LCOV - code coverage report
Current view: top level - src - bootstrapper.cc (source / functions) Hit Total Coverage
Test: app.info Lines: 2057 2102 97.9 %
Date: 2019-03-21 Functions: 94 112 83.9 %

          Line data    Source code
       1             : // Copyright 2014 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #include "src/bootstrapper.h"
       6             : 
       7             : #include "src/accessors.h"
       8             : #include "src/api-inl.h"
       9             : #include "src/api-natives.h"
      10             : #include "src/base/ieee754.h"
      11             : #include "src/compiler.h"
      12             : #include "src/counters.h"
      13             : #include "src/debug/debug.h"
      14             : #include "src/extensions/externalize-string-extension.h"
      15             : #include "src/extensions/free-buffer-extension.h"
      16             : #include "src/extensions/gc-extension.h"
      17             : #include "src/extensions/ignition-statistics-extension.h"
      18             : #include "src/extensions/statistics-extension.h"
      19             : #include "src/extensions/trigger-failure-extension.h"
      20             : #include "src/function-kind.h"
      21             : #include "src/heap/heap-inl.h"
      22             : #include "src/isolate-inl.h"
      23             : #include "src/math-random.h"
      24             : #include "src/microtask-queue.h"
      25             : #include "src/objects/api-callbacks.h"
      26             : #include "src/objects/arguments.h"
      27             : #include "src/objects/hash-table-inl.h"
      28             : #ifdef V8_INTL_SUPPORT
      29             : #include "src/objects/intl-objects.h"
      30             : #endif  // V8_INTL_SUPPORT
      31             : #include "src/objects/js-array-buffer-inl.h"
      32             : #include "src/objects/js-array-inl.h"
      33             : #ifdef V8_INTL_SUPPORT
      34             : #include "src/objects/js-break-iterator.h"
      35             : #include "src/objects/js-collator.h"
      36             : #include "src/objects/js-date-time-format.h"
      37             : #include "src/objects/js-list-format.h"
      38             : #include "src/objects/js-locale.h"
      39             : #include "src/objects/js-number-format.h"
      40             : #include "src/objects/js-plural-rules.h"
      41             : #endif  // V8_INTL_SUPPORT
      42             : #include "src/objects/js-regexp-string-iterator.h"
      43             : #include "src/objects/js-regexp.h"
      44             : #ifdef V8_INTL_SUPPORT
      45             : #include "src/objects/js-relative-time-format.h"
      46             : #include "src/objects/js-segment-iterator.h"
      47             : #include "src/objects/js-segmenter.h"
      48             : #endif  // V8_INTL_SUPPORT
      49             : #include "src/objects/js-weak-refs.h"
      50             : #include "src/objects/property-cell.h"
      51             : #include "src/objects/slots-inl.h"
      52             : #include "src/objects/templates.h"
      53             : #include "src/snapshot/natives.h"
      54             : #include "src/snapshot/snapshot.h"
      55             : #include "src/wasm/wasm-js.h"
      56             : 
      57             : namespace v8 {
      58             : namespace internal {
      59             : 
      60           0 : void SourceCodeCache::Initialize(Isolate* isolate, bool create_heap_objects) {
      61             :   cache_ = create_heap_objects ? ReadOnlyRoots(isolate).empty_fixed_array()
      62      123108 :                                : FixedArray();
      63           0 : }
      64             : 
      65           0 : void SourceCodeCache::Iterate(RootVisitor* v) {
      66      553776 :   v->VisitRootPointer(Root::kExtensions, nullptr, FullObjectSlot(&cache_));
      67           0 : }
      68             : 
      69        4573 : bool SourceCodeCache::Lookup(Isolate* isolate, Vector<const char> name,
      70             :                              Handle<SharedFunctionInfo>* handle) {
      71       16289 :   for (int i = 0; i < cache_->length(); i += 2) {
      72        7179 :     SeqOneByteString str = SeqOneByteString::cast(cache_->get(i));
      73        7179 :     if (str->IsUtf8EqualTo(name)) {
      74             :       *handle = Handle<SharedFunctionInfo>(
      75        2644 :           SharedFunctionInfo::cast(cache_->get(i + 1)), isolate);
      76        1322 :       return true;
      77             :     }
      78             :   }
      79             :   return false;
      80             : }
      81             : 
      82        3213 : void SourceCodeCache::Add(Isolate* isolate, Vector<const char> name,
      83             :                           Handle<SharedFunctionInfo> shared) {
      84             :   Factory* factory = isolate->factory();
      85             :   HandleScope scope(isolate);
      86             :   int length = cache_->length();
      87             :   Handle<FixedArray> new_array =
      88        3213 :       factory->NewFixedArray(length + 2, AllocationType::kOld);
      89        3210 :   cache_->CopyTo(0, *new_array, 0, cache_->length());
      90        3219 :   cache_ = *new_array;
      91             :   Handle<String> str =
      92             :       factory
      93        6432 :           ->NewStringFromOneByte(Vector<const uint8_t>::cast(name),
      94             :                                  AllocationType::kOld)
      95             :           .ToHandleChecked();
      96             :   DCHECK(!str.is_null());
      97        3213 :   cache_->set(length, *str);
      98        3218 :   cache_->set(length + 1, *shared);
      99        9652 :   Script::cast(shared->script())->set_type(type_);
     100        3214 : }
     101             : 
     102       61533 : Bootstrapper::Bootstrapper(Isolate* isolate)
     103             :     : isolate_(isolate),
     104             :       nesting_(0),
     105      123066 :       extensions_cache_(Script::TYPE_EXTENSION) {}
     106             : 
     107         111 : Handle<String> Bootstrapper::GetNativeSource(NativeType type, int index) {
     108             :   NativesExternalStringResource* resource =
     109         111 :       new NativesExternalStringResource(type, index);
     110             :   Handle<ExternalOneByteString> source_code =
     111         111 :       isolate_->factory()->NewNativeSourceString(resource);
     112             :   DCHECK(source_code->is_uncached());
     113         111 :   return source_code;
     114             : }
     115             : 
     116       61534 : void Bootstrapper::Initialize(bool create_heap_objects) {
     117       61534 :   extensions_cache_.Initialize(isolate_, create_heap_objects);
     118       61534 : }
     119             : 
     120             : 
     121             : static const char* GCFunctionName() {
     122             :   bool flag_given =
     123       60098 :       FLAG_expose_gc_as != nullptr && strlen(FLAG_expose_gc_as) != 0;
     124       60098 :   return flag_given ? FLAG_expose_gc_as : "gc";
     125             : }
     126             : 
     127       60098 : void Bootstrapper::InitializeOncePerProcess() {
     128      240392 :   v8::RegisterExtension(v8::base::make_unique<FreeBufferExtension>());
     129      120196 :   v8::RegisterExtension(v8::base::make_unique<GCExtension>(GCFunctionName()));
     130      240392 :   v8::RegisterExtension(v8::base::make_unique<ExternalizeStringExtension>());
     131      240392 :   v8::RegisterExtension(v8::base::make_unique<StatisticsExtension>());
     132      240392 :   v8::RegisterExtension(v8::base::make_unique<TriggerFailureExtension>());
     133      240392 :   v8::RegisterExtension(v8::base::make_unique<IgnitionStatisticsExtension>());
     134       60098 : }
     135             : 
     136       61518 : void Bootstrapper::TearDown() {
     137             :   extensions_cache_.Initialize(isolate_, false);  // Yes, symmetrical
     138       61518 : }
     139             : 
     140             : class Genesis {
     141             :  public:
     142             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     143             :           v8::Local<v8::ObjectTemplate> global_proxy_template,
     144             :           size_t context_snapshot_index,
     145             :           v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
     146             :           v8::MicrotaskQueue* microtask_queue);
     147             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     148             :           v8::Local<v8::ObjectTemplate> global_proxy_template);
     149       90498 :   ~Genesis() = default;
     150             : 
     151             :   Isolate* isolate() const { return isolate_; }
     152             :   Factory* factory() const { return isolate_->factory(); }
     153             :   Builtins* builtins() const { return isolate_->builtins(); }
     154             :   Heap* heap() const { return isolate_->heap(); }
     155             : 
     156             :   Handle<Context> result() { return result_; }
     157             : 
     158             :   Handle<JSGlobalProxy> global_proxy() { return global_proxy_; }
     159             : 
     160             :  private:
     161             :   Handle<NativeContext> native_context() { return native_context_; }
     162             : 
     163             :   // Creates some basic objects. Used for creating a context from scratch.
     164             :   void CreateRoots();
     165             :   // Creates the empty function.  Used for creating a context from scratch.
     166             :   Handle<JSFunction> CreateEmptyFunction();
     167             :   // Returns the %ThrowTypeError% intrinsic function.
