LCOV - code coverage report
Current view: top level - src - bootstrapper.cc (source / functions) Hit Total Coverage
Test: app.info Lines: 2067 2108 98.1 %
Date: 2019-04-17 Functions: 96 114 84.2 %

          Line data    Source code
       1             : // Copyright 2014 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #include "src/bootstrapper.h"
       6             : 
       7             : #include "src/accessors.h"
       8             : #include "src/api-inl.h"
       9             : #include "src/api-natives.h"
      10             : #include "src/base/ieee754.h"
      11             : #include "src/compiler.h"
      12             : #include "src/counters.h"
      13             : #include "src/debug/debug.h"
      14             : #include "src/extensions/externalize-string-extension.h"
      15             : #include "src/extensions/free-buffer-extension.h"
      16             : #include "src/extensions/gc-extension.h"
      17             : #include "src/extensions/ignition-statistics-extension.h"
      18             : #include "src/extensions/statistics-extension.h"
      19             : #include "src/extensions/trigger-failure-extension.h"
      20             : #include "src/function-kind.h"
      21             : #include "src/heap/heap-inl.h"
      22             : #include "src/isolate-inl.h"
      23             : #include "src/math-random.h"
      24             : #include "src/microtask-queue.h"
      25             : #include "src/objects/api-callbacks.h"
      26             : #include "src/objects/arguments.h"
      27             : #include "src/objects/hash-table-inl.h"
      28             : #ifdef V8_INTL_SUPPORT
      29             : #include "src/objects/intl-objects.h"
      30             : #endif  // V8_INTL_SUPPORT
      31             : #include "src/objects/js-array-buffer-inl.h"
      32             : #include "src/objects/js-array-inl.h"
      33             : #ifdef V8_INTL_SUPPORT
      34             : #include "src/objects/js-break-iterator.h"
      35             : #include "src/objects/js-collator.h"
      36             : #include "src/objects/js-date-time-format.h"
      37             : #include "src/objects/js-list-format.h"
      38             : #include "src/objects/js-locale.h"
      39             : #include "src/objects/js-number-format.h"
      40             : #include "src/objects/js-plural-rules.h"
      41             : #endif  // V8_INTL_SUPPORT
      42             : #include "src/objects/js-regexp-string-iterator.h"
      43             : #include "src/objects/js-regexp.h"
      44             : #ifdef V8_INTL_SUPPORT
      45             : #include "src/objects/js-relative-time-format.h"
      46             : #include "src/objects/js-segment-iterator.h"
      47             : #include "src/objects/js-segmenter.h"
      48             : #endif  // V8_INTL_SUPPORT
      49             : #include "src/objects/js-weak-refs.h"
      50             : #include "src/objects/property-cell.h"
      51             : #include "src/objects/slots-inl.h"
      52             : #include "src/objects/templates.h"
      53             : #include "src/snapshot/natives.h"
      54             : #include "src/snapshot/snapshot.h"
      55             : #include "src/wasm/wasm-js.h"
      56             : 
      57             : namespace v8 {
      58             : namespace internal {
      59             : 
      60           0 : void SourceCodeCache::Initialize(Isolate* isolate, bool create_heap_objects) {
      61             :   cache_ = create_heap_objects ? ReadOnlyRoots(isolate).empty_fixed_array()
      62      124892 :                                : FixedArray();
      63           0 : }
      64             : 
      65           0 : void SourceCodeCache::Iterate(RootVisitor* v) {
      66      582522 :   v->VisitRootPointer(Root::kExtensions, nullptr, FullObjectSlot(&cache_));
      67           0 : }
      68             : 
      69        4630 : bool SourceCodeCache::Lookup(Isolate* isolate, Vector<const char> name,
      70             :                              Handle<SharedFunctionInfo>* handle) {
      71       16328 :   for (int i = 0; i < cache_->length(); i += 2) {
      72        7199 :     SeqOneByteString str = SeqOneByteString::cast(cache_->get(i));
      73        7199 :     if (str->IsUtf8EqualTo(name)) {
      74             :       *handle = Handle<SharedFunctionInfo>(
      75        2704 :           SharedFunctionInfo::cast(cache_->get(i + 1)), isolate);
      76        1352 :       return true;
      77             :     }
      78             :   }
      79             :   return false;
      80             : }
      81             : 
      82        3240 : void SourceCodeCache::Add(Isolate* isolate, Vector<const char> name,
      83             :                           Handle<SharedFunctionInfo> shared) {
      84             :   Factory* factory = isolate->factory();
      85             :   HandleScope scope(isolate);
      86             :   int length = cache_->length();
      87             :   Handle<FixedArray> new_array =
      88        3240 :       factory->NewFixedArray(length + 2, AllocationType::kOld);
      89        3245 :   cache_->CopyTo(0, *new_array, 0, cache_->length());
      90        3252 :   cache_ = *new_array;
      91             :   Handle<String> str =
      92             :       factory
      93        6487 :           ->NewStringFromOneByte(Vector<const uint8_t>::cast(name),
      94             :                                  AllocationType::kOld)
      95             :           .ToHandleChecked();
      96             :   DCHECK(!str.is_null());
      97        3235 :   cache_->set(length, *str);
      98        3240 :   cache_->set(length + 1, *shared);
      99        9735 :   Script::cast(shared->script())->set_type(type_);
     100        3242 : }
     101             : 
     102       62425 : Bootstrapper::Bootstrapper(Isolate* isolate)
     103             :     : isolate_(isolate),
     104             :       nesting_(0),
     105      124850 :       extensions_cache_(Script::TYPE_EXTENSION) {}
     106             : 
     107         111 : Handle<String> Bootstrapper::GetNativeSource(NativeType type, int index) {
     108             :   NativesExternalStringResource* resource =
     109         111 :       new NativesExternalStringResource(type, index);
     110             :   Handle<ExternalOneByteString> source_code =
     111         111 :       isolate_->factory()->NewNativeSourceString(resource);
     112             :   DCHECK(source_code->is_uncached());
     113         111 :   return source_code;
     114             : }
     115             : 
     116       62426 : void Bootstrapper::Initialize(bool create_heap_objects) {
     117       62426 :   extensions_cache_.Initialize(isolate_, create_heap_objects);
     118       62426 : }
     119             : 
     120             : 
     121             : static const char* GCFunctionName() {
     122             :   bool flag_given =
     123       60992 :       FLAG_expose_gc_as != nullptr && strlen(FLAG_expose_gc_as) != 0;
     124       60992 :   return flag_given ? FLAG_expose_gc_as : "gc";
     125             : }
     126             : 
     127       60992 : void Bootstrapper::InitializeOncePerProcess() {
     128      243968 :   v8::RegisterExtension(v8::base::make_unique<FreeBufferExtension>());
     129      121984 :   v8::RegisterExtension(v8::base::make_unique<GCExtension>(GCFunctionName()));
     130      243968 :   v8::RegisterExtension(v8::base::make_unique<ExternalizeStringExtension>());
     131      243968 :   v8::RegisterExtension(v8::base::make_unique<StatisticsExtension>());
     132      243968 :   v8::RegisterExtension(v8::base::make_unique<TriggerFailureExtension>());
     133      243968 :   v8::RegisterExtension(v8::base::make_unique<IgnitionStatisticsExtension>());
     134       60992 : }
     135             : 
     136       62410 : void Bootstrapper::TearDown() {
     137             :   extensions_cache_.Initialize(isolate_, false);  // Yes, symmetrical
     138       62410 : }
     139             : 
     140             : class Genesis {
     141             :  public:
     142             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     143             :           v8::Local<v8::ObjectTemplate> global_proxy_template,
     144             :           size_t context_snapshot_index,
     145             :           v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
     146             :           v8::MicrotaskQueue* microtask_queue);
     147             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     148             :           v8::Local<v8::ObjectTemplate> global_proxy_template);
     149       91777 :   ~Genesis() = default;
     150             : 
     151             :   Isolate* isolate() const { return isolate_; }
     152             :   Factory* factory() const { return isolate_->factory(); }
     153             :   Builtins* builtins() const { return isolate_->builtins(); }
     154             :   Heap* heap() const { return isolate_->heap(); }
     155             : 
     156             :   Handle<Context> result() { return result_; }
     157             : 
     158             :   Handle<JSGlobalProxy> global_proxy() { return global_proxy_; }
     159             : 
     160             :  private:
     161             :   Handle<NativeContext> native_context() { return native_context_; }
     162             : 
     163             :   // Creates some basic objects. Used for creating a context from scratch.
     164             :   void CreateRoots();
     165             :   // Creates the empty function.  Used for creating a context from scratch.
     166             :   Handle<JSFunction> CreateEmptyFunction();
     167             :   // Returns the %ThrowTypeError% intrinsic function.
     168             :   // See ES#sec-%throwtypeerror% for details.
     169             :   Handle<JSFunction> GetThrowTypeErrorIntrinsic();
     170             : 
     171             :   void CreateSloppyModeFunctionMaps(Handle<JSFunction> empty);
     172             :   void CreateStrictModeFunctionMaps(Handle<JSFunction> empty);
     173             :   void CreateObjectFunction(Handle<JSFunction> empty);
     174             :   void CreateIteratorMaps(Handle<JSFunction> empty);
     175             :   void CreateAsyncIteratorMaps(Handle<JSFunction> empty);
     176             :   void CreateAsyncFunctionMaps(Handle<JSFunction> empty);
     177             :   void CreateJSProxyMaps();
     178             : 
     179             :   // Make the "arguments" and "caller" properties throw a TypeError on access.
     180             :   void AddRestrictedFunctionProperties(Handle<JSFunction> empty);
     181             : 
     182             :   // Creates the global objects using the global proxy and the template passed
     183             :   // in through the API.  We call this regardless of whether we are building a
     184             :   // context from scratch or using a deserialized one from the partial snapshot
     185             :   // but in the latter case we don't use the objects it produces directly, as
     186             :   // we have to use the deserialized ones that are linked together with the
     187             :   // rest of the context snapshot. At the end we link the global proxy and the
     188             :   // context to each other.
     189             :   Handle<JSGlobalObject> CreateNewGlobals(
     190             :       v8::Local<v8::ObjectTemplate> global_proxy_template,
     191             :       Handle<JSGlobalProxy> global_proxy);
     192             :   // Similarly, we want to use the global that has been created by the templates
     193             :   // passed through the API.  The global from the snapshot is detached from the
     194             :   // other objects in the snapshot.
     195             :   void HookUpGlobalObject(Handle<JSGlobalObject> global_object);
     196             :   // Hooks the given global proxy into the context in the case we do not
     197             :   // replace the global object from the deserialized native context.
     198             :   void HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy);
     199             :   // The native context has a ScriptContextTable that store declarative bindings
     200             :   // made in script scopes.  Add a "this" binding to that table pointing to the
     201             :   // global proxy.
     202             :   void InstallGlobalThisBinding();
     203             :   // New context initialization.  Used for creating a context from scratch.
     204             :   void InitializeGlobal(Handle<JSGlobalObject> global_object,
     205             :                         Handle<JSFunction> empty_function);
     206             :   void InitializeExperimentalGlobal();
     207             :   void InitializeIteratorFunctions();
     208             :   void InitializeCallSiteBuiltins();
     209             :   // Depending on the situation, expose and/or get rid of the utils object.
     210             :   void ConfigureUtilsObject();
     211             : 
     212             : #define DECLARE_FEATURE_INITIALIZATION(id, descr) \
     213             :   void InitializeGlobal_##id();
     214             : 
     215             :   HARMONY_INPROGRESS(DECLARE_FEATURE_INITIALIZATION)
     216             :   HARMONY_STAGED(DECLARE_FEATURE_INITIALIZATION)
     217             :   HARMONY_SHIPPING(DECLARE_FEATURE_INITIALIZATION)
     218             : #undef DECLARE_FEATURE_INITIALIZATION
     219             : 
     220             :   enum ArrayBufferKind {
     221             :     ARRAY_BUFFER,
     222             :     SHARED_ARRAY_BUFFER,
     223             :   };
     224             :   Handle<JSFunction> CreateArrayBuffer(Handle<String> name,
     225             :                                        ArrayBufferKind array_buffer_kind);
     226             :   void InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
     227             :                                           const char* name);
     228             :   void InstallInternalPackedArray(Handle<JSObject> target, const char* name);
     229             :   bool InstallNatives();
     230             : 
     231             :   Handle<JSFunction> InstallTypedArray(const char* name,
     232             :                                        ElementsKind elements_kind);
     233             :   bool InstallExtraNatives();
     234             :   void InitializeNormalizedMapCaches();
     235             : 
     236             :   enum ExtensionTraversalState {
     237             :     UNVISITED, VISITED, INSTALLED
     238             :   };
     239             : 
     240       91452 :   class ExtensionStates {
     241             :    public:
     242             :     ExtensionStates();
     243             :     ExtensionTraversalState get_state(RegisteredExtension* extension);
     244             :     void set_state(RegisteredExtension* extension,
     245             :                    ExtensionTraversalState state);
     246             :    private:
     247             :     base::HashMap map_;
     248             :     DISALLOW_COPY_AND_ASSIGN(ExtensionStates);
     249             :   };
     250             : 
     251             :   // Used both for deserialized and from-scratch contexts to add the extensions
     252             :   // provided.
     253             :   static bool InstallExtensions(Isolate* isolate,
     254             :                                 Handle<Context> native_context,
     255             :                                 v8::ExtensionConfiguration* extensions);
     256             :   static bool InstallAutoExtensions(Isolate* isolate,
     257             :                                     ExtensionStates* extension_states);
     258             :   static bool InstallRequestedExtensions(Isolate* isolate,
     259             :                                          v8::ExtensionConfiguration* extensions,
     260             :                                          ExtensionStates* extension_states);
     261             :   static bool InstallExtension(Isolate* isolate,
     262             :                                const char* name,
     263             :                                ExtensionStates* extension_states);
     264             :   static bool InstallExtension(Isolate* isolate,
     265             :                                v8::RegisteredExtension* current,
     266             :                                ExtensionStates* extension_states);
     267             :   static bool InstallSpecialObjects(Isolate* isolate,
     268             :                                     Handle<Context> native_context);
     269             :   bool ConfigureApiObject(Handle<JSObject> object,
     270             :                           Handle<ObjectTemplateInfo> object_template);
     271             :   bool ConfigureGlobalObjects(
     272             :       v8::Local<v8::ObjectTemplate> global_proxy_template);
     273             : 
     274             :   // Migrates all properties from the 'from' object to the 'to'
     275             :   // object and overrides the prototype in 'to' with the one from
     276             :   // 'from'.
     277             :   void TransferObject(Handle<JSObject> from, Handle<JSObject> to);
     278             :   void TransferNamedProperties(Handle<JSObject> from, Handle<JSObject> to);
     279             :   void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);
     280             : 
     281             :   static bool CompileExtension(Isolate* isolate, v8::Extension* extension);
     282             : 
     283             :   Isolate* isolate_;
     284             :   Handle<Context> result_;
     285             :   Handle<NativeContext> native_context_;
     286             :   Handle<JSGlobalProxy> global_proxy_;
     287             : 
     288             :   // Temporary function maps needed only during bootstrapping.
     289             :   Handle<Map> strict_function_with_home_object_map_;
     290             :   Handle<Map> strict_function_with_name_and_home_object_map_;
     291             : 
     292             :   // %ThrowTypeError%. See ES#sec-%throwtypeerror% for details.
     293             :   Handle<JSFunction> restricted_properties_thrower_;
     294             : 
     295             :   BootstrapperActive active_;
     296             :   friend class Bootstrapper;
     297             : };
     298             : 
     299      291261 : void Bootstrapper::Iterate(RootVisitor* v) {
     300             :   extensions_cache_.Iterate(v);
     301      291261 :   v->Synchronize(VisitorSynchronization::kExtensions);
     302      291261 : }
     303             : 
     304       91759 : Handle<Context> Bootstrapper::CreateEnvironment(
     305             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     306             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
     307             :     v8::ExtensionConfiguration* extensions, size_t context_snapshot_index,
     308             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
     309             :     v8::MicrotaskQueue* microtask_queue) {
     310       91759 :   HandleScope scope(isolate_);
     311             :   Handle<Context> env;
     312             :   {
     313             :     Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template,
     314             :                     context_snapshot_index, embedder_fields_deserializer,
     315       91759 :                     microtask_queue);
     316             :     env = genesis.result();
     317       91760 :     if (env.is_null() || !InstallExtensions(env, extensions)) {
     318          40 :       return Handle<Context>();
     319             :     }
     320             :   }
     321       91719 :   LogAllMaps();
     322      183436 :   isolate_->heap()->NotifyBootstrapComplete();
     323       91719 :   return scope.CloseAndEscape(env);
     324             : }
     325             : 
     326          18 : Handle<JSGlobalProxy> Bootstrapper::NewRemoteContext(
     327             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     328             :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
     329          18 :   HandleScope scope(isolate_);
     330             :   Handle<JSGlobalProxy> global_proxy;
     331             :   {
     332          18 :     Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template);
     333             :     global_proxy = genesis.global_proxy();
     334          18 :     if (global_proxy.is_null()) return Handle<JSGlobalProxy>();
     335             :   }
     336          18 :   LogAllMaps();
     337          18 :   return scope.CloseAndEscape(global_proxy);
     338             : }
     339             : 
     340       91736 : void Bootstrapper::LogAllMaps() {
     341       91736 :   if (!FLAG_trace_maps || isolate_->initialized_from_snapshot()) return;
     342             :   // Log all created Map objects that are on the heap. For snapshots the Map
     343             :   // logging happens during deserialization in order to avoid printing Maps
     344             :   // multiple times during partial deserialization.
     345           0 :   LOG(isolate_, LogAllMaps());
     346             : }
     347             : 
     348         126 : void Bootstrapper::DetachGlobal(Handle<Context> env) {
     349         252 :   isolate_->counters()->errors_thrown_per_context()->AddSample(
     350         126 :       env->GetErrorsThrown());
     351             : 
     352         126 :   ReadOnlyRoots roots(isolate_);
     353         252 :   Handle<JSGlobalProxy> global_proxy(env->global_proxy(), isolate_);
     354         252 :   global_proxy->set_native_context(roots.null_value());
     355         252 :   JSObject::ForceSetPrototype(global_proxy, isolate_->factory()->null_value());
     356         252 :   global_proxy->map()->SetConstructor(roots.null_value());
     357         126 :   if (FLAG_track_detached_contexts) {
     358         126 :     isolate_->AddDetachedContext(env);
     359             :   }
     360             : 
     361             :   env->native_context()->set_microtask_queue(nullptr);
     362         126 : }
     363             : 
     364             : namespace {
     365             : 
     366        2553 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
     367             :     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len,
     368             :     FunctionKind kind = FunctionKind::kNormalFunction) {
     369             :   Handle<SharedFunctionInfo> shared =
     370             :       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
     371        5106 :                                                           kind);
     372             :   shared->set_internal_formal_parameter_count(len);
     373             :   shared->set_length(len);
     374        2553 :   return shared;
     375             : }
     376             : 
     377         111 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateBuiltinSharedFunctionInfo(
     378             :     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len) {
     379             :   Handle<SharedFunctionInfo> shared =
     380             :       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
     381         111 :                                                           kNormalFunction);
     382             :   shared->set_internal_formal_parameter_count(len);
     383             :   shared->set_length(len);
     384         111 :   return shared;
     385             : }
     386             : 
     387      191396 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     388             :     Isolate* isolate, Handle<String> name, InstanceType type, int instance_size,
     389             :     int inobject_properties, Handle<HeapObject> prototype,
     390             :     Builtins::Name builtin_id) {
     391             :   Handle<JSFunction> result;
     392             : 
     393             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
     394             :       name, prototype, type, instance_size, inobject_properties, builtin_id,
     395      191396 :       IMMUTABLE);
     396             : 
     397      191396 :   result = isolate->factory()->NewFunction(args);
     398             :   // Make the JSFunction's prototype object fast.
     399      382792 :   JSObject::MakePrototypesFast(handle(result->prototype(), isolate),
     400      191396 :                                kStartAtReceiver, isolate);
     401             : 
     402             :   // Make the resulting JSFunction object fast.
     403      191396 :   JSObject::MakePrototypesFast(result, kStartAtReceiver, isolate);
     404      191396 :   result->shared()->set_native(true);
     405      191396 :   return result;
     406             : }
     407             : 
     408       92119 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     409             :     Isolate* isolate, const char* name, InstanceType type, int instance_size,
     410             :     int inobject_properties, Handle<HeapObject> prototype,
     411             :     Builtins::Name builtin_id) {
     412             :   return CreateFunction(
     413             :       isolate, isolate->factory()->InternalizeUtf8String(name), type,
     414       92119 :       instance_size, inobject_properties, prototype, builtin_id);
     415             : }
     416             : 
     417       96922 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     418             :     Isolate* isolate, Handle<JSObject> target, Handle<String> name,
     419             :     InstanceType type, int instance_size, int inobject_properties,
     420             :     Handle<HeapObject> prototype, Builtins::Name call) {
     421             :   Handle<JSFunction> function = CreateFunction(
     422       96922 :       isolate, name, type, instance_size, inobject_properties, prototype, call);
     423       96922 :   JSObject::AddProperty(isolate, target, name, function, DONT_ENUM);
     424       96922 :   return function;
     425             : }
     426             : 
     427       95812 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     428             :     Isolate* isolate, Handle<JSObject> target, const char* name,
     429             :     InstanceType type, int instance_size, int inobject_properties,
     430             :     Handle<HeapObject> prototype, Builtins::Name call) {
     431             :   return InstallFunction(isolate, target,
     432             :                          isolate->factory()->InternalizeUtf8String(name), type,
     433       95812 :                          instance_size, inobject_properties, prototype, call);
     434             : }
     435             : 
     436     1619770 : V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,
     437             :                                                     Handle<String> name,
     438             :                                                     Builtins::Name call,
     439             :                                                     int len, bool adapt) {
     440             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
     441     1619770 :       name, call, LanguageMode::kStrict);
     442     1619771 :   Handle<JSFunction> fun = isolate->factory()->NewFunction(args);
     443             :   // Make the resulting JSFunction object fast.
     444     1619769 :   JSObject::MakePrototypesFast(fun, kStartAtReceiver, isolate);
     445     1619768 :   fun->shared()->set_native(true);
     446             : 
     447     1619766 :   if (adapt) {
     448             :     fun->shared()->set_internal_formal_parameter_count(len);
     449             :   } else {
     450             :     fun->shared()->DontAdaptArguments();
     451             :   }
     452             :   fun->shared()->set_length(len);
     453     1619766 :   return fun;
     454             : }
     455             : 
     456        3108 : V8_NOINLINE Handle<JSFunction> InstallFunctionWithBuiltinId(
     457             :     Isolate* isolate, Handle<JSObject> base, const char* name,
     458             :     Builtins::Name call, int len, bool adapt) {
     459             :   Handle<String> internalized_name =
     460        3108 :       isolate->factory()->InternalizeUtf8String(name);
     461             :   Handle<JSFunction> fun =
     462        3108 :       SimpleCreateFunction(isolate, internalized_name, call, len, adapt);
     463        3108 :   JSObject::AddProperty(isolate, base, internalized_name, fun, DONT_ENUM);
     464        3108 :   return fun;
     465             : }
     466             : 
     467      598977 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
     468             :     Isolate* isolate, Handle<JSObject> base, const char* name,
     469             :     Builtins::Name call, int len, bool adapt,
     470             :     PropertyAttributes attrs = DONT_ENUM) {
     471             :   // Although function name does not have to be internalized the property name
     472             :   // will be internalized during property addition anyway, so do it here now.
     473             :   Handle<String> internalized_name =
     474      598977 :       isolate->factory()->InternalizeUtf8String(name);
     475             :   Handle<JSFunction> fun =
     476      598978 :       SimpleCreateFunction(isolate, internalized_name, call, len, adapt);
     477      598978 :   JSObject::AddProperty(isolate, base, internalized_name, fun, attrs);
     478      598978 :   return fun;
     479             : }
     480             : 
     481       92563 : V8_NOINLINE Handle<JSFunction> InstallFunctionAtSymbol(
     482             :     Isolate* isolate, Handle<JSObject> base, Handle<Symbol> symbol,
     483             :     const char* symbol_string, Builtins::Name call, int len, bool adapt,
     484             :     PropertyAttributes attrs = DONT_ENUM) {
     485             :   Handle<String> internalized_symbol =
     486       92563 :       isolate->factory()->InternalizeUtf8String(symbol_string);
     487             :   Handle<JSFunction> fun =
     488       92563 :       SimpleCreateFunction(isolate, internalized_symbol, call, len, adapt);
     489       92563 :   JSObject::AddProperty(isolate, base, symbol, fun, attrs);
     490       92563 :   return fun;
     491             : }
     492             : 
     493        2220 : V8_NOINLINE void SimpleInstallGetterSetter(Isolate* isolate,
     494             :                                            Handle<JSObject> base,
     495             :                                            Handle<String> name,
     496             :                                            Builtins::Name call_getter,
     497             :                                            Builtins::Name call_setter) {
     498             :   Handle<String> getter_name =
     499        4440 :       Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
     500        2220 :           .ToHandleChecked();
     501             :   Handle<JSFunction> getter =
     502        2220 :       SimpleCreateFunction(isolate, getter_name, call_getter, 0, true);
     503             : 
     504             :   Handle<String> setter_name =
     505        4440 :       Name::ToFunctionName(isolate, name, isolate->factory()->set_string())
     506        2220 :           .ToHandleChecked();
     507             :   Handle<JSFunction> setter =
     508        2220 :       SimpleCreateFunction(isolate, setter_name, call_setter, 1, true);
     509             : 
     510        4440 :   JSObject::DefineAccessor(base, name, getter, setter, DONT_ENUM).Check();
     511        2220 : }
     512             : 
     513             : void SimpleInstallGetterSetter(Isolate* isolate, Handle<JSObject> base,
     514             :                                const char* name, Builtins::Name call_getter,
     515             :                                Builtins::Name call_setter) {
     516        1998 :   SimpleInstallGetterSetter(isolate, base,
     517             :                             isolate->factory()->InternalizeUtf8String(name),
     518        1998 :                             call_getter, call_setter);
     519             : }
     520             : 
     521      919800 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
     522             :     Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
     523             :     Handle<Name> property_name, Builtins::Name call, bool adapt) {
     524             :   Handle<String> getter_name =
     525     1839603 :       Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
     526      919803 :           .ToHandleChecked();
     527             :   Handle<JSFunction> getter =
     528      919803 :       SimpleCreateFunction(isolate, getter_name, call, 0, adapt);
     529             : 
     530             :   Handle<Object> setter = isolate->factory()->undefined_value();
     531             : 
     532     1839586 :   JSObject::DefineAccessor(base, property_name, getter, setter, DONT_ENUM)
     533             :       .Check();
     534             : 
     535      919797 :   return getter;
     536             : }
     537             : 
     538      918909 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Isolate* isolate,
     539             :                                                    Handle<JSObject> base,
     540             :                                                    Handle<Name> name,
     541             :                                                    Builtins::Name call,
     542             :                                                    bool adapt) {
     543      918909 :   return SimpleInstallGetter(isolate, base, name, name, call, adapt);
     544             : }
     545             : 
     546       97336 : V8_NOINLINE void InstallConstant(Isolate* isolate, Handle<JSObject> holder,
     547             :                                  const char* name, Handle<Object> value) {
     548      194672 :   JSObject::AddProperty(
     549             :       isolate, holder, isolate->factory()->InternalizeUtf8String(name), value,
     550       97336 :       static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     551       97336 : }
     552             : 
     553        1110 : V8_NOINLINE void InstallTrueValuedProperty(Isolate* isolate,
     554             :                                            Handle<JSObject> holder,
     555             :                                            const char* name) {
     556        2220 :   JSObject::AddProperty(isolate, holder,
     557             :                         isolate->factory()->InternalizeUtf8String(name),
     558        1110 :                         isolate->factory()->true_value(), NONE);
     559        1110 : }
     560             : 
     561         888 : V8_NOINLINE void InstallSpeciesGetter(Isolate* isolate,
     562             :                                       Handle<JSFunction> constructor) {
     563             :   Factory* factory = isolate->factory();
     564             :   // TODO(adamk): We should be able to share a SharedFunctionInfo
     565             :   // between all these JSFunctins.
     566             :   SimpleInstallGetter(isolate, constructor, factory->symbol_species_string(),
     567             :                       factory->species_symbol(), Builtins::kReturnReceiver,
     568         888 :                       true);
     569         888 : }
     570             : 
     571      280181 : V8_NOINLINE void InstallToStringTag(Isolate* isolate, Handle<JSObject> holder,
     572             :                                     Handle<String> value) {
     573      280179 :   JSObject::AddProperty(isolate, holder,
     574             :                         isolate->factory()->to_string_tag_symbol(), value,
     575      280181 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     576      280179 : }
     577             : 
     578             : void InstallToStringTag(Isolate* isolate, Handle<JSObject> holder,
     579             :                         const char* value) {
     580      277045 :   InstallToStringTag(isolate, holder,
     581      277048 :                      isolate->factory()->InternalizeUtf8String(value));
     582             : }
     583             : 
     584             : }  // namespace
     585             : 
     586         111 : Handle<JSFunction> Genesis::CreateEmptyFunction() {
     587             :   // Allocate the function map first and then patch the prototype later.
     588             :   Handle<Map> empty_function_map = factory()->CreateSloppyFunctionMap(
     589         111 :       FUNCTION_WITHOUT_PROTOTYPE, MaybeHandle<JSFunction>());
     590             :   empty_function_map->set_is_prototype_map(true);
     591             :   DCHECK(!empty_function_map->is_dictionary_map());
     592             : 
     593             :   // Allocate ScopeInfo for the empty function.
     594         111 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateForEmptyFunction(isolate());
     595             : 
     596             :   // Allocate the empty function as the prototype for function according to
     597             :   // ES#sec-properties-of-the-function-prototype-object
     598             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
     599         111 :       factory()->empty_string(), empty_function_map, Builtins::kEmptyFunction);
     600         111 :   Handle<JSFunction> empty_function = factory()->NewFunction(args);
     601         111 :   native_context()->set_empty_function(*empty_function);
     602             : 
     603             :   // --- E m p t y ---
     604         111 :   Handle<String> source = factory()->NewStringFromStaticChars("() {}");
     605         111 :   Handle<Script> script = factory()->NewScript(source);
     606             :   script->set_type(Script::TYPE_NATIVE);
     607         111 :   Handle<WeakFixedArray> infos = factory()->NewWeakFixedArray(2);
     608         111 :   script->set_shared_function_infos(*infos);
     609         111 :   empty_function->shared()->set_scope_info(*scope_info);
     610             :   empty_function->shared()->DontAdaptArguments();
     611         111 :   SharedFunctionInfo::SetScript(handle(empty_function->shared(), isolate()),
     612         111 :                                 script, 1);
     613             : 
     614         111 :   return empty_function;
     615             : }
     616             : 
     617         111 : void Genesis::CreateSloppyModeFunctionMaps(Handle<JSFunction> empty) {
     618         111 :   Factory* factory = isolate_->factory();
     619             :   Handle<Map> map;
     620             : 
     621             :   //
     622             :   // Allocate maps for sloppy functions without prototype.
     623             :   //
     624         111 :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     625         111 :   native_context()->set_sloppy_function_without_prototype_map(*map);
     626             : 
     627             :   //
     628             :   // Allocate maps for sloppy functions with readonly prototype.
     629             :   //
     630             :   map =
     631         111 :       factory->CreateSloppyFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     632         111 :   native_context()->set_sloppy_function_with_readonly_prototype_map(*map);
     633             : 
     634             :   //
     635             :   // Allocate maps for sloppy functions with writable prototype.
     636             :   //
     637             :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     638         111 :                                          empty);
     639         111 :   native_context()->set_sloppy_function_map(*map);
     640             : 
     641             :   map = factory->CreateSloppyFunctionMap(
     642         111 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     643         111 :   native_context()->set_sloppy_function_with_name_map(*map);
     644         111 : }
     645             : 
     646         222 : Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {
     647         222 :   if (!restricted_properties_thrower_.is_null()) {
     648         111 :     return restricted_properties_thrower_;
     649             :   }
     650         111 :   Handle<String> name = factory()->empty_string();
     651             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
     652         111 :       name, Builtins::kStrictPoisonPillThrower, i::LanguageMode::kStrict);
     653         111 :   Handle<JSFunction> function = factory()->NewFunction(args);
     654             :   function->shared()->DontAdaptArguments();
     655             : 
     656             :   // %ThrowTypeError% must not have a name property.
     657         111 :   if (JSReceiver::DeleteProperty(function, factory()->name_string())
     658             :           .IsNothing()) {
     659             :     DCHECK(false);
     660             :   }
     661             : 
     662             :   // length needs to be non configurable.
     663             :   Handle<Object> value(Smi::FromInt(function->length()), isolate());
     664         111 :   JSObject::SetOwnPropertyIgnoreAttributes(
     665             :       function, factory()->length_string(), value,
     666         111 :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))
     667             :       .Assert();
     668             : 
     669         111 :   if (JSObject::PreventExtensions(function, kThrowOnError).IsNothing()) {
     670             :     DCHECK(false);
     671             :   }
     672             : 
     673         111 :   JSObject::MigrateSlowToFast(function, 0, "Bootstrapping");
     674             : 
     675         111 :   restricted_properties_thrower_ = function;
     676         111 :   return function;
     677             : }
     678             : 
     679         111 : void Genesis::CreateStrictModeFunctionMaps(Handle<JSFunction> empty) {
     680         111 :   Factory* factory = isolate_->factory();
     681             :   Handle<Map> map;
     682             : 
     683             :   //
     684             :   // Allocate maps for strict functions without prototype.
     685             :   //
     686         111 :   map = factory->CreateStrictFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     687         111 :   native_context()->set_strict_function_without_prototype_map(*map);
     688             : 
     689         111 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_NAME, empty);
     690         111 :   native_context()->set_method_with_name_map(*map);
     691             : 
     692         111 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_HOME_OBJECT, empty);
     693         111 :   native_context()->set_method_with_home_object_map(*map);
     694             : 
     695             :   map =
     696         111 :       factory->CreateStrictFunctionMap(METHOD_WITH_NAME_AND_HOME_OBJECT, empty);
     697         111 :   native_context()->set_method_with_name_and_home_object_map(*map);
     698             : 
     699             :   //
     700             :   // Allocate maps for strict functions with writable prototype.
     701             :   //
     702             :   map = factory->CreateStrictFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     703         111 :                                          empty);
     704         111 :   native_context()->set_strict_function_map(*map);
     705             : 
     706             :   map = factory->CreateStrictFunctionMap(
     707         111 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     708         111 :   native_context()->set_strict_function_with_name_map(*map);
     709             : 
     710             :   strict_function_with_home_object_map_ = factory->CreateStrictFunctionMap(
     711         111 :       FUNCTION_WITH_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     712             :   strict_function_with_name_and_home_object_map_ =
     713             :       factory->CreateStrictFunctionMap(
     714         111 :           FUNCTION_WITH_NAME_AND_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     715             : 
     716             :   //
     717             :   // Allocate maps for strict functions with readonly prototype.
     718             :   //
     719             :   map =
     720         111 :       factory->CreateStrictFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     721         111 :   native_context()->set_strict_function_with_readonly_prototype_map(*map);
     722             : 
     723             :   //
     724             :   // Allocate map for class functions.
     725             :   //
     726         111 :   map = factory->CreateClassFunctionMap(empty);
     727         111 :   native_context()->set_class_function_map(*map);
     728             : 
     729             :   // Now that the strict mode function map is available, set up the
     730             :   // restricted "arguments" and "caller" getters.
     731         111 :   AddRestrictedFunctionProperties(empty);
     732         111 : }
     733             : 
     734         111 : void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
     735         111 :   Factory* factory = isolate_->factory();
     736             : 
     737             :   // --- O b j e c t ---
     738             :   int inobject_properties = JSObject::kInitialGlobalObjectUnusedPropertiesCount;
     739             :   int instance_size = JSObject::kHeaderSize + kTaggedSize * inobject_properties;
     740             : 
     741             :   Handle<JSFunction> object_fun = CreateFunction(
     742             :       isolate_, factory->Object_string(), JS_OBJECT_TYPE, instance_size,
     743         111 :       inobject_properties, factory->null_value(), Builtins::kObjectConstructor);
     744             :   object_fun->shared()->set_length(1);
     745             :   object_fun->shared()->DontAdaptArguments();
     746         111 :   native_context()->set_object_function(*object_fun);
     747             : 
     748             :   {
     749             :     // Finish setting up Object function's initial map.
     750         111 :     Map initial_map = object_fun->initial_map();
     751         111 :     initial_map->set_elements_kind(HOLEY_ELEMENTS);
     752             :   }
     753             : 
     754             :   // Allocate a new prototype for the object function.
     755             :   Handle<JSObject> object_function_prototype =
     756         111 :       factory->NewFunctionPrototype(object_fun);
     757             : 
     758             :   Handle<Map> map =
     759             :       Map::Copy(isolate(), handle(object_function_prototype->map(), isolate()),
     760         111 :                 "EmptyObjectPrototype");
     761             :   map->set_is_prototype_map(true);
     762             :   // Ban re-setting Object.prototype.__proto__ to prevent Proxy security bug
     763         111 :   map->set_is_immutable_proto(true);
     764         111 :   object_function_prototype->set_map(*map);
     765             : 
     766             :   // Complete setting up empty function.
     767             :   {
     768         111 :     Handle<Map> empty_function_map(empty_function->map(), isolate_);
     769         111 :     Map::SetPrototype(isolate(), empty_function_map, object_function_prototype);
     770             :   }
     771             : 
     772         111 :   native_context()->set_initial_object_prototype(*object_function_prototype);
     773         111 :   JSFunction::SetPrototype(object_fun, object_function_prototype);
     774             : 
     775             :   {
     776             :     // Set up slow map for Object.create(null) instances without in-object
     777             :     // properties.
     778         111 :     Handle<Map> map(object_fun->initial_map(), isolate_);
     779         111 :     map = Map::CopyInitialMapNormalized(isolate(), map);
     780         111 :     Map::SetPrototype(isolate(), map, factory->null_value());
     781         111 :     native_context()->set_slow_object_with_null_prototype_map(*map);
     782             : 
     783             :     // Set up slow map for literals with too many properties.
     784         111 :     map = Map::Copy(isolate(), map, "slow_object_with_object_prototype_map");
     785         111 :     Map::SetPrototype(isolate(), map, object_function_prototype);
     786         111 :     native_context()->set_slow_object_with_object_prototype_map(*map);
     787             :   }
     788         111 : }
     789             : 
     790             : namespace {
     791             : 
     792         888 : Handle<Map> CreateNonConstructorMap(Isolate* isolate, Handle<Map> source_map,
     793             :                                     Handle<JSObject> prototype,
     794             :                                     const char* reason) {
     795         888 :   Handle<Map> map = Map::Copy(isolate, source_map, reason);
     796             :   // Ensure the resulting map has prototype slot (it is necessary for storing
     797             :   // inital map even when the prototype property is not required).
     798         888 :   if (!map->has_prototype_slot()) {
     799             :     // Re-set the unused property fields after changing the instance size.
     800             :     // TODO(ulan): Do not change instance size after map creation.
