         183 : void Genesis::CreateRoots() {
    1115             :   // Allocate the native context FixedArray first and then patch the
    1116             :   // closure and extension object later (we need the empty function
    1117             :   // and the global object, but in order to create those, we need the
    1118             :   // native context).
    1119          61 :   native_context_ = factory()->NewNativeContext();
    1120          61 :   AddToWeakNativeContextList(*native_context());
    1121             :   isolate()->set_context(*native_context());
    1122             : 
    1123             :   // Allocate the message listeners object.
    1124             :   {
    1125          61 :     Handle<TemplateList> list = TemplateList::New(isolate(), 1);
    1126             :     native_context()->set_message_listeners(*list);
    1127             :   }
    1128          61 : }
    1129             : 
    1130             : 
    1131         183 : void Genesis::InstallGlobalThisBinding() {
    1132             :   Handle<ScriptContextTable> script_contexts(
    1133             :       native_context()->script_context_table());
    1134          61 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateGlobalThisBinding(isolate());
    1135             :   Handle<JSFunction> closure(native_context()->closure());
    1136          61 :   Handle<Context> context = factory()->NewScriptContext(closure, scope_info);
    1137             : 
    1138             :   // Go ahead and hook it up while we're at it.
    1139          61 :   int slot = scope_info->ReceiverContextSlotIndex();
    1140             :   DCHECK_EQ(slot, Context::MIN_CONTEXT_SLOTS);
    1141         122 :   context->set(slot, native_context()->global_proxy());
    1142             : 
    1143             :   Handle<ScriptContextTable> new_script_contexts =
    1144          61 :       ScriptContextTable::Extend(script_contexts, context);
    1145             :   native_context()->set_script_context_table(*new_script_contexts);
    1146          61 : }
    1147             : 
    1148             : 
    1149       83572 : Handle<JSGlobalObject> Genesis::CreateNewGlobals(
    1150             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    1151      656320 :     Handle<JSGlobalProxy> global_proxy) {
    1152             :   // The argument global_proxy_template aka data is an ObjectTemplateInfo.
    1153             :   // It has a constructor pointer that points at global_constructor which is a
    1154             :   // FunctionTemplateInfo.
    1155             :   // The global_proxy_constructor is used to (re)initialize the
    1156             :   // global_proxy. The global_proxy_constructor also has a prototype_template
    1157             :   // pointer that points at js_global_object_template which is an
    1158             :   // ObjectTemplateInfo.
    1159             :   // That in turn has a constructor pointer that points at
    1160             :   // js_global_object_constructor which is a FunctionTemplateInfo.
    1161             :   // js_global_object_constructor is used to make js_global_object_function
    1162             :   // js_global_object_function is used to make the new global_object.
    1163             :   //
    1164             :   // --- G l o b a l ---
    1165             :   // Step 1: Create a fresh JSGlobalObject.
    1166             :   Handle<JSFunction> js_global_object_function;
    1167             :   Handle<ObjectTemplateInfo> js_global_object_template;
    1168       83572 :   if (!global_proxy_template.IsEmpty()) {
    1169             :     // Get prototype template of the global_proxy_template.
    1170             :     Handle<ObjectTemplateInfo> data =
    1171             :         v8::Utils::OpenHandle(*global_proxy_template);
    1172             :     Handle<FunctionTemplateInfo> global_constructor =
    1173             :         Handle<FunctionTemplateInfo>(
    1174             :             FunctionTemplateInfo::cast(data->constructor()));
    1175             :     Handle<Object> proto_template(global_constructor->prototype_template(),
    1176             :                                   isolate());
    1177       47914 :     if (!proto_template->IsUndefined(isolate())) {
    1178             :       js_global_object_template =
    1179             :           Handle<ObjectTemplateInfo>::cast(proto_template);
    1180             :     }
    1181             :   }
    1182             : 
    1183       83572 :   if (js_global_object_template.is_null()) {
    1184       35658 :     Handle<String> name(factory()->empty_string());
    1185       35658 :     Handle<Code> code = BUILTIN_CODE(isolate(), Illegal);
    1186             :     Handle<JSObject> prototype =
    1187       71316 :         factory()->NewFunctionPrototype(isolate()->object_function());
    1188             :     js_global_object_function =
    1189             :         factory()->NewFunction(name, code, prototype, JS_GLOBAL_OBJECT_TYPE,
    1190       35658 :                                JSGlobalObject::kSize, 0, LanguageMode::kStrict);
    1191             : #ifdef DEBUG
    1192             :     LookupIterator it(prototype, factory()->constructor_string(),
    1193             :                       LookupIterator::OWN_SKIP_INTERCEPTOR);
    1194             :     Handle<Object> value = Object::GetProperty(&it).ToHandleChecked();
    1195             :     DCHECK(it.IsFound());
    1196             :     DCHECK_EQ(*isolate()->object_function(), *value);
    1197             : #endif
    1198             :   } else {
    1199             :     Handle<FunctionTemplateInfo> js_global_object_constructor(
    1200             :         FunctionTemplateInfo::cast(js_global_object_template->constructor()));
    1201             :     js_global_object_function = ApiNatives::CreateApiFunction(
    1202             :         isolate(), js_global_object_constructor, factory()->the_hole_value(),
    1203       47914 :         ApiNatives::GlobalObjectType);
    1204             :   }
    1205             : 
    1206             :   js_global_object_function->initial_map()->set_is_prototype_map(true);
    1207             :   js_global_object_function->initial_map()->set_dictionary_map(true);
    1208             :   js_global_object_function->initial_map()->set_may_have_interesting_symbols(
    1209             :       true);
    1210             :   Handle<JSGlobalObject> global_object =
    1211       83572 :       factory()->NewJSGlobalObject(js_global_object_function);
    1212             : 
    1213             :   // Step 2: (re)initialize the global proxy object.
    1214             :   Handle<JSFunction> global_proxy_function;
    1215       83572 :   if (global_proxy_template.IsEmpty()) {
    1216       35658 :     Handle<String> name(factory()->empty_string());
    1217       35658 :     Handle<Code> code = BUILTIN_CODE(isolate(), Illegal);
    1218             :     global_proxy_function =
    1219             :         factory()->NewFunction(name, code, JS_GLOBAL_PROXY_TYPE,
    1220       35658 :                                JSGlobalProxy::SizeWithEmbedderFields(0), 0);
    1221             :   } else {
    1222             :     Handle<ObjectTemplateInfo> data =
    1223             :         v8::Utils::OpenHandle(*global_proxy_template);
    1224             :     Handle<FunctionTemplateInfo> global_constructor(
    1225             :             FunctionTemplateInfo::cast(data->constructor()));
    1226             :     global_proxy_function = ApiNatives::CreateApiFunction(
    1227             :         isolate(), global_constructor, factory()->the_hole_value(),
    1228       47914 :         ApiNatives::GlobalProxyType);
    1229             :   }
    1230             :   Handle<String> global_name = factory()->global_string();
    1231       83572 :   global_proxy_function->shared()->set_instance_class_name(*global_name);
    1232             :   global_proxy_function->initial_map()->set_is_access_check_needed(true);
    1233             :   global_proxy_function->initial_map()->set_has_hidden_prototype(true);
    1234             :   global_proxy_function->initial_map()->set_may_have_interesting_symbols(true);
    1235             :   native_context()->set_global_proxy_function(*global_proxy_function);
    1236             : 
    1237             :   // Set global_proxy.__proto__ to js_global after ConfigureGlobalObjects
    1238             :   // Return the global proxy.
    1239             : 
    1240       83572 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1241             : 
    1242             :   // Set the native context for the global object.
    1243       83572 :   global_object->set_native_context(*native_context());
    1244       83572 :   global_object->set_global_proxy(*global_proxy);
    1245             :   // Set the native context of the global proxy.
    1246       83572 :   global_proxy->set_native_context(*native_context());
    1247             :   // Set the global proxy of the native context. If the native context has been
    1248             :   // deserialized, the global proxy is already correctly set up by the
    1249             :   // deserializer. Otherwise it's undefined.
    1250             :   DCHECK(native_context()
    1251             :              ->get(Context::GLOBAL_PROXY_INDEX)
    1252             :              ->IsUndefined(isolate()) ||
    1253             :          native_context()->global_proxy() == *global_proxy);
    1254       83572 :   native_context()->set_global_proxy(*global_proxy);
    1255             : 
    1256       83572 :   return global_object;
    1257             : }
    1258             : 
    1259          50 : void Genesis::HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy) {
    1260             :   // Re-initialize the global proxy with the global proxy function from the
    1261             :   // snapshot, and then set up the link to the native context.
    1262             :   Handle<JSFunction> global_proxy_function(
    1263             :       native_context()->global_proxy_function());
    1264          25 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1265             :   Handle<JSObject> global_object(
    1266          25 :       JSObject::cast(native_context()->global_object()));
    1267          25 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    1268          25 :   global_proxy->set_native_context(*native_context());
    1269             :   DCHECK(native_context()->global_proxy() == *global_proxy);
    1270          25 : }
    1271             : 
    1272       83511 : void Genesis::HookUpGlobalObject(Handle<JSGlobalObject> global_object) {
    1273             :   Handle<JSGlobalObject> global_object_from_snapshot(
    1274             :       JSGlobalObject::cast(native_context()->extension()));
    1275             :   native_context()->set_extension(*global_object);
    1276             :   native_context()->set_security_token(*global_object);
    1277             : 
    1278       83511 :   TransferNamedProperties(global_object_from_snapshot, global_object);
    1279       83511 :   TransferIndexedProperties(global_object_from_snapshot, global_object);
    1280       83511 : }
    1281             : 
    1282        2214 : static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
    1283             :                                              Handle<JSFunction> function,
    1284             :                                              int context_index) {
    1285             :   Handle<Smi> index(Smi::FromInt(context_index), isolate);
    1286             :   JSObject::AddProperty(
    1287        2214 :       function, isolate->factory()->native_context_index_symbol(), index, NONE);
    1288        4428 :   isolate->native_context()->set(context_index, *function);
    1289        2214 : }
    1290             : 
    1291         610 : static void InstallError(Isolate* isolate, Handle<JSObject> global,
    1292             :                          Handle<String> name, int context_index) {
    1293             :   Factory* factory = isolate->factory();
    1294             : 
    1295             :   Handle<JSFunction> error_fun = InstallFunction(
    1296             :       global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
    1297         610 :       factory->the_hole_value(), Builtins::kErrorConstructor, DONT_ENUM);
    1298         610 :   error_fun->shared()->set_instance_class_name(*factory->Error_string());
    1299             :   error_fun->shared()->DontAdaptArguments();
    1300             :   error_fun->shared()->SetConstructStub(
    1301        1220 :       *BUILTIN_CODE(isolate, ErrorConstructor));
    1302             :   error_fun->shared()->set_length(1);
    1303             : 
    1304         610 :   if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1305             :     SimpleInstallFunction(error_fun, "captureStackTrace",
    1306          61 :                           Builtins::kErrorCaptureStackTrace, 2, false);
    1307             :   }
    1308             : 
    1309         610 :   InstallWithIntrinsicDefaultProto(isolate, error_fun, context_index);
    1310             : 
    1311             :   {
    1312             :     // Setup %XXXErrorPrototype%.
    1313             :     Handle<JSObject> prototype(JSObject::cast(error_fun->instance_prototype()));
    1314             : 
    1315         610 :     JSObject::AddProperty(prototype, factory->name_string(), name, DONT_ENUM);
    1316             :     JSObject::AddProperty(prototype, factory->message_string(),
    1317         610 :                           factory->empty_string(), DONT_ENUM);
    1318             : 
    1319         610 :     if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1320             :       Handle<JSFunction> to_string_fun =
    1321             :           SimpleInstallFunction(prototype, factory->toString_string(),
    1322          61 :                                 Builtins::kErrorPrototypeToString, 0, true);
    1323         122 :       isolate->native_context()->set_error_to_string(*to_string_fun);
    1324         122 :       isolate->native_context()->set_initial_error_prototype(*prototype);
    1325             :     } else {
    1326             :       DCHECK(isolate->native_context()->error_to_string()->IsJSFunction());
    1327             : 
    1328             :       InstallFunction(prototype, isolate->error_to_string(),
    1329         549 :                       factory->toString_string(), DONT_ENUM);
    1330             : 
    1331         549 :       Handle<JSFunction> global_error = isolate->error_function();
    1332        1098 :       CHECK(JSReceiver::SetPrototype(error_fun, global_error, false,
    1333             :                                      Object::THROW_ON_ERROR)
    1334             :                 .FromMaybe(false));
    1335        1647 :       CHECK(JSReceiver::SetPrototype(prototype,
    1336             :                                      handle(global_error->prototype(), isolate),
    1337             :                                      false, Object::THROW_ON_ERROR)
    1338             :                 .FromMaybe(false));
    1339             :     }
    1340             :   }
    1341             : 
    1342             :   Handle<Map> initial_map(error_fun->initial_map());
    1343         610 :   Map::EnsureDescriptorSlack(initial_map, 1);
    1344             : 
    1345             :   PropertyAttributes attribs = DONT_ENUM;
    1346             :   Handle<AccessorInfo> error_stack =
    1347         610 :       Accessors::ErrorStackInfo(isolate, attribs);
    1348             :   {
    1349             :     Descriptor d = Descriptor::AccessorConstant(
    1350             :         Handle<Name>(Name::cast(error_stack->name())), error_stack, attribs);
    1351         610 :     initial_map->AppendDescriptor(&d);
    1352             :   }
    1353         610 : }
    1354             : 
    1355             : namespace {
    1356             : 
    1357         305 : void InstallMakeError(Isolate* isolate, Handle<Code> code, int context_index) {
    1358             :   Handle<JSFunction> function =
    1359             :       isolate->factory()->NewFunction(isolate->factory()->empty_string(), code,
    1360         305 :                                       JS_OBJECT_TYPE, JSObject::kHeaderSize, 0);
    1361             :   function->shared()->DontAdaptArguments();
    1362         610 :   isolate->native_context()->set(context_index, *function);
    1363         305 : }
    1364             : 
    1365             : }  // namespace
    1366             : 
    1367             : // This is only called if we are not using snapshots.  The equivalent
    1368             : // work in the snapshot case is done in HookUpGlobalObject.
    1369          61 : void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
    1370             :                                Handle<JSFunction> empty_function,
    1371             :                                GlobalContextType context_type) {
    1372             :   // --- N a t i v e   C o n t e x t ---
    1373             :   // Use the empty function as closure (no scope info).
    1374             :   native_context()->set_closure(*empty_function);
    1375             :   native_context()->set_previous(nullptr);
    1376             :   // Set extension and global object.
    1377             :   native_context()->set_extension(*global_object);
    1378             :   // Security setup: Set the security token of the native context to the global
    1379             :   // object. This makes the security check between two different contexts fail
    1380             :   // by default even in case of global object reinitialization.
    1381             :   native_context()->set_security_token(*global_object);
    1382             : 
    1383             :   Isolate* isolate = global_object->GetIsolate();
    1384             :   Factory* factory = isolate->factory();
    1385             : 
    1386             :   Handle<ScriptContextTable> script_context_table =
    1387          61 :       factory->NewScriptContextTable();
    1388             :   native_context()->set_script_context_table(*script_context_table);
    1389          61 :   InstallGlobalThisBinding();
    1390             : 
    1391             :   {  // --- O b j e c t ---
    1392             :     Handle<String> object_name = factory->Object_string();
    1393          61 :     Handle<JSFunction> object_function = isolate->object_function();
    1394             :     JSObject::AddProperty(global_object, object_name, object_function,
    1395          61 :                           DONT_ENUM);
    1396             : 
    1397             :     SimpleInstallFunction(object_function, factory->assign_string(),
    1398          61 :                           Builtins::kObjectAssign, 2, false);
    1399             :     SimpleInstallFunction(object_function, "getOwnPropertyDescriptor",
    1400          61 :                           Builtins::kObjectGetOwnPropertyDescriptor, 2, false);
    1401             :     SimpleInstallFunction(object_function,
    1402             :                           factory->getOwnPropertyDescriptors_string(),
    1403          61 :                           Builtins::kObjectGetOwnPropertyDescriptors, 1, false);
    1404             :     SimpleInstallFunction(object_function, "getOwnPropertyNames",
    1405          61 :                           Builtins::kObjectGetOwnPropertyNames, 1, false);
    1406             :     SimpleInstallFunction(object_function, "getOwnPropertySymbols",
    1407          61 :                           Builtins::kObjectGetOwnPropertySymbols, 1, false);
    1408             :     SimpleInstallFunction(object_function, "is",
    1409          61 :                           Builtins::kObjectIs, 2, true);
    1410             :     SimpleInstallFunction(object_function, "preventExtensions",
    1411          61 :                           Builtins::kObjectPreventExtensions, 1, false);
    1412             :     SimpleInstallFunction(object_function, "seal",
    1413          61 :                           Builtins::kObjectSeal, 1, false);
    1414             : 
    1415             :     Handle<JSFunction> object_create =
    1416             :         SimpleInstallFunction(object_function, factory->create_string(),
    1417          61 :                               Builtins::kObjectCreate, 2, false);
    1418             :     native_context()->set_object_create(*object_create);
    1419             : 
    1420             :     Handle<JSFunction> object_define_properties = SimpleInstallFunction(
    1421             :         object_function, "defineProperties",
    1422          61 :         Builtins::kObjectDefineProperties, 2, true);
    1423             :     native_context()->set_object_define_properties(*object_define_properties);
    1424             : 
    1425             :     Handle<JSFunction> object_define_property = SimpleInstallFunction(
    1426             :         object_function, factory->defineProperty_string(),
    1427          61 :         Builtins::kObjectDefineProperty, 3, true);
    1428             :     native_context()->set_object_define_property(*object_define_property);
    1429             : 
    1430             :     SimpleInstallFunction(object_function, "freeze", Builtins::kObjectFreeze, 1,
    1431          61 :                           false);
    1432             : 
    1433             :     Handle<JSFunction> object_get_prototype_of = SimpleInstallFunction(
    1434             :         object_function, "getPrototypeOf", Builtins::kObjectGetPrototypeOf,
    1435          61 :         1, false);
    1436             :     native_context()->set_object_get_prototype_of(*object_get_prototype_of);
    1437             :     SimpleInstallFunction(object_function, "setPrototypeOf",
    1438          61 :                           Builtins::kObjectSetPrototypeOf, 2, false);
    1439             : 
    1440             :     Handle<JSFunction> object_is_extensible = SimpleInstallFunction(
    1441             :         object_function, "isExtensible", Builtins::kObjectIsExtensible,
    1442          61 :         1, false);
    1443             :     native_context()->set_object_is_extensible(*object_is_extensible);
    1444             : 
    1445             :     Handle<JSFunction> object_is_frozen = SimpleInstallFunction(
    1446          61 :         object_function, "isFrozen", Builtins::kObjectIsFrozen, 1, false);
    1447             :     native_context()->set_object_is_frozen(*object_is_frozen);
    1448             : 
    1449             :     Handle<JSFunction> object_is_sealed = SimpleInstallFunction(
    1450          61 :         object_function, "isSealed", Builtins::kObjectIsSealed, 1, false);
    1451             :     native_context()->set_object_is_sealed(*object_is_sealed);
    1452             : 
    1453             :     Handle<JSFunction> object_keys = SimpleInstallFunction(
    1454          61 :         object_function, "keys", Builtins::kObjectKeys, 1, true);
    1455             :     native_context()->set_object_keys(*object_keys);
    1456             :     SimpleInstallFunction(object_function, factory->entries_string(),
    1457          61 :                           Builtins::kObjectEntries, 1, false);
    1458             :     SimpleInstallFunction(object_function, factory->values_string(),
    1459          61 :                           Builtins::kObjectValues, 1, false);
    1460             : 
    1461             :     SimpleInstallFunction(isolate->initial_object_prototype(),
    1462             :                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
    1463          61 :                           true);
    1464             :     SimpleInstallFunction(isolate->initial_object_prototype(),
    1465             :                           "__defineSetter__", Builtins::kObjectDefineSetter, 2,
    1466          61 :                           true);
    1467             :     SimpleInstallFunction(isolate->initial_object_prototype(), "hasOwnProperty",
    1468          61 :                           Builtins::kObjectPrototypeHasOwnProperty, 1, true);
    1469             :     SimpleInstallFunction(isolate->initial_object_prototype(),
    1470             :                           "__lookupGetter__", Builtins::kObjectLookupGetter, 1,
    1471          61 :                           true);
    1472             :     SimpleInstallFunction(isolate->initial_object_prototype(),
    1473             :                           "__lookupSetter__", Builtins::kObjectLookupSetter, 1,
    1474          61 :                           true);
    1475             :     SimpleInstallFunction(isolate->initial_object_prototype(), "isPrototypeOf",
    1476          61 :                           Builtins::kObjectPrototypeIsPrototypeOf, 1, true);
    1477             :     SimpleInstallFunction(
    1478             :         isolate->initial_object_prototype(), "propertyIsEnumerable",
    1479          61 :         Builtins::kObjectPrototypePropertyIsEnumerable, 1, false);
    1480             :     Handle<JSFunction> object_to_string = SimpleInstallFunction(
    1481             :         isolate->initial_object_prototype(), factory->toString_string(),
    1482          61 :         Builtins::kObjectPrototypeToString, 0, true);
    1483             :     native_context()->set_object_to_string(*object_to_string);
    1484             :     Handle<JSFunction> object_value_of = SimpleInstallFunction(
    1485             :         isolate->initial_object_prototype(), "valueOf",
    1486          61 :         Builtins::kObjectPrototypeValueOf, 0, true);
    1487             :     native_context()->set_object_value_of(*object_value_of);
    1488             : 
    1489             :     SimpleInstallGetterSetter(isolate->initial_object_prototype(),
    1490             :                               factory->proto_string(),
    1491             :                               Builtins::kObjectPrototypeGetProto,
    1492          61 :                               Builtins::kObjectPrototypeSetProto, DONT_ENUM);
    1493             :   }
    1494             : 
    1495          61 :   Handle<JSObject> global(native_context()->global_object());
    1496             : 
    1497             :   {  // --- F u n c t i o n ---
    1498          61 :     Handle<JSFunction> prototype = empty_function;
    1499             :     Handle<JSFunction> function_fun = InstallFunction(
    1500             :         global, "Function", JS_FUNCTION_TYPE, JSFunction::kSizeWithPrototype, 0,
    1501          61 :         prototype, Builtins::kFunctionConstructor);
    1502             :     // Function instances are sloppy by default.
    1503         122 :     function_fun->set_prototype_or_initial_map(*isolate->sloppy_function_map());
    1504             :     function_fun->shared()->DontAdaptArguments();
    1505             :     function_fun->shared()->SetConstructStub(
    1506         122 :         *BUILTIN_CODE(isolate, FunctionConstructor));
    1507             :     function_fun->shared()->set_length(1);
    1508             :     InstallWithIntrinsicDefaultProto(isolate, function_fun,
    1509          61 :                                      Context::FUNCTION_FUNCTION_INDEX);
    1510             : 
    1511             :     // Setup the methods on the %FunctionPrototype%.
    1512             :     JSObject::AddProperty(prototype, factory->constructor_string(),
    1513          61 :                           function_fun, DONT_ENUM);
    1514             :     SimpleInstallFunction(prototype, factory->apply_string(),
    1515          61 :                           Builtins::kFunctionPrototypeApply, 2, false);
    1516             :     SimpleInstallFunction(prototype, factory->bind_string(),
    1517          61 :                           Builtins::kFastFunctionPrototypeBind, 1, false);
    1518             :     SimpleInstallFunction(prototype, factory->call_string(),
    1519          61 :                           Builtins::kFunctionPrototypeCall, 1, false);
    1520             :     SimpleInstallFunction(prototype, factory->toString_string(),
    1521          61 :                           Builtins::kFunctionPrototypeToString, 0, false);
    1522             : 
    1523             :     // Install the @@hasInstance function.
    1524             :     Handle<JSFunction> has_instance = SimpleInstallFunction(
    1525             :         prototype, factory->has_instance_symbol(), "[Symbol.hasInstance]",
    1526             :         Builtins::kFunctionPrototypeHasInstance, 1, true,
    1527             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY),
    1528          61 :         kFunctionHasInstance);
    1529             :     native_context()->set_function_has_instance(*has_instance);
    1530             : 
    1531             :     // Complete setting up function maps.
    1532             :     {
    1533         122 :       isolate->sloppy_function_map()->SetConstructor(*function_fun);
    1534         122 :       isolate->sloppy_function_with_name_map()->SetConstructor(*function_fun);
    1535             :       isolate->sloppy_function_with_readonly_prototype_map()->SetConstructor(
    1536         122 :           *function_fun);
    1537             : 
    1538         122 :       isolate->strict_function_map()->SetConstructor(*function_fun);
    1539         122 :       isolate->strict_function_with_name_map()->SetConstructor(*function_fun);
    1540             :       strict_function_with_home_object_map_->SetConstructor(*function_fun);
    1541             :       strict_function_with_name_and_home_object_map_->SetConstructor(
    1542             :           *function_fun);
    1543             :       isolate->strict_function_with_readonly_prototype_map()->SetConstructor(
    1544         122 :           *function_fun);
    1545             : 
    1546         122 :       isolate->class_function_map()->SetConstructor(*function_fun);
    1547             :     }
    1548             :   }
    1549             : 
    1550             :   {  // --- A s y n c F r o m S y n c I t e r a t o r
    1551             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1552             :         isolate, Builtins::kAsyncIteratorValueUnwrap, factory->empty_string(),
    1553          61 :         1);
    1554             :     native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
    1555             :   }
    1556             : 
    1557             :   {  // --- A s y n c G e n e r a t o r ---
    1558             :     Handle<JSFunction> await_caught =
    1559             :         SimpleCreateFunction(isolate, factory->empty_string(),
    1560          61 :                              Builtins::kAsyncGeneratorAwaitCaught, 1, false);
    1561             :     native_context()->set_async_generator_await_caught(*await_caught);
    1562             : 
    1563             :     Handle<JSFunction> await_uncaught =
    1564             :         SimpleCreateFunction(isolate, factory->empty_string(),
    1565          61 :                              Builtins::kAsyncGeneratorAwaitUncaught, 1, false);
    1566             :     native_context()->set_async_generator_await_uncaught(*await_uncaught);
    1567             : 
    1568             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1569             :         isolate, Builtins::kAsyncGeneratorAwaitResolveClosure,
    1570          61 :         factory->empty_string(), 1);
    1571             :     native_context()->set_async_generator_await_resolve_shared_fun(*info);
    1572             : 
    1573             :     info = SimpleCreateSharedFunctionInfo(
    1574             :         isolate, Builtins::kAsyncGeneratorAwaitRejectClosure,
    1575          61 :         factory->empty_string(), 1);
    1576             :     native_context()->set_async_generator_await_reject_shared_fun(*info);
    1577             : 
    1578             :     info = SimpleCreateSharedFunctionInfo(
    1579             :         isolate, Builtins::kAsyncGeneratorYieldResolveClosure,
    1580          61 :         factory->empty_string(), 1);
    1581             :     native_context()->set_async_generator_yield_resolve_shared_fun(*info);
    1582             : 
    1583             :     info = SimpleCreateSharedFunctionInfo(
    1584             :         isolate, Builtins::kAsyncGeneratorReturnResolveClosure,
    1585          61 :         factory->empty_string(), 1);
    1586             :     native_context()->set_async_generator_return_resolve_shared_fun(*info);
    1587             : 
    1588             :     info = SimpleCreateSharedFunctionInfo(
    1589             :         isolate, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
    1590          61 :         factory->empty_string(), 1);
    1591             :     native_context()->set_async_generator_return_closed_resolve_shared_fun(
    1592             :         *info);
    1593             : 
    1594             :     info = SimpleCreateSharedFunctionInfo(
    1595             :         isolate, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
    1596          61 :         factory->empty_string(), 1);
    1597             :     native_context()->set_async_generator_return_closed_reject_shared_fun(
    1598             :         *info);
    1599             :   }
    1600             : 
    1601             :   {  // --- A r r a y ---
    1602             :     Handle<JSFunction> array_function = InstallFunction(
    1603             :         global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
    1604         122 :         isolate->initial_object_prototype(), Builtins::kArrayConstructor);
    1605             :     array_function->shared()->DontAdaptArguments();
    1606             :     array_function->shared()->set_builtin_function_id(kArrayConstructor);
    1607             : 
    1608             :     // This seems a bit hackish, but we need to make sure Array.length
    1609             :     // is 1.
    1610             :     array_function->shared()->set_length(1);
    1611             : 
    1612             :     Handle<Map> initial_map(array_function->initial_map());
    1613             : 
    1614             :     // This assert protects an optimization in
    1615             :     // HGraphBuilder::JSArrayBuilder::EmitMapCode()
    1616             :     DCHECK(initial_map->elements_kind() == GetInitialFastElementsKind());
    1617          61 :     Map::EnsureDescriptorSlack(initial_map, 1);
    1618             : 
    1619             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1620             :         DONT_ENUM | DONT_DELETE);
    1621             : 
    1622             :     Handle<AccessorInfo> array_length =
    1623          61 :         Accessors::ArrayLengthInfo(isolate, attribs);
    1624             :     {  // Add length.
    1625             :       Descriptor d = Descriptor::AccessorConstant(
    1626             :           Handle<Name>(Name::cast(array_length->name())), array_length,
    1627             :           attribs);
    1628          61 :       initial_map->AppendDescriptor(&d);
    1629             :     }
    1630             : 
    1631             :     InstallWithIntrinsicDefaultProto(isolate, array_function,
    1632          61 :                                      Context::ARRAY_FUNCTION_INDEX);
    1633          61 :     InstallSpeciesGetter(array_function);
    1634             : 
    1635             :     // Cache the array maps, needed by ArrayConstructorStub
    1636          61 :     CacheInitialJSArrayMaps(native_context(), initial_map);
    1637          61 :     ArrayConstructorStub array_constructor_stub(isolate);
    1638          61 :     Handle<Code> code = array_constructor_stub.GetCode();
    1639          61 :     array_function->shared()->SetConstructStub(*code);
    1640             : 
    1641             :     // Set up %ArrayPrototype%.