     168             :   // See ES#sec-%throwtypeerror% for details.
     169             :   Handle<JSFunction> GetThrowTypeErrorIntrinsic();
     170             : 
     171             :   void CreateSloppyModeFunctionMaps(Handle<JSFunction> empty);
     172             :   void CreateStrictModeFunctionMaps(Handle<JSFunction> empty);
     173             :   void CreateObjectFunction(Handle<JSFunction> empty);
     174             :   void CreateIteratorMaps(Handle<JSFunction> empty);
     175             :   void CreateAsyncIteratorMaps(Handle<JSFunction> empty);
     176             :   void CreateAsyncFunctionMaps(Handle<JSFunction> empty);
     177             :   void CreateJSProxyMaps();
     178             : 
     179             :   // Make the "arguments" and "caller" properties throw a TypeError on access.
     180             :   void AddRestrictedFunctionProperties(Handle<JSFunction> empty);
     181             : 
     182             :   // Creates the global objects using the global proxy and the template passed
     183             :   // in through the API.  We call this regardless of whether we are building a
     184             :   // context from scratch or using a deserialized one from the partial snapshot
     185             :   // but in the latter case we don't use the objects it produces directly, as
     186             :   // we have to use the deserialized ones that are linked together with the
     187             :   // rest of the context snapshot. At the end we link the global proxy and the
     188             :   // context to each other.
     189             :   Handle<JSGlobalObject> CreateNewGlobals(
     190             :       v8::Local<v8::ObjectTemplate> global_proxy_template,
     191             :       Handle<JSGlobalProxy> global_proxy);
     192             :   // Similarly, we want to use the global that has been created by the templates
     193             :   // passed through the API.  The global from the snapshot is detached from the
     194             :   // other objects in the snapshot.
     195             :   void HookUpGlobalObject(Handle<JSGlobalObject> global_object);
     196             :   // Hooks the given global proxy into the context in the case we do not
     197             :   // replace the global object from the deserialized native context.
     198             :   void HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy);
     199             :   // The native context has a ScriptContextTable that store declarative bindings
     200             :   // made in script scopes.  Add a "this" binding to that table pointing to the
     201             :   // global proxy.
     202             :   void InstallGlobalThisBinding();
     203             :   // New context initialization.  Used for creating a context from scratch.
     204             :   void InitializeGlobal(Handle<JSGlobalObject> global_object,
     205             :                         Handle<JSFunction> empty_function);
     206             :   void InitializeExperimentalGlobal();
     207             :   void InitializeIteratorFunctions();
     208             :   void InitializeCallSiteBuiltins();
     209             :   // Depending on the situation, expose and/or get rid of the utils object.
     210             :   void ConfigureUtilsObject();
     211             : 
     212             : #define DECLARE_FEATURE_INITIALIZATION(id, descr) \
     213             :   void InitializeGlobal_##id();
     214             : 
     215             :   HARMONY_INPROGRESS(DECLARE_FEATURE_INITIALIZATION)
     216             :   HARMONY_STAGED(DECLARE_FEATURE_INITIALIZATION)
     217             :   HARMONY_SHIPPING(DECLARE_FEATURE_INITIALIZATION)
     218             : #undef DECLARE_FEATURE_INITIALIZATION
     219             : 
     220             :   enum ArrayBufferKind {
     221             :     ARRAY_BUFFER,
     222             :     SHARED_ARRAY_BUFFER,
     223             :   };
     224             :   Handle<JSFunction> CreateArrayBuffer(Handle<String> name,
     225             :                                        ArrayBufferKind array_buffer_kind);
     226             :   void InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
     227             :                                           const char* name);
     228             :   void InstallInternalPackedArray(Handle<JSObject> target, const char* name);
     229             :   bool InstallNatives();
     230             : 
     231             :   Handle<JSFunction> InstallTypedArray(const char* name,
     232             :                                        ElementsKind elements_kind);
     233             :   bool InstallExtraNatives();
     234             :   void InitializeNormalizedMapCaches();
     235             : 
     236             :   enum ExtensionTraversalState {
     237             :     UNVISITED, VISITED, INSTALLED
     238             :   };
     239             : 
     240       90174 :   class ExtensionStates {
     241             :    public:
     242             :     ExtensionStates();
     243             :     ExtensionTraversalState get_state(RegisteredExtension* extension);
     244             :     void set_state(RegisteredExtension* extension,
     245             :                    ExtensionTraversalState state);
     246             :    private:
     247             :     base::HashMap map_;
     248             :     DISALLOW_COPY_AND_ASSIGN(ExtensionStates);
     249             :   };
     250             : 
     251             :   // Used both for deserialized and from-scratch contexts to add the extensions
     252             :   // provided.
     253             :   static bool InstallExtensions(Isolate* isolate,
     254             :                                 Handle<Context> native_context,
     255             :                                 v8::ExtensionConfiguration* extensions);
     256             :   static bool InstallAutoExtensions(Isolate* isolate,
     257             :                                     ExtensionStates* extension_states);
     258             :   static bool InstallRequestedExtensions(Isolate* isolate,
     259             :                                          v8::ExtensionConfiguration* extensions,
     260             :                                          ExtensionStates* extension_states);
     261             :   static bool InstallExtension(Isolate* isolate,
     262             :                                const char* name,
     263             :                                ExtensionStates* extension_states);
     264             :   static bool InstallExtension(Isolate* isolate,
     265             :                                v8::RegisteredExtension* current,
     266             :                                ExtensionStates* extension_states);
     267             :   static bool InstallSpecialObjects(Isolate* isolate,
     268             :                                     Handle<Context> native_context);
     269             :   bool ConfigureApiObject(Handle<JSObject> object,
     270             :                           Handle<ObjectTemplateInfo> object_template);
     271             :   bool ConfigureGlobalObjects(
     272             :       v8::Local<v8::ObjectTemplate> global_proxy_template);
     273             : 
     274             :   // Migrates all properties from the 'from' object to the 'to'
     275             :   // object and overrides the prototype in 'to' with the one from
     276             :   // 'from'.
     277             :   void TransferObject(Handle<JSObject> from, Handle<JSObject> to);
     278             :   void TransferNamedProperties(Handle<JSObject> from, Handle<JSObject> to);
     279             :   void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);
     280             : 
     281             :   static bool CompileExtension(Isolate* isolate, v8::Extension* extension);
     282             : 
     283             :   Isolate* isolate_;
     284             :   Handle<Context> result_;
     285             :   Handle<NativeContext> native_context_;
     286             :   Handle<JSGlobalProxy> global_proxy_;
     287             : 
     288             :   // Temporary function maps needed only during bootstrapping.
     289             :   Handle<Map> strict_function_with_home_object_map_;
     290             :   Handle<Map> strict_function_with_name_and_home_object_map_;
     291             : 
     292             :   // %ThrowTypeError%. See ES#sec-%throwtypeerror% for details.
     293             :   Handle<JSFunction> restricted_properties_thrower_;
     294             : 
     295             :   BootstrapperActive active_;
     296             :   friend class Bootstrapper;
     297             : };
     298             : 
     299      276888 : void Bootstrapper::Iterate(RootVisitor* v) {
     300             :   extensions_cache_.Iterate(v);
     301      276888 :   v->Synchronize(VisitorSynchronization::kExtensions);
     302      276888 : }
     303             : 
     304       90479 : Handle<Context> Bootstrapper::CreateEnvironment(
     305             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     306             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
     307             :     v8::ExtensionConfiguration* extensions, size_t context_snapshot_index,
     308             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
     309             :     v8::MicrotaskQueue* microtask_queue) {
     310       90479 :   HandleScope scope(isolate_);
     311             :   Handle<Context> env;
     312             :   {
     313             :     Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template,
     314             :                     context_snapshot_index, embedder_fields_deserializer,
     315       90479 :                     microtask_queue);
     316             :     env = genesis.result();
     317       90479 :     if (env.is_null() || !InstallExtensions(env, extensions)) {
     318          40 :       return Handle<Context>();
     319             :     }
     320             :   }
     321       90440 :   LogAllMaps();
     322      180878 :   isolate_->heap()->NotifyBootstrapComplete();
     323       90440 :   return scope.CloseAndEscape(env);
     324             : }
     325             : 
     326          18 : Handle<JSGlobalProxy> Bootstrapper::NewRemoteContext(
     327             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     328             :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
     329          18 :   HandleScope scope(isolate_);
     330             :   Handle<JSGlobalProxy> global_proxy;
     331             :   {
     332          18 :     Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template);
     333             :     global_proxy = genesis.global_proxy();
     334          18 :     if (global_proxy.is_null()) return Handle<JSGlobalProxy>();
     335             :   }
     336          18 :   LogAllMaps();
     337          18 :   return scope.CloseAndEscape(global_proxy);
     338             : }
     339             : 
     340       90457 : void Bootstrapper::LogAllMaps() {
     341       90457 :   if (!FLAG_trace_maps || isolate_->initialized_from_snapshot()) return;
     342             :   // Log all created Map objects that are on the heap. For snapshots the Map
     343             :   // logging happens during deserialization in order to avoid printing Maps
     344             :   // multiple times during partial deserialization.