     801           0 :     int unused_property_fields = map->UnusedPropertyFields();
     802           0 :     map->set_instance_size(map->instance_size() + kTaggedSize);
     803             :     // The prototype slot shifts the in-object properties area by one slot.
     804           0 :     map->SetInObjectPropertiesStartInWords(
     805           0 :         map->GetInObjectPropertiesStartInWords() + 1);
     806           0 :     map->set_has_prototype_slot(true);
     807           0 :     map->SetInObjectUnusedPropertyFields(unused_property_fields);
     808             :   }
     809             :   map->set_is_constructor(false);
     810         888 :   Map::SetPrototype(isolate, map, prototype);
     811         888 :   return map;
     812             : }
     813             : 
     814             : }  // namespace
     815             : 
     816         111 : void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
     817             :   // Create iterator-related meta-objects.
     818             :   Handle<JSObject> iterator_prototype = factory()->NewJSObject(
     819         111 :       isolate()->object_function(), AllocationType::kOld);
     820             : 
     821             :   InstallFunctionAtSymbol(isolate(), iterator_prototype,
     822             :                           factory()->iterator_symbol(), "[Symbol.iterator]",
     823         111 :                           Builtins::kReturnReceiver, 0, true);
     824         111 :   native_context()->set_initial_iterator_prototype(*iterator_prototype);
     825             : 
     826             :   Handle<JSObject> generator_object_prototype = factory()->NewJSObject(
     827         111 :       isolate()->object_function(), AllocationType::kOld);
     828         222 :   native_context()->set_initial_generator_prototype(
     829         111 :       *generator_object_prototype);
     830         111 :   JSObject::ForceSetPrototype(generator_object_prototype, iterator_prototype);
     831             :   Handle<JSObject> generator_function_prototype = factory()->NewJSObject(
     832         111 :       isolate()->object_function(), AllocationType::kOld);
     833         111 :   JSObject::ForceSetPrototype(generator_function_prototype, empty);
     834             : 
     835             :   InstallToStringTag(isolate(), generator_function_prototype,
     836             :                      "GeneratorFunction");
     837         111 :   JSObject::AddProperty(isolate(), generator_function_prototype,
     838             :                         factory()->prototype_string(),
     839             :                         generator_object_prototype,
     840         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     841             : 
     842         111 :   JSObject::AddProperty(isolate(), generator_object_prototype,
     843             :                         factory()->constructor_string(),
     844             :                         generator_function_prototype,
     845         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     846             :   InstallToStringTag(isolate(), generator_object_prototype, "Generator");
     847             :   SimpleInstallFunction(isolate(), generator_object_prototype, "next",
     848         111 :                         Builtins::kGeneratorPrototypeNext, 1, false);
     849             :   SimpleInstallFunction(isolate(), generator_object_prototype, "return",
     850         111 :                         Builtins::kGeneratorPrototypeReturn, 1, false);
     851             :   SimpleInstallFunction(isolate(), generator_object_prototype, "throw",
     852         111 :                         Builtins::kGeneratorPrototypeThrow, 1, false);
     853             : 
     854             :   // Internal version of generator_prototype_next, flagged as non-native such
     855             :   // that it doesn't show up in Error traces.
     856             :   Handle<JSFunction> generator_next_internal =
     857             :       SimpleCreateFunction(isolate(), factory()->next_string(),
     858         111 :                            Builtins::kGeneratorPrototypeNext, 1, false);
     859         111 :   generator_next_internal->shared()->set_native(false);
     860         111 :   native_context()->set_generator_next_internal(*generator_next_internal);
     861             : 
     862             :   // Create maps for generator functions and their prototypes.  Store those
     863             :   // maps in the native context. The "prototype" property descriptor is
     864             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     865             :   // 04-14-15, section 25.2.4.3).
     866             :   // Generator functions do not have "caller" or "arguments" accessors.
     867             :   Handle<Map> map;
     868             :   map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
     869             :                                 generator_function_prototype,
     870         111 :                                 "GeneratorFunction");
     871         111 :   native_context()->set_generator_function_map(*map);
     872             : 
     873             :   map = CreateNonConstructorMap(
     874             :       isolate(), isolate()->strict_function_with_name_map(),
     875         111 :       generator_function_prototype, "GeneratorFunction with name");
     876         111 :   native_context()->set_generator_function_with_name_map(*map);
     877             : 
     878             :   map = CreateNonConstructorMap(
     879             :       isolate(), strict_function_with_home_object_map_,
     880         111 :       generator_function_prototype, "GeneratorFunction with home object");
     881         111 :   native_context()->set_generator_function_with_home_object_map(*map);
     882             : 
     883             :   map = CreateNonConstructorMap(isolate(),
     884             :                                 strict_function_with_name_and_home_object_map_,
     885             :                                 generator_function_prototype,
     886         111 :                                 "GeneratorFunction with name and home object");
     887         111 :   native_context()->set_generator_function_with_name_and_home_object_map(*map);
     888             : 
     889         222 :   Handle<JSFunction> object_function(native_context()->object_function(),
     890         111 :                                      isolate());
     891         111 :   Handle<Map> generator_object_prototype_map = Map::Create(isolate(), 0);
     892         111 :   Map::SetPrototype(isolate(), generator_object_prototype_map,
     893         111 :                     generator_object_prototype);
     894         222 :   native_context()->set_generator_object_prototype_map(
     895         111 :       *generator_object_prototype_map);
     896         111 : }
     897             : 
     898         111 : void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
     899             :   // %AsyncIteratorPrototype%
     900             :   // proposal-async-iteration/#sec-asynciteratorprototype
     901             :   Handle<JSObject> async_iterator_prototype = factory()->NewJSObject(
     902         111 :       isolate()->object_function(), AllocationType::kOld);
     903             : 
     904             :   InstallFunctionAtSymbol(
     905             :       isolate(), async_iterator_prototype, factory()->async_iterator_symbol(),
     906         111 :       "[Symbol.asyncIterator]", Builtins::kReturnReceiver, 0, true);
     907             : 
     908             :   // %AsyncFromSyncIteratorPrototype%
     909             :   // proposal-async-iteration/#sec-%asyncfromsynciteratorprototype%-object
     910             :   Handle<JSObject> async_from_sync_iterator_prototype = factory()->NewJSObject(
     911         111 :       isolate()->object_function(), AllocationType::kOld);
     912             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "next",
     913         111 :                         Builtins::kAsyncFromSyncIteratorPrototypeNext, 1, true);
     914             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "return",
     915             :                         Builtins::kAsyncFromSyncIteratorPrototypeReturn, 1,
     916         111 :                         true);
     917             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "throw",
     918             :                         Builtins::kAsyncFromSyncIteratorPrototypeThrow, 1,
     919         111 :                         true);
     920             : 
     921             :   InstallToStringTag(isolate(), async_from_sync_iterator_prototype,
     922             :                      "Async-from-Sync Iterator");
     923             : 
     924         111 :   JSObject::ForceSetPrototype(async_from_sync_iterator_prototype,
     925         111 :                               async_iterator_prototype);
     926             : 
     927             :   Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
     928         111 :       JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
     929         111 :   Map::SetPrototype(isolate(), async_from_sync_iterator_map,
     930         111 :                     async_from_sync_iterator_prototype);
     931         222 :   native_context()->set_async_from_sync_iterator_map(
     932         111 :       *async_from_sync_iterator_map);
     933             : 
     934             :   // Async Generators
     935             :   Handle<JSObject> async_generator_object_prototype = factory()->NewJSObject(
     936         111 :       isolate()->object_function(), AllocationType::kOld);
     937             :   Handle<JSObject> async_generator_function_prototype = factory()->NewJSObject(
     938         111 :       isolate()->object_function(), AllocationType::kOld);
     939             : 
     940             :   // %AsyncGenerator% / %AsyncGeneratorFunction%.prototype
     941         111 :   JSObject::ForceSetPrototype(async_generator_function_prototype, empty);
     942             : 
     943             :   // The value of AsyncGeneratorFunction.prototype.prototype is the
     944             :   //     %AsyncGeneratorPrototype% intrinsic object.
     945             :   // This property has the attributes
     946             :   //     { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
     947         111 :   JSObject::AddProperty(isolate(), async_generator_function_prototype,
     948             :                         factory()->prototype_string(),
     949             :                         async_generator_object_prototype,
     950         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     951         111 :   JSObject::AddProperty(isolate(), async_generator_object_prototype,
     952             :                         factory()->constructor_string(),
     953             :                         async_generator_function_prototype,
     954         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     955             :   InstallToStringTag(isolate(), async_generator_function_prototype,
     956             :                      "AsyncGeneratorFunction");
     957             : 
     958             :   // %AsyncGeneratorPrototype%
     959         111 :   JSObject::ForceSetPrototype(async_generator_object_prototype,
     960         111 :                               async_iterator_prototype);
     961         222 :   native_context()->set_initial_async_generator_prototype(
     962         111 :       *async_generator_object_prototype);
     963             : 
     964             :   InstallToStringTag(isolate(), async_generator_object_prototype,
     965             :                      "AsyncGenerator");
     966             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "next",
     967         111 :                         Builtins::kAsyncGeneratorPrototypeNext, 1, false);
     968             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "return",
     969         111 :                         Builtins::kAsyncGeneratorPrototypeReturn, 1, false);
     970             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "throw",
     971         111 :                         Builtins::kAsyncGeneratorPrototypeThrow, 1, false);
     972             : 
     973             :   // Create maps for generator functions and their prototypes.  Store those
     974             :   // maps in the native context. The "prototype" property descriptor is
     975             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     976             :   // 04-14-15, section 25.2.4.3).
     977             :   // Async Generator functions do not have "caller" or "arguments" accessors.
     978             :   Handle<Map> map;
     979             :   map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
     980             :                                 async_generator_function_prototype,
     981         111 :                                 "AsyncGeneratorFunction");
     982         111 :   native_context()->set_async_generator_function_map(*map);
     983             : 
     984             :   map = CreateNonConstructorMap(
     985             :       isolate(), isolate()->strict_function_with_name_map(),
     986         111 :       async_generator_function_prototype, "AsyncGeneratorFunction with name");
     987         111 :   native_context()->set_async_generator_function_with_name_map(*map);
     988             : 
     989             :   map =
     990             :       CreateNonConstructorMap(isolate(), strict_function_with_home_object_map_,
     991             :                               async_generator_function_prototype,
     992         111 :                               "AsyncGeneratorFunction with home object");
     993         111 :   native_context()->set_async_generator_function_with_home_object_map(*map);
     994             : 
     995             :   map = CreateNonConstructorMap(
     996             :       isolate(), strict_function_with_name_and_home_object_map_,
     997             :       async_generator_function_prototype,
     998         111 :       "AsyncGeneratorFunction with name and home object");
     999         222 :   native_context()->set_async_generator_function_with_name_and_home_object_map(
    1000         111 :       *map);
    1001             : 
    1002         222 :   Handle<JSFunction> object_function(native_context()->object_function(),
    1003         111 :                                      isolate());
    1004         111 :   Handle<Map> async_generator_object_prototype_map = Map::Create(isolate(), 0);
    1005         111 :   Map::SetPrototype(isolate(), async_generator_object_prototype_map,
    1006         111 :                     async_generator_object_prototype);
    1007         222 :   native_context()->set_async_generator_object_prototype_map(
    1008         111 :       *async_generator_object_prototype_map);
    1009         111 : }
    1010             : 
    1011         111 : void Genesis::CreateAsyncFunctionMaps(Handle<JSFunction> empty) {
    1012             :   // %AsyncFunctionPrototype% intrinsic
    1013             :   Handle<JSObject> async_function_prototype = factory()->NewJSObject(
    1014         111 :       isolate()->object_function(), AllocationType::kOld);
    1015         111 :   JSObject::ForceSetPrototype(async_function_prototype, empty);
    1016             : 
    1017             :   InstallToStringTag(isolate(), async_function_prototype, "AsyncFunction");
    1018             : 
    1019             :   Handle<Map> map =
    1020             :       Map::Copy(isolate(), isolate()->strict_function_without_prototype_map(),
    1021         111 :                 "AsyncFunction");
    1022         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1023         111 :   native_context()->set_async_function_map(*map);
    1024             : 
    1025             :   map = Map::Copy(isolate(), isolate()->method_with_name_map(),
    1026         111 :                   "AsyncFunction with name");
    1027         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1028         111 :   native_context()->set_async_function_with_name_map(*map);
    1029             : 
    1030             :   map = Map::Copy(isolate(), isolate()->method_with_home_object_map(),
    1031         111 :                   "AsyncFunction with home object");
    1032         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1033         111 :   native_context()->set_async_function_with_home_object_map(*map);
    1034             : 
    1035             :   map = Map::Copy(isolate(), isolate()->method_with_name_and_home_object_map(),
    1036         111 :                   "AsyncFunction with name and home object");
    1037         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1038         111 :   native_context()->set_async_function_with_name_and_home_object_map(*map);
    1039         111 : }
    1040             : 
    1041         111 : void Genesis::CreateJSProxyMaps() {
    1042             :   // Allocate maps for all Proxy types.
    1043             :   // Next to the default proxy, we need maps indicating callable and
    1044             :   // constructable proxies.
    1045             :   Handle<Map> proxy_map = factory()->NewMap(JS_PROXY_TYPE, JSProxy::kSize,
    1046         111 :                                             TERMINAL_FAST_ELEMENTS_KIND);
    1047         111 :   proxy_map->set_is_dictionary_map(true);
    1048         111 :   proxy_map->set_may_have_interesting_symbols(true);
    1049         111 :   native_context()->set_proxy_map(*proxy_map);
    1050             : 
    1051             :   Handle<Map> proxy_callable_map =
    1052         111 :       Map::Copy(isolate_, proxy_map, "callable Proxy");
    1053             :   proxy_callable_map->set_is_callable(true);
    1054         111 :   native_context()->set_proxy_callable_map(*proxy_callable_map);
    1055         222 :   proxy_callable_map->SetConstructor(native_context()->function_function());
    1056             : 
    1057             :   Handle<Map> proxy_constructor_map =
    1058         111 :       Map::Copy(isolate_, proxy_callable_map, "constructor Proxy");
    1059             :   proxy_constructor_map->set_is_constructor(true);
    1060         111 :   native_context()->set_proxy_constructor_map(*proxy_constructor_map);
    1061             : 
    1062             :   {
    1063             :     Handle<Map> map =
    1064             :         factory()->NewMap(JS_OBJECT_TYPE, JSProxyRevocableResult::kSize,
    1065         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 2);
    1066         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    1067             : 
    1068             :     {  // proxy
    1069             :       Descriptor d = Descriptor::DataField(isolate(), factory()->proxy_string(),
    1070             :                                            JSProxyRevocableResult::kProxyIndex,
    1071         111 :                                            NONE, Representation::Tagged());
    1072         111 :       map->AppendDescriptor(isolate(), &d);
    1073             :     }
    1074             :     {  // revoke
    1075             :       Descriptor d = Descriptor::DataField(
    1076             :           isolate(), factory()->revoke_string(),
    1077         111 :           JSProxyRevocableResult::kRevokeIndex, NONE, Representation::Tagged());
    1078         111 :       map->AppendDescriptor(isolate(), &d);
    1079             :     }
    1080             : 
    1081         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    1082         222 :     map->SetConstructor(native_context()->object_function());
    1083             : 
    1084         111 :     native_context()->set_proxy_revocable_result_map(*map);
    1085             :   }
    1086         111 : }
    1087             : 
    1088             : namespace {
    1089         222 : void ReplaceAccessors(Isolate* isolate, Handle<Map> map, Handle<String> name,
    1090             :                       PropertyAttributes attributes,
    1091             :                       Handle<AccessorPair> accessor_pair) {
    1092         222 :   DescriptorArray descriptors = map->instance_descriptors();
    1093             :   int idx = descriptors->SearchWithCache(isolate, *name, *map);
    1094         222 :   Descriptor d = Descriptor::AccessorConstant(name, accessor_pair, attributes);
    1095         222 :   descriptors->Replace(idx, &d);
    1096         222 : }
    1097             : }  // namespace
    1098             : 
    1099         111 : void Genesis::AddRestrictedFunctionProperties(Handle<JSFunction> empty) {
    1100             :   PropertyAttributes rw_attribs = static_cast<PropertyAttributes>(DONT_ENUM);
    1101         111 :   Handle<JSFunction> thrower = GetThrowTypeErrorIntrinsic();
    1102         111 :   Handle<AccessorPair> accessors = factory()->NewAccessorPair();
    1103         222 :   accessors->set_getter(*thrower);
    1104         222 :   accessors->set_setter(*thrower);
    1105             : 
    1106             :   Handle<Map> map(empty->map(), isolate());
    1107             :   ReplaceAccessors(isolate(), map, factory()->arguments_string(), rw_attribs,
    1108         111 :                    accessors);
    1109             :   ReplaceAccessors(isolate(), map, factory()->caller_string(), rw_attribs,
    1110         111 :                    accessors);
    1111         111 : }
    1112             : 
    1113       91759 : static void AddToWeakNativeContextList(Isolate* isolate, Context context) {
    1114             :   DCHECK(context->IsNativeContext());
    1115             :   Heap* heap = isolate->heap();
    1116             : #ifdef DEBUG
    1117             :   { // NOLINT
    1118             :     DCHECK(context->next_context_link()->IsUndefined(isolate));
    1119             :     // Check that context is not in the list yet.
    1120             :     for (Object current = heap->native_contexts_list();
    1121             :          !current->IsUndefined(isolate);
    1122             :          current = Context::cast(current)->next_context_link()) {
    1123             :       DCHECK(current != context);
    1124             :     }
    1125             :   }
    1126             : #endif
    1127             :   context->set(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list(),
    1128             :                UPDATE_WEAK_WRITE_BARRIER);
    1129             :   heap->set_native_contexts_list(context);
    1130       91759 : }
    1131             : 
    1132             : 
    1133         111 : void Genesis::CreateRoots() {
    1134             :   // Allocate the native context FixedArray first and then patch the
    1135             :   // closure and extension object later (we need the empty function
    1136             :   // and the global object, but in order to create those, we need the
    1137             :   // native context).
    1138         111 :   native_context_ = factory()->NewNativeContext();
    1139         111 :   AddToWeakNativeContextList(isolate(), *native_context());
    1140             :   isolate()->set_context(*native_context());
    1141             : 
    1142             :   // Allocate the message listeners object.
    1143             :   {
    1144         111 :     Handle<TemplateList> list = TemplateList::New(isolate(), 1);
    1145         111 :     native_context()->set_message_listeners(*list);
    1146             :   }
    1147         111 : }
    1148             : 
    1149             : 
    1150         111 : void Genesis::InstallGlobalThisBinding() {
    1151             :   Handle<ScriptContextTable> script_contexts(
    1152         222 :       native_context()->script_context_table(), isolate());
    1153         111 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateGlobalThisBinding(isolate());
    1154             :   Handle<Context> context =
    1155         111 :       factory()->NewScriptContext(native_context(), scope_info);
    1156             : 
    1157             :   // Go ahead and hook it up while we're at it.
    1158         111 :   int slot = scope_info->ReceiverContextSlotIndex();
    1159             :   DCHECK_EQ(slot, Context::MIN_CONTEXT_SLOTS);
    1160         222 :   context->set(slot, native_context()->global_proxy());
    1161             : 
    1162             :   Handle<ScriptContextTable> new_script_contexts =
    1163         111 :       ScriptContextTable::Extend(script_contexts, context);
    1164         111 :   native_context()->set_script_context_table(*new_script_contexts);
    1165         111 : }
    1166             : 
    1167             : 
    1168       91719 : Handle<JSGlobalObject> Genesis::CreateNewGlobals(
    1169             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    1170             :     Handle<JSGlobalProxy> global_proxy) {
    1171             :   // The argument global_proxy_template aka data is an ObjectTemplateInfo.
    1172             :   // It has a constructor pointer that points at global_constructor which is a
    1173             :   // FunctionTemplateInfo.
    1174             :   // The global_proxy_constructor is used to (re)initialize the
    1175             :   // global_proxy. The global_proxy_constructor also has a prototype_template
    1176             :   // pointer that points at js_global_object_template which is an
    1177             :   // ObjectTemplateInfo.
    1178             :   // That in turn has a constructor pointer that points at
    1179             :   // js_global_object_constructor which is a FunctionTemplateInfo.
    1180             :   // js_global_object_constructor is used to make js_global_object_function
    1181             :   // js_global_object_function is used to make the new global_object.
    1182             :   //
    1183             :   // --- G l o b a l ---
    1184             :   // Step 1: Create a fresh JSGlobalObject.
    1185             :   Handle<JSFunction> js_global_object_function;
    1186             :   Handle<ObjectTemplateInfo> js_global_object_template;
    1187       91719 :   if (!global_proxy_template.IsEmpty()) {
    1188             :     // Get prototype template of the global_proxy_template.
    1189             :     Handle<ObjectTemplateInfo> data =
    1190             :         v8::Utils::OpenHandle(*global_proxy_template);
    1191             :     Handle<FunctionTemplateInfo> global_constructor =
    1192             :         Handle<FunctionTemplateInfo>(
    1193             :             FunctionTemplateInfo::cast(data->constructor()), isolate());
    1194             :     Handle<Object> proto_template(global_constructor->GetPrototypeTemplate(),
    1195             :                                   isolate());
    1196       56308 :     if (!proto_template->IsUndefined(isolate())) {
    1197             :       js_global_object_template =
    1198             :           Handle<ObjectTemplateInfo>::cast(proto_template);
    1199             :     }
    1200             :   }
    1201             : 
    1202       91719 :   if (js_global_object_template.is_null()) {
    1203       35411 :     Handle<String> name = factory()->empty_string();
    1204             :     Handle<JSObject> prototype =
    1205       35411 :         factory()->NewFunctionPrototype(isolate()->object_function());
    1206             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1207             :         name, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize, 0,
    1208       35411 :         Builtins::kIllegal, MUTABLE);
    1209       35410 :     js_global_object_function = factory()->NewFunction(args);
    1210             : #ifdef DEBUG
    1211             :     LookupIterator it(isolate(), prototype, factory()->constructor_string(),
    1212             :                       LookupIterator::OWN_SKIP_INTERCEPTOR);
    1213             :     Handle<Object> value = Object::GetProperty(&it).ToHandleChecked();
    1214             :     DCHECK(it.IsFound());
    1215             :     DCHECK_EQ(*isolate()->object_function(), *value);
    1216             : #endif
    1217             :   } else {
    1218             :     Handle<FunctionTemplateInfo> js_global_object_constructor(
    1219             :         FunctionTemplateInfo::cast(js_global_object_template->constructor()),
    1220             :         isolate());
    1221             :     js_global_object_function = ApiNatives::CreateApiFunction(
    1222             :         isolate(), js_global_object_constructor, factory()->the_hole_value(),
    1223      112616 :         JS_GLOBAL_OBJECT_TYPE);
    1224             :   }
    1225             : 
    1226             :   js_global_object_function->initial_map()->set_is_prototype_map(true);
    1227       91717 :   js_global_object_function->initial_map()->set_is_dictionary_map(true);
    1228      183434 :   js_global_object_function->initial_map()->set_may_have_interesting_symbols(
    1229       91717 :       true);
    1230             :   Handle<JSGlobalObject> global_object =
    1231       91717 :       factory()->NewJSGlobalObject(js_global_object_function);
    1232             : 
    1233             :   // Step 2: (re)initialize the global proxy object.
    1234             :   Handle<JSFunction> global_proxy_function;
    1235       91719 :   if (global_proxy_template.IsEmpty()) {
    1236       35411 :     Handle<String> name = factory()->empty_string();
    1237             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1238             :         name, factory()->the_hole_value(), JS_GLOBAL_PROXY_TYPE,
    1239             :         JSGlobalProxy::SizeWithEmbedderFields(0), 0, Builtins::kIllegal,
    1240       35411 :         MUTABLE);
    1241       35411 :     global_proxy_function = factory()->NewFunction(args);
    1242             :   } else {
    1243             :     Handle<ObjectTemplateInfo> data =
    1244             :         v8::Utils::OpenHandle(*global_proxy_template);
    1245             :     Handle<FunctionTemplateInfo> global_constructor(
    1246             :         FunctionTemplateInfo::cast(data->constructor()), isolate());
    1247             :     global_proxy_function = ApiNatives::CreateApiFunction(
    1248             :         isolate(), global_constructor, factory()->the_hole_value(),
    1249      112616 :         JS_GLOBAL_PROXY_TYPE);
    1250             :   }
    1251             :   global_proxy_function->initial_map()->set_is_access_check_needed(true);
    1252       91719 :   global_proxy_function->initial_map()->set_has_hidden_prototype(true);
    1253       91719 :   global_proxy_function->initial_map()->set_may_have_interesting_symbols(true);
    1254       91719 :   native_context()->set_global_proxy_function(*global_proxy_function);
    1255             : 
    1256             :   // Set global_proxy.__proto__ to js_global after ConfigureGlobalObjects
    1257             :   // Return the global proxy.
    1258             : 
    1259       91719 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1260             : 
    1261             :   // Set the native context for the global object.
    1262       91719 :   global_object->set_native_context(*native_context());
    1263       91719 :   global_object->set_global_proxy(*global_proxy);
    1264             :   // Set the native context of the global proxy.
    1265      183438 :   global_proxy->set_native_context(*native_context());
    1266             :   // Set the global proxy of the native context. If the native context has been
    1267             :   // deserialized, the global proxy is already correctly set up by the
    1268             :   // deserializer. Otherwise it's undefined.
    1269             :   DCHECK(native_context()
    1270             :              ->get(Context::GLOBAL_PROXY_INDEX)
    1271             :              ->IsUndefined(isolate()) ||
    1272             :          native_context()->global_proxy() == *global_proxy);
    1273       91719 :   native_context()->set_global_proxy(*global_proxy);
    1274             : 
    1275       91719 :   return global_object;
    1276             : }
    1277             : 
    1278          40 : void Genesis::HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy) {
    1279             :   // Re-initialize the global proxy with the global proxy function from the
    1280             :   // snapshot, and then set up the link to the native context.
    1281             :   Handle<JSFunction> global_proxy_function(
    1282          80 :       native_context()->global_proxy_function(), isolate());
    1283          40 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1284             :   Handle<JSObject> global_object(
    1285          80 :       JSObject::cast(native_context()->global_object()), isolate());
    1286          40 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    1287          80 :   global_proxy->set_native_context(*native_context());
    1288             :   DCHECK(native_context()->global_proxy() == *global_proxy);
    1289          40 : }
    1290             : 
    1291       91608 : void Genesis::HookUpGlobalObject(Handle<JSGlobalObject> global_object) {
    1292             :   Handle<JSGlobalObject> global_object_from_snapshot(
    1293      183216 :       JSGlobalObject::cast(native_context()->extension()), isolate());
    1294      183216 :   native_context()->set_extension(*global_object);
    1295      183216 :   native_context()->set_security_token(*global_object);
    1296             : 
    1297       91608 :   TransferNamedProperties(global_object_from_snapshot, global_object);
    1298       91608 :   TransferIndexedProperties(global_object_from_snapshot, global_object);
    1299       91608 : }
    1300             : 
    1301       96114 : static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
    1302             :                                              Handle<JSFunction> function,
    1303             :                                              int context_index) {
    1304             :   Handle<Smi> index(Smi::FromInt(context_index), isolate);
    1305       96115 :   JSObject::AddProperty(isolate, function,
    1306             :                         isolate->factory()->native_context_index_symbol(),
    1307       96114 :                         index, NONE);
    1308      288345 :   isolate->native_context()->set(context_index, *function);
    1309       96115 : }
    1310             : 
    1311        1110 : static void InstallError(Isolate* isolate, Handle<JSObject> global,
    1312             :                          Handle<String> name, int context_index) {
    1313             :   Factory* factory = isolate->factory();
    1314             : 
    1315             :   // Most Error objects consist of a message and a stack trace.
    1316             :   // Reserve two in-object properties for these.
    1317             :   const int kInObjectPropertiesCount = 2;
    1318             :   const int kErrorObjectSize =
    1319             :       JSObject::kHeaderSize + kInObjectPropertiesCount * kTaggedSize;
    1320             :   Handle<JSFunction> error_fun =
    1321             :       InstallFunction(isolate, global, name, JS_ERROR_TYPE, kErrorObjectSize,
    1322             :                       kInObjectPropertiesCount, factory->the_hole_value(),
    1323        1110 :                       Builtins::kErrorConstructor);
    1324             :   error_fun->shared()->DontAdaptArguments();
    1325             :   error_fun->shared()->set_length(1);
    1326             : 
    1327        1110 :   if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1328             :     SimpleInstallFunction(isolate, error_fun, "captureStackTrace",
    1329         111 :                           Builtins::kErrorCaptureStackTrace, 2, false);
    1330             :   }
    1331             : 
    1332        1110 :   InstallWithIntrinsicDefaultProto(isolate, error_fun, context_index);
    1333             : 
    1334             :   {
    1335             :     // Setup %XXXErrorPrototype%.
    1336        2220 :     Handle<JSObject> prototype(JSObject::cast(error_fun->instance_prototype()),
    1337             :                                isolate);
    1338             : 
    1339        1110 :     JSObject::AddProperty(isolate, prototype, factory->name_string(), name,
    1340        1110 :                           DONT_ENUM);
    1341        1110 :     JSObject::AddProperty(isolate, prototype, factory->message_string(),
    1342        1110 :                           factory->empty_string(), DONT_ENUM);
    1343             : 
    1344        1110 :     if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1345             :       Handle<JSFunction> to_string_fun =
    1346             :           SimpleInstallFunction(isolate, prototype, "toString",
    1347         111 :                                 Builtins::kErrorPrototypeToString, 0, true);
    1348         222 :       isolate->native_context()->set_error_to_string(*to_string_fun);
    1349         222 :       isolate->native_context()->set_initial_error_prototype(*prototype);
    1350             :     } else {
    1351             :       DCHECK(isolate->native_context()->error_to_string()->IsJSFunction());
    1352             : 
    1353        1998 :       JSObject::AddProperty(isolate, prototype, factory->toString_string(),
    1354         999 :                             isolate->error_to_string(), DONT_ENUM);
    1355             : 
    1356         999 :       Handle<JSFunction> global_error = isolate->error_function();
    1357        1998 :       CHECK(JSReceiver::SetPrototype(error_fun, global_error, false,
    1358             :                                      kThrowOnError)
    1359             :                 .FromMaybe(false));
    1360        2997 :       CHECK(JSReceiver::SetPrototype(prototype,
    1361             :                                      handle(global_error->prototype(), isolate),
    1362             :                                      false, kThrowOnError)
    1363             :                 .FromMaybe(false));
    1364             :     }
    1365             :   }
    1366             : 
    1367             :   Handle<Map> initial_map(error_fun->initial_map(), isolate);
    1368        1110 :   Map::EnsureDescriptorSlack(isolate, initial_map, 1);
    1369             : 
    1370             :   {
    1371             :     Handle<AccessorInfo> info = factory->error_stack_accessor();
    1372             :     Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
    1373        1110 :                                                 info, DONT_ENUM);
    1374        1110 :     initial_map->AppendDescriptor(isolate, &d);
    1375             :   }
    1376        1110 : }
    1377             : 
    1378             : namespace {
    1379             : 
    1380         555 : void InstallMakeError(Isolate* isolate, int builtin_id, int context_index) {
    1381             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1382             :       isolate->factory()->empty_string(), isolate->factory()->the_hole_value(),
    1383         555 :       JS_OBJECT_TYPE, JSObject::kHeaderSize, 0, builtin_id, MUTABLE);
    1384             : 
    1385         555 :   Handle<JSFunction> function = isolate->factory()->NewFunction(args);
    1386             :   function->shared()->DontAdaptArguments();
    1387        1665 :   isolate->native_context()->set(context_index, *function);
    1388         555 : }
    1389             : 
    1390             : }  // namespace
    1391             : 
    1392             : // This is only called if we are not using snapshots.  The equivalent
    1393             : // work in the snapshot case is done in HookUpGlobalObject.
    1394         111 : void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
    1395             :                                Handle<JSFunction> empty_function) {
    1396             :   // --- N a t i v e   C o n t e x t ---
    1397             :   // Use the empty scope info.
    1398         222 :   native_context()->set_scope_info(empty_function->shared()->scope_info());
    1399         111 :   native_context()->set_previous(Context());
    1400             :   // Set extension and global object.
    1401         222 :   native_context()->set_extension(*global_object);
    1402             :   // Security setup: Set the security token of the native context to the global
    1403             :   // object. This makes the security check between two different contexts fail
    1404             :   // by default even in case of global object reinitialization.
    1405         222 :   native_context()->set_security_token(*global_object);
    1406             : 
    1407         111 :   Factory* factory = isolate_->factory();
    1408             : 
    1409             :   Handle<ScriptContextTable> script_context_table =
    1410         111 :       factory->NewScriptContextTable();
    1411         111 :   native_context()->set_script_context_table(*script_context_table);
    1412         111 :   InstallGlobalThisBinding();
    1413             : 
    1414             :   {  // --- O b j e c t ---
    1415             :     Handle<String> object_name = factory->Object_string();
    1416         111 :     Handle<JSFunction> object_function = isolate_->object_function();
    1417         222 :     JSObject::AddProperty(isolate_, global_object, object_name, object_function,
    1418         111 :                           DONT_ENUM);
    1419             : 
    1420             :     SimpleInstallFunction(isolate_, object_function, "assign",
    1421         111 :                           Builtins::kObjectAssign, 2, false);
    1422             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertyDescriptor",
    1423         111 :                           Builtins::kObjectGetOwnPropertyDescriptor, 2, false);
    1424             :     SimpleInstallFunction(isolate_, object_function,
    1425             :                           "getOwnPropertyDescriptors",
    1426         111 :                           Builtins::kObjectGetOwnPropertyDescriptors, 1, false);
    1427             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertyNames",
    1428         111 :                           Builtins::kObjectGetOwnPropertyNames, 1, true);
    1429             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertySymbols",
    1430         111 :                           Builtins::kObjectGetOwnPropertySymbols, 1, false);
    1431             :     SimpleInstallFunction(isolate_, object_function, "is", Builtins::kObjectIs,
    1432         111 :                           2, true);
    1433             :     SimpleInstallFunction(isolate_, object_function, "preventExtensions",
    1434         111 :                           Builtins::kObjectPreventExtensions, 1, false);
    1435             :     SimpleInstallFunction(isolate_, object_function, "seal",
    1436         111 :                           Builtins::kObjectSeal, 1, false);
    1437             : 
    1438             :     Handle<JSFunction> object_create = SimpleInstallFunction(
    1439         111 :         isolate_, object_function, "create", Builtins::kObjectCreate, 2, false);
    1440         111 :     native_context()->set_object_create(*object_create);
    1441             : 
    1442             :     Handle<JSFunction> object_define_properties =
    1443             :         SimpleInstallFunction(isolate_, object_function, "defineProperties",
    1444         111 :                               Builtins::kObjectDefineProperties, 2, true);
    1445         111 :     native_context()->set_object_define_properties(*object_define_properties);
    1446             : 
    1447             :     Handle<JSFunction> object_define_property =
    1448             :         SimpleInstallFunction(isolate_, object_function, "defineProperty",
    1449         111 :                               Builtins::kObjectDefineProperty, 3, true);
    1450         111 :     native_context()->set_object_define_property(*object_define_property);
    1451             : 
    1452             :     SimpleInstallFunction(isolate_, object_function, "freeze",
    1453         111 :                           Builtins::kObjectFreeze, 1, false);
    1454             : 
    1455             :     Handle<JSFunction> object_get_prototype_of =
    1456             :         SimpleInstallFunction(isolate_, object_function, "getPrototypeOf",
    1457         111 :                               Builtins::kObjectGetPrototypeOf, 1, false);
    1458         111 :     native_context()->set_object_get_prototype_of(*object_get_prototype_of);
    1459             :     SimpleInstallFunction(isolate_, object_function, "setPrototypeOf",
    1460         111 :                           Builtins::kObjectSetPrototypeOf, 2, false);
    1461             : 
    1462             :     SimpleInstallFunction(isolate_, object_function, "isExtensible",
    1463         111 :                           Builtins::kObjectIsExtensible, 1, false);
    1464             :     SimpleInstallFunction(isolate_, object_function, "isFrozen",
    1465         111 :                           Builtins::kObjectIsFrozen, 1, false);
    1466             : 
    1467             :     Handle<JSFunction> object_is_sealed =
    1468             :         SimpleInstallFunction(isolate_, object_function, "isSealed",
    1469         111 :                               Builtins::kObjectIsSealed, 1, false);
    1470         111 :     native_context()->set_object_is_sealed(*object_is_sealed);
    1471             : 
    1472             :     Handle<JSFunction> object_keys = SimpleInstallFunction(
    1473         111 :         isolate_, object_function, "keys", Builtins::kObjectKeys, 1, true);
    1474         111 :     native_context()->set_object_keys(*object_keys);
    1475             :     SimpleInstallFunction(isolate_, object_function, "entries",
    1476         111 :                           Builtins::kObjectEntries, 1, true);
    1477             :     SimpleInstallFunction(isolate_, object_function, "values",
    1478         111 :                           Builtins::kObjectValues, 1, true);
    1479             : 
    1480         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1481             :                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
    1482         111 :                           true);
    1483         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1484             :                           "__defineSetter__", Builtins::kObjectDefineSetter, 2,
    1485         111 :                           true);
    1486         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1487             :                           "hasOwnProperty",
    1488         111 :                           Builtins::kObjectPrototypeHasOwnProperty, 1, true);
    1489         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1490             :                           "__lookupGetter__", Builtins::kObjectLookupGetter, 1,
    1491         111 :                           true);
    1492         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1493             :                           "__lookupSetter__", Builtins::kObjectLookupSetter, 1,
    1494         111 :                           true);
    1495         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1496             :                           "isPrototypeOf",
    1497         111 :                           Builtins::kObjectPrototypeIsPrototypeOf, 1, true);
    1498             :     SimpleInstallFunction(
    1499         111 :         isolate_, isolate_->initial_object_prototype(), "propertyIsEnumerable",
    1500         111 :         Builtins::kObjectPrototypePropertyIsEnumerable, 1, false);
    1501             :     Handle<JSFunction> object_to_string = SimpleInstallFunction(
    1502         111 :         isolate_, isolate_->initial_object_prototype(), "toString",
    1503         111 :         Builtins::kObjectPrototypeToString, 0, true);
    1504         111 :     native_context()->set_object_to_string(*object_to_string);
    1505         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1506             :                           "valueOf", Builtins::kObjectPrototypeValueOf, 0,
    1507         111 :                           true);
    1508             : 
    1509         111 :     SimpleInstallGetterSetter(
    1510         111 :         isolate_, isolate_->initial_object_prototype(), factory->proto_string(),
    1511         111 :         Builtins::kObjectPrototypeGetProto, Builtins::kObjectPrototypeSetProto);
    1512             : 
    1513         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1514             :                           "toLocaleString",
    1515         111 :                           Builtins::kObjectPrototypeToLocaleString, 0, true);
    1516             :   }
    1517             : 
    1518         222 :   Handle<JSObject> global(native_context()->global_object(), isolate());
    1519             : 
    1520             :   {  // --- F u n c t i o n ---
    1521         111 :     Handle<JSFunction> prototype = empty_function;
    1522             :     Handle<JSFunction> function_fun =
    1523             :         InstallFunction(isolate_, global, "Function", JS_FUNCTION_TYPE,
    1524             :                         JSFunction::kSizeWithPrototype, 0, prototype,
    1525         111 :                         Builtins::kFunctionConstructor);
    1526             :     // Function instances are sloppy by default.