    1642             :     Handle<JSArray> proto =
    1643          61 :         Handle<JSArray>::cast(factory->NewJSObject(array_function, TENURED));
    1644          61 :     JSArray::Initialize(proto, 0);
    1645          61 :     JSFunction::SetPrototype(array_function, proto);
    1646             :     native_context()->set_initial_array_prototype(*proto);
    1647             : 
    1648             :     Handle<JSFunction> is_arraylike = SimpleInstallFunction(
    1649          61 :         array_function, "isArray", Builtins::kArrayIsArray, 1, true);
    1650             :     native_context()->set_is_arraylike(*is_arraylike);
    1651             : 
    1652             :     JSObject::AddProperty(proto, factory->constructor_string(), array_function,
    1653          61 :                           DONT_ENUM);
    1654             : 
    1655          61 :     SimpleInstallFunction(proto, "concat", Builtins::kArrayConcat, 1, false);
    1656          61 :     SimpleInstallFunction(proto, "pop", Builtins::kFastArrayPop, 0, false);
    1657          61 :     SimpleInstallFunction(proto, "push", Builtins::kFastArrayPush, 1, false);
    1658          61 :     SimpleInstallFunction(proto, "shift", Builtins::kFastArrayShift, 0, false);
    1659          61 :     SimpleInstallFunction(proto, "unshift", Builtins::kArrayUnshift, 1, false);
    1660          61 :     SimpleInstallFunction(proto, "slice", Builtins::kArraySlice, 2, false);
    1661          61 :     SimpleInstallFunction(proto, "splice", Builtins::kArraySplice, 2, false);
    1662             :     SimpleInstallFunction(proto, "includes", Builtins::kArrayIncludes, 1,
    1663          61 :                           false);
    1664          61 :     SimpleInstallFunction(proto, "indexOf", Builtins::kArrayIndexOf, 1, false);
    1665             :     SimpleInstallFunction(proto, "keys", Builtins::kArrayPrototypeKeys, 0, true,
    1666          61 :                           kArrayKeys);
    1667             :     SimpleInstallFunction(proto, "entries", Builtins::kArrayPrototypeEntries, 0,
    1668          61 :                           true, kArrayEntries);
    1669             :     SimpleInstallFunction(proto, factory->iterator_symbol(), "values",
    1670             :                           Builtins::kArrayPrototypeValues, 0, true, DONT_ENUM,
    1671          61 :                           kArrayValues);
    1672          61 :     SimpleInstallFunction(proto, "forEach", Builtins::kArrayForEach, 1, false);
    1673          61 :     SimpleInstallFunction(proto, "filter", Builtins::kArrayFilter, 1, false);
    1674          61 :     SimpleInstallFunction(proto, "map", Builtins::kArrayMap, 1, false);
    1675          61 :     SimpleInstallFunction(proto, "every", Builtins::kArrayEvery, 1, false);
    1676          61 :     SimpleInstallFunction(proto, "some", Builtins::kArraySome, 1, false);
    1677          61 :     SimpleInstallFunction(proto, "reduce", Builtins::kArrayReduce, 1, false);
    1678             :     SimpleInstallFunction(proto, "reduceRight", Builtins::kArrayReduceRight, 1,
    1679          61 :                           false);
    1680             :   }
    1681             : 
    1682             :   {  // --- A r r a y I t e r a t o r ---
    1683             :     Handle<JSObject> iterator_prototype(
    1684             :         native_context()->initial_iterator_prototype());
    1685             : 
    1686             :     Handle<JSObject> array_iterator_prototype =
    1687          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    1688          61 :     JSObject::ForceSetPrototype(array_iterator_prototype, iterator_prototype);
    1689             : 
    1690             :     JSObject::AddProperty(
    1691             :         array_iterator_prototype, factory->to_string_tag_symbol(),
    1692             :         factory->ArrayIterator_string(),
    1693          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1694             : 
    1695             :     SimpleInstallFunction(array_iterator_prototype, "next",
    1696             :                           Builtins::kArrayIteratorPrototypeNext, 0, true,
    1697          61 :                           kArrayIteratorNext);
    1698             : 
    1699             :     Handle<JSFunction> array_iterator_function = CreateFunction(
    1700             :         isolate, factory->ArrayIterator_string(),
    1701             :         JS_FAST_ARRAY_VALUE_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
    1702          61 :         array_iterator_prototype, Builtins::kIllegal);
    1703             :     array_iterator_function->shared()->set_native(false);
    1704             :     array_iterator_function->shared()->set_instance_class_name(
    1705         122 :         isolate->heap()->ArrayIterator_string());
    1706             : 
    1707             :     native_context()->set_initial_array_iterator_prototype(
    1708             :         *array_iterator_prototype);
    1709             :     native_context()->set_initial_array_iterator_prototype_map(
    1710             :         array_iterator_prototype->map());
    1711             : 
    1712             :     Handle<Map> initial_map(array_iterator_function->initial_map(), isolate);
    1713             : 
    1714             : #define ARRAY_ITERATOR_LIST(V)                                              \
    1715             :   V(TYPED_ARRAY, KEY, typed_array, key)                                     \
    1716             :   V(FAST_ARRAY, KEY, fast_array, key)                                       \
    1717             :   V(GENERIC_ARRAY, KEY, array, key)                                         \
    1718             :   V(UINT8_ARRAY, KEY_VALUE, uint8_array, key_value)                         \
    1719             :   V(INT8_ARRAY, KEY_VALUE, int8_array, key_value)                           \
    1720             :   V(UINT16_ARRAY, KEY_VALUE, uint16_array, key_value)                       \
    1721             :   V(INT16_ARRAY, KEY_VALUE, int16_array, key_value)                         \
    1722             :   V(UINT32_ARRAY, KEY_VALUE, uint32_array, key_value)                       \
    1723             :   V(INT32_ARRAY, KEY_VALUE, int32_array, key_value)                         \
    1724             :   V(FLOAT32_ARRAY, KEY_VALUE, float32_array, key_value)                     \
    1725             :   V(FLOAT64_ARRAY, KEY_VALUE, float64_array, key_value)                     \
    1726             :   V(UINT8_CLAMPED_ARRAY, KEY_VALUE, uint8_clamped_array, key_value)         \
    1727             :   V(FAST_SMI_ARRAY, KEY_VALUE, fast_smi_array, key_value)                   \
    1728             :   V(FAST_HOLEY_SMI_ARRAY, KEY_VALUE, fast_holey_smi_array, key_value)       \
    1729             :   V(FAST_ARRAY, KEY_VALUE, fast_array, key_value)                           \
    1730             :   V(FAST_HOLEY_ARRAY, KEY_VALUE, fast_holey_array, key_value)               \
    1731             :   V(FAST_DOUBLE_ARRAY, KEY_VALUE, fast_double_array, key_value)             \
    1732             :   V(FAST_HOLEY_DOUBLE_ARRAY, KEY_VALUE, fast_holey_double_array, key_value) \
    1733             :   V(GENERIC_ARRAY, KEY_VALUE, array, key_value)                             \
    1734             :   V(UINT8_ARRAY, VALUE, uint8_array, value)                                 \
    1735             :   V(INT8_ARRAY, VALUE, int8_array, value)                                   \
    1736             :   V(UINT16_ARRAY, VALUE, uint16_array, value)                               \
    1737             :   V(INT16_ARRAY, VALUE, int16_array, value)                                 \
    1738             :   V(UINT32_ARRAY, VALUE, uint32_array, value)                               \
    1739             :   V(INT32_ARRAY, VALUE, int32_array, value)                                 \
    1740             :   V(FLOAT32_ARRAY, VALUE, float32_array, value)                             \
    1741             :   V(FLOAT64_ARRAY, VALUE, float64_array, value)                             \
    1742             :   V(UINT8_CLAMPED_ARRAY, VALUE, uint8_clamped_array, value)                 \
    1743             :   V(FAST_SMI_ARRAY, VALUE, fast_smi_array, value)                           \
    1744             :   V(FAST_HOLEY_SMI_ARRAY, VALUE, fast_holey_smi_array, value)               \
    1745             :   V(FAST_ARRAY, VALUE, fast_array, value)                                   \
    1746             :   V(FAST_HOLEY_ARRAY, VALUE, fast_holey_array, value)                       \
    1747             :   V(FAST_DOUBLE_ARRAY, VALUE, fast_double_array, value)                     \
    1748             :   V(FAST_HOLEY_DOUBLE_ARRAY, VALUE, fast_holey_double_array, value)         \
    1749             :   V(GENERIC_ARRAY, VALUE, array, value)
    1750             : 
    1751             : #define CREATE_ARRAY_ITERATOR_MAP(PREFIX, SUFFIX, prefix, suffix)           \
    1752             :   do {                                                                      \
    1753             :     const InstanceType type = JS_##PREFIX##_##SUFFIX##_ITERATOR_TYPE;       \
    1754             :     Handle<Map> map =                                                       \
    1755             :         Map::Copy(initial_map, "JS_" #PREFIX "_" #SUFFIX "_ITERATOR_TYPE"); \
    1756             :     map->set_instance_type(type);                                           \
    1757             :     native_context()->set_##prefix##_##suffix##_iterator_map(*map);         \
    1758             :   } while (0);
    1759             : 
    1760        2135 :     ARRAY_ITERATOR_LIST(CREATE_ARRAY_ITERATOR_MAP)
    1761             : 
    1762             : #undef CREATE_ARRAY_ITERATOR_MAP
    1763             : #undef ARRAY_ITERATOR_LIST
    1764             :   }
    1765             : 
    1766             :   {  // --- N u m b e r ---
    1767             :     Handle<JSFunction> number_fun = InstallFunction(
    1768             :         global, "Number", JS_VALUE_TYPE, JSValue::kSize, 0,
    1769         122 :         isolate->initial_object_prototype(), Builtins::kNumberConstructor);
    1770             :     number_fun->shared()->DontAdaptArguments();
    1771             :     number_fun->shared()->SetConstructStub(
    1772         122 :         *BUILTIN_CODE(isolate, NumberConstructor_ConstructStub));
    1773             :     number_fun->shared()->set_length(1);
    1774             :     InstallWithIntrinsicDefaultProto(isolate, number_fun,
    1775          61 :                                      Context::NUMBER_FUNCTION_INDEX);
    1776             : 
    1777             :     // Create the %NumberPrototype%
    1778             :     Handle<JSValue> prototype =
    1779          61 :         Handle<JSValue>::cast(factory->NewJSObject(number_fun, TENURED));
    1780          61 :     prototype->set_value(Smi::kZero);
    1781          61 :     JSFunction::SetPrototype(number_fun, prototype);
    1782             : 
    1783             :     // Install the "constructor" property on the {prototype}.
    1784             :     JSObject::AddProperty(prototype, factory->constructor_string(), number_fun,
    1785          61 :                           DONT_ENUM);
    1786             : 
    1787             :     // Install the Number.prototype methods.
    1788             :     SimpleInstallFunction(prototype, "toExponential",
    1789          61 :                           Builtins::kNumberPrototypeToExponential, 1, false);
    1790             :     SimpleInstallFunction(prototype, "toFixed",
    1791          61 :                           Builtins::kNumberPrototypeToFixed, 1, false);
    1792             :     SimpleInstallFunction(prototype, "toPrecision",
    1793          61 :                           Builtins::kNumberPrototypeToPrecision, 1, false);
    1794             :     SimpleInstallFunction(prototype, "toString",
    1795          61 :                           Builtins::kNumberPrototypeToString, 1, false);
    1796             :     SimpleInstallFunction(prototype, "valueOf",
    1797          61 :                           Builtins::kNumberPrototypeValueOf, 0, true);
    1798             : 
    1799             :     // Install Intl fallback functions.
    1800             :     SimpleInstallFunction(prototype, "toLocaleString",
    1801          61 :                           Builtins::kNumberPrototypeToLocaleString, 0, false);
    1802             : 
    1803             :     // Install the Number functions.
    1804             :     SimpleInstallFunction(number_fun, "isFinite", Builtins::kNumberIsFinite, 1,
    1805          61 :                           true);
    1806             :     SimpleInstallFunction(number_fun, "isInteger", Builtins::kNumberIsInteger,
    1807          61 :                           1, true);
    1808          61 :     SimpleInstallFunction(number_fun, "isNaN", Builtins::kNumberIsNaN, 1, true);
    1809             :     SimpleInstallFunction(number_fun, "isSafeInteger",
    1810          61 :                           Builtins::kNumberIsSafeInteger, 1, true);
    1811             : 
    1812             :     // Install Number.parseFloat and Global.parseFloat.
    1813             :     Handle<JSFunction> parse_float_fun = SimpleInstallFunction(
    1814          61 :         number_fun, "parseFloat", Builtins::kNumberParseFloat, 1, true);
    1815             :     JSObject::AddProperty(global_object,
    1816             :                           factory->NewStringFromAsciiChecked("parseFloat"),
    1817         122 :                           parse_float_fun, DONT_ENUM);
    1818             : 
    1819             :     // Install Number.parseInt and Global.parseInt.
    1820             :     Handle<JSFunction> parse_int_fun = SimpleInstallFunction(
    1821          61 :         number_fun, "parseInt", Builtins::kNumberParseInt, 2, true);
    1822             :     JSObject::AddProperty(global_object,
    1823             :                           factory->NewStringFromAsciiChecked("parseInt"),
    1824         122 :                           parse_int_fun, DONT_ENUM);
    1825             : 
    1826             :     // Install Number constants
    1827             :     double kMaxValue = 1.7976931348623157e+308;
    1828             :     double kMinValue = 5e-324;
    1829             : 
    1830             :     double kMaxSafeInt = 9007199254740991;
    1831             :     double kMinSafeInt = -9007199254740991;
    1832             :     double kEPS = 2.220446049250313e-16;
    1833             : 
    1834             :     Handle<Object> infinity = factory->infinity_value();
    1835             :     Handle<Object> nan = factory->nan_value();
    1836          61 :     Handle<String> nan_name = factory->NewStringFromAsciiChecked("NaN");
    1837             : 
    1838             :     JSObject::AddProperty(
    1839             :         number_fun, factory->NewStringFromAsciiChecked("MAX_VALUE"),
    1840             :         factory->NewNumber(kMaxValue),
    1841         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1842             :     JSObject::AddProperty(
    1843             :         number_fun, factory->NewStringFromAsciiChecked("MIN_VALUE"),
    1844             :         factory->NewNumber(kMinValue),
    1845         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1846             :     JSObject::AddProperty(
    1847             :         number_fun, nan_name, nan,
    1848          61 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1849             :     JSObject::AddProperty(
    1850             :         number_fun, factory->NewStringFromAsciiChecked("NEGATIVE_INFINITY"),
    1851             :         factory->NewNumber(-V8_INFINITY),
    1852         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1853             :     JSObject::AddProperty(
    1854             :         number_fun, factory->NewStringFromAsciiChecked("POSITIVE_INFINITY"),
    1855             :         infinity,
    1856         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1857             :     JSObject::AddProperty(
    1858             :         number_fun, factory->NewStringFromAsciiChecked("MAX_SAFE_INTEGER"),
    1859             :         factory->NewNumber(kMaxSafeInt),
    1860         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1861             :     JSObject::AddProperty(
    1862             :         number_fun, factory->NewStringFromAsciiChecked("MIN_SAFE_INTEGER"),
    1863             :         factory->NewNumber(kMinSafeInt),
    1864         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1865             :     JSObject::AddProperty(
    1866             :         number_fun, factory->NewStringFromAsciiChecked("EPSILON"),
    1867             :         factory->NewNumber(kEPS),
    1868         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1869             : 
    1870             :     JSObject::AddProperty(
    1871             :         global, factory->NewStringFromAsciiChecked("Infinity"), infinity,
    1872         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1873             :     JSObject::AddProperty(
    1874             :         global, nan_name, nan,
    1875          61 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1876             :     JSObject::AddProperty(
    1877             :         global, factory->NewStringFromAsciiChecked("undefined"),
    1878             :         factory->undefined_value(),
    1879         122 :         static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
    1880             :   }
    1881             : 
    1882             :   {  // --- B o o l e a n ---
    1883             :     Handle<JSFunction> boolean_fun = InstallFunction(
    1884             :         global, "Boolean", JS_VALUE_TYPE, JSValue::kSize, 0,
    1885         122 :         isolate->initial_object_prototype(), Builtins::kBooleanConstructor);
    1886             :     boolean_fun->shared()->DontAdaptArguments();
    1887             :     boolean_fun->shared()->SetConstructStub(
    1888         122 :         *BUILTIN_CODE(isolate, BooleanConstructor_ConstructStub));
    1889             :     boolean_fun->shared()->set_length(1);
    1890             :     InstallWithIntrinsicDefaultProto(isolate, boolean_fun,
    1891          61 :                                      Context::BOOLEAN_FUNCTION_INDEX);
    1892             : 
    1893             :     // Create the %BooleanPrototype%
    1894             :     Handle<JSValue> prototype =
    1895          61 :         Handle<JSValue>::cast(factory->NewJSObject(boolean_fun, TENURED));
    1896         122 :     prototype->set_value(isolate->heap()->false_value());
    1897          61 :     JSFunction::SetPrototype(boolean_fun, prototype);
    1898             : 
    1899             :     // Install the "constructor" property on the {prototype}.
    1900             :     JSObject::AddProperty(prototype, factory->constructor_string(), boolean_fun,
    1901          61 :                           DONT_ENUM);
    1902             : 
    1903             :     // Install the Boolean.prototype methods.
    1904             :     SimpleInstallFunction(prototype, "toString",
    1905          61 :                           Builtins::kBooleanPrototypeToString, 0, true);
    1906             :     SimpleInstallFunction(prototype, "valueOf",
    1907          61 :                           Builtins::kBooleanPrototypeValueOf, 0, true);
    1908             :   }
    1909             : 
    1910             :   {  // --- S t r i n g ---
    1911             :     Handle<JSFunction> string_fun = InstallFunction(
    1912             :         global, "String", JS_VALUE_TYPE, JSValue::kSize, 0,
    1913         122 :         isolate->initial_object_prototype(), Builtins::kStringConstructor);
    1914             :     string_fun->shared()->SetConstructStub(
    1915         122 :         *BUILTIN_CODE(isolate, StringConstructor_ConstructStub));
    1916             :     string_fun->shared()->DontAdaptArguments();
    1917             :     string_fun->shared()->set_length(1);
    1918             :     InstallWithIntrinsicDefaultProto(isolate, string_fun,
    1919          61 :                                      Context::STRING_FUNCTION_INDEX);
    1920             : 
    1921             :     Handle<Map> string_map =
    1922             :         Handle<Map>(native_context()->string_function()->initial_map());
    1923             :     string_map->set_elements_kind(FAST_STRING_WRAPPER_ELEMENTS);
    1924          61 :     Map::EnsureDescriptorSlack(string_map, 1);
    1925             : 
    1926             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1927             :         DONT_ENUM | DONT_DELETE | READ_ONLY);
    1928             :     Handle<AccessorInfo> string_length(
    1929          61 :         Accessors::StringLengthInfo(isolate, attribs));
    1930             : 
    1931             :     {  // Add length.
    1932             :       Descriptor d = Descriptor::AccessorConstant(factory->length_string(),
    1933             :                                                   string_length, attribs);
    1934          61 :       string_map->AppendDescriptor(&d);
    1935             :     }
    1936             : 
    1937             :     // Install the String.fromCharCode function.
    1938             :     SimpleInstallFunction(string_fun, "fromCharCode",
    1939          61 :                           Builtins::kStringFromCharCode, 1, false);
    1940             : 
    1941             :     // Install the String.fromCodePoint function.
    1942             :     SimpleInstallFunction(string_fun, "fromCodePoint",
    1943          61 :                           Builtins::kStringFromCodePoint, 1, false);
    1944             : 
    1945             :     // Install the String.raw function.
    1946          61 :     SimpleInstallFunction(string_fun, "raw", Builtins::kStringRaw, 1, false);
    1947             : 
    1948             :     // Create the %StringPrototype%
    1949             :     Handle<JSValue> prototype =
    1950          61 :         Handle<JSValue>::cast(factory->NewJSObject(string_fun, TENURED));
    1951         122 :     prototype->set_value(isolate->heap()->empty_string());
    1952          61 :     JSFunction::SetPrototype(string_fun, prototype);
    1953             : 
    1954             :     // Install the "constructor" property on the {prototype}.
    1955             :     JSObject::AddProperty(prototype, factory->constructor_string(), string_fun,
    1956          61 :                           DONT_ENUM);
    1957             : 
    1958             :     // Install the String.prototype methods.
    1959             :     SimpleInstallFunction(prototype, "anchor", Builtins::kStringPrototypeAnchor,
    1960          61 :                           1, true);
    1961             :     SimpleInstallFunction(prototype, "big", Builtins::kStringPrototypeBig, 0,
    1962          61 :                           true);
    1963             :     SimpleInstallFunction(prototype, "blink", Builtins::kStringPrototypeBlink,
    1964          61 :                           0, true);
    1965             :     SimpleInstallFunction(prototype, "bold", Builtins::kStringPrototypeBold, 0,
    1966          61 :                           true);
    1967             :     SimpleInstallFunction(prototype, "charAt", Builtins::kStringPrototypeCharAt,
    1968          61 :                           1, true);
    1969             :     SimpleInstallFunction(prototype, "charCodeAt",
    1970          61 :                           Builtins::kStringPrototypeCharCodeAt, 1, true);
    1971             :     SimpleInstallFunction(prototype, "codePointAt",
    1972          61 :                           Builtins::kStringPrototypeCodePointAt, 1, true);
    1973             :     SimpleInstallFunction(prototype, "concat", Builtins::kStringPrototypeConcat,
    1974          61 :                           1, false);
    1975             :     SimpleInstallFunction(prototype, "endsWith",
    1976          61 :                           Builtins::kStringPrototypeEndsWith, 1, false);
    1977             :     SimpleInstallFunction(prototype, "fontcolor",
    1978          61 :                           Builtins::kStringPrototypeFontcolor, 1, true);
    1979             :     SimpleInstallFunction(prototype, "fontsize",
    1980          61 :                           Builtins::kStringPrototypeFontsize, 1, true);
    1981             :     SimpleInstallFunction(prototype, "fixed", Builtins::kStringPrototypeFixed,
    1982          61 :                           0, true);
    1983             :     SimpleInstallFunction(prototype, "includes",
    1984          61 :                           Builtins::kStringPrototypeIncludes, 1, false);
    1985             :     SimpleInstallFunction(prototype, "indexOf",
    1986          61 :                           Builtins::kStringPrototypeIndexOf, 1, false);
    1987             :     SimpleInstallFunction(prototype, "italics",
    1988          61 :                           Builtins::kStringPrototypeItalics, 0, true);
    1989             :     SimpleInstallFunction(prototype, "lastIndexOf",
    1990          61 :                           Builtins::kStringPrototypeLastIndexOf, 1, false);
    1991             :     SimpleInstallFunction(prototype, "link", Builtins::kStringPrototypeLink, 1,
    1992          61 :                           true);
    1993             :     SimpleInstallFunction(prototype, "localeCompare",
    1994          61 :                           Builtins::kStringPrototypeLocaleCompare, 1, true);
    1995             :     SimpleInstallFunction(prototype, "match", Builtins::kStringPrototypeMatch,
    1996          61 :                           1, true);
    1997             : #ifdef V8_INTL_SUPPORT
    1998             :     SimpleInstallFunction(prototype, "normalize",
    1999          61 :                           Builtins::kStringPrototypeNormalizeIntl, 0, false);
    2000             : #else
    2001             :     SimpleInstallFunction(prototype, "normalize",
    2002             :                           Builtins::kStringPrototypeNormalize, 0, false);
    2003             : #endif  // V8_INTL_SUPPORT
    2004             :     SimpleInstallFunction(prototype, "padEnd", Builtins::kStringPrototypePadEnd,
    2005          61 :                           1, false);
    2006             :     SimpleInstallFunction(prototype, "padStart",
    2007          61 :                           Builtins::kStringPrototypePadStart, 1, false);
    2008             :     SimpleInstallFunction(prototype, "repeat", Builtins::kStringPrototypeRepeat,
    2009          61 :                           1, true);
    2010             :     SimpleInstallFunction(prototype, "replace",
    2011          61 :                           Builtins::kStringPrototypeReplace, 2, true);
    2012             :     SimpleInstallFunction(prototype, "search", Builtins::kStringPrototypeSearch,
    2013          61 :                           1, true);
    2014             :     SimpleInstallFunction(prototype, "slice", Builtins::kStringPrototypeSlice,
    2015          61 :                           2, false);
    2016             :     SimpleInstallFunction(prototype, "small", Builtins::kStringPrototypeSmall,
    2017          61 :                           0, true);
    2018             :     SimpleInstallFunction(prototype, "split", Builtins::kStringPrototypeSplit,
    2019          61 :                           2, false);
    2020             :     SimpleInstallFunction(prototype, "strike", Builtins::kStringPrototypeStrike,
    2021          61 :                           0, true);
    2022             :     SimpleInstallFunction(prototype, "sub", Builtins::kStringPrototypeSub, 0,
    2023          61 :                           true);
    2024             :     SimpleInstallFunction(prototype, "substr", Builtins::kStringPrototypeSubstr,
    2025          61 :                           2, false);
    2026             :     SimpleInstallFunction(prototype, "substring",
    2027          61 :                           Builtins::kStringPrototypeSubstring, 2, false);
    2028             :     SimpleInstallFunction(prototype, "sup", Builtins::kStringPrototypeSup, 0,
    2029          61 :                           true);
    2030             :     SimpleInstallFunction(prototype, "startsWith",
    2031          61 :                           Builtins::kStringPrototypeStartsWith, 1, false);
    2032             :     SimpleInstallFunction(prototype, "toString",
    2033          61 :                           Builtins::kStringPrototypeToString, 0, true);
    2034             :     SimpleInstallFunction(prototype, "trim", Builtins::kStringPrototypeTrim, 0,
    2035          61 :                           false);
    2036             :     SimpleInstallFunction(prototype, "trimLeft",
    2037          61 :                           Builtins::kStringPrototypeTrimLeft, 0, false);
    2038             :     SimpleInstallFunction(prototype, "trimRight",
    2039          61 :                           Builtins::kStringPrototypeTrimRight, 0, false);
    2040             : #ifdef V8_INTL_SUPPORT
    2041             :     SimpleInstallFunction(prototype, "toLowerCase",
    2042          61 :                           Builtins::kStringPrototypeToLowerCaseIntl, 0, true);
    2043             :     SimpleInstallFunction(prototype, "toUpperCase",
    2044          61 :                           Builtins::kStringPrototypeToUpperCaseIntl, 0, false);
    2045             : #else
    2046             :     SimpleInstallFunction(prototype, "toLocaleLowerCase",
    2047             :                           Builtins::kStringPrototypeToLocaleLowerCase, 0,
    2048             :                           false);
    2049             :     SimpleInstallFunction(prototype, "toLocaleUpperCase",
    2050             :                           Builtins::kStringPrototypeToLocaleUpperCase, 0,
    2051             :                           false);
    2052             :     SimpleInstallFunction(prototype, "toLowerCase",
    2053             :                           Builtins::kStringPrototypeToLowerCase, 0, false);
    2054             :     SimpleInstallFunction(prototype, "toUpperCase",
    2055             :                           Builtins::kStringPrototypeToUpperCase, 0, false);
    2056             : #endif
    2057             :     SimpleInstallFunction(prototype, "valueOf",
    2058          61 :                           Builtins::kStringPrototypeValueOf, 0, true);
    2059             : 
    2060             :     SimpleInstallFunction(prototype, factory->iterator_symbol(),
    2061             :                           "[Symbol.iterator]",
    2062             :                           Builtins::kStringPrototypeIterator, 0, true,
    2063          61 :                           DONT_ENUM, kStringIterator);
    2064             :   }
    2065             : 
    2066             :   {  // --- S t r i n g I t e r a t o r ---
    2067             :     Handle<JSObject> iterator_prototype(
    2068             :         native_context()->initial_iterator_prototype());
    2069             : 
    2070             :     Handle<JSObject> string_iterator_prototype =
    2071          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2072          61 :     JSObject::ForceSetPrototype(string_iterator_prototype, iterator_prototype);
    2073             : 
    2074             :     JSObject::AddProperty(
    2075             :         string_iterator_prototype, factory->to_string_tag_symbol(),
    2076             :         factory->NewStringFromAsciiChecked("String Iterator"),
    2077         122 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2078             : 
    2079             :     SimpleInstallFunction(string_iterator_prototype, "next",
    2080             :                           Builtins::kStringIteratorPrototypeNext, 0, true,
    2081          61 :                           kStringIteratorNext);
    2082             : 
    2083             :     Handle<JSFunction> string_iterator_function = CreateFunction(
    2084             :         isolate, factory->NewStringFromAsciiChecked("StringIterator"),
    2085             :         JS_STRING_ITERATOR_TYPE, JSStringIterator::kSize, 0,
    2086          61 :         string_iterator_prototype, Builtins::kIllegal);
    2087             :     string_iterator_function->shared()->set_native(false);
    2088             :     native_context()->set_string_iterator_map(
    2089             :         string_iterator_function->initial_map());
    2090             :   }
    2091             : 
    2092             :   {  // --- S y m b o l ---
    2093             :     Handle<JSFunction> symbol_fun = InstallFunction(
    2094             :         global, "Symbol", JS_VALUE_TYPE, JSValue::kSize, 0,
    2095          61 :         factory->the_hole_value(), Builtins::kSymbolConstructor);
    2096             :     symbol_fun->shared()->SetConstructStub(
    2097         122 :         *BUILTIN_CODE(isolate, SymbolConstructor_ConstructStub));
    2098             :     symbol_fun->shared()->set_length(0);
    2099             :     symbol_fun->shared()->DontAdaptArguments();
    2100             :     native_context()->set_symbol_function(*symbol_fun);
    2101             : 
    2102             :     // Install the Symbol.for and Symbol.keyFor functions.
    2103          61 :     SimpleInstallFunction(symbol_fun, "for", Builtins::kSymbolFor, 1, false);
    2104             :     SimpleInstallFunction(symbol_fun, "keyFor", Builtins::kSymbolKeyFor, 1,
    2105          61 :                           false);
    2106             : 
    2107             :     // Install well-known symbols.
    2108             :     InstallConstant(isolate, symbol_fun, "hasInstance",
    2109          61 :                     factory->has_instance_symbol());
    2110             :     InstallConstant(isolate, symbol_fun, "isConcatSpreadable",
    2111          61 :                     factory->is_concat_spreadable_symbol());
    2112             :     InstallConstant(isolate, symbol_fun, "iterator",
    2113          61 :                     factory->iterator_symbol());
    2114          61 :     InstallConstant(isolate, symbol_fun, "match", factory->match_symbol());
    2115          61 :     InstallConstant(isolate, symbol_fun, "replace", factory->replace_symbol());
    2116          61 :     InstallConstant(isolate, symbol_fun, "search", factory->search_symbol());
    2117          61 :     InstallConstant(isolate, symbol_fun, "species", factory->species_symbol());
    2118          61 :     InstallConstant(isolate, symbol_fun, "split", factory->split_symbol());
    2119             :     InstallConstant(isolate, symbol_fun, "toPrimitive",
    2120          61 :                     factory->to_primitive_symbol());
    2121             :     InstallConstant(isolate, symbol_fun, "toStringTag",
    2122          61 :                     factory->to_string_tag_symbol());
    2123             :     InstallConstant(isolate, symbol_fun, "unscopables",
    2124          61 :                     factory->unscopables_symbol());
    2125             : 
    2126             :     // Setup %SymbolPrototype%.
    2127             :     Handle<JSObject> prototype(
    2128             :         JSObject::cast(symbol_fun->instance_prototype()));
    2129             : 
    2130             :     // Install the @@toStringTag property on the {prototype}.
    2131             :     JSObject::AddProperty(
    2132             :         prototype, factory->to_string_tag_symbol(),
    2133             :         factory->NewStringFromAsciiChecked("Symbol"),
    2134         122 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2135             : 
    2136             :     // Install the Symbol.prototype methods.
    2137             :     SimpleInstallFunction(prototype, "toString",
    2138          61 :                           Builtins::kSymbolPrototypeToString, 0, true);
    2139             :     SimpleInstallFunction(prototype, "valueOf",
    2140          61 :                           Builtins::kSymbolPrototypeValueOf, 0, true);
    2141             : 
    2142             :     // Install the @@toPrimitive function.
    2143             :     Handle<JSFunction> to_primitive = InstallFunction(
    2144             :         prototype, factory->to_primitive_symbol(), JS_OBJECT_TYPE,
    2145             :         JSObject::kHeaderSize, 0, MaybeHandle<JSObject>(),
    2146             :         Builtins::kSymbolPrototypeToPrimitive,
    2147          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2148             : 
    2149             :     // Set the expected parameters for @@toPrimitive to 1; required by builtin.