     345           0 :   LOG(isolate_, LogAllMaps());
     346             : }
     347             : 
     348         121 : void Bootstrapper::DetachGlobal(Handle<Context> env) {
     349         242 :   isolate_->counters()->errors_thrown_per_context()->AddSample(
     350         121 :       env->GetErrorsThrown());
     351             : 
     352         121 :   ReadOnlyRoots roots(isolate_);
     353         242 :   Handle<JSGlobalProxy> global_proxy(env->global_proxy(), isolate_);
     354         242 :   global_proxy->set_native_context(roots.null_value());
     355         242 :   JSObject::ForceSetPrototype(global_proxy, isolate_->factory()->null_value());
     356         242 :   global_proxy->map()->SetConstructor(roots.null_value());
     357         121 :   if (FLAG_track_detached_contexts) {
     358         121 :     isolate_->AddDetachedContext(env);
     359             :   }
     360             : 
     361         242 :   env->native_context()->set_microtask_queue(nullptr);
     362         121 : }
     363             : 
     364             : namespace {
     365             : 
     366        1887 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
     367             :     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len,
     368             :     FunctionKind kind = FunctionKind::kNormalFunction) {
     369             :   Handle<SharedFunctionInfo> shared =
     370             :       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
     371        3774 :                                                           kind);
     372             :   shared->set_internal_formal_parameter_count(len);
     373             :   shared->set_length(len);
     374        1887 :   return shared;
     375             : }
     376             : 
     377         111 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateBuiltinSharedFunctionInfo(
     378             :     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len) {
     379             :   Handle<SharedFunctionInfo> shared =
     380             :       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
     381         111 :                                                           kNormalFunction);
     382             :   shared->set_internal_formal_parameter_count(len);
     383             :   shared->set_length(len);
     384         111 :   return shared;
     385             : }
     386             : 
     387      188827 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     388             :     Isolate* isolate, Handle<String> name, InstanceType type, int instance_size,
     389             :     int inobject_properties, Handle<Object> prototype,
     390             :     Builtins::Name builtin_id) {
     391             :   Handle<JSFunction> result;
     392             : 
     393             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
     394             :       name, prototype, type, instance_size, inobject_properties, builtin_id,
     395      188827 :       IMMUTABLE);
     396             : 
     397      188827 :   result = isolate->factory()->NewFunction(args);
     398             :   // Make the JSFunction's prototype object fast.
     399      377656 :   JSObject::MakePrototypesFast(handle(result->prototype(), isolate),
     400      188828 :                                kStartAtReceiver, isolate);
     401             : 
     402             :   // Make the resulting JSFunction object fast.
     403      188828 :   JSObject::MakePrototypesFast(result, kStartAtReceiver, isolate);
     404      188827 :   result->shared()->set_native(true);
     405      188827 :   return result;
     406             : }
     407             : 
     408       90839 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     409             :     Isolate* isolate, const char* name, InstanceType type, int instance_size,
     410             :     int inobject_properties, Handle<Object> prototype,
     411             :     Builtins::Name builtin_id) {
     412             :   return CreateFunction(
     413             :       isolate, isolate->factory()->InternalizeUtf8String(name), type,
     414       90839 :       instance_size, inobject_properties, prototype, builtin_id);
     415             : }
     416             : 
     417       95643 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     418             :     Isolate* isolate, Handle<JSObject> target, Handle<String> name,
     419             :     InstanceType type, int instance_size, int inobject_properties,
     420             :     Handle<Object> prototype, Builtins::Name call) {
     421             :   Handle<JSFunction> function = CreateFunction(
     422       95643 :       isolate, name, type, instance_size, inobject_properties, prototype, call);
     423       95643 :   JSObject::AddProperty(isolate, target, name, function, DONT_ENUM);
     424       95643 :   return function;
     425             : }
     426             : 
     427       94533 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     428             :     Isolate* isolate, Handle<JSObject> target, const char* name,
     429             :     InstanceType type, int instance_size, int inobject_properties,
     430             :     Handle<Object> prototype, Builtins::Name call) {
     431             :   return InstallFunction(isolate, target,
     432             :                          isolate->factory()->InternalizeUtf8String(name), type,
     433       94533 :                          instance_size, inobject_properties, prototype, call);
     434             : }
     435             : 
     436     1597643 : V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,
     437             :                                                     Handle<String> name,
     438             :                                                     Builtins::Name call,
     439             :                                                     int len, bool adapt) {
     440             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
     441     1597643 :       name, call, LanguageMode::kStrict);
     442     1597641 :   Handle<JSFunction> fun = isolate->factory()->NewFunction(args);
     443             :   // Make the resulting JSFunction object fast.
     444     1597643 :   JSObject::MakePrototypesFast(fun, kStartAtReceiver, isolate);
     445     1597643 :   fun->shared()->set_native(true);
     446             : 
     447     1597643 :   if (adapt) {
     448             :     fun->shared()->set_internal_formal_parameter_count(len);
     449             :   } else {
     450             :     fun->shared()->DontAdaptArguments();
     451             :   }
     452             :   fun->shared()->set_length(len);
     453     1597642 :   return fun;
     454             : }
     455             : 
     456        3108 : V8_NOINLINE Handle<JSFunction> InstallFunctionWithBuiltinId(
     457             :     Isolate* isolate, Handle<JSObject> base, const char* name,
     458             :     Builtins::Name call, int len, bool adapt) {
     459             :   Handle<String> internalized_name =
     460        3108 :       isolate->factory()->InternalizeUtf8String(name);
     461             :   Handle<JSFunction> fun =
     462        3108 :       SimpleCreateFunction(isolate, internalized_name, call, len, adapt);
     463        3108 :   JSObject::AddProperty(isolate, base, internalized_name, fun, DONT_ENUM);
     464        3108 :   return fun;
     465             : }
     466             : 
     467      590910 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
     468             :     Isolate* isolate, Handle<JSObject> base, const char* name,
     469             :     Builtins::Name call, int len, bool adapt,
     470             :     PropertyAttributes attrs = DONT_ENUM) {
     471             :   // Although function name does not have to be internalized the property name
     472             :   // will be internalized during property addition anyway, so do it here now.