    1527         333 :     function_fun->set_prototype_or_initial_map(
    1528         333 :         *isolate_->sloppy_function_map());
    1529             :     function_fun->shared()->DontAdaptArguments();
    1530             :     function_fun->shared()->set_length(1);
    1531         111 :     InstallWithIntrinsicDefaultProto(isolate_, function_fun,
    1532         111 :                                      Context::FUNCTION_FUNCTION_INDEX);
    1533             : 
    1534             :     // Setup the methods on the %FunctionPrototype%.
    1535         222 :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1536         111 :                           function_fun, DONT_ENUM);
    1537             :     SimpleInstallFunction(isolate_, prototype, "apply",
    1538         111 :                           Builtins::kFunctionPrototypeApply, 2, false);
    1539             :     SimpleInstallFunction(isolate_, prototype, "bind",
    1540         111 :                           Builtins::kFastFunctionPrototypeBind, 1, false);
    1541             :     SimpleInstallFunction(isolate_, prototype, "call",
    1542         111 :                           Builtins::kFunctionPrototypeCall, 1, false);
    1543             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1544         111 :                           Builtins::kFunctionPrototypeToString, 0, false);
    1545             : 
    1546             :     // Install the @@hasInstance function.
    1547             :     Handle<JSFunction> has_instance = InstallFunctionAtSymbol(
    1548             :         isolate_, prototype, factory->has_instance_symbol(),
    1549             :         "[Symbol.hasInstance]", Builtins::kFunctionPrototypeHasInstance, 1,
    1550             :         true,
    1551         111 :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY));
    1552         111 :     native_context()->set_function_has_instance(*has_instance);
    1553             : 
    1554             :     // Complete setting up function maps.
    1555             :     {
    1556         222 :       isolate_->sloppy_function_map()->SetConstructor(*function_fun);
    1557         222 :       isolate_->sloppy_function_with_name_map()->SetConstructor(*function_fun);
    1558         333 :       isolate_->sloppy_function_with_readonly_prototype_map()->SetConstructor(
    1559         111 :           *function_fun);
    1560             : 
    1561         222 :       isolate_->strict_function_map()->SetConstructor(*function_fun);
    1562         222 :       isolate_->strict_function_with_name_map()->SetConstructor(*function_fun);
    1563         222 :       strict_function_with_home_object_map_->SetConstructor(*function_fun);
    1564         333 :       strict_function_with_name_and_home_object_map_->SetConstructor(
    1565         111 :           *function_fun);
    1566         333 :       isolate_->strict_function_with_readonly_prototype_map()->SetConstructor(
    1567         111 :           *function_fun);
    1568             : 
    1569         222 :       isolate_->class_function_map()->SetConstructor(*function_fun);
    1570             :     }
    1571             :   }
    1572             : 
    1573             :   {  // --- A s y n c F r o m S y n c I t e r a t o r
    1574             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1575             :         isolate_, Builtins::kAsyncIteratorValueUnwrap, factory->empty_string(),
    1576         111 :         1);
    1577         111 :     native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
    1578             :   }
    1579             : 
    1580             :   {  // --- A s y n c G e n e r a t o r ---
    1581             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1582             :         isolate_, Builtins::kAsyncGeneratorAwaitResolveClosure,
    1583         111 :         factory->empty_string(), 1);
    1584         111 :     native_context()->set_async_generator_await_resolve_shared_fun(*info);
    1585             : 
    1586             :     info = SimpleCreateSharedFunctionInfo(
    1587             :         isolate_, Builtins::kAsyncGeneratorAwaitRejectClosure,
    1588         111 :         factory->empty_string(), 1);
    1589         111 :     native_context()->set_async_generator_await_reject_shared_fun(*info);
    1590             : 
    1591             :     info = SimpleCreateSharedFunctionInfo(
    1592             :         isolate_, Builtins::kAsyncGeneratorYieldResolveClosure,
    1593         111 :         factory->empty_string(), 1);
    1594         111 :     native_context()->set_async_generator_yield_resolve_shared_fun(*info);
    1595             : 
    1596             :     info = SimpleCreateSharedFunctionInfo(
    1597             :         isolate_, Builtins::kAsyncGeneratorReturnResolveClosure,
    1598         111 :         factory->empty_string(), 1);
    1599         111 :     native_context()->set_async_generator_return_resolve_shared_fun(*info);
    1600             : 
    1601             :     info = SimpleCreateSharedFunctionInfo(
    1602             :         isolate_, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
    1603         111 :         factory->empty_string(), 1);
    1604         222 :     native_context()->set_async_generator_return_closed_resolve_shared_fun(
    1605         111 :         *info);
    1606             : 
    1607             :     info = SimpleCreateSharedFunctionInfo(
    1608             :         isolate_, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
    1609         111 :         factory->empty_string(), 1);
    1610         222 :     native_context()->set_async_generator_return_closed_reject_shared_fun(
    1611         111 :         *info);
    1612             :   }
    1613             : 
    1614             :   Handle<JSFunction> array_prototype_to_string_fun;
    1615             :   {  // --- A r r a y ---
    1616             :     Handle<JSFunction> array_function = InstallFunction(
    1617             :         isolate_, global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
    1618         222 :         isolate_->initial_object_prototype(), Builtins::kArrayConstructor);
    1619             :     array_function->shared()->DontAdaptArguments();
    1620             : 
    1621             :     // This seems a bit hackish, but we need to make sure Array.length
    1622             :     // is 1.
    1623             :     array_function->shared()->set_length(1);
    1624             : 
    1625             :     Handle<Map> initial_map(array_function->initial_map(), isolate());
    1626             : 
    1627             :     // This assert protects an optimization in
    1628             :     // HGraphBuilder::JSArrayBuilder::EmitMapCode()
    1629             :     DCHECK(initial_map->elements_kind() == GetInitialFastElementsKind());
    1630         111 :     Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
    1631             : 
    1632             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1633             :         DONT_ENUM | DONT_DELETE);
    1634             : 
    1635             :     STATIC_ASSERT(JSArray::kLengthDescriptorIndex == 0);
    1636             :     {  // Add length.
    1637             :       Descriptor d = Descriptor::AccessorConstant(
    1638         111 :           factory->length_string(), factory->array_length_accessor(), attribs);
    1639         111 :       initial_map->AppendDescriptor(isolate(), &d);
    1640             :     }
    1641             : 
    1642         111 :     InstallWithIntrinsicDefaultProto(isolate_, array_function,
    1643         111 :                                      Context::ARRAY_FUNCTION_INDEX);
    1644         111 :     InstallSpeciesGetter(isolate_, array_function);
    1645             : 
    1646             :     // Cache the array maps, needed by ArrayConstructorStub
    1647         111 :     CacheInitialJSArrayMaps(native_context(), initial_map);
    1648             : 
    1649             :     // Set up %ArrayPrototype%.
    1650             :     // The %ArrayPrototype% has TERMINAL_FAST_ELEMENTS_KIND in order to ensure
    1651             :     // that constant functions stay constant after turning prototype to setup
    1652             :     // mode and back when constant field tracking is enabled.
    1653             :     Handle<JSArray> proto = factory->NewJSArray(0, TERMINAL_FAST_ELEMENTS_KIND,
    1654             :                                                 AllocationType::kOld);
    1655         111 :     JSFunction::SetPrototype(array_function, proto);
    1656         222 :     native_context()->set_initial_array_prototype(*proto);
    1657             : 
    1658             :     Handle<JSFunction> is_arraylike = SimpleInstallFunction(
    1659         111 :         isolate_, array_function, "isArray", Builtins::kArrayIsArray, 1, true);
    1660         111 :     native_context()->set_is_arraylike(*is_arraylike);
    1661             : 
    1662             :     SimpleInstallFunction(isolate_, array_function, "from",
    1663         111 :                           Builtins::kArrayFrom, 1, false);
    1664             :     SimpleInstallFunction(isolate_, array_function, "of", Builtins::kArrayOf, 0,
    1665         111 :                           false);
    1666             : 
    1667         222 :     JSObject::AddProperty(isolate_, proto, factory->constructor_string(),
    1668         111 :                           array_function, DONT_ENUM);
    1669             : 
    1670             :     SimpleInstallFunction(isolate_, proto, "concat", Builtins::kArrayConcat, 1,
    1671         111 :                           false);
    1672             :     SimpleInstallFunction(isolate_, proto, "copyWithin",
    1673         111 :                           Builtins::kArrayPrototypeCopyWithin, 2, false);
    1674             :     SimpleInstallFunction(isolate_, proto, "fill",
    1675         111 :                           Builtins::kArrayPrototypeFill, 1, false);
    1676             :     SimpleInstallFunction(isolate_, proto, "find",
    1677         111 :                           Builtins::kArrayPrototypeFind, 1, false);
    1678             :     SimpleInstallFunction(isolate_, proto, "findIndex",
    1679         111 :                           Builtins::kArrayPrototypeFindIndex, 1, false);
    1680             :     SimpleInstallFunction(isolate_, proto, "lastIndexOf",
    1681         111 :                           Builtins::kArrayPrototypeLastIndexOf, 1, false);
    1682             :     SimpleInstallFunction(isolate_, proto, "pop", Builtins::kArrayPrototypePop,
    1683         111 :                           0, false);
    1684             :     SimpleInstallFunction(isolate_, proto, "push",
    1685         111 :                           Builtins::kArrayPrototypePush, 1, false);
    1686             :     SimpleInstallFunction(isolate_, proto, "reverse",
    1687         111 :                           Builtins::kArrayPrototypeReverse, 0, false);
    1688             :     SimpleInstallFunction(isolate_, proto, "shift",
    1689         111 :                           Builtins::kArrayPrototypeShift, 0, false);
    1690             :     SimpleInstallFunction(isolate_, proto, "unshift",
    1691         111 :                           Builtins::kArrayPrototypeUnshift, 1, false);
    1692             :     SimpleInstallFunction(isolate_, proto, "slice",
    1693         111 :                           Builtins::kArrayPrototypeSlice, 2, false);
    1694             :     SimpleInstallFunction(isolate_, proto, "sort",
    1695         111 :                           Builtins::kArrayPrototypeSort, 1, false);
    1696             :     SimpleInstallFunction(isolate_, proto, "splice",
    1697         111 :                           Builtins::kArrayPrototypeSplice, 2, false);
    1698             :     SimpleInstallFunction(isolate_, proto, "includes", Builtins::kArrayIncludes,
    1699         111 :                           1, false);
    1700             :     SimpleInstallFunction(isolate_, proto, "indexOf", Builtins::kArrayIndexOf,
    1701         111 :                           1, false);
    1702             :     SimpleInstallFunction(isolate_, proto, "join",
    1703         111 :                           Builtins::kArrayPrototypeJoin, 1, false);
    1704             : 
    1705             :     {  // Set up iterator-related properties.
    1706             :       Handle<JSFunction> keys = InstallFunctionWithBuiltinId(
    1707         111 :           isolate_, proto, "keys", Builtins::kArrayPrototypeKeys, 0, true);
    1708         111 :       native_context()->set_array_keys_iterator(*keys);
    1709             : 
    1710             :       Handle<JSFunction> entries = InstallFunctionWithBuiltinId(
    1711             :           isolate_, proto, "entries", Builtins::kArrayPrototypeEntries, 0,
    1712         111 :           true);
    1713         111 :       native_context()->set_array_entries_iterator(*entries);
    1714             : 
    1715             :       Handle<JSFunction> values = InstallFunctionWithBuiltinId(
    1716         111 :           isolate_, proto, "values", Builtins::kArrayPrototypeValues, 0, true);
    1717         222 :       JSObject::AddProperty(isolate_, proto, factory->iterator_symbol(), values,
    1718         111 :                             DONT_ENUM);
    1719         111 :       native_context()->set_array_values_iterator(*values);
    1720             :     }
    1721             : 
    1722             :     Handle<JSFunction> for_each_fun = SimpleInstallFunction(
    1723         111 :         isolate_, proto, "forEach", Builtins::kArrayForEach, 1, false);
    1724         111 :     native_context()->set_array_for_each_iterator(*for_each_fun);
    1725             :     SimpleInstallFunction(isolate_, proto, "filter", Builtins::kArrayFilter, 1,
    1726         111 :                           false);
    1727             :     SimpleInstallFunction(isolate_, proto, "flat",
    1728         111 :                           Builtins::kArrayPrototypeFlat, 0, false);
    1729             :     SimpleInstallFunction(isolate_, proto, "flatMap",
    1730         111 :                           Builtins::kArrayPrototypeFlatMap, 1, false);
    1731             :     SimpleInstallFunction(isolate_, proto, "map", Builtins::kArrayMap, 1,
    1732         111 :                           false);
    1733             :     SimpleInstallFunction(isolate_, proto, "every", Builtins::kArrayEvery, 1,
    1734         111 :                           false);
    1735             :     SimpleInstallFunction(isolate_, proto, "some", Builtins::kArraySome, 1,
    1736         111 :                           false);
    1737             :     SimpleInstallFunction(isolate_, proto, "reduce", Builtins::kArrayReduce, 1,
    1738         111 :                           false);
    1739             :     SimpleInstallFunction(isolate_, proto, "reduceRight",
    1740         111 :                           Builtins::kArrayReduceRight, 1, false);
    1741             :     SimpleInstallFunction(isolate_, proto, "toLocaleString",
    1742         111 :                           Builtins::kArrayPrototypeToLocaleString, 0, false);
    1743             :     array_prototype_to_string_fun =
    1744             :         SimpleInstallFunction(isolate_, proto, "toString",
    1745         111 :                               Builtins::kArrayPrototypeToString, 0, false);
    1746             : 
    1747         111 :     Handle<JSObject> unscopables = factory->NewJSObjectWithNullProto();
    1748         111 :     InstallTrueValuedProperty(isolate_, unscopables, "copyWithin");
    1749         111 :     InstallTrueValuedProperty(isolate_, unscopables, "entries");
    1750         111 :     InstallTrueValuedProperty(isolate_, unscopables, "fill");
    1751         111 :     InstallTrueValuedProperty(isolate_, unscopables, "find");
    1752         111 :     InstallTrueValuedProperty(isolate_, unscopables, "findIndex");
    1753         111 :     InstallTrueValuedProperty(isolate_, unscopables, "flat");
    1754         111 :     InstallTrueValuedProperty(isolate_, unscopables, "flatMap");
    1755         111 :     InstallTrueValuedProperty(isolate_, unscopables, "includes");
    1756         111 :     InstallTrueValuedProperty(isolate_, unscopables, "keys");
    1757         111 :     InstallTrueValuedProperty(isolate_, unscopables, "values");
    1758         111 :     JSObject::MigrateSlowToFast(unscopables, 0, "Bootstrapping");
    1759         222 :     JSObject::AddProperty(
    1760             :         isolate_, proto, factory->unscopables_symbol(), unscopables,
    1761         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1762             : 
    1763         111 :     Handle<Map> map(proto->map(), isolate_);
    1764         111 :     Map::SetShouldBeFastPrototypeMap(map, true, isolate_);
    1765             :   }
    1766             : 
    1767             :   {  // --- A r r a y I t e r a t o r ---
    1768             :     Handle<JSObject> iterator_prototype(
    1769         222 :         native_context()->initial_iterator_prototype(), isolate());
    1770             : 
    1771             :     Handle<JSObject> array_iterator_prototype =
    1772         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    1773         111 :     JSObject::ForceSetPrototype(array_iterator_prototype, iterator_prototype);
    1774             : 
    1775         111 :     InstallToStringTag(isolate_, array_iterator_prototype,
    1776         111 :                        factory->ArrayIterator_string());
    1777             : 
    1778             :     InstallFunctionWithBuiltinId(isolate_, array_iterator_prototype, "next",
    1779             :                                  Builtins::kArrayIteratorPrototypeNext, 0,
    1780         111 :                                  true);
    1781             : 
    1782             :     Handle<JSFunction> array_iterator_function =
    1783             :         CreateFunction(isolate_, factory->ArrayIterator_string(),
    1784             :                        JS_ARRAY_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
    1785         111 :                        array_iterator_prototype, Builtins::kIllegal);
    1786         111 :     array_iterator_function->shared()->set_native(false);
    1787             : 
    1788         222 :     native_context()->set_initial_array_iterator_map(
    1789         111 :         array_iterator_function->initial_map());
    1790         222 :     native_context()->set_initial_array_iterator_prototype(
    1791         111 :         *array_iterator_prototype);
    1792             :   }
    1793             : 
    1794             :   {  // --- N u m b e r ---
    1795             :     Handle<JSFunction> number_fun = InstallFunction(
    1796             :         isolate_, global, "Number", JS_VALUE_TYPE, JSValue::kSize, 0,
    1797         222 :         isolate_->initial_object_prototype(), Builtins::kNumberConstructor);
    1798             :     number_fun->shared()->DontAdaptArguments();
    1799             :     number_fun->shared()->set_length(1);
    1800         111 :     InstallWithIntrinsicDefaultProto(isolate_, number_fun,
    1801         111 :                                      Context::NUMBER_FUNCTION_INDEX);
    1802             : 
    1803             :     // Create the %NumberPrototype%
    1804             :     Handle<JSValue> prototype = Handle<JSValue>::cast(
    1805         111 :         factory->NewJSObject(number_fun, AllocationType::kOld));
    1806         111 :     prototype->set_value(Smi::kZero);
    1807         111 :     JSFunction::SetPrototype(number_fun, prototype);
    1808             : 
    1809             :     // Install the "constructor" property on the {prototype}.
    1810         222 :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1811         111 :                           number_fun, DONT_ENUM);
    1812             : 
    1813             :     // Install the Number.prototype methods.
    1814             :     SimpleInstallFunction(isolate_, prototype, "toExponential",
    1815         111 :                           Builtins::kNumberPrototypeToExponential, 1, false);
    1816             :     SimpleInstallFunction(isolate_, prototype, "toFixed",
    1817         111 :                           Builtins::kNumberPrototypeToFixed, 1, false);
    1818             :     SimpleInstallFunction(isolate_, prototype, "toPrecision",
    1819         111 :                           Builtins::kNumberPrototypeToPrecision, 1, false);
    1820             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1821         111 :                           Builtins::kNumberPrototypeToString, 1, false);
    1822             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    1823         111 :                           Builtins::kNumberPrototypeValueOf, 0, true);
    1824             : 
    1825             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    1826         111 :                           Builtins::kNumberPrototypeToLocaleString, 0, false);
    1827             : 
    1828             :     // Install the Number functions.
    1829             :     SimpleInstallFunction(isolate_, number_fun, "isFinite",
    1830         111 :                           Builtins::kNumberIsFinite, 1, true);
    1831             :     SimpleInstallFunction(isolate_, number_fun, "isInteger",
    1832         111 :                           Builtins::kNumberIsInteger, 1, true);
    1833             :     SimpleInstallFunction(isolate_, number_fun, "isNaN", Builtins::kNumberIsNaN,
    1834         111 :                           1, true);
    1835             :     SimpleInstallFunction(isolate_, number_fun, "isSafeInteger",
    1836         111 :                           Builtins::kNumberIsSafeInteger, 1, true);
    1837             : 
    1838             :     // Install Number.parseFloat and Global.parseFloat.
    1839             :     Handle<JSFunction> parse_float_fun =
    1840             :         SimpleInstallFunction(isolate_, number_fun, "parseFloat",
    1841         111 :                               Builtins::kNumberParseFloat, 1, true);
    1842         222 :     JSObject::AddProperty(isolate_, global_object, "parseFloat",
    1843         111 :                           parse_float_fun, DONT_ENUM);
    1844             : 
    1845             :     // Install Number.parseInt and Global.parseInt.
    1846             :     Handle<JSFunction> parse_int_fun = SimpleInstallFunction(
    1847         111 :         isolate_, number_fun, "parseInt", Builtins::kNumberParseInt, 2, true);
    1848         222 :     JSObject::AddProperty(isolate_, global_object, "parseInt", parse_int_fun,
    1849         111 :                           DONT_ENUM);
    1850             : 
    1851             :     // Install Number constants
    1852             :     const double kMaxValue = 1.7976931348623157e+308;
    1853             :     const double kMinValue = 5e-324;
    1854             :     const double kMinSafeInteger = -kMaxSafeInteger;
    1855             :     const double kEPS = 2.220446049250313e-16;
    1856             : 
    1857         333 :     InstallConstant(isolate_, number_fun, "MAX_VALUE",
    1858         111 :                     factory->NewNumber(kMaxValue));
    1859         333 :     InstallConstant(isolate_, number_fun, "MIN_VALUE",
    1860         111 :                     factory->NewNumber(kMinValue));
    1861         111 :     InstallConstant(isolate_, number_fun, "NaN", factory->nan_value());
    1862         333 :     InstallConstant(isolate_, number_fun, "NEGATIVE_INFINITY",
    1863         111 :                     factory->NewNumber(-V8_INFINITY));
    1864         222 :     InstallConstant(isolate_, number_fun, "POSITIVE_INFINITY",
    1865         111 :                     factory->infinity_value());
    1866         333 :     InstallConstant(isolate_, number_fun, "MAX_SAFE_INTEGER",
    1867         111 :                     factory->NewNumber(kMaxSafeInteger));
    1868         333 :     InstallConstant(isolate_, number_fun, "MIN_SAFE_INTEGER",
    1869         111 :                     factory->NewNumber(kMinSafeInteger));
    1870         222 :     InstallConstant(isolate_, number_fun, "EPSILON", factory->NewNumber(kEPS));
    1871             : 
    1872         111 :     InstallConstant(isolate_, global, "Infinity", factory->infinity_value());
    1873         111 :     InstallConstant(isolate_, global, "NaN", factory->nan_value());
    1874         111 :     InstallConstant(isolate_, global, "undefined", factory->undefined_value());
    1875             :   }
    1876             : 
    1877             :   {  // --- B o o l e a n ---
    1878             :     Handle<JSFunction> boolean_fun = InstallFunction(
    1879             :         isolate_, global, "Boolean", JS_VALUE_TYPE, JSValue::kSize, 0,
    1880         222 :         isolate_->initial_object_prototype(), Builtins::kBooleanConstructor);
    1881             :     boolean_fun->shared()->DontAdaptArguments();
    1882             :     boolean_fun->shared()->set_length(1);
    1883         111 :     InstallWithIntrinsicDefaultProto(isolate_, boolean_fun,
    1884         111 :                                      Context::BOOLEAN_FUNCTION_INDEX);
    1885             : 
    1886             :     // Create the %BooleanPrototype%
    1887             :     Handle<JSValue> prototype = Handle<JSValue>::cast(
    1888         111 :         factory->NewJSObject(boolean_fun, AllocationType::kOld));
    1889         333 :     prototype->set_value(ReadOnlyRoots(isolate_).false_value());
    1890         111 :     JSFunction::SetPrototype(boolean_fun, prototype);
    1891             : 
    1892             :     // Install the "constructor" property on the {prototype}.
    1893         222 :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1894         111 :                           boolean_fun, DONT_ENUM);
    1895             : 
    1896             :     // Install the Boolean.prototype methods.
    1897             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1898         111 :                           Builtins::kBooleanPrototypeToString, 0, true);
    1899             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    1900         111 :                           Builtins::kBooleanPrototypeValueOf, 0, true);
    1901             :   }
    1902             : 
    1903             :   {  // --- S t r i n g ---
    1904             :     Handle<JSFunction> string_fun = InstallFunction(
    1905             :         isolate_, global, "String", JS_VALUE_TYPE, JSValue::kSize, 0,
    1906         222 :         isolate_->initial_object_prototype(), Builtins::kStringConstructor);
    1907             :     string_fun->shared()->DontAdaptArguments();
    1908             :     string_fun->shared()->set_length(1);
    1909         111 :     InstallWithIntrinsicDefaultProto(isolate_, string_fun,
    1910         111 :                                      Context::STRING_FUNCTION_INDEX);
    1911             : 
    1912             :     Handle<Map> string_map = Handle<Map>(
    1913         222 :         native_context()->string_function()->initial_map(), isolate());
    1914         111 :     string_map->set_elements_kind(FAST_STRING_WRAPPER_ELEMENTS);
    1915         111 :     Map::EnsureDescriptorSlack(isolate_, string_map, 1);
    1916             : 
    1917             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1918             :         DONT_ENUM | DONT_DELETE | READ_ONLY);
    1919             : 
    1920             :     {  // Add length.
    1921             :       Descriptor d = Descriptor::AccessorConstant(
    1922         111 :           factory->length_string(), factory->string_length_accessor(), attribs);
    1923         111 :       string_map->AppendDescriptor(isolate(), &d);
    1924             :     }
    1925             : 
    1926             :     // Install the String.fromCharCode function.
    1927             :     SimpleInstallFunction(isolate_, string_fun, "fromCharCode",
    1928         111 :                           Builtins::kStringFromCharCode, 1, false);
    1929             : 
    1930             :     // Install the String.fromCodePoint function.
    1931             :     SimpleInstallFunction(isolate_, string_fun, "fromCodePoint",
    1932         111 :                           Builtins::kStringFromCodePoint, 1, false);
    1933             : 
    1934             :     // Install the String.raw function.
    1935             :     SimpleInstallFunction(isolate_, string_fun, "raw", Builtins::kStringRaw, 1,
    1936         111 :                           false);
    1937             : 
    1938             :     // Create the %StringPrototype%
    1939             :     Handle<JSValue> prototype = Handle<JSValue>::cast(
    1940         111 :         factory->NewJSObject(string_fun, AllocationType::kOld));
    1941         333 :     prototype->set_value(ReadOnlyRoots(isolate_).empty_string());
    1942         111 :     JSFunction::SetPrototype(string_fun, prototype);
    1943         222 :     native_context()->set_initial_string_prototype(*prototype);
    1944             : 
    1945             :     // Install the "constructor" property on the {prototype}.
    1946         222 :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1947         111 :                           string_fun, DONT_ENUM);
    1948             : 
    1949             :     // Install the String.prototype methods.
    1950             :     SimpleInstallFunction(isolate_, prototype, "anchor",
    1951         111 :                           Builtins::kStringPrototypeAnchor, 1, false);
    1952             :     SimpleInstallFunction(isolate_, prototype, "big",
    1953         111 :                           Builtins::kStringPrototypeBig, 0, false);
    1954             :     SimpleInstallFunction(isolate_, prototype, "blink",
    1955         111 :                           Builtins::kStringPrototypeBlink, 0, false);
    1956             :     SimpleInstallFunction(isolate_, prototype, "bold",
    1957         111 :                           Builtins::kStringPrototypeBold, 0, false);
    1958             :     SimpleInstallFunction(isolate_, prototype, "charAt",
    1959         111 :                           Builtins::kStringPrototypeCharAt, 1, true);
    1960             :     SimpleInstallFunction(isolate_, prototype, "charCodeAt",
    1961         111 :                           Builtins::kStringPrototypeCharCodeAt, 1, true);
    1962             :     SimpleInstallFunction(isolate_, prototype, "codePointAt",
    1963         111 :                           Builtins::kStringPrototypeCodePointAt, 1, true);
    1964             :     SimpleInstallFunction(isolate_, prototype, "concat",
    1965         111 :                           Builtins::kStringPrototypeConcat, 1, false);
    1966             :     SimpleInstallFunction(isolate_, prototype, "endsWith",
    1967         111 :                           Builtins::kStringPrototypeEndsWith, 1, false);
    1968             :     SimpleInstallFunction(isolate_, prototype, "fontcolor",
    1969         111 :                           Builtins::kStringPrototypeFontcolor, 1, false);
    1970             :     SimpleInstallFunction(isolate_, prototype, "fontsize",
    1971         111 :                           Builtins::kStringPrototypeFontsize, 1, false);
    1972             :     SimpleInstallFunction(isolate_, prototype, "fixed",
    1973         111 :                           Builtins::kStringPrototypeFixed, 0, false);
    1974             :     SimpleInstallFunction(isolate_, prototype, "includes",
    1975         111 :                           Builtins::kStringPrototypeIncludes, 1, false);
    1976             :     SimpleInstallFunction(isolate_, prototype, "indexOf",
    1977         111 :                           Builtins::kStringPrototypeIndexOf, 1, false);
    1978             :     SimpleInstallFunction(isolate_, prototype, "italics",
    1979         111 :                           Builtins::kStringPrototypeItalics, 0, false);
    1980             :     SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
    1981         111 :                           Builtins::kStringPrototypeLastIndexOf, 1, false);
    1982             :     SimpleInstallFunction(isolate_, prototype, "link",
    1983         111 :                           Builtins::kStringPrototypeLink, 1, false);
    1984             : #ifdef V8_INTL_SUPPORT
    1985             :     SimpleInstallFunction(isolate_, prototype, "localeCompare",
    1986         111 :                           Builtins::kStringPrototypeLocaleCompare, 1, false);
    1987             : #else
    1988             :     SimpleInstallFunction(isolate_, prototype, "localeCompare",
    1989             :                           Builtins::kStringPrototypeLocaleCompare, 1, true);
    1990             : #endif  // V8_INTL_SUPPORT
    1991             :     SimpleInstallFunction(isolate_, prototype, "match",
    1992         111 :                           Builtins::kStringPrototypeMatch, 1, true);
    1993             : #ifdef V8_INTL_SUPPORT
    1994             :     SimpleInstallFunction(isolate_, prototype, "normalize",
    1995         111 :                           Builtins::kStringPrototypeNormalizeIntl, 0, false);
    1996             : #else
    1997             :     SimpleInstallFunction(isolate_, prototype, "normalize",
    1998             :                           Builtins::kStringPrototypeNormalize, 0, false);
    1999             : #endif  // V8_INTL_SUPPORT
    2000             :     SimpleInstallFunction(isolate_, prototype, "padEnd",
    2001         111 :                           Builtins::kStringPrototypePadEnd, 1, false);
    2002             :     SimpleInstallFunction(isolate_, prototype, "padStart",
    2003         111 :                           Builtins::kStringPrototypePadStart, 1, false);
    2004             :     SimpleInstallFunction(isolate_, prototype, "repeat",
    2005         111 :                           Builtins::kStringPrototypeRepeat, 1, true);
    2006             :     SimpleInstallFunction(isolate_, prototype, "replace",
    2007         111 :                           Builtins::kStringPrototypeReplace, 2, true);
    2008             :     SimpleInstallFunction(isolate_, prototype, "search",
    2009         111 :                           Builtins::kStringPrototypeSearch, 1, true);
    2010             :     SimpleInstallFunction(isolate_, prototype, "slice",
    2011         111 :                           Builtins::kStringPrototypeSlice, 2, false);
    2012             :     SimpleInstallFunction(isolate_, prototype, "small",
    2013         111 :                           Builtins::kStringPrototypeSmall, 0, false);
    2014             :     SimpleInstallFunction(isolate_, prototype, "split",
    2015         111 :                           Builtins::kStringPrototypeSplit, 2, false);
    2016             :     SimpleInstallFunction(isolate_, prototype, "strike",
    2017         111 :                           Builtins::kStringPrototypeStrike, 0, false);
    2018             :     SimpleInstallFunction(isolate_, prototype, "sub",
    2019         111 :                           Builtins::kStringPrototypeSub, 0, false);
    2020             :     SimpleInstallFunction(isolate_, prototype, "substr",
    2021         111 :                           Builtins::kStringPrototypeSubstr, 2, false);
    2022             :     SimpleInstallFunction(isolate_, prototype, "substring",
    2023         111 :                           Builtins::kStringPrototypeSubstring, 2, false);
    2024             :     SimpleInstallFunction(isolate_, prototype, "sup",
    2025         111 :                           Builtins::kStringPrototypeSup, 0, false);
    2026             :     SimpleInstallFunction(isolate_, prototype, "startsWith",
    2027         111 :                           Builtins::kStringPrototypeStartsWith, 1, false);
    2028             :     SimpleInstallFunction(isolate_, prototype, "toString",
    2029         111 :                           Builtins::kStringPrototypeToString, 0, true);
    2030             :     SimpleInstallFunction(isolate_, prototype, "trim",
    2031         111 :                           Builtins::kStringPrototypeTrim, 0, false);
    2032             : 
    2033             :     // Install `String.prototype.trimStart` with `trimLeft` alias.
    2034             :     Handle<JSFunction> trim_start_fun =
    2035             :         SimpleInstallFunction(isolate_, prototype, "trimStart",
    2036         111 :                               Builtins::kStringPrototypeTrimStart, 0, false);
    2037         222 :     JSObject::AddProperty(isolate_, prototype, "trimLeft", trim_start_fun,
    2038         111 :                           DONT_ENUM);
    2039             : 
    2040             :     // Install `String.prototype.trimEnd` with `trimRight` alias.
    2041             :     Handle<JSFunction> trim_end_fun =
    2042             :         SimpleInstallFunction(isolate_, prototype, "trimEnd",
    2043         111 :                               Builtins::kStringPrototypeTrimEnd, 0, false);
    2044         222 :     JSObject::AddProperty(isolate_, prototype, "trimRight", trim_end_fun,
    2045         111 :                           DONT_ENUM);
    2046             : 
    2047             :     SimpleInstallFunction(isolate_, prototype, "toLocaleLowerCase",
    2048             :                           Builtins::kStringPrototypeToLocaleLowerCase, 0,
    2049         111 :                           false);
    2050             :     SimpleInstallFunction(isolate_, prototype, "toLocaleUpperCase",
    2051             :                           Builtins::kStringPrototypeToLocaleUpperCase, 0,
    2052         111 :                           false);
    2053             : #ifdef V8_INTL_SUPPORT
    2054             :     SimpleInstallFunction(isolate_, prototype, "toLowerCase",
    2055         111 :                           Builtins::kStringPrototypeToLowerCaseIntl, 0, true);
    2056             :     SimpleInstallFunction(isolate_, prototype, "toUpperCase",
    2057         111 :                           Builtins::kStringPrototypeToUpperCaseIntl, 0, false);
    2058             : #else
    2059             :     SimpleInstallFunction(isolate_, prototype, "toLowerCase",
    2060             :                           Builtins::kStringPrototypeToLowerCase, 0, false);
    2061             :     SimpleInstallFunction(isolate_, prototype, "toUpperCase",
    2062             :                           Builtins::kStringPrototypeToUpperCase, 0, false);
    2063             : #endif
    2064             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    2065         111 :                           Builtins::kStringPrototypeValueOf, 0, true);
    2066             : 
    2067             :     InstallFunctionAtSymbol(
    2068             :         isolate_, prototype, factory->iterator_symbol(), "[Symbol.iterator]",
    2069         111 :         Builtins::kStringPrototypeIterator, 0, true, DONT_ENUM);
    2070             :   }
    2071             : 
    2072             :   {  // --- S t r i n g I t e r a t o r ---
    2073             :     Handle<JSObject> iterator_prototype(
    2074         222 :         native_context()->initial_iterator_prototype(), isolate());
    2075             : 
    2076             :     Handle<JSObject> string_iterator_prototype =
    2077         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    2078         111 :     JSObject::ForceSetPrototype(string_iterator_prototype, iterator_prototype);
    2079             : 
    2080         111 :     InstallToStringTag(isolate_, string_iterator_prototype, "String Iterator");
    2081             : 
    2082             :     InstallFunctionWithBuiltinId(isolate_, string_iterator_prototype, "next",
    2083             :                                  Builtins::kStringIteratorPrototypeNext, 0,
    2084         111 :                                  true);
    2085             : 
    2086             :     Handle<JSFunction> string_iterator_function = CreateFunction(
    2087             :         isolate_, factory->InternalizeUtf8String("StringIterator"),
    2088             :         JS_STRING_ITERATOR_TYPE, JSStringIterator::kSize, 0,
    2089         111 :         string_iterator_prototype, Builtins::kIllegal);
    2090         111 :     string_iterator_function->shared()->set_native(false);
    2091         222 :     native_context()->set_initial_string_iterator_map(
    2092         111 :         string_iterator_function->initial_map());
    2093         222 :     native_context()->set_initial_string_iterator_prototype(
    2094         111 :         *string_iterator_prototype);
    2095             :   }
    2096             : 
    2097             :   {  // --- S y m b o l ---
    2098             :     Handle<JSFunction> symbol_fun = InstallFunction(
    2099             :         isolate_, global, "Symbol", JS_VALUE_TYPE, JSValue::kSize, 0,
    2100         111 :         factory->the_hole_value(), Builtins::kSymbolConstructor);
    2101             :     symbol_fun->shared()->set_length(0);
    2102             :     symbol_fun->shared()->DontAdaptArguments();
    2103         111 :     native_context()->set_symbol_function(*symbol_fun);
    2104             : 
    2105             :     // Install the Symbol.for and Symbol.keyFor functions.
    2106             :     SimpleInstallFunction(isolate_, symbol_fun, "for", Builtins::kSymbolFor, 1,
    2107         111 :                           false);
    2108             :     SimpleInstallFunction(isolate_, symbol_fun, "keyFor",
    2109         111 :                           Builtins::kSymbolKeyFor, 1, false);
    2110             : 
    2111             :     // Install well-known symbols.
    2112         222 :     InstallConstant(isolate_, symbol_fun, "asyncIterator",
    2113         111 :                     factory->async_iterator_symbol());
    2114         222 :     InstallConstant(isolate_, symbol_fun, "hasInstance",
    2115         111 :                     factory->has_instance_symbol());
    2116         222 :     InstallConstant(isolate_, symbol_fun, "isConcatSpreadable",
    2117         111 :                     factory->is_concat_spreadable_symbol());
    2118         222 :     InstallConstant(isolate_, symbol_fun, "iterator",
    2119         111 :                     factory->iterator_symbol());
    2120         111 :     InstallConstant(isolate_, symbol_fun, "match", factory->match_symbol());
    2121         111 :     InstallConstant(isolate_, symbol_fun, "replace", factory->replace_symbol());
    2122         111 :     InstallConstant(isolate_, symbol_fun, "search", factory->search_symbol());
    2123         111 :     InstallConstant(isolate_, symbol_fun, "species", factory->species_symbol());
    2124         111 :     InstallConstant(isolate_, symbol_fun, "split", factory->split_symbol());
    2125         222 :     InstallConstant(isolate_, symbol_fun, "toPrimitive",
    2126         111 :                     factory->to_primitive_symbol());
    2127         222 :     InstallConstant(isolate_, symbol_fun, "toStringTag",
    2128         111 :                     factory->to_string_tag_symbol());
    2129         222 :     InstallConstant(isolate_, symbol_fun, "unscopables",
    2130         111 :                     factory->unscopables_symbol());
    2131             : 
    2132             :     // Setup %SymbolPrototype%.
    2133         222 :     Handle<JSObject> prototype(JSObject::cast(symbol_fun->instance_prototype()),
    2134             :                                isolate());
    2135             : 
    2136         111 :     InstallToStringTag(isolate_, prototype, "Symbol");
    2137             : 
    2138             :     // Install the Symbol.prototype methods.
    2139             :     InstallFunctionWithBuiltinId(isolate_, prototype, "toString",
    2140         111 :                                  Builtins::kSymbolPrototypeToString, 0, true);
    2141             :     InstallFunctionWithBuiltinId(isolate_, prototype, "valueOf",
    2142         111 :                                  Builtins::kSymbolPrototypeValueOf, 0, true);
    2143             : 
    2144             :     // Install the Symbol.prototype.description getter.