    2150             :     to_primitive->shared()->set_internal_formal_parameter_count(1);
    2151             : 
    2152             :     // Set the length for the function to satisfy ECMA-262.
    2153             :     to_primitive->shared()->set_length(1);
    2154             :   }
    2155             : 
    2156             :   {  // --- D a t e ---
    2157             :     Handle<JSFunction> date_fun =
    2158             :         InstallFunction(global, "Date", JS_DATE_TYPE, JSDate::kSize, 0,
    2159          61 :                         factory->the_hole_value(), Builtins::kDateConstructor);
    2160             :     InstallWithIntrinsicDefaultProto(isolate, date_fun,
    2161          61 :                                      Context::DATE_FUNCTION_INDEX);
    2162             :     date_fun->shared()->SetConstructStub(
    2163         122 :         *BUILTIN_CODE(isolate, DateConstructor_ConstructStub));
    2164             :     date_fun->shared()->set_length(7);
    2165             :     date_fun->shared()->DontAdaptArguments();
    2166             : 
    2167             :     // Install the Date.now, Date.parse and Date.UTC functions.
    2168          61 :     SimpleInstallFunction(date_fun, "now", Builtins::kDateNow, 0, false);
    2169          61 :     SimpleInstallFunction(date_fun, "parse", Builtins::kDateParse, 1, false);
    2170          61 :     SimpleInstallFunction(date_fun, "UTC", Builtins::kDateUTC, 7, false);
    2171             : 
    2172             :     // Setup %DatePrototype%.
    2173             :     Handle<JSObject> prototype(JSObject::cast(date_fun->instance_prototype()));
    2174             : 
    2175             :     // Install the Date.prototype methods.
    2176             :     SimpleInstallFunction(prototype, "toString",
    2177          61 :                           Builtins::kDatePrototypeToString, 0, false);
    2178             :     SimpleInstallFunction(prototype, "toDateString",
    2179          61 :                           Builtins::kDatePrototypeToDateString, 0, false);
    2180             :     SimpleInstallFunction(prototype, "toTimeString",
    2181          61 :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2182             :     SimpleInstallFunction(prototype, "toISOString",
    2183          61 :                           Builtins::kDatePrototypeToISOString, 0, false);
    2184             :     Handle<JSFunction> to_utc_string =
    2185             :         SimpleInstallFunction(prototype, "toUTCString",
    2186          61 :                               Builtins::kDatePrototypeToUTCString, 0, false);
    2187             :     InstallFunction(prototype, to_utc_string,
    2188         122 :                     factory->InternalizeUtf8String("toGMTString"), DONT_ENUM);
    2189             :     SimpleInstallFunction(prototype, "getDate", Builtins::kDatePrototypeGetDate,
    2190          61 :                           0, true);
    2191             :     SimpleInstallFunction(prototype, "setDate", Builtins::kDatePrototypeSetDate,
    2192          61 :                           1, false);
    2193             :     SimpleInstallFunction(prototype, "getDay", Builtins::kDatePrototypeGetDay,
    2194          61 :                           0, true);
    2195             :     SimpleInstallFunction(prototype, "getFullYear",
    2196          61 :                           Builtins::kDatePrototypeGetFullYear, 0, true);
    2197             :     SimpleInstallFunction(prototype, "setFullYear",
    2198          61 :                           Builtins::kDatePrototypeSetFullYear, 3, false);
    2199             :     SimpleInstallFunction(prototype, "getHours",
    2200          61 :                           Builtins::kDatePrototypeGetHours, 0, true);
    2201             :     SimpleInstallFunction(prototype, "setHours",
    2202          61 :                           Builtins::kDatePrototypeSetHours, 4, false);
    2203             :     SimpleInstallFunction(prototype, "getMilliseconds",
    2204          61 :                           Builtins::kDatePrototypeGetMilliseconds, 0, true);
    2205             :     SimpleInstallFunction(prototype, "setMilliseconds",
    2206          61 :                           Builtins::kDatePrototypeSetMilliseconds, 1, false);
    2207             :     SimpleInstallFunction(prototype, "getMinutes",
    2208          61 :                           Builtins::kDatePrototypeGetMinutes, 0, true);
    2209             :     SimpleInstallFunction(prototype, "setMinutes",
    2210          61 :                           Builtins::kDatePrototypeSetMinutes, 3, false);
    2211             :     SimpleInstallFunction(prototype, "getMonth",
    2212          61 :                           Builtins::kDatePrototypeGetMonth, 0, true);
    2213             :     SimpleInstallFunction(prototype, "setMonth",
    2214          61 :                           Builtins::kDatePrototypeSetMonth, 2, false);
    2215             :     SimpleInstallFunction(prototype, "getSeconds",
    2216          61 :                           Builtins::kDatePrototypeGetSeconds, 0, true);
    2217             :     SimpleInstallFunction(prototype, "setSeconds",
    2218          61 :                           Builtins::kDatePrototypeSetSeconds, 2, false);
    2219             :     SimpleInstallFunction(prototype, "getTime", Builtins::kDatePrototypeGetTime,
    2220          61 :                           0, true);
    2221             :     SimpleInstallFunction(prototype, "setTime", Builtins::kDatePrototypeSetTime,
    2222          61 :                           1, false);
    2223             :     SimpleInstallFunction(prototype, "getTimezoneOffset",
    2224          61 :                           Builtins::kDatePrototypeGetTimezoneOffset, 0, true);
    2225             :     SimpleInstallFunction(prototype, "getUTCDate",
    2226          61 :                           Builtins::kDatePrototypeGetUTCDate, 0, true);
    2227             :     SimpleInstallFunction(prototype, "setUTCDate",
    2228          61 :                           Builtins::kDatePrototypeSetUTCDate, 1, false);
    2229             :     SimpleInstallFunction(prototype, "getUTCDay",
    2230          61 :                           Builtins::kDatePrototypeGetUTCDay, 0, true);
    2231             :     SimpleInstallFunction(prototype, "getUTCFullYear",
    2232          61 :                           Builtins::kDatePrototypeGetUTCFullYear, 0, true);
    2233             :     SimpleInstallFunction(prototype, "setUTCFullYear",
    2234          61 :                           Builtins::kDatePrototypeSetUTCFullYear, 3, false);
    2235             :     SimpleInstallFunction(prototype, "getUTCHours",
    2236          61 :                           Builtins::kDatePrototypeGetUTCHours, 0, true);
    2237             :     SimpleInstallFunction(prototype, "setUTCHours",
    2238          61 :                           Builtins::kDatePrototypeSetUTCHours, 4, false);
    2239             :     SimpleInstallFunction(prototype, "getUTCMilliseconds",
    2240          61 :                           Builtins::kDatePrototypeGetUTCMilliseconds, 0, true);
    2241             :     SimpleInstallFunction(prototype, "setUTCMilliseconds",
    2242          61 :                           Builtins::kDatePrototypeSetUTCMilliseconds, 1, false);
    2243             :     SimpleInstallFunction(prototype, "getUTCMinutes",
    2244          61 :                           Builtins::kDatePrototypeGetUTCMinutes, 0, true);
    2245             :     SimpleInstallFunction(prototype, "setUTCMinutes",
    2246          61 :                           Builtins::kDatePrototypeSetUTCMinutes, 3, false);
    2247             :     SimpleInstallFunction(prototype, "getUTCMonth",
    2248          61 :                           Builtins::kDatePrototypeGetUTCMonth, 0, true);
    2249             :     SimpleInstallFunction(prototype, "setUTCMonth",
    2250          61 :                           Builtins::kDatePrototypeSetUTCMonth, 2, false);
    2251             :     SimpleInstallFunction(prototype, "getUTCSeconds",
    2252          61 :                           Builtins::kDatePrototypeGetUTCSeconds, 0, true);
    2253             :     SimpleInstallFunction(prototype, "setUTCSeconds",
    2254          61 :                           Builtins::kDatePrototypeSetUTCSeconds, 2, false);
    2255             :     SimpleInstallFunction(prototype, "valueOf", Builtins::kDatePrototypeValueOf,
    2256          61 :                           0, true);
    2257             :     SimpleInstallFunction(prototype, "getYear", Builtins::kDatePrototypeGetYear,
    2258          61 :                           0, true);
    2259             :     SimpleInstallFunction(prototype, "setYear", Builtins::kDatePrototypeSetYear,
    2260          61 :                           1, false);
    2261             :     SimpleInstallFunction(prototype, "toJSON", Builtins::kDatePrototypeToJson,
    2262          61 :                           1, false);
    2263             : 
    2264             :     // Install Intl fallback functions.
    2265             :     SimpleInstallFunction(prototype, "toLocaleString",
    2266          61 :                           Builtins::kDatePrototypeToString, 0, false);
    2267             :     SimpleInstallFunction(prototype, "toLocaleDateString",
    2268          61 :                           Builtins::kDatePrototypeToDateString, 0, false);
    2269             :     SimpleInstallFunction(prototype, "toLocaleTimeString",
    2270          61 :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2271             : 
    2272             :     // Install the @@toPrimitive function.
    2273             :     Handle<JSFunction> to_primitive = InstallFunction(
    2274             :         prototype, factory->to_primitive_symbol(), JS_OBJECT_TYPE,
    2275             :         JSObject::kHeaderSize, 0, MaybeHandle<JSObject>(),
    2276             :         Builtins::kDatePrototypeToPrimitive,
    2277          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2278             : 
    2279             :     // Set the expected parameters for @@toPrimitive to 1; required by builtin.
    2280             :     to_primitive->shared()->set_internal_formal_parameter_count(1);
    2281             : 
    2282             :     // Set the length for the function to satisfy ECMA-262.
    2283             :     to_primitive->shared()->set_length(1);
    2284             :   }
    2285             : 
    2286             :   {
    2287             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2288             :         isolate, Builtins::kPromiseGetCapabilitiesExecutor,
    2289          61 :         factory->empty_string(), factory->Object_string(), 2);
    2290             :     native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
    2291             : 
    2292             :     // %new_promise_capability(C, debugEvent)
    2293             :     Handle<JSFunction> new_promise_capability =
    2294             :         SimpleCreateFunction(isolate, factory->empty_string(),
    2295          61 :                              Builtins::kNewPromiseCapability, 2, false);
    2296             :     native_context()->set_new_promise_capability(*new_promise_capability);
    2297             :   }
    2298             : 
    2299             :   {  // -- P r o m i s e
    2300             :     Handle<JSFunction> promise_fun = InstallFunction(
    2301             :         global, "Promise", JS_PROMISE_TYPE, JSPromise::kSizeWithEmbedderFields,
    2302          61 :         0, factory->the_hole_value(), Builtins::kPromiseConstructor);
    2303             :     InstallWithIntrinsicDefaultProto(isolate, promise_fun,
    2304          61 :                                      Context::PROMISE_FUNCTION_INDEX);
    2305             : 
    2306             :     Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate);
    2307         122 :     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
    2308         122 :     shared->set_instance_class_name(isolate->heap()->Object_string());
    2309             :     shared->set_internal_formal_parameter_count(1);
    2310             :     shared->set_length(1);
    2311             : 
    2312          61 :     InstallSpeciesGetter(promise_fun);
    2313             : 
    2314          61 :     SimpleInstallFunction(promise_fun, "all", Builtins::kPromiseAll, 1, true);
    2315             : 
    2316          61 :     SimpleInstallFunction(promise_fun, "race", Builtins::kPromiseRace, 1, true);
    2317             : 
    2318             :     SimpleInstallFunction(promise_fun, "resolve",
    2319          61 :                           Builtins::kPromiseResolveWrapper, 1, true);
    2320             : 
    2321             :     SimpleInstallFunction(promise_fun, "reject", Builtins::kPromiseReject, 1,
    2322          61 :                           true);
    2323             : 
    2324             :     // Setup %PromisePrototype%.
    2325             :     Handle<JSObject> prototype(
    2326             :         JSObject::cast(promise_fun->instance_prototype()));
    2327             : 
    2328             :     // Install the @@toStringTag property on the {prototype}.
    2329             :     JSObject::AddProperty(
    2330             :         prototype, factory->to_string_tag_symbol(), factory->Promise_string(),
    2331          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2332             : 
    2333             :     Handle<JSFunction> promise_then =
    2334             :         SimpleInstallFunction(prototype, isolate->factory()->then_string(),
    2335          61 :                               Builtins::kPromiseThen, 2, true);
    2336             :     native_context()->set_promise_then(*promise_then);
    2337             : 
    2338             :     Handle<JSFunction> promise_catch = SimpleInstallFunction(
    2339          61 :         prototype, "catch", Builtins::kPromiseCatch, 1, true);
    2340             :     native_context()->set_promise_catch(*promise_catch);
    2341             : 
    2342             :     // Force the Promise constructor to fast properties, so that we can use the
    2343             :     // fast paths for various things like
    2344             :     //
    2345             :     //   x instanceof Promise
    2346             :     //
    2347             :     // etc. We should probably come up with a more principled approach once
    2348             :     // the JavaScript builtins are gone.
    2349             :     JSObject::MigrateSlowToFast(Handle<JSObject>::cast(promise_fun), 0,
    2350          61 :                                 "Bootstrapping");
    2351             : 
    2352             :     Handle<Map> prototype_map(prototype->map());
    2353          61 :     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate);
    2354             : 
    2355             :     // Store the initial Promise.prototype map. This is used in fast-path
    2356             :     // checks. Do not alter the prototype after this point.
    2357             :     native_context()->set_promise_prototype_map(*prototype_map);
    2358             : 
    2359             :     {  // Internal: PromiseInternalConstructor
    2360             :        // Also exposed as extrasUtils.createPromise.
    2361             :       Handle<JSFunction> function =
    2362             :           SimpleCreateFunction(isolate, factory->empty_string(),
    2363          61 :                                Builtins::kPromiseInternalConstructor, 1, true);
    2364             :       function->shared()->set_native(false);
    2365             :       native_context()->set_promise_internal_constructor(*function);
    2366             :     }
    2367             : 
    2368             :     {  // Internal: IsPromise
    2369             :       Handle<JSFunction> function = SimpleCreateFunction(
    2370          61 :           isolate, factory->empty_string(), Builtins::kIsPromise, 1, false);
    2371             :       native_context()->set_is_promise(*function);
    2372             :     }
    2373             : 
    2374             :     {  // Internal: ResolvePromise
    2375             :        // Also exposed as extrasUtils.resolvePromise.
    2376             :       Handle<JSFunction> function = SimpleCreateFunction(
    2377          61 :           isolate, factory->empty_string(), Builtins::kResolvePromise, 2, true);
    2378             :       function->shared()->set_native(false);
    2379             :       native_context()->set_promise_resolve(*function);
    2380             :     }
    2381             : 
    2382             :     {  // Internal: PromiseHandle
    2383             :       Handle<JSFunction> function = SimpleCreateFunction(
    2384          61 :           isolate, factory->empty_string(), Builtins::kPromiseHandle, 5, false);
    2385             :       native_context()->set_promise_handle(*function);
    2386             :     }
    2387             : 
    2388             :     {  // Internal: PromiseHandleReject
    2389             :       Handle<JSFunction> function =
    2390             :           SimpleCreateFunction(isolate, factory->empty_string(),
    2391          61 :                                Builtins::kPromiseHandleReject, 3, false);
    2392             :       native_context()->set_promise_handle_reject(*function);
    2393             :     }
    2394             : 
    2395             :     {  // Internal: InternalPromiseReject
    2396             :       Handle<JSFunction> function =
    2397             :           SimpleCreateFunction(isolate, factory->empty_string(),
    2398          61 :                                Builtins::kInternalPromiseReject, 3, true);
    2399             :       function->shared()->set_native(false);
    2400             :       native_context()->set_promise_internal_reject(*function);
    2401             :     }
    2402             : 
    2403             :     {
    2404             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2405             :           isolate, Builtins::kPromiseResolveClosure, factory->empty_string(),
    2406          61 :           1);
    2407             :       native_context()->set_promise_resolve_shared_fun(*info);
    2408             : 
    2409             :       info = SimpleCreateSharedFunctionInfo(
    2410          61 :           isolate, Builtins::kPromiseRejectClosure, factory->empty_string(), 1);
    2411             :       native_context()->set_promise_reject_shared_fun(*info);
    2412             :     }
    2413             : 
    2414             :     {
    2415             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2416             :           isolate, Builtins::kPromiseAllResolveElementClosure,
    2417          61 :           factory->empty_string(), 1);
    2418             :       native_context()->set_promise_all_resolve_element_shared_fun(*info);
    2419             :     }
    2420             : 
    2421             :     // Force the Promise constructor to fast properties, so that we can use the
    2422             :     // fast paths for various things like
    2423             :     //
    2424             :     //   x instanceof Promise
    2425             :     //
    2426             :     // etc. We should probably come up with a more principled approach once
    2427             :     // the JavaScript builtins are gone.
    2428          61 :     JSObject::MigrateSlowToFast(promise_fun, 0, "Bootstrapping");
    2429             :   }
    2430             : 
    2431             :   {  // -- R e g E x p
    2432             :     // Builtin functions for RegExp.prototype.
    2433             :     Handle<JSFunction> regexp_fun = InstallFunction(
    2434             :         global, "RegExp", JS_REGEXP_TYPE,
    2435             :         JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize,
    2436             :         JSRegExp::kInObjectFieldCount, factory->the_hole_value(),
    2437          61 :         Builtins::kRegExpConstructor);
    2438             :     InstallWithIntrinsicDefaultProto(isolate, regexp_fun,
    2439          61 :                                      Context::REGEXP_FUNCTION_INDEX);
    2440             : 
    2441             :     Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate);
    2442         122 :     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
    2443         122 :     shared->set_instance_class_name(isolate->heap()->RegExp_string());
    2444             :     shared->set_internal_formal_parameter_count(2);
    2445             :     shared->set_length(2);
    2446             : 
    2447             :     {
    2448             :       // Setup %RegExpPrototype%.
    2449             :       Handle<JSObject> prototype(
    2450             :           JSObject::cast(regexp_fun->instance_prototype()));
    2451             : 
    2452             :       {
    2453             :         Handle<JSFunction> fun = SimpleInstallFunction(
    2454             :             prototype, factory->exec_string(), Builtins::kRegExpPrototypeExec,
    2455          61 :             1, true, DONT_ENUM);
    2456             :         native_context()->set_regexp_exec_function(*fun);
    2457             :       }
    2458             : 
    2459             :       SimpleInstallGetter(prototype, factory->flags_string(),
    2460          61 :                           Builtins::kRegExpPrototypeFlagsGetter, true);
    2461             :       SimpleInstallGetter(prototype, factory->global_string(),
    2462          61 :                           Builtins::kRegExpPrototypeGlobalGetter, true);
    2463             :       SimpleInstallGetter(prototype, factory->ignoreCase_string(),
    2464          61 :                           Builtins::kRegExpPrototypeIgnoreCaseGetter, true);
    2465             :       SimpleInstallGetter(prototype, factory->multiline_string(),
    2466          61 :                           Builtins::kRegExpPrototypeMultilineGetter, true);
    2467             :       SimpleInstallGetter(prototype, factory->source_string(),
    2468          61 :                           Builtins::kRegExpPrototypeSourceGetter, true);
    2469             :       SimpleInstallGetter(prototype, factory->sticky_string(),
    2470          61 :                           Builtins::kRegExpPrototypeStickyGetter, true);
    2471             :       SimpleInstallGetter(prototype, factory->unicode_string(),
    2472          61 :                           Builtins::kRegExpPrototypeUnicodeGetter, true);
    2473             : 
    2474             :       SimpleInstallFunction(prototype, "compile",
    2475             :                             Builtins::kRegExpPrototypeCompile, 2, true,
    2476          61 :                             DONT_ENUM);
    2477             :       SimpleInstallFunction(prototype, factory->toString_string(),
    2478             :                             Builtins::kRegExpPrototypeToString, 0, false,
    2479          61 :                             DONT_ENUM);
    2480             :       SimpleInstallFunction(prototype, "test", Builtins::kRegExpPrototypeTest,
    2481          61 :                             1, true, DONT_ENUM);
    2482             : 
    2483             :       SimpleInstallFunction(prototype, factory->match_symbol(),
    2484             :                             "[Symbol.match]", Builtins::kRegExpPrototypeMatch,
    2485          61 :                             1, true);
    2486             : 
    2487             :       SimpleInstallFunction(prototype, factory->replace_symbol(),
    2488             :                             "[Symbol.replace]",
    2489          61 :                             Builtins::kRegExpPrototypeReplace, 2, false);
    2490             : 
    2491             :       SimpleInstallFunction(prototype, factory->search_symbol(),
    2492             :                             "[Symbol.search]", Builtins::kRegExpPrototypeSearch,
    2493          61 :                             1, true);
    2494             : 
    2495             :       SimpleInstallFunction(prototype, factory->split_symbol(),
    2496             :                             "[Symbol.split]", Builtins::kRegExpPrototypeSplit,
    2497          61 :                             2, false);
    2498             : 
    2499             :       Handle<Map> prototype_map(prototype->map());
    2500          61 :       Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate);
    2501             : 
    2502             :       // Store the initial RegExp.prototype map. This is used in fast-path
    2503             :       // checks. Do not alter the prototype after this point.
    2504             :       native_context()->set_regexp_prototype_map(*prototype_map);
    2505             :     }
    2506             : 
    2507             :     {
    2508             :       // RegExp getters and setters.
    2509             : 
    2510          61 :       InstallSpeciesGetter(regexp_fun);
    2511             : 
    2512             :       // Static properties set by a successful match.
    2513             : 
    2514             :       const PropertyAttributes no_enum = DONT_ENUM;
    2515             :       SimpleInstallGetterSetter(regexp_fun, factory->input_string(),
    2516             :                                 Builtins::kRegExpInputGetter,
    2517          61 :                                 Builtins::kRegExpInputSetter, no_enum);
    2518             :       SimpleInstallGetterSetter(
    2519             :           regexp_fun, factory->InternalizeUtf8String("$_"),
    2520         122 :           Builtins::kRegExpInputGetter, Builtins::kRegExpInputSetter, no_enum);
    2521             : 
    2522             :       SimpleInstallGetterSetter(
    2523             :           regexp_fun, factory->InternalizeUtf8String("lastMatch"),
    2524         122 :           Builtins::kRegExpLastMatchGetter, Builtins::kEmptyFunction, no_enum);
    2525             :       SimpleInstallGetterSetter(
    2526             :           regexp_fun, factory->InternalizeUtf8String("$&"),
    2527         122 :           Builtins::kRegExpLastMatchGetter, Builtins::kEmptyFunction, no_enum);
    2528             : 
    2529             :       SimpleInstallGetterSetter(
    2530             :           regexp_fun, factory->InternalizeUtf8String("lastParen"),
    2531         122 :           Builtins::kRegExpLastParenGetter, Builtins::kEmptyFunction, no_enum);
    2532             :       SimpleInstallGetterSetter(
    2533             :           regexp_fun, factory->InternalizeUtf8String("$+"),
    2534         122 :           Builtins::kRegExpLastParenGetter, Builtins::kEmptyFunction, no_enum);
    2535             : 
    2536             :       SimpleInstallGetterSetter(regexp_fun,
    2537             :                                 factory->InternalizeUtf8String("leftContext"),
    2538             :                                 Builtins::kRegExpLeftContextGetter,
    2539         122 :                                 Builtins::kEmptyFunction, no_enum);
    2540             :       SimpleInstallGetterSetter(regexp_fun,
    2541             :                                 factory->InternalizeUtf8String("$`"),
    2542             :                                 Builtins::kRegExpLeftContextGetter,
    2543         122 :                                 Builtins::kEmptyFunction, no_enum);
    2544             : 
    2545             :       SimpleInstallGetterSetter(regexp_fun,
    2546             :                                 factory->InternalizeUtf8String("rightContext"),
    2547             :                                 Builtins::kRegExpRightContextGetter,
    2548         122 :                                 Builtins::kEmptyFunction, no_enum);
    2549             :       SimpleInstallGetterSetter(regexp_fun,
    2550             :                                 factory->InternalizeUtf8String("$'"),
    2551             :                                 Builtins::kRegExpRightContextGetter,
    2552         122 :                                 Builtins::kEmptyFunction, no_enum);
    2553             : 
    2554             : #define INSTALL_CAPTURE_GETTER(i)                         \
    2555             :   SimpleInstallGetterSetter(                              \
    2556             :       regexp_fun, factory->InternalizeUtf8String("$" #i), \
    2557             :       Builtins::kRegExpCapture##i##Getter, Builtins::kEmptyFunction, no_enum)
    2558         122 :       INSTALL_CAPTURE_GETTER(1);
    2559         122 :       INSTALL_CAPTURE_GETTER(2);
    2560         122 :       INSTALL_CAPTURE_GETTER(3);
    2561         122 :       INSTALL_CAPTURE_GETTER(4);
    2562         122 :       INSTALL_CAPTURE_GETTER(5);
    2563         122 :       INSTALL_CAPTURE_GETTER(6);
    2564         122 :       INSTALL_CAPTURE_GETTER(7);
    2565         122 :       INSTALL_CAPTURE_GETTER(8);
    2566         122 :       INSTALL_CAPTURE_GETTER(9);
    2567             : #undef INSTALL_CAPTURE_GETTER
    2568             :     }
    2569             : 
    2570             :     DCHECK(regexp_fun->has_initial_map());
    2571             :     Handle<Map> initial_map(regexp_fun->initial_map());
    2572             : 
    2573             :     DCHECK_EQ(1, initial_map->GetInObjectProperties());
    2574             : 
    2575          61 :     Map::EnsureDescriptorSlack(initial_map, 1);
    2576             : 
    2577             :     // ECMA-262, section 15.10.7.5.
    2578             :     PropertyAttributes writable =
    2579             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
    2580             :     Descriptor d = Descriptor::DataField(factory->lastIndex_string(),
    2581             :                                          JSRegExp::kLastIndexFieldIndex,
    2582          61 :                                          writable, Representation::Tagged());
    2583          61 :     initial_map->AppendDescriptor(&d);
    2584             : 
    2585             :     {  // Internal: RegExpInternalMatch
    2586             :       Handle<JSFunction> function =
    2587             :           SimpleCreateFunction(isolate, isolate->factory()->empty_string(),
    2588          61 :                                Builtins::kRegExpInternalMatch, 2, true);
    2589          61 :       native_context()->set(Context::REGEXP_INTERNAL_MATCH, *function);
    2590             :     }
    2591             : 
    2592             :     // Create the last match info. One for external use, and one for internal
    2593             :     // use when we don't want to modify the externally visible match info.
    2594          61 :     Handle<RegExpMatchInfo> last_match_info = factory->NewRegExpMatchInfo();
    2595             :     native_context()->set_regexp_last_match_info(*last_match_info);
    2596          61 :     Handle<RegExpMatchInfo> internal_match_info = factory->NewRegExpMatchInfo();
    2597             :     native_context()->set_regexp_internal_match_info(*internal_match_info);
    2598             : 
    2599             :     // Force the RegExp constructor to fast properties, so that we can use the
    2600             :     // fast paths for various things like
    2601             :     //
    2602             :     //   x instanceof RegExp
    2603             :     //
    2604             :     // etc. We should probably come up with a more principled approach once
    2605             :     // the JavaScript builtins are gone.
    2606          61 :     JSObject::MigrateSlowToFast(regexp_fun, 0, "Bootstrapping");
    2607             :   }
    2608             : 
    2609             :   {  // -- E r r o r
    2610             :     InstallError(isolate, global, factory->Error_string(),
    2611          61 :                  Context::ERROR_FUNCTION_INDEX);
    2612             :     InstallMakeError(isolate, BUILTIN_CODE(isolate, MakeError),
    2613          61 :                      Context::MAKE_ERROR_INDEX);
    2614             :   }
    2615             : 
    2616             :   {  // -- E v a l E r r o r
    2617             :     InstallError(isolate, global, factory->EvalError_string(),
    2618          61 :                  Context::EVAL_ERROR_FUNCTION_INDEX);
    2619             :   }
    2620             : 
    2621             :   {  // -- R a n g e E r r o r
    2622             :     InstallError(isolate, global, factory->RangeError_string(),
    2623          61 :                  Context::RANGE_ERROR_FUNCTION_INDEX);
    2624             :     InstallMakeError(isolate, BUILTIN_CODE(isolate, MakeRangeError),
    2625          61 :                      Context::MAKE_RANGE_ERROR_INDEX);
    2626             :   }
    2627             : 
    2628             :   {  // -- R e f e r e n c e E r r o r
    2629             :     InstallError(isolate, global, factory->ReferenceError_string(),
    2630          61 :                  Context::REFERENCE_ERROR_FUNCTION_INDEX);
    2631             :   }
    2632             : 
    2633             :   {  // -- S y n t a x E r r o r
    2634             :     InstallError(isolate, global, factory->SyntaxError_string(),
    2635          61 :                  Context::SYNTAX_ERROR_FUNCTION_INDEX);
    2636             :     InstallMakeError(isolate, BUILTIN_CODE(isolate, MakeSyntaxError),
    2637          61 :                      Context::MAKE_SYNTAX_ERROR_INDEX);
    2638             :   }
    2639             : 
    2640             :   {  // -- T y p e E r r o r
    2641             :     InstallError(isolate, global, factory->TypeError_string(),
    2642          61 :                  Context::TYPE_ERROR_FUNCTION_INDEX);
    2643             :     InstallMakeError(isolate, BUILTIN_CODE(isolate, MakeTypeError),
    2644          61 :                      Context::MAKE_TYPE_ERROR_INDEX);
    2645             :   }
    2646             : 
    2647             :   {  // -- U R I E r r o r
    2648             :     InstallError(isolate, global, factory->URIError_string(),
    2649          61 :                  Context::URI_ERROR_FUNCTION_INDEX);
    2650             :     InstallMakeError(isolate, BUILTIN_CODE(isolate, MakeURIError),
    2651          61 :                      Context::MAKE_URI_ERROR_INDEX);
    2652             :   }
    2653             : 
    2654             :   {  // -- C o m p i l e E r r o r
    2655          61 :     Handle<JSObject> dummy = factory->NewJSObject(isolate->object_function());
    2656             :     InstallError(isolate, dummy, factory->CompileError_string(),
    2657          61 :                  Context::WASM_COMPILE_ERROR_FUNCTION_INDEX);
    2658             : 
    2659             :     // -- L i n k E r r o r
    2660             :     InstallError(isolate, dummy, factory->LinkError_string(),
    2661          61 :                  Context::WASM_LINK_ERROR_FUNCTION_INDEX);
    2662             : 
    2663             :     // -- R u n t i m e E r r o r
    2664             :     InstallError(isolate, dummy, factory->RuntimeError_string(),
    2665          61 :                  Context::WASM_RUNTIME_ERROR_FUNCTION_INDEX);
    2666             :   }
    2667             : 
    2668             :   // Initialize the embedder data slot.