     473             :   Handle<String> internalized_name =
     474      590910 :       isolate->factory()->InternalizeUtf8String(name);
     475             :   Handle<JSFunction> fun =
     476      590911 :       SimpleCreateFunction(isolate, internalized_name, call, len, adapt);
     477      590911 :   JSObject::AddProperty(isolate, base, internalized_name, fun, attrs);
     478      590909 :   return fun;
     479             : }
     480             : 
     481       91284 : V8_NOINLINE Handle<JSFunction> InstallFunctionAtSymbol(
     482             :     Isolate* isolate, Handle<JSObject> base, Handle<Symbol> symbol,
     483             :     const char* symbol_string, Builtins::Name call, int len, bool adapt,
     484             :     PropertyAttributes attrs = DONT_ENUM) {
     485             :   Handle<String> internalized_symbol =
     486       91284 :       isolate->factory()->InternalizeUtf8String(symbol_string);
     487             :   Handle<JSFunction> fun =
     488       91283 :       SimpleCreateFunction(isolate, internalized_symbol, call, len, adapt);
     489       91283 :   JSObject::AddProperty(isolate, base, symbol, fun, attrs);
     490       91283 :   return fun;
     491             : }
     492             : 
     493        2220 : V8_NOINLINE void SimpleInstallGetterSetter(Isolate* isolate,
     494             :                                            Handle<JSObject> base,
     495             :                                            Handle<String> name,
     496             :                                            Builtins::Name call_getter,
     497             :                                            Builtins::Name call_setter) {
     498             :   Handle<String> getter_name =
     499        4440 :       Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
     500        2220 :           .ToHandleChecked();
     501             :   Handle<JSFunction> getter =
     502        2220 :       SimpleCreateFunction(isolate, getter_name, call_getter, 0, true);
     503             : 
     504             :   Handle<String> setter_name =
     505        4440 :       Name::ToFunctionName(isolate, name, isolate->factory()->set_string())
     506        2220 :           .ToHandleChecked();
     507             :   Handle<JSFunction> setter =
     508        2220 :       SimpleCreateFunction(isolate, setter_name, call_setter, 1, true);
     509             : 
     510        4440 :   JSObject::DefineAccessor(base, name, getter, setter, DONT_ENUM).Check();
     511        2220 : }
     512             : 
     513             : void SimpleInstallGetterSetter(Isolate* isolate, Handle<JSObject> base,
     514             :                                const char* name, Builtins::Name call_getter,
     515             :                                Builtins::Name call_setter) {
     516        1998 :   SimpleInstallGetterSetter(isolate, base,
     517             :                             isolate->factory()->InternalizeUtf8String(name),
     518        1998 :                             call_getter, call_setter);
     519             : }
     520             : 
     521      907013 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
     522             :     Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
     523             :     Handle<Name> property_name, Builtins::Name call, bool adapt) {
     524             :   Handle<String> getter_name =
     525     1814029 :       Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
     526      907016 :           .ToHandleChecked();
     527             :   Handle<JSFunction> getter =
     528      907016 :       SimpleCreateFunction(isolate, getter_name, call, 0, adapt);
     529             : 
     530             :   Handle<Object> setter = isolate->factory()->undefined_value();
     531             : 
     532     1814028 :   JSObject::DefineAccessor(base, property_name, getter, setter, DONT_ENUM)
     533             :       .Check();
     534             : 
     535      907015 :   return getter;
     536             : }
     537             : 
     538      906124 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Isolate* isolate,
     539             :                                                    Handle<JSObject> base,
     540             :                                                    Handle<Name> name,
     541             :                                                    Builtins::Name call,
     542             :                                                    bool adapt) {
     543      906124 :   return SimpleInstallGetter(isolate, base, name, name, call, adapt);
     544             : }
     545             : 
     546       96056 : V8_NOINLINE void InstallConstant(Isolate* isolate, Handle<JSObject> holder,
     547             :                                  const char* name, Handle<Object> value) {
     548      192113 :   JSObject::AddProperty(
     549             :       isolate, holder, isolate->factory()->InternalizeUtf8String(name), value,
     550       96056 :       static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     551       96057 : }
     552             : 
     553        1110 : V8_NOINLINE void InstallTrueValuedProperty(Isolate* isolate,
     554             :                                            Handle<JSObject> holder,
     555             :                                            const char* name) {
     556        2220 :   JSObject::AddProperty(isolate, holder,
     557             :                         isolate->factory()->InternalizeUtf8String(name),
     558        1110 :                         isolate->factory()->true_value(), NONE);
     559        1110 : }
     560             : 
     561         888 : V8_NOINLINE void InstallSpeciesGetter(Isolate* isolate,
     562             :                                       Handle<JSFunction> constructor) {
     563             :   Factory* factory = isolate->factory();
     564             :   // TODO(adamk): We should be able to share a SharedFunctionInfo
     565             :   // between all these JSFunctins.
     566             :   SimpleInstallGetter(isolate, constructor, factory->symbol_species_string(),
     567             :                       factory->species_symbol(), Builtins::kReturnReceiver,
     568         888 :                       true);
     569         888 : }
     570             : 
     571      276329 : V8_NOINLINE void InstallToStringTag(Isolate* isolate, Handle<JSObject> holder,
     572             :                                     Handle<String> value) {
     573      276328 :   JSObject::AddProperty(isolate, holder,
     574             :                         isolate->factory()->to_string_tag_symbol(), value,
     575      276329 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     576      276328 : }
     577             : 
     578             : void InstallToStringTag(Isolate* isolate, Handle<JSObject> holder,
     579             :                         const char* value) {
     580      273207 :   InstallToStringTag(isolate, holder,
     581      273208 :                      isolate->factory()->InternalizeUtf8String(value));
     582             : }
     583             : 
     584             : }  // namespace
     585             : 
     586         111 : Handle<JSFunction> Genesis::CreateEmptyFunction() {
     587             :   // Allocate the function map first and then patch the prototype later.
     588             :   Handle<Map> empty_function_map = factory()->CreateSloppyFunctionMap(
     589         111 :       FUNCTION_WITHOUT_PROTOTYPE, MaybeHandle<JSFunction>());
     590             :   empty_function_map->set_is_prototype_map(true);
     591             :   DCHECK(!empty_function_map->is_dictionary_map());
     592             : 
     593             :   // Allocate ScopeInfo for the empty function.
     594         111 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateForEmptyFunction(isolate());
     595             : 
     596             :   // Allocate the empty function as the prototype for function according to
     597             :   // ES#sec-properties-of-the-function-prototype-object
     598             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
     599         111 :       factory()->empty_string(), empty_function_map, Builtins::kEmptyFunction);
     600         111 :   Handle<JSFunction> empty_function = factory()->NewFunction(args);
     601         111 :   native_context()->set_empty_function(*empty_function);
     602             : 
     603             :   // --- E m p t y ---
     604         111 :   Handle<String> source = factory()->NewStringFromStaticChars("() {}");
     605         111 :   Handle<Script> script = factory()->NewScript(source);
     606             :   script->set_type(Script::TYPE_NATIVE);
     607         111 :   Handle<WeakFixedArray> infos = factory()->NewWeakFixedArray(2);
     608         111 :   script->set_shared_function_infos(*infos);
     609         111 :   empty_function->shared()->set_scope_info(*scope_info);
     610             :   empty_function->shared()->DontAdaptArguments();
     611         111 :   SharedFunctionInfo::SetScript(handle(empty_function->shared(), isolate()),
     612         111 :                                 script, 1);
     613             : 
     614         111 :   return empty_function;
     615             : }
     616             : 
     617         111 : void Genesis::CreateSloppyModeFunctionMaps(Handle<JSFunction> empty) {
     618         111 :   Factory* factory = isolate_->factory();
     619             :   Handle<Map> map;
     620             : 
     621             :   //
     622             :   // Allocate maps for sloppy functions without prototype.
     623             :   //
     624         111 :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     625         111 :   native_context()->set_sloppy_function_without_prototype_map(*map);
     626             : 
     627             :   //
     628             :   // Allocate maps for sloppy functions with readonly prototype.
     629             :   //
     630             :   map =
     631         111 :       factory->CreateSloppyFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     632         111 :   native_context()->set_sloppy_function_with_readonly_prototype_map(*map);
     633             : 
     634             :   //
     635             :   // Allocate maps for sloppy functions with writable prototype.
     636             :   //
     637             :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     638         111 :                                          empty);
     639         111 :   native_context()->set_sloppy_function_map(*map);
     640             : 
     641             :   map = factory->CreateSloppyFunctionMap(
     642         111 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     643         111 :   native_context()->set_sloppy_function_with_name_map(*map);
     644         111 : }
     645             : 
     646         222 : Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {
     647         222 :   if (!restricted_properties_thrower_.is_null()) {
     648         111 :     return restricted_properties_thrower_;
     649             :   }
     650         111 :   Handle<String> name = factory()->empty_string();
     651             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
     652         111 :       name, Builtins::kStrictPoisonPillThrower, i::LanguageMode::kStrict);
     653         111 :   Handle<JSFunction> function = factory()->NewFunction(args);
     654             :   function->shared()->DontAdaptArguments();
     655             : 
     656             :   // %ThrowTypeError% must not have a name property.
     657         111 :   if (JSReceiver::DeleteProperty(function, factory()->name_string())
     658             :           .IsNothing()) {
     659             :     DCHECK(false);
     660             :   }
     661             : 
     662             :   // length needs to be non configurable.
     663             :   Handle<Object> value(Smi::FromInt(function->shared()->GetLength()),
     664             :                        isolate());
     665         111 :   JSObject::SetOwnPropertyIgnoreAttributes(
     666             :       function, factory()->length_string(), value,
     667         111 :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))
     668             :       .Assert();
     669             : 
     670         111 :   if (JSObject::PreventExtensions(function, kThrowOnError).IsNothing()) {
     671             :     DCHECK(false);
     672             :   }
     673             : 
     674         111 :   JSObject::MigrateSlowToFast(function, 0, "Bootstrapping");
     675             : 
     676         111 :   restricted_properties_thrower_ = function;
     677         111 :   return function;
     678             : }
     679             : 
     680         111 : void Genesis::CreateStrictModeFunctionMaps(Handle<JSFunction> empty) {
     681         111 :   Factory* factory = isolate_->factory();
     682             :   Handle<Map> map;
     683             : 
     684             :   //
     685             :   // Allocate maps for strict functions without prototype.
     686             :   //
     687         111 :   map = factory->CreateStrictFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     688         111 :   native_context()->set_strict_function_without_prototype_map(*map);
     689             : 
     690         111 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_NAME, empty);
     691         111 :   native_context()->set_method_with_name_map(*map);
     692             : 
     693         111 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_HOME_OBJECT, empty);
     694         111 :   native_context()->set_method_with_home_object_map(*map);
     695             : 
     696             :   map =
     697         111 :       factory->CreateStrictFunctionMap(METHOD_WITH_NAME_AND_HOME_OBJECT, empty);
     698         111 :   native_context()->set_method_with_name_and_home_object_map(*map);
     699             : 
     700             :   //
     701             :   // Allocate maps for strict functions with writable prototype.