    2145             :     SimpleInstallGetter(isolate_, prototype,
    2146             :                         factory->InternalizeUtf8String("description"),
    2147         222 :                         Builtins::kSymbolPrototypeDescriptionGetter, true);
    2148             : 
    2149             :     // Install the @@toPrimitive function.
    2150             :     InstallFunctionAtSymbol(
    2151             :         isolate_, prototype, factory->to_primitive_symbol(),
    2152             :         "[Symbol.toPrimitive]", Builtins::kSymbolPrototypeToPrimitive, 1, true,
    2153         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2154             :   }
    2155             : 
    2156             :   {  // --- D a t e ---
    2157             :     Handle<JSFunction> date_fun = InstallFunction(
    2158             :         isolate_, global, "Date", JS_DATE_TYPE, JSDate::kSize, 0,
    2159         111 :         factory->the_hole_value(), Builtins::kDateConstructor);
    2160         111 :     InstallWithIntrinsicDefaultProto(isolate_, date_fun,
    2161         111 :                                      Context::DATE_FUNCTION_INDEX);
    2162             :     date_fun->shared()->set_length(7);
    2163             :     date_fun->shared()->DontAdaptArguments();
    2164             : 
    2165             :     // Install the Date.now, Date.parse and Date.UTC functions.
    2166             :     SimpleInstallFunction(isolate_, date_fun, "now", Builtins::kDateNow, 0,
    2167         111 :                           false);
    2168             :     SimpleInstallFunction(isolate_, date_fun, "parse", Builtins::kDateParse, 1,
    2169         111 :                           false);
    2170             :     SimpleInstallFunction(isolate_, date_fun, "UTC", Builtins::kDateUTC, 7,
    2171         111 :                           false);
    2172             : 
    2173             :     // Setup %DatePrototype%.
    2174         222 :     Handle<JSObject> prototype(JSObject::cast(date_fun->instance_prototype()),
    2175             :                                isolate());
    2176             : 
    2177             :     // Install the Date.prototype methods.
    2178             :     SimpleInstallFunction(isolate_, prototype, "toString",
    2179         111 :                           Builtins::kDatePrototypeToString, 0, false);
    2180             :     SimpleInstallFunction(isolate_, prototype, "toDateString",
    2181         111 :                           Builtins::kDatePrototypeToDateString, 0, false);
    2182             :     SimpleInstallFunction(isolate_, prototype, "toTimeString",
    2183         111 :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2184             :     SimpleInstallFunction(isolate_, prototype, "toISOString",
    2185         111 :                           Builtins::kDatePrototypeToISOString, 0, false);
    2186             :     Handle<JSFunction> to_utc_string =
    2187             :         SimpleInstallFunction(isolate_, prototype, "toUTCString",
    2188         111 :                               Builtins::kDatePrototypeToUTCString, 0, false);
    2189         222 :     JSObject::AddProperty(isolate_, prototype, "toGMTString", to_utc_string,
    2190         111 :                           DONT_ENUM);
    2191             :     SimpleInstallFunction(isolate_, prototype, "getDate",
    2192         111 :                           Builtins::kDatePrototypeGetDate, 0, true);
    2193             :     SimpleInstallFunction(isolate_, prototype, "setDate",
    2194         111 :                           Builtins::kDatePrototypeSetDate, 1, false);
    2195             :     SimpleInstallFunction(isolate_, prototype, "getDay",
    2196         111 :                           Builtins::kDatePrototypeGetDay, 0, true);
    2197             :     SimpleInstallFunction(isolate_, prototype, "getFullYear",
    2198         111 :                           Builtins::kDatePrototypeGetFullYear, 0, true);
    2199             :     SimpleInstallFunction(isolate_, prototype, "setFullYear",
    2200         111 :                           Builtins::kDatePrototypeSetFullYear, 3, false);
    2201             :     SimpleInstallFunction(isolate_, prototype, "getHours",
    2202         111 :                           Builtins::kDatePrototypeGetHours, 0, true);
    2203             :     SimpleInstallFunction(isolate_, prototype, "setHours",
    2204         111 :                           Builtins::kDatePrototypeSetHours, 4, false);
    2205             :     SimpleInstallFunction(isolate_, prototype, "getMilliseconds",
    2206         111 :                           Builtins::kDatePrototypeGetMilliseconds, 0, true);
    2207             :     SimpleInstallFunction(isolate_, prototype, "setMilliseconds",
    2208         111 :                           Builtins::kDatePrototypeSetMilliseconds, 1, false);
    2209             :     SimpleInstallFunction(isolate_, prototype, "getMinutes",
    2210         111 :                           Builtins::kDatePrototypeGetMinutes, 0, true);
    2211             :     SimpleInstallFunction(isolate_, prototype, "setMinutes",
    2212         111 :                           Builtins::kDatePrototypeSetMinutes, 3, false);
    2213             :     SimpleInstallFunction(isolate_, prototype, "getMonth",
    2214         111 :                           Builtins::kDatePrototypeGetMonth, 0, true);
    2215             :     SimpleInstallFunction(isolate_, prototype, "setMonth",
    2216         111 :                           Builtins::kDatePrototypeSetMonth, 2, false);
    2217             :     SimpleInstallFunction(isolate_, prototype, "getSeconds",
    2218         111 :                           Builtins::kDatePrototypeGetSeconds, 0, true);
    2219             :     SimpleInstallFunction(isolate_, prototype, "setSeconds",
    2220         111 :                           Builtins::kDatePrototypeSetSeconds, 2, false);
    2221             :     SimpleInstallFunction(isolate_, prototype, "getTime",
    2222         111 :                           Builtins::kDatePrototypeGetTime, 0, true);
    2223             :     SimpleInstallFunction(isolate_, prototype, "setTime",
    2224         111 :                           Builtins::kDatePrototypeSetTime, 1, false);
    2225             :     SimpleInstallFunction(isolate_, prototype, "getTimezoneOffset",
    2226         111 :                           Builtins::kDatePrototypeGetTimezoneOffset, 0, true);
    2227             :     SimpleInstallFunction(isolate_, prototype, "getUTCDate",
    2228         111 :                           Builtins::kDatePrototypeGetUTCDate, 0, true);
    2229             :     SimpleInstallFunction(isolate_, prototype, "setUTCDate",
    2230         111 :                           Builtins::kDatePrototypeSetUTCDate, 1, false);
    2231             :     SimpleInstallFunction(isolate_, prototype, "getUTCDay",
    2232         111 :                           Builtins::kDatePrototypeGetUTCDay, 0, true);
    2233             :     SimpleInstallFunction(isolate_, prototype, "getUTCFullYear",
    2234         111 :                           Builtins::kDatePrototypeGetUTCFullYear, 0, true);
    2235             :     SimpleInstallFunction(isolate_, prototype, "setUTCFullYear",
    2236         111 :                           Builtins::kDatePrototypeSetUTCFullYear, 3, false);
    2237             :     SimpleInstallFunction(isolate_, prototype, "getUTCHours",
    2238         111 :                           Builtins::kDatePrototypeGetUTCHours, 0, true);
    2239             :     SimpleInstallFunction(isolate_, prototype, "setUTCHours",
    2240         111 :                           Builtins::kDatePrototypeSetUTCHours, 4, false);
    2241             :     SimpleInstallFunction(isolate_, prototype, "getUTCMilliseconds",
    2242         111 :                           Builtins::kDatePrototypeGetUTCMilliseconds, 0, true);
    2243             :     SimpleInstallFunction(isolate_, prototype, "setUTCMilliseconds",
    2244         111 :                           Builtins::kDatePrototypeSetUTCMilliseconds, 1, false);
    2245             :     SimpleInstallFunction(isolate_, prototype, "getUTCMinutes",
    2246         111 :                           Builtins::kDatePrototypeGetUTCMinutes, 0, true);
    2247             :     SimpleInstallFunction(isolate_, prototype, "setUTCMinutes",
    2248         111 :                           Builtins::kDatePrototypeSetUTCMinutes, 3, false);
    2249             :     SimpleInstallFunction(isolate_, prototype, "getUTCMonth",
    2250         111 :                           Builtins::kDatePrototypeGetUTCMonth, 0, true);
    2251             :     SimpleInstallFunction(isolate_, prototype, "setUTCMonth",
    2252         111 :                           Builtins::kDatePrototypeSetUTCMonth, 2, false);
    2253             :     SimpleInstallFunction(isolate_, prototype, "getUTCSeconds",
    2254         111 :                           Builtins::kDatePrototypeGetUTCSeconds, 0, true);
    2255             :     SimpleInstallFunction(isolate_, prototype, "setUTCSeconds",
    2256         111 :                           Builtins::kDatePrototypeSetUTCSeconds, 2, false);
    2257             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    2258         111 :                           Builtins::kDatePrototypeValueOf, 0, true);
    2259             :     SimpleInstallFunction(isolate_, prototype, "getYear",
    2260         111 :                           Builtins::kDatePrototypeGetYear, 0, true);
    2261             :     SimpleInstallFunction(isolate_, prototype, "setYear",
    2262         111 :                           Builtins::kDatePrototypeSetYear, 1, false);
    2263             :     SimpleInstallFunction(isolate_, prototype, "toJSON",
    2264         111 :                           Builtins::kDatePrototypeToJson, 1, false);
    2265             : 
    2266             : #ifdef V8_INTL_SUPPORT
    2267             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    2268         111 :                           Builtins::kDatePrototypeToLocaleString, 0, false);
    2269             :     SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
    2270         111 :                           Builtins::kDatePrototypeToLocaleDateString, 0, false);
    2271             :     SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
    2272         111 :                           Builtins::kDatePrototypeToLocaleTimeString, 0, false);
    2273             : #else
    2274             :     // Install Intl fallback functions.
    2275             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    2276             :                           Builtins::kDatePrototypeToString, 0, false);
    2277             :     SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
    2278             :                           Builtins::kDatePrototypeToDateString, 0, false);
    2279             :     SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
    2280             :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2281             : #endif  // V8_INTL_SUPPORT
    2282             : 
    2283             :     // Install the @@toPrimitive function.
    2284             :     InstallFunctionAtSymbol(
    2285             :         isolate_, prototype, factory->to_primitive_symbol(),
    2286             :         "[Symbol.toPrimitive]", Builtins::kDatePrototypeToPrimitive, 1, true,
    2287         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2288             :   }
    2289             : 
    2290             :   {
    2291             :     Handle<SharedFunctionInfo> info = SimpleCreateBuiltinSharedFunctionInfo(
    2292             :         isolate_, Builtins::kPromiseGetCapabilitiesExecutor,
    2293         111 :         factory->empty_string(), 2);
    2294         111 :     native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
    2295             :   }
    2296             : 
    2297             :   {  // -- P r o m i s e
    2298             :     Handle<JSFunction> promise_fun = InstallFunction(
    2299             :         isolate_, global, "Promise", JS_PROMISE_TYPE,
    2300             :         JSPromise::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    2301         111 :         Builtins::kPromiseConstructor);
    2302         111 :     InstallWithIntrinsicDefaultProto(isolate_, promise_fun,
    2303         111 :                                      Context::PROMISE_FUNCTION_INDEX);
    2304             : 
    2305         111 :     Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate_);
    2306             :     shared->set_internal_formal_parameter_count(1);
    2307             :     shared->set_length(1);
    2308             : 
    2309         111 :     InstallSpeciesGetter(isolate_, promise_fun);
    2310             : 
    2311             :     Handle<JSFunction> promise_all = InstallFunctionWithBuiltinId(
    2312         111 :         isolate_, promise_fun, "all", Builtins::kPromiseAll, 1, true);
    2313         111 :     native_context()->set_promise_all(*promise_all);
    2314             : 
    2315             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "race",
    2316         111 :                                  Builtins::kPromiseRace, 1, true);
    2317             : 
    2318             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "resolve",
    2319         111 :                                  Builtins::kPromiseResolveTrampoline, 1, true);
    2320             : 
    2321             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "reject",
    2322         111 :                                  Builtins::kPromiseReject, 1, true);
    2323             : 
    2324             :     // Setup %PromisePrototype%.
    2325             :     Handle<JSObject> prototype(
    2326         222 :         JSObject::cast(promise_fun->instance_prototype()), isolate());
    2327         111 :     native_context()->set_promise_prototype(*prototype);
    2328             : 
    2329         111 :     InstallToStringTag(isolate_, prototype, factory->Promise_string());
    2330             : 
    2331             :     Handle<JSFunction> promise_then = InstallFunctionWithBuiltinId(
    2332         111 :         isolate_, prototype, "then", Builtins::kPromisePrototypeThen, 2, true);
    2333         111 :     native_context()->set_promise_then(*promise_then);
    2334             : 
    2335             :     Handle<JSFunction> promise_catch =
    2336             :         InstallFunctionWithBuiltinId(isolate_, prototype, "catch",
    2337         111 :                                      Builtins::kPromisePrototypeCatch, 1, true);
    2338         111 :     native_context()->set_promise_catch(*promise_catch);
    2339             : 
    2340             :     InstallFunctionWithBuiltinId(isolate_, prototype, "finally",
    2341         111 :                                  Builtins::kPromisePrototypeFinally, 1, true);
    2342             : 
    2343             :     {
    2344             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2345             :           isolate(), Builtins::kPromiseThenFinally,
    2346         222 :           isolate_->factory()->empty_string(), 1);
    2347         111 :       info->set_native(true);
    2348         111 :       native_context()->set_promise_then_finally_shared_fun(*info);
    2349             :     }
    2350             : 
    2351             :     {
    2352             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2353             :           isolate(), Builtins::kPromiseCatchFinally,
    2354         222 :           isolate_->factory()->empty_string(), 1);
    2355         111 :       info->set_native(true);
    2356         111 :       native_context()->set_promise_catch_finally_shared_fun(*info);
    2357             :     }
    2358             : 
    2359             :     {
    2360             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2361             :           isolate(), Builtins::kPromiseValueThunkFinally,
    2362         222 :           isolate_->factory()->empty_string(), 0);
    2363         111 :       native_context()->set_promise_value_thunk_finally_shared_fun(*info);
    2364             :     }
    2365             : 
    2366             :     {
    2367             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2368             :           isolate(), Builtins::kPromiseThrowerFinally,
    2369         222 :           isolate_->factory()->empty_string(), 0);
    2370         111 :       native_context()->set_promise_thrower_finally_shared_fun(*info);
    2371             :     }
    2372             : 
    2373             :     // Force the Promise constructor to fast properties, so that we can use the
    2374             :     // fast paths for various things like
    2375             :     //
    2376             :     //   x instanceof Promise
    2377             :     //
    2378             :     // etc. We should probably come up with a more principled approach once
    2379             :     // the JavaScript builtins are gone.
    2380             :     JSObject::MigrateSlowToFast(Handle<JSObject>::cast(promise_fun), 0,
    2381         111 :                                 "Bootstrapping");
    2382             : 
    2383             :     Handle<Map> prototype_map(prototype->map(), isolate());
    2384         111 :     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
    2385             : 
    2386             :     {  // Internal: IsPromise
    2387             :       Handle<JSFunction> function = SimpleCreateFunction(
    2388         111 :           isolate_, factory->empty_string(), Builtins::kIsPromise, 1, false);
    2389         111 :       native_context()->set_is_promise(*function);
    2390             :     }
    2391             : 
    2392             :     {
    2393             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2394             :           isolate_, Builtins::kPromiseCapabilityDefaultResolve,
    2395         111 :           factory->empty_string(), 1, FunctionKind::kConciseMethod);
    2396         111 :       info->set_native(true);
    2397         222 :       info->set_function_map_index(
    2398         111 :           Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
    2399         222 :       native_context()->set_promise_capability_default_resolve_shared_fun(
    2400         111 :           *info);
    2401             : 
    2402             :       info = SimpleCreateSharedFunctionInfo(
    2403             :           isolate_, Builtins::kPromiseCapabilityDefaultReject,
    2404         111 :           factory->empty_string(), 1, FunctionKind::kConciseMethod);
    2405         111 :       info->set_native(true);
    2406         222 :       info->set_function_map_index(
    2407         111 :           Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
    2408         111 :       native_context()->set_promise_capability_default_reject_shared_fun(*info);
    2409             :     }
    2410             : 
    2411             :     {
    2412             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2413             :           isolate_, Builtins::kPromiseAllResolveElementClosure,
    2414         111 :           factory->empty_string(), 1);
    2415         111 :       native_context()->set_promise_all_resolve_element_shared_fun(*info);
    2416             :     }
    2417             : 
    2418             :     // Force the Promise constructor to fast properties, so that we can use the
    2419             :     // fast paths for various things like
    2420             :     //
    2421             :     //   x instanceof Promise
    2422             :     //
    2423             :     // etc. We should probably come up with a more principled approach once
    2424             :     // the JavaScript builtins are gone.
    2425         111 :     JSObject::MigrateSlowToFast(promise_fun, 0, "Bootstrapping");
    2426             :   }
    2427             : 
    2428             :   {  // -- R e g E x p
    2429             :     // Builtin functions for RegExp.prototype.
    2430             :     Handle<JSFunction> regexp_fun = InstallFunction(
    2431             :         isolate_, global, "RegExp", JS_REGEXP_TYPE,
    2432             :         JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kTaggedSize,
    2433             :         JSRegExp::kInObjectFieldCount, factory->the_hole_value(),
    2434         111 :         Builtins::kRegExpConstructor);
    2435         111 :     InstallWithIntrinsicDefaultProto(isolate_, regexp_fun,
    2436         111 :                                      Context::REGEXP_FUNCTION_INDEX);
    2437             : 
    2438         111 :     Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate_);
    2439             :     shared->set_internal_formal_parameter_count(2);
    2440             :     shared->set_length(2);
    2441             : 
    2442             :     {
    2443             :       // Setup %RegExpPrototype%.
    2444             :       Handle<JSObject> prototype(
    2445         222 :           JSObject::cast(regexp_fun->instance_prototype()), isolate());
    2446         111 :       native_context()->set_regexp_prototype(*prototype);
    2447             : 
    2448             :       {
    2449             :         Handle<JSFunction> fun =
    2450             :             SimpleInstallFunction(isolate_, prototype, "exec",
    2451         111 :                                   Builtins::kRegExpPrototypeExec, 1, true);
    2452             :         // Check that index of "exec" function in JSRegExp is correct.
    2453             :         DCHECK_EQ(JSRegExp::kExecFunctionDescriptorIndex,
    2454             :                   prototype->map()->LastAdded());
    2455             : 
    2456         111 :         native_context()->set_regexp_exec_function(*fun);
    2457             :       }
    2458             : 
    2459             :       SimpleInstallGetter(isolate_, prototype, factory->dotAll_string(),
    2460         111 :                           Builtins::kRegExpPrototypeDotAllGetter, true);
    2461             :       SimpleInstallGetter(isolate_, prototype, factory->flags_string(),
    2462         111 :                           Builtins::kRegExpPrototypeFlagsGetter, true);
    2463             :       SimpleInstallGetter(isolate_, prototype, factory->global_string(),
    2464         111 :                           Builtins::kRegExpPrototypeGlobalGetter, true);
    2465             :       SimpleInstallGetter(isolate_, prototype, factory->ignoreCase_string(),
    2466         111 :                           Builtins::kRegExpPrototypeIgnoreCaseGetter, true);
    2467             :       SimpleInstallGetter(isolate_, prototype, factory->multiline_string(),
    2468         111 :                           Builtins::kRegExpPrototypeMultilineGetter, true);
    2469             :       SimpleInstallGetter(isolate_, prototype, factory->source_string(),
    2470         111 :                           Builtins::kRegExpPrototypeSourceGetter, true);
    2471             :       SimpleInstallGetter(isolate_, prototype, factory->sticky_string(),
    2472         111 :                           Builtins::kRegExpPrototypeStickyGetter, true);
    2473             :       SimpleInstallGetter(isolate_, prototype, factory->unicode_string(),
    2474         111 :                           Builtins::kRegExpPrototypeUnicodeGetter, true);
    2475             : 
    2476             :       SimpleInstallFunction(isolate_, prototype, "compile",
    2477         111 :                             Builtins::kRegExpPrototypeCompile, 2, true);
    2478             :       SimpleInstallFunction(isolate_, prototype, "toString",
    2479         111 :                             Builtins::kRegExpPrototypeToString, 0, false);
    2480             :       SimpleInstallFunction(isolate_, prototype, "test",
    2481         111 :                             Builtins::kRegExpPrototypeTest, 1, true);
    2482             : 
    2483             :       InstallFunctionAtSymbol(isolate_, prototype, factory->match_symbol(),
    2484             :                               "[Symbol.match]", Builtins::kRegExpPrototypeMatch,
    2485         111 :                               1, true);
    2486             :       DCHECK_EQ(JSRegExp::kSymbolMatchFunctionDescriptorIndex,
    2487             :                 prototype->map()->LastAdded());
    2488             : 
    2489             :       InstallFunctionAtSymbol(isolate_, prototype, factory->replace_symbol(),
    2490             :                               "[Symbol.replace]",
    2491         111 :                               Builtins::kRegExpPrototypeReplace, 2, false);
    2492             :       DCHECK_EQ(JSRegExp::kSymbolReplaceFunctionDescriptorIndex,
    2493             :                 prototype->map()->LastAdded());
    2494             : 
    2495             :       InstallFunctionAtSymbol(isolate_, prototype, factory->search_symbol(),
    2496             :                               "[Symbol.search]",
    2497         111 :                               Builtins::kRegExpPrototypeSearch, 1, true);
    2498             :       DCHECK_EQ(JSRegExp::kSymbolSearchFunctionDescriptorIndex,
    2499             :                 prototype->map()->LastAdded());
    2500             : 
    2501             :       InstallFunctionAtSymbol(isolate_, prototype, factory->split_symbol(),
    2502             :                               "[Symbol.split]", Builtins::kRegExpPrototypeSplit,
    2503         111 :                               2, false);
    2504             :       DCHECK_EQ(JSRegExp::kSymbolSplitFunctionDescriptorIndex,
    2505             :                 prototype->map()->LastAdded());
    2506             : 
    2507             :       Handle<Map> prototype_map(prototype->map(), isolate());
    2508         111 :       Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
    2509             : 
    2510             :       // Store the initial RegExp.prototype map. This is used in fast-path
    2511             :       // checks. Do not alter the prototype after this point.
    2512         111 :       native_context()->set_regexp_prototype_map(*prototype_map);
    2513             :     }
    2514             : 
    2515             :     {
    2516             :       // RegExp getters and setters.
    2517             : 
    2518         111 :       InstallSpeciesGetter(isolate_, regexp_fun);
    2519             : 
    2520             :       // Static properties set by a successful match.
    2521             : 
    2522         222 :       SimpleInstallGetterSetter(isolate_, regexp_fun, factory->input_string(),
    2523             :                                 Builtins::kRegExpInputGetter,
    2524         111 :                                 Builtins::kRegExpInputSetter);
    2525         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$_",
    2526             :                                 Builtins::kRegExpInputGetter,
    2527             :                                 Builtins::kRegExpInputSetter);
    2528             : 
    2529         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "lastMatch",
    2530             :                                 Builtins::kRegExpLastMatchGetter,
    2531             :                                 Builtins::kEmptyFunction);
    2532         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$&",
    2533             :                                 Builtins::kRegExpLastMatchGetter,
    2534             :                                 Builtins::kEmptyFunction);
    2535             : 
    2536         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "lastParen",
    2537             :                                 Builtins::kRegExpLastParenGetter,
    2538             :                                 Builtins::kEmptyFunction);
    2539         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$+",
    2540             :                                 Builtins::kRegExpLastParenGetter,
    2541             :                                 Builtins::kEmptyFunction);
    2542             : 
    2543         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "leftContext",
    2544             :                                 Builtins::kRegExpLeftContextGetter,
    2545             :                                 Builtins::kEmptyFunction);
    2546         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$`",
    2547             :                                 Builtins::kRegExpLeftContextGetter,
    2548             :                                 Builtins::kEmptyFunction);
    2549             : 
    2550         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "rightContext",
    2551             :                                 Builtins::kRegExpRightContextGetter,
    2552             :                                 Builtins::kEmptyFunction);
    2553         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$'",
    2554             :                                 Builtins::kRegExpRightContextGetter,
    2555             :                                 Builtins::kEmptyFunction);
    2556             : 
    2557             : #define INSTALL_CAPTURE_GETTER(i)                                \
    2558             :   SimpleInstallGetterSetter(isolate_, regexp_fun, "$" #i,        \
    2559             :                             Builtins::kRegExpCapture##i##Getter, \
    2560             :                             Builtins::kEmptyFunction)
    2561         111 :       INSTALL_CAPTURE_GETTER(1);
    2562         111 :       INSTALL_CAPTURE_GETTER(2);
    2563         111 :       INSTALL_CAPTURE_GETTER(3);
    2564         111 :       INSTALL_CAPTURE_GETTER(4);
    2565         111 :       INSTALL_CAPTURE_GETTER(5);
    2566         111 :       INSTALL_CAPTURE_GETTER(6);
    2567         111 :       INSTALL_CAPTURE_GETTER(7);
    2568         111 :       INSTALL_CAPTURE_GETTER(8);
    2569         111 :       INSTALL_CAPTURE_GETTER(9);
    2570             : #undef INSTALL_CAPTURE_GETTER
    2571             :     }
    2572             : 
    2573             :     DCHECK(regexp_fun->has_initial_map());
    2574             :     Handle<Map> initial_map(regexp_fun->initial_map(), isolate());
    2575             : 
    2576             :     DCHECK_EQ(1, initial_map->GetInObjectProperties());
    2577             : 
    2578         111 :     Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
    2579             : 
    2580             :     // ECMA-262, section 15.10.7.5.
    2581             :     PropertyAttributes writable =
    2582             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
    2583             :     Descriptor d = Descriptor::DataField(isolate(), factory->lastIndex_string(),
    2584             :                                          JSRegExp::kLastIndexFieldIndex,
    2585         111 :                                          writable, Representation::Tagged());
    2586         111 :     initial_map->AppendDescriptor(isolate(), &d);
    2587             : 
    2588             :     // Create the last match info.
    2589         111 :     Handle<RegExpMatchInfo> last_match_info = factory->NewRegExpMatchInfo();
    2590         111 :     native_context()->set_regexp_last_match_info(*last_match_info);
    2591             : 
    2592             :     // Force the RegExp constructor to fast properties, so that we can use the
    2593             :     // fast paths for various things like
    2594             :     //
    2595             :     //   x instanceof RegExp
    2596             :     //
    2597             :     // etc. We should probably come up with a more principled approach once
    2598             :     // the JavaScript builtins are gone.
    2599         111 :     JSObject::MigrateSlowToFast(regexp_fun, 0, "Bootstrapping");
    2600             :   }
    2601             : 
    2602             :   {  // -- E r r o r
    2603         111 :     InstallError(isolate_, global, factory->Error_string(),
    2604         111 :                  Context::ERROR_FUNCTION_INDEX);
    2605         111 :     InstallMakeError(isolate_, Builtins::kMakeError, Context::MAKE_ERROR_INDEX);
    2606             :   }
    2607             : 
    2608             :   {  // -- E v a l E r r o r
    2609         111 :     InstallError(isolate_, global, factory->EvalError_string(),
    2610         111 :                  Context::EVAL_ERROR_FUNCTION_INDEX);
    2611             :   }
    2612             : 
    2613             :   {  // -- R a n g e E r r o r
    2614         111 :     InstallError(isolate_, global, factory->RangeError_string(),
    2615         111 :                  Context::RANGE_ERROR_FUNCTION_INDEX);
    2616         111 :     InstallMakeError(isolate_, Builtins::kMakeRangeError,
    2617         111 :                      Context::MAKE_RANGE_ERROR_INDEX);
    2618             :   }
    2619             : 
    2620             :   {  // -- R e f e r e n c e E r r o r
    2621         111 :     InstallError(isolate_, global, factory->ReferenceError_string(),
    2622         111 :                  Context::REFERENCE_ERROR_FUNCTION_INDEX);
    2623             :   }
    2624             : 
    2625             :   {  // -- S y n t a x E r r o r
    2626         111 :     InstallError(isolate_, global, factory->SyntaxError_string(),
    2627         111 :                  Context::SYNTAX_ERROR_FUNCTION_INDEX);
    2628         111 :     InstallMakeError(isolate_, Builtins::kMakeSyntaxError,
    2629         111 :                      Context::MAKE_SYNTAX_ERROR_INDEX);
    2630             :   }
    2631             : 
    2632             :   {  // -- T y p e E r r o r
    2633         111 :     InstallError(isolate_, global, factory->TypeError_string(),
    2634         111 :                  Context::TYPE_ERROR_FUNCTION_INDEX);
    2635         111 :     InstallMakeError(isolate_, Builtins::kMakeTypeError,
    2636         111 :                      Context::MAKE_TYPE_ERROR_INDEX);
    2637             :   }
    2638             : 
    2639             :   {  // -- U R I E r r o r
    2640         111 :     InstallError(isolate_, global, factory->URIError_string(),
    2641         111 :                  Context::URI_ERROR_FUNCTION_INDEX);
    2642         111 :     InstallMakeError(isolate_, Builtins::kMakeURIError,
    2643         111 :                      Context::MAKE_URI_ERROR_INDEX);
    2644             :   }
    2645             : 
    2646             :   {  // -- C o m p i l e E r r o r
    2647         111 :     Handle<JSObject> dummy = factory->NewJSObject(isolate_->object_function());
    2648         111 :     InstallError(isolate_, dummy, factory->CompileError_string(),
    2649         111 :                  Context::WASM_COMPILE_ERROR_FUNCTION_INDEX);
    2650             : 
    2651             :     // -- L i n k E r r o r
    2652         111 :     InstallError(isolate_, dummy, factory->LinkError_string(),
    2653         111 :                  Context::WASM_LINK_ERROR_FUNCTION_INDEX);
    2654             : 
    2655             :     // -- R u n t i m e E r r o r
    2656         111 :     InstallError(isolate_, dummy, factory->RuntimeError_string(),
    2657         111 :                  Context::WASM_RUNTIME_ERROR_FUNCTION_INDEX);
    2658             :   }
    2659             : 
    2660             :   // Initialize the embedder data slot.
    2661             :   // TODO(ishell): microtask queue pointer will be moved from native context
    2662             :   // to the embedder data array so we don't need an empty embedder data array.
    2663         111 :   Handle<EmbedderDataArray> embedder_data = factory->NewEmbedderDataArray(0);
    2664         222 :   native_context()->set_embedder_data(*embedder_data);
    2665             : 
    2666             :   {  // -- J S O N
    2667             :     Handle<JSObject> json_object =
    2668         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    2669         111 :     JSObject::AddProperty(isolate_, global, "JSON", json_object, DONT_ENUM);
    2670             :     SimpleInstallFunction(isolate_, json_object, "parse", Builtins::kJsonParse,
    2671         111 :                           2, false);
    2672             :     SimpleInstallFunction(isolate_, json_object, "stringify",
    2673         111 :                           Builtins::kJsonStringify, 3, true);
    2674         111 :     InstallToStringTag(isolate_, json_object, "JSON");
    2675             :   }
    2676             : 
    2677             :   {  // -- M a t h
    2678             :     Handle<JSObject> math =
    2679         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    2680         111 :     JSObject::AddProperty(isolate_, global, "Math", math, DONT_ENUM);
    2681         111 :     SimpleInstallFunction(isolate_, math, "abs", Builtins::kMathAbs, 1, true);
    2682         111 :     SimpleInstallFunction(isolate_, math, "acos", Builtins::kMathAcos, 1, true);
    2683             :     SimpleInstallFunction(isolate_, math, "acosh", Builtins::kMathAcosh, 1,
    2684         111 :                           true);
    2685         111 :     SimpleInstallFunction(isolate_, math, "asin", Builtins::kMathAsin, 1, true);
    2686             :     SimpleInstallFunction(isolate_, math, "asinh", Builtins::kMathAsinh, 1,
    2687         111 :                           true);
    2688         111 :     SimpleInstallFunction(isolate_, math, "atan", Builtins::kMathAtan, 1, true);
    2689             :     SimpleInstallFunction(isolate_, math, "atanh", Builtins::kMathAtanh, 1,
    2690         111 :                           true);
    2691             :     SimpleInstallFunction(isolate_, math, "atan2", Builtins::kMathAtan2, 2,
    2692         111 :                           true);
    2693         111 :     SimpleInstallFunction(isolate_, math, "ceil", Builtins::kMathCeil, 1, true);
    2694         111 :     SimpleInstallFunction(isolate_, math, "cbrt", Builtins::kMathCbrt, 1, true);
    2695             :     SimpleInstallFunction(isolate_, math, "expm1", Builtins::kMathExpm1, 1,
    2696         111 :                           true);
    2697             :     SimpleInstallFunction(isolate_, math, "clz32", Builtins::kMathClz32, 1,
    2698         111 :                           true);
    2699         111 :     SimpleInstallFunction(isolate_, math, "cos", Builtins::kMathCos, 1, true);
    2700         111 :     SimpleInstallFunction(isolate_, math, "cosh", Builtins::kMathCosh, 1, true);
    2701         111 :     SimpleInstallFunction(isolate_, math, "exp", Builtins::kMathExp, 1, true);
    2702             :     Handle<JSFunction> math_floor = SimpleInstallFunction(
    2703         111 :         isolate_, math, "floor", Builtins::kMathFloor, 1, true);
    2704         111 :     native_context()->set_math_floor(*math_floor);
    2705             :     SimpleInstallFunction(isolate_, math, "fround", Builtins::kMathFround, 1,
    2706         111 :                           true);
    2707             :     SimpleInstallFunction(isolate_, math, "hypot", Builtins::kMathHypot, 2,
    2708         111 :                           false);
    2709         111 :     SimpleInstallFunction(isolate_, math, "imul", Builtins::kMathImul, 2, true);
    2710         111 :     SimpleInstallFunction(isolate_, math, "log", Builtins::kMathLog, 1, true);
    2711             :     SimpleInstallFunction(isolate_, math, "log1p", Builtins::kMathLog1p, 1,
    2712         111 :                           true);
    2713         111 :     SimpleInstallFunction(isolate_, math, "log2", Builtins::kMathLog2, 1, true);
    2714             :     SimpleInstallFunction(isolate_, math, "log10", Builtins::kMathLog10, 1,
    2715         111 :                           true);
    2716         111 :     SimpleInstallFunction(isolate_, math, "max", Builtins::kMathMax, 2, false);
    2717         111 :     SimpleInstallFunction(isolate_, math, "min", Builtins::kMathMin, 2, false);
    2718             :     Handle<JSFunction> math_pow = SimpleInstallFunction(
    2719         111 :         isolate_, math, "pow", Builtins::kMathPow, 2, true);
    2720         111 :     native_context()->set_math_pow(*math_pow);
    2721             :     SimpleInstallFunction(isolate_, math, "random", Builtins::kMathRandom, 0,
    2722         111 :                           true);
    2723             :     SimpleInstallFunction(isolate_, math, "round", Builtins::kMathRound, 1,
    2724         111 :                           true);
    2725         111 :     SimpleInstallFunction(isolate_, math, "sign", Builtins::kMathSign, 1, true);
    2726         111 :     SimpleInstallFunction(isolate_, math, "sin", Builtins::kMathSin, 1, true);
    2727         111 :     SimpleInstallFunction(isolate_, math, "sinh", Builtins::kMathSinh, 1, true);
    2728         111 :     SimpleInstallFunction(isolate_, math, "sqrt", Builtins::kMathSqrt, 1, true);
    2729         111 :     SimpleInstallFunction(isolate_, math, "tan", Builtins::kMathTan, 1, true);
    2730         111 :     SimpleInstallFunction(isolate_, math, "tanh", Builtins::kMathTanh, 1, true);
    2731             :     SimpleInstallFunction(isolate_, math, "trunc", Builtins::kMathTrunc, 1,
    2732         111 :                           true);
    2733             : 
    2734             :     // Install math constants.