    2669          61 :   Handle<FixedArray> embedder_data = factory->NewFixedArray(3);
    2670             :   native_context()->set_embedder_data(*embedder_data);
    2671             : 
    2672             :   {  // -- J S O N
    2673          61 :     Handle<String> name = factory->InternalizeUtf8String("JSON");
    2674             :     Handle<JSObject> json_object =
    2675          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2676          61 :     JSObject::AddProperty(global, name, json_object, DONT_ENUM);
    2677          61 :     SimpleInstallFunction(json_object, "parse", Builtins::kJsonParse, 2, false);
    2678             :     SimpleInstallFunction(json_object, "stringify", Builtins::kJsonStringify, 3,
    2679          61 :                           true);
    2680             :     JSObject::AddProperty(
    2681             :         json_object, factory->to_string_tag_symbol(),
    2682             :         factory->NewStringFromAsciiChecked("JSON"),
    2683         122 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2684             :   }
    2685             : 
    2686             :   {  // -- M a t h
    2687          61 :     Handle<String> name = factory->InternalizeUtf8String("Math");
    2688             :     Handle<JSObject> math =
    2689          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2690          61 :     JSObject::AddProperty(global, name, math, DONT_ENUM);
    2691          61 :     SimpleInstallFunction(math, "abs", Builtins::kMathAbs, 1, true);
    2692          61 :     SimpleInstallFunction(math, "acos", Builtins::kMathAcos, 1, true);
    2693          61 :     SimpleInstallFunction(math, "acosh", Builtins::kMathAcosh, 1, true);
    2694          61 :     SimpleInstallFunction(math, "asin", Builtins::kMathAsin, 1, true);
    2695          61 :     SimpleInstallFunction(math, "asinh", Builtins::kMathAsinh, 1, true);
    2696          61 :     SimpleInstallFunction(math, "atan", Builtins::kMathAtan, 1, true);
    2697          61 :     SimpleInstallFunction(math, "atanh", Builtins::kMathAtanh, 1, true);
    2698          61 :     SimpleInstallFunction(math, "atan2", Builtins::kMathAtan2, 2, true);
    2699          61 :     SimpleInstallFunction(math, "ceil", Builtins::kMathCeil, 1, true);
    2700          61 :     SimpleInstallFunction(math, "cbrt", Builtins::kMathCbrt, 1, true);
    2701          61 :     SimpleInstallFunction(math, "expm1", Builtins::kMathExpm1, 1, true);
    2702          61 :     SimpleInstallFunction(math, "clz32", Builtins::kMathClz32, 1, true);
    2703          61 :     SimpleInstallFunction(math, "cos", Builtins::kMathCos, 1, true);
    2704          61 :     SimpleInstallFunction(math, "cosh", Builtins::kMathCosh, 1, true);
    2705          61 :     SimpleInstallFunction(math, "exp", Builtins::kMathExp, 1, true);
    2706             :     Handle<JSFunction> math_floor =
    2707          61 :         SimpleInstallFunction(math, "floor", Builtins::kMathFloor, 1, true);
    2708             :     native_context()->set_math_floor(*math_floor);
    2709          61 :     SimpleInstallFunction(math, "fround", Builtins::kMathFround, 1, true);
    2710          61 :     SimpleInstallFunction(math, "hypot", Builtins::kMathHypot, 2, false);
    2711          61 :     SimpleInstallFunction(math, "imul", Builtins::kMathImul, 2, true);
    2712          61 :     SimpleInstallFunction(math, "log", Builtins::kMathLog, 1, true);
    2713          61 :     SimpleInstallFunction(math, "log1p", Builtins::kMathLog1p, 1, true);
    2714          61 :     SimpleInstallFunction(math, "log2", Builtins::kMathLog2, 1, true);
    2715          61 :     SimpleInstallFunction(math, "log10", Builtins::kMathLog10, 1, true);
    2716          61 :     SimpleInstallFunction(math, "max", Builtins::kMathMax, 2, false);
    2717          61 :     SimpleInstallFunction(math, "min", Builtins::kMathMin, 2, false);
    2718             :     Handle<JSFunction> math_pow =
    2719          61 :         SimpleInstallFunction(math, "pow", Builtins::kMathPow, 2, true);
    2720             :     native_context()->set_math_pow(*math_pow);
    2721          61 :     SimpleInstallFunction(math, "random", Builtins::kMathRandom, 0, true);
    2722          61 :     SimpleInstallFunction(math, "round", Builtins::kMathRound, 1, true);
    2723          61 :     SimpleInstallFunction(math, "sign", Builtins::kMathSign, 1, true);
    2724          61 :     SimpleInstallFunction(math, "sin", Builtins::kMathSin, 1, true);
    2725          61 :     SimpleInstallFunction(math, "sinh", Builtins::kMathSinh, 1, true);
    2726          61 :     SimpleInstallFunction(math, "sqrt", Builtins::kMathSqrt, 1, true);
    2727          61 :     SimpleInstallFunction(math, "tan", Builtins::kMathTan, 1, true);
    2728          61 :     SimpleInstallFunction(math, "tanh", Builtins::kMathTanh, 1, true);
    2729          61 :     SimpleInstallFunction(math, "trunc", Builtins::kMathTrunc, 1, true);
    2730             : 
    2731             :     // Install math constants.
    2732          61 :     double const kE = base::ieee754::exp(1.0);
    2733             :     double const kPI = 3.1415926535897932;
    2734          61 :     InstallConstant(isolate, math, "E", factory->NewNumber(kE));
    2735             :     InstallConstant(isolate, math, "LN10",
    2736          61 :                     factory->NewNumber(base::ieee754::log(10.0)));
    2737             :     InstallConstant(isolate, math, "LN2",
    2738          61 :                     factory->NewNumber(base::ieee754::log(2.0)));
    2739             :     InstallConstant(isolate, math, "LOG10E",
    2740          61 :                     factory->NewNumber(base::ieee754::log10(kE)));
    2741             :     InstallConstant(isolate, math, "LOG2E",
    2742          61 :                     factory->NewNumber(base::ieee754::log2(kE)));
    2743          61 :     InstallConstant(isolate, math, "PI", factory->NewNumber(kPI));
    2744             :     InstallConstant(isolate, math, "SQRT1_2",
    2745          61 :                     factory->NewNumber(std::sqrt(0.5)));
    2746          61 :     InstallConstant(isolate, math, "SQRT2", factory->NewNumber(std::sqrt(2.0)));
    2747             :     JSObject::AddProperty(
    2748             :         math, factory->to_string_tag_symbol(),
    2749             :         factory->NewStringFromAsciiChecked("Math"),
    2750         122 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2751             :   }
    2752             : 
    2753             :   {  // -- C o n s o l e
    2754          61 :     Handle<String> name = factory->InternalizeUtf8String("console");
    2755             :     Handle<JSFunction> cons = factory->NewFunction(
    2756          61 :         isolate->strict_function_map(), name, MaybeHandle<Code>());
    2757          61 :     Handle<JSObject> empty = factory->NewJSObject(isolate->object_function());
    2758          61 :     JSFunction::SetPrototype(cons, empty);
    2759          61 :     Handle<JSObject> console = factory->NewJSObject(cons, TENURED);
    2760             :     DCHECK(console->IsJSObject());
    2761          61 :     JSObject::AddProperty(global, name, console, DONT_ENUM);
    2762             :     SimpleInstallFunction(console, "debug", Builtins::kConsoleDebug, 1, false,
    2763          61 :                           NONE);
    2764             :     SimpleInstallFunction(console, "error", Builtins::kConsoleError, 1, false,
    2765          61 :                           NONE);
    2766             :     SimpleInstallFunction(console, "info", Builtins::kConsoleInfo, 1, false,
    2767          61 :                           NONE);
    2768             :     SimpleInstallFunction(console, "log", Builtins::kConsoleLog, 1, false,
    2769          61 :                           NONE);
    2770             :     SimpleInstallFunction(console, "warn", Builtins::kConsoleWarn, 1, false,
    2771          61 :                           NONE);
    2772             :     SimpleInstallFunction(console, "dir", Builtins::kConsoleDir, 1, false,
    2773          61 :                           NONE);
    2774             :     SimpleInstallFunction(console, "dirxml", Builtins::kConsoleDirXml, 1, false,
    2775          61 :                           NONE);
    2776             :     SimpleInstallFunction(console, "table", Builtins::kConsoleTable, 1, false,
    2777          61 :                           NONE);
    2778             :     SimpleInstallFunction(console, "trace", Builtins::kConsoleTrace, 1, false,
    2779          61 :                           NONE);
    2780             :     SimpleInstallFunction(console, "group", Builtins::kConsoleGroup, 1, false,
    2781          61 :                           NONE);
    2782             :     SimpleInstallFunction(console, "groupCollapsed",
    2783          61 :                           Builtins::kConsoleGroupCollapsed, 1, false, NONE);
    2784             :     SimpleInstallFunction(console, "groupEnd", Builtins::kConsoleGroupEnd, 1,
    2785          61 :                           false, NONE);
    2786             :     SimpleInstallFunction(console, "clear", Builtins::kConsoleClear, 1, false,
    2787          61 :                           NONE);
    2788             :     SimpleInstallFunction(console, "count", Builtins::kConsoleCount, 1, false,
    2789          61 :                           NONE);
    2790             :     SimpleInstallFunction(console, "assert", Builtins::kFastConsoleAssert, 1,
    2791          61 :                           false, NONE);
    2792             :     SimpleInstallFunction(console, "markTimeline",
    2793          61 :                           Builtins::kConsoleMarkTimeline, 1, false, NONE);
    2794             :     SimpleInstallFunction(console, "profile", Builtins::kConsoleProfile, 1,
    2795          61 :                           false, NONE);
    2796             :     SimpleInstallFunction(console, "profileEnd", Builtins::kConsoleProfileEnd,
    2797          61 :                           1, false, NONE);
    2798             :     SimpleInstallFunction(console, "timeline", Builtins::kConsoleTimeline, 1,
    2799          61 :                           false, NONE);
    2800             :     SimpleInstallFunction(console, "timelineEnd", Builtins::kConsoleTimelineEnd,
    2801          61 :                           1, false, NONE);
    2802             :     SimpleInstallFunction(console, "time", Builtins::kConsoleTime, 1, false,
    2803          61 :                           NONE);
    2804             :     SimpleInstallFunction(console, "timeEnd", Builtins::kConsoleTimeEnd, 1,
    2805          61 :                           false, NONE);
    2806             :     SimpleInstallFunction(console, "timeStamp", Builtins::kConsoleTimeStamp, 1,
    2807          61 :                           false, NONE);
    2808             :     SimpleInstallFunction(console, "context", Builtins::kConsoleContext, 1,
    2809          61 :                           true, NONE);
    2810             :     JSObject::AddProperty(
    2811             :         console, factory->to_string_tag_symbol(),
    2812             :         factory->NewStringFromAsciiChecked("Object"),
    2813         122 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2814             :   }
    2815             : 
    2816             : #ifdef V8_INTL_SUPPORT
    2817             :   {  // -- I n t l
    2818          61 :     Handle<String> name = factory->InternalizeUtf8String("Intl");
    2819             :     Handle<JSObject> intl =
    2820          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2821          61 :     JSObject::AddProperty(global, name, intl, DONT_ENUM);
    2822             : 
    2823             :     {
    2824             :       Handle<JSFunction> date_time_format_constructor = InstallFunction(
    2825             :           intl, "DateTimeFormat", JS_OBJECT_TYPE, DateFormat::kSize, 0,
    2826          61 :           factory->the_hole_value(), Builtins::kIllegal);
    2827             :       native_context()->set_intl_date_time_format_function(
    2828             :           *date_time_format_constructor);
    2829             : 
    2830             :       Handle<JSObject> prototype(
    2831          61 :           JSObject::cast(date_time_format_constructor->prototype()), isolate);
    2832             : 
    2833             :       // Install the @@toStringTag property on the {prototype}.
    2834             :       JSObject::AddProperty(
    2835             :           prototype, factory->to_string_tag_symbol(), factory->Object_string(),
    2836          61 :           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2837             :     }
    2838             : 
    2839             :     {
    2840             :       Handle<JSFunction> number_format_constructor = InstallFunction(
    2841             :           intl, "NumberFormat", JS_OBJECT_TYPE, NumberFormat::kSize, 0,
    2842          61 :           factory->the_hole_value(), Builtins::kIllegal);
    2843             :       native_context()->set_intl_number_format_function(
    2844             :           *number_format_constructor);
    2845             : 
    2846             :       Handle<JSObject> prototype(
    2847          61 :           JSObject::cast(number_format_constructor->prototype()), isolate);
    2848             : 
    2849             :       // Install the @@toStringTag property on the {prototype}.
    2850             :       JSObject::AddProperty(
    2851             :           prototype, factory->to_string_tag_symbol(), factory->Object_string(),
    2852          61 :           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2853             :     }
    2854             : 
    2855             :     {
    2856             :       Handle<JSFunction> collator_constructor =
    2857             :           InstallFunction(intl, "Collator", JS_OBJECT_TYPE, Collator::kSize, 0,
    2858          61 :                           factory->the_hole_value(), Builtins::kIllegal);
    2859             :       native_context()->set_intl_collator_function(*collator_constructor);
    2860             : 
    2861             :       Handle<JSObject> prototype(
    2862          61 :           JSObject::cast(collator_constructor->prototype()), isolate);
    2863             : 
    2864             :       // Install the @@toStringTag property on the {prototype}.
    2865             :       JSObject::AddProperty(
    2866             :           prototype, factory->to_string_tag_symbol(), factory->Object_string(),
    2867          61 :           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2868             :     }
    2869             : 
    2870             :     {
    2871             :       Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
    2872             :           intl, "v8BreakIterator", JS_OBJECT_TYPE, V8BreakIterator::kSize, 0,
    2873          61 :           factory->the_hole_value(), Builtins::kIllegal);
    2874             :       native_context()->set_intl_v8_break_iterator_function(
    2875             :           *v8_break_iterator_constructor);
    2876             : 
    2877             :       Handle<JSObject> prototype(
    2878          61 :           JSObject::cast(v8_break_iterator_constructor->prototype()), isolate);
    2879             : 
    2880             :       // Install the @@toStringTag property on the {prototype}.
    2881             :       JSObject::AddProperty(
    2882             :           prototype, factory->to_string_tag_symbol(), factory->Object_string(),
    2883          61 :           static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2884             :     }
    2885             :   }
    2886             : #endif  // V8_INTL_SUPPORT
    2887             : 
    2888             :   {  // -- A r r a y B u f f e r
    2889          61 :     Handle<String> name = factory->InternalizeUtf8String("ArrayBuffer");
    2890             :     Handle<JSFunction> array_buffer_fun =
    2891             :         CreateArrayBuffer(name, Builtins::kArrayBufferPrototypeGetByteLength,
    2892             :                           BuiltinFunctionId::kArrayBufferByteLength,
    2893          61 :                           Builtins::kArrayBufferPrototypeSlice);
    2894          61 :     JSObject::AddProperty(global, name, array_buffer_fun, DONT_ENUM);
    2895             :     InstallWithIntrinsicDefaultProto(isolate, array_buffer_fun,
    2896          61 :                                      Context::ARRAY_BUFFER_FUN_INDEX);
    2897          61 :     InstallSpeciesGetter(array_buffer_fun);
    2898             : 
    2899             :     Handle<JSFunction> array_buffer_noinit_fun = SimpleCreateFunction(
    2900             :         isolate,
    2901             :         factory->NewStringFromAsciiChecked(
    2902             :             "arrayBufferConstructor_DoNotInitialize"),
    2903          61 :         Builtins::kArrayBufferConstructor_DoNotInitialize, 1, false);
    2904             :     native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun);
    2905             :   }
    2906             : 
    2907             :   {  // -- S h a r e d A r r a y B u f f e r
    2908          61 :     Handle<String> name = factory->InternalizeUtf8String("SharedArrayBuffer");
    2909             :     Handle<JSFunction> shared_array_buffer_fun = CreateArrayBuffer(
    2910             :         name, Builtins::kSharedArrayBufferPrototypeGetByteLength,
    2911             :         BuiltinFunctionId::kSharedArrayBufferByteLength,
    2912          61 :         Builtins::kSharedArrayBufferPrototypeSlice);
    2913             :     InstallWithIntrinsicDefaultProto(isolate, shared_array_buffer_fun,
    2914          61 :                                      Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
    2915          61 :     InstallSpeciesGetter(shared_array_buffer_fun);
    2916             :   }
    2917             : 
    2918             :   {  // -- A t o m i c s
    2919             :     Handle<JSObject> atomics_object =
    2920          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    2921             :     native_context()->set_atomics_object(*atomics_object);
    2922             : 
    2923             :     SimpleInstallFunction(atomics_object, "load", Builtins::kAtomicsLoad, 2,
    2924          61 :                           true);
    2925             :     SimpleInstallFunction(atomics_object, "store", Builtins::kAtomicsStore, 3,
    2926          61 :                           true);
    2927             :     SimpleInstallFunction(atomics_object, "add", Builtins::kAtomicsAdd, 3,
    2928          61 :                           true);
    2929             :     SimpleInstallFunction(atomics_object, "sub", Builtins::kAtomicsSub, 3,
    2930          61 :                           true);
    2931             :     SimpleInstallFunction(atomics_object, "and", Builtins::kAtomicsAnd, 3,
    2932          61 :                           true);
    2933          61 :     SimpleInstallFunction(atomics_object, "or", Builtins::kAtomicsOr, 3, true);
    2934             :     SimpleInstallFunction(atomics_object, "xor", Builtins::kAtomicsXor, 3,
    2935          61 :                           true);
    2936             :     SimpleInstallFunction(atomics_object, "exchange",
    2937          61 :                           Builtins::kAtomicsExchange, 3, true);
    2938             :     SimpleInstallFunction(atomics_object, "compareExchange",
    2939          61 :                           Builtins::kAtomicsCompareExchange, 4, true);
    2940             :     SimpleInstallFunction(atomics_object, "isLockFree",
    2941          61 :                           Builtins::kAtomicsIsLockFree, 1, true);
    2942             :     SimpleInstallFunction(atomics_object, "wait", Builtins::kAtomicsWait, 4,
    2943          61 :                           true);
    2944             :     SimpleInstallFunction(atomics_object, "wake", Builtins::kAtomicsWake, 3,
    2945          61 :                           true);
    2946             :   }
    2947             : 
    2948             :   {  // -- T y p e d A r r a y
    2949             :     Handle<JSFunction> typed_array_fun =
    2950             :         CreateFunction(isolate, factory->InternalizeUtf8String("TypedArray"),
    2951             :                        JS_TYPED_ARRAY_TYPE, JSTypedArray::kSize, 0,
    2952          61 :                        factory->the_hole_value(), Builtins::kIllegal);
    2953             :     typed_array_fun->shared()->set_native(false);
    2954          61 :     InstallSpeciesGetter(typed_array_fun);
    2955             :     native_context()->set_typed_array_function(*typed_array_fun);
    2956             : 
    2957             :     // Setup %TypedArrayPrototype%.
    2958             :     Handle<JSObject> prototype(
    2959             :         JSObject::cast(typed_array_fun->instance_prototype()));
    2960             :     native_context()->set_typed_array_prototype(*prototype);
    2961             : 
    2962             :     // Install the "buffer", "byteOffset", "byteLength", "length"
    2963             :     // and @@toStringTag getters on the {prototype}.
    2964             :     SimpleInstallGetter(prototype, factory->buffer_string(),
    2965          61 :                         Builtins::kTypedArrayPrototypeBuffer, false);
    2966             :     SimpleInstallGetter(prototype, factory->byte_length_string(),
    2967             :                         Builtins::kTypedArrayPrototypeByteLength, true,
    2968          61 :                         kTypedArrayByteLength);
    2969             :     SimpleInstallGetter(prototype, factory->byte_offset_string(),
    2970             :                         Builtins::kTypedArrayPrototypeByteOffset, true,
    2971          61 :                         kTypedArrayByteOffset);
    2972             :     SimpleInstallGetter(prototype, factory->length_string(),
    2973             :                         Builtins::kTypedArrayPrototypeLength, true,
    2974          61 :                         kTypedArrayLength);
    2975             :     SimpleInstallGetter(prototype, factory->to_string_tag_symbol(),
    2976             :                         Builtins::kTypedArrayPrototypeToStringTag, true,
    2977          61 :                         kTypedArrayToStringTag);
    2978             : 
    2979             :     // Install "keys", "values" and "entries" methods on the {prototype}.
    2980             :     SimpleInstallFunction(prototype, "entries",
    2981             :                           Builtins::kTypedArrayPrototypeEntries, 0, true,
    2982          61 :                           kTypedArrayEntries);
    2983             : 
    2984             :     SimpleInstallFunction(prototype, "keys", Builtins::kTypedArrayPrototypeKeys,
    2985          61 :                           0, true, kTypedArrayKeys);
    2986             : 
    2987             :     Handle<JSFunction> values = SimpleInstallFunction(
    2988             :         prototype, "values", Builtins::kTypedArrayPrototypeValues, 0, true,
    2989          61 :         kTypedArrayValues);
    2990             :     JSObject::AddProperty(prototype, factory->iterator_symbol(), values,
    2991          61 :                           DONT_ENUM);
    2992             : 
    2993             :     // TODO(caitp): alphasort accessors/methods
    2994             :     SimpleInstallFunction(prototype, "copyWithin",
    2995          61 :                           Builtins::kTypedArrayPrototypeCopyWithin, 2, false);
    2996             :     SimpleInstallFunction(prototype, "every",
    2997          61 :                           Builtins::kTypedArrayPrototypeEvery, 1, false);
    2998             :     SimpleInstallFunction(prototype, "fill",
    2999          61 :                           Builtins::kTypedArrayPrototypeFill, 1, false);
    3000             :     SimpleInstallFunction(prototype, "forEach",
    3001          61 :                           Builtins::kTypedArrayPrototypeForEach, 1, false);
    3002             :     SimpleInstallFunction(prototype, "includes",
    3003          61 :                           Builtins::kTypedArrayPrototypeIncludes, 1, false);
    3004             :     SimpleInstallFunction(prototype, "indexOf",
    3005          61 :                           Builtins::kTypedArrayPrototypeIndexOf, 1, false);
    3006             :     SimpleInstallFunction(prototype, "lastIndexOf",
    3007          61 :                           Builtins::kTypedArrayPrototypeLastIndexOf, 1, false);
    3008             :     SimpleInstallFunction(prototype, "map", Builtins::kTypedArrayPrototypeMap,
    3009          61 :                           1, false);
    3010             :     SimpleInstallFunction(prototype, "reverse",
    3011          61 :                           Builtins::kTypedArrayPrototypeReverse, 0, false);
    3012             :     SimpleInstallFunction(prototype, "reduce",
    3013          61 :                           Builtins::kTypedArrayPrototypeReduce, 1, false);
    3014             :     SimpleInstallFunction(prototype, "reduceRight",
    3015          61 :                           Builtins::kTypedArrayPrototypeReduceRight, 1, false);
    3016             :     SimpleInstallFunction(prototype, "set", Builtins::kTypedArrayPrototypeSet,
    3017          61 :                           1, false);
    3018             :     SimpleInstallFunction(prototype, "slice",
    3019          61 :                           Builtins::kTypedArrayPrototypeSlice, 2, false);
    3020             :     SimpleInstallFunction(prototype, "some", Builtins::kTypedArrayPrototypeSome,
    3021          61 :                           1, false);
    3022             :   }
    3023             : 
    3024             :   {  // -- T y p e d A r r a y s
    3025             : #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype, size)             \
    3026             :   {                                                                    \
    3027             :     Handle<JSFunction> fun;                                            \
    3028             :     InstallTypedArray(#Type "Array", TYPE##_ELEMENTS, &fun);           \
    3029             :     InstallWithIntrinsicDefaultProto(isolate, fun,                     \
    3030             :                                      Context::TYPE##_ARRAY_FUN_INDEX); \
    3031             :   }
    3032         549 :     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
    3033             : #undef INSTALL_TYPED_ARRAY
    3034             : 
    3035             :     // %typed_array_construct_by_length
    3036             :     Handle<JSFunction> construct_by_length = SimpleCreateFunction(
    3037             :         isolate,
    3038             :         factory->NewStringFromAsciiChecked("typedArrayConstructByLength"),
    3039          61 :         Builtins::kTypedArrayConstructByLength, 3, false);
    3040             :     native_context()->set_typed_array_construct_by_length(*construct_by_length);
    3041             : 
    3042             :     // %typed_array_construct_by_array_buffer
    3043             :     Handle<JSFunction> construct_by_buffer = SimpleCreateFunction(
    3044             :         isolate,
    3045             :         factory->NewStringFromAsciiChecked("typedArrayConstructByArrayBuffer"),
    3046          61 :         Builtins::kTypedArrayConstructByArrayBuffer, 5, false);
    3047             :     native_context()->set_typed_array_construct_by_array_buffer(
    3048             :         *construct_by_buffer);
    3049             : 
    3050             :     // %typed_array_construct_by_array_like
    3051             :     Handle<JSFunction> construct_by_array_like = SimpleCreateFunction(
    3052             :         isolate,
    3053             :         factory->NewStringFromAsciiChecked("typedArrayConstructByArrayLike"),
    3054          61 :         Builtins::kTypedArrayConstructByArrayLike, 4, false);
    3055             :     native_context()->set_typed_array_construct_by_array_like(
    3056             :         *construct_by_array_like);
    3057             :   }
    3058             : 
    3059             :   {  // -- D a t a V i e w
    3060             :     Handle<JSFunction> data_view_fun = InstallFunction(
    3061             :         global, "DataView", JS_DATA_VIEW_TYPE,
    3062             :         JSDataView::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    3063          61 :         Builtins::kDataViewConstructor);
    3064             :     InstallWithIntrinsicDefaultProto(isolate, data_view_fun,
    3065          61 :                                      Context::DATA_VIEW_FUN_INDEX);
    3066             :     data_view_fun->shared()->SetConstructStub(
    3067         122 :         *BUILTIN_CODE(isolate, DataViewConstructor_ConstructStub));
    3068             :     data_view_fun->shared()->set_length(3);
    3069             :     data_view_fun->shared()->DontAdaptArguments();
    3070             : 
    3071             :     // Setup %DataViewPrototype%.
    3072             :     Handle<JSObject> prototype(
    3073             :         JSObject::cast(data_view_fun->instance_prototype()));
    3074             : 
    3075             :     // Install the @@toStringTag property on the {prototype}.
    3076             :     JSObject::AddProperty(
    3077             :         prototype, factory->to_string_tag_symbol(),
    3078             :         factory->NewStringFromAsciiChecked("DataView"),
    3079         122 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3080             : 
    3081             :     // Install the "buffer", "byteOffset" and "byteLength" getters
    3082             :     // on the {prototype}.
    3083             :     SimpleInstallGetter(prototype, factory->buffer_string(),
    3084             :                         Builtins::kDataViewPrototypeGetBuffer, false,
    3085          61 :                         kDataViewBuffer);
    3086             :     SimpleInstallGetter(prototype, factory->byte_length_string(),
    3087             :                         Builtins::kDataViewPrototypeGetByteLength, false,
    3088          61 :                         kDataViewByteLength);
    3089             :     SimpleInstallGetter(prototype, factory->byte_offset_string(),
    3090             :                         Builtins::kDataViewPrototypeGetByteOffset, false,
    3091          61 :                         kDataViewByteOffset);
    3092             : 
    3093             :     SimpleInstallFunction(prototype, "getInt8",
    3094          61 :                           Builtins::kDataViewPrototypeGetInt8, 1, false);
    3095             :     SimpleInstallFunction(prototype, "setInt8",
    3096          61 :                           Builtins::kDataViewPrototypeSetInt8, 2, false);
    3097             :     SimpleInstallFunction(prototype, "getUint8",
    3098          61 :                           Builtins::kDataViewPrototypeGetUint8, 1, false);
    3099             :     SimpleInstallFunction(prototype, "setUint8",
    3100          61 :                           Builtins::kDataViewPrototypeSetUint8, 2, false);
    3101             :     SimpleInstallFunction(prototype, "getInt16",
    3102          61 :                           Builtins::kDataViewPrototypeGetInt16, 1, false);
    3103             :     SimpleInstallFunction(prototype, "setInt16",
    3104          61 :                           Builtins::kDataViewPrototypeSetInt16, 2, false);
    3105             :     SimpleInstallFunction(prototype, "getUint16",
    3106          61 :                           Builtins::kDataViewPrototypeGetUint16, 1, false);
    3107             :     SimpleInstallFunction(prototype, "setUint16",
    3108          61 :                           Builtins::kDataViewPrototypeSetUint16, 2, false);
    3109             :     SimpleInstallFunction(prototype, "getInt32",
    3110          61 :                           Builtins::kDataViewPrototypeGetInt32, 1, false);
    3111             :     SimpleInstallFunction(prototype, "setInt32",
    3112          61 :                           Builtins::kDataViewPrototypeSetInt32, 2, false);
    3113             :     SimpleInstallFunction(prototype, "getUint32",
    3114          61 :                           Builtins::kDataViewPrototypeGetUint32, 1, false);
    3115             :     SimpleInstallFunction(prototype, "setUint32",
    3116          61 :                           Builtins::kDataViewPrototypeSetUint32, 2, false);
    3117             :     SimpleInstallFunction(prototype, "getFloat32",
    3118          61 :                           Builtins::kDataViewPrototypeGetFloat32, 1, false);
    3119             :     SimpleInstallFunction(prototype, "setFloat32",
    3120          61 :                           Builtins::kDataViewPrototypeSetFloat32, 2, false);
    3121             :     SimpleInstallFunction(prototype, "getFloat64",
    3122          61 :                           Builtins::kDataViewPrototypeGetFloat64, 1, false);
    3123             :     SimpleInstallFunction(prototype, "setFloat64",
    3124          61 :                           Builtins::kDataViewPrototypeSetFloat64, 2, false);
    3125             :   }
    3126             : 
    3127             :   {  // -- M a p
    3128             :     {
    3129             :       Handle<String> index_string = isolate->factory()->zero_string();
    3130             :       uint32_t field =
    3131          61 :           StringHasher::MakeArrayIndexHash(0, index_string->length());
    3132             :       index_string->set_hash_field(field);
    3133             : 
    3134             :       index_string = isolate->factory()->one_string();
    3135          61 :       field = StringHasher::MakeArrayIndexHash(1, index_string->length());
    3136             :       index_string->set_hash_field(field);
    3137             :     }
    3138             : 
    3139             :     Handle<JSFunction> js_map_fun =
    3140             :         InstallFunction(global, "Map", JS_MAP_TYPE, JSMap::kSize, 0,
    3141          61 :                         factory->the_hole_value(), Builtins::kMapConstructor);
    3142             :     InstallWithIntrinsicDefaultProto(isolate, js_map_fun,
    3143          61 :                                      Context::JS_MAP_FUN_INDEX);
    3144             : 
    3145             :     Handle<SharedFunctionInfo> shared(js_map_fun->shared(), isolate);
    3146         122 :     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
    3147         122 :     shared->set_instance_class_name(isolate->heap()->Map_string());
    3148             :     shared->DontAdaptArguments();
    3149             :     shared->set_length(0);
    3150             : 
    3151             :     // Setup %MapPrototype%.
    3152             :     Handle<JSObject> prototype(
    3153             :         JSObject::cast(js_map_fun->instance_prototype()));
    3154             : 
    3155             :     // Install the @@toStringTag property on the {prototype}.