     702             :   //
     703             :   map = factory->CreateStrictFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     704         111 :                                          empty);
     705         111 :   native_context()->set_strict_function_map(*map);
     706             : 
     707             :   map = factory->CreateStrictFunctionMap(
     708         111 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     709         111 :   native_context()->set_strict_function_with_name_map(*map);
     710             : 
     711             :   strict_function_with_home_object_map_ = factory->CreateStrictFunctionMap(
     712         111 :       FUNCTION_WITH_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     713             :   strict_function_with_name_and_home_object_map_ =
     714             :       factory->CreateStrictFunctionMap(
     715         111 :           FUNCTION_WITH_NAME_AND_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     716             : 
     717             :   //
     718             :   // Allocate maps for strict functions with readonly prototype.
     719             :   //
     720             :   map =
     721         111 :       factory->CreateStrictFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     722         111 :   native_context()->set_strict_function_with_readonly_prototype_map(*map);
     723             : 
     724             :   //
     725             :   // Allocate map for class functions.
     726             :   //
     727         111 :   map = factory->CreateClassFunctionMap(empty);
     728         111 :   native_context()->set_class_function_map(*map);
     729             : 
     730             :   // Now that the strict mode function map is available, set up the
     731             :   // restricted "arguments" and "caller" getters.
     732         111 :   AddRestrictedFunctionProperties(empty);
     733         111 : }
     734             : 
     735         111 : void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
     736         111 :   Factory* factory = isolate_->factory();
     737             : 
     738             :   // --- O b j e c t ---
     739             :   int inobject_properties = JSObject::kInitialGlobalObjectUnusedPropertiesCount;
     740             :   int instance_size = JSObject::kHeaderSize + kTaggedSize * inobject_properties;
     741             : 
     742             :   Handle<JSFunction> object_fun = CreateFunction(
     743             :       isolate_, factory->Object_string(), JS_OBJECT_TYPE, instance_size,
     744         111 :       inobject_properties, factory->null_value(), Builtins::kObjectConstructor);
     745             :   object_fun->shared()->set_length(1);
     746             :   object_fun->shared()->DontAdaptArguments();
     747         111 :   native_context()->set_object_function(*object_fun);
     748             : 
     749             :   {
     750             :     // Finish setting up Object function's initial map.
     751         111 :     Map initial_map = object_fun->initial_map();
     752         111 :     initial_map->set_elements_kind(HOLEY_ELEMENTS);
     753             :   }
     754             : 
     755             :   // Allocate a new prototype for the object function.
     756             :   Handle<JSObject> object_function_prototype =
     757         111 :       factory->NewFunctionPrototype(object_fun);
     758             : 
     759             :   Handle<Map> map =
     760             :       Map::Copy(isolate(), handle(object_function_prototype->map(), isolate()),
     761         111 :                 "EmptyObjectPrototype");
     762             :   map->set_is_prototype_map(true);
     763             :   // Ban re-setting Object.prototype.__proto__ to prevent Proxy security bug
     764         111 :   map->set_is_immutable_proto(true);
     765         111 :   object_function_prototype->set_map(*map);
     766             : 
     767             :   // Complete setting up empty function.
     768             :   {
     769         111 :     Handle<Map> empty_function_map(empty_function->map(), isolate_);
     770         111 :     Map::SetPrototype(isolate(), empty_function_map, object_function_prototype);
     771             :   }
     772             : 
     773         111 :   native_context()->set_initial_object_prototype(*object_function_prototype);
     774         111 :   JSFunction::SetPrototype(object_fun, object_function_prototype);
     775             : 
     776             :   {
     777             :     // Set up slow map for Object.create(null) instances without in-object
     778             :     // properties.
     779         111 :     Handle<Map> map(object_fun->initial_map(), isolate_);
     780         111 :     map = Map::CopyInitialMapNormalized(isolate(), map);
     781         111 :     Map::SetPrototype(isolate(), map, factory->null_value());
     782         111 :     native_context()->set_slow_object_with_null_prototype_map(*map);
     783             : 
     784             :     // Set up slow map for literals with too many properties.
     785         111 :     map = Map::Copy(isolate(), map, "slow_object_with_object_prototype_map");
     786         111 :     Map::SetPrototype(isolate(), map, object_function_prototype);
     787         111 :     native_context()->set_slow_object_with_object_prototype_map(*map);
     788             :   }
     789         111 : }
     790             : 
     791             : namespace {
     792             : 
     793         888 : Handle<Map> CreateNonConstructorMap(Isolate* isolate, Handle<Map> source_map,
     794             :                                     Handle<JSObject> prototype,
     795             :                                     const char* reason) {
     796         888 :   Handle<Map> map = Map::Copy(isolate, source_map, reason);
     797             :   // Ensure the resulting map has prototype slot (it is necessary for storing
     798             :   // inital map even when the prototype property is not required).
     799         888 :   if (!map->has_prototype_slot()) {
     800             :     // Re-set the unused property fields after changing the instance size.
     801             :     // TODO(ulan): Do not change instance size after map creation.
     802           0 :     int unused_property_fields = map->UnusedPropertyFields();
     803           0 :     map->set_instance_size(map->instance_size() + kTaggedSize);
     804             :     // The prototype slot shifts the in-object properties area by one slot.
     805           0 :     map->SetInObjectPropertiesStartInWords(
     806           0 :         map->GetInObjectPropertiesStartInWords() + 1);
     807           0 :     map->set_has_prototype_slot(true);
     808           0 :     map->SetInObjectUnusedPropertyFields(unused_property_fields);
     809             :   }
     810             :   map->set_is_constructor(false);
     811         888 :   Map::SetPrototype(isolate, map, prototype);
     812         888 :   return map;
     813             : }
     814             : 
     815             : }  // namespace
     816             : 
     817         111 : void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
     818             :   // Create iterator-related meta-objects.
     819             :   Handle<JSObject> iterator_prototype = factory()->NewJSObject(
     820         111 :       isolate()->object_function(), AllocationType::kOld);
     821             : 
     822             :   InstallFunctionAtSymbol(isolate(), iterator_prototype,
     823             :                           factory()->iterator_symbol(), "[Symbol.iterator]",
     824         111 :                           Builtins::kReturnReceiver, 0, true);
     825         111 :   native_context()->set_initial_iterator_prototype(*iterator_prototype);
     826             : 
     827             :   Handle<JSObject> generator_object_prototype = factory()->NewJSObject(
     828         111 :       isolate()->object_function(), AllocationType::kOld);
     829         222 :   native_context()->set_initial_generator_prototype(
     830         111 :       *generator_object_prototype);
     831         111 :   JSObject::ForceSetPrototype(generator_object_prototype, iterator_prototype);
     832             :   Handle<JSObject> generator_function_prototype = factory()->NewJSObject(
     833         111 :       isolate()->object_function(), AllocationType::kOld);
     834         111 :   JSObject::ForceSetPrototype(generator_function_prototype, empty);
     835             : 
     836             :   InstallToStringTag(isolate(), generator_function_prototype,
     837             :                      "GeneratorFunction");
     838         111 :   JSObject::AddProperty(isolate(), generator_function_prototype,
     839             :                         factory()->prototype_string(),
     840             :                         generator_object_prototype,
     841         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     842             : 
     843         111 :   JSObject::AddProperty(isolate(), generator_object_prototype,
     844             :                         factory()->constructor_string(),
     845             :                         generator_function_prototype,
     846         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     847             :   InstallToStringTag(isolate(), generator_object_prototype, "Generator");
     848             :   SimpleInstallFunction(isolate(), generator_object_prototype, "next",
     849         111 :                         Builtins::kGeneratorPrototypeNext, 1, false);
     850             :   SimpleInstallFunction(isolate(), generator_object_prototype, "return",
     851         111 :                         Builtins::kGeneratorPrototypeReturn, 1, false);
     852             :   SimpleInstallFunction(isolate(), generator_object_prototype, "throw",
     853         111 :                         Builtins::kGeneratorPrototypeThrow, 1, false);
     854             : 
     855             :   // Internal version of generator_prototype_next, flagged as non-native such
     856             :   // that it doesn't show up in Error traces.
     857             :   Handle<JSFunction> generator_next_internal =
     858             :       SimpleCreateFunction(isolate(), factory()->next_string(),
     859         111 :                            Builtins::kGeneratorPrototypeNext, 1, false);
     860         111 :   generator_next_internal->shared()->set_native(false);
     861         111 :   native_context()->set_generator_next_internal(*generator_next_internal);
     862             : 
     863             :   // Create maps for generator functions and their prototypes.  Store those
     864             :   // maps in the native context. The "prototype" property descriptor is
     865             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     866             :   // 04-14-15, section 25.2.4.3).