    2735         111 :     double const kE = base::ieee754::exp(1.0);
    2736             :     double const kPI = 3.1415926535897932;
    2737         111 :     InstallConstant(isolate_, math, "E", factory->NewNumber(kE));
    2738         111 :     InstallConstant(isolate_, math, "LN10",
    2739         111 :                     factory->NewNumber(base::ieee754::log(10.0)));
    2740         111 :     InstallConstant(isolate_, math, "LN2",
    2741         111 :                     factory->NewNumber(base::ieee754::log(2.0)));
    2742         111 :     InstallConstant(isolate_, math, "LOG10E",
    2743         111 :                     factory->NewNumber(base::ieee754::log10(kE)));
    2744         111 :     InstallConstant(isolate_, math, "LOG2E",
    2745         111 :                     factory->NewNumber(base::ieee754::log2(kE)));
    2746         111 :     InstallConstant(isolate_, math, "PI", factory->NewNumber(kPI));
    2747         111 :     InstallConstant(isolate_, math, "SQRT1_2",
    2748         111 :                     factory->NewNumber(std::sqrt(0.5)));
    2749         111 :     InstallConstant(isolate_, math, "SQRT2",
    2750         111 :                     factory->NewNumber(std::sqrt(2.0)));
    2751         111 :     InstallToStringTag(isolate_, math, "Math");
    2752             :   }
    2753             : 
    2754             :   {  // -- C o n s o l e
    2755         111 :     Handle<String> name = factory->InternalizeUtf8String("console");
    2756             :     NewFunctionArgs args = NewFunctionArgs::ForFunctionWithoutCode(
    2757         111 :         name, isolate_->strict_function_map(), LanguageMode::kStrict);
    2758         111 :     Handle<JSFunction> cons = factory->NewFunction(args);
    2759             : 
    2760         111 :     Handle<JSObject> empty = factory->NewJSObject(isolate_->object_function());
    2761         111 :     JSFunction::SetPrototype(cons, empty);
    2762             : 
    2763         111 :     Handle<JSObject> console = factory->NewJSObject(cons, AllocationType::kOld);
    2764             :     DCHECK(console->IsJSObject());
    2765         111 :     JSObject::AddProperty(isolate_, global, name, console, DONT_ENUM);
    2766             :     SimpleInstallFunction(isolate_, console, "debug", Builtins::kConsoleDebug,
    2767         111 :                           1, false, NONE);
    2768             :     SimpleInstallFunction(isolate_, console, "error", Builtins::kConsoleError,
    2769         111 :                           1, false, NONE);
    2770             :     SimpleInstallFunction(isolate_, console, "info", Builtins::kConsoleInfo, 1,
    2771         111 :                           false, NONE);
    2772             :     SimpleInstallFunction(isolate_, console, "log", Builtins::kConsoleLog, 1,
    2773         111 :                           false, NONE);
    2774             :     SimpleInstallFunction(isolate_, console, "warn", Builtins::kConsoleWarn, 1,
    2775         111 :                           false, NONE);
    2776             :     SimpleInstallFunction(isolate_, console, "dir", Builtins::kConsoleDir, 1,
    2777         111 :                           false, NONE);
    2778             :     SimpleInstallFunction(isolate_, console, "dirxml", Builtins::kConsoleDirXml,
    2779         111 :                           1, false, NONE);
    2780             :     SimpleInstallFunction(isolate_, console, "table", Builtins::kConsoleTable,
    2781         111 :                           1, false, NONE);
    2782             :     SimpleInstallFunction(isolate_, console, "trace", Builtins::kConsoleTrace,
    2783         111 :                           1, false, NONE);
    2784             :     SimpleInstallFunction(isolate_, console, "group", Builtins::kConsoleGroup,
    2785         111 :                           1, false, NONE);
    2786             :     SimpleInstallFunction(isolate_, console, "groupCollapsed",
    2787         111 :                           Builtins::kConsoleGroupCollapsed, 1, false, NONE);
    2788             :     SimpleInstallFunction(isolate_, console, "groupEnd",
    2789         111 :                           Builtins::kConsoleGroupEnd, 1, false, NONE);
    2790             :     SimpleInstallFunction(isolate_, console, "clear", Builtins::kConsoleClear,
    2791         111 :                           1, false, NONE);
    2792             :     SimpleInstallFunction(isolate_, console, "count", Builtins::kConsoleCount,
    2793         111 :                           1, false, NONE);
    2794             :     SimpleInstallFunction(isolate_, console, "countReset",
    2795         111 :                           Builtins::kConsoleCountReset, 1, false, NONE);
    2796             :     SimpleInstallFunction(isolate_, console, "assert",
    2797         111 :                           Builtins::kFastConsoleAssert, 1, false, NONE);
    2798             :     SimpleInstallFunction(isolate_, console, "profile",
    2799         111 :                           Builtins::kConsoleProfile, 1, false, NONE);
    2800             :     SimpleInstallFunction(isolate_, console, "profileEnd",
    2801         111 :                           Builtins::kConsoleProfileEnd, 1, false, NONE);
    2802             :     SimpleInstallFunction(isolate_, console, "time", Builtins::kConsoleTime, 1,
    2803         111 :                           false, NONE);
    2804             :     SimpleInstallFunction(isolate_, console, "timeLog",
    2805         111 :                           Builtins::kConsoleTimeLog, 1, false, NONE);
    2806             :     SimpleInstallFunction(isolate_, console, "timeEnd",
    2807         111 :                           Builtins::kConsoleTimeEnd, 1, false, NONE);
    2808             :     SimpleInstallFunction(isolate_, console, "timeStamp",
    2809         111 :                           Builtins::kConsoleTimeStamp, 1, false, NONE);
    2810             :     SimpleInstallFunction(isolate_, console, "context",
    2811         111 :                           Builtins::kConsoleContext, 1, true, NONE);
    2812         111 :     InstallToStringTag(isolate_, console, "Object");
    2813             :   }
    2814             : 
    2815             : #ifdef V8_INTL_SUPPORT
    2816             :   {  // -- I n t l
    2817             :     Handle<JSObject> intl =
    2818         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    2819         111 :     JSObject::AddProperty(isolate_, global, "Intl", intl, DONT_ENUM);
    2820             : 
    2821             :     SimpleInstallFunction(isolate(), intl, "getCanonicalLocales",
    2822         111 :                           Builtins::kIntlGetCanonicalLocales, 1, false);
    2823             : 
    2824             :     {  // -- D a t e T i m e F o r m a t
    2825             :       Handle<JSFunction> date_time_format_constructor = InstallFunction(
    2826             :           isolate_, intl, "DateTimeFormat", JS_INTL_DATE_TIME_FORMAT_TYPE,
    2827             :           JSDateTimeFormat::kSize, 0, factory->the_hole_value(),
    2828         111 :           Builtins::kDateTimeFormatConstructor);
    2829             :       date_time_format_constructor->shared()->set_length(0);
    2830             :       date_time_format_constructor->shared()->DontAdaptArguments();
    2831         111 :       InstallWithIntrinsicDefaultProto(
    2832             :           isolate_, date_time_format_constructor,
    2833         111 :           Context::INTL_DATE_TIME_FORMAT_FUNCTION_INDEX);
    2834             : 
    2835             :       SimpleInstallFunction(
    2836             :           isolate(), date_time_format_constructor, "supportedLocalesOf",
    2837         111 :           Builtins::kDateTimeFormatSupportedLocalesOf, 1, false);
    2838             : 
    2839             :       Handle<JSObject> prototype(
    2840         333 :           JSObject::cast(date_time_format_constructor->prototype()), isolate_);
    2841             : 
    2842         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2843             : 
    2844             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2845             :                             Builtins::kDateTimeFormatPrototypeResolvedOptions,
    2846         111 :                             0, false);
    2847             : 
    2848             :       SimpleInstallFunction(isolate_, prototype, "formatToParts",
    2849             :                             Builtins::kDateTimeFormatPrototypeFormatToParts, 1,
    2850         111 :                             false);
    2851             : 
    2852             :       SimpleInstallGetter(isolate_, prototype, factory->format_string(),
    2853         111 :                           Builtins::kDateTimeFormatPrototypeFormat, false);
    2854             :     }
    2855             : 
    2856             :     {  // -- N u m b e r F o r m a t
    2857             :       Handle<JSFunction> number_format_constructor = InstallFunction(
    2858             :           isolate_, intl, "NumberFormat", JS_INTL_NUMBER_FORMAT_TYPE,
    2859             :           JSNumberFormat::kSize, 0, factory->the_hole_value(),
    2860         111 :           Builtins::kNumberFormatConstructor);
    2861             :       number_format_constructor->shared()->set_length(0);
    2862             :       number_format_constructor->shared()->DontAdaptArguments();
    2863         111 :       InstallWithIntrinsicDefaultProto(
    2864             :           isolate_, number_format_constructor,
    2865         111 :           Context::INTL_NUMBER_FORMAT_FUNCTION_INDEX);
    2866             : 
    2867             :       SimpleInstallFunction(
    2868             :           isolate(), number_format_constructor, "supportedLocalesOf",
    2869         111 :           Builtins::kNumberFormatSupportedLocalesOf, 1, false);
    2870             : 
    2871             :       Handle<JSObject> prototype(
    2872         333 :           JSObject::cast(number_format_constructor->prototype()), isolate_);
    2873             : 
    2874         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2875             : 
    2876             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2877             :                             Builtins::kNumberFormatPrototypeResolvedOptions, 0,
    2878         111 :                             false);
    2879             : 
    2880             :       SimpleInstallFunction(isolate_, prototype, "formatToParts",
    2881             :                             Builtins::kNumberFormatPrototypeFormatToParts, 1,
    2882         111 :                             false);
    2883             :       SimpleInstallGetter(isolate_, prototype, factory->format_string(),
    2884         111 :                           Builtins::kNumberFormatPrototypeFormatNumber, false);
    2885             :     }
    2886             : 
    2887             :     {  // -- C o l l a t o r
    2888             :       Handle<JSFunction> collator_constructor = InstallFunction(
    2889             :           isolate_, intl, "Collator", JS_INTL_COLLATOR_TYPE, JSCollator::kSize,
    2890         111 :           0, factory->the_hole_value(), Builtins::kCollatorConstructor);
    2891             :       collator_constructor->shared()->DontAdaptArguments();
    2892         111 :       InstallWithIntrinsicDefaultProto(isolate_, collator_constructor,
    2893         111 :                                        Context::INTL_COLLATOR_FUNCTION_INDEX);
    2894             : 
    2895             :       SimpleInstallFunction(isolate(), collator_constructor,
    2896             :                             "supportedLocalesOf",
    2897         111 :                             Builtins::kCollatorSupportedLocalesOf, 1, false);
    2898             : 
    2899             :       Handle<JSObject> prototype(
    2900         333 :           JSObject::cast(collator_constructor->prototype()), isolate_);
    2901             : 
    2902         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2903             : 
    2904             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2905             :                             Builtins::kCollatorPrototypeResolvedOptions, 0,
    2906         111 :                             false);
    2907             : 
    2908             :       SimpleInstallGetter(isolate_, prototype, factory->compare_string(),
    2909         111 :                           Builtins::kCollatorPrototypeCompare, false);
    2910             :     }
    2911             : 
    2912             :     {  // -- V 8 B r e a k I t e r a t o r
    2913             :       Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
    2914             :           isolate_, intl, "v8BreakIterator", JS_INTL_V8_BREAK_ITERATOR_TYPE,
    2915             :           JSV8BreakIterator::kSize, 0, factory->the_hole_value(),
    2916         111 :           Builtins::kV8BreakIteratorConstructor);
    2917             :       v8_break_iterator_constructor->shared()->DontAdaptArguments();
    2918             : 
    2919             :       SimpleInstallFunction(
    2920             :           isolate_, v8_break_iterator_constructor, "supportedLocalesOf",
    2921         111 :           Builtins::kV8BreakIteratorSupportedLocalesOf, 1, false);
    2922             : 
    2923             :       Handle<JSObject> prototype(
    2924         333 :           JSObject::cast(v8_break_iterator_constructor->prototype()), isolate_);
    2925             : 
    2926         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2927             : 
    2928             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2929             :                             Builtins::kV8BreakIteratorPrototypeResolvedOptions,
    2930         111 :                             0, false);
    2931             : 
    2932             :       SimpleInstallGetter(isolate_, prototype, factory->adoptText_string(),
    2933         111 :                           Builtins::kV8BreakIteratorPrototypeAdoptText, false);
    2934             : 
    2935             :       SimpleInstallGetter(isolate_, prototype, factory->first_string(),
    2936         111 :                           Builtins::kV8BreakIteratorPrototypeFirst, false);
    2937             : 
    2938             :       SimpleInstallGetter(isolate_, prototype, factory->next_string(),
    2939         111 :                           Builtins::kV8BreakIteratorPrototypeNext, false);
    2940             : 
    2941             :       SimpleInstallGetter(isolate_, prototype, factory->current_string(),
    2942         111 :                           Builtins::kV8BreakIteratorPrototypeCurrent, false);
    2943             : 
    2944             :       SimpleInstallGetter(isolate_, prototype, factory->breakType_string(),
    2945         111 :                           Builtins::kV8BreakIteratorPrototypeBreakType, false);
    2946             :     }
    2947             : 
    2948             :     {  // -- P l u r a l R u l e s
    2949             :       Handle<JSFunction> plural_rules_constructor = InstallFunction(
    2950             :           isolate_, intl, "PluralRules", JS_INTL_PLURAL_RULES_TYPE,
    2951             :           JSPluralRules::kSize, 0, factory->the_hole_value(),
    2952         111 :           Builtins::kPluralRulesConstructor);
    2953             :       plural_rules_constructor->shared()->DontAdaptArguments();
    2954             : 
    2955             :       SimpleInstallFunction(isolate(), plural_rules_constructor,
    2956             :                             "supportedLocalesOf",
    2957         111 :                             Builtins::kPluralRulesSupportedLocalesOf, 1, false);
    2958             : 
    2959             :       Handle<JSObject> prototype(
    2960         333 :           JSObject::cast(plural_rules_constructor->prototype()), isolate_);
    2961             : 
    2962         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2963             : 
    2964             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2965             :                             Builtins::kPluralRulesPrototypeResolvedOptions, 0,
    2966         111 :                             false);
    2967             : 
    2968             :       SimpleInstallFunction(isolate_, prototype, "select",
    2969         111 :                             Builtins::kPluralRulesPrototypeSelect, 1, false);
    2970             :     }
    2971             : 
    2972             :     {  // -- R e l a t i v e T i m e F o r m a t e
    2973             :       Handle<JSFunction> relative_time_format_fun = InstallFunction(
    2974             :           isolate(), intl, "RelativeTimeFormat",
    2975             :           JS_INTL_RELATIVE_TIME_FORMAT_TYPE, JSRelativeTimeFormat::kSize, 0,
    2976         111 :           factory->the_hole_value(), Builtins::kRelativeTimeFormatConstructor);
    2977             :       relative_time_format_fun->shared()->set_length(0);
    2978             :       relative_time_format_fun->shared()->DontAdaptArguments();
    2979             : 
    2980             :       SimpleInstallFunction(
    2981             :           isolate(), relative_time_format_fun, "supportedLocalesOf",
    2982         111 :           Builtins::kRelativeTimeFormatSupportedLocalesOf, 1, false);
    2983             : 
    2984             :       // Setup %RelativeTimeFormatPrototype%.
    2985             :       Handle<JSObject> prototype(
    2986         222 :           JSObject::cast(relative_time_format_fun->instance_prototype()),
    2987             :           isolate());
    2988             : 
    2989             :       InstallToStringTag(isolate(), prototype, "Intl.RelativeTimeFormat");
    2990             : 
    2991             :       SimpleInstallFunction(
    2992             :           isolate(), prototype, "resolvedOptions",
    2993         111 :           Builtins::kRelativeTimeFormatPrototypeResolvedOptions, 0, false);
    2994             :       SimpleInstallFunction(isolate(), prototype, "format",
    2995             :                             Builtins::kRelativeTimeFormatPrototypeFormat, 2,
    2996         111 :                             false);
    2997             :       SimpleInstallFunction(isolate(), prototype, "formatToParts",
    2998             :                             Builtins::kRelativeTimeFormatPrototypeFormatToParts,
    2999         111 :                             2, false);
    3000             :     }
    3001             : 
    3002             :     {  // -- L i s t F o r m a t
    3003             :       Handle<JSFunction> list_format_fun = InstallFunction(
    3004             :           isolate(), intl, "ListFormat", JS_INTL_LIST_FORMAT_TYPE,
    3005             :           JSListFormat::kSize, 0, factory->the_hole_value(),
    3006         111 :           Builtins::kListFormatConstructor);
    3007             :       list_format_fun->shared()->set_length(0);
    3008             :       list_format_fun->shared()->DontAdaptArguments();
    3009             : 
    3010             :       SimpleInstallFunction(isolate(), list_format_fun, "supportedLocalesOf",
    3011         111 :                             Builtins::kListFormatSupportedLocalesOf, 1, false);
    3012             : 
    3013             :       // Setup %ListFormatPrototype%.
    3014             :       Handle<JSObject> prototype(
    3015         222 :           JSObject::cast(list_format_fun->instance_prototype()), isolate());
    3016             : 
    3017             :       InstallToStringTag(isolate(), prototype, "Intl.ListFormat");
    3018             : 
    3019             :       SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    3020             :                             Builtins::kListFormatPrototypeResolvedOptions, 0,
    3021         111 :                             false);
    3022             :       SimpleInstallFunction(isolate(), prototype, "format",
    3023         111 :                             Builtins::kListFormatPrototypeFormat, 1, false);
    3024             :       SimpleInstallFunction(isolate(), prototype, "formatToParts",
    3025             :                             Builtins::kListFormatPrototypeFormatToParts, 1,
    3026         111 :                             false);
    3027             :     }
    3028             :   }
    3029             : #endif  // V8_INTL_SUPPORT
    3030             : 
    3031             :   {  // -- A r r a y B u f f e r
    3032             :     Handle<String> name = factory->ArrayBuffer_string();
    3033         111 :     Handle<JSFunction> array_buffer_fun = CreateArrayBuffer(name, ARRAY_BUFFER);
    3034         111 :     JSObject::AddProperty(isolate_, global, name, array_buffer_fun, DONT_ENUM);
    3035         111 :     InstallWithIntrinsicDefaultProto(isolate_, array_buffer_fun,
    3036         111 :                                      Context::ARRAY_BUFFER_FUN_INDEX);
    3037         111 :     InstallSpeciesGetter(isolate_, array_buffer_fun);
    3038             : 
    3039             :     Handle<JSFunction> array_buffer_noinit_fun = SimpleCreateFunction(
    3040             :         isolate_,
    3041             :         factory->InternalizeUtf8String(
    3042             :             "arrayBufferConstructor_DoNotInitialize"),
    3043         111 :         Builtins::kArrayBufferConstructor_DoNotInitialize, 1, false);
    3044         111 :     native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun);
    3045             :   }
    3046             : 
    3047             :   {  // -- S h a r e d A r r a y B u f f e r
    3048         111 :     Handle<String> name = factory->SharedArrayBuffer_string();
    3049             :     Handle<JSFunction> shared_array_buffer_fun =
    3050         111 :         CreateArrayBuffer(name, SHARED_ARRAY_BUFFER);
    3051         111 :     InstallWithIntrinsicDefaultProto(isolate_, shared_array_buffer_fun,
    3052         111 :                                      Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
    3053         111 :     InstallSpeciesGetter(isolate_, shared_array_buffer_fun);
    3054             :   }
    3055             : 
    3056             :   {  // -- A t o m i c s
    3057             :     Handle<JSObject> atomics_object =
    3058         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    3059         111 :     native_context()->set_atomics_object(*atomics_object);
    3060             : 
    3061             :     SimpleInstallFunction(isolate_, atomics_object, "load",
    3062         111 :                           Builtins::kAtomicsLoad, 2, true);
    3063             :     SimpleInstallFunction(isolate_, atomics_object, "store",
    3064         111 :                           Builtins::kAtomicsStore, 3, true);
    3065             :     SimpleInstallFunction(isolate_, atomics_object, "add",
    3066         111 :                           Builtins::kAtomicsAdd, 3, true);
    3067             :     SimpleInstallFunction(isolate_, atomics_object, "sub",
    3068         111 :                           Builtins::kAtomicsSub, 3, true);
    3069             :     SimpleInstallFunction(isolate_, atomics_object, "and",
    3070         111 :                           Builtins::kAtomicsAnd, 3, true);
    3071             :     SimpleInstallFunction(isolate_, atomics_object, "or", Builtins::kAtomicsOr,
    3072         111 :                           3, true);
    3073             :     SimpleInstallFunction(isolate_, atomics_object, "xor",
    3074         111 :                           Builtins::kAtomicsXor, 3, true);
    3075             :     SimpleInstallFunction(isolate_, atomics_object, "exchange",
    3076         111 :                           Builtins::kAtomicsExchange, 3, true);
    3077             :     SimpleInstallFunction(isolate_, atomics_object, "compareExchange",
    3078         111 :                           Builtins::kAtomicsCompareExchange, 4, true);
    3079             :     SimpleInstallFunction(isolate_, atomics_object, "isLockFree",
    3080         111 :                           Builtins::kAtomicsIsLockFree, 1, true);
    3081             :     SimpleInstallFunction(isolate_, atomics_object, "wait",
    3082         111 :                           Builtins::kAtomicsWait, 4, true);
    3083             :     SimpleInstallFunction(isolate_, atomics_object, "wake",
    3084         111 :                           Builtins::kAtomicsWake, 3, true);
    3085             :     SimpleInstallFunction(isolate_, atomics_object, "notify",
    3086         111 :                           Builtins::kAtomicsNotify, 3, true);
    3087             :   }
    3088             : 
    3089             :   {  // -- T y p e d A r r a y
    3090             :     Handle<JSFunction> typed_array_fun = CreateFunction(
    3091             :         isolate_, factory->InternalizeUtf8String("TypedArray"),
    3092             :         JS_TYPED_ARRAY_TYPE, JSTypedArray::kHeaderSize, 0,
    3093         111 :         factory->the_hole_value(), Builtins::kTypedArrayBaseConstructor);
    3094         111 :     typed_array_fun->shared()->set_native(false);
    3095             :     typed_array_fun->shared()->set_length(0);
    3096         111 :     InstallSpeciesGetter(isolate_, typed_array_fun);
    3097         111 :     native_context()->set_typed_array_function(*typed_array_fun);
    3098             : 
    3099             :     SimpleInstallFunction(isolate_, typed_array_fun, "of",
    3100         111 :                           Builtins::kTypedArrayOf, 0, false);
    3101             :     SimpleInstallFunction(isolate_, typed_array_fun, "from",
    3102         111 :                           Builtins::kTypedArrayFrom, 1, false);
    3103             : 
    3104             :     // Setup %TypedArrayPrototype%.
    3105             :     Handle<JSObject> prototype(
    3106         222 :         JSObject::cast(typed_array_fun->instance_prototype()), isolate());
    3107         111 :     native_context()->set_typed_array_prototype(*prototype);
    3108             : 
    3109             :     // Install the "buffer", "byteOffset", "byteLength", "length"
    3110             :     // and @@toStringTag getters on the {prototype}.
    3111             :     SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
    3112         111 :                         Builtins::kTypedArrayPrototypeBuffer, false);
    3113             :     SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
    3114         111 :                         Builtins::kTypedArrayPrototypeByteLength, true);
    3115             :     SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
    3116         111 :                         Builtins::kTypedArrayPrototypeByteOffset, true);
    3117             :     SimpleInstallGetter(isolate_, prototype, factory->length_string(),
    3118         111 :                         Builtins::kTypedArrayPrototypeLength, true);
    3119             :     SimpleInstallGetter(isolate_, prototype, factory->to_string_tag_symbol(),
    3120         111 :                         Builtins::kTypedArrayPrototypeToStringTag, true);
    3121             : 
    3122             :     // Install "keys", "values" and "entries" methods on the {prototype}.
    3123             :     InstallFunctionWithBuiltinId(isolate_, prototype, "entries",
    3124             :                                  Builtins::kTypedArrayPrototypeEntries, 0,
    3125         111 :                                  true);
    3126             : 
    3127             :     InstallFunctionWithBuiltinId(isolate_, prototype, "keys",
    3128         111 :                                  Builtins::kTypedArrayPrototypeKeys, 0, true);
    3129             : 
    3130             :     Handle<JSFunction> values = InstallFunctionWithBuiltinId(
    3131             :         isolate_, prototype, "values", Builtins::kTypedArrayPrototypeValues, 0,
    3132         111 :         true);
    3133         222 :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3134         111 :                           values, DONT_ENUM);
    3135             : 
    3136             :     // TODO(caitp): alphasort accessors/methods
    3137             :     SimpleInstallFunction(isolate_, prototype, "copyWithin",
    3138         111 :                           Builtins::kTypedArrayPrototypeCopyWithin, 2, false);
    3139             :     SimpleInstallFunction(isolate_, prototype, "every",
    3140         111 :                           Builtins::kTypedArrayPrototypeEvery, 1, false);
    3141             :     SimpleInstallFunction(isolate_, prototype, "fill",
    3142         111 :                           Builtins::kTypedArrayPrototypeFill, 1, false);
    3143             :     SimpleInstallFunction(isolate_, prototype, "filter",
    3144         111 :                           Builtins::kTypedArrayPrototypeFilter, 1, false);
    3145             :     SimpleInstallFunction(isolate_, prototype, "find",
    3146         111 :                           Builtins::kTypedArrayPrototypeFind, 1, false);
    3147             :     SimpleInstallFunction(isolate_, prototype, "findIndex",
    3148         111 :                           Builtins::kTypedArrayPrototypeFindIndex, 1, false);
    3149             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3150         111 :                           Builtins::kTypedArrayPrototypeForEach, 1, false);
    3151             :     SimpleInstallFunction(isolate_, prototype, "includes",
    3152         111 :                           Builtins::kTypedArrayPrototypeIncludes, 1, false);
    3153             :     SimpleInstallFunction(isolate_, prototype, "indexOf",
    3154         111 :                           Builtins::kTypedArrayPrototypeIndexOf, 1, false);
    3155             :     SimpleInstallFunction(isolate_, prototype, "join",
    3156         111 :                           Builtins::kTypedArrayPrototypeJoin, 1, false);
    3157             :     SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
    3158         111 :                           Builtins::kTypedArrayPrototypeLastIndexOf, 1, false);
    3159             :     SimpleInstallFunction(isolate_, prototype, "map",
    3160         111 :                           Builtins::kTypedArrayPrototypeMap, 1, false);
    3161             :     SimpleInstallFunction(isolate_, prototype, "reverse",
    3162         111 :                           Builtins::kTypedArrayPrototypeReverse, 0, false);
    3163             :     SimpleInstallFunction(isolate_, prototype, "reduce",
    3164         111 :                           Builtins::kTypedArrayPrototypeReduce, 1, false);
    3165             :     SimpleInstallFunction(isolate_, prototype, "reduceRight",
    3166         111 :                           Builtins::kTypedArrayPrototypeReduceRight, 1, false);
    3167             :     SimpleInstallFunction(isolate_, prototype, "set",
    3168         111 :                           Builtins::kTypedArrayPrototypeSet, 1, false);
    3169             :     SimpleInstallFunction(isolate_, prototype, "slice",
    3170         111 :                           Builtins::kTypedArrayPrototypeSlice, 2, false);
    3171             :     SimpleInstallFunction(isolate_, prototype, "some",
    3172         111 :                           Builtins::kTypedArrayPrototypeSome, 1, false);
    3173             :     SimpleInstallFunction(isolate_, prototype, "sort",
    3174         111 :                           Builtins::kTypedArrayPrototypeSort, 1, false);
    3175             :     SimpleInstallFunction(isolate_, prototype, "subarray",
    3176         111 :                           Builtins::kTypedArrayPrototypeSubArray, 2, false);
    3177             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    3178             :                           Builtins::kTypedArrayPrototypeToLocaleString, 0,
    3179         111 :                           false);
    3180         222 :     JSObject::AddProperty(isolate_, prototype, factory->toString_string(),
    3181         111 :                           array_prototype_to_string_fun, DONT_ENUM);
    3182             :   }
    3183             : 
    3184             :   {  // -- T y p e d A r r a y s
    3185             : #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype)                   \
    3186             :   {                                                                    \
    3187             :     Handle<JSFunction> fun =                                           \
    3188             :         InstallTypedArray(#Type "Array", TYPE##_ELEMENTS);             \
    3189             :     InstallWithIntrinsicDefaultProto(isolate_, fun,                    \
    3190             :                                      Context::TYPE##_ARRAY_FUN_INDEX); \
    3191             :   }
    3192         111 :     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
    3193             : #undef INSTALL_TYPED_ARRAY
    3194             :   }
    3195             : 
    3196             :   {  // -- D a t a V i e w
    3197             :     Handle<JSFunction> data_view_fun = InstallFunction(
    3198             :         isolate_, global, "DataView", JS_DATA_VIEW_TYPE,
    3199             :         JSDataView::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    3200         111 :         Builtins::kDataViewConstructor);
    3201         111 :     InstallWithIntrinsicDefaultProto(isolate_, data_view_fun,
    3202         111 :                                      Context::DATA_VIEW_FUN_INDEX);
    3203             :     data_view_fun->shared()->set_length(1);
    3204             :     data_view_fun->shared()->DontAdaptArguments();
    3205             : 
    3206             :     // Setup %DataViewPrototype%.
    3207             :     Handle<JSObject> prototype(
    3208         222 :         JSObject::cast(data_view_fun->instance_prototype()), isolate());
    3209             : 
    3210         111 :     InstallToStringTag(isolate_, prototype, "DataView");
    3211             : 
    3212             :     // Install the "buffer", "byteOffset" and "byteLength" getters
    3213             :     // on the {prototype}.
    3214             :     SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
    3215         111 :                         Builtins::kDataViewPrototypeGetBuffer, false);
    3216             :     SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
    3217         111 :                         Builtins::kDataViewPrototypeGetByteLength, false);
    3218             :     SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
    3219         111 :                         Builtins::kDataViewPrototypeGetByteOffset, false);
    3220             : 
    3221             :     SimpleInstallFunction(isolate_, prototype, "getInt8",
    3222         111 :                           Builtins::kDataViewPrototypeGetInt8, 1, false);
    3223             :     SimpleInstallFunction(isolate_, prototype, "setInt8",
    3224         111 :                           Builtins::kDataViewPrototypeSetInt8, 2, false);
    3225             :     SimpleInstallFunction(isolate_, prototype, "getUint8",
    3226         111 :                           Builtins::kDataViewPrototypeGetUint8, 1, false);
    3227             :     SimpleInstallFunction(isolate_, prototype, "setUint8",
    3228         111 :                           Builtins::kDataViewPrototypeSetUint8, 2, false);
    3229             :     SimpleInstallFunction(isolate_, prototype, "getInt16",
    3230         111 :                           Builtins::kDataViewPrototypeGetInt16, 1, false);
    3231             :     SimpleInstallFunction(isolate_, prototype, "setInt16",
    3232         111 :                           Builtins::kDataViewPrototypeSetInt16, 2, false);
    3233             :     SimpleInstallFunction(isolate_, prototype, "getUint16",
    3234         111 :                           Builtins::kDataViewPrototypeGetUint16, 1, false);
    3235             :     SimpleInstallFunction(isolate_, prototype, "setUint16",
    3236         111 :                           Builtins::kDataViewPrototypeSetUint16, 2, false);
    3237             :     SimpleInstallFunction(isolate_, prototype, "getInt32",
    3238         111 :                           Builtins::kDataViewPrototypeGetInt32, 1, false);
    3239             :     SimpleInstallFunction(isolate_, prototype, "setInt32",
    3240         111 :                           Builtins::kDataViewPrototypeSetInt32, 2, false);
    3241             :     SimpleInstallFunction(isolate_, prototype, "getUint32",
    3242         111 :                           Builtins::kDataViewPrototypeGetUint32, 1, false);
    3243             :     SimpleInstallFunction(isolate_, prototype, "setUint32",
    3244         111 :                           Builtins::kDataViewPrototypeSetUint32, 2, false);
    3245             :     SimpleInstallFunction(isolate_, prototype, "getFloat32",
    3246         111 :                           Builtins::kDataViewPrototypeGetFloat32, 1, false);
    3247             :     SimpleInstallFunction(isolate_, prototype, "setFloat32",
    3248         111 :                           Builtins::kDataViewPrototypeSetFloat32, 2, false);
    3249             :     SimpleInstallFunction(isolate_, prototype, "getFloat64",
    3250         111 :                           Builtins::kDataViewPrototypeGetFloat64, 1, false);
    3251             :     SimpleInstallFunction(isolate_, prototype, "setFloat64",
    3252         111 :                           Builtins::kDataViewPrototypeSetFloat64, 2, false);
    3253             :     SimpleInstallFunction(isolate_, prototype, "getBigInt64",
    3254         111 :                           Builtins::kDataViewPrototypeGetBigInt64, 1, false);
    3255             :     SimpleInstallFunction(isolate_, prototype, "setBigInt64",
    3256         111 :                           Builtins::kDataViewPrototypeSetBigInt64, 2, false);
    3257             :     SimpleInstallFunction(isolate_, prototype, "getBigUint64",
    3258         111 :                           Builtins::kDataViewPrototypeGetBigUint64, 1, false);
    3259             :     SimpleInstallFunction(isolate_, prototype, "setBigUint64",
    3260         111 :                           Builtins::kDataViewPrototypeSetBigUint64, 2, false);
    3261             :   }
    3262             : 
    3263             :   {  // -- M a p
    3264             :     Handle<JSFunction> js_map_fun =
    3265             :         InstallFunction(isolate_, global, "Map", JS_MAP_TYPE, JSMap::kSize, 0,
    3266         111 :                         factory->the_hole_value(), Builtins::kMapConstructor);
    3267         111 :     InstallWithIntrinsicDefaultProto(isolate_, js_map_fun,
    3268         111 :                                      Context::JS_MAP_FUN_INDEX);
    3269             : 
    3270         111 :     Handle<SharedFunctionInfo> shared(js_map_fun->shared(), isolate_);
    3271             :     shared->DontAdaptArguments();
    3272             :     shared->set_length(0);
    3273             : 
    3274             :     // Setup %MapPrototype%.
    3275         222 :     Handle<JSObject> prototype(JSObject::cast(js_map_fun->instance_prototype()),
    3276             :                                isolate());
    3277             : 
    3278         111 :     InstallToStringTag(isolate_, prototype, factory->Map_string());
    3279             : 
    3280             :     Handle<JSFunction> map_get = SimpleInstallFunction(
    3281         111 :         isolate_, prototype, "get", Builtins::kMapPrototypeGet, 1, true);
    3282         111 :     native_context()->set_map_get(*map_get);
    3283             : 
    3284             :     Handle<JSFunction> map_set = SimpleInstallFunction(
    3285         111 :         isolate_, prototype, "set", Builtins::kMapPrototypeSet, 2, true);
    3286             :     // Check that index of "set" function in JSCollection is correct.
    3287             :     DCHECK_EQ(JSCollection::kAddFunctionDescriptorIndex,
    3288             :               prototype->map()->LastAdded());
    3289         111 :     native_context()->set_map_set(*map_set);
    3290             : 
    3291             :     Handle<JSFunction> map_has = SimpleInstallFunction(
    3292         111 :         isolate_, prototype, "has", Builtins::kMapPrototypeHas, 1, true);
    3293         111 :     native_context()->set_map_has(*map_has);
    3294             : 
    3295             :     Handle<JSFunction> map_delete = SimpleInstallFunction(
    3296         111 :         isolate_, prototype, "delete", Builtins::kMapPrototypeDelete, 1, true);
    3297         111 :     native_context()->set_map_delete(*map_delete);
    3298             : 
    3299             :     SimpleInstallFunction(isolate_, prototype, "clear",
    3300         111 :                           Builtins::kMapPrototypeClear, 0, true);
    3301             :     Handle<JSFunction> entries =
    3302             :         SimpleInstallFunction(isolate_, prototype, "entries",
    3303         111 :                               Builtins::kMapPrototypeEntries, 0, true);
    3304         222 :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3305         111 :                           entries, DONT_ENUM);
    3306             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3307         111 :                           Builtins::kMapPrototypeForEach, 1, false);
    3308             :     SimpleInstallFunction(isolate_, prototype, "keys",
    3309         111 :                           Builtins::kMapPrototypeKeys, 0, true);
    3310             :     SimpleInstallGetter(isolate_, prototype,
    3311             :                         factory->InternalizeUtf8String("size"),
    3312         222 :                         Builtins::kMapPrototypeGetSize, true);
    3313             :     SimpleInstallFunction(isolate_, prototype, "values",
    3314         111 :                           Builtins::kMapPrototypeValues, 0, true);
    3315             : 
    3316         111 :     native_context()->set_initial_map_prototype_map(prototype->map());
    3317             : 
    3318         111 :     InstallSpeciesGetter(isolate_, js_map_fun);
    3319             :   }
    3320             : 
    3321             :   {  // -- B i g I n t
    3322             :     Handle<JSFunction> bigint_fun = InstallFunction(
    3323             :         isolate_, global, "BigInt", JS_VALUE_TYPE, JSValue::kSize, 0,
    3324         111 :         factory->the_hole_value(), Builtins::kBigIntConstructor);
    3325             :     bigint_fun->shared()->DontAdaptArguments();
    3326             :     bigint_fun->shared()->set_length(1);
    3327         111 :     InstallWithIntrinsicDefaultProto(isolate_, bigint_fun,
    3328         111 :                                      Context::BIGINT_FUNCTION_INDEX);
    3329             : 
    3330             :     // Install the properties of the BigInt constructor.
    3331             :     // asUintN(bits, bigint)
    3332             :     SimpleInstallFunction(isolate_, bigint_fun, "asUintN",
    3333         111 :                           Builtins::kBigIntAsUintN, 2, false);
    3334             :     // asIntN(bits, bigint)
    3335             :     SimpleInstallFunction(isolate_, bigint_fun, "asIntN",
    3336         111 :                           Builtins::kBigIntAsIntN, 2, false);
    3337             : 
    3338             :     // Set up the %BigIntPrototype%.
    3339         222 :     Handle<JSObject> prototype(JSObject::cast(bigint_fun->instance_prototype()),
    3340         111 :                                isolate_);
    3341         111 :     JSFunction::SetPrototype(bigint_fun, prototype);
    3342             : 
    3343             :     // Install the properties of the BigInt.prototype.
    3344             :     // "constructor" is created implicitly by InstallFunction() above.
    3345             :     // toLocaleString([reserved1 [, reserved2]])
    3346             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    3347         111 :                           Builtins::kBigIntPrototypeToLocaleString, 0, false);
    3348             :     // toString([radix])
    3349             :     SimpleInstallFunction(isolate_, prototype, "toString",
    3350         111 :                           Builtins::kBigIntPrototypeToString, 0, false);
    3351             :     // valueOf()
    3352             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    3353         111 :                           Builtins::kBigIntPrototypeValueOf, 0, false);
    3354             :     // @@toStringTag
    3355         111 :     InstallToStringTag(isolate_, prototype, factory->BigInt_string());
    3356             :   }
    3357             : 
    3358             :   {  // -- S e t
    3359             :     Handle<JSFunction> js_set_fun =
    3360             :         InstallFunction(isolate_, global, "Set", JS_SET_TYPE, JSSet::kSize, 0,
    3361         111 :                         factory->the_hole_value(), Builtins::kSetConstructor);
    3362         111 :     InstallWithIntrinsicDefaultProto(isolate_, js_set_fun,
    3363         111 :                                      Context::JS_SET_FUN_INDEX);
    3364             : 
    3365         111 :     Handle<SharedFunctionInfo> shared(js_set_fun->shared(), isolate_);
    3366             :     shared->DontAdaptArguments();
    3367             :     shared->set_length(0);
    3368             : 
    3369             :     // Setup %SetPrototype%.
    3370         222 :     Handle<JSObject> prototype(JSObject::cast(js_set_fun->instance_prototype()),
    3371             :                                isolate());
    3372             : 
    3373         111 :     InstallToStringTag(isolate_, prototype, factory->Set_string());
    3374             : 
    3375             :     Handle<JSFunction> set_has = SimpleInstallFunction(
    3376         111 :         isolate_, prototype, "has", Builtins::kSetPrototypeHas, 1, true);
    3377         111 :     native_context()->set_set_has(*set_has);
    3378             : 
    3379             :     Handle<JSFunction> set_add = SimpleInstallFunction(
    3380         111 :         isolate_, prototype, "add", Builtins::kSetPrototypeAdd, 1, true);
    3381             :     // Check that index of "add" function in JSCollection is correct.
    3382             :     DCHECK_EQ(JSCollection::kAddFunctionDescriptorIndex,
    3383             :               prototype->map()->LastAdded());
    3384         111 :     native_context()->set_set_add(*set_add);
    3385             : 
    3386             :     Handle<JSFunction> set_delete = SimpleInstallFunction(
    3387         111 :         isolate_, prototype, "delete", Builtins::kSetPrototypeDelete, 1, true);
    3388         111 :     native_context()->set_set_delete(*set_delete);
    3389             : 
    3390             :     SimpleInstallFunction(isolate_, prototype, "clear",
    3391         111 :                           Builtins::kSetPrototypeClear, 0, true);
    3392             :     SimpleInstallFunction(isolate_, prototype, "entries",
    3393         111 :                           Builtins::kSetPrototypeEntries, 0, true);
    3394             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3395         111 :                           Builtins::kSetPrototypeForEach, 1, false);
    3396             :     SimpleInstallGetter(isolate_, prototype,
    3397             :                         factory->InternalizeUtf8String("size"),
    3398         222 :                         Builtins::kSetPrototypeGetSize, true);
    3399             :     Handle<JSFunction> values = SimpleInstallFunction(
    3400         111 :         isolate_, prototype, "values", Builtins::kSetPrototypeValues, 0, true);
    3401         222 :     JSObject::AddProperty(isolate_, prototype, factory->keys_string(), values,
    3402         111 :                           DONT_ENUM);
    3403         222 :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3404         111 :                           values, DONT_ENUM);
    3405             : 
    3406         111 :     native_context()->set_initial_set_prototype_map(prototype->map());
    3407         111 :     native_context()->set_initial_set_prototype(*prototype);
    3408             : 
    3409         111 :     InstallSpeciesGetter(isolate_, js_set_fun);
    3410             :   }
    3411             : 
    3412             :   {  // -- J S M o d u l e N a m e s p a c e
    3413             :     Handle<Map> map = factory->NewMap(
    3414             :         JS_MODULE_NAMESPACE_TYPE, JSModuleNamespace::kSize,
    3415         111 :         TERMINAL_FAST_ELEMENTS_KIND, JSModuleNamespace::kInObjectFieldCount);
    3416         222 :     Map::SetPrototype(isolate(), map, isolate_->factory()->null_value());
    3417         111 :     Map::EnsureDescriptorSlack(isolate_, map, 1);
    3418         111 :     native_context()->set_js_module_namespace_map(*map);
    3419             : 
    3420             :     {  // Install @@toStringTag.