    3156             :     JSObject::AddProperty(
    3157             :         prototype, factory->to_string_tag_symbol(), factory->Map_string(),
    3158          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3159             : 
    3160             :     Handle<JSFunction> map_get = SimpleInstallFunction(
    3161          61 :         prototype, "get", Builtins::kMapPrototypeGet, 1, true);
    3162             :     native_context()->set_map_get(*map_get);
    3163             : 
    3164             :     Handle<JSFunction> map_set = SimpleInstallFunction(
    3165          61 :         prototype, "set", Builtins::kMapPrototypeSet, 2, true);
    3166             :     native_context()->set_map_set(*map_set);
    3167             : 
    3168             :     Handle<JSFunction> map_has = SimpleInstallFunction(
    3169          61 :         prototype, "has", Builtins::kMapPrototypeHas, 1, true);
    3170             :     native_context()->set_map_has(*map_has);
    3171             : 
    3172             :     Handle<JSFunction> map_delete = SimpleInstallFunction(
    3173          61 :         prototype, "delete", Builtins::kMapPrototypeDelete, 1, true);
    3174             :     native_context()->set_map_delete(*map_delete);
    3175             : 
    3176             :     SimpleInstallFunction(prototype, "clear", Builtins::kMapPrototypeClear, 0,
    3177          61 :                           true);
    3178             :     Handle<JSFunction> entries = SimpleInstallFunction(
    3179          61 :         prototype, "entries", Builtins::kMapPrototypeEntries, 0, true);
    3180             :     JSObject::AddProperty(prototype, factory->iterator_symbol(), entries,
    3181          61 :                           DONT_ENUM);
    3182             :     SimpleInstallFunction(prototype, "forEach", Builtins::kMapPrototypeForEach,
    3183          61 :                           1, false);
    3184             :     SimpleInstallFunction(prototype, "keys", Builtins::kMapPrototypeKeys, 0,
    3185          61 :                           true);
    3186             :     SimpleInstallGetter(prototype, factory->InternalizeUtf8String("size"),
    3187             :                         Builtins::kMapPrototypeGetSize, true,
    3188         122 :                         BuiltinFunctionId::kMapSize);
    3189             :     SimpleInstallFunction(prototype, "values", Builtins::kMapPrototypeValues, 0,
    3190          61 :                           true);
    3191          61 :     InstallSpeciesGetter(js_map_fun);
    3192             :   }
    3193             : 
    3194             :   {  // -- S e t
    3195             :     Handle<JSFunction> js_set_fun =
    3196             :         InstallFunction(global, "Set", JS_SET_TYPE, JSSet::kSize, 0,
    3197          61 :                         factory->the_hole_value(), Builtins::kSetConstructor);
    3198             :     InstallWithIntrinsicDefaultProto(isolate, js_set_fun,
    3199          61 :                                      Context::JS_SET_FUN_INDEX);
    3200             : 
    3201             :     Handle<SharedFunctionInfo> shared(js_set_fun->shared(), isolate);
    3202         122 :     shared->SetConstructStub(*BUILTIN_CODE(isolate, JSBuiltinsConstructStub));
    3203         122 :     shared->set_instance_class_name(isolate->heap()->Set_string());
    3204             :     shared->DontAdaptArguments();
    3205             :     shared->set_length(0);
    3206             : 
    3207             :     // Setup %SetPrototype%.
    3208             :     Handle<JSObject> prototype(
    3209             :         JSObject::cast(js_set_fun->instance_prototype()));
    3210             : 
    3211             :     // Install the @@toStringTag property on the {prototype}.
    3212             :     JSObject::AddProperty(
    3213             :         prototype, factory->to_string_tag_symbol(), factory->Set_string(),
    3214          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3215             : 
    3216             :     Handle<JSFunction> set_has = SimpleInstallFunction(
    3217          61 :         prototype, "has", Builtins::kSetPrototypeHas, 1, true);
    3218             :     native_context()->set_set_has(*set_has);
    3219             : 
    3220             :     Handle<JSFunction> set_add = SimpleInstallFunction(
    3221          61 :         prototype, "add", Builtins::kSetPrototypeAdd, 1, true);
    3222             :     native_context()->set_set_add(*set_add);
    3223             : 
    3224             :     Handle<JSFunction> set_delete = SimpleInstallFunction(
    3225          61 :         prototype, "delete", Builtins::kSetPrototypeDelete, 1, true);
    3226             :     native_context()->set_set_delete(*set_delete);
    3227             : 
    3228             :     SimpleInstallFunction(prototype, "clear", Builtins::kSetPrototypeClear, 0,
    3229          61 :                           true);
    3230             :     SimpleInstallFunction(prototype, "entries", Builtins::kSetPrototypeEntries,
    3231          61 :                           0, true);
    3232             :     SimpleInstallFunction(prototype, "forEach", Builtins::kSetPrototypeForEach,
    3233          61 :                           1, false);
    3234             :     SimpleInstallGetter(prototype, factory->InternalizeUtf8String("size"),
    3235             :                         Builtins::kSetPrototypeGetSize, true,
    3236         122 :                         BuiltinFunctionId::kSetSize);
    3237             :     Handle<JSFunction> values = SimpleInstallFunction(
    3238          61 :         prototype, "values", Builtins::kSetPrototypeValues, 0, true);
    3239          61 :     JSObject::AddProperty(prototype, factory->keys_string(), values, DONT_ENUM);
    3240             :     JSObject::AddProperty(prototype, factory->iterator_symbol(), values,
    3241          61 :                           DONT_ENUM);
    3242          61 :     InstallSpeciesGetter(js_set_fun);
    3243             :   }
    3244             : 
    3245             :   {  // -- J S M o d u l e N a m e s p a c e
    3246             :     Handle<Map> map = factory->NewMap(
    3247             :         JS_MODULE_NAMESPACE_TYPE, JSModuleNamespace::kSize,
    3248          61 :         TERMINAL_FAST_ELEMENTS_KIND, JSModuleNamespace::kInObjectFieldCount);
    3249          61 :     Map::SetPrototype(map, isolate->factory()->null_value());
    3250          61 :     Map::EnsureDescriptorSlack(map, 1);
    3251             :     native_context()->set_js_module_namespace_map(*map);
    3252             : 
    3253             :     {  // Install @@toStringTag.
    3254             :       PropertyAttributes attribs =
    3255             :           static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY);
    3256             :       Descriptor d =
    3257             :           Descriptor::DataField(factory->to_string_tag_symbol(),
    3258             :                                 JSModuleNamespace::kToStringTagFieldIndex,
    3259          61 :                                 attribs, Representation::Tagged());
    3260          61 :       map->AppendDescriptor(&d);
    3261             :     }
    3262             :   }
    3263             : 
    3264             :   {  // -- I t e r a t o r R e s u l t
    3265             :     Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSIteratorResult::kSize,
    3266          61 :                                       TERMINAL_FAST_ELEMENTS_KIND, 2);
    3267         122 :     Map::SetPrototype(map, isolate->initial_object_prototype());
    3268          61 :     Map::EnsureDescriptorSlack(map, 2);
    3269             : 
    3270             :     {  // value
    3271             :       Descriptor d = Descriptor::DataField(factory->value_string(),
    3272             :                                            JSIteratorResult::kValueIndex, NONE,
    3273          61 :                                            Representation::Tagged());
    3274          61 :       map->AppendDescriptor(&d);
    3275             :     }
    3276             : 
    3277             :     {  // done
    3278             :       Descriptor d = Descriptor::DataField(factory->done_string(),
    3279             :                                            JSIteratorResult::kDoneIndex, NONE,
    3280          61 :                                            Representation::Tagged());
    3281          61 :       map->AppendDescriptor(&d);
    3282             :     }
    3283             : 
    3284             :     map->SetConstructor(native_context()->object_function());
    3285             :     native_context()->set_iterator_result_map(*map);
    3286             :   }
    3287             : 
    3288             :   {  // -- W e a k M a p
    3289             :     Handle<JSFunction> cons =
    3290             :         InstallFunction(global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize,
    3291          61 :                         0, factory->the_hole_value(), Builtins::kIllegal);
    3292             :     InstallWithIntrinsicDefaultProto(isolate, cons,
    3293          61 :                                      Context::JS_WEAK_MAP_FUN_INDEX);
    3294             :     // Setup %WeakMapPrototype%.
    3295             :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()));
    3296             : 
    3297          61 :     SimpleInstallFunction(prototype, "get", Builtins::kWeakMapGet, 1, true);
    3298          61 :     SimpleInstallFunction(prototype, "has", Builtins::kWeakMapHas, 1, true);
    3299             : 
    3300             :     JSObject::AddProperty(
    3301             :         prototype, factory->to_string_tag_symbol(),
    3302             :         factory->NewStringFromAsciiChecked("WeakMap"),
    3303         122 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3304             :   }
    3305             : 
    3306             :   {  // -- W e a k S e t
    3307             :     Handle<JSFunction> cons =
    3308             :         InstallFunction(global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize,
    3309          61 :                         0, factory->the_hole_value(), Builtins::kIllegal);
    3310             :     InstallWithIntrinsicDefaultProto(isolate, cons,
    3311          61 :                                      Context::JS_WEAK_SET_FUN_INDEX);
    3312             :     // Setup %WeakSetPrototype%.
    3313             :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()));
    3314             : 
    3315          61 :     SimpleInstallFunction(prototype, "has", Builtins::kWeakSetHas, 1, true);
    3316             : 
    3317             :     JSObject::AddProperty(
    3318             :         prototype, factory->to_string_tag_symbol(),
    3319             :         factory->NewStringFromAsciiChecked("WeakSet"),
    3320         122 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3321             :   }
    3322             : 
    3323             :   {  // -- P r o x y
    3324          61 :     CreateJSProxyMaps();
    3325             : 
    3326             :     // Proxy function map has prototype slot for storing initial map but does
    3327             :     // not have a prototype property.
    3328             :     Handle<Map> proxy_function_map =
    3329          61 :         Map::Copy(isolate->strict_function_without_prototype_map(), "Proxy");
    3330             :     // Re-set the unused property fields after changing the instance size.
    3331             :     // TODO(ulan): Do not change instance size after map creation.
    3332             :     int unused_property_fields = proxy_function_map->UnusedPropertyFields();
    3333             :     proxy_function_map->set_instance_size(JSFunction::kSizeWithPrototype);
    3334             :     proxy_function_map->set_has_prototype_slot(true);
    3335             :     proxy_function_map->set_is_constructor(true);
    3336          61 :     proxy_function_map->SetInObjectUnusedPropertyFields(unused_property_fields);
    3337             : 
    3338             :     Handle<String> name = factory->Proxy_string();
    3339          61 :     Handle<Code> code(BUILTIN_CODE(isolate, ProxyConstructor));
    3340             :     Handle<JSFunction> proxy_function =
    3341          61 :         factory->NewFunction(proxy_function_map, name, code);
    3342             : 
    3343             :     JSFunction::SetInitialMap(proxy_function, isolate->proxy_map(),
    3344          61 :                               factory->null_value());
    3345             : 
    3346             :     proxy_function->shared()->SetConstructStub(
    3347         122 :         *BUILTIN_CODE(isolate, ProxyConstructor_ConstructStub));
    3348             :     proxy_function->shared()->set_internal_formal_parameter_count(2);
    3349             :     proxy_function->shared()->set_length(2);
    3350             : 
    3351             :     native_context()->set_proxy_function(*proxy_function);
    3352          61 :     InstallFunction(global, name, proxy_function, factory->Object_string());
    3353             :   }
    3354             : 
    3355             :   {  // -- R e f l e c t
    3356          61 :     Handle<String> reflect_string = factory->InternalizeUtf8String("Reflect");
    3357             :     Handle<JSObject> reflect =
    3358          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    3359          61 :     JSObject::AddProperty(global, reflect_string, reflect, DONT_ENUM);
    3360             : 
    3361             :     Handle<JSFunction> define_property =
    3362             :         SimpleInstallFunction(reflect, factory->defineProperty_string(),
    3363          61 :                               Builtins::kReflectDefineProperty, 3, true);
    3364             :     native_context()->set_reflect_define_property(*define_property);
    3365             : 
    3366             :     Handle<JSFunction> delete_property =
    3367             :         SimpleInstallFunction(reflect, factory->deleteProperty_string(),
    3368          61 :                               Builtins::kReflectDeleteProperty, 2, true);
    3369             :     native_context()->set_reflect_delete_property(*delete_property);
    3370             : 
    3371             :     Handle<JSFunction> apply = SimpleInstallFunction(
    3372          61 :         reflect, factory->apply_string(), Builtins::kReflectApply, 3, false);
    3373             :     native_context()->set_reflect_apply(*apply);
    3374             : 
    3375             :     Handle<JSFunction> construct =
    3376             :         SimpleInstallFunction(reflect, factory->construct_string(),
    3377          61 :                               Builtins::kReflectConstruct, 2, false);
    3378             :     native_context()->set_reflect_construct(*construct);
    3379             : 
    3380             :     SimpleInstallFunction(reflect, factory->get_string(), Builtins::kReflectGet,
    3381          61 :                           2, false);
    3382             :     SimpleInstallFunction(reflect, factory->getOwnPropertyDescriptor_string(),
    3383          61 :                           Builtins::kReflectGetOwnPropertyDescriptor, 2, true);
    3384             :     SimpleInstallFunction(reflect, factory->getPrototypeOf_string(),
    3385          61 :                           Builtins::kReflectGetPrototypeOf, 1, true);
    3386             :     SimpleInstallFunction(reflect, factory->has_string(), Builtins::kReflectHas,
    3387          61 :                           2, true);
    3388             :     SimpleInstallFunction(reflect, factory->isExtensible_string(),
    3389          61 :                           Builtins::kReflectIsExtensible, 1, true);
    3390             :     SimpleInstallFunction(reflect, factory->ownKeys_string(),
    3391          61 :                           Builtins::kReflectOwnKeys, 1, true);
    3392             :     SimpleInstallFunction(reflect, factory->preventExtensions_string(),
    3393          61 :                           Builtins::kReflectPreventExtensions, 1, true);
    3394             :     SimpleInstallFunction(reflect, factory->set_string(), Builtins::kReflectSet,
    3395          61 :                           3, false);
    3396             :     SimpleInstallFunction(reflect, factory->setPrototypeOf_string(),
    3397          61 :                           Builtins::kReflectSetPrototypeOf, 2, true);
    3398             :   }
    3399             : 
    3400             :   {  // --- B o u n d F u n c t i o n
    3401             :     Handle<Map> map =
    3402             :         factory->NewMap(JS_BOUND_FUNCTION_TYPE, JSBoundFunction::kSize,
    3403          61 :                         TERMINAL_FAST_ELEMENTS_KIND, 0);
    3404             :     map->set_is_callable();
    3405          61 :     Map::SetPrototype(map, empty_function);
    3406             : 
    3407             :     PropertyAttributes roc_attribs =
    3408             :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
    3409          61 :     Map::EnsureDescriptorSlack(map, 2);
    3410             : 
    3411             :     Handle<AccessorInfo> bound_length =
    3412          61 :         Accessors::BoundFunctionLengthInfo(isolate, roc_attribs);
    3413             :     {  // length
    3414             :       Descriptor d = Descriptor::AccessorConstant(factory->length_string(),
    3415             :                                                   bound_length, roc_attribs);
    3416          61 :       map->AppendDescriptor(&d);
    3417             :     }
    3418             :     Handle<AccessorInfo> bound_name =
    3419          61 :         Accessors::BoundFunctionNameInfo(isolate, roc_attribs);
    3420             :     {  // name
    3421             :       Descriptor d = Descriptor::AccessorConstant(factory->name_string(),
    3422             :                                                   bound_name, roc_attribs);
    3423          61 :       map->AppendDescriptor(&d);
    3424             :     }
    3425             :     native_context()->set_bound_function_without_constructor_map(*map);
    3426             : 
    3427          61 :     map = Map::Copy(map, "IsConstructor");
    3428             :     map->set_is_constructor(true);
    3429             :     native_context()->set_bound_function_with_constructor_map(*map);
    3430             :   }
    3431             : 
    3432             :   {  // --- sloppy arguments map
    3433             :     // Make sure we can recognize argument objects at runtime.
    3434             :     // This is done by introducing an anonymous function with
    3435             :     // class_name equals 'Arguments'.
    3436             :     Handle<String> arguments_string = factory->Arguments_string();
    3437             :     Handle<JSFunction> function = factory->NewFunction(
    3438             :         arguments_string, BUILTIN_CODE(isolate, Illegal),
    3439         122 :         isolate->initial_object_prototype(), LanguageMode::kStrict);
    3440          61 :     function->shared()->set_instance_class_name(*arguments_string);
    3441             : 
    3442             :     Handle<Map> map = factory->NewMap(
    3443          61 :         JS_ARGUMENTS_TYPE, JSSloppyArgumentsObject::kSize, PACKED_ELEMENTS, 2);
    3444             :     JSFunction::SetInitialMap(function, map,
    3445         122 :                               isolate->initial_object_prototype());
    3446             : 
    3447             :     // Create the descriptor array for the arguments object.
    3448          61 :     Map::EnsureDescriptorSlack(map, 2);
    3449             : 
    3450             :     {  // length
    3451             :       Descriptor d = Descriptor::DataField(
    3452             :           factory->length_string(), JSSloppyArgumentsObject::kLengthIndex,
    3453          61 :           DONT_ENUM, Representation::Tagged());
    3454          61 :       map->AppendDescriptor(&d);
    3455             :     }
    3456             :     {  // callee
    3457             :       Descriptor d = Descriptor::DataField(
    3458             :           factory->callee_string(), JSSloppyArgumentsObject::kCalleeIndex,
    3459          61 :           DONT_ENUM, Representation::Tagged());
    3460          61 :       map->AppendDescriptor(&d);
    3461             :     }
    3462             :     // @@iterator method is added later.
    3463             : 
    3464             :     native_context()->set_sloppy_arguments_map(*map);
    3465             : 
    3466             :     DCHECK(!map->is_dictionary_map());
    3467             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3468             :   }
    3469             : 
    3470             :   {  // --- fast and slow aliased arguments map
    3471          61 :     Handle<Map> map = isolate->sloppy_arguments_map();
    3472          61 :     map = Map::Copy(map, "FastAliasedArguments");
    3473             :     map->set_elements_kind(FAST_SLOPPY_ARGUMENTS_ELEMENTS);
    3474             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3475             :     native_context()->set_fast_aliased_arguments_map(*map);
    3476             : 
    3477          61 :     map = Map::Copy(map, "SlowAliasedArguments");
    3478             :     map->set_elements_kind(SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
    3479             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3480             :     native_context()->set_slow_aliased_arguments_map(*map);
    3481             :   }
    3482             : 
    3483             :   {  // --- strict mode arguments map
    3484             :     const PropertyAttributes attributes =
    3485             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3486             : 
    3487             :     // Create the ThrowTypeError function.
    3488          61 :     Handle<AccessorPair> callee = factory->NewAccessorPair();
    3489             : 
    3490          61 :     Handle<JSFunction> poison = GetThrowTypeErrorIntrinsic();
    3491             : 
    3492             :     // Install the ThrowTypeError function.
    3493          61 :     callee->set_getter(*poison);
    3494          61 :     callee->set_setter(*poison);
    3495             : 
    3496             :     // Create the map. Allocate one in-object field for length.
    3497             :     Handle<Map> map = factory->NewMap(
    3498          61 :         JS_ARGUMENTS_TYPE, JSStrictArgumentsObject::kSize, PACKED_ELEMENTS, 1);
    3499             :     // Create the descriptor array for the arguments object.
    3500          61 :     Map::EnsureDescriptorSlack(map, 2);
    3501             : 
    3502             :     {  // length
    3503             :       Descriptor d = Descriptor::DataField(
    3504             :           factory->length_string(), JSStrictArgumentsObject::kLengthIndex,
    3505          61 :           DONT_ENUM, Representation::Tagged());
    3506          61 :       map->AppendDescriptor(&d);
    3507             :     }
    3508             :     {  // callee
    3509             :       Descriptor d = Descriptor::AccessorConstant(factory->callee_string(),
    3510             :                                                   callee, attributes);
    3511          61 :       map->AppendDescriptor(&d);
    3512             :     }
    3513             :     // @@iterator method is added later.
    3514             : 
    3515             :     DCHECK_EQ(native_context()->object_function()->prototype(),
    3516             :               *isolate->initial_object_prototype());
    3517         122 :     Map::SetPrototype(map, isolate->initial_object_prototype());
    3518             : 
    3519             :     // Copy constructor from the sloppy arguments boilerplate.
    3520             :     map->SetConstructor(
    3521          61 :         native_context()->sloppy_arguments_map()->GetConstructor());
    3522             : 
    3523             :     native_context()->set_strict_arguments_map(*map);
    3524             : 
    3525             :     DCHECK(!map->is_dictionary_map());
    3526             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3527             :   }
    3528             : 
    3529             :   {  // --- context extension
    3530             :     // Create a function for the context extension objects.
    3531             :     Handle<JSFunction> context_extension_fun =
    3532             :         CreateFunction(isolate, factory->empty_string(),
    3533             :                        JS_CONTEXT_EXTENSION_OBJECT_TYPE, JSObject::kHeaderSize,
    3534          61 :                        0, factory->the_hole_value(), Builtins::kIllegal);
    3535          61 :     Handle<String> name = factory->InternalizeUtf8String("context_extension");
    3536          61 :     context_extension_fun->shared()->set_instance_class_name(*name);
    3537             :     native_context()->set_context_extension_function(*context_extension_fun);
    3538             :   }
    3539             : 
    3540             :   {
    3541             :     // Set up the call-as-function delegate.
    3542             :     Handle<JSFunction> delegate =
    3543             :         SimpleCreateFunction(isolate, factory->empty_string(),
    3544          61 :                              Builtins::kHandleApiCallAsFunction, 0, false);
    3545             :     native_context()->set_call_as_function_delegate(*delegate);
    3546             :   }
    3547             : 
    3548             :   {
    3549             :     // Set up the call-as-constructor delegate.
    3550             :     Handle<JSFunction> delegate =
    3551             :         SimpleCreateFunction(isolate, factory->empty_string(),
    3552          61 :                              Builtins::kHandleApiCallAsConstructor, 0, false);
    3553             :     native_context()->set_call_as_constructor_delegate(*delegate);
    3554             :   }
    3555          61 : }  // NOLINT(readability/fn_size)
    3556             : 
    3557         549 : void Genesis::InstallTypedArray(const char* name, ElementsKind elements_kind,
    3558        2196 :                                 Handle<JSFunction>* fun) {
    3559         549 :   Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());
    3560             : 
    3561             :   Handle<JSObject> typed_array_prototype =
    3562         549 :       Handle<JSObject>(isolate()->typed_array_prototype());
    3563             :   Handle<JSFunction> typed_array_function =
    3564         549 :       Handle<JSFunction>(isolate()->typed_array_function());
    3565             : 
    3566             :   Handle<JSObject> prototype =
    3567        1098 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    3568             :   Handle<JSFunction> result = InstallFunction(
    3569             :       global, name, JS_TYPED_ARRAY_TYPE, JSTypedArray::kSizeWithEmbedderFields,
    3570         549 :       0, prototype, Builtins::kIllegal);
    3571             :   result->initial_map()->set_elements_kind(elements_kind);
    3572             : 
    3573        1098 :   CHECK(JSObject::SetPrototype(result, typed_array_function, false,
    3574             :                                Object::DONT_THROW)
    3575             :             .FromJust());
    3576             : 
    3577        1098 :   CHECK(JSObject::SetPrototype(prototype, typed_array_prototype, false,
    3578             :                                Object::DONT_THROW)
    3579             :             .FromJust());
    3580         549 :   *fun = result;
    3581         549 : }
    3582             : 
    3583             : 
    3584       83406 : void Genesis::InitializeExperimentalGlobal() {
    3585             : #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
    3586             : 
    3587       83406 :   HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
    3588       83406 :   HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
    3589       83406 :   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
    3590             : #undef FEATURE_INITIALIZE_GLOBAL
    3591       83406 : }
    3592             : 
    3593       26328 : bool Bootstrapper::CompileBuiltin(Isolate* isolate, int index) {
    3594       13164 :   Vector<const char> name = Natives::GetScriptName(index);
    3595             :   Handle<String> source_code =
    3596       13164 :       isolate->bootstrapper()->GetNativeSource(CORE, index);
    3597             : 
    3598             :   // We pass in extras_utils so that builtin code can set it up for later use
    3599             :   // by actual extras code, compiled with CompileExtraBuiltin.
    3600       13164 :   Handle<Object> global = isolate->global_object();
    3601       13164 :   Handle<Object> utils = isolate->natives_utils_object();
    3602       13164 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3603       13164 :   Handle<Object> args[] = {global, utils, extras_utils};
    3604             : 
    3605             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3606       13164 :                                      arraysize(args), args, NATIVES_CODE);
    3607             : }
    3608             : 
    3609             : 
    3610         122 : bool Bootstrapper::CompileExtraBuiltin(Isolate* isolate, int index) {
    3611             :   HandleScope scope(isolate);
    3612          61 :   Vector<const char> name = ExtraNatives::GetScriptName(index);
    3613             :   Handle<String> source_code =
    3614          61 :       isolate->bootstrapper()->GetNativeSource(EXTRAS, index);
    3615          61 :   Handle<Object> global = isolate->global_object();
    3616          61 :   Handle<Object> binding = isolate->extras_binding_object();
    3617          61 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3618          61 :   Handle<Object> args[] = {global, binding, extras_utils};
    3619             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3620         122 :                                      arraysize(args), args, EXTENSION_CODE);
    3621             : }
    3622             : 
    3623             : 
    3624          10 : bool Bootstrapper::CompileExperimentalExtraBuiltin(Isolate* isolate,
    3625             :                                                    int index) {
    3626             :   HandleScope scope(isolate);
    3627           5 :   Vector<const char> name = ExperimentalExtraNatives::GetScriptName(index);
    3628             :   Handle<String> source_code =
    3629           5 :       isolate->bootstrapper()->GetNativeSource(EXPERIMENTAL_EXTRAS, index);
    3630           5 :   Handle<Object> global = isolate->global_object();
    3631           5 :   Handle<Object> binding = isolate->extras_binding_object();
    3632           5 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3633           5 :   Handle<Object> args[] = {global, binding, extras_utils};
    3634             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3635          10 :                                      arraysize(args), args, EXTENSION_CODE);
    3636             : }
    3637             : 
    3638       25623 : bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
    3639             :                                  Handle<String> source, int argc,
    3640             :                                  Handle<Object> argv[],
    3641             :                                  NativesFlag natives_flag) {
    3642             :   SuppressDebug compiling_natives(isolate->debug());
    3643             :   // During genesis, the boilerplate for stack overflow won't work until the
    3644             :   // environment has been at least partially initialized. Add a stack check
    3645             :   // before entering JS code to catch overflow early.
    3646             :   StackLimitCheck check(isolate);
    3647       13230 :   if (check.JsHasOverflowed(kStackSpaceRequiredForCompilation * KB)) {
    3648         837 :     isolate->StackOverflow();
    3649         837 :     return false;
    3650             :   }
    3651             : 
    3652             :   Handle<Context> context(isolate->context());
    3653             : 
    3654             :   Handle<String> script_name =
    3655       24786 :       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
    3656             :   MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3657             :       Compiler::GetSharedFunctionInfoForScript(
    3658             :           source, script_name, 0, 0, ScriptOriginOptions(),
    3659             :           MaybeHandle<Object>(), context, nullptr, nullptr,
    3660             :           ScriptCompiler::kNoCompileOptions, natives_flag,
    3661       12393 :           MaybeHandle<FixedArray>());
    3662             :   Handle<SharedFunctionInfo> function_info;
    3663       12393 :   if (!maybe_function_info.ToHandle(&function_info)) return false;
    3664             : 
    3665             :   DCHECK(context->IsNativeContext());
    3666             : 
    3667             :   Handle<JSFunction> fun =
    3668             :       isolate->factory()->NewFunctionFromSharedFunctionInfo(function_info,
    3669       12393 :                                                             context);
    3670             :   Handle<Object> receiver = isolate->factory()->undefined_value();
    3671             : 
    3672             :   // For non-extension scripts, run script to get the function wrapper.
    3673             :   Handle<Object> wrapper;
    3674       12393 :   if (!Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3675       12393 :                           Execution::MessageHandling::kKeepPending, nullptr)
    3676       24786 :            .ToHandle(&wrapper)) {
    3677             :     return false;
    3678             :   }
    3679             :   // Then run the function wrapper.
    3680             :   return !Execution::TryCall(isolate, Handle<JSFunction>::cast(wrapper),
    3681             :                              receiver, argc, argv,
    3682       12393 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3683       24786 :               .is_null();
    3684             : }
    3685             : 
    3686             : 
    3687          61 : bool Genesis::CallUtilsFunction(Isolate* isolate, const char* name) {
    3688             :   Handle<JSObject> utils =
    3689          61 :       Handle<JSObject>::cast(isolate->natives_utils_object());
    3690             :   Handle<String> name_string =
    3691          61 :       isolate->factory()->NewStringFromAsciiChecked(name);
    3692          61 :   Handle<Object> fun = JSObject::GetDataProperty(utils, name_string);
    3693             :   Handle<Object> receiver = isolate->factory()->undefined_value();
    3694             :   Handle<Object> args[] = {utils};
    3695             :   return !Execution::TryCall(isolate, fun, receiver, 1, args,
    3696             :                              Execution::MessageHandling::kKeepPending, nullptr)
    3697         122 :               .is_null();
    3698             : }
    3699             : 
    3700             : 
    3701       16880 : bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
    3702             :   Factory* factory = isolate->factory();
    3703             :   HandleScope scope(isolate);
    3704             :   Handle<SharedFunctionInfo> function_info;
    3705             : 
    3706             :   Handle<String> source =
    3707             :       isolate->factory()
    3708        4220 :           ->NewExternalStringFromOneByte(extension->source())
    3709        8440 :           .ToHandleChecked();
    3710             :   DCHECK(source->IsOneByteRepresentation());
    3711             : 
    3712             :   // If we can't find the function in the cache, we compile a new
    3713             :   // function and insert it into the cache.
    3714        4220 :   Vector<const char> name = CStrVector(extension->name());
    3715        4220 :   SourceCodeCache* cache = isolate->bootstrapper()->extensions_cache();
    3716             :   Handle<Context> context(isolate->context());
    3717             :   DCHECK(context->IsNativeContext());
    3718             : 
    3719        4220 :   if (!cache->Lookup(name, &function_info)) {
    3720             :     Handle<String> script_name =
    3721        6275 :         factory->NewStringFromUtf8(name).ToHandleChecked();
    3722             :     MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3723             :         Compiler::GetSharedFunctionInfoForScript(
    3724             :             source, script_name, 0, 0, ScriptOriginOptions(),
    3725             :             MaybeHandle<Object>(), context, extension, nullptr,
    3726             :             ScriptCompiler::kNoCompileOptions, EXTENSION_CODE,
    3727        3137 :             MaybeHandle<FixedArray>());
    3728        3138 :     if (!maybe_function_info.ToHandle(&function_info)) return false;
    3729        3108 :     cache->Add(name, function_info);
    3730             :   }
    3731             : 
    3732             :   // Set up the function context. Conceptually, we should clone the
    3733             :   // function before overwriting the context but since we're in a
    3734             :   // single-threaded environment it is not strictly necessary.
    3735             :   Handle<JSFunction> fun =
    3736        4189 :       factory->NewFunctionFromSharedFunctionInfo(function_info, context);
    3737             : 
    3738             :   // Call function using either the runtime object or the global
    3739             :   // object as the receiver. Provide no parameters.