     867             :   // Generator functions do not have "caller" or "arguments" accessors.
     868             :   Handle<Map> map;
     869             :   map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
     870             :                                 generator_function_prototype,
     871         111 :                                 "GeneratorFunction");
     872         111 :   native_context()->set_generator_function_map(*map);
     873             : 
     874             :   map = CreateNonConstructorMap(
     875             :       isolate(), isolate()->strict_function_with_name_map(),
     876         111 :       generator_function_prototype, "GeneratorFunction with name");
     877         111 :   native_context()->set_generator_function_with_name_map(*map);
     878             : 
     879             :   map = CreateNonConstructorMap(
     880             :       isolate(), strict_function_with_home_object_map_,
     881         111 :       generator_function_prototype, "GeneratorFunction with home object");
     882         111 :   native_context()->set_generator_function_with_home_object_map(*map);
     883             : 
     884             :   map = CreateNonConstructorMap(isolate(),
     885             :                                 strict_function_with_name_and_home_object_map_,
     886             :                                 generator_function_prototype,
     887         111 :                                 "GeneratorFunction with name and home object");
     888         111 :   native_context()->set_generator_function_with_name_and_home_object_map(*map);
     889             : 
     890         222 :   Handle<JSFunction> object_function(native_context()->object_function(),
     891         111 :                                      isolate());
     892         111 :   Handle<Map> generator_object_prototype_map = Map::Create(isolate(), 0);
     893         111 :   Map::SetPrototype(isolate(), generator_object_prototype_map,
     894         111 :                     generator_object_prototype);
     895         222 :   native_context()->set_generator_object_prototype_map(
     896         111 :       *generator_object_prototype_map);
     897         111 : }
     898             : 
     899         111 : void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
     900             :   // %AsyncIteratorPrototype%
     901             :   // proposal-async-iteration/#sec-asynciteratorprototype
     902             :   Handle<JSObject> async_iterator_prototype = factory()->NewJSObject(
     903         111 :       isolate()->object_function(), AllocationType::kOld);
     904             : 
     905             :   InstallFunctionAtSymbol(
     906             :       isolate(), async_iterator_prototype, factory()->async_iterator_symbol(),
     907         111 :       "[Symbol.asyncIterator]", Builtins::kReturnReceiver, 0, true);
     908             : 
     909             :   // %AsyncFromSyncIteratorPrototype%
     910             :   // proposal-async-iteration/#sec-%asyncfromsynciteratorprototype%-object
     911             :   Handle<JSObject> async_from_sync_iterator_prototype = factory()->NewJSObject(
     912         111 :       isolate()->object_function(), AllocationType::kOld);
     913             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "next",
     914         111 :                         Builtins::kAsyncFromSyncIteratorPrototypeNext, 1, true);
     915             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "return",
     916             :                         Builtins::kAsyncFromSyncIteratorPrototypeReturn, 1,
     917         111 :                         true);
     918             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "throw",
     919             :                         Builtins::kAsyncFromSyncIteratorPrototypeThrow, 1,
     920         111 :                         true);
     921             : 
     922             :   InstallToStringTag(isolate(), async_from_sync_iterator_prototype,
     923             :                      "Async-from-Sync Iterator");
     924             : 
     925         111 :   JSObject::ForceSetPrototype(async_from_sync_iterator_prototype,
     926         111 :                               async_iterator_prototype);
     927             : 
     928             :   Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
     929         111 :       JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
     930         111 :   Map::SetPrototype(isolate(), async_from_sync_iterator_map,
     931         111 :                     async_from_sync_iterator_prototype);
     932         222 :   native_context()->set_async_from_sync_iterator_map(
     933         111 :       *async_from_sync_iterator_map);
     934             : 
     935             :   // Async Generators
     936             :   Handle<JSObject> async_generator_object_prototype = factory()->NewJSObject(
     937         111 :       isolate()->object_function(), AllocationType::kOld);
     938             :   Handle<JSObject> async_generator_function_prototype = factory()->NewJSObject(
     939         111 :       isolate()->object_function(), AllocationType::kOld);
     940             : 
     941             :   // %AsyncGenerator% / %AsyncGeneratorFunction%.prototype
     942         111 :   JSObject::ForceSetPrototype(async_generator_function_prototype, empty);
     943             : 
     944             :   // The value of AsyncGeneratorFunction.prototype.prototype is the
     945             :   //     %AsyncGeneratorPrototype% intrinsic object.
     946             :   // This property has the attributes
     947             :   //     { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
     948         111 :   JSObject::AddProperty(isolate(), async_generator_function_prototype,
     949             :                         factory()->prototype_string(),
     950             :                         async_generator_object_prototype,
     951         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     952         111 :   JSObject::AddProperty(isolate(), async_generator_object_prototype,
     953             :                         factory()->constructor_string(),
     954             :                         async_generator_function_prototype,
     955         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     956             :   InstallToStringTag(isolate(), async_generator_function_prototype,
     957             :                      "AsyncGeneratorFunction");
     958             : 
     959             :   // %AsyncGeneratorPrototype%
     960         111 :   JSObject::ForceSetPrototype(async_generator_object_prototype,
     961         111 :                               async_iterator_prototype);
     962         222 :   native_context()->set_initial_async_generator_prototype(
     963         111 :       *async_generator_object_prototype);
     964             : 
     965             :   InstallToStringTag(isolate(), async_generator_object_prototype,
     966             :                      "AsyncGenerator");
     967             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "next",
     968         111 :                         Builtins::kAsyncGeneratorPrototypeNext, 1, false);
     969             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "return",
     970         111 :                         Builtins::kAsyncGeneratorPrototypeReturn, 1, false);
     971             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "throw",
     972         111 :                         Builtins::kAsyncGeneratorPrototypeThrow, 1, false);
     973             : 
     974             :   // Create maps for generator functions and their prototypes.  Store those
     975             :   // maps in the native context. The "prototype" property descriptor is
     976             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     977             :   // 04-14-15, section 25.2.4.3).
     978             :   // Async Generator functions do not have "caller" or "arguments" accessors.
     979             :   Handle<Map> map;
     980             :   map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
     981             :                                 async_generator_function_prototype,
     982         111 :                                 "AsyncGeneratorFunction");
     983         111 :   native_context()->set_async_generator_function_map(*map);
     984             : 
     985             :   map = CreateNonConstructorMap(
     986             :       isolate(), isolate()->strict_function_with_name_map(),
     987         111 :       async_generator_function_prototype, "AsyncGeneratorFunction with name");
     988         111 :   native_context()->set_async_generator_function_with_name_map(*map);
     989             : 
     990             :   map =
     991             :       CreateNonConstructorMap(isolate(), strict_function_with_home_object_map_,
     992             :                               async_generator_function_prototype,
     993         111 :                               "AsyncGeneratorFunction with home object");
     994         111 :   native_context()->set_async_generator_function_with_home_object_map(*map);
     995             : 
     996             :   map = CreateNonConstructorMap(
     997             :       isolate(), strict_function_with_name_and_home_object_map_,
     998             :       async_generator_function_prototype,
     999         111 :       "AsyncGeneratorFunction with name and home object");
    1000         222 :   native_context()->set_async_generator_function_with_name_and_home_object_map(
    1001         111 :       *map);
    1002             : 
    1003         222 :   Handle<JSFunction> object_function(native_context()->object_function(),
    1004         111 :                                      isolate());
    1005         111 :   Handle<Map> async_generator_object_prototype_map = Map::Create(isolate(), 0);
    1006         111 :   Map::SetPrototype(isolate(), async_generator_object_prototype_map,
    1007         111 :                     async_generator_object_prototype);
    1008         222 :   native_context()->set_async_generator_object_prototype_map(
    1009         111 :       *async_generator_object_prototype_map);
    1010         111 : }
    1011             : 
    1012         111 : void Genesis::CreateAsyncFunctionMaps(Handle<JSFunction> empty) {
    1013             :   // %AsyncFunctionPrototype% intrinsic
    1014             :   Handle<JSObject> async_function_prototype = factory()->NewJSObject(
    1015         111 :       isolate()->object_function(), AllocationType::kOld);
    1016         111 :   JSObject::ForceSetPrototype(async_function_prototype, empty);
    1017             : 
    1018             :   InstallToStringTag(isolate(), async_function_prototype, "AsyncFunction");
    1019             : 
    1020             :   Handle<Map> map =
    1021             :       Map::Copy(isolate(), isolate()->strict_function_without_prototype_map(),
    1022         111 :                 "AsyncFunction");
    1023         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1024         111 :   native_context()->set_async_function_map(*map);
    1025             : 
    1026             :   map = Map::Copy(isolate(), isolate()->method_with_name_map(),
    1027         111 :                   "AsyncFunction with name");
    1028         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1029         111 :   native_context()->set_async_function_with_name_map(*map);
    1030             : 
    1031             :   map = Map::Copy(isolate(), isolate()->method_with_home_object_map(),
    1032         111 :                   "AsyncFunction with home object");
    1033         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1034         111 :   native_context()->set_async_function_with_home_object_map(*map);
    1035             : 
    1036             :   map = Map::Copy(isolate(), isolate()->method_with_name_and_home_object_map(),
    1037         111 :                   "AsyncFunction with name and home object");
    1038         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1039         111 :   native_context()->set_async_function_with_name_and_home_object_map(*map);
    1040         111 : }
    1041             : 
    1042         111 : void Genesis::CreateJSProxyMaps() {
    1043             :   // Allocate maps for all Proxy types.