    3421             :       PropertyAttributes attribs =
    3422             :           static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY);
    3423             :       Descriptor d =
    3424             :           Descriptor::DataField(isolate(), factory->to_string_tag_symbol(),
    3425             :                                 JSModuleNamespace::kToStringTagFieldIndex,
    3426         111 :                                 attribs, Representation::Tagged());
    3427         111 :       map->AppendDescriptor(isolate(), &d);
    3428             :     }
    3429             :   }
    3430             : 
    3431             :   {  // -- I t e r a t o r R e s u l t
    3432             :     Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSIteratorResult::kSize,
    3433         111 :                                       TERMINAL_FAST_ELEMENTS_KIND, 2);
    3434         222 :     Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
    3435         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3436             : 
    3437             :     {  // value
    3438             :       Descriptor d = Descriptor::DataField(isolate(), factory->value_string(),
    3439             :                                            JSIteratorResult::kValueIndex, NONE,
    3440         111 :                                            Representation::Tagged());
    3441         111 :       map->AppendDescriptor(isolate(), &d);
    3442             :     }
    3443             : 
    3444             :     {  // done
    3445             :       Descriptor d = Descriptor::DataField(isolate(), factory->done_string(),
    3446             :                                            JSIteratorResult::kDoneIndex, NONE,
    3447         111 :                                            Representation::Tagged());
    3448         111 :       map->AppendDescriptor(isolate(), &d);
    3449             :     }
    3450             : 
    3451         222 :     map->SetConstructor(native_context()->object_function());
    3452         111 :     native_context()->set_iterator_result_map(*map);
    3453             :   }
    3454             : 
    3455             :   {  // -- W e a k M a p
    3456             :     Handle<JSFunction> cons = InstallFunction(
    3457             :         isolate_, global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize, 0,
    3458         111 :         factory->the_hole_value(), Builtins::kWeakMapConstructor);
    3459         111 :     InstallWithIntrinsicDefaultProto(isolate_, cons,
    3460         111 :                                      Context::JS_WEAK_MAP_FUN_INDEX);
    3461             : 
    3462         111 :     Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
    3463             :     shared->DontAdaptArguments();
    3464             :     shared->set_length(0);
    3465             : 
    3466             :     // Setup %WeakMapPrototype%.
    3467         222 :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
    3468             :                                isolate());
    3469             : 
    3470             :     SimpleInstallFunction(isolate_, prototype, "delete",
    3471         111 :                           Builtins::kWeakMapPrototypeDelete, 1, true);
    3472             :     Handle<JSFunction> weakmap_get = SimpleInstallFunction(
    3473         111 :         isolate_, prototype, "get", Builtins::kWeakMapGet, 1, true);
    3474         111 :     native_context()->set_weakmap_get(*weakmap_get);
    3475             : 
    3476             :     Handle<JSFunction> weakmap_set = SimpleInstallFunction(
    3477         111 :         isolate_, prototype, "set", Builtins::kWeakMapPrototypeSet, 2, true);
    3478             :     // Check that index of "set" function in JSWeakCollection is correct.
    3479             :     DCHECK_EQ(JSWeakCollection::kAddFunctionDescriptorIndex,
    3480             :               prototype->map()->LastAdded());
    3481             : 
    3482         111 :     native_context()->set_weakmap_set(*weakmap_set);
    3483             :     SimpleInstallFunction(isolate_, prototype, "has",
    3484         111 :                           Builtins::kWeakMapPrototypeHas, 1, true);
    3485             : 
    3486         111 :     InstallToStringTag(isolate_, prototype, "WeakMap");
    3487             : 
    3488         111 :     native_context()->set_initial_weakmap_prototype_map(prototype->map());
    3489             :   }
    3490             : 
    3491             :   {  // -- W e a k S e t
    3492             :     Handle<JSFunction> cons = InstallFunction(
    3493             :         isolate_, global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize, 0,
    3494         111 :         factory->the_hole_value(), Builtins::kWeakSetConstructor);
    3495         111 :     InstallWithIntrinsicDefaultProto(isolate_, cons,
    3496         111 :                                      Context::JS_WEAK_SET_FUN_INDEX);
    3497             : 
    3498         111 :     Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
    3499             :     shared->DontAdaptArguments();
    3500             :     shared->set_length(0);
    3501             : 
    3502             :     // Setup %WeakSetPrototype%.
    3503         222 :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
    3504             :                                isolate());
    3505             : 
    3506             :     SimpleInstallFunction(isolate_, prototype, "delete",
    3507         111 :                           Builtins::kWeakSetPrototypeDelete, 1, true);
    3508             :     SimpleInstallFunction(isolate_, prototype, "has",
    3509         111 :                           Builtins::kWeakSetPrototypeHas, 1, true);
    3510             : 
    3511             :     Handle<JSFunction> weakset_add = SimpleInstallFunction(
    3512         111 :         isolate_, prototype, "add", Builtins::kWeakSetPrototypeAdd, 1, true);
    3513             :     // Check that index of "add" function in JSWeakCollection is correct.
    3514             :     DCHECK_EQ(JSWeakCollection::kAddFunctionDescriptorIndex,
    3515             :               prototype->map()->LastAdded());
    3516             : 
    3517         111 :     native_context()->set_weakset_add(*weakset_add);
    3518             : 
    3519         111 :     InstallToStringTag(isolate_, prototype,
    3520         111 :                        factory->InternalizeUtf8String("WeakSet"));
    3521             : 
    3522         111 :     native_context()->set_initial_weakset_prototype_map(prototype->map());
    3523             :   }
    3524             : 
    3525             :   {  // -- P r o x y
    3526         111 :     CreateJSProxyMaps();
    3527             :     // Proxy function map has prototype slot for storing initial map but does
    3528             :     // not have a prototype property.
    3529             :     Handle<Map> proxy_function_map = Map::Copy(
    3530         111 :         isolate_, isolate_->strict_function_without_prototype_map(), "Proxy");
    3531             :     proxy_function_map->set_is_constructor(true);
    3532             : 
    3533             :     Handle<String> name = factory->Proxy_string();
    3534             : 
    3535             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
    3536         111 :         name, proxy_function_map, Builtins::kProxyConstructor);
    3537         111 :     Handle<JSFunction> proxy_function = factory->NewFunction(args);
    3538             : 
    3539         222 :     isolate_->proxy_map()->SetConstructor(*proxy_function);
    3540             : 
    3541             :     proxy_function->shared()->set_internal_formal_parameter_count(2);
    3542             :     proxy_function->shared()->set_length(2);
    3543             : 
    3544         111 :     native_context()->set_proxy_function(*proxy_function);
    3545         111 :     JSObject::AddProperty(isolate_, global, name, proxy_function, DONT_ENUM);
    3546             : 
    3547             :     DCHECK(!proxy_function->has_prototype_property());
    3548             : 
    3549             :     SimpleInstallFunction(isolate_, proxy_function, "revocable",
    3550         111 :                           Builtins::kProxyRevocable, 2, true);
    3551             : 
    3552             :     {  // Internal: ProxyRevoke
    3553             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    3554         111 :           isolate_, Builtins::kProxyRevoke, factory->empty_string(), 0);
    3555         111 :       native_context()->set_proxy_revoke_shared_fun(*info);
    3556             :     }
    3557             :   }
    3558             : 
    3559             :   {  // -- R e f l e c t
    3560         111 :     Handle<String> reflect_string = factory->InternalizeUtf8String("Reflect");
    3561             :     Handle<JSObject> reflect =
    3562         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    3563         111 :     JSObject::AddProperty(isolate_, global, reflect_string, reflect, DONT_ENUM);
    3564             : 
    3565             :     Handle<JSFunction> define_property =
    3566             :         SimpleInstallFunction(isolate_, reflect, "defineProperty",
    3567         111 :                               Builtins::kReflectDefineProperty, 3, true);
    3568         111 :     native_context()->set_reflect_define_property(*define_property);
    3569             : 
    3570             :     Handle<JSFunction> delete_property =
    3571             :         SimpleInstallFunction(isolate_, reflect, "deleteProperty",
    3572         111 :                               Builtins::kReflectDeleteProperty, 2, true);
    3573         111 :     native_context()->set_reflect_delete_property(*delete_property);
    3574             : 
    3575             :     Handle<JSFunction> apply = SimpleInstallFunction(
    3576         111 :         isolate_, reflect, "apply", Builtins::kReflectApply, 3, false);
    3577         111 :     native_context()->set_reflect_apply(*apply);
    3578             : 
    3579             :     Handle<JSFunction> construct = SimpleInstallFunction(
    3580         111 :         isolate_, reflect, "construct", Builtins::kReflectConstruct, 2, false);
    3581         111 :     native_context()->set_reflect_construct(*construct);
    3582             : 
    3583             :     SimpleInstallFunction(isolate_, reflect, "get", Builtins::kReflectGet, 2,
    3584         111 :                           false);
    3585             :     SimpleInstallFunction(isolate_, reflect, "getOwnPropertyDescriptor",
    3586         111 :                           Builtins::kReflectGetOwnPropertyDescriptor, 2, true);
    3587             :     SimpleInstallFunction(isolate_, reflect, "getPrototypeOf",
    3588         111 :                           Builtins::kReflectGetPrototypeOf, 1, true);
    3589             :     SimpleInstallFunction(isolate_, reflect, "has", Builtins::kReflectHas, 2,
    3590         111 :                           true);
    3591             :     SimpleInstallFunction(isolate_, reflect, "isExtensible",
    3592         111 :                           Builtins::kReflectIsExtensible, 1, true);
    3593             :     SimpleInstallFunction(isolate_, reflect, "ownKeys",
    3594         111 :                           Builtins::kReflectOwnKeys, 1, true);
    3595             :     SimpleInstallFunction(isolate_, reflect, "preventExtensions",
    3596         111 :                           Builtins::kReflectPreventExtensions, 1, true);
    3597             :     SimpleInstallFunction(isolate_, reflect, "set", Builtins::kReflectSet, 3,
    3598         111 :                           false);
    3599             :     SimpleInstallFunction(isolate_, reflect, "setPrototypeOf",
    3600         111 :                           Builtins::kReflectSetPrototypeOf, 2, true);
    3601             :   }
    3602             : 
    3603             :   {  // --- B o u n d F u n c t i o n
    3604             :     Handle<Map> map =
    3605             :         factory->NewMap(JS_BOUND_FUNCTION_TYPE, JSBoundFunction::kSize,
    3606         111 :                         TERMINAL_FAST_ELEMENTS_KIND, 0);
    3607         222 :     map->SetConstructor(native_context()->object_function());
    3608             :     map->set_is_callable(true);
    3609         111 :     Map::SetPrototype(isolate(), map, empty_function);
    3610             : 
    3611             :     PropertyAttributes roc_attribs =
    3612             :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
    3613         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3614             : 
    3615             :     {  // length
    3616             :       Descriptor d = Descriptor::AccessorConstant(
    3617             :           factory->length_string(), factory->bound_function_length_accessor(),
    3618         111 :           roc_attribs);
    3619         111 :       map->AppendDescriptor(isolate(), &d);
    3620             :     }
    3621             : 
    3622             :     {  // name
    3623             :       Descriptor d = Descriptor::AccessorConstant(
    3624             :           factory->name_string(), factory->bound_function_name_accessor(),
    3625         111 :           roc_attribs);
    3626         111 :       map->AppendDescriptor(isolate(), &d);
    3627             :     }
    3628         111 :     native_context()->set_bound_function_without_constructor_map(*map);
    3629             : 
    3630         111 :     map = Map::Copy(isolate_, map, "IsConstructor");
    3631             :     map->set_is_constructor(true);
    3632         111 :     native_context()->set_bound_function_with_constructor_map(*map);
    3633             :   }
    3634             : 
    3635             :   {  // --- sloppy arguments map
    3636         111 :     Handle<String> arguments_string = factory->Arguments_string();
    3637             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    3638         111 :         arguments_string, isolate_->initial_object_prototype(),
    3639             :         JS_ARGUMENTS_TYPE, JSSloppyArgumentsObject::kSize, 2,
    3640         222 :         Builtins::kIllegal, MUTABLE);
    3641         111 :     Handle<JSFunction> function = factory->NewFunction(args);
    3642             :     Handle<Map> map(function->initial_map(), isolate());
    3643             : 
    3644             :     // Create the descriptor array for the arguments object.
    3645         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3646             : 
    3647             :     {  // length
    3648             :       Descriptor d =
    3649             :           Descriptor::DataField(isolate(), factory->length_string(),
    3650             :                                 JSSloppyArgumentsObject::kLengthIndex,
    3651         111 :                                 DONT_ENUM, Representation::Tagged());
    3652         111 :       map->AppendDescriptor(isolate(), &d);
    3653             :     }
    3654             :     {  // callee
    3655             :       Descriptor d =
    3656             :           Descriptor::DataField(isolate(), factory->callee_string(),
    3657             :                                 JSSloppyArgumentsObject::kCalleeIndex,
    3658         111 :                                 DONT_ENUM, Representation::Tagged());
    3659         111 :       map->AppendDescriptor(isolate(), &d);
    3660             :     }
    3661             :     // @@iterator method is added later.
    3662             : 
    3663         111 :     native_context()->set_sloppy_arguments_map(*map);
    3664             : 
    3665             :     DCHECK(!map->is_dictionary_map());
    3666             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3667             :   }
    3668             : 
    3669             :   {  // --- fast and slow aliased arguments map
    3670         111 :     Handle<Map> map = isolate_->sloppy_arguments_map();
    3671         111 :     map = Map::Copy(isolate_, map, "FastAliasedArguments");
    3672         111 :     map->set_elements_kind(FAST_SLOPPY_ARGUMENTS_ELEMENTS);
    3673             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3674         111 :     native_context()->set_fast_aliased_arguments_map(*map);
    3675             : 
    3676         111 :     map = Map::Copy(isolate_, map, "SlowAliasedArguments");
    3677         111 :     map->set_elements_kind(SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
    3678             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3679         111 :     native_context()->set_slow_aliased_arguments_map(*map);
    3680             :   }
    3681             : 
    3682             :   {  // --- strict mode arguments map
    3683             :     const PropertyAttributes attributes =
    3684             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3685             : 
    3686             :     // Create the ThrowTypeError function.
    3687         111 :     Handle<AccessorPair> callee = factory->NewAccessorPair();
    3688             : 
    3689         111 :     Handle<JSFunction> poison = GetThrowTypeErrorIntrinsic();
    3690             : 
    3691             :     // Install the ThrowTypeError function.
    3692         222 :     callee->set_getter(*poison);
    3693         222 :     callee->set_setter(*poison);
    3694             : 
    3695             :     // Create the map. Allocate one in-object field for length.
    3696             :     Handle<Map> map = factory->NewMap(
    3697         111 :         JS_ARGUMENTS_TYPE, JSStrictArgumentsObject::kSize, PACKED_ELEMENTS, 1);
    3698             :     // Create the descriptor array for the arguments object.
    3699         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3700             : 
    3701             :     {  // length
    3702             :       Descriptor d =
    3703             :           Descriptor::DataField(isolate(), factory->length_string(),
    3704             :                                 JSStrictArgumentsObject::kLengthIndex,
    3705         111 :                                 DONT_ENUM, Representation::Tagged());
    3706         111 :       map->AppendDescriptor(isolate(), &d);
    3707             :     }
    3708             :     {  // callee
    3709             :       Descriptor d = Descriptor::AccessorConstant(factory->callee_string(),
    3710         111 :                                                   callee, attributes);
    3711         111 :       map->AppendDescriptor(isolate(), &d);
    3712             :     }
    3713             :     // @@iterator method is added later.
    3714             : 
    3715             :     DCHECK_EQ(native_context()->object_function()->prototype(),
    3716             :               *isolate_->initial_object_prototype());
    3717         222 :     Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
    3718             : 
    3719             :     // Copy constructor from the sloppy arguments boilerplate.
    3720         333 :     map->SetConstructor(
    3721         333 :         native_context()->sloppy_arguments_map()->GetConstructor());
    3722             : 
    3723         111 :     native_context()->set_strict_arguments_map(*map);
    3724             : 
    3725             :     DCHECK(!map->is_dictionary_map());
    3726             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3727             :   }
    3728             : 
    3729             :   {  // --- context extension
    3730             :     // Create a function for the context extension objects.
    3731             :     Handle<JSFunction> context_extension_fun =
    3732             :         CreateFunction(isolate_, factory->empty_string(),
    3733             :                        JS_CONTEXT_EXTENSION_OBJECT_TYPE, JSObject::kHeaderSize,
    3734         111 :                        0, factory->the_hole_value(), Builtins::kIllegal);
    3735         111 :     native_context()->set_context_extension_function(*context_extension_fun);
    3736             :   }
    3737             : 
    3738             :   {
    3739             :     // Set up the call-as-function delegate.
    3740             :     Handle<JSFunction> delegate =
    3741             :         SimpleCreateFunction(isolate_, factory->empty_string(),
    3742         111 :                              Builtins::kHandleApiCallAsFunction, 0, false);
    3743         111 :     native_context()->set_call_as_function_delegate(*delegate);
    3744             :   }
    3745             : 
    3746             :   {
    3747             :     // Set up the call-as-constructor delegate.
    3748             :     Handle<JSFunction> delegate =
    3749             :         SimpleCreateFunction(isolate_, factory->empty_string(),
    3750         111 :                              Builtins::kHandleApiCallAsConstructor, 0, false);
    3751         111 :     native_context()->set_call_as_constructor_delegate(*delegate);
    3752             :   }
    3753         111 : }  // NOLINT(readability/fn_size)
    3754             : 
    3755        1221 : Handle<JSFunction> Genesis::InstallTypedArray(const char* name,
    3756             :                                               ElementsKind elements_kind) {
    3757             :   Handle<JSObject> global =
    3758        2442 :       Handle<JSObject>(native_context()->global_object(), isolate());
    3759             : 
    3760        1221 :   Handle<JSObject> typed_array_prototype = isolate()->typed_array_prototype();
    3761        1221 :   Handle<JSFunction> typed_array_function = isolate()->typed_array_function();
    3762             : 
    3763             :   Handle<JSFunction> result = InstallFunction(
    3764             :       isolate(), global, name, JS_TYPED_ARRAY_TYPE,
    3765             :       JSTypedArray::kSizeWithEmbedderFields, 0, factory()->the_hole_value(),
    3766        1221 :       Builtins::kTypedArrayConstructor);
    3767        2442 :   result->initial_map()->set_elements_kind(elements_kind);
    3768             : 
    3769             :   result->shared()->DontAdaptArguments();
    3770             :   result->shared()->set_length(3);
    3771             : 
    3772        2442 :   CHECK(JSObject::SetPrototype(result, typed_array_function, false, kDontThrow)
    3773             :             .FromJust());
    3774             : 
    3775             :   Handle<Smi> bytes_per_element(
    3776        1221 :       Smi::FromInt(1 << ElementsKindToShiftSize(elements_kind)), isolate());
    3777             : 
    3778        1221 :   InstallConstant(isolate(), result, "BYTES_PER_ELEMENT", bytes_per_element);
    3779             : 
    3780             :   // Setup prototype object.
    3781             :   DCHECK(result->prototype()->IsJSObject());
    3782        2442 :   Handle<JSObject> prototype(JSObject::cast(result->prototype()), isolate());
    3783             : 
    3784        2442 :   CHECK(JSObject::SetPrototype(prototype, typed_array_prototype, false,
    3785             :                                kDontThrow)
    3786             :             .FromJust());
    3787             : 
    3788        1221 :   InstallConstant(isolate(), prototype, "BYTES_PER_ELEMENT", bytes_per_element);
    3789        1221 :   return result;
    3790             : }
    3791             : 
    3792             : 
    3793       91453 : void Genesis::InitializeExperimentalGlobal() {
    3794             : #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
    3795             : 
    3796       91453 :   HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
    3797       91453 :   HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
    3798       91453 :   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
    3799             : #undef FEATURE_INITIALIZE_GLOBAL
    3800       91453 : }
    3801             : 
    3802         111 : bool Bootstrapper::CompileExtraBuiltin(Isolate* isolate, int index) {
    3803             :   HandleScope scope(isolate);
    3804         111 :   Vector<const char> name = ExtraNatives::GetScriptName(index);
    3805             :   Handle<String> source_code =
    3806         111 :       isolate->bootstrapper()->GetNativeSource(EXTRAS, index);
    3807         111 :   Handle<Object> global = isolate->global_object();
    3808         111 :   Handle<Object> binding = isolate->extras_binding_object();
    3809         111 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3810         111 :   Handle<Object> args[] = {global, binding, extras_utils};
    3811             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3812         222 :                                      arraysize(args), args, EXTENSION_CODE);
    3813             : }
    3814             : 
    3815             : 
    3816         111 : bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
    3817             :                                  Handle<String> source, int argc,
    3818             :                                  Handle<Object> argv[],
    3819             :                                  NativesFlag natives_flag) {
    3820             :   SuppressDebug compiling_natives(isolate->debug());
    3821             : 
    3822             :   Handle<Context> context(isolate->context(), isolate);
    3823             :   Handle<String> script_name =
    3824         222 :       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
    3825             :   MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3826             :       Compiler::GetSharedFunctionInfoForScript(
    3827             :           isolate, source, Compiler::ScriptDetails(script_name),
    3828             :           ScriptOriginOptions(), nullptr, nullptr,
    3829             :           ScriptCompiler::kNoCompileOptions, ScriptCompiler::kNoCacheNoReason,
    3830         111 :           natives_flag);
    3831             :   Handle<SharedFunctionInfo> function_info;
    3832         111 :   if (!maybe_function_info.ToHandle(&function_info)) return false;
    3833             : 
    3834             :   DCHECK(context->IsNativeContext());
    3835             : 
    3836             :   Handle<JSFunction> fun =
    3837             :       isolate->factory()->NewFunctionFromSharedFunctionInfo(function_info,
    3838         111 :                                                             context);
    3839             :   Handle<Object> receiver = isolate->factory()->undefined_value();
    3840             : 
    3841             :   // For non-extension scripts, run script to get the function wrapper.
    3842             :   Handle<Object> wrapper;
    3843         333 :   if (!Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3844         111 :                           Execution::MessageHandling::kKeepPending, nullptr)
    3845             :            .ToHandle(&wrapper)) {
    3846             :     return false;
    3847             :   }
    3848             :   // Then run the function wrapper.
    3849         222 :   return !Execution::TryCall(isolate, Handle<JSFunction>::cast(wrapper),
    3850             :                              receiver, argc, argv,
    3851         111 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3852         111 :               .is_null();
    3853             : }
    3854             : 
    3855             : 
    3856        4624 : bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
    3857             :   Factory* factory = isolate->factory();
    3858             :   HandleScope scope(isolate);
    3859             :   Handle<SharedFunctionInfo> function_info;
    3860             : 
    3861             :   Handle<String> source =
    3862             :       isolate->factory()
    3863        9257 :           ->NewExternalStringFromOneByte(extension->source())
    3864        4633 :           .ToHandleChecked();
    3865             :   DCHECK(source->IsOneByteRepresentation());
    3866             : 
    3867             :   // If we can't find the function in the cache, we compile a new
    3868             :   // function and insert it into the cache.
    3869        4633 :   Vector<const char> name = CStrVector(extension->name());
    3870             :   SourceCodeCache* cache = isolate->bootstrapper()->extensions_cache();
    3871             :   Handle<Context> context(isolate->context(), isolate);
    3872             :   DCHECK(context->IsNativeContext());
    3873             : 
    3874        4633 :   if (!cache->Lookup(isolate, name, &function_info)) {
    3875             :     Handle<String> script_name =
    3876        6556 :         factory->NewStringFromUtf8(name).ToHandleChecked();
    3877             :     MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3878             :         Compiler::GetSharedFunctionInfoForScript(
    3879             :             isolate, source, Compiler::ScriptDetails(script_name),
    3880             :             ScriptOriginOptions(), extension, nullptr,
    3881             :             ScriptCompiler::kNoCompileOptions,
    3882        3277 :             ScriptCompiler::kNoCacheBecauseV8Extension, EXTENSION_CODE);
    3883        3276 :     if (!maybe_function_info.ToHandle(&function_info)) return false;
    3884        3246 :     cache->Add(isolate, name, function_info);
    3885             :   }
    3886             : 
    3887             :   // Set up the function context. Conceptually, we should clone the
    3888             :   // function before overwriting the context but since we're in a
    3889             :   // single-threaded environment it is not strictly necessary.
    3890             :   Handle<JSFunction> fun =
    3891        4594 :       factory->NewFunctionFromSharedFunctionInfo(function_info, context);
    3892             : 
    3893             :   // Call function using either the runtime object or the global
    3894             :   // object as the receiver. Provide no parameters.
    3895        4591 :   Handle<Object> receiver = isolate->global_object();
    3896        9190 :   return !Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3897        4600 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3898        4600 :               .is_null();
    3899             : }
    3900             : 
    3901       91759 : void Genesis::ConfigureUtilsObject() {
    3902             :   // We still need the utils object after deserialization.
    3903       92065 :   if (isolate()->serializer_enabled()) return;
    3904             : 
    3905             :   // The utils object can be removed for cases that reach this point.
    3906       91453 :   HeapObject undefined = ReadOnlyRoots(heap()).undefined_value();
    3907       91453 :   native_context()->set_extras_utils_object(undefined);
    3908             : }
    3909             : 
    3910         111 : void Genesis::InitializeIteratorFunctions() {
    3911         111 :   Isolate* isolate = isolate_;
    3912             :   Factory* factory = isolate->factory();
    3913             :   HandleScope scope(isolate);
    3914         111 :   Handle<NativeContext> native_context = isolate->native_context();
    3915             :   Handle<JSObject> iterator_prototype(
    3916         222 :       native_context->initial_iterator_prototype(), isolate);
    3917             : 
    3918             :   {  // -- G e n e r a t o r
    3919         111 :     PrototypeIterator iter(isolate, native_context->generator_function_map());
    3920             :     Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>(),
    3921             :                                                   isolate);
    3922             :     Handle<JSFunction> generator_function_function = CreateFunction(
    3923             :         isolate, "GeneratorFunction", JS_FUNCTION_TYPE,
    3924             :         JSFunction::kSizeWithPrototype, 0, generator_function_prototype,
    3925         111 :         Builtins::kGeneratorFunctionConstructor);
    3926         222 :     generator_function_function->set_prototype_or_initial_map(
    3927         333 :         native_context->generator_function_map());
    3928             :     generator_function_function->shared()->DontAdaptArguments();
    3929             :     generator_function_function->shared()->set_length(1);
    3930             :     InstallWithIntrinsicDefaultProto(
    3931             :         isolate, generator_function_function,
    3932         111 :         Context::GENERATOR_FUNCTION_FUNCTION_INDEX);
    3933             : 
    3934         222 :     JSObject::ForceSetPrototype(generator_function_function,
    3935         111 :                                 isolate->function_function());
    3936         111 :     JSObject::AddProperty(
    3937             :         isolate, generator_function_prototype, factory->constructor_string(),
    3938             :         generator_function_function,
    3939         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3940             : 
    3941         333 :     native_context->generator_function_map()->SetConstructor(
    3942         111 :         *generator_function_function);
    3943             :   }
    3944             : 
    3945             :   {  // -- A s y n c G e n e r a t o r
    3946             :     PrototypeIterator iter(isolate,
    3947         111 :                            native_context->async_generator_function_map());
    3948             :     Handle<JSObject> async_generator_function_prototype(
    3949             :         iter.GetCurrent<JSObject>(), isolate);
    3950             : 
    3951             :     Handle<JSFunction> async_generator_function_function = CreateFunction(
    3952             :         isolate, "AsyncGeneratorFunction", JS_FUNCTION_TYPE,
    3953             :         JSFunction::kSizeWithPrototype, 0, async_generator_function_prototype,
    3954         111 :         Builtins::kAsyncGeneratorFunctionConstructor);
    3955         222 :     async_generator_function_function->set_prototype_or_initial_map(
    3956         333 :         native_context->async_generator_function_map());
    3957             :     async_generator_function_function->shared()->DontAdaptArguments();
    3958             :     async_generator_function_function->shared()->set_length(1);
    3959             :     InstallWithIntrinsicDefaultProto(
    3960             :         isolate, async_generator_function_function,
    3961         111 :         Context::ASYNC_GENERATOR_FUNCTION_FUNCTION_INDEX);
    3962             : 
    3963         222 :     JSObject::ForceSetPrototype(async_generator_function_function,
    3964         111 :                                 isolate->function_function());
    3965             : 
    3966         111 :     JSObject::AddProperty(
    3967             :         isolate, async_generator_function_prototype,
    3968             :         factory->constructor_string(), async_generator_function_function,
    3969         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3970             : 
    3971         333 :     native_context->async_generator_function_map()->SetConstructor(
    3972         111 :         *async_generator_function_function);
    3973             :   }
    3974             : 
    3975             :   {  // -- S e t I t e r a t o r
    3976             :     // Setup %SetIteratorPrototype%.
    3977             :     Handle<JSObject> prototype =
    3978         111 :         factory->NewJSObject(isolate->object_function(), AllocationType::kOld);
    3979         111 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    3980             : 
    3981         111 :     InstallToStringTag(isolate, prototype, factory->SetIterator_string());
    3982             : 
    3983             :     // Install the next function on the {prototype}.
    3984             :     InstallFunctionWithBuiltinId(isolate, prototype, "next",
    3985         111 :                                  Builtins::kSetIteratorPrototypeNext, 0, true);
    3986         111 :     native_context->set_initial_set_iterator_prototype(*prototype);
    3987             : 
    3988             :     // Setup SetIterator constructor.
    3989             :     Handle<JSFunction> set_iterator_function =
    3990             :         CreateFunction(isolate, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
    3991         111 :                        JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
    3992         111 :     set_iterator_function->shared()->set_native(false);
    3993             : 
    3994             :     Handle<Map> set_value_iterator_map(set_iterator_function->initial_map(),
    3995             :                                        isolate);
    3996         111 :     native_context->set_set_value_iterator_map(*set_value_iterator_map);
    3997             : 
    3998             :     Handle<Map> set_key_value_iterator_map = Map::Copy(
    3999         111 :         isolate, set_value_iterator_map, "JS_SET_KEY_VALUE_ITERATOR_TYPE");
    4000             :     set_key_value_iterator_map->set_instance_type(
    4001             :         JS_SET_KEY_VALUE_ITERATOR_TYPE);
    4002         111 :     native_context->set_set_key_value_iterator_map(*set_key_value_iterator_map);
    4003             :   }
    4004             : 
    4005             :   {  // -- M a p I t e r a t o r
    4006             :     // Setup %MapIteratorPrototype%.
    4007             :     Handle<JSObject> prototype =
    4008         111 :         factory->NewJSObject(isolate->object_function(), AllocationType::kOld);
    4009         111 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4010             : 
    4011         111 :     InstallToStringTag(isolate, prototype, factory->MapIterator_string());
    4012             : 
    4013             :     // Install the next function on the {prototype}.
    4014             :     InstallFunctionWithBuiltinId(isolate, prototype, "next",
    4015         111 :                                  Builtins::kMapIteratorPrototypeNext, 0, true);
    4016         111 :     native_context->set_initial_map_iterator_prototype(*prototype);
    4017             : 
    4018             :     // Setup MapIterator constructor.
    4019             :     Handle<JSFunction> map_iterator_function =
    4020             :         CreateFunction(isolate, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
    4021         111 :                        JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
    4022         111 :     map_iterator_function->shared()->set_native(false);
    4023             : 
    4024             :     Handle<Map> map_key_iterator_map(map_iterator_function->initial_map(),
    4025             :                                      isolate);
    4026         111 :     native_context->set_map_key_iterator_map(*map_key_iterator_map);
    4027             : 
    4028             :     Handle<Map> map_key_value_iterator_map = Map::Copy(
    4029         111 :         isolate, map_key_iterator_map, "JS_MAP_KEY_VALUE_ITERATOR_TYPE");
    4030             :     map_key_value_iterator_map->set_instance_type(
    4031             :         JS_MAP_KEY_VALUE_ITERATOR_TYPE);
    4032         111 :     native_context->set_map_key_value_iterator_map(*map_key_value_iterator_map);
    4033             : 
    4034             :     Handle<Map> map_value_iterator_map =
    4035         111 :         Map::Copy(isolate, map_key_iterator_map, "JS_MAP_VALUE_ITERATOR_TYPE");
    4036             :     map_value_iterator_map->set_instance_type(JS_MAP_VALUE_ITERATOR_TYPE);
    4037         111 :     native_context->set_map_value_iterator_map(*map_value_iterator_map);
    4038             :   }
    4039             : 
    4040             :   {  // -- A s y n c F u n c t i o n
    4041             :     // Builtin functions for AsyncFunction.
    4042         111 :     PrototypeIterator iter(isolate, native_context->async_function_map());
    4043             :     Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>(),
    4044             :                                               isolate);
    4045             : 
    4046             :     Handle<JSFunction> async_function_constructor = CreateFunction(
    4047             :         isolate, "AsyncFunction", JS_FUNCTION_TYPE,
    4048             :         JSFunction::kSizeWithPrototype, 0, async_function_prototype,
    4049         111 :         Builtins::kAsyncFunctionConstructor);
    4050         222 :     async_function_constructor->set_prototype_or_initial_map(
    4051         333 :         native_context->async_function_map());
    4052             :     async_function_constructor->shared()->DontAdaptArguments();
    4053             :     async_function_constructor->shared()->set_length(1);
    4054         111 :     native_context->set_async_function_constructor(*async_function_constructor);
    4055         222 :     JSObject::ForceSetPrototype(async_function_constructor,
    4056         111 :                                 isolate->function_function());
    4057             : 
    4058         111 :     JSObject::AddProperty(
    4059             :         isolate, async_function_prototype, factory->constructor_string(),
    4060             :         async_function_constructor,
    4061         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4062             : 
    4063         111 :     JSFunction::SetPrototype(async_function_constructor,
    4064         111 :                              async_function_prototype);
    4065             : 
    4066             :     // Async functions don't have a prototype, but they use generator objects
    4067             :     // under the hood to model the suspend/resume (in await). Instead of using
    4068             :     // the "prototype" / initial_map machinery (like for (async) generators),
    4069             :     // there's one global (per native context) map here that is used for the
    4070             :     // async function generator objects. These objects never escape to user
    4071             :     // JavaScript anyways.
    4072             :     Handle<Map> async_function_object_map = factory->NewMap(
    4073         111 :         JS_ASYNC_FUNCTION_OBJECT_TYPE, JSAsyncFunctionObject::kSize);
    4074         111 :     native_context->set_async_function_object_map(*async_function_object_map);
    4075             : 
    4076             :     {
    4077             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4078             :           isolate, Builtins::kAsyncFunctionAwaitRejectClosure,
    4079         111 :           factory->empty_string(), 1);
    4080         111 :       native_context->set_async_function_await_reject_shared_fun(*info);
    4081             :     }
    4082             : 
    4083             :     {
    4084             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4085             :           isolate, Builtins::kAsyncFunctionAwaitResolveClosure,
    4086         111 :           factory->empty_string(), 1);
    4087         111 :       native_context->set_async_function_await_resolve_shared_fun(*info);
    4088             :     }
    4089             :   }
    4090         111 : }
    4091             : 
    4092         111 : void Genesis::InitializeCallSiteBuiltins() {
    4093             :   Factory* factory = isolate()->factory();
    4094             :   HandleScope scope(isolate());
    4095             :   // -- C a l l S i t e
    4096             :   // Builtin functions for CallSite.
    4097             : 
    4098             :   // CallSites are a special case; the constructor is for our private use
    4099             :   // only, therefore we set it up as a builtin that throws. Internally, we use
    4100             :   // CallSiteUtils::Construct to create CallSite objects.
    4101             : 
    4102             :   Handle<JSFunction> callsite_fun = CreateFunction(
    4103             :       isolate(), "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize, 0,
    4104         111 :       factory->the_hole_value(), Builtins::kUnsupportedThrower);
    4105             :   callsite_fun->shared()->DontAdaptArguments();
    4106         222 :   isolate()->native_context()->set_callsite_function(*callsite_fun);
    4107             : 
    4108             :   // Setup CallSite.prototype.