    3740        4190 :   Handle<Object> receiver = isolate->global_object();
    3741             :   return !Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3742        4190 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3743        8379 :               .is_null();
    3744             : }
    3745             : 
    3746             : 
    3747        7869 : static Handle<JSObject> ResolveBuiltinIdHolder(Handle<Context> native_context,
    3748             :                                                const char* holder_expr) {
    3749             :   Isolate* isolate = native_context->GetIsolate();
    3750             :   Factory* factory = isolate->factory();
    3751        7869 :   Handle<JSGlobalObject> global(native_context->global_object());
    3752             :   const char* period_pos = strchr(holder_expr, '.');
    3753        7869 :   if (period_pos == nullptr) {
    3754             :     return Handle<JSObject>::cast(
    3755             :         Object::GetPropertyOrElement(
    3756        5856 :             global, factory->InternalizeUtf8String(holder_expr))
    3757        5856 :             .ToHandleChecked());
    3758             :   }
    3759        4941 :   const char* inner = period_pos + 1;
    3760             :   DCHECK(!strchr(inner, '.'));
    3761             :   Vector<const char> property(holder_expr,
    3762        4941 :                               static_cast<int>(period_pos - holder_expr));
    3763        4941 :   Handle<String> property_string = factory->InternalizeUtf8String(property);
    3764             :   DCHECK(!property_string.is_null());
    3765             :   Handle<JSObject> object = Handle<JSObject>::cast(
    3766        9882 :       JSReceiver::GetProperty(global, property_string).ToHandleChecked());
    3767        4941 :   if (strcmp("prototype", inner) == 0) {
    3768             :     Handle<JSFunction> function = Handle<JSFunction>::cast(object);
    3769        9882 :     return Handle<JSObject>(JSObject::cast(function->prototype()));
    3770             :   }
    3771           0 :   Handle<String> inner_string = factory->InternalizeUtf8String(inner);
    3772             :   DCHECK(!inner_string.is_null());
    3773             :   Handle<Object> value =
    3774           0 :       JSReceiver::GetProperty(object, inner_string).ToHandleChecked();
    3775             :   return Handle<JSObject>::cast(value);
    3776             : }
    3777             : 
    3778      318965 : void Genesis::ConfigureUtilsObject(GlobalContextType context_type) {
    3779       82760 :   switch (context_type) {
    3780             :     // We still need the utils object to find debug functions.
    3781             :     case DEBUG_CONTEXT:
    3782             :       return;
    3783             :     // Expose the natives in global if a valid name for it is specified.
    3784             :     case FULL_CONTEXT: {
    3785             :       // We still need the utils object after deserialization.
    3786       79025 :       if (isolate()->serializer_enabled()) return;
    3787       78643 :       if (FLAG_expose_natives_as == nullptr) break;
    3788          35 :       if (strlen(FLAG_expose_natives_as) == 0) break;
    3789             :       HandleScope scope(isolate());
    3790             :       Handle<String> natives_key =
    3791          35 :           factory()->InternalizeUtf8String(FLAG_expose_natives_as);
    3792             :       uint32_t dummy_index;
    3793          35 :       if (natives_key->AsArrayIndex(&dummy_index)) break;
    3794          25 :       Handle<Object> utils = isolate()->natives_utils_object();
    3795          25 :       Handle<JSObject> global = isolate()->global_object();
    3796          25 :       JSObject::AddProperty(global, natives_key, utils, DONT_ENUM);
    3797          25 :       break;
    3798             :     }
    3799             :   }
    3800             : 
    3801             :   // The utils object can be removed for cases that reach this point.
    3802       78643 :   native_context()->set_natives_utils_object(heap()->undefined_value());
    3803       78643 :   native_context()->set_extras_utils_object(heap()->undefined_value());
    3804             : }
    3805             : 
    3806             : 
    3807          61 : void Bootstrapper::ExportFromRuntime(Isolate* isolate,
    3808             :                                      Handle<JSObject> container) {
    3809             :   Factory* factory = isolate->factory();
    3810             :   HandleScope scope(isolate);
    3811          61 :   Handle<Context> native_context = isolate->native_context();
    3812             : #define EXPORT_PRIVATE_SYMBOL(NAME)                                       \
    3813             :   Handle<String> NAME##_name = factory->NewStringFromAsciiChecked(#NAME); \
    3814             :   JSObject::AddProperty(container, NAME##_name, factory->NAME(), NONE);
    3815        2379 :   PRIVATE_SYMBOL_LIST(EXPORT_PRIVATE_SYMBOL)
    3816             : #undef EXPORT_PRIVATE_SYMBOL
    3817             : 
    3818             : #define EXPORT_PUBLIC_SYMBOL(NAME, DESCRIPTION)                           \
    3819             :   Handle<String> NAME##_name = factory->NewStringFromAsciiChecked(#NAME); \
    3820             :   JSObject::AddProperty(container, NAME##_name, factory->NAME(), NONE);
    3821         671 :   PUBLIC_SYMBOL_LIST(EXPORT_PUBLIC_SYMBOL)
    3822         244 :   WELL_KNOWN_SYMBOL_LIST(EXPORT_PUBLIC_SYMBOL)
    3823             : #undef EXPORT_PUBLIC_SYMBOL
    3824             : 
    3825             :   Handle<JSObject> iterator_prototype(
    3826             :       native_context->initial_iterator_prototype());
    3827             : 
    3828             :   JSObject::AddProperty(container,
    3829             :                         factory->InternalizeUtf8String("IteratorPrototype"),
    3830         122 :                         iterator_prototype, NONE);
    3831             : 
    3832             :   {
    3833          61 :     PrototypeIterator iter(native_context->generator_function_map());
    3834          61 :     Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>());
    3835             : 
    3836             :     JSObject::AddProperty(
    3837             :         container, factory->InternalizeUtf8String("GeneratorFunctionPrototype"),
    3838         122 :         generator_function_prototype, NONE);
    3839             : 
    3840             :     Handle<JSFunction> generator_function_function = InstallFunction(
    3841             :         container, "GeneratorFunction", JS_FUNCTION_TYPE,
    3842             :         JSFunction::kSizeWithPrototype, 0, generator_function_prototype,
    3843          61 :         Builtins::kGeneratorFunctionConstructor);
    3844             :     generator_function_function->set_prototype_or_initial_map(
    3845          61 :         native_context->generator_function_map());
    3846             :     generator_function_function->shared()->DontAdaptArguments();
    3847             :     generator_function_function->shared()->SetConstructStub(
    3848         122 :         *BUILTIN_CODE(isolate, GeneratorFunctionConstructor));
    3849             :     generator_function_function->shared()->set_length(1);
    3850             :     InstallWithIntrinsicDefaultProto(
    3851             :         isolate, generator_function_function,
    3852          61 :         Context::GENERATOR_FUNCTION_FUNCTION_INDEX);
    3853             : 
    3854             :     JSObject::ForceSetPrototype(generator_function_function,
    3855         122 :                                 isolate->function_function());
    3856             :     JSObject::AddProperty(
    3857             :         generator_function_prototype, factory->constructor_string(),
    3858             :         generator_function_function,
    3859          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3860             : 
    3861             :     native_context->generator_function_map()->SetConstructor(
    3862             :         *generator_function_function);
    3863             :   }
    3864             : 
    3865             :   {
    3866          61 :     PrototypeIterator iter(native_context->async_generator_function_map());
    3867             :     Handle<JSObject> async_generator_function_prototype(
    3868          61 :         iter.GetCurrent<JSObject>());
    3869             : 
    3870             :     Handle<JSFunction> async_generator_function_function = InstallFunction(
    3871             :         container, "AsyncGeneratorFunction", JS_FUNCTION_TYPE,
    3872             :         JSFunction::kSizeWithPrototype, 0, async_generator_function_prototype,
    3873          61 :         Builtins::kAsyncGeneratorFunctionConstructor);
    3874             :     async_generator_function_function->set_prototype_or_initial_map(
    3875          61 :         native_context->async_generator_function_map());
    3876             :     async_generator_function_function->shared()->DontAdaptArguments();
    3877             :     async_generator_function_function->shared()->SetConstructStub(
    3878         122 :         *BUILTIN_CODE(isolate, AsyncGeneratorFunctionConstructor));
    3879             :     async_generator_function_function->shared()->set_length(1);
    3880             :     InstallWithIntrinsicDefaultProto(
    3881             :         isolate, async_generator_function_function,
    3882          61 :         Context::ASYNC_GENERATOR_FUNCTION_FUNCTION_INDEX);
    3883             : 
    3884             :     JSObject::ForceSetPrototype(async_generator_function_function,
    3885         122 :                                 isolate->function_function());
    3886             : 
    3887             :     JSObject::AddProperty(
    3888             :         async_generator_function_prototype, factory->constructor_string(),
    3889             :         async_generator_function_function,
    3890          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3891             : 
    3892             :     native_context->async_generator_function_map()->SetConstructor(
    3893             :         *async_generator_function_function);
    3894             :   }
    3895             : 
    3896             :   {  // -- S e t I t e r a t o r
    3897          61 :     Handle<String> name = factory->InternalizeUtf8String("Set Iterator");
    3898             : 
    3899             :     // Setup %SetIteratorPrototype%.
    3900             :     Handle<JSObject> prototype =
    3901          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    3902          61 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    3903             : 
    3904             :     // Install the @@toStringTag property on the {prototype}.
    3905             :     JSObject::AddProperty(
    3906             :         prototype, factory->to_string_tag_symbol(), name,
    3907          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3908             : 
    3909             :     // Install the next function on the {prototype}.
    3910             :     SimpleInstallFunction(prototype, "next",
    3911             :                           Builtins::kSetIteratorPrototypeNext, 0, true,
    3912          61 :                           kSetIteratorNext);
    3913             : 
    3914             :     // Setup SetIterator constructor.
    3915             :     Handle<JSFunction> set_iterator_function =
    3916             :         InstallFunction(container, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
    3917          61 :                         JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
    3918             :     set_iterator_function->shared()->set_native(false);
    3919          61 :     set_iterator_function->shared()->set_instance_class_name(*name);
    3920             : 
    3921             :     Handle<Map> set_value_iterator_map(set_iterator_function->initial_map(),
    3922             :                                        isolate);
    3923             :     native_context->set_set_value_iterator_map(*set_value_iterator_map);
    3924             : 
    3925             :     Handle<Map> set_key_value_iterator_map =
    3926          61 :         Map::Copy(set_value_iterator_map, "JS_SET_KEY_VALUE_ITERATOR_TYPE");
    3927             :     set_key_value_iterator_map->set_instance_type(
    3928             :         JS_SET_KEY_VALUE_ITERATOR_TYPE);
    3929             :     native_context->set_set_key_value_iterator_map(*set_key_value_iterator_map);
    3930             :   }
    3931             : 
    3932             :   {  // -- M a p I t e r a t o r
    3933          61 :     Handle<String> name = factory->InternalizeUtf8String("Map Iterator");
    3934             : 
    3935             :     // Setup %MapIteratorPrototype%.
    3936             :     Handle<JSObject> prototype =
    3937          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    3938          61 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    3939             : 
    3940             :     // Install the @@toStringTag property on the {prototype}.
    3941             :     JSObject::AddProperty(
    3942             :         prototype, factory->to_string_tag_symbol(), name,
    3943          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3944             : 
    3945             :     // Install the next function on the {prototype}.
    3946             :     SimpleInstallFunction(prototype, "next",
    3947             :                           Builtins::kMapIteratorPrototypeNext, 0, true,
    3948          61 :                           kMapIteratorNext);
    3949             : 
    3950             :     // Setup MapIterator constructor.
    3951             :     Handle<JSFunction> map_iterator_function =
    3952             :         InstallFunction(container, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
    3953          61 :                         JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
    3954             :     map_iterator_function->shared()->set_native(false);
    3955          61 :     map_iterator_function->shared()->set_instance_class_name(*name);
    3956             : 
    3957             :     Handle<Map> map_key_iterator_map(map_iterator_function->initial_map(),
    3958             :                                      isolate);
    3959             :     native_context->set_map_key_iterator_map(*map_key_iterator_map);
    3960             : 
    3961             :     Handle<Map> map_key_value_iterator_map =
    3962          61 :         Map::Copy(map_key_iterator_map, "JS_MAP_KEY_VALUE_ITERATOR_TYPE");
    3963             :     map_key_value_iterator_map->set_instance_type(
    3964             :         JS_MAP_KEY_VALUE_ITERATOR_TYPE);
    3965             :     native_context->set_map_key_value_iterator_map(*map_key_value_iterator_map);
    3966             : 
    3967             :     Handle<Map> map_value_iterator_map =
    3968          61 :         Map::Copy(map_key_iterator_map, "JS_MAP_VALUE_ITERATOR_TYPE");
    3969             :     map_value_iterator_map->set_instance_type(JS_MAP_VALUE_ITERATOR_TYPE);
    3970             :     native_context->set_map_value_iterator_map(*map_value_iterator_map);
    3971             :   }
    3972             : 
    3973             :   {  // -- S c r i p t
    3974          61 :     Handle<String> name = factory->InternalizeUtf8String("Script");
    3975             :     Handle<JSFunction> script_fun = InstallFunction(
    3976             :         container, name, JS_VALUE_TYPE, JSValue::kSize, 0,
    3977          61 :         factory->the_hole_value(), Builtins::kUnsupportedThrower, DONT_ENUM);
    3978          61 :     script_fun->shared()->set_instance_class_name(*name);
    3979             :     native_context->set_script_function(*script_fun);
    3980             : 
    3981             :     Handle<Map> script_map = Handle<Map>(script_fun->initial_map());
    3982          61 :     Map::EnsureDescriptorSlack(script_map, 15);
    3983             : 
    3984             :     PropertyAttributes attribs =
    3985             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3986             : 
    3987             :     Handle<AccessorInfo> script_column =
    3988          61 :         Accessors::ScriptColumnOffsetInfo(isolate, attribs);
    3989             :     {
    3990             :       Descriptor d = Descriptor::AccessorConstant(
    3991             :           Handle<Name>(Name::cast(script_column->name())), script_column,
    3992             :           attribs);
    3993          61 :       script_map->AppendDescriptor(&d);
    3994             :     }
    3995             : 
    3996          61 :     Handle<AccessorInfo> script_id = Accessors::ScriptIdInfo(isolate, attribs);
    3997             :     {
    3998             :       Descriptor d = Descriptor::AccessorConstant(
    3999             :           Handle<Name>(Name::cast(script_id->name())), script_id, attribs);
    4000          61 :       script_map->AppendDescriptor(&d);
    4001             :     }
    4002             : 
    4003             : 
    4004             :     Handle<AccessorInfo> script_name =
    4005          61 :         Accessors::ScriptNameInfo(isolate, attribs);
    4006             :     {
    4007             :       Descriptor d = Descriptor::AccessorConstant(
    4008             :           Handle<Name>(Name::cast(script_name->name())), script_name, attribs);
    4009          61 :       script_map->AppendDescriptor(&d);
    4010             :     }
    4011             : 
    4012             :     Handle<AccessorInfo> script_line =
    4013          61 :         Accessors::ScriptLineOffsetInfo(isolate, attribs);
    4014             :     {
    4015             :       Descriptor d = Descriptor::AccessorConstant(
    4016             :           Handle<Name>(Name::cast(script_line->name())), script_line, attribs);
    4017          61 :       script_map->AppendDescriptor(&d);
    4018             :     }
    4019             : 
    4020             :     Handle<AccessorInfo> script_source =
    4021          61 :         Accessors::ScriptSourceInfo(isolate, attribs);
    4022             :     {
    4023             :       Descriptor d = Descriptor::AccessorConstant(
    4024             :           Handle<Name>(Name::cast(script_source->name())), script_source,
    4025             :           attribs);
    4026          61 :       script_map->AppendDescriptor(&d);
    4027             :     }
    4028             : 
    4029             :     Handle<AccessorInfo> script_type =
    4030          61 :         Accessors::ScriptTypeInfo(isolate, attribs);
    4031             :     {
    4032             :       Descriptor d = Descriptor::AccessorConstant(
    4033             :           Handle<Name>(Name::cast(script_type->name())), script_type, attribs);
    4034          61 :       script_map->AppendDescriptor(&d);
    4035             :     }
    4036             : 
    4037             :     Handle<AccessorInfo> script_compilation_type =
    4038          61 :         Accessors::ScriptCompilationTypeInfo(isolate, attribs);
    4039             :     {
    4040             :       Descriptor d = Descriptor::AccessorConstant(
    4041             :           Handle<Name>(Name::cast(script_compilation_type->name())),
    4042             :           script_compilation_type, attribs);
    4043          61 :       script_map->AppendDescriptor(&d);
    4044             :     }
    4045             : 
    4046             :     Handle<AccessorInfo> script_context_data =
    4047          61 :         Accessors::ScriptContextDataInfo(isolate, attribs);
    4048             :     {
    4049             :       Descriptor d = Descriptor::AccessorConstant(
    4050             :           Handle<Name>(Name::cast(script_context_data->name())),
    4051             :           script_context_data, attribs);
    4052          61 :       script_map->AppendDescriptor(&d);
    4053             :     }
    4054             : 
    4055             :     Handle<AccessorInfo> script_eval_from_script =
    4056          61 :         Accessors::ScriptEvalFromScriptInfo(isolate, attribs);
    4057             :     {
    4058             :       Descriptor d = Descriptor::AccessorConstant(
    4059             :           Handle<Name>(Name::cast(script_eval_from_script->name())),
    4060             :           script_eval_from_script, attribs);
    4061          61 :       script_map->AppendDescriptor(&d);
    4062             :     }
    4063             : 
    4064             :     Handle<AccessorInfo> script_eval_from_script_position =
    4065          61 :         Accessors::ScriptEvalFromScriptPositionInfo(isolate, attribs);
    4066             :     {
    4067             :       Descriptor d = Descriptor::AccessorConstant(
    4068             :           Handle<Name>(Name::cast(script_eval_from_script_position->name())),
    4069             :           script_eval_from_script_position, attribs);
    4070          61 :       script_map->AppendDescriptor(&d);
    4071             :     }
    4072             : 
    4073             :     Handle<AccessorInfo> script_eval_from_function_name =
    4074          61 :         Accessors::ScriptEvalFromFunctionNameInfo(isolate, attribs);
    4075             :     {
    4076             :       Descriptor d = Descriptor::AccessorConstant(
    4077             :           Handle<Name>(Name::cast(script_eval_from_function_name->name())),
    4078             :           script_eval_from_function_name, attribs);
    4079          61 :       script_map->AppendDescriptor(&d);
    4080             :     }
    4081             : 
    4082             :     Handle<AccessorInfo> script_source_url =
    4083          61 :         Accessors::ScriptSourceUrlInfo(isolate, attribs);
    4084             :     {
    4085             :       Descriptor d = Descriptor::AccessorConstant(
    4086             :           Handle<Name>(Name::cast(script_source_url->name())),
    4087             :           script_source_url, attribs);
    4088          61 :       script_map->AppendDescriptor(&d);
    4089             :     }
    4090             : 
    4091             :     Handle<AccessorInfo> script_source_mapping_url =
    4092          61 :         Accessors::ScriptSourceMappingUrlInfo(isolate, attribs);
    4093             :     {
    4094             :       Descriptor d = Descriptor::AccessorConstant(
    4095             :           Handle<Name>(Name::cast(script_source_mapping_url->name())),
    4096             :           script_source_mapping_url, attribs);
    4097          61 :       script_map->AppendDescriptor(&d);
    4098             :     }
    4099             :   }
    4100             : 
    4101             :   {  // -- A s y n c F u n c t i o n
    4102             :     // Builtin functions for AsyncFunction.
    4103          61 :     PrototypeIterator iter(native_context->async_function_map());
    4104          61 :     Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>());
    4105             : 
    4106             :     Handle<JSFunction> async_function_constructor = InstallFunction(
    4107             :         container, "AsyncFunction", JS_FUNCTION_TYPE,
    4108             :         JSFunction::kSizeWithPrototype, 0, async_function_prototype,
    4109          61 :         Builtins::kAsyncFunctionConstructor);
    4110             :     async_function_constructor->set_prototype_or_initial_map(
    4111          61 :         native_context->async_function_map());
    4112             :     async_function_constructor->shared()->DontAdaptArguments();
    4113             :     async_function_constructor->shared()->SetConstructStub(
    4114         122 :         *BUILTIN_CODE(isolate, AsyncFunctionConstructor));
    4115             :     async_function_constructor->shared()->set_length(1);
    4116             :     native_context->set_async_function_constructor(*async_function_constructor);
    4117             :     JSObject::ForceSetPrototype(async_function_constructor,
    4118         122 :                                 isolate->function_function());
    4119             : 
    4120             :     JSObject::AddProperty(
    4121             :         async_function_prototype, factory->constructor_string(),
    4122             :         async_function_constructor,
    4123          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4124             : 
    4125             :     JSFunction::SetPrototype(async_function_constructor,
    4126          61 :                              async_function_prototype);
    4127             : 
    4128             :     {
    4129             :       Handle<JSFunction> function =
    4130             :           SimpleCreateFunction(isolate, factory->empty_string(),
    4131          61 :                                Builtins::kAsyncFunctionAwaitCaught, 2, false);
    4132             :       native_context->set_async_function_await_caught(*function);
    4133             :     }
    4134             : 
    4135             :     {
    4136             :       Handle<JSFunction> function =
    4137             :           SimpleCreateFunction(isolate, factory->empty_string(),
    4138          61 :                                Builtins::kAsyncFunctionAwaitUncaught, 2, false);
    4139             :       native_context->set_async_function_await_uncaught(*function);
    4140             :     }
    4141             : 
    4142             :     {
    4143             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4144             :           isolate, Builtins::kAsyncFunctionAwaitRejectClosure,
    4145          61 :           factory->empty_string(), 1);
    4146             :       native_context->set_async_function_await_reject_shared_fun(*info);
    4147             :     }
    4148             : 
    4149             :     {
    4150             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4151             :           isolate, Builtins::kAsyncFunctionAwaitResolveClosure,
    4152          61 :           factory->empty_string(), 1);
    4153             :       native_context->set_async_function_await_resolve_shared_fun(*info);
    4154             :     }
    4155             : 
    4156             :     {
    4157             :       Handle<JSFunction> function =
    4158             :           SimpleCreateFunction(isolate, factory->empty_string(),
    4159          61 :                                Builtins::kAsyncFunctionPromiseCreate, 0, false);
    4160             :       native_context->set_async_function_promise_create(*function);
    4161             :     }
    4162             : 
    4163             :     {
    4164             :       Handle<JSFunction> function = SimpleCreateFunction(
    4165             :           isolate, factory->empty_string(),
    4166          61 :           Builtins::kAsyncFunctionPromiseRelease, 1, false);
    4167             :       native_context->set_async_function_promise_release(*function);
    4168             :     }
    4169             :   }
    4170             : 
    4171             :   {  // -- C a l l S i t e
    4172             :     // Builtin functions for CallSite.
    4173             : 
    4174             :     // CallSites are a special case; the constructor is for our private use
    4175             :     // only, therefore we set it up as a builtin that throws. Internally, we use
    4176             :     // CallSiteUtils::Construct to create CallSite objects.
    4177             : 
    4178             :     Handle<JSFunction> callsite_fun = InstallFunction(
    4179             :         container, "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize, 0,
    4180          61 :         factory->the_hole_value(), Builtins::kUnsupportedThrower);
    4181             :     callsite_fun->shared()->DontAdaptArguments();
    4182         122 :     isolate->native_context()->set_callsite_function(*callsite_fun);
    4183             : 
    4184             :     {
    4185             :       // Setup CallSite.prototype.
    4186             :       Handle<JSObject> prototype(
    4187             :           JSObject::cast(callsite_fun->instance_prototype()));
    4188             : 
    4189             :       struct FunctionInfo {
    4190             :         const char* name;
    4191             :         Builtins::Name id;
    4192             :       };
    4193             : 
    4194             :       FunctionInfo infos[] = {
    4195             :           {"getColumnNumber", Builtins::kCallSitePrototypeGetColumnNumber},
    4196             :           {"getEvalOrigin", Builtins::kCallSitePrototypeGetEvalOrigin},
    4197             :           {"getFileName", Builtins::kCallSitePrototypeGetFileName},
    4198             :           {"getFunction", Builtins::kCallSitePrototypeGetFunction},
    4199             :           {"getFunctionName", Builtins::kCallSitePrototypeGetFunctionName},
    4200             :           {"getLineNumber", Builtins::kCallSitePrototypeGetLineNumber},
    4201             :           {"getMethodName", Builtins::kCallSitePrototypeGetMethodName},
    4202             :           {"getPosition", Builtins::kCallSitePrototypeGetPosition},
    4203             :           {"getScriptNameOrSourceURL",
    4204             :            Builtins::kCallSitePrototypeGetScriptNameOrSourceURL},
    4205             :           {"getThis", Builtins::kCallSitePrototypeGetThis},
    4206             :           {"getTypeName", Builtins::kCallSitePrototypeGetTypeName},
    4207             :           {"isConstructor", Builtins::kCallSitePrototypeIsConstructor},
    4208             :           {"isEval", Builtins::kCallSitePrototypeIsEval},
    4209             :           {"isNative", Builtins::kCallSitePrototypeIsNative},
    4210             :           {"isToplevel", Builtins::kCallSitePrototypeIsToplevel},
    4211          61 :           {"toString", Builtins::kCallSitePrototypeToString}};
    4212             : 
    4213             :       PropertyAttributes attrs =
    4214             :           static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    4215             : 
    4216             :       Handle<JSFunction> fun;
    4217        1037 :       for (const FunctionInfo& info : infos) {
    4218         976 :         SimpleInstallFunction(prototype, info.name, info.id, 0, true, attrs);
    4219             :       }
    4220             :     }
    4221             :   }
    4222             : 
    4223             : #ifdef V8_INTL_SUPPORT
    4224             :   {  // I n t l  P l u r a l R u l e s
    4225             :     Handle<JSObject> plural_rules_prototype =
    4226          61 :         factory->NewJSObject(isolate->object_function(), TENURED);
    4227             :     // Install the @@toStringTag property on the {prototype}.
    4228             :     JSObject::AddProperty(
    4229             :         plural_rules_prototype, factory->to_string_tag_symbol(),
    4230             :         factory->Object_string(),
    4231          61 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4232             :     Handle<JSFunction> plural_rules_constructor = InstallFunction(
    4233             :         container, "PluralRules", JS_OBJECT_TYPE, PluralRules::kSize, 0,
    4234          61 :         plural_rules_prototype, Builtins::kIllegal);
    4235             :     JSObject::AddProperty(plural_rules_prototype, factory->constructor_string(),
    4236          61 :                           plural_rules_constructor, DONT_ENUM);
    4237             :     native_context->set_intl_plural_rules_function(*plural_rules_constructor);
    4238             :   }
    4239             : #endif  // V8_INTL_SUPPORT
    4240          61 : }
    4241             : 
    4242             : 
    4243             : #define EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(id) \
    4244             :   void Genesis::InitializeGlobal_##id() {}
    4245             : 
    4246           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_do_expressions)
    4247           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_lookbehind)
    4248           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_named_captures)
    4249           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_property)
    4250           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_function_sent)
    4251           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_restrictive_generators)
    4252           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_function_tostring)
    4253           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_class_fields)
    4254           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_object_rest_spread)
    4255           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
    4256           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_meta)
    4257           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_template_escapes)
    4258           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_restrict_constructor_return)
    4259           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_strict_legacy_accessor_builtins)
    4260             : 
    4261           0 : void InstallPublicSymbol(Factory* factory, Handle<Context> native_context,
    4262             :                          const char* name, Handle<Symbol> value) {
    4263             :   Handle<JSGlobalObject> global(
    4264           0 :       JSGlobalObject::cast(native_context->global_object()));
    4265           0 :   Handle<String> symbol_string = factory->InternalizeUtf8String("Symbol");
    4266             :   Handle<JSObject> symbol = Handle<JSObject>::cast(
    4267           0 :       JSObject::GetProperty(global, symbol_string).ToHandleChecked());
    4268           0 :   Handle<String> name_string = factory->InternalizeUtf8String(name);
    4269             :   PropertyAttributes attributes =
    4270             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    4271           0 :   JSObject::AddProperty(symbol, name_string, value, attributes);
    4272           0 : }
    4273             : 
    4274       83406 : void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
    4275      166812 :   if (!FLAG_harmony_sharedarraybuffer) return;
    4276             : 
    4277       83396 :   Handle<JSGlobalObject> global(native_context()->global_object());
    4278             :   Isolate* isolate = global->GetIsolate();
    4279             :   Factory* factory = isolate->factory();
    4280             : 
    4281             :   {
    4282       83396 :     Handle<String> name = factory->InternalizeUtf8String("SharedArrayBuffer");
    4283             :     JSObject::AddProperty(global, name, isolate->shared_array_buffer_fun(),
    4284      166792 :                           DONT_ENUM);
    4285             :   }
    4286             : 
    4287             :   {
    4288       83396 :     Handle<String> name = factory->InternalizeUtf8String("Atomics");
    4289      166792 :     JSObject::AddProperty(global, name, isolate->atomics_object(), DONT_ENUM);
    4290             :     JSObject::AddProperty(
    4291             :         isolate->atomics_object(), factory->to_string_tag_symbol(), name,
    4292       83396 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4293             :   }
    4294             : }
    4295             : 
    4296       83442 : void Genesis::InitializeGlobal_harmony_array_prototype_values() {
    4297      166803 :   if (!FLAG_harmony_array_prototype_values) return;
    4298             :   Handle<JSFunction> array_constructor(native_context()->array_function());
    4299             :   Handle<JSObject> array_prototype(
    4300             :       JSObject::cast(array_constructor->instance_prototype()));
    4301             :   Handle<Object> values_iterator =
    4302           9 :       JSObject::GetProperty(array_prototype, factory()->iterator_symbol())
    4303          18 :           .ToHandleChecked();
    4304             :   DCHECK(values_iterator->IsJSFunction());
    4305             :   JSObject::AddProperty(array_prototype, factory()->values_string(),
    4306           9 :                         values_iterator, DONT_ENUM);
    4307             : 
    4308             :   Handle<Object> unscopables =
    4309           9 :       JSObject::GetProperty(array_prototype, factory()->unscopables_symbol())
    4310          18 :           .ToHandleChecked();
    4311             :   DCHECK(unscopables->IsJSObject());
    4312             :   JSObject::AddProperty(Handle<JSObject>::cast(unscopables),
    4313             :                         factory()->values_string(), factory()->true_value(),
    4314           9 :                         NONE);
    4315             : }
    4316             : 
    4317      166292 : void Genesis::InitializeGlobal_harmony_async_iteration() {
    4318      166812 :   if (!FLAG_harmony_async_iteration) return;
    4319             :   Handle<JSFunction> symbol_fun(native_context()->symbol_function());
    4320             :   InstallConstant(isolate(), symbol_fun, "asyncIterator",
    4321       82886 :                   factory()->async_iterator_symbol());
    4322             : }
    4323             : 
    4324      500386 : void Genesis::InitializeGlobal_harmony_promise_finally() {
    4325      166812 :   if (!FLAG_harmony_promise_finally) return;
    4326             : 
    4327             :   Handle<JSFunction> constructor(native_context()->promise_function());
    4328             :   Handle<JSObject> prototype(JSObject::cast(constructor->instance_prototype()));
    4329             :   SimpleInstallFunction(prototype, "finally", Builtins::kPromiseFinally, 1,
    4330       83396 :                         true, DONT_ENUM);
    4331             : 
    4332             :   // The promise prototype map has changed because we added a property
    4333             :   // to prototype, so we update the saved map.