    1044             :   // Next to the default proxy, we need maps indicating callable and
    1045             :   // constructable proxies.
    1046             :   Handle<Map> proxy_map = factory()->NewMap(JS_PROXY_TYPE, JSProxy::kSize,
    1047         111 :                                             TERMINAL_FAST_ELEMENTS_KIND);
    1048         111 :   proxy_map->set_is_dictionary_map(true);
    1049         111 :   proxy_map->set_may_have_interesting_symbols(true);
    1050         111 :   native_context()->set_proxy_map(*proxy_map);
    1051             : 
    1052             :   Handle<Map> proxy_callable_map =
    1053         111 :       Map::Copy(isolate_, proxy_map, "callable Proxy");
    1054             :   proxy_callable_map->set_is_callable(true);
    1055         111 :   native_context()->set_proxy_callable_map(*proxy_callable_map);
    1056         222 :   proxy_callable_map->SetConstructor(native_context()->function_function());
    1057             : 
    1058             :   Handle<Map> proxy_constructor_map =
    1059         111 :       Map::Copy(isolate_, proxy_callable_map, "constructor Proxy");
    1060             :   proxy_constructor_map->set_is_constructor(true);
    1061         111 :   native_context()->set_proxy_constructor_map(*proxy_constructor_map);
    1062             : 
    1063             :   {
    1064             :     Handle<Map> map =
    1065             :         factory()->NewMap(JS_OBJECT_TYPE, JSProxyRevocableResult::kSize,
    1066         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 2);
    1067         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    1068             : 
    1069             :     {  // proxy
    1070             :       Descriptor d = Descriptor::DataField(isolate(), factory()->proxy_string(),
    1071             :                                            JSProxyRevocableResult::kProxyIndex,
    1072         111 :                                            NONE, Representation::Tagged());
    1073         111 :       map->AppendDescriptor(isolate(), &d);
    1074             :     }
    1075             :     {  // revoke
    1076             :       Descriptor d = Descriptor::DataField(
    1077             :           isolate(), factory()->revoke_string(),
    1078         111 :           JSProxyRevocableResult::kRevokeIndex, NONE, Representation::Tagged());
    1079         111 :       map->AppendDescriptor(isolate(), &d);
    1080             :     }
    1081             : 
    1082         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    1083         222 :     map->SetConstructor(native_context()->object_function());
    1084             : 
    1085         111 :     native_context()->set_proxy_revocable_result_map(*map);
    1086             :   }
    1087         111 : }
    1088             : 
    1089             : namespace {
    1090         222 : void ReplaceAccessors(Isolate* isolate, Handle<Map> map, Handle<String> name,
    1091             :                       PropertyAttributes attributes,
    1092             :                       Handle<AccessorPair> accessor_pair) {
    1093         222 :   DescriptorArray descriptors = map->instance_descriptors();
    1094             :   int idx = descriptors->SearchWithCache(isolate, *name, *map);
    1095         222 :   Descriptor d = Descriptor::AccessorConstant(name, accessor_pair, attributes);
    1096         222 :   descriptors->Replace(idx, &d);
    1097         222 : }
    1098             : }  // namespace
    1099             : 
    1100         111 : void Genesis::AddRestrictedFunctionProperties(Handle<JSFunction> empty) {
    1101             :   PropertyAttributes rw_attribs = static_cast<PropertyAttributes>(DONT_ENUM);
    1102         111 :   Handle<JSFunction> thrower = GetThrowTypeErrorIntrinsic();
    1103         111 :   Handle<AccessorPair> accessors = factory()->NewAccessorPair();
    1104         222 :   accessors->set_getter(*thrower);
    1105         222 :   accessors->set_setter(*thrower);
    1106             : 
    1107             :   Handle<Map> map(empty->map(), isolate());
    1108             :   ReplaceAccessors(isolate(), map, factory()->arguments_string(), rw_attribs,
    1109         111 :                    accessors);
    1110             :   ReplaceAccessors(isolate(), map, factory()->caller_string(), rw_attribs,
    1111         111 :                    accessors);
    1112         111 : }
    1113             : 
    1114       90480 : static void AddToWeakNativeContextList(Isolate* isolate, Context context) {
    1115             :   DCHECK(context->IsNativeContext());
    1116             :   Heap* heap = isolate->heap();
    1117             : #ifdef DEBUG
    1118             :   { // NOLINT
    1119             :     DCHECK(context->next_context_link()->IsUndefined(isolate));
    1120             :     // Check that context is not in the list yet.
    1121             :     for (Object current = heap->native_contexts_list();
    1122             :          !current->IsUndefined(isolate);
    1123             :          current = Context::cast(current)->next_context_link()) {
    1124             :       DCHECK(current != context);
    1125             :     }
    1126             :   }
    1127             : #endif
    1128             :   context->set(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list(),
    1129             :                UPDATE_WEAK_WRITE_BARRIER);
    1130             :   heap->set_native_contexts_list(context);
    1131       90480 : }
    1132             : 
    1133             : 
    1134         111 : void Genesis::CreateRoots() {
    1135             :   // Allocate the native context FixedArray first and then patch the
    1136             :   // closure and extension object later (we need the empty function
    1137             :   // and the global object, but in order to create those, we need the
    1138             :   // native context).
    1139         111 :   native_context_ = factory()->NewNativeContext();
    1140         111 :   AddToWeakNativeContextList(isolate(), *native_context());
    1141             :   isolate()->set_context(*native_context());
    1142             : 
    1143             :   // Allocate the message listeners object.
    1144             :   {
    1145         111 :     Handle<TemplateList> list = TemplateList::New(isolate(), 1);
    1146         111 :     native_context()->set_message_listeners(*list);
    1147             :   }
    1148         111 : }
    1149             : 
    1150             : 
    1151         111 : void Genesis::InstallGlobalThisBinding() {
    1152             :   Handle<ScriptContextTable> script_contexts(
    1153         222 :       native_context()->script_context_table(), isolate());
    1154         111 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateGlobalThisBinding(isolate());
    1155             :   Handle<Context> context =
    1156         111 :       factory()->NewScriptContext(native_context(), scope_info);
    1157             : 
    1158             :   // Go ahead and hook it up while we're at it.
    1159         111 :   int slot = scope_info->ReceiverContextSlotIndex();
    1160             :   DCHECK_EQ(slot, Context::MIN_CONTEXT_SLOTS);
    1161         222 :   context->set(slot, native_context()->global_proxy());
    1162             : 
    1163             :   Handle<ScriptContextTable> new_script_contexts =
    1164         111 :       ScriptContextTable::Extend(script_contexts, context);
    1165         111 :   native_context()->set_script_context_table(*new_script_contexts);
    1166         111 : }
    1167             : 
    1168             : 
    1169       90440 : Handle<JSGlobalObject> Genesis::CreateNewGlobals(
    1170             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    1171             :     Handle<JSGlobalProxy> global_proxy) {
    1172             :   // The argument global_proxy_template aka data is an ObjectTemplateInfo.
    1173             :   // It has a constructor pointer that points at global_constructor which is a
    1174             :   // FunctionTemplateInfo.
    1175             :   // The global_proxy_constructor is used to (re)initialize the
    1176             :   // global_proxy. The global_proxy_constructor also has a prototype_template
    1177             :   // pointer that points at js_global_object_template which is an
    1178             :   // ObjectTemplateInfo.
    1179             :   // That in turn has a constructor pointer that points at
    1180             :   // js_global_object_constructor which is a FunctionTemplateInfo.
    1181             :   // js_global_object_constructor is used to make js_global_object_function
    1182             :   // js_global_object_function is used to make the new global_object.
    1183             :   //
    1184             :   // --- G l o b a l ---
    1185             :   // Step 1: Create a fresh JSGlobalObject.
    1186             :   Handle<JSFunction> js_global_object_function;
    1187             :   Handle<ObjectTemplateInfo> js_global_object_template;
    1188       90440 :   if (!global_proxy_template.IsEmpty()) {
    1189             :     // Get prototype template of the global_proxy_template.