    4109         222 :   Handle<JSObject> prototype(JSObject::cast(callsite_fun->instance_prototype()),
    4110             :                              isolate());
    4111             : 
    4112             :   struct FunctionInfo {
    4113             :     const char* name;
    4114             :     Builtins::Name id;
    4115             :   };
    4116             : 
    4117             :   FunctionInfo infos[] = {
    4118             :       {"getColumnNumber", Builtins::kCallSitePrototypeGetColumnNumber},
    4119             :       {"getEvalOrigin", Builtins::kCallSitePrototypeGetEvalOrigin},
    4120             :       {"getFileName", Builtins::kCallSitePrototypeGetFileName},
    4121             :       {"getFunction", Builtins::kCallSitePrototypeGetFunction},
    4122             :       {"getFunctionName", Builtins::kCallSitePrototypeGetFunctionName},
    4123             :       {"getLineNumber", Builtins::kCallSitePrototypeGetLineNumber},
    4124             :       {"getMethodName", Builtins::kCallSitePrototypeGetMethodName},
    4125             :       {"getPosition", Builtins::kCallSitePrototypeGetPosition},
    4126             :       {"getPromiseIndex", Builtins::kCallSitePrototypeGetPromiseIndex},
    4127             :       {"getScriptNameOrSourceURL",
    4128             :        Builtins::kCallSitePrototypeGetScriptNameOrSourceURL},
    4129             :       {"getThis", Builtins::kCallSitePrototypeGetThis},
    4130             :       {"getTypeName", Builtins::kCallSitePrototypeGetTypeName},
    4131             :       {"isAsync", Builtins::kCallSitePrototypeIsAsync},
    4132             :       {"isConstructor", Builtins::kCallSitePrototypeIsConstructor},
    4133             :       {"isEval", Builtins::kCallSitePrototypeIsEval},
    4134             :       {"isNative", Builtins::kCallSitePrototypeIsNative},
    4135             :       {"isPromiseAll", Builtins::kCallSitePrototypeIsPromiseAll},
    4136             :       {"isToplevel", Builtins::kCallSitePrototypeIsToplevel},
    4137         111 :       {"toString", Builtins::kCallSitePrototypeToString}};
    4138             : 
    4139             :   PropertyAttributes attrs =
    4140             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    4141             : 
    4142             :   Handle<JSFunction> fun;
    4143        4329 :   for (const FunctionInfo& info : infos) {
    4144        2109 :     SimpleInstallFunction(isolate(), prototype, info.name, info.id, 0, true,
    4145        2109 :                           attrs);
    4146             :   }
    4147         111 : }
    4148             : 
    4149             : #define EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(id) \
    4150             :   void Genesis::InitializeGlobal_##id() {}
    4151             : 
    4152           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_namespace_exports)
    4153           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_public_fields)
    4154           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_fields)
    4155           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_methods)
    4156           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_static_fields)
    4157           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_class_fields)
    4158           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
    4159           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_meta)
    4160           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_numeric_separator)
    4161           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_json_stringify)
    4162           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_sequence)
    4163           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_await_optimization)
    4164           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_hashbang)
    4165             : 
    4166             : #ifdef V8_INTL_SUPPORT
    4167           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_bigint)
    4168           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_datetime_style)
    4169             : #endif  // V8_INTL_SUPPORT
    4170             : 
    4171             : #undef EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE
    4172             : 
    4173       91453 : void Genesis::InitializeGlobal_harmony_global() {
    4174       91453 :   if (!FLAG_harmony_global) return;
    4175             : 
    4176             :   Factory* factory = isolate()->factory();
    4177      182906 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4178      182906 :   Handle<JSGlobalProxy> global_proxy(native_context()->global_proxy(),
    4179       91453 :                                      isolate());
    4180      182906 :   JSObject::AddProperty(isolate_, global, factory->globalThis_string(),
    4181       91453 :                         global_proxy, DONT_ENUM);
    4182             : }
    4183             : 
    4184       91453 : void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
    4185       91453 :   if (!FLAG_harmony_sharedarraybuffer) return;
    4186             : 
    4187      182905 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4188             : 
    4189      274355 :   JSObject::AddProperty(isolate_, global, "SharedArrayBuffer",
    4190       91452 :                         isolate()->shared_array_buffer_fun(), DONT_ENUM);
    4191             : 
    4192      274352 :   JSObject::AddProperty(isolate_, global, "Atomics",
    4193       91451 :                         isolate()->atomics_object(), DONT_ENUM);
    4194       91450 :   InstallToStringTag(isolate_, isolate()->atomics_object(), "Atomics");
    4195             : }
    4196             : 
    4197       91453 : void Genesis::InitializeGlobal_harmony_string_matchall() {
    4198       91453 :   if (!FLAG_harmony_string_matchall) return;
    4199             : 
    4200             :   {  // String.prototype.matchAll
    4201      182906 :     Handle<JSFunction> string_fun(native_context()->string_function(),
    4202       91453 :                                   isolate());
    4203             :     Handle<JSObject> string_prototype(
    4204      182906 :         JSObject::cast(string_fun->instance_prototype()), isolate());
    4205             : 
    4206             :     SimpleInstallFunction(isolate(), string_prototype, "matchAll",
    4207       91453 :                           Builtins::kStringPrototypeMatchAll, 1, true);
    4208             :   }
    4209             : 
    4210             :   {  // RegExp.prototype[@@matchAll]
    4211      182906 :     Handle<JSFunction> regexp_fun(native_context()->regexp_function(),
    4212       91453 :                                   isolate());
    4213             :     Handle<JSObject> regexp_prototype(
    4214      182906 :         JSObject::cast(regexp_fun->instance_prototype()), isolate());
    4215             :     InstallFunctionAtSymbol(isolate(), regexp_prototype,
    4216             :                             factory()->match_all_symbol(), "[Symbol.matchAll]",
    4217       91453 :                             Builtins::kRegExpPrototypeMatchAll, 1, true);
    4218             :     DCHECK_EQ(JSRegExp::kSymbolMatchAllFunctionDescriptorIndex,
    4219             :               regexp_prototype->map()->LastAdded());
    4220             : 
    4221             :     Handle<Map> regexp_prototype_map(regexp_prototype->map(), isolate());
    4222       91453 :     Map::SetShouldBeFastPrototypeMap(regexp_prototype_map, true, isolate());
    4223       91453 :     native_context()->set_regexp_prototype_map(*regexp_prototype_map);
    4224             :   }
    4225             : 
    4226             :   {  // --- R e g E x p S t r i n g  I t e r a t o r ---
    4227             :     Handle<JSObject> iterator_prototype(
    4228      182906 :         native_context()->initial_iterator_prototype(), isolate());
    4229             : 
    4230             :     Handle<JSObject> regexp_string_iterator_prototype = factory()->NewJSObject(
    4231       91453 :         isolate()->object_function(), AllocationType::kOld);
    4232       91453 :     JSObject::ForceSetPrototype(regexp_string_iterator_prototype,
    4233       91453 :                                 iterator_prototype);
    4234             : 
    4235             :     InstallToStringTag(isolate(), regexp_string_iterator_prototype,
    4236             :                        "RegExp String Iterator");
    4237             : 
    4238             :     SimpleInstallFunction(isolate(), regexp_string_iterator_prototype, "next",
    4239             :                           Builtins::kRegExpStringIteratorPrototypeNext, 0,
    4240       91451 :                           true);
    4241             : 
    4242             :     Handle<JSFunction> regexp_string_iterator_function = CreateFunction(
    4243             :         isolate(), "RegExpStringIterator", JS_REGEXP_STRING_ITERATOR_TYPE,
    4244             :         JSRegExpStringIterator::kSize, 0, regexp_string_iterator_prototype,
    4245       91453 :         Builtins::kIllegal);
    4246       91453 :     regexp_string_iterator_function->shared()->set_native(false);
    4247      182906 :     native_context()->set_initial_regexp_string_iterator_prototype_map(
    4248       91453 :         regexp_string_iterator_function->initial_map());
    4249             :   }
    4250             : 
    4251             :   {  // @@matchAll Symbol
    4252      182906 :     Handle<JSFunction> symbol_fun(native_context()->symbol_function(),
    4253       91453 :                                   isolate());
    4254       91453 :     InstallConstant(isolate(), symbol_fun, "matchAll",
    4255       91453 :                     factory()->match_all_symbol());
    4256             :   }
    4257             : }
    4258             : 
    4259       91453 : void Genesis::InitializeGlobal_harmony_weak_refs() {
    4260       91453 :   if (!FLAG_harmony_weak_refs) return;
    4261             : 
    4262             :   Factory* factory = isolate()->factory();
    4263         882 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4264             : 
    4265             :   {
    4266             :     // Create %FinalizationGroupPrototype%
    4267             :     Handle<String> finalization_group_name =
    4268         441 :         factory->NewStringFromStaticChars("FinalizationGroup");
    4269             :     Handle<JSObject> finalization_group_prototype = factory->NewJSObject(
    4270         441 :         isolate()->object_function(), AllocationType::kOld);
    4271             : 
    4272             :     // Create %FinalizationGroup%
    4273             :     Handle<JSFunction> finalization_group_fun = CreateFunction(
    4274             :         isolate(), finalization_group_name, JS_FINALIZATION_GROUP_TYPE,
    4275             :         JSFinalizationGroup::kSize, 0, finalization_group_prototype,
    4276         441 :         Builtins::kFinalizationGroupConstructor);
    4277             : 
    4278             :     finalization_group_fun->shared()->DontAdaptArguments();
    4279             :     finalization_group_fun->shared()->set_length(1);
    4280             : 
    4281             :     // Install the "constructor" property on the prototype.
    4282         441 :     JSObject::AddProperty(isolate(), finalization_group_prototype,
    4283             :                           factory->constructor_string(), finalization_group_fun,
    4284         441 :                           DONT_ENUM);
    4285             : 
    4286             :     InstallToStringTag(isolate(), finalization_group_prototype,
    4287         441 :                        finalization_group_name);
    4288             : 
    4289         441 :     JSObject::AddProperty(isolate(), global, finalization_group_name,
    4290         441 :                           finalization_group_fun, DONT_ENUM);
    4291             : 
    4292             :     SimpleInstallFunction(isolate(), finalization_group_prototype, "register",
    4293         441 :                           Builtins::kFinalizationGroupRegister, 3, false);
    4294             : 
    4295             :     SimpleInstallFunction(isolate(), finalization_group_prototype, "unregister",
    4296         441 :                           Builtins::kFinalizationGroupUnregister, 1, false);
    4297             : 
    4298             :     SimpleInstallFunction(isolate(), finalization_group_prototype,
    4299             :                           "cleanupSome",
    4300         441 :                           Builtins::kFinalizationGroupCleanupSome, 0, false);
    4301             :   }
    4302             :   {
    4303             :     // Create %WeakRefPrototype%
    4304             :     Handle<Map> weak_ref_map =
    4305         441 :         factory->NewMap(JS_WEAK_REF_TYPE, JSWeakRef::kSize);
    4306             :     DCHECK(weak_ref_map->IsJSObjectMap());
    4307         441 :     native_context()->set_js_weak_ref_map(*weak_ref_map);
    4308             : 
    4309             :     Handle<JSObject> weak_ref_prototype = factory->NewJSObject(
    4310         441 :         isolate()->object_function(), AllocationType::kOld);
    4311         441 :     Map::SetPrototype(isolate(), weak_ref_map, weak_ref_prototype);
    4312             : 
    4313             :     InstallToStringTag(isolate(), weak_ref_prototype,
    4314         441 :                        factory->WeakRef_string());
    4315             : 
    4316             :     SimpleInstallFunction(isolate(), weak_ref_prototype, "deref",
    4317         441 :                           Builtins::kWeakRefDeref, 0, false);
    4318             : 
    4319             :     // Create %WeakRef%
    4320         441 :     Handle<String> weak_ref_name = factory->InternalizeUtf8String("WeakRef");
    4321             :     Handle<JSFunction> weak_ref_fun = CreateFunction(
    4322             :         isolate(), weak_ref_name, JS_WEAK_REF_TYPE, JSWeakRef::kSize, 0,
    4323         441 :         weak_ref_prototype, Builtins::kWeakRefConstructor);
    4324             : 
    4325             :     weak_ref_fun->shared()->DontAdaptArguments();
    4326             :     weak_ref_fun->shared()->set_length(1);
    4327             : 
    4328             :     // Install the "constructor" property on the prototype.
    4329         441 :     JSObject::AddProperty(isolate(), weak_ref_prototype,
    4330             :                           factory->constructor_string(), weak_ref_fun,
    4331         441 :                           DONT_ENUM);
    4332             : 
    4333         441 :     JSObject::AddProperty(isolate(), global, weak_ref_name, weak_ref_fun,
    4334         441 :                           DONT_ENUM);
    4335             :   }
    4336             : 
    4337             :   {
    4338             :     // Create cleanup iterator for JSFinalizationGroup.
    4339             :     Handle<JSObject> iterator_prototype(
    4340         882 :         native_context()->initial_iterator_prototype(), isolate());
    4341             : 
    4342             :     Handle<JSObject> cleanup_iterator_prototype = factory->NewJSObject(
    4343         441 :         isolate()->object_function(), AllocationType::kOld);
    4344         441 :     JSObject::ForceSetPrototype(cleanup_iterator_prototype, iterator_prototype);
    4345             : 
    4346             :     InstallToStringTag(isolate(), cleanup_iterator_prototype,
    4347             :                        "JSFinalizationGroupCleanupIterator");
    4348             : 
    4349             :     SimpleInstallFunction(isolate(), cleanup_iterator_prototype, "next",
    4350             :                           Builtins::kFinalizationGroupCleanupIteratorNext, 0,
    4351         441 :                           true);
    4352             :     Handle<Map> cleanup_iterator_map =
    4353             :         factory->NewMap(JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE,
    4354         441 :                         JSFinalizationGroupCleanupIterator::kSize);
    4355         441 :     Map::SetPrototype(isolate(), cleanup_iterator_map,
    4356         441 :                       cleanup_iterator_prototype);
    4357         882 :     native_context()->set_js_finalization_group_cleanup_iterator_map(
    4358         441 :         *cleanup_iterator_map);
    4359             :   }
    4360             : }
    4361             : 
    4362       91453 : void Genesis::InitializeGlobal_harmony_promise_all_settled() {
    4363       91453 :   if (!FLAG_harmony_promise_all_settled) return;
    4364             :   SimpleInstallFunction(isolate(), isolate()->promise_function(), "allSettled",
    4365         666 :                         Builtins::kPromiseAllSettled, 1, false);
    4366             :   Factory* factory = isolate()->factory();
    4367             :   {
    4368             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4369             :         isolate_, Builtins::kPromiseAllSettledResolveElementClosure,
    4370         333 :         factory->empty_string(), 1);
    4371         333 :     native_context()->set_promise_all_settled_resolve_element_shared_fun(*info);
    4372             :   }
    4373             : 
    4374             :   {
    4375             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4376             :         isolate_, Builtins::kPromiseAllSettledRejectElementClosure,
    4377         333 :         factory->empty_string(), 1);
    4378         333 :     native_context()->set_promise_all_settled_reject_element_shared_fun(*info);
    4379             :   }
    4380             : }
    4381             : 
    4382             : #ifdef V8_INTL_SUPPORT
    4383             : 
    4384       91453 : void Genesis::InitializeGlobal_harmony_intl_date_format_range() {
    4385      182888 :   if (!FLAG_harmony_intl_date_format_range) return;
    4386             : 
    4387             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4388          36 :       JSReceiver::GetProperty(
    4389             :           isolate(),
    4390          36 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4391          54 :           factory()->InternalizeUtf8String("Intl"))
    4392             :           .ToHandleChecked());
    4393             : 
    4394             :   Handle<JSObject> date_time_format_object = Handle<JSObject>::cast(
    4395          36 :       JSReceiver::GetProperty(
    4396             :           isolate(), Handle<JSReceiver>(JSReceiver::cast(*intl), isolate()),
    4397          36 :           factory()->InternalizeUtf8String("DateTimeFormat"))
    4398             :           .ToHandleChecked());
    4399             : 
    4400             :   Handle<JSFunction> date_time_format_constructor =
    4401             :       Handle<JSFunction>(JSFunction::cast(*date_time_format_object), isolate());
    4402             : 
    4403             :   Handle<JSObject> prototype(
    4404          54 :       JSObject::cast(date_time_format_constructor->prototype()), isolate_);
    4405             : 
    4406             :   SimpleInstallFunction(isolate_, prototype, "formatRange",
    4407             :                         Builtins::kDateTimeFormatPrototypeFormatRange, 2,
    4408          18 :                         false);
    4409             :   SimpleInstallFunction(isolate_, prototype, "formatRangeToParts",
    4410             :                         Builtins::kDateTimeFormatPrototypeFormatRangeToParts, 2,
    4411          18 :                         false);
    4412             : }
    4413             : 
    4414       91453 : void Genesis::InitializeGlobal_harmony_locale() {
    4415       91453 :   if (!FLAG_harmony_locale) return;
    4416             : 
    4417             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4418      182906 :       JSReceiver::GetProperty(
    4419             :           isolate(),
    4420      182906 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4421      274359 :           factory()->InternalizeUtf8String("Intl"))
    4422       91453 :           .ToHandleChecked());
    4423             : 
    4424             :   Handle<JSFunction> locale_fun = InstallFunction(
    4425             :       isolate(), intl, "Locale", JS_INTL_LOCALE_TYPE, JSLocale::kSize, 0,
    4426       91453 :       factory()->the_hole_value(), Builtins::kLocaleConstructor);
    4427             :   InstallWithIntrinsicDefaultProto(isolate(), locale_fun,
    4428       91453 :                                    Context::INTL_LOCALE_FUNCTION_INDEX);
    4429             :   locale_fun->shared()->set_length(1);
    4430             :   locale_fun->shared()->DontAdaptArguments();
    4431             : 
    4432             :   // Setup %LocalePrototype%.
    4433      182905 :   Handle<JSObject> prototype(JSObject::cast(locale_fun->instance_prototype()),
    4434             :                              isolate());
    4435             : 
    4436             :   InstallToStringTag(isolate(), prototype, "Intl.Locale");
    4437             : 
    4438             :   SimpleInstallFunction(isolate(), prototype, "toString",
    4439       91452 :                         Builtins::kLocalePrototypeToString, 0, false);
    4440             :   SimpleInstallFunction(isolate(), prototype, "maximize",
    4441       91453 :                         Builtins::kLocalePrototypeMaximize, 0, false);
    4442             :   SimpleInstallFunction(isolate(), prototype, "minimize",
    4443       91453 :                         Builtins::kLocalePrototypeMinimize, 0, false);
    4444             :   // Base locale getters.
    4445             :   SimpleInstallGetter(isolate(), prototype, factory()->language_string(),
    4446       91453 :                       Builtins::kLocalePrototypeLanguage, true);
    4447             :   SimpleInstallGetter(isolate(), prototype, factory()->script_string(),
    4448       91453 :                       Builtins::kLocalePrototypeScript, true);
    4449             :   SimpleInstallGetter(isolate(), prototype, factory()->region_string(),
    4450       91453 :                       Builtins::kLocalePrototypeRegion, true);
    4451             :   SimpleInstallGetter(isolate(), prototype, factory()->baseName_string(),
    4452       91453 :                       Builtins::kLocalePrototypeBaseName, true);
    4453             :   // Unicode extension getters.
    4454             :   SimpleInstallGetter(isolate(), prototype, factory()->calendar_string(),
    4455       91453 :                       Builtins::kLocalePrototypeCalendar, true);
    4456             :   SimpleInstallGetter(isolate(), prototype, factory()->caseFirst_string(),
    4457       91453 :                       Builtins::kLocalePrototypeCaseFirst, true);
    4458             :   SimpleInstallGetter(isolate(), prototype, factory()->collation_string(),
    4459       91453 :                       Builtins::kLocalePrototypeCollation, true);
    4460             :   SimpleInstallGetter(isolate(), prototype, factory()->hourCycle_string(),
    4461       91453 :                       Builtins::kLocalePrototypeHourCycle, true);
    4462             :   SimpleInstallGetter(isolate(), prototype, factory()->numeric_string(),
    4463       91453 :                       Builtins::kLocalePrototypeNumeric, true);
    4464             :   SimpleInstallGetter(isolate(), prototype, factory()->numberingSystem_string(),
    4465       91453 :                       Builtins::kLocalePrototypeNumberingSystem, true);
    4466             : }
    4467             : 
    4468       91453 : void Genesis::InitializeGlobal_harmony_intl_segmenter() {
    4469      182321 :   if (!FLAG_harmony_intl_segmenter) return;
    4470             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4471        1170 :       JSReceiver::GetProperty(
    4472             :           isolate(),
    4473        1170 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4474        1755 :           factory()->InternalizeUtf8String("Intl"))
    4475         585 :           .ToHandleChecked());
    4476             : 
    4477             :   Handle<JSFunction> segmenter_fun = InstallFunction(
    4478             :       isolate(), intl, "Segmenter", JS_INTL_SEGMENTER_TYPE, JSSegmenter::kSize,
    4479         585 :       0, factory()->the_hole_value(), Builtins::kSegmenterConstructor);
    4480             :   segmenter_fun->shared()->set_length(0);
    4481             :   segmenter_fun->shared()->DontAdaptArguments();
    4482             : 
    4483             :   SimpleInstallFunction(isolate(), segmenter_fun, "supportedLocalesOf",
    4484         585 :                         Builtins::kSegmenterSupportedLocalesOf, 1, false);
    4485             : 
    4486             :   {
    4487             :     // Setup %SegmenterPrototype%.
    4488             :     Handle<JSObject> prototype(
    4489        1170 :         JSObject::cast(segmenter_fun->instance_prototype()), isolate());
    4490             : 
    4491             :     InstallToStringTag(isolate(), prototype, "Intl.Segmenter");
    4492             : 
    4493             :     SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    4494             :                           Builtins::kSegmenterPrototypeResolvedOptions, 0,
    4495         585 :                           false);
    4496             : 
    4497             :     SimpleInstallFunction(isolate(), prototype, "segment",
    4498         585 :                           Builtins::kSegmenterPrototypeSegment, 1, false);
    4499             :   }
    4500             : 
    4501             :   {
    4502             :     // Setup %SegmentIteratorPrototype%.
    4503             :     Handle<JSObject> iterator_prototype(
    4504        1170 :         native_context()->initial_iterator_prototype(), isolate());
    4505             : 
    4506             :     Handle<JSObject> prototype = factory()->NewJSObject(
    4507         585 :         isolate()->object_function(), AllocationType::kOld);
    4508         585 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4509             : 
    4510             :     InstallToStringTag(isolate(), prototype,
    4511         585 :                        factory()->SegmentIterator_string());
    4512             : 
    4513             :     SimpleInstallFunction(isolate(), prototype, "next",
    4514         585 :                           Builtins::kSegmentIteratorPrototypeNext, 0, false);
    4515             : 
    4516             :     SimpleInstallFunction(isolate(), prototype, "following",
    4517             :                           Builtins::kSegmentIteratorPrototypeFollowing, 0,
    4518         585 :                           false);
    4519             : 
    4520             :     SimpleInstallFunction(isolate(), prototype, "preceding",
    4521             :                           Builtins::kSegmentIteratorPrototypePreceding, 0,
    4522         585 :                           false);
    4523             : 
    4524             :     SimpleInstallGetter(isolate(), prototype, factory()->index_string(),
    4525         585 :                         Builtins::kSegmentIteratorPrototypeIndex, false);
    4526             : 
    4527             :     SimpleInstallGetter(isolate(), prototype, factory()->breakType_string(),
    4528         585 :                         Builtins::kSegmentIteratorPrototypeBreakType, false);
    4529             : 
    4530             :     // Setup SegmentIterator constructor.
    4531             :     Handle<String> name_string =
    4532        1170 :         Name::ToFunctionName(isolate(),
    4533         585 :                              isolate()->factory()->SegmentIterator_string())
    4534         585 :             .ToHandleChecked();
    4535             :     Handle<JSFunction> segment_iterator_fun = CreateFunction(
    4536             :         isolate(), name_string, JS_INTL_SEGMENT_ITERATOR_TYPE,
    4537         585 :         JSSegmentIterator::kSize, 0, prototype, Builtins::kIllegal);
    4538         585 :     segment_iterator_fun->shared()->set_native(false);
    4539             : 
    4540             :     Handle<Map> segment_iterator_map(segment_iterator_fun->initial_map(),
    4541             :                                      isolate());
    4542         585 :     native_context()->set_intl_segment_iterator_map(*segment_iterator_map);
    4543             :   }
    4544             : }
    4545             : 
    4546             : #endif  // V8_INTL_SUPPORT
    4547             : 
    4548       91453 : void Genesis::InitializeGlobal_harmony_object_from_entries() {
    4549       91453 :   if (!FLAG_harmony_object_from_entries) return;
    4550             :   SimpleInstallFunction(isolate(), isolate()->object_function(), "fromEntries",
    4551      182906 :                         Builtins::kObjectFromEntries, 1, false);
    4552             : }
    4553             : 
    4554         222 : Handle<JSFunction> Genesis::CreateArrayBuffer(
    4555             :     Handle<String> name, ArrayBufferKind array_buffer_kind) {
    4556             :   // Create the %ArrayBufferPrototype%
    4557             :   // Setup the {prototype} with the given {name} for @@toStringTag.
    4558             :   Handle<JSObject> prototype = factory()->NewJSObject(
    4559         222 :       isolate()->object_function(), AllocationType::kOld);
    4560         222 :   InstallToStringTag(isolate(), prototype, name);
    4561             : 
    4562             :   // Allocate the constructor with the given {prototype}.
    4563             :   Handle<JSFunction> array_buffer_fun =
    4564             :       CreateFunction(isolate(), name, JS_ARRAY_BUFFER_TYPE,
    4565             :                      JSArrayBuffer::kSizeWithEmbedderFields, 0, prototype,
    4566         222 :                      Builtins::kArrayBufferConstructor);
    4567             :   array_buffer_fun->shared()->DontAdaptArguments();
    4568             :   array_buffer_fun->shared()->set_length(1);
    4569             : 
    4570             :   // Install the "constructor" property on the {prototype}.
    4571         222 :   JSObject::AddProperty(isolate(), prototype, factory()->constructor_string(),
    4572         222 :                         array_buffer_fun, DONT_ENUM);
    4573             : 
    4574         222 :   switch (array_buffer_kind) {
    4575             :     case ARRAY_BUFFER:
    4576             :       InstallFunctionWithBuiltinId(isolate(), array_buffer_fun, "isView",
    4577         111 :                                    Builtins::kArrayBufferIsView, 1, true);
    4578             : 
    4579             :       // Install the "byteLength" getter on the {prototype}.
    4580             :       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
    4581         111 :                           Builtins::kArrayBufferPrototypeGetByteLength, false);
    4582             : 
    4583             :       SimpleInstallFunction(isolate(), prototype, "slice",
    4584         111 :                             Builtins::kArrayBufferPrototypeSlice, 2, true);
    4585         111 :       break;
    4586             : 
    4587             :     case SHARED_ARRAY_BUFFER:
    4588             :       // Install the "byteLength" getter on the {prototype}.
    4589             :       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
    4590             :                           Builtins::kSharedArrayBufferPrototypeGetByteLength,
    4591         111 :                           false);
    4592             : 
    4593             :       SimpleInstallFunction(isolate(), prototype, "slice",
    4594             :                             Builtins::kSharedArrayBufferPrototypeSlice, 2,
    4595         111 :                             true);
    4596         111 :       break;
    4597             :   }
    4598             : 
    4599         222 :   return array_buffer_fun;
    4600             : }
    4601             : 
    4602         666 : void Genesis::InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
    4603             :                                                  const char* function_name) {
    4604        1332 :   Handle<JSObject> array_prototype(native_context()->initial_array_prototype(),
    4605         666 :                                    isolate());
    4606             :   Handle<Object> func =
    4607        1332 :       JSReceiver::GetProperty(isolate(), array_prototype, function_name)
    4608         666 :           .ToHandleChecked();
    4609             :   JSObject::AddProperty(isolate(), prototype, function_name, func,
    4610         666 :                         ALL_ATTRIBUTES_MASK);
    4611         666 : }
    4612             : 
    4613         111 : void Genesis::InstallInternalPackedArray(Handle<JSObject> target,
    4614             :                                          const char* name) {
    4615             :   // --- I n t e r n a l   A r r a y ---
    4616             :   // An array constructor on the builtins object that works like
    4617             :   // the public Array constructor, except that its prototype
    4618             :   // doesn't inherit from Object.prototype.
    4619             :   // To be used only for internal work by builtins. Instances
    4620             :   // must not be leaked to user code.
    4621             :   Handle<JSObject> prototype = factory()->NewJSObject(
    4622         111 :       isolate()->object_function(), AllocationType::kOld);
    4623             :   Handle<JSFunction> array_function =
    4624             :       InstallFunction(isolate(), target, name, JS_ARRAY_TYPE, JSArray::kSize, 0,
    4625         111 :                       prototype, Builtins::kInternalArrayConstructor);
    4626             : 
    4627             :   array_function->shared()->DontAdaptArguments();
    4628             : 
    4629             :   Handle<Map> original_map(array_function->initial_map(), isolate());
    4630         111 :   Handle<Map> initial_map = Map::Copy(isolate(), original_map, "InternalArray");
    4631         111 :   initial_map->set_elements_kind(PACKED_ELEMENTS);
    4632         111 :   JSFunction::SetInitialMap(array_function, initial_map, prototype);
    4633             : 
    4634             :   // Make "length" magic on instances.
    4635         111 :   Map::EnsureDescriptorSlack(isolate(), initial_map, 1);
    4636             : 
    4637             :   PropertyAttributes attribs = static_cast<PropertyAttributes>(
    4638             :       DONT_ENUM | DONT_DELETE);
    4639             : 
    4640             :   {  // Add length.
    4641             :     Descriptor d = Descriptor::AccessorConstant(
    4642             :         factory()->length_string(), factory()->array_length_accessor(),
    4643         111 :         attribs);
    4644         111 :     initial_map->AppendDescriptor(isolate(), &d);
    4645             :   }
    4646             : 
    4647             :   JSObject::NormalizeProperties(
    4648             :       prototype, KEEP_INOBJECT_PROPERTIES, 6,
    4649         111 :       "OptimizeInternalPackedArrayPrototypeForAdding");
    4650         111 :   InstallInternalPackedArrayFunction(prototype, "push");
    4651         111 :   InstallInternalPackedArrayFunction(prototype, "pop");
    4652         111 :   InstallInternalPackedArrayFunction(prototype, "shift");
    4653         111 :   InstallInternalPackedArrayFunction(prototype, "unshift");
    4654         111 :   InstallInternalPackedArrayFunction(prototype, "splice");
    4655         111 :   InstallInternalPackedArrayFunction(prototype, "slice");
    4656             : 
    4657         111 :   JSObject::ForceSetPrototype(prototype, factory()->null_value());
    4658         111 :   JSObject::MigrateSlowToFast(prototype, 0, "Bootstrapping");
    4659         111 : }
    4660             : 
    4661         111 : bool Genesis::InstallNatives() {
    4662             :   HandleScope scope(isolate());
    4663             : 
    4664             :   // Set up the extras utils object as a shared container between native
    4665             :   // scripts and extras. (Extras consume things added there by native scripts.)
    4666         111 :   Handle<JSObject> extras_utils = factory()->NewJSObjectWithNullProto();
    4667         222 :   native_context()->set_extras_utils_object(*extras_utils);
    4668             : 
    4669         111 :   InstallInternalPackedArray(extras_utils, "InternalPackedArray");
    4670             : 
    4671             :   // Extras need the ability to store private state on their objects without
    4672             :   // exposing it to the outside world.
    4673             :   SimpleInstallFunction(isolate_, extras_utils, "createPrivateSymbol",
    4674         111 :                         Builtins::kExtrasUtilsCreatePrivateSymbol, 1, false);
    4675             : 
    4676             :   SimpleInstallFunction(isolate_, extras_utils, "uncurryThis",
    4677         111 :                         Builtins::kExtrasUtilsUncurryThis, 1, false);
    4678             : 
    4679             :   SimpleInstallFunction(isolate_, extras_utils, "markPromiseAsHandled",
    4680         111 :                         Builtins::kExtrasUtilsMarkPromiseAsHandled, 1, false);
    4681             : 
    4682             :   SimpleInstallFunction(isolate_, extras_utils, "promiseState",
    4683         111 :                         Builtins::kExtrasUtilsPromiseState, 1, false);
    4684             : 
    4685             :   // [[PromiseState]] values (for extrasUtils.promiseState())
    4686             :   // These values should be kept in sync with PromiseStatus in globals.h
    4687         111 :   JSObject::AddProperty(
    4688             :       isolate(), extras_utils, "kPROMISE_PENDING",
    4689             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kPending)),
    4690         111 :       DONT_ENUM);
    4691         111 :   JSObject::AddProperty(
    4692             :       isolate(), extras_utils, "kPROMISE_FULFILLED",
    4693             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kFulfilled)),
    4694         111 :       DONT_ENUM);
    4695         111 :   JSObject::AddProperty(
    4696             :       isolate(), extras_utils, "kPROMISE_REJECTED",
    4697             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kRejected)),
    4698         111 :       DONT_ENUM);
    4699             : 
    4700             :   // v8.createPromise(parent)
    4701             :   Handle<JSFunction> promise_internal_constructor =
    4702             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4703         111 :                            Builtins::kPromiseInternalConstructor, 1, true);
    4704         111 :   promise_internal_constructor->shared()->set_native(false);
    4705         111 :   JSObject::AddProperty(isolate(), extras_utils, "createPromise",
    4706         111 :                         promise_internal_constructor, DONT_ENUM);
    4707             : 
    4708             :   // v8.rejectPromise(promise, reason)
    4709             :   Handle<JSFunction> promise_internal_reject =
    4710             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4711         111 :                            Builtins::kPromiseInternalReject, 2, true);
    4712         111 :   promise_internal_reject->shared()->set_native(false);
    4713         111 :   JSObject::AddProperty(isolate(), extras_utils, "rejectPromise",
    4714         111 :                         promise_internal_reject, DONT_ENUM);
    4715             : 
    4716             :   // v8.resolvePromise(promise, resolution)
    4717             :   Handle<JSFunction> promise_internal_resolve =
    4718             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4719         111 :                            Builtins::kPromiseInternalResolve, 2, true);
    4720         111 :   promise_internal_resolve->shared()->set_native(false);
    4721         111 :   JSObject::AddProperty(isolate(), extras_utils, "resolvePromise",
    4722         111 :                         promise_internal_resolve, DONT_ENUM);
    4723             : 
    4724         222 :   JSObject::AddProperty(isolate(), extras_utils, "isPromise",
    4725         111 :                         isolate()->is_promise(), DONT_ENUM);
    4726             : 
    4727             :   JSObject::MigrateSlowToFast(Handle<JSObject>::cast(extras_utils), 0,
    4728         111 :                               "Bootstrapping");
    4729             : 
    4730             :   {
    4731             :     // Builtin function for OpaqueReference -- a JSValue-based object,
    4732             :     // that keeps its field isolated from JavaScript code. It may store
    4733             :     // objects, that JavaScript code may not access.
    4734             :     Handle<JSObject> prototype = factory()->NewJSObject(
    4735         111 :         isolate()->object_function(), AllocationType::kOld);
    4736             :     Handle<JSFunction> opaque_reference_fun =
    4737             :         CreateFunction(isolate(), factory()->empty_string(), JS_VALUE_TYPE,
    4738         111 :                        JSValue::kSize, 0, prototype, Builtins::kIllegal);
    4739         111 :     native_context()->set_opaque_reference_function(*opaque_reference_fun);
    4740             :   }
    4741             : 
    4742             :   auto fast_template_instantiations_cache = isolate()->factory()->NewFixedArray(
    4743         111 :       TemplateInfo::kFastTemplateInstantiationsCacheSize);
    4744         222 :   native_context()->set_fast_template_instantiations_cache(
    4745         111 :       *fast_template_instantiations_cache);
    4746             : 
    4747             :   auto slow_template_instantiations_cache = SimpleNumberDictionary::New(
    4748         111 :       isolate(), ApiNatives::kInitialFunctionCacheSize);
    4749         222 :   native_context()->set_slow_template_instantiations_cache(
    4750         111 :       *slow_template_instantiations_cache);
    4751             : 
    4752             :   // Store the map for the %ObjectPrototype% after the natives has been compiled
    4753             :   // and the Object function has been set up.
    4754             :   {
    4755         222 :     Handle<JSFunction> object_function(native_context()->object_function(),
    4756         111 :                                        isolate());
    4757             :     DCHECK(JSObject::cast(object_function->initial_map()->prototype())
    4758             :                ->HasFastProperties());
    4759         222 :     native_context()->set_object_function_prototype_map(
    4760         111 :         HeapObject::cast(object_function->initial_map()->prototype())->map());
    4761             :   }
    4762             : 
    4763             :   // Store the map for the %StringPrototype% after the natives has been compiled
    4764             :   // and the String function has been set up.
    4765         222 :   Handle<JSFunction> string_function(native_context()->string_function(),
    4766         111 :                                      isolate());
    4767             :   JSObject string_function_prototype =
    4768             :       JSObject::cast(string_function->initial_map()->prototype());
    4769             :   DCHECK(string_function_prototype->HasFastProperties());
    4770         222 :   native_context()->set_string_function_prototype_map(
    4771         111 :       string_function_prototype->map());
    4772             : 
    4773             :   Handle<JSGlobalObject> global_object =
    4774         222 :       handle(native_context()->global_object(), isolate());
    4775             : 
    4776             :   // Install Global.decodeURI.
    4777             :   InstallFunctionWithBuiltinId(isolate(), global_object, "decodeURI",
    4778         111 :                                Builtins::kGlobalDecodeURI, 1, false);
    4779             : 
    4780             :   // Install Global.decodeURIComponent.
    4781             :   InstallFunctionWithBuiltinId(isolate(), global_object, "decodeURIComponent",
    4782         111 :                                Builtins::kGlobalDecodeURIComponent, 1, false);
    4783             : 
    4784             :   // Install Global.encodeURI.
    4785             :   InstallFunctionWithBuiltinId(isolate(), global_object, "encodeURI",
    4786         111 :                                Builtins::kGlobalEncodeURI, 1, false);
    4787             : 
    4788             :   // Install Global.encodeURIComponent.
    4789             :   InstallFunctionWithBuiltinId(isolate(), global_object, "encodeURIComponent",
    4790         111 :                                Builtins::kGlobalEncodeURIComponent, 1, false);
    4791             : 
    4792             :   // Install Global.escape.
    4793             :   InstallFunctionWithBuiltinId(isolate(), global_object, "escape",
    4794         111 :                                Builtins::kGlobalEscape, 1, false);
    4795             : 
    4796             :   // Install Global.unescape.
    4797             :   InstallFunctionWithBuiltinId(isolate(), global_object, "unescape",
    4798         111 :                                Builtins::kGlobalUnescape, 1, false);
    4799             : 
    4800             :   // Install Global.eval.
    4801             :   {
    4802             :     Handle<JSFunction> eval = SimpleInstallFunction(
    4803         111 :         isolate(), global_object, "eval", Builtins::kGlobalEval, 1, false);
    4804         111 :     native_context()->set_global_eval_fun(*eval);
    4805             :   }
    4806             : 
    4807             :   // Install Global.isFinite
    4808             :   InstallFunctionWithBuiltinId(isolate(), global_object, "isFinite",
    4809         111 :                                Builtins::kGlobalIsFinite, 1, true);
    4810             : 
    4811             :   // Install Global.isNaN
    4812             :   InstallFunctionWithBuiltinId(isolate(), global_object, "isNaN",
    4813         111 :                                Builtins::kGlobalIsNaN, 1, true);
    4814             : 
    4815             :   // Install Array builtin functions.
    4816             :   {
    4817         222 :     Handle<JSFunction> array_constructor(native_context()->array_function(),
    4818         111 :                                          isolate());
    4819             :     Handle<JSArray> proto(JSArray::cast(array_constructor->prototype()),
    4820         222 :                           isolate());
    4821             : 
    4822             :     // Verification of important array prototype properties.
    4823             :     Object length = proto->length();
    4824         111 :     CHECK(length->IsSmi());
    4825         111 :     CHECK_EQ(Smi::ToInt(length), 0);
    4826         111 :     CHECK(proto->HasSmiOrObjectElements());
    4827             :     // This is necessary to enable fast checks for absence of elements
    4828             :     // on Array.prototype and below.
    4829         222 :     proto->set_elements(ReadOnlyRoots(heap()).empty_fixed_array());
    4830             :   }
    4831             : 
    4832             :   // Create a map for accessor property descriptors (a variant of JSObject
    4833             :   // that predefines four properties get, set, configurable and enumerable).
    4834             :   {
    4835             :     // AccessorPropertyDescriptor initial map.
    4836             :     Handle<Map> map =
    4837             :         factory()->NewMap(JS_OBJECT_TYPE, JSAccessorPropertyDescriptor::kSize,
    4838         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4839             :     // Create the descriptor array for the property descriptor object.
    4840         111 :     Map::EnsureDescriptorSlack(isolate(), map, 4);
    4841             : 
    4842             :     {  // get
    4843             :       Descriptor d =
    4844             :           Descriptor::DataField(isolate(), factory()->get_string(),
    4845             :                                 JSAccessorPropertyDescriptor::kGetIndex, NONE,
    4846         111 :                                 Representation::Tagged());
    4847         111 :       map->AppendDescriptor(isolate(), &d);
    4848             :     }
    4849             :     {  // set
    4850             :       Descriptor d =
    4851             :           Descriptor::DataField(isolate(), factory()->set_string(),
    4852             :                                 JSAccessorPropertyDescriptor::kSetIndex, NONE,
    4853         111 :                                 Representation::Tagged());
    4854         111 :       map->AppendDescriptor(isolate(), &d);
    4855             :     }
    4856             :     {  // enumerable
    4857             :       Descriptor d =
    4858             :           Descriptor::DataField(isolate(), factory()->enumerable_string(),
    4859             :                                 JSAccessorPropertyDescriptor::kEnumerableIndex,
    4860         111 :                                 NONE, Representation::Tagged());
    4861         111 :       map->AppendDescriptor(isolate(), &d);
    4862             :     }
    4863             :     {  // configurable
    4864             :       Descriptor d = Descriptor::DataField(
    4865             :           isolate(), factory()->configurable_string(),
    4866             :           JSAccessorPropertyDescriptor::kConfigurableIndex, NONE,
    4867         111 :           Representation::Tagged());
    4868         111 :       map->AppendDescriptor(isolate(), &d);
    4869             :     }
    4870             : 
    4871         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    4872         222 :     map->SetConstructor(native_context()->object_function());
    4873             : 
    4874         111 :     native_context()->set_accessor_property_descriptor_map(*map);
    4875             :   }
    4876             : 
    4877             :   // Create a map for data property descriptors (a variant of JSObject
    4878             :   // that predefines four properties value, writable, configurable and
    4879             :   // enumerable).