    4334             :   Handle<Map> prototype_map(prototype->map());
    4335       83396 :   Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate());
    4336             :   native_context()->set_promise_prototype_map(*prototype_map);
    4337             : 
    4338             :   {
    4339             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4340       83396 :         isolate(), Builtins::kPromiseThenFinally, factory()->empty_string(), 1);
    4341             :     info->set_native(true);
    4342             :     native_context()->set_promise_then_finally_shared_fun(*info);
    4343             :   }
    4344             : 
    4345             :   {
    4346             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4347             :         isolate(), Builtins::kPromiseCatchFinally, factory()->empty_string(),
    4348       83396 :         1);
    4349             :     info->set_native(true);
    4350             :     native_context()->set_promise_catch_finally_shared_fun(*info);
    4351             :   }
    4352             : 
    4353             :   {
    4354             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4355             :         isolate(), Builtins::kPromiseValueThunkFinally,
    4356       83396 :         factory()->empty_string(), 0);
    4357             :     native_context()->set_promise_value_thunk_finally_shared_fun(*info);
    4358             :   }
    4359             : 
    4360             :   {
    4361             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4362             :         isolate(), Builtins::kPromiseThrowerFinally, factory()->empty_string(),
    4363       83396 :         0);
    4364             :     native_context()->set_promise_thrower_finally_shared_fun(*info);
    4365             :   }
    4366             : }
    4367             : 
    4368      250198 : void Genesis::InitializeGlobal_harmony_regexp_dotall() {
    4369      166812 :   if (!FLAG_harmony_regexp_dotall) return;
    4370             : 
    4371             :   Handle<JSFunction> constructor(native_context()->regexp_function());
    4372             :   Handle<JSObject> prototype(JSObject::cast(constructor->instance_prototype()));
    4373             : 
    4374             :   SimpleInstallGetter(prototype, isolate()->factory()->dotAll_string(),
    4375       83396 :                       Builtins::kRegExpPrototypeDotAllGetter, true);
    4376             : 
    4377             :   // The regexp prototype map has changed because we added a property
    4378             :   // to it, so we update the saved map.
    4379             :   Handle<Map> prototype_map(prototype->map());
    4380       83396 :   Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate());
    4381             :   native_context()->set_regexp_prototype_map(*prototype_map);
    4382             : }
    4383             : 
    4384       83478 : void Genesis::InitializeGlobal_harmony_bigint() {
    4385      166812 :   if (!FLAG_harmony_bigint) return;
    4386             : 
    4387          18 :   Handle<JSGlobalObject> global(native_context()->global_object());
    4388             :   Handle<JSFunction> bigint_fun = InstallFunction(
    4389             :       global, "BigInt", JS_VALUE_TYPE, JSValue::kSize, 0,
    4390          18 :       isolate()->factory()->the_hole_value(), Builtins::kBigIntConstructor);
    4391             :   bigint_fun->shared()->DontAdaptArguments();
    4392             :   bigint_fun->shared()->SetConstructStub(
    4393          36 :       *BUILTIN_CODE(isolate(), BigIntConstructor_ConstructStub));
    4394             :   bigint_fun->shared()->set_length(1);
    4395             :   InstallWithIntrinsicDefaultProto(isolate(), bigint_fun,
    4396          18 :                                    Context::BIGINT_FUNCTION_INDEX);
    4397             :   heap()->bigint_map()->SetConstructorFunctionIndex(
    4398          18 :       Context::BIGINT_FUNCTION_INDEX);
    4399             : 
    4400             :   // Install the properties of the BigInt constructor.
    4401             :   // parseInt(string, radix)
    4402             :   SimpleInstallFunction(bigint_fun, "parseInt", Builtins::kBigIntParseInt, 2,
    4403          18 :                         false);
    4404             :   // asUintN(bits, bigint)
    4405             :   SimpleInstallFunction(bigint_fun, "asUintN", Builtins::kBigIntAsUintN, 2,
    4406          18 :                         false);
    4407             :   // asIntN(bits, bigint)
    4408             :   SimpleInstallFunction(bigint_fun, "asIntN", Builtins::kBigIntAsIntN, 2,
    4409          18 :                         false);
    4410             : 
    4411             :   // Set up the %BigIntPrototype%.
    4412             :   Handle<JSObject> prototype(JSObject::cast(bigint_fun->instance_prototype()));
    4413          18 :   JSFunction::SetPrototype(bigint_fun, prototype);
    4414             : 
    4415             :   // Install the properties of the BigInt.prototype.
    4416             :   // "constructor" is created implicitly by InstallFunction() above.
    4417             :   // toLocaleString([reserved1 [, reserved2]])
    4418             :   SimpleInstallFunction(prototype, "toLocaleString",
    4419          18 :                         Builtins::kBigIntPrototypeToLocaleString, 0, false);
    4420             :   // toString([radix])
    4421             :   SimpleInstallFunction(prototype, "toString",
    4422          18 :                         Builtins::kBigIntPrototypeToString, 0, false);
    4423             :   // valueOf()
    4424             :   SimpleInstallFunction(prototype, "valueOf", Builtins::kBigIntPrototypeValueOf,
    4425          18 :                         0, false);
    4426             : }
    4427             : 
    4428             : #ifdef V8_INTL_SUPPORT
    4429             : 
    4430       84104 : void Genesis::InitializeGlobal_harmony_number_format_to_parts() {
    4431      166463 :   if (!FLAG_harmony_number_format_to_parts) return;
    4432             :   Handle<JSObject> number_format_prototype(JSObject::cast(
    4433         349 :       native_context()->intl_number_format_function()->prototype()));
    4434         349 :   Handle<String> name = factory()->InternalizeUtf8String("formatToParts");
    4435             :   InstallFunction(number_format_prototype,
    4436             :                   SimpleCreateFunction(
    4437             :                       isolate(), name,
    4438             :                       Builtins::kNumberFormatPrototypeFormatToParts, 1, false),
    4439         349 :                   name);
    4440             : }
    4441             : 
    4442      250198 : void Genesis::InitializeGlobal_harmony_plural_rules() {
    4443       83416 :   if (!FLAG_harmony_plural_rules) return;
    4444             : 
    4445             :   Handle<JSFunction> plural_rules(
    4446             :       native_context()->intl_plural_rules_function());
    4447             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4448             :       JSReceiver::GetProperty(
    4449       83396 :           Handle<JSReceiver>(native_context()->global_object()),
    4450      166792 :           factory()->InternalizeUtf8String("Intl"))
    4451      166792 :           .ToHandleChecked());
    4452             :   JSObject::AddProperty(intl, factory()->InternalizeUtf8String("PluralRules"),
    4453      166792 :                         plural_rules, DONT_ENUM);
    4454             : }
    4455             : 
    4456             : #endif  // V8_INTL_SUPPORT
    4457             : 
    4458         122 : Handle<JSFunction> Genesis::CreateArrayBuffer(Handle<String> name,
    4459             :                                               Builtins::Name call_byteLength,
    4460             :                                               BuiltinFunctionId byteLength_id,
    4461         976 :                                               Builtins::Name call_slice) {
    4462             :   // Create the %ArrayBufferPrototype%
    4463             :   // Setup the {prototype} with the given {name} for @@toStringTag.
    4464             :   Handle<JSObject> prototype =
    4465         244 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    4466             :   JSObject::AddProperty(prototype, factory()->to_string_tag_symbol(), name,
    4467         122 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4468             : 
    4469             :   // Allocate the constructor with the given {prototype}.
    4470             :   Handle<JSFunction> array_buffer_fun =
    4471             :       CreateFunction(isolate(), name, JS_ARRAY_BUFFER_TYPE,
    4472             :                      JSArrayBuffer::kSizeWithEmbedderFields, 0, prototype,
    4473         122 :                      Builtins::kArrayBufferConstructor);
    4474             :   Handle<Code> code =
    4475         122 :       BUILTIN_CODE(isolate(), ArrayBufferConstructor_ConstructStub);
    4476         122 :   array_buffer_fun->shared()->SetConstructStub(*code);
    4477             :   array_buffer_fun->shared()->DontAdaptArguments();
    4478             :   array_buffer_fun->shared()->set_length(1);
    4479         122 :   array_buffer_fun->shared()->set_instance_class_name(*name);
    4480             : 
    4481             :   // Install the "constructor" property on the {prototype}.
    4482             :   JSObject::AddProperty(prototype, factory()->constructor_string(),
    4483         122 :                         array_buffer_fun, DONT_ENUM);
    4484             : 
    4485             :   SimpleInstallFunction(array_buffer_fun, factory()->isView_string(),
    4486             :                         Builtins::kArrayBufferIsView, 1, true, DONT_ENUM,
    4487         122 :                         kArrayBufferIsView);
    4488             : 
    4489             :   // Install the "byteLength" getter on the {prototype}.
    4490             :   SimpleInstallGetter(prototype, factory()->byte_length_string(),
    4491         122 :                       call_byteLength, false, byteLength_id);
    4492             : 
    4493         122 :   SimpleInstallFunction(prototype, "slice", call_slice, 2, true);
    4494             : 
    4495         122 :   return array_buffer_fun;
    4496             : }
    4497             : 
    4498             : 
    4499         122 : Handle<JSFunction> Genesis::InstallInternalArray(Handle<JSObject> target,
    4500             :                                                  const char* name,
    4501         488 :                                                  ElementsKind elements_kind) {
    4502             :   // --- I n t e r n a l   A r r a y ---
    4503             :   // An array constructor on the builtins object that works like
    4504             :   // the public Array constructor, except that its prototype
    4505             :   // doesn't inherit from Object.prototype.
    4506             :   // To be used only for internal work by builtins. Instances
    4507             :   // must not be leaked to user code.
    4508             :   Handle<JSObject> prototype =
    4509         244 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    4510             :   Handle<JSFunction> array_function =
    4511             :       InstallFunction(target, name, JS_ARRAY_TYPE, JSArray::kSize, 0, prototype,
    4512         122 :                       Builtins::kInternalArrayConstructor);
    4513             : 
    4514         122 :   InternalArrayConstructorStub internal_array_constructor_stub(isolate());
    4515         122 :   Handle<Code> code = internal_array_constructor_stub.GetCode();
    4516         122 :   array_function->shared()->SetConstructStub(*code);
    4517             :   array_function->shared()->DontAdaptArguments();
    4518             : 
    4519             :   Handle<Map> original_map(array_function->initial_map());
    4520         122 :   Handle<Map> initial_map = Map::Copy(original_map, "InternalArray");
    4521             :   initial_map->set_elements_kind(elements_kind);
    4522         122 :   JSFunction::SetInitialMap(array_function, initial_map, prototype);
    4523             : 
    4524             :   // Make "length" magic on instances.
    4525         122 :   Map::EnsureDescriptorSlack(initial_map, 1);
    4526             : 
    4527             :   PropertyAttributes attribs = static_cast<PropertyAttributes>(
    4528             :       DONT_ENUM | DONT_DELETE);
    4529             : 
    4530             :   Handle<AccessorInfo> array_length =
    4531         122 :       Accessors::ArrayLengthInfo(isolate(), attribs);
    4532             :   {  // Add length.
    4533             :     Descriptor d = Descriptor::AccessorConstant(
    4534             :         Handle<Name>(Name::cast(array_length->name())), array_length, attribs);
    4535         122 :     initial_map->AppendDescriptor(&d);
    4536             :   }
    4537             : 
    4538         122 :   return array_function;
    4539             : }
    4540             : 
    4541        3172 : bool Genesis::InstallNatives(GlobalContextType context_type) {
    4542             :   HandleScope scope(isolate());
    4543             : 
    4544             :   // Set up the utils object as shared container between native scripts.
    4545         122 :   Handle<JSObject> utils = factory()->NewJSObject(isolate()->object_function());
    4546             :   JSObject::NormalizeProperties(utils, CLEAR_INOBJECT_PROPERTIES, 16,
    4547          61 :                                 "utils container for native scripts");
    4548             :   native_context()->set_natives_utils_object(*utils);
    4549             : 
    4550             :   // Set up the extras utils object as a shared container between native
    4551             :   // scripts and extras. (Extras consume things added there by native scripts.)
    4552             :   Handle<JSObject> extras_utils =
    4553         122 :       factory()->NewJSObject(isolate()->object_function());
    4554             :   native_context()->set_extras_utils_object(*extras_utils);
    4555             : 
    4556          61 :   InstallInternalArray(extras_utils, "InternalPackedArray", PACKED_ELEMENTS);
    4557             : 
    4558             :   InstallFunction(extras_utils, isolate()->promise_internal_constructor(),
    4559         122 :                   factory()->NewStringFromAsciiChecked("createPromise"));
    4560             :   InstallFunction(extras_utils, isolate()->promise_resolve(),
    4561         122 :                   factory()->NewStringFromAsciiChecked("resolvePromise"));
    4562             :   InstallFunction(extras_utils, isolate()->is_promise(),
    4563         122 :                   factory()->NewStringFromAsciiChecked("isPromise"));
    4564             : 
    4565          61 :   int builtin_index = Natives::GetDebuggerCount();
    4566             :   // Only run prologue.js at this point.
    4567             :   DCHECK_EQ(builtin_index, Natives::GetIndex("prologue"));
    4568         122 :   if (!Bootstrapper::CompileBuiltin(isolate(), builtin_index++)) return false;
    4569             : 
    4570             :   {
    4571             :     // Builtin function for OpaqueReference -- a JSValue-based object,
    4572             :     // that keeps its field isolated from JavaScript code. It may store
    4573             :     // objects, that JavaScript code may not access.
    4574             :     Handle<JSObject> prototype =
    4575         122 :         factory()->NewJSObject(isolate()->object_function(), TENURED);
    4576             :     Handle<JSFunction> opaque_reference_fun =
    4577             :         CreateFunction(isolate(), factory()->empty_string(), JS_VALUE_TYPE,
    4578          61 :                        JSValue::kSize, 0, prototype, Builtins::kIllegal);
    4579             :     native_context()->set_opaque_reference_function(*opaque_reference_fun);
    4580             :   }
    4581             : 
    4582             :   // InternalArrays should not use Smi-Only array optimizations. There are too
    4583             :   // many places in the C++ runtime code (e.g. RegEx) that assume that
    4584             :   // elements in InternalArrays can be set to non-Smi values without going
    4585             :   // through a common bottleneck that would make the SMI_ONLY -> FAST_ELEMENT
    4586             :   // transition easy to trap. Moreover, they rarely are smi-only.
    4587             :   {
    4588             :     HandleScope scope(isolate());
    4589             :     Handle<JSObject> utils =
    4590          61 :         Handle<JSObject>::cast(isolate()->natives_utils_object());
    4591             :     Handle<JSFunction> array_function =
    4592          61 :         InstallInternalArray(utils, "InternalArray", HOLEY_ELEMENTS);
    4593             :     native_context()->set_internal_array_function(*array_function);
    4594             :   }
    4595             : 
    4596             :   // Run the rest of the native scripts.
    4597         610 :   while (builtin_index < Natives::GetBuiltinsCount()) {
    4598         976 :     if (!Bootstrapper::CompileBuiltin(isolate(), builtin_index++)) return false;
    4599             :   }
    4600             : 
    4601          61 :   if (!CallUtilsFunction(isolate(), "PostNatives")) return false;
    4602             :   auto fast_template_instantiations_cache = isolate()->factory()->NewFixedArray(
    4603          61 :       TemplateInfo::kFastTemplateInstantiationsCacheSize);
    4604             :   native_context()->set_fast_template_instantiations_cache(
    4605             :       *fast_template_instantiations_cache);
    4606             : 
    4607             :   auto slow_template_instantiations_cache = UnseededNumberDictionary::New(
    4608          61 :       isolate(), ApiNatives::kInitialFunctionCacheSize);
    4609             :   native_context()->set_slow_template_instantiations_cache(
    4610             :       *slow_template_instantiations_cache);
    4611             : 
    4612             :   // Store the map for the %ObjectPrototype% after the natives has been compiled
    4613             :   // and the Object function has been set up.
    4614             :   {
    4615             :     Handle<JSFunction> object_function(native_context()->object_function());
    4616             :     DCHECK(JSObject::cast(object_function->initial_map()->prototype())
    4617             :                ->HasFastProperties());
    4618             :     native_context()->set_object_function_prototype_map(
    4619             :         HeapObject::cast(object_function->initial_map()->prototype())->map());
    4620             :   }
    4621             : 
    4622             :   // Store the map for the %StringPrototype% after the natives has been compiled
    4623             :   // and the String function has been set up.
    4624             :   Handle<JSFunction> string_function(native_context()->string_function());
    4625             :   JSObject* string_function_prototype =
    4626             :       JSObject::cast(string_function->initial_map()->prototype());
    4627             :   DCHECK(string_function_prototype->HasFastProperties());
    4628             :   native_context()->set_string_function_prototype_map(
    4629             :       string_function_prototype->map());
    4630             : 
    4631             :   Handle<JSGlobalObject> global_object =
    4632          61 :       handle(native_context()->global_object());
    4633             : 
    4634             :   // Install Global.decodeURI.
    4635             :   SimpleInstallFunction(global_object, "decodeURI", Builtins::kGlobalDecodeURI,
    4636          61 :                         1, false, kGlobalDecodeURI);
    4637             : 
    4638             :   // Install Global.decodeURIComponent.
    4639             :   SimpleInstallFunction(global_object, "decodeURIComponent",
    4640             :                         Builtins::kGlobalDecodeURIComponent, 1, false,
    4641          61 :                         kGlobalDecodeURIComponent);
    4642             : 
    4643             :   // Install Global.encodeURI.
    4644             :   SimpleInstallFunction(global_object, "encodeURI", Builtins::kGlobalEncodeURI,
    4645          61 :                         1, false, kGlobalEncodeURI);
    4646             : 
    4647             :   // Install Global.encodeURIComponent.
    4648             :   SimpleInstallFunction(global_object, "encodeURIComponent",
    4649             :                         Builtins::kGlobalEncodeURIComponent, 1, false,
    4650          61 :                         kGlobalEncodeURIComponent);
    4651             : 
    4652             :   // Install Global.escape.
    4653             :   SimpleInstallFunction(global_object, "escape", Builtins::kGlobalEscape, 1,
    4654          61 :                         false, kGlobalEscape);
    4655             : 
    4656             :   // Install Global.unescape.
    4657             :   SimpleInstallFunction(global_object, "unescape", Builtins::kGlobalUnescape, 1,
    4658          61 :                         false, kGlobalUnescape);
    4659             : 
    4660             :   // Install Global.eval.
    4661             :   {
    4662             :     Handle<JSFunction> eval =
    4663             :         SimpleInstallFunction(global_object, factory()->eval_string(),
    4664          61 :                               Builtins::kGlobalEval, 1, false);
    4665             :     native_context()->set_global_eval_fun(*eval);
    4666             :   }
    4667             : 
    4668             :   // Install Global.isFinite
    4669             :   SimpleInstallFunction(global_object, "isFinite", Builtins::kGlobalIsFinite, 1,
    4670          61 :                         true, kGlobalIsFinite);
    4671             : 
    4672             :   // Install Global.isNaN
    4673             :   SimpleInstallFunction(global_object, "isNaN", Builtins::kGlobalIsNaN, 1, true,
    4674          61 :                         kGlobalIsNaN);
    4675             : 
    4676             :   // Install Array builtin functions.
    4677             :   {
    4678             :     Handle<JSFunction> array_constructor(native_context()->array_function());
    4679          61 :     Handle<JSArray> proto(JSArray::cast(array_constructor->prototype()));
    4680             : 
    4681             :     // Verification of important array prototype properties.
    4682             :     Object* length = proto->length();
    4683          61 :     CHECK(length->IsSmi());
    4684          61 :     CHECK_EQ(Smi::ToInt(length), 0);
    4685          61 :     CHECK(proto->HasSmiOrObjectElements());
    4686             :     // This is necessary to enable fast checks for absence of elements
    4687             :     // on Array.prototype and below.
    4688         122 :     proto->set_elements(heap()->empty_fixed_array());
    4689             :   }
    4690             : 
    4691             :   // Install InternalArray.prototype.concat
    4692             :   {
    4693             :     Handle<JSFunction> array_constructor(
    4694             :         native_context()->internal_array_function());
    4695          61 :     Handle<JSObject> proto(JSObject::cast(array_constructor->prototype()));
    4696          61 :     SimpleInstallFunction(proto, "concat", Builtins::kArrayConcat, 1, false);
    4697             :   }
    4698             : 
    4699          61 :   InstallBuiltinFunctionIds();
    4700             : 
    4701             :   // Create a map for accessor property descriptors (a variant of JSObject
    4702             :   // that predefines four properties get, set, configurable and enumerable).
    4703             :   {
    4704             :     // AccessorPropertyDescriptor initial map.
    4705             :     Handle<Map> map =
    4706             :         factory()->NewMap(JS_OBJECT_TYPE, JSAccessorPropertyDescriptor::kSize,
    4707          61 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4708             :     // Create the descriptor array for the property descriptor object.
    4709          61 :     Map::EnsureDescriptorSlack(map, 4);
    4710             : 
    4711             :     {  // get
    4712             :       Descriptor d = Descriptor::DataField(
    4713             :           factory()->get_string(), JSAccessorPropertyDescriptor::kGetIndex,
    4714          61 :           NONE, Representation::Tagged());
    4715          61 :       map->AppendDescriptor(&d);
    4716             :     }
    4717             :     {  // set
    4718             :       Descriptor d = Descriptor::DataField(
    4719             :           factory()->set_string(), JSAccessorPropertyDescriptor::kSetIndex,
    4720          61 :           NONE, Representation::Tagged());
    4721          61 :       map->AppendDescriptor(&d);
    4722             :     }
    4723             :     {  // enumerable
    4724             :       Descriptor d =
    4725             :           Descriptor::DataField(factory()->enumerable_string(),
    4726             :                                 JSAccessorPropertyDescriptor::kEnumerableIndex,
    4727          61 :                                 NONE, Representation::Tagged());
    4728          61 :       map->AppendDescriptor(&d);
    4729             :     }
    4730             :     {  // configurable
    4731             :       Descriptor d = Descriptor::DataField(
    4732             :           factory()->configurable_string(),
    4733             :           JSAccessorPropertyDescriptor::kConfigurableIndex, NONE,
    4734          61 :           Representation::Tagged());
    4735          61 :       map->AppendDescriptor(&d);
    4736             :     }
    4737             : 
    4738         122 :     Map::SetPrototype(map, isolate()->initial_object_prototype());
    4739             :     map->SetConstructor(native_context()->object_function());
    4740             : 
    4741             :     native_context()->set_accessor_property_descriptor_map(*map);
    4742             :   }
    4743             : 
    4744             :   // Create a map for data property descriptors (a variant of JSObject
    4745             :   // that predefines four properties value, writable, configurable and
    4746             :   // enumerable).
    4747             :   {
    4748             :     // DataPropertyDescriptor initial map.
    4749             :     Handle<Map> map =
    4750             :         factory()->NewMap(JS_OBJECT_TYPE, JSDataPropertyDescriptor::kSize,
    4751          61 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4752             :     // Create the descriptor array for the property descriptor object.
    4753          61 :     Map::EnsureDescriptorSlack(map, 4);
    4754             : 
    4755             :     {  // value
    4756             :       Descriptor d = Descriptor::DataField(
    4757             :           factory()->value_string(), JSDataPropertyDescriptor::kValueIndex,
    4758          61 :           NONE, Representation::Tagged());
    4759          61 :       map->AppendDescriptor(&d);
    4760             :     }
    4761             :     {  // writable
    4762             :       Descriptor d =
    4763             :           Descriptor::DataField(factory()->writable_string(),
    4764             :                                 JSDataPropertyDescriptor::kWritableIndex, NONE,
    4765          61 :                                 Representation::Tagged());
    4766          61 :       map->AppendDescriptor(&d);
    4767             :     }
    4768             :     {  // enumerable
    4769             :       Descriptor d =
    4770             :           Descriptor::DataField(factory()->enumerable_string(),
    4771             :                                 JSDataPropertyDescriptor::kEnumerableIndex,
    4772          61 :                                 NONE, Representation::Tagged());
    4773          61 :       map->AppendDescriptor(&d);
    4774             :     }
    4775             :     {  // configurable
    4776             :       Descriptor d =
    4777             :           Descriptor::DataField(factory()->configurable_string(),
    4778             :                                 JSDataPropertyDescriptor::kConfigurableIndex,
    4779          61 :                                 NONE, Representation::Tagged());
    4780          61 :       map->AppendDescriptor(&d);
    4781             :     }
    4782             : 
    4783         122 :     Map::SetPrototype(map, isolate()->initial_object_prototype());
    4784             :     map->SetConstructor(native_context()->object_function());
    4785             : 
    4786             :     native_context()->set_data_property_descriptor_map(*map);
    4787             :   }
    4788             : 
    4789             :   // Create a constructor for RegExp results (a variant of Array that
    4790             :   // predefines the two properties index and match).
    4791             :   {
    4792             :     // RegExpResult initial map.
    4793             : 
    4794             :     // Find global.Array.prototype to inherit from.
    4795             :     Handle<JSFunction> array_constructor(native_context()->array_function());
    4796             :     Handle<JSObject> array_prototype(
    4797             :         JSObject::cast(array_constructor->instance_prototype()));
    4798             : 
    4799             :     // Add initial map.
    4800             :     Handle<Map> initial_map = factory()->NewMap(
    4801          61 :         JS_ARRAY_TYPE, JSRegExpResult::kSize, TERMINAL_FAST_ELEMENTS_KIND, 2);
    4802             :     initial_map->SetConstructor(*array_constructor);
    4803             : 
    4804             :     // Set prototype on map.
    4805             :     initial_map->set_non_instance_prototype(false);
    4806          61 :     Map::SetPrototype(initial_map, array_prototype);
    4807             : 
    4808             :     // Update map with length accessor from Array and add "index" and "input".
    4809          61 :     Map::EnsureDescriptorSlack(initial_map, 3);
    4810             : 
    4811             :     {
    4812             :       JSFunction* array_function = native_context()->array_function();
    4813             :       Handle<DescriptorArray> array_descriptors(
    4814             :           array_function->initial_map()->instance_descriptors());
    4815             :       Handle<String> length = factory()->length_string();
    4816             :       int old = array_descriptors->SearchWithCache(
    4817             :           isolate(), *length, array_function->initial_map());
    4818             :       DCHECK_NE(old, DescriptorArray::kNotFound);
    4819             :       Descriptor d = Descriptor::AccessorConstant(
    4820             :           length, handle(array_descriptors->GetValue(old), isolate()),
    4821         122 :           array_descriptors->GetDetails(old).attributes());
    4822          61 :       initial_map->AppendDescriptor(&d);
    4823             :     }
    4824             :     {
    4825             :       Descriptor d = Descriptor::DataField(factory()->index_string(),
    4826             :                                            JSRegExpResult::kIndexIndex, NONE,
    4827          61 :                                            Representation::Tagged());
    4828          61 :       initial_map->AppendDescriptor(&d);
    4829             :     }
    4830             : 
    4831             :     {
    4832             :       Descriptor d = Descriptor::DataField(factory()->input_string(),
    4833             :                                            JSRegExpResult::kInputIndex, NONE,
    4834          61 :                                            Representation::Tagged());
    4835          61 :       initial_map->AppendDescriptor(&d);
    4836             :     }
    4837             : 
    4838             :     native_context()->set_regexp_result_map(*initial_map);
    4839             :   }
    4840             : 
    4841             :   // Add @@iterator method to the arguments object maps.
    4842             :   {
    4843             :     PropertyAttributes attribs = DONT_ENUM;
    4844             :     Handle<AccessorInfo> arguments_iterator =
    4845          61 :         Accessors::ArgumentsIteratorInfo(isolate(), attribs);
    4846             :     {
    4847             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4848             :                                                   arguments_iterator, attribs);
    4849             :       Handle<Map> map(native_context()->sloppy_arguments_map());
    4850          61 :       Map::EnsureDescriptorSlack(map, 1);
    4851          61 :       map->AppendDescriptor(&d);
    4852             :     }
    4853             :     {
    4854             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4855             :                                                   arguments_iterator, attribs);
    4856             :       Handle<Map> map(native_context()->fast_aliased_arguments_map());
    4857          61 :       Map::EnsureDescriptorSlack(map, 1);
    4858          61 :       map->AppendDescriptor(&d);
    4859             :     }
    4860             :     {
    4861             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4862             :                                                   arguments_iterator, attribs);
    4863             :       Handle<Map> map(native_context()->slow_aliased_arguments_map());
    4864          61 :       Map::EnsureDescriptorSlack(map, 1);
    4865          61 :       map->AppendDescriptor(&d);
    4866             :     }
    4867             :     {
    4868             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4869             :                                                   arguments_iterator, attribs);
    4870             :       Handle<Map> map(native_context()->strict_arguments_map());
    4871          61 :       Map::EnsureDescriptorSlack(map, 1);
    4872          61 :       map->AppendDescriptor(&d);
    4873             :     }
    4874             :   }
    4875             : 
    4876          61 :   return true;
    4877             : }
    4878             : 
    4879         244 : bool Genesis::InstallExtraNatives() {
    4880             :   HandleScope scope(isolate());
    4881             : 
    4882             :   Handle<JSObject> extras_binding =
    4883         122 :       factory()->NewJSObject(isolate()->object_function());
    4884             :   native_context()->set_extras_binding_object(*extras_binding);
    4885             : 
    4886         244 :   for (int i = ExtraNatives::GetDebuggerCount();
    4887         122 :        i < ExtraNatives::GetBuiltinsCount(); i++) {
    4888          61 :     if (!Bootstrapper::CompileExtraBuiltin(isolate(), i)) return false;
    4889             :   }
    4890             : 
    4891             :   return true;
    4892             : }
    4893             : 
    4894             : 
    4895          10 : bool Genesis::InstallExperimentalExtraNatives() {
    4896          20 :   for (int i = ExperimentalExtraNatives::GetDebuggerCount();
    4897          10 :        i < ExperimentalExtraNatives::GetBuiltinsCount(); i++) {
    4898           5 :     if (!Bootstrapper::CompileExperimentalExtraBuiltin(isolate(), i))
    4899             :       return false;
    4900             :   }
    4901             : 
    4902             :   return true;
    4903             : }
    4904             : 
    4905             : 
    4906       17378 : bool Genesis::InstallDebuggerNatives() {
    4907       16541 :   for (int i = 0; i < Natives::GetDebuggerCount(); ++i) {
    4908       12615 :     if (!Bootstrapper::CompileBuiltin(isolate(), i)) return false;
    4909             :   }
    4910             :   return true;
    4911             : }
    4912             : 
    4913             : 
    4914        7869 : static void InstallBuiltinFunctionId(Handle<JSObject> holder,
    4915             :                                      const char* function_name,
    4916             :                                      BuiltinFunctionId id) {
    4917             :   Isolate* isolate = holder->GetIsolate();
    4918             :   Handle<Object> function_object =
    4919       15738 :       JSReceiver::GetProperty(isolate, holder, function_name).ToHandleChecked();
    4920             :   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
    4921             :   function->shared()->set_builtin_function_id(id);
    4922        7869 : }
    4923             : 
    4924             : 
    4925             : #define INSTALL_BUILTIN_ID(holder_expr, fun_name, name) \
    4926             :   { #holder_expr, #fun_name, k##name }                  \
    4927             :   ,
    4928             : 
    4929             : 
    4930          61 : void Genesis::InstallBuiltinFunctionIds() {
    4931             :   HandleScope scope(isolate());
    4932             :   struct BuiltinFunctionIds {
    4933             :     const char* holder_expr;
    4934             :     const char* fun_name;
    4935             :     BuiltinFunctionId id;
    4936             :   };
    4937             : 
    4938             :   const BuiltinFunctionIds builtins[] = {
    4939          61 :       FUNCTIONS_WITH_ID_LIST(INSTALL_BUILTIN_ID)};
    4940             : 
    4941        7930 :   for (const BuiltinFunctionIds& builtin : builtins) {
    4942             :     Handle<JSObject> holder =
    4943        7869 :         ResolveBuiltinIdHolder(native_context(), builtin.holder_expr);
    4944        7869 :     InstallBuiltinFunctionId(holder, builtin.fun_name, builtin.id);
    4945             :   }
    4946          61 : }
    4947             : 
    4948             : #undef INSTALL_BUILTIN_ID
    4949             : 
    4950             : 
    4951          61 : void Genesis::InitializeNormalizedMapCaches() {
    4952          61 :   Handle<NormalizedMapCache> cache = NormalizedMapCache::New(isolate());
    4953             :   native_context()->set_normalized_map_cache(*cache);
    4954          61 : }
    4955             : 
    4956             : 
    4957       82760 : bool Bootstrapper::InstallExtensions(Handle<Context> native_context,
    4958             :                                      v8::ExtensionConfiguration* extensions) {
    4959             :   BootstrapperActive active(this);
    4960      165520 :   SaveContext saved_context(isolate_);
    4961       82760 :   isolate_->set_context(*native_context);
    4962      165480 :   return Genesis::InstallExtensions(native_context, extensions) &&
    4963      165480 :       Genesis::InstallSpecialObjects(native_context);
    4964             : }
    4965             : 
    4966             : 
    4967       82720 : bool Genesis::InstallSpecialObjects(Handle<Context> native_context) {
    4968       82720 :   Isolate* isolate = native_context->GetIsolate();
    4969             :   // Don't install extensions into the snapshot.