    4880             :   {
    4881             :     // DataPropertyDescriptor initial map.
    4882             :     Handle<Map> map =
    4883             :         factory()->NewMap(JS_OBJECT_TYPE, JSDataPropertyDescriptor::kSize,
    4884         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4885             :     // Create the descriptor array for the property descriptor object.
    4886         111 :     Map::EnsureDescriptorSlack(isolate(), map, 4);
    4887             : 
    4888             :     {  // value
    4889             :       Descriptor d =
    4890             :           Descriptor::DataField(isolate(), factory()->value_string(),
    4891             :                                 JSDataPropertyDescriptor::kValueIndex, NONE,
    4892         111 :                                 Representation::Tagged());
    4893         111 :       map->AppendDescriptor(isolate(), &d);
    4894             :     }
    4895             :     {  // writable
    4896             :       Descriptor d =
    4897             :           Descriptor::DataField(isolate(), factory()->writable_string(),
    4898             :                                 JSDataPropertyDescriptor::kWritableIndex, NONE,
    4899         111 :                                 Representation::Tagged());
    4900         111 :       map->AppendDescriptor(isolate(), &d);
    4901             :     }
    4902             :     {  // enumerable
    4903             :       Descriptor d =
    4904             :           Descriptor::DataField(isolate(), factory()->enumerable_string(),
    4905             :                                 JSDataPropertyDescriptor::kEnumerableIndex,
    4906         111 :                                 NONE, Representation::Tagged());
    4907         111 :       map->AppendDescriptor(isolate(), &d);
    4908             :     }
    4909             :     {  // configurable
    4910             :       Descriptor d =
    4911             :           Descriptor::DataField(isolate(), factory()->configurable_string(),
    4912             :                                 JSDataPropertyDescriptor::kConfigurableIndex,
    4913         111 :                                 NONE, Representation::Tagged());
    4914         111 :       map->AppendDescriptor(isolate(), &d);
    4915             :     }
    4916             : 
    4917         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    4918         222 :     map->SetConstructor(native_context()->object_function());
    4919             : 
    4920         111 :     native_context()->set_data_property_descriptor_map(*map);
    4921             :   }
    4922             : 
    4923             :   // Create a constructor for RegExp results (a variant of Array that
    4924             :   // predefines the properties index, input, and groups).
    4925             :   {
    4926             :     // JSRegExpResult initial map.
    4927             : 
    4928             :     // Find global.Array.prototype to inherit from.
    4929         222 :     Handle<JSFunction> array_constructor(native_context()->array_function(),
    4930         111 :                                          isolate());
    4931             :     Handle<JSObject> array_prototype(
    4932         222 :         JSObject::cast(array_constructor->instance_prototype()), isolate());
    4933             : 
    4934             :     // Add initial map.
    4935             :     Handle<Map> initial_map = factory()->NewMap(
    4936             :         JS_ARRAY_TYPE, JSRegExpResult::kSize, TERMINAL_FAST_ELEMENTS_KIND,
    4937         111 :         JSRegExpResult::kInObjectPropertyCount);
    4938         222 :     initial_map->SetConstructor(*array_constructor);
    4939             : 
    4940             :     // Set prototype on map.
    4941         111 :     initial_map->set_has_non_instance_prototype(false);
    4942         111 :     Map::SetPrototype(isolate(), initial_map, array_prototype);
    4943             : 
    4944             :     // Update map with length accessor from Array and add "index", "input" and
    4945             :     // "groups".
    4946             :     Map::EnsureDescriptorSlack(isolate(), initial_map,
    4947         111 :                                JSRegExpResult::kInObjectPropertyCount + 1);
    4948             : 
    4949             :     // length descriptor.
    4950             :     {
    4951         111 :       JSFunction array_function = native_context()->array_function();
    4952             :       Handle<DescriptorArray> array_descriptors(
    4953             :           array_function->initial_map()->instance_descriptors(), isolate());
    4954             :       Handle<String> length = factory()->length_string();
    4955         222 :       int old = array_descriptors->SearchWithCache(
    4956             :           isolate(), *length, array_function->initial_map());
    4957             :       DCHECK_NE(old, DescriptorArray::kNotFound);
    4958             :       Descriptor d = Descriptor::AccessorConstant(
    4959             :           length, handle(array_descriptors->GetStrongValue(old), isolate()),
    4960         222 :           array_descriptors->GetDetails(old).attributes());
    4961         111 :       initial_map->AppendDescriptor(isolate(), &d);
    4962             :     }
    4963             : 
    4964             :     // index descriptor.
    4965             :     {
    4966             :       Descriptor d = Descriptor::DataField(isolate(), factory()->index_string(),
    4967             :                                            JSRegExpResult::kIndexIndex, NONE,
    4968         111 :                                            Representation::Tagged());
    4969         111 :       initial_map->AppendDescriptor(isolate(), &d);
    4970             :     }
    4971             : 
    4972             :     // input descriptor.
    4973             :     {
    4974             :       Descriptor d = Descriptor::DataField(isolate(), factory()->input_string(),
    4975             :                                            JSRegExpResult::kInputIndex, NONE,
    4976         111 :                                            Representation::Tagged());
    4977         111 :       initial_map->AppendDescriptor(isolate(), &d);
    4978             :     }
    4979             : 
    4980             :     // groups descriptor.
    4981             :     {
    4982             :       Descriptor d = Descriptor::DataField(
    4983             :           isolate(), factory()->groups_string(), JSRegExpResult::kGroupsIndex,
    4984         111 :           NONE, Representation::Tagged());
    4985         111 :       initial_map->AppendDescriptor(isolate(), &d);
    4986             :     }
    4987             : 
    4988         111 :     native_context()->set_regexp_result_map(*initial_map);
    4989             :   }
    4990             : 
    4991             :   // Add @@iterator method to the arguments object maps.
    4992             :   {
    4993             :     PropertyAttributes attribs = DONT_ENUM;
    4994             :     Handle<AccessorInfo> arguments_iterator =
    4995             :         factory()->arguments_iterator_accessor();
    4996             :     {
    4997             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4998         111 :                                                   arguments_iterator, attribs);
    4999         222 :       Handle<Map> map(native_context()->sloppy_arguments_map(), isolate());
    5000         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5001         111 :       map->AppendDescriptor(isolate(), &d);
    5002             :     }
    5003             :     {
    5004             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5005         111 :                                                   arguments_iterator, attribs);
    5006         222 :       Handle<Map> map(native_context()->fast_aliased_arguments_map(),
    5007         111 :                       isolate());
    5008         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5009         111 :       map->AppendDescriptor(isolate(), &d);
    5010             :     }
    5011             :     {
    5012             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5013         111 :                                                   arguments_iterator, attribs);
    5014         222 :       Handle<Map> map(native_context()->slow_aliased_arguments_map(),
    5015         111 :                       isolate());
    5016         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5017         111 :       map->AppendDescriptor(isolate(), &d);
    5018             :     }
    5019             :     {
    5020             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5021         111 :                                                   arguments_iterator, attribs);
    5022         222 :       Handle<Map> map(native_context()->strict_arguments_map(), isolate());
    5023         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5024         111 :       map->AppendDescriptor(isolate(), &d);
    5025             :     }
    5026             :   }
    5027             : 
    5028         111 :   return true;
    5029             : }
    5030             : 
    5031         111 : bool Genesis::InstallExtraNatives() {
    5032             :   HandleScope scope(isolate());
    5033             : 
    5034         111 :   Handle<JSObject> extras_binding = factory()->NewJSObjectWithNullProto();
    5035             : 
    5036             :   // binding.isTraceCategoryEnabled(category)
    5037             :   SimpleInstallFunction(isolate(), extras_binding, "isTraceCategoryEnabled",
    5038         111 :                         Builtins::kIsTraceCategoryEnabled, 1, true);
    5039             : 
    5040             :   // binding.trace(phase, category, name, id, data)
    5041             :   SimpleInstallFunction(isolate(), extras_binding, "trace", Builtins::kTrace, 5,
    5042         111 :                         true);
    5043             : 
    5044         111 :   native_context()->set_extras_binding_object(*extras_binding);
    5045             : 
    5046         333 :   for (int i = 0; i < ExtraNatives::GetBuiltinsCount(); i++) {
    5047         111 :     if (!Bootstrapper::CompileExtraBuiltin(isolate(), i)) return false;
    5048             :   }
    5049             : 
    5050             :   return true;
    5051             : }
    5052             : 
    5053         111 : void Genesis::InitializeNormalizedMapCaches() {
    5054         111 :   Handle<NormalizedMapCache> cache = NormalizedMapCache::New(isolate());
    5055         222 :   native_context()->set_normalized_map_cache(*cache);
    5056         111 : }
    5057             : 
    5058             : 
    5059       91759 : bool Bootstrapper::InstallExtensions(Handle<Context> native_context,
    5060             :                                      v8::ExtensionConfiguration* extensions) {
    5061             :   // Don't install extensions into the snapshot.
    5062       91759 :   if (isolate_->serializer_enabled()) return true;
    5063             :   BootstrapperActive active(this);
    5064       91453 :   SaveAndSwitchContext saved_context(isolate_, *native_context);
    5065      182866 :   return Genesis::InstallExtensions(isolate_, native_context, extensions) &&
    5066       91413 :          Genesis::InstallSpecialObjects(isolate_, native_context);
    5067             : }
    5068             : 
    5069       91413 : bool Genesis::InstallSpecialObjects(Isolate* isolate,
    5070             :                                     Handle<Context> native_context) {
    5071             :   HandleScope scope(isolate);
    5072             : 
    5073       91413 :   Handle<JSObject> Error = isolate->error_function();
    5074             :   Handle<String> name = isolate->factory()->stackTraceLimit_string();
    5075       91413 :   Handle<Smi> stack_trace_limit(Smi::FromInt(FLAG_stack_trace_limit), isolate);
    5076       91413 :   JSObject::AddProperty(isolate, Error, name, stack_trace_limit, NONE);
    5077             : 
    5078       91412 :   if (FLAG_expose_wasm) {
    5079             :     // Install the internal data structures into the isolate and expose on
    5080             :     // the global object.
    5081       81697 :     WasmJs::Install(isolate, true);
    5082        9715 :   } else if (FLAG_validate_asm) {
    5083             :     // Install the internal data structures only; these are needed for asm.js
    5084             :     // translated to WASM to work correctly.
    5085          25 :     WasmJs::Install(isolate, false);
    5086             :   }
    5087             : 
    5088       91413 :   return true;
    5089             : }
    5090             : 
    5091             : 
    5092             : static uint32_t Hash(RegisteredExtension* extension) {
    5093             :   return v8::internal::ComputePointerHash(extension);
    5094             : }
    5095             : 
    5096           0 : Genesis::ExtensionStates::ExtensionStates() : map_(8) {}
    5097             : 
    5098        4698 : Genesis::ExtensionTraversalState Genesis::ExtensionStates::get_state(
    5099             :     RegisteredExtension* extension) {
    5100             :   base::HashMap::Entry* entry = map_.Lookup(extension, Hash(extension));
    5101        4698 :   if (entry == nullptr) {
    5102             :     return UNVISITED;
    5103             :   }
    5104             :   return static_cast<ExtensionTraversalState>(
    5105          59 :       reinterpret_cast<intptr_t>(entry->value));
    5106             : }
    5107             : 
    5108        9254 : void Genesis::ExtensionStates::set_state(RegisteredExtension* extension,
    5109             :                                          ExtensionTraversalState state) {
    5110       18508 :   map_.LookupOrInsert(extension, Hash(extension))->value =
    5111        9254 :       reinterpret_cast<void*>(static_cast<intptr_t>(state));
    5112        9254 : }
    5113             : 
    5114       91453 : bool Genesis::InstallExtensions(Isolate* isolate,
    5115             :                                 Handle<Context> native_context,
    5116             :                                 v8::ExtensionConfiguration* extensions) {
    5117             :   ExtensionStates extension_states;  // All extensions have state UNVISITED.
    5118      182906 :   return InstallAutoExtensions(isolate, &extension_states) &&
    5119       91453 :          (!FLAG_expose_free_buffer ||
    5120       91453 :           InstallExtension(isolate, "v8/free-buffer", &extension_states)) &&
    5121       94025 :          (!FLAG_expose_gc ||
    5122       94025 :           InstallExtension(isolate, "v8/gc", &extension_states)) &&
    5123       91575 :          (!FLAG_expose_externalize_string ||
    5124       91575 :           InstallExtension(isolate, "v8/externalize", &extension_states)) &&
    5125           0 :          (!TracingFlags::is_gc_stats_enabled() ||
    5126       91453 :           InstallExtension(isolate, "v8/statistics", &extension_states)) &&
    5127       91454 :          (!FLAG_expose_trigger_failure ||
    5128       91454 :           InstallExtension(isolate, "v8/trigger-failure", &extension_states)) &&
    5129       91462 :          (!FLAG_trace_ignition_dispatches ||
    5130           9 :           InstallExtension(isolate, "v8/ignition-statistics",
    5131      182905 :                            &extension_states)) &&
    5132      182905 :          InstallRequestedExtensions(isolate, extensions, &extension_states);
    5133             : }
    5134             : 
    5135             : 
    5136       91453 : bool Genesis::InstallAutoExtensions(Isolate* isolate,
    5137             :                                     ExtensionStates* extension_states) {
    5138      655038 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5139      746491 :        it != nullptr; it = it->next()) {
    5140      655058 :     if (it->extension()->auto_enable() &&
    5141          20 :         !InstallExtension(isolate, it, extension_states)) {
    5142             :       return false;
    5143             :     }
    5144             :   }
    5145             :   return true;
    5146             : }
    5147             : 
    5148             : 
    5149       91453 : bool Genesis::InstallRequestedExtensions(Isolate* isolate,
    5150             :                                          v8::ExtensionConfiguration* extensions,
    5151             :                                          ExtensionStates* extension_states) {
    5152       95095 :   for (const char** it = extensions->begin(); it != extensions->end(); ++it) {
    5153        1864 :     if (!InstallExtension(isolate, *it, extension_states)) return false;
    5154             :   }
    5155             :   return true;
    5156             : }
    5157             : 
    5158             : 
    5159             : // Installs a named extension.  This methods is unoptimized and does
    5160             : // not scale well if we want to support a large number of extensions.
    5161        4678 : bool Genesis::InstallExtension(Isolate* isolate,
    5162             :                                const char* name,
    5163             :                                ExtensionStates* extension_states) {
    5164       17520 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5165       22198 :        it != nullptr; it = it->next()) {
    5166       22198 :     if (strcmp(name, it->extension()->name()) == 0) {
    5167        4678 :       return InstallExtension(isolate, it, extension_states);
    5168             :     }
    5169             :   }
    5170             :   return Utils::ApiCheck(false,
    5171             :                          "v8::Context::New()",
    5172           0 :                          "Cannot find required extension");
    5173             : }
    5174             : 
    5175             : 
    5176        4699 : bool Genesis::InstallExtension(Isolate* isolate,
    5177             :                                v8::RegisteredExtension* current,
    5178             :                                ExtensionStates* extension_states) {
    5179             :   HandleScope scope(isolate);
    5180             : 
    5181        4699 :   if (extension_states->get_state(current) == INSTALLED) return true;
    5182             :   // The current node has already been visited so there must be a
    5183             :   // cycle in the dependency graph; fail.
    5184        4644 :   if (!Utils::ApiCheck(extension_states->get_state(current) != VISITED,
    5185             :                        "v8::Context::New()",
    5186             :                        "Circular extension dependency")) {
    5187             :     return false;
    5188             :   }
    5189             :   DCHECK(extension_states->get_state(current) == UNVISITED);
    5190        4639 :   extension_states->set_state(current, VISITED);
    5191             :   v8::Extension* extension = current->extension();
    5192             :   // Install the extension's dependencies
    5193        4827 :   for (int i = 0; i < extension->dependency_count(); i++) {
    5194         106 :     if (!InstallExtension(isolate,
    5195         106 :                           extension->dependencies()[i],
    5196             :                           extension_states)) {
    5197             :       return false;
    5198             :     }
    5199             :   }
    5200             :   // We do not expect this to throw an exception. Change this if it does.
    5201        4625 :   bool result = CompileExtension(isolate, extension);
    5202             :   DCHECK(isolate->has_pending_exception() != result);
    5203        4618 :   if (!result) {
    5204             :     // We print out the name of the extension that fail to install.
    5205             :     // When an error is thrown during bootstrapping we automatically print
    5206             :     // the line number at which this happened to the console in the isolate
    5207             :     // error throwing functionality.
    5208             :     base::OS::PrintError("Error installing extension '%s'.\n",
    5209          35 :                          current->extension()->name());
    5210             :     isolate->clear_pending_exception();
    5211             :   }
    5212        4618 :   extension_states->set_state(current, INSTALLED);
    5213        4620 :   return result;
    5214             : }
    5215             : 
    5216             : 
    5217       91719 : bool Genesis::ConfigureGlobalObjects(
    5218             :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
    5219      183438 :   Handle<JSObject> global_proxy(native_context()->global_proxy(), isolate());
    5220      183437 :   Handle<JSObject> global_object(native_context()->global_object(), isolate());
    5221             : 
    5222       91718 :   if (!global_proxy_template.IsEmpty()) {
    5223             :     // Configure the global proxy object.
    5224             :     Handle<ObjectTemplateInfo> global_proxy_data =
    5225             :         v8::Utils::OpenHandle(*global_proxy_template);
    5226       56308 :     if (!ConfigureApiObject(global_proxy, global_proxy_data)) return false;
    5227             : 
    5228             :     // Configure the global object.
    5229             :     Handle<FunctionTemplateInfo> proxy_constructor(
    5230             :         FunctionTemplateInfo::cast(global_proxy_data->constructor()),
    5231             :         isolate());
    5232       56308 :     if (!proxy_constructor->GetPrototypeTemplate()->IsUndefined(isolate())) {
    5233             :       Handle<ObjectTemplateInfo> global_object_data(
    5234             :           ObjectTemplateInfo::cast(proxy_constructor->GetPrototypeTemplate()),
    5235             :           isolate());
    5236       56308 :       if (!ConfigureApiObject(global_object, global_object_data)) return false;
    5237             :     }
    5238             :   }
    5239             : 
    5240       91718 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5241             : 
    5242      183437 :   native_context()->set_array_buffer_map(
    5243      275155 :       native_context()->array_buffer_fun()->initial_map());
    5244             : 
    5245      183437 :   Handle<JSFunction> js_map_fun(native_context()->js_map_fun(), isolate());
    5246      183436 :   Handle<JSFunction> js_set_fun(native_context()->js_set_fun(), isolate());
    5247             :   // Force the Map/Set constructor to fast properties, so that we can use the
    5248             :   // fast paths for various things like
    5249             :   //
    5250             :   //   x instanceof Map
    5251             :   //   x instanceof Set
    5252             :   //
    5253             :   // etc. We should probably come up with a more principled approach once
    5254             :   // the JavaScript builtins are gone.
    5255       91718 :   JSObject::MigrateSlowToFast(js_map_fun, 0, "Bootstrapping");
    5256       91718 :   JSObject::MigrateSlowToFast(js_set_fun, 0, "Bootstrapping");
    5257             : 
    5258       91719 :   native_context()->set_js_map_map(js_map_fun->initial_map());
    5259       91719 :   native_context()->set_js_set_map(js_set_fun->initial_map());
    5260             : 
    5261       91719 :   return true;
    5262             : }
    5263             : 
    5264             : 
    5265      112616 : bool Genesis::ConfigureApiObject(Handle<JSObject> object,
    5266             :                                  Handle<ObjectTemplateInfo> object_template) {
    5267             :   DCHECK(!object_template.is_null());
    5268             :   DCHECK(FunctionTemplateInfo::cast(object_template->constructor())
    5269             :              ->IsTemplateFor(object->map()));;
    5270             : 
    5271             :   MaybeHandle<JSObject> maybe_obj =
    5272      112616 :       ApiNatives::InstantiateObject(object->GetIsolate(), object_template);
    5273             :   Handle<JSObject> instantiated_template;
    5274      112616 :   if (!maybe_obj.ToHandle(&instantiated_template)) {
    5275             :     DCHECK(isolate()->has_pending_exception());
    5276             :     isolate()->clear_pending_exception();
    5277           0 :     return false;
    5278             :   }
    5279      112616 :   TransferObject(instantiated_template, object);
    5280      112616 :   return true;
    5281             : }
    5282             : 
    5283     5894711 : static bool PropertyAlreadyExists(Isolate* isolate, Handle<JSObject> to,
    5284             :                                   Handle<Name> key) {
    5285     5894711 :   LookupIterator it(isolate, to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    5286     5894704 :   CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    5287     5894704 :   return it.IsFound();
    5288             : }
    5289             : 
    5290      204224 : void Genesis::TransferNamedProperties(Handle<JSObject> from,
    5291             :                                       Handle<JSObject> to) {
    5292             :   // If JSObject::AddProperty asserts due to already existing property,
    5293             :   // it is likely due to both global objects sharing property name(s).
    5294             :   // Merging those two global objects is impossible.
    5295             :   // The global template must not create properties that already exist
    5296             :   // in the snapshotted global object.
    5297      204224 :   if (from->HasFastProperties()) {
    5298             :     Handle<DescriptorArray> descs =
    5299             :         Handle<DescriptorArray>(from->map()->instance_descriptors(), isolate());
    5300     1824704 :     for (int i = 0; i < from->map()->NumberOfOwnDescriptors(); i++) {
    5301      856044 :       PropertyDetails details = descs->GetDetails(i);
    5302      856044 :       if (details.location() == kField) {
    5303      855880 :         if (details.kind() == kData) {
    5304             :           HandleScope inner(isolate());
    5305             :           Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
    5306             :           // If the property is already there we skip it.
    5307      855880 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5308      855875 :           FieldIndex index = FieldIndex::ForDescriptor(from->map(), i);
    5309             :           Handle<Object> value =
    5310      855875 :               JSObject::FastPropertyAt(from, details.representation(), index);
    5311             :           JSObject::AddProperty(isolate(), to, key, value,
    5312      855875 :                                 details.attributes());
    5313             :         } else {
    5314             :           DCHECK_EQ(kAccessor, details.kind());
    5315           0 :           UNREACHABLE();
    5316             :         }
    5317             : 
    5318             :       } else {
    5319             :         DCHECK_EQ(kDescriptor, details.location());
    5320         164 :         if (details.kind() == kData) {
    5321             :           DCHECK(!FLAG_track_constant_fields);
    5322             :           HandleScope inner(isolate());
    5323             :           Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
    5324             :           // If the property is already there we skip it.
    5325           0 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5326             :           Handle<Object> value(descs->GetStrongValue(i), isolate());
    5327             :           JSObject::AddProperty(isolate(), to, key, value,
    5328           0 :                                 details.attributes());
    5329             :         } else {
    5330             :           DCHECK_EQ(kAccessor, details.kind());
    5331             :           Handle<Name> key(descs->GetKey(i), isolate());
    5332             :           // If the property is already there we skip it.
    5333         164 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5334             :           HandleScope inner(isolate());
    5335             :           DCHECK(!to->HasFastProperties());
    5336             :           // Add to dictionary.
    5337             :           Handle<Object> value(descs->GetStrongValue(i), isolate());
    5338             :           PropertyDetails d(kAccessor, details.attributes(),
    5339             :                             PropertyCellType::kMutable);
    5340         164 :           JSObject::SetNormalizedProperty(to, key, value, d);
    5341             :         }
    5342             :       }
    5343             :     }
    5344       91608 :   } else if (from->IsJSGlobalObject()) {
    5345             :     // Copy all keys and values in enumeration order.
    5346             :     Handle<GlobalDictionary> properties(
    5347             :         JSGlobalObject::cast(*from)->global_dictionary(), isolate());
    5348             :     Handle<FixedArray> indices =
    5349       91608 :         GlobalDictionary::IterationIndices(isolate(), properties);
    5350    10168816 :     for (int i = 0; i < indices->length(); i++) {
    5351             :       int index = Smi::ToInt(indices->get(i));
    5352             :       Handle<PropertyCell> cell(properties->CellAt(index), isolate());
    5353             :       Handle<Name> key(cell->name(), isolate());
    5354             :       // If the property is already there we skip it.
    5355     5038652 :       if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5356             :       // Set the property.
    5357             :       Handle<Object> value(cell->value(), isolate());
    5358     5038670 :       if (value->IsTheHole(isolate())) continue;
    5359             :       PropertyDetails details = cell->property_details();
    5360     5038664 :       if (details.kind() != kData) continue;
    5361     5038666 :       JSObject::AddProperty(isolate(), to, key, value, details.attributes());
    5362             :     }
    5363             :   } else {
    5364             :     // Copy all keys and values in enumeration order.
    5365             :     Handle<NameDictionary> properties =
    5366           0 :         Handle<NameDictionary>(from->property_dictionary(), isolate());
    5367             :     Handle<FixedArray> key_indices =
    5368           0 :         NameDictionary::IterationIndices(isolate(), properties);
    5369             :     ReadOnlyRoots roots(isolate());
    5370           0 :     for (int i = 0; i < key_indices->length(); i++) {
    5371             :       int key_index = Smi::ToInt(key_indices->get(i));
    5372             :       Object raw_key = properties->KeyAt(key_index);
    5373             :       DCHECK(properties->IsKey(roots, raw_key));
    5374             :       DCHECK(raw_key->IsName());
    5375             :       Handle<Name> key(Name::cast(raw_key), isolate());
    5376             :       // If the property is already there we skip it.
    5377           0 :       if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5378             :       // Set the property.
    5379             :       Handle<Object> value =
    5380             :           Handle<Object>(properties->ValueAt(key_index), isolate());
    5381             :       DCHECK(!value->IsCell());
    5382             :       DCHECK(!value->IsTheHole(isolate()));
    5383           0 :       PropertyDetails details = properties->DetailsAt(key_index);
    5384             :       DCHECK_EQ(kData, details.kind());
    5385           0 :       JSObject::AddProperty(isolate(), to, key, value, details.attributes());
    5386             :     }
    5387             :   }
    5388      204208 : }
    5389             : 
    5390             : 
    5391      204224 : void Genesis::TransferIndexedProperties(Handle<JSObject> from,
    5392             :                                         Handle<JSObject> to) {
    5393             :   // Cloning the elements array is sufficient.
    5394             :   Handle<FixedArray> from_elements =
    5395             :       Handle<FixedArray>(FixedArray::cast(from->elements()), isolate());
    5396      204224 :   Handle<FixedArray> to_elements = factory()->CopyFixedArray(from_elements);
    5397      408448 :   to->set_elements(*to_elements);
    5398      204224 : }
    5399             : 
    5400             : 
    5401      112616 : void Genesis::TransferObject(Handle<JSObject> from, Handle<JSObject> to) {
    5402             :   HandleScope outer(isolate());
    5403             : 
    5404             :   DCHECK(!from->IsJSArray());
    5405             :   DCHECK(!to->IsJSArray());
    5406             : 
    5407      112616 :   TransferNamedProperties(from, to);
    5408      112616 :   TransferIndexedProperties(from, to);
    5409             : 
    5410             :   // Transfer the prototype (new map is needed).
    5411             :   Handle<HeapObject> proto(from->map()->prototype(), isolate());
    5412      112616 :   JSObject::ForceSetPrototype(to, proto);
    5413      112616 : }
    5414             : 
    5415       91759 : Genesis::Genesis(
    5416             :     Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5417             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    5418             :     size_t context_snapshot_index,
    5419             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
    5420             :     v8::MicrotaskQueue* microtask_queue)
    5421       91759 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5422       91759 :   RuntimeCallTimerScope rcs_timer(isolate, RuntimeCallCounterId::kGenesis);
    5423       91759 :   result_ = Handle<Context>::null();
    5424       91759 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5425             : 
    5426             :   // Before creating the roots we must save the context and restore it
    5427             :   // on all function exits.
    5428      183518 :   SaveContext saved_context(isolate);
    5429             : 
    5430             :   // The deserializer needs to hook up references to the global proxy.
    5431             :   // Create an uninitialized global proxy now if we don't have one
    5432             :   // and initialize it later in CreateNewGlobals.
    5433             :   Handle<JSGlobalProxy> global_proxy;
    5434       91759 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5435             :     int instance_size = 0;
    5436       91690 :     if (context_snapshot_index > 0) {
    5437             :       // The global proxy function to reinitialize this global proxy is in the
    5438             :       // context that is yet to be deserialized. We need to prepare a global
    5439             :       // proxy of the correct size.
    5440             :       Object size = isolate->heap()->serialized_global_proxy_sizes()->get(
    5441          35 :           static_cast<int>(context_snapshot_index) - 1);
    5442             :       instance_size = Smi::ToInt(size);
    5443             :     } else {
    5444       91655 :       instance_size = JSGlobalProxy::SizeWithEmbedderFields(
    5445             :           global_proxy_template.IsEmpty()
    5446             :               ? 0
    5447             :               : global_proxy_template->InternalFieldCount());
    5448             :     }
    5449             :     global_proxy =
    5450       91690 :         isolate->factory()->NewUninitializedJSGlobalProxy(instance_size);
    5451             :   }
    5452             : 
    5453             :   // We can only de-serialize a context if the isolate was initialized from
    5454             :   // a snapshot. Otherwise we have to build the context from scratch.
    5455             :   // Also create a context from scratch to expose natives, if required by flag.
    5456             :   DCHECK(native_context_.is_null());
    5457       91759 :   if (isolate->initialized_from_snapshot()) {
    5458             :     Handle<Context> context;
    5459      183386 :     if (Snapshot::NewContextFromSnapshot(isolate, global_proxy,
    5460             :                                          context_snapshot_index,
    5461             :                                          embedder_fields_deserializer)
    5462             :             .ToHandle(&context)) {
    5463       91648 :       native_context_ = Handle<NativeContext>::cast(context);
    5464             :     }
    5465             :   }
    5466             : 
    5467       91759 :   if (!native_context().is_null()) {
    5468       91648 :     AddToWeakNativeContextList(isolate, *native_context());
    5469             :     isolate->set_context(*native_context());
    5470       91648 :     isolate->counters()->contexts_created_by_snapshot()->Increment();
    5471             : 
    5472       91648 :     if (context_snapshot_index == 0) {
    5473             :       Handle<JSGlobalObject> global_object =
    5474       91608 :           CreateNewGlobals(global_proxy_template, global_proxy);
    5475       91608 :       HookUpGlobalObject(global_object);
    5476             : 
    5477       91608 :       if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5478             :     } else {
    5479             :       // The global proxy needs to be integrated into the native context.
    5480          40 :       HookUpGlobalProxy(global_proxy);
    5481             :     }
    5482             :     DCHECK(!global_proxy->IsDetachedFrom(native_context()->global_object()));
    5483             :   } else {
    5484             :     base::ElapsedTimer timer;
    5485         111 :     if (FLAG_profile_deserialization) timer.Start();
    5486             :     DCHECK_EQ(0u, context_snapshot_index);
    5487             :     // We get here if there was no context snapshot.
    5488         111 :     CreateRoots();
    5489         111 :     MathRandom::InitializeContext(isolate, native_context());
    5490         111 :     Handle<JSFunction> empty_function = CreateEmptyFunction();
    5491         111 :     CreateSloppyModeFunctionMaps(empty_function);
    5492         111 :     CreateStrictModeFunctionMaps(empty_function);
    5493         111 :     CreateObjectFunction(empty_function);
    5494         111 :     CreateIteratorMaps(empty_function);
    5495         111 :     CreateAsyncIteratorMaps(empty_function);
    5496         111 :     CreateAsyncFunctionMaps(empty_function);
    5497             :     Handle<JSGlobalObject> global_object =
    5498         111 :         CreateNewGlobals(global_proxy_template, global_proxy);
    5499         111 :     InitializeGlobal(global_object, empty_function);
    5500         111 :     InitializeNormalizedMapCaches();
    5501         111 :     InitializeIteratorFunctions();
    5502         111 :     InitializeCallSiteBuiltins();
    5503             : 
    5504         111 :     if (!InstallNatives()) return;
    5505         111 :     if (!InstallExtraNatives()) return;
    5506         111 :     if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5507             : 
    5508         111 :     isolate->counters()->contexts_created_from_scratch()->Increment();
    5509             : 
    5510         111 :     if (FLAG_profile_deserialization) {
    5511           0 :       double ms = timer.Elapsed().InMillisecondsF();
    5512           0 :       PrintF("[Initializing context from scratch took %0.3f ms]\n", ms);
    5513             :     }
    5514             :   }
    5515             : 
    5516       91758 :   native_context()->set_microtask_queue(
    5517             :       microtask_queue ? static_cast<MicrotaskQueue*>(microtask_queue)
    5518             :                       : isolate->default_microtask_queue());
    5519             : 
    5520             :   // Install experimental natives. Do not include them into the
    5521             :   // snapshot as we should be able to turn them off at runtime. Re-installing
    5522             :   // them after they have already been deserialized would also fail.
    5523       91758 :     if (!isolate->serializer_enabled()) {
    5524       91452 :       InitializeExperimentalGlobal();
    5525             : 
    5526             :       // Store String.prototype's map again in case it has been changed by
    5527             :       // experimental natives.
    5528      182906 :       Handle<JSFunction> string_function(native_context()->string_function(),
    5529       91453 :                                          isolate);
    5530             :       JSObject string_function_prototype =
    5531             :           JSObject::cast(string_function->initial_map()->prototype());
    5532             :       DCHECK(string_function_prototype->HasFastProperties());
    5533      182906 :       native_context()->set_string_function_prototype_map(
    5534       91453 :           string_function_prototype->map());
    5535             :     }
    5536             : 
    5537       91759 :   if (FLAG_disallow_code_generation_from_strings) {
    5538          18 :     native_context()->set_allow_code_gen_from_strings(
    5539          27 :         ReadOnlyRoots(isolate).false_value());
    5540             :   }
    5541             : 
    5542       91759 :   ConfigureUtilsObject();
    5543             : 
    5544             :   // We created new functions, which may require debug instrumentation.
    5545       91759 :   if (isolate->debug()->is_active()) {
    5546         150 :     isolate->debug()->InstallDebugBreakTrampoline();
    5547             :   }
    5548             : 
    5549       91759 :   native_context()->ResetErrorsThrown();
    5550       91759 :   result_ = native_context();
    5551             : }
    5552             : 
    5553          18 : Genesis::Genesis(Isolate* isolate,
    5554             :                  MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5555             :                  v8::Local<v8::ObjectTemplate> global_proxy_template)
    5556          18 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5557          18 :   result_ = Handle<Context>::null();
    5558          18 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5559             : 
    5560             :   // Before creating the roots we must save the context and restore it
    5561             :   // on all function exits.
    5562          36 :   SaveContext saved_context(isolate);
    5563             : 
    5564          18 :   const int proxy_size = JSGlobalProxy::SizeWithEmbedderFields(
    5565             :       global_proxy_template->InternalFieldCount());
    5566             : 
    5567             :   Handle<JSGlobalProxy> global_proxy;
    5568          18 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5569          13 :     global_proxy = factory()->NewUninitializedJSGlobalProxy(proxy_size);
    5570             :   }
    5571             : 
    5572             :   // Create a remote object as the global object.
    5573             :   Handle<ObjectTemplateInfo> global_proxy_data =
    5574             :       Utils::OpenHandle(*global_proxy_template);
    5575             :   Handle<FunctionTemplateInfo> global_constructor(
    5576             :       FunctionTemplateInfo::cast(global_proxy_data->constructor()), isolate);
    5577             : 
    5578             :   Handle<ObjectTemplateInfo> global_object_template(
    5579             :       ObjectTemplateInfo::cast(global_constructor->GetPrototypeTemplate()),
    5580             :       isolate);
    5581             :   Handle<JSObject> global_object =
    5582          36 :       ApiNatives::InstantiateRemoteObject(
    5583             :           global_object_template).ToHandleChecked();
    5584             : 
    5585             :   // (Re)initialize the global proxy object.
    5586             :   DCHECK_EQ(global_proxy_data->embedder_field_count(),
    5587             :             global_proxy_template->InternalFieldCount());
    5588             :   Handle<Map> global_proxy_map = isolate->factory()->NewMap(
    5589          18 :       JS_GLOBAL_PROXY_TYPE, proxy_size, TERMINAL_FAST_ELEMENTS_KIND);
    5590             :   global_proxy_map->set_is_access_check_needed(true);
    5591          18 :   global_proxy_map->set_has_hidden_prototype(true);
    5592          18 :   global_proxy_map->set_may_have_interesting_symbols(true);
    5593             : 
    5594             :   // A remote global proxy has no native context.
    5595          36 :   global_proxy->set_native_context(ReadOnlyRoots(heap()).null_value());
    5596             : 
    5597             :   // Configure the hidden prototype chain of the global proxy.
    5598          18 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5599          36 :   global_proxy->map()->SetConstructor(*global_constructor);
    5600             :   // TODO(dcheng): This is a hack. Why does this need to be manually called
    5601             :   // here? Line 4812 should have taken care of it?
    5602          18 :   global_proxy->map()->set_has_hidden_prototype(true);
    5603             : 
    5604          18 :   global_proxy_ = global_proxy;
    5605          18 : }
    5606             : 
    5607             : // Support for thread preemption.
    5608             : 
    5609             : // Reserve space for statics needing saving and restoring.
    5610        1117 : int Bootstrapper::ArchiveSpacePerThread() {
    5611        1117 :   return sizeof(NestingCounterType);
    5612             : }
    5613             : 
    5614             : 
    5615             : // Archive statics that are thread-local.
    5616       32453 : char* Bootstrapper::ArchiveState(char* to) {
    5617       32453 :   *reinterpret_cast<NestingCounterType*>(to) = nesting_;
    5618       32453 :   nesting_ = 0;
    5619       32453 :   return to + sizeof(NestingCounterType);
    5620             : }
    5621             : 
    5622             : 
    5623             : // Restore statics that are thread-local.
    5624       32453 : char* Bootstrapper::RestoreState(char* from) {
    5625       32453 :   nesting_ = *reinterpret_cast<NestingCounterType*>(from);
    5626       32453 :   return from + sizeof(NestingCounterType);
    5627             : }
    5628             : 
    5629             : 
    5630             : // Called when the top-level V8 mutex is destroyed.
    5631        5918 : void Bootstrapper::FreeThreadResources() {
    5632             :   DCHECK(!IsActive());
    5633        5918 : }
    5634             : 
    5635             : }  // namespace internal
    5636      122004 : }  // namespace v8

Generated by: LCOV version 1.10