    4970       82720 :   if (isolate->serializer_enabled()) return true;
    4971             : 
    4972             :   Factory* factory = isolate->factory();
    4973             :   HandleScope scope(isolate);
    4974             : 
    4975       82529 :   Handle<JSObject> Error = isolate->error_function();
    4976             :   Handle<String> name =
    4977       82529 :       factory->InternalizeOneByteString(STATIC_CHAR_VECTOR("stackTraceLimit"));
    4978       82529 :   Handle<Smi> stack_trace_limit(Smi::FromInt(FLAG_stack_trace_limit), isolate);
    4979       82529 :   JSObject::AddProperty(Error, name, stack_trace_limit, NONE);
    4980             : 
    4981       82529 :   if (FLAG_expose_wasm) {
    4982             :     // Install the internal data structures into the isolate and expose on
    4983             :     // the global object.
    4984       82499 :     WasmJs::Install(isolate, true);
    4985          30 :   } else if (FLAG_validate_asm) {
    4986             :     // Install the internal data structures only; these are needed for asm.js
    4987             :     // translated to WASM to work correctly.
    4988          30 :     WasmJs::Install(isolate, false);
    4989             :   }
    4990             : 
    4991             :   return true;
    4992             : }
    4993             : 
    4994             : 
    4995             : static uint32_t Hash(RegisteredExtension* extension) {
    4996             :   return v8::internal::ComputePointerHash(extension);
    4997             : }
    4998             : 
    4999           0 : Genesis::ExtensionStates::ExtensionStates() : map_(8) {}
    5000             : 
    5001        4290 : Genesis::ExtensionTraversalState Genesis::ExtensionStates::get_state(
    5002             :     RegisteredExtension* extension) {
    5003        4290 :   base::HashMap::Entry* entry = map_.Lookup(extension, Hash(extension));
    5004        4290 :   if (entry == nullptr) {
    5005             :     return UNVISITED;
    5006             :   }
    5007             :   return static_cast<ExtensionTraversalState>(
    5008          60 :       reinterpret_cast<intptr_t>(entry->value));
    5009             : }
    5010             : 
    5011        8450 : void Genesis::ExtensionStates::set_state(RegisteredExtension* extension,
    5012             :                                          ExtensionTraversalState state) {
    5013       16900 :   map_.LookupOrInsert(extension, Hash(extension))->value =
    5014        8450 :       reinterpret_cast<void*>(static_cast<intptr_t>(state));
    5015        8450 : }
    5016             : 
    5017             : 
    5018       82760 : bool Genesis::InstallExtensions(Handle<Context> native_context,
    5019             :                                 v8::ExtensionConfiguration* extensions) {
    5020             :   Isolate* isolate = native_context->GetIsolate();
    5021             :   ExtensionStates extension_states;  // All extensions have state UNVISITED.
    5022      165520 :   return InstallAutoExtensions(isolate, &extension_states) &&
    5023       82760 :          (!FLAG_expose_free_buffer ||
    5024       82760 :           InstallExtension(isolate, "v8/free-buffer", &extension_states)) &&
    5025       84931 :          (!FLAG_expose_gc ||
    5026       84931 :           InstallExtension(isolate, "v8/gc", &extension_states)) &&
    5027       82865 :          (!FLAG_expose_externalize_string ||
    5028       82865 :           InstallExtension(isolate, "v8/externalize", &extension_states)) &&
    5029       82760 :          (!FLAG_gc_stats ||
    5030       82760 :           InstallExtension(isolate, "v8/statistics", &extension_states)) &&
    5031       82761 :          (!FLAG_expose_trigger_failure ||
    5032       82761 :           InstallExtension(isolate, "v8/trigger-failure", &extension_states)) &&
    5033       82769 :          (!FLAG_trace_ignition_dispatches ||
    5034             :           InstallExtension(isolate, "v8/ignition-statistics",
    5035      165529 :                            &extension_states)) &&
    5036      165520 :          InstallRequestedExtensions(isolate, extensions, &extension_states);
    5037             : }
    5038             : 
    5039             : 
    5040       82760 : bool Genesis::InstallAutoExtensions(Isolate* isolate,
    5041             :                                     ExtensionStates* extension_states) {
    5042      674990 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5043             :        it != nullptr; it = it->next()) {
    5044      592250 :     if (it->extension()->auto_enable() &&
    5045          20 :         !InstallExtension(isolate, it, extension_states)) {
    5046             :       return false;
    5047             :     }
    5048             :   }
    5049             :   return true;
    5050             : }
    5051             : 
    5052             : 
    5053       82760 : bool Genesis::InstallRequestedExtensions(Isolate* isolate,
    5054      167358 :                                          v8::ExtensionConfiguration* extensions,
    5055             :                                          ExtensionStates* extension_states) {
    5056      169196 :   for (const char** it = extensions->begin(); it != extensions->end(); ++it) {
    5057        1878 :     if (!InstallExtension(isolate, *it, extension_states)) return false;
    5058             :   }
    5059             :   return true;
    5060             : }
    5061             : 
    5062             : 
    5063             : // Installs a named extension.  This methods is unoptimized and does
    5064             : // not scale well if we want to support a large number of extensions.
    5065        4270 : bool Genesis::InstallExtension(Isolate* isolate,
    5066             :                                const char* name,
    5067             :                                ExtensionStates* extension_states) {
    5068       19942 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5069             :        it != nullptr; it = it->next()) {
    5070       19942 :     if (strcmp(name, it->extension()->name()) == 0) {
    5071        4270 :       return InstallExtension(isolate, it, extension_states);
    5072             :     }
    5073             :   }
    5074             :   return Utils::ApiCheck(false,
    5075             :                          "v8::Context::New()",
    5076           0 :                          "Cannot find required extension");
    5077             : }
    5078             : 
    5079             : 
    5080        4290 : bool Genesis::InstallExtension(Isolate* isolate,
    5081        4265 :                                v8::RegisteredExtension* current,
    5082             :                                ExtensionStates* extension_states) {
    5083             :   HandleScope scope(isolate);
    5084             : 
    5085        4290 :   if (extension_states->get_state(current) == INSTALLED) return true;
    5086             :   // The current node has already been visited so there must be a
    5087             :   // cycle in the dependency graph; fail.
    5088        4235 :   if (!Utils::ApiCheck(extension_states->get_state(current) != VISITED,
    5089             :                        "v8::Context::New()",
    5090        4235 :                        "Circular extension dependency")) {
    5091             :     return false;
    5092             :   }
    5093             :   DCHECK(extension_states->get_state(current) == UNVISITED);
    5094        4230 :   extension_states->set_state(current, VISITED);
    5095        4432 :   v8::Extension* extension = current->extension();
    5096             :   // Install the extension's dependencies
    5097        8652 :   for (int i = 0; i < extension->dependency_count(); i++) {
    5098         106 :     if (!InstallExtension(isolate,
    5099         106 :                           extension->dependencies()[i],
    5100         106 :                           extension_states)) {
    5101             :       return false;
    5102             :     }
    5103             :   }
    5104             :   // We do not expect this to throw an exception. Change this if it does.
    5105        4220 :   bool result = CompileExtension(isolate, extension);
    5106             :   DCHECK(isolate->has_pending_exception() != result);
    5107        4220 :   if (!result) {
    5108             :     // We print out the name of the extension that fail to install.
    5109             :     // When an error is thrown during bootstrapping we automatically print
    5110             :     // the line number at which this happened to the console in the isolate
    5111             :     // error throwing functionality.
    5112             :     base::OS::PrintError("Error installing extension '%s'.\n",
    5113          35 :                          current->extension()->name());
    5114             :     isolate->clear_pending_exception();
    5115             :   }
    5116        4220 :   extension_states->set_state(current, INSTALLED);
    5117        4220 :   return result;
    5118             : }
    5119             : 
    5120             : 
    5121       83572 : bool Genesis::ConfigureGlobalObjects(
    5122       47914 :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
    5123             :   Handle<JSObject> global_proxy(
    5124       83572 :       JSObject::cast(native_context()->global_proxy()));
    5125             :   Handle<JSObject> global_object(
    5126       83572 :       JSObject::cast(native_context()->global_object()));
    5127             : 
    5128       83572 :   if (!global_proxy_template.IsEmpty()) {
    5129             :     // Configure the global proxy object.
    5130             :     Handle<ObjectTemplateInfo> global_proxy_data =
    5131             :         v8::Utils::OpenHandle(*global_proxy_template);
    5132       47914 :     if (!ConfigureApiObject(global_proxy, global_proxy_data)) return false;
    5133             : 
    5134             :     // Configure the global object.
    5135             :     Handle<FunctionTemplateInfo> proxy_constructor(
    5136             :         FunctionTemplateInfo::cast(global_proxy_data->constructor()));
    5137       47914 :     if (!proxy_constructor->prototype_template()->IsUndefined(isolate())) {
    5138             :       Handle<ObjectTemplateInfo> global_object_data(
    5139             :           ObjectTemplateInfo::cast(proxy_constructor->prototype_template()));
    5140       47914 :       if (!ConfigureApiObject(global_object, global_object_data)) return false;
    5141             :     }
    5142             :   }
    5143             : 
    5144       83572 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5145             : 
    5146             :   native_context()->set_array_buffer_map(
    5147             :       native_context()->array_buffer_fun()->initial_map());
    5148             : 
    5149             :   Handle<JSFunction> js_map_fun(native_context()->js_map_fun());
    5150             :   Handle<JSFunction> js_set_fun(native_context()->js_set_fun());
    5151             :   // Force the Map/Set constructor to fast properties, so that we can use the
    5152             :   // fast paths for various things like
    5153             :   //
    5154             :   //   x instanceof Map
    5155             :   //   x instanceof Set
    5156             :   //
    5157             :   // etc. We should probably come up with a more principled approach once
    5158             :   // the JavaScript builtins are gone.
    5159       83572 :   JSObject::MigrateSlowToFast(js_map_fun, 0, "Bootstrapping");
    5160       83572 :   JSObject::MigrateSlowToFast(js_set_fun, 0, "Bootstrapping");
    5161             : 
    5162             :   native_context()->set_js_map_map(js_map_fun->initial_map());
    5163             :   native_context()->set_js_set_map(js_set_fun->initial_map());
    5164             : 
    5165       83572 :   return true;
    5166             : }
    5167             : 
    5168             : 
    5169       95828 : bool Genesis::ConfigureApiObject(Handle<JSObject> object,
    5170           0 :                                  Handle<ObjectTemplateInfo> object_template) {
    5171             :   DCHECK(!object_template.is_null());
    5172             :   DCHECK(FunctionTemplateInfo::cast(object_template->constructor())
    5173             :              ->IsTemplateFor(object->map()));;
    5174             : 
    5175             :   MaybeHandle<JSObject> maybe_obj =
    5176       95828 :       ApiNatives::InstantiateObject(object_template);
    5177             :   Handle<JSObject> obj;
    5178       95828 :   if (!maybe_obj.ToHandle(&obj)) {
    5179             :     DCHECK(isolate()->has_pending_exception());
    5180             :     isolate()->clear_pending_exception();
    5181           0 :     return false;
    5182             :   }
    5183       95828 :   TransferObject(obj, object);
    5184       95828 :   return true;
    5185             : }
    5186             : 
    5187             : 
    5188      179339 : void Genesis::TransferNamedProperties(Handle<JSObject> from,
    5189    14262375 :                                       Handle<JSObject> to) {
    5190             :   // If JSObject::AddProperty asserts due to already existing property,
    5191             :   // it is likely due to both global objects sharing property name(s).
    5192             :   // Merging those two global objects is impossible.
    5193             :   // The global template must not create properties that already exist
    5194             :   // in the snapshotted global object.
    5195      179339 :   if (from->HasFastProperties()) {
    5196             :     Handle<DescriptorArray> descs =
    5197             :         Handle<DescriptorArray>(from->map()->instance_descriptors());
    5198     1654990 :     for (int i = 0; i < from->map()->NumberOfOwnDescriptors(); i++) {
    5199      731667 :       PropertyDetails details = descs->GetDetails(i);
    5200      731667 :       if (details.location() == kField) {
    5201      229335 :         if (details.kind() == kData) {
    5202             :           HandleScope inner(isolate());
    5203             :           Handle<Name> key = Handle<Name>(descs->GetKey(i));
    5204      229335 :           FieldIndex index = FieldIndex::ForDescriptor(from->map(), i);
    5205             :           Handle<Object> value =
    5206      229335 :               JSObject::FastPropertyAt(from, details.representation(), index);
    5207      229335 :           JSObject::AddProperty(to, key, value, details.attributes());
    5208             :         } else {
    5209             :           DCHECK_EQ(kAccessor, details.kind());
    5210           0 :           UNREACHABLE();
    5211             :         }
    5212             : 
    5213             :       } else {
    5214             :         DCHECK_EQ(kDescriptor, details.location());
    5215      502332 :         if (details.kind() == kData) {
    5216             :           DCHECK(!FLAG_track_constant_fields);
    5217             :           HandleScope inner(isolate());
    5218             :           Handle<Name> key = Handle<Name>(descs->GetKey(i));
    5219             :           Handle<Object> value(descs->GetValue(i), isolate());
    5220      502152 :           JSObject::AddProperty(to, key, value, details.attributes());
    5221             : 
    5222             :         } else {
    5223             :           DCHECK_EQ(kAccessor, details.kind());
    5224             :           Handle<Name> key(descs->GetKey(i));
    5225         180 :           LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    5226         180 :           CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    5227             :           // If the property is already there we skip it
    5228         180 :           if (it.IsFound()) continue;
    5229             :           HandleScope inner(isolate());
    5230             :           DCHECK(!to->HasFastProperties());
    5231             :           // Add to dictionary.
    5232             :           Handle<Object> value(descs->GetValue(i), isolate());
    5233             :           PropertyDetails d(kAccessor, details.attributes(),
    5234             :                             PropertyCellType::kMutable);
    5235         180 :           JSObject::SetNormalizedProperty(to, key, value, d);
    5236             :         }
    5237             :       }
    5238             :     }
    5239       83511 :   } else if (from->IsJSGlobalObject()) {
    5240             :     // Copy all keys and values in enumeration order.
    5241             :     Handle<GlobalDictionary> properties(
    5242             :         JSGlobalObject::cast(*from)->global_dictionary());
    5243       83511 :     Handle<FixedArray> indices = GlobalDictionary::IterationIndices(properties);
    5244     8852606 :     for (int i = 0; i < indices->length(); i++) {
    5245             :       int index = Smi::ToInt(indices->get(i));
    5246             :       // If the property is already there we skip it.
    5247             :       Handle<PropertyCell> cell(properties->CellAt(index));
    5248             :       Handle<Name> key(cell->name(), isolate());
    5249     4342792 :       LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    5250     4342792 :       CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    5251     4342792 :       if (it.IsFound()) continue;
    5252             :       // Set the property.
    5253             :       Handle<Object> value(cell->value(), isolate());
    5254     4342792 :       if (value->IsTheHole(isolate())) continue;
    5255             :       PropertyDetails details = cell->property_details();
    5256     4342792 :       if (details.kind() != kData) continue;
    5257     4342792 :       JSObject::AddProperty(to, key, value, details.attributes());
    5258             :     }
    5259             :   } else {
    5260             :     // Copy all keys and values in enumeration order.
    5261             :     Handle<NameDictionary> properties =
    5262             :         Handle<NameDictionary>(from->property_dictionary());
    5263             :     Handle<FixedArray> key_indices =
    5264           0 :         NameDictionary::IterationIndices(properties);
    5265           0 :     for (int i = 0; i < key_indices->length(); i++) {
    5266             :       int key_index = Smi::ToInt(key_indices->get(i));
    5267             :       Object* raw_key = properties->KeyAt(key_index);
    5268             :       DCHECK(properties->IsKey(isolate(), raw_key));
    5269             :       DCHECK(raw_key->IsName());
    5270             :       // If the property is already there we skip it.
    5271             :       Handle<Name> key(Name::cast(raw_key), isolate());
    5272           0 :       LookupIterator it(to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    5273           0 :       CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    5274           0 :       if (it.IsFound()) continue;
    5275             :       // Set the property.
    5276             :       Handle<Object> value =
    5277           0 :           Handle<Object>(properties->ValueAt(key_index), isolate());
    5278             :       DCHECK(!value->IsCell());
    5279             :       DCHECK(!value->IsTheHole(isolate()));
    5280             :       PropertyDetails details = properties->DetailsAt(key_index);
    5281             :       DCHECK_EQ(kData, details.kind());
    5282           0 :       JSObject::AddProperty(to, key, value, details.attributes());
    5283             :     }
    5284             :   }
    5285      179339 : }
    5286             : 
    5287             : 
    5288      179339 : void Genesis::TransferIndexedProperties(Handle<JSObject> from,
    5289      179339 :                                         Handle<JSObject> to) {
    5290             :   // Cloning the elements array is sufficient.
    5291             :   Handle<FixedArray> from_elements =
    5292             :       Handle<FixedArray>(FixedArray::cast(from->elements()));
    5293      179339 :   Handle<FixedArray> to_elements = factory()->CopyFixedArray(from_elements);
    5294      179339 :   to->set_elements(*to_elements);
    5295      179339 : }
    5296             : 
    5297             : 
    5298      191656 : void Genesis::TransferObject(Handle<JSObject> from, Handle<JSObject> to) {
    5299             :   HandleScope outer(isolate());
    5300             : 
    5301             :   DCHECK(!from->IsJSArray());
    5302             :   DCHECK(!to->IsJSArray());
    5303             : 
    5304       95828 :   TransferNamedProperties(from, to);
    5305       95828 :   TransferIndexedProperties(from, to);
    5306             : 
    5307             :   // Transfer the prototype (new map is needed).
    5308             :   Handle<Object> proto(from->map()->prototype(), isolate());
    5309       95828 :   JSObject::ForceSetPrototype(to, proto);
    5310       95828 : }
    5311             : 
    5312             : 
    5313       83880 : Genesis::Genesis(
    5314      246311 :     Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5315             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    5316             :     size_t context_snapshot_index,
    5317             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
    5318             :     GlobalContextType context_type)
    5319       83880 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5320       83880 :   result_ = Handle<Context>::null();
    5321       83880 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5322             : 
    5323             :   // Before creating the roots we must save the context and restore it
    5324             :   // on all function exits.
    5325       83880 :   SaveContext saved_context(isolate);
    5326             : 
    5327             :   // During genesis, the boilerplate for stack overflow won't work until the
    5328             :   // environment has been at least partially initialized. Add a stack check
    5329             :   // before entering JS code to catch overflow early.
    5330             :   StackLimitCheck check(isolate);
    5331       83880 :   if (check.HasOverflowed()) {
    5332         283 :     isolate->StackOverflow();
    5333         283 :     return;
    5334             :   }
    5335             : 
    5336             :   // The deserializer needs to hook up references to the global proxy.
    5337             :   // Create an uninitialized global proxy now if we don't have one
    5338             :   // and initialize it later in CreateNewGlobals.
    5339             :   Handle<JSGlobalProxy> global_proxy;
    5340       83597 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5341             :     int instance_size = 0;
    5342       83525 :     if (context_snapshot_index > 0) {
    5343             :       // The global proxy function to reinitialize this global proxy is in the
    5344             :       // context that is yet to be deserialized. We need to prepare a global
    5345             :       // proxy of the correct size.
    5346             :       Object* size = isolate->heap()->serialized_global_proxy_sizes()->get(
    5347          20 :           static_cast<int>(context_snapshot_index) - 1);
    5348             :       instance_size = Smi::ToInt(size);
    5349             :     } else {
    5350             :       instance_size = JSGlobalProxy::SizeWithEmbedderFields(
    5351             :           global_proxy_template.IsEmpty()
    5352             :               ? 0
    5353       83505 :               : global_proxy_template->InternalFieldCount());
    5354             :     }
    5355             :     global_proxy =
    5356       83525 :         isolate->factory()->NewUninitializedJSGlobalProxy(instance_size);
    5357             :   }
    5358             : 
    5359             :   // We can only de-serialize a context if the isolate was initialized from
    5360             :   // a snapshot. Otherwise we have to build the context from scratch.
    5361             :   // Also create a context from scratch to expose natives, if required by flag.
    5362      250791 :   if (!isolate->initialized_from_snapshot() ||
    5363             :       !Snapshot::NewContextFromSnapshot(isolate, global_proxy,
    5364             :                                         context_snapshot_index,
    5365             :                                         embedder_fields_deserializer)
    5366      250709 :            .ToHandle(&native_context_)) {
    5367          61 :     native_context_ = Handle<Context>();
    5368             :   }
    5369             : 
    5370       83597 :   if (!native_context().is_null()) {
    5371       83536 :     AddToWeakNativeContextList(*native_context());
    5372             :     isolate->set_context(*native_context());
    5373       83536 :     isolate->counters()->contexts_created_by_snapshot()->Increment();
    5374             : #if V8_TRACE_MAPS
    5375             :     if (FLAG_trace_maps) {
    5376             :       Handle<JSFunction> object_fun = isolate->object_function();
    5377             :       PrintF("[TraceMap: InitialMap map= %p SFI= %d_Object ]\n",
    5378             :              reinterpret_cast<void*>(object_fun->initial_map()),
    5379             :              object_fun->shared()->unique_id());
    5380             :       Map::TraceAllTransitions(object_fun->initial_map());
    5381             :     }
    5382             : #endif
    5383             : 
    5384       83536 :     if (context_snapshot_index == 0) {
    5385             :       Handle<JSGlobalObject> global_object =
    5386       83511 :           CreateNewGlobals(global_proxy_template, global_proxy);
    5387       83511 :       HookUpGlobalObject(global_object);
    5388             : 
    5389       83511 :       if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5390             :     } else {
    5391             :       // The global proxy needs to be integrated into the native context.
    5392          25 :       HookUpGlobalProxy(global_proxy);
    5393             :     }
    5394             :     DCHECK(!global_proxy->IsDetachedFrom(native_context()->global_object()));
    5395             :   } else {
    5396             :     base::ElapsedTimer timer;
    5397          61 :     if (FLAG_profile_deserialization) timer.Start();
    5398             :     DCHECK_EQ(0u, context_snapshot_index);
    5399             :     // We get here if there was no context snapshot.
    5400          61 :     CreateRoots();
    5401          61 :     Handle<JSFunction> empty_function = CreateEmptyFunction(isolate);
    5402          61 :     CreateSloppyModeFunctionMaps(empty_function);
    5403          61 :     CreateStrictModeFunctionMaps(empty_function);
    5404          61 :     CreateObjectFunction(empty_function);
    5405          61 :     CreateIteratorMaps(empty_function);
    5406          61 :     CreateAsyncIteratorMaps(empty_function);
    5407          61 :     CreateAsyncFunctionMaps(empty_function);
    5408             :     Handle<JSGlobalObject> global_object =
    5409          61 :         CreateNewGlobals(global_proxy_template, global_proxy);
    5410          61 :     InitializeGlobal(global_object, empty_function, context_type);
    5411          61 :     InitializeNormalizedMapCaches();
    5412             : 
    5413          61 :     if (!InstallNatives(context_type)) return;
    5414          61 :     if (!InstallExtraNatives()) return;
    5415          61 :     if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5416             : 
    5417          61 :     isolate->counters()->contexts_created_from_scratch()->Increment();
    5418             : 
    5419          61 :     if (FLAG_profile_deserialization) {
    5420           0 :       double ms = timer.Elapsed().InMillisecondsF();
    5421           0 :       i::PrintF("[Initializing context from scratch took %0.3f ms]\n", ms);
    5422             :     }
    5423             :   }
    5424             : 
    5425             :   // Install experimental natives. Do not include them into the
    5426             :   // snapshot as we should be able to turn them off at runtime. Re-installing
    5427             :   // them after they have already been deserialized would also fail.
    5428       83597 :   if (context_type == FULL_CONTEXT) {
    5429       78834 :     if (!isolate->serializer_enabled()) {
    5430       78643 :       InitializeExperimentalGlobal();
    5431             : 
    5432       78643 :       if (FLAG_experimental_extras) {
    5433           5 :         if (!InstallExperimentalExtraNatives()) return;
    5434             :       }
    5435             : 
    5436             :       // Store String.prototype's map again in case it has been changed by
    5437             :       // experimental natives.
    5438             :       Handle<JSFunction> string_function(native_context()->string_function());
    5439             :       JSObject* string_function_prototype =
    5440             :           JSObject::cast(string_function->initial_map()->prototype());
    5441             :       DCHECK(string_function_prototype->HasFastProperties());
    5442             :       native_context()->set_string_function_prototype_map(
    5443             :           string_function_prototype->map());
    5444             :     }
    5445        4763 :   } else if (context_type == DEBUG_CONTEXT) {
    5446             :     DCHECK(!isolate->serializer_enabled());
    5447        4763 :     InitializeExperimentalGlobal();
    5448        4763 :     if (!InstallDebuggerNatives()) return;
    5449             :   }
    5450             : 
    5451       82760 :   ConfigureUtilsObject(context_type);
    5452             : 
    5453             :   // Check that the script context table is empty except for the 'this' binding.
    5454             :   // We do not need script contexts for native scripts.
    5455             :   DCHECK_EQ(1, native_context()->script_context_table()->used());
    5456             : 
    5457       82760 :   native_context()->ResetErrorsThrown();
    5458       82760 :   result_ = native_context();
    5459             : }
    5460             : 
    5461          42 : Genesis::Genesis(Isolate* isolate,
    5462             :                  MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5463          36 :                  v8::Local<v8::ObjectTemplate> global_proxy_template)
    5464          21 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5465          21 :   result_ = Handle<Context>::null();
    5466          21 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5467             : 
    5468             :   // Before creating the roots we must save the context and restore it
    5469             :   // on all function exits.
    5470          21 :   SaveContext saved_context(isolate);
    5471             : 
    5472             :   // During genesis, the boilerplate for stack overflow won't work until the
    5473             :   // environment has been at least partially initialized. Add a stack check
    5474             :   // before entering JS code to catch overflow early.
    5475             :   StackLimitCheck check(isolate);
    5476          21 :   if (check.HasOverflowed()) {
    5477           0 :     isolate->StackOverflow();
    5478          21 :     return;
    5479             :   }
    5480             : 
    5481             :   const int proxy_size = JSGlobalProxy::SizeWithEmbedderFields(
    5482          21 :       global_proxy_template->InternalFieldCount());
    5483             : 
    5484             :   Handle<JSGlobalProxy> global_proxy;
    5485          21 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5486          15 :     global_proxy = factory()->NewUninitializedJSGlobalProxy(proxy_size);
    5487             :   }
    5488             : 
    5489             :   // Create a remote object as the global object.
    5490             :   Handle<ObjectTemplateInfo> global_proxy_data =
    5491             :       Utils::OpenHandle(*global_proxy_template);
    5492             :   Handle<FunctionTemplateInfo> global_constructor(
    5493             :       FunctionTemplateInfo::cast(global_proxy_data->constructor()));
    5494             : 
    5495             :   Handle<ObjectTemplateInfo> global_object_template(
    5496             :       ObjectTemplateInfo::cast(global_constructor->prototype_template()));
    5497             :   Handle<JSObject> global_object =
    5498             :       ApiNatives::InstantiateRemoteObject(
    5499          42 :           global_object_template).ToHandleChecked();
    5500             : 
    5501             :   // (Re)initialize the global proxy object.
    5502             :   DCHECK_EQ(global_proxy_data->embedder_field_count(),
    5503             :             global_proxy_template->InternalFieldCount());
    5504             :   Handle<Map> global_proxy_map = isolate->factory()->NewMap(
    5505          21 :       JS_GLOBAL_PROXY_TYPE, proxy_size, HOLEY_SMI_ELEMENTS);
    5506             :   global_proxy_map->set_is_access_check_needed(true);
    5507             :   global_proxy_map->set_has_hidden_prototype(true);
    5508             :   global_proxy_map->set_may_have_interesting_symbols(true);
    5509             : 
    5510             :   // A remote global proxy has no native context.
    5511          42 :   global_proxy->set_native_context(heap()->null_value());
    5512             : 
    5513             :   // Configure the hidden prototype chain of the global proxy.
    5514          21 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5515             :   global_proxy->map()->SetConstructor(*global_constructor);
    5516             :   // TODO(dcheng): This is a hack. Why does this need to be manually called
    5517             :   // here? Line 4812 should have taken care of it?
    5518             :   global_proxy->map()->set_has_hidden_prototype(true);
    5519             : 
    5520          21 :   global_proxy_ = global_proxy;
    5521             : }
    5522             : 
    5523             : // Support for thread preemption.
    5524             : 
    5525             : // Reserve space for statics needing saving and restoring.
    5526        1118 : int Bootstrapper::ArchiveSpacePerThread() {
    5527        1118 :   return sizeof(NestingCounterType);
    5528             : }
    5529             : 
    5530             : 
    5531             : // Archive statics that are thread-local.
    5532       24163 : char* Bootstrapper::ArchiveState(char* to) {
    5533       24163 :   *reinterpret_cast<NestingCounterType*>(to) = nesting_;
    5534       24163 :   nesting_ = 0;
    5535       24163 :   return to + sizeof(NestingCounterType);
    5536             : }
    5537             : 
    5538             : 
    5539             : // Restore statics that are thread-local.
    5540       24163 : char* Bootstrapper::RestoreState(char* from) {
    5541       24163 :   nesting_ = *reinterpret_cast<NestingCounterType*>(from);
    5542       24163 :   return from + sizeof(NestingCounterType);
    5543             : }
    5544             : 
    5545             : 
    5546             : // Called when the top-level V8 mutex is destroyed.
    5547        5856 : void Bootstrapper::FreeThreadResources() {
    5548             :   DCHECK(!IsActive());
    5549        5856 : }
    5550             : 
    5551             : }  // namespace internal
    5552             : }  // namespace v8

Generated by: LCOV version 1.10