    1190             :     Handle<ObjectTemplateInfo> data =
    1191             :         v8::Utils::OpenHandle(*global_proxy_template);
    1192             :     Handle<FunctionTemplateInfo> global_constructor =
    1193             :         Handle<FunctionTemplateInfo>(
    1194             :             FunctionTemplateInfo::cast(data->constructor()), isolate());
    1195             :     Handle<Object> proto_template(global_constructor->GetPrototypeTemplate(),
    1196      111528 :                                   isolate());
    1197       55764 :     if (!proto_template->IsUndefined(isolate())) {
    1198             :       js_global_object_template =
    1199             :           Handle<ObjectTemplateInfo>::cast(proto_template);
    1200             :     }
    1201             :   }
    1202             : 
    1203       90440 :   if (js_global_object_template.is_null()) {
    1204       34676 :     Handle<String> name = factory()->empty_string();
    1205             :     Handle<JSObject> prototype =
    1206       34676 :         factory()->NewFunctionPrototype(isolate()->object_function());
    1207             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1208             :         name, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize, 0,
    1209       34676 :         Builtins::kIllegal, MUTABLE);
    1210       34676 :     js_global_object_function = factory()->NewFunction(args);
    1211             : #ifdef DEBUG
    1212             :     LookupIterator it(isolate(), prototype, factory()->constructor_string(),
    1213             :                       LookupIterator::OWN_SKIP_INTERCEPTOR);
    1214             :     Handle<Object> value = Object::GetProperty(&it).ToHandleChecked();
    1215             :     DCHECK(it.IsFound());
    1216             :     DCHECK_EQ(*isolate()->object_function(), *value);
    1217             : #endif
    1218             :   } else {
    1219             :     Handle<FunctionTemplateInfo> js_global_object_constructor(
    1220             :         FunctionTemplateInfo::cast(js_global_object_template->constructor()),
    1221             :         isolate());
    1222             :     js_global_object_function = ApiNatives::CreateApiFunction(
    1223             :         isolate(), js_global_object_constructor, factory()->the_hole_value(),
    1224      111528 :         JS_GLOBAL_OBJECT_TYPE);
    1225             :   }
    1226             : 
    1227             :   js_global_object_function->initial_map()->set_is_prototype_map(true);
    1228       90440 :   js_global_object_function->initial_map()->set_is_dictionary_map(true);
    1229      180880 :   js_global_object_function->initial_map()->set_may_have_interesting_symbols(
    1230       90440 :       true);
    1231             :   Handle<JSGlobalObject> global_object =
    1232       90440 :       factory()->NewJSGlobalObject(js_global_object_function);
    1233             : 
    1234             :   // Step 2: (re)initialize the global proxy object.
    1235             :   Handle<JSFunction> global_proxy_function;
    1236       90440 :   if (global_proxy_template.IsEmpty()) {
    1237       34676 :     Handle<String> name = factory()->empty_string();
    1238             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1239             :         name, factory()->the_hole_value(), JS_GLOBAL_PROXY_TYPE,
    1240             :         JSGlobalProxy::SizeWithEmbedderFields(0), 0, Builtins::kIllegal,
    1241       34676 :         MUTABLE);
    1242       34676 :     global_proxy_function = factory()->NewFunction(args);
    1243             :   } else {
    1244             :     Handle<ObjectTemplateInfo> data =
    1245             :         v8::Utils::OpenHandle(*global_proxy_template);
    1246             :     Handle<FunctionTemplateInfo> global_constructor(
    1247             :         FunctionTemplateInfo::cast(data->constructor()), isolate());
    1248             :     global_proxy_function = ApiNatives::CreateApiFunction(
    1249             :         isolate(), global_constructor, factory()->the_hole_value(),
    1250      111528 :         JS_GLOBAL_PROXY_TYPE);
    1251             :   }
    1252             :   global_proxy_function->initial_map()->set_is_access_check_needed(true);
    1253       90440 :   global_proxy_function->initial_map()->set_has_hidden_prototype(true);
    1254       90439 :   global_proxy_function->initial_map()->set_may_have_interesting_symbols(true);
    1255       90440 :   native_context()->set_global_proxy_function(*global_proxy_function);
    1256             : 
    1257             :   // Set global_proxy.__proto__ to js_global after ConfigureGlobalObjects
    1258             :   // Return the global proxy.
    1259             : 
    1260       90440 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1261             : 
    1262             :   // Set the native context for the global object.
    1263       90440 :   global_object->set_native_context(*native_context());
    1264       90440 :   global_object->set_global_proxy(*global_proxy);
    1265             :   // Set the native context of the global proxy.
    1266      180880 :   global_proxy->set_native_context(*native_context());
    1267             :   // Set the global proxy of the native context. If the native context has been
    1268             :   // deserialized, the global proxy is already correctly set up by the
    1269             :   // deserializer. Otherwise it's undefined.
    1270             :   DCHECK(native_context()
    1271             :              ->get(Context::GLOBAL_PROXY_INDEX)
    1272             :              ->IsUndefined(isolate()) ||
    1273             :          native_context()->global_proxy() == *global_proxy);
    1274       90440 :   native_context()->set_global_proxy(*global_proxy);
    1275             : 
    1276       90440 :   return global_object;
    1277             : }
    1278             : 
    1279          40 : void Genesis::HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy) {
    1280             :   // Re-initialize the global proxy with the global proxy function from the
    1281             :   // snapshot, and then set up the link to the native context.
    1282             :   Handle<JSFunction> global_proxy_function(
    1283          80 :       native_context()->global_proxy_function(), isolate());
    1284          40 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1285             :   Handle<JSObject> global_object(
    1286          80 :       JSObject::cast(native_context()->global_object()), isolate());
    1287          40 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    1288          80 :   global_proxy->set_native_context(*native_context());
    1289             :   DCHECK(native_context()->global_proxy() == *global_proxy);
    1290          40 : }
    1291             : 
    1292       90329 : void Genesis::HookUpGlobalObject(Handle<JSGlobalObject> global_object) {
    1293             :   Handle<JSGlobalObject> global_object_from_snapshot(
    1294      180658 :       JSGlobalObject::cast(native_context()->extension()), isolate());
    1295      180658 :   native_context()->set_extension(*global_object);
    1296      180658 :   native_context()->set_security_token(*global_object);
    1297             : 
    1298       90329 :   TransferNamedProperties(global_object_from_snapshot, global_object);
    1299       90329 :   TransferIndexedProperties(global_object_from_snapshot, global_object);
    1300       90329 : }
    1301             : 
    1302       94836 : static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
    1303             :                                              Handle<JSFunction> function,
    1304             :                                              int context_index) {
    1305             :   Handle<Smi> index(Smi::FromInt(context_index), isolate);
    1306       94836 :   JSObject::AddProperty(isolate, function,
    1307             :                         isolate->factory()->native_context_index_symbol(),
    1308       94836 :                         index, NONE);
    1309      284508 :   isolate->native_context()->set(context_index, *function);
    1310       94836 : }
    1311             : 
    1312        1110 : static void InstallError(Isolate* isolate, Handle<JSObject> global,
    1313             :                          Handle<String> name, int context_index) {
    1314             :   Factory* factory = isolate->factory();
    1315             : 
    1316             :   Handle<JSFunction> error_fun = InstallFunction(
    1317             :       isolate, global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
    1318        1110 :       factory->the_hole_value(), Builtins::kErrorConstructor);
    1319             :   error_fun->shared()->DontAdaptArguments();
    1320             :   error_fun->shared()->set_length(1);
    1321             : 
    1322        1110 :   if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1323             :     SimpleInstallFunction(isolate, error_fun, "captureStackTrace",
    1324         111 :                           Builtins::kErrorCaptureStackTrace, 2, false);
    1325             :   }
    1326             : 
    1327        1110 :   InstallWithIntrinsicDefaultProto(isolate, error_fun, context_index);
    1328             : 
    1329             :   {
    1330             :     // Setup %XXXErrorPrototype%.
    1331             :     Handle<JSObject> prototype(JSObject::cast(error_fun->instance_prototype()),
    1332        2220 :                                isolate);
    1333             : 
    1334        1110 :     JSObject::AddProperty(isolate, prototype, factory->name_string(), name,
    1335        1110 :                           DONT_ENUM);
    1336        1110 :     JSObject::AddProperty(isolate, prototype, factory->message_string(),
    1337        1110 :                           factory->empty_string(), DONT_ENUM);
    1338             : 
    1339        1110 :     if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1340             :       Handle<JSFunction> to_string_fun =
    1341             :           SimpleInstallFunction(isolate, prototype, "toString",
    1342         111 :                                 Builtins::kErrorPrototypeToString, 0, true);
    1343         222 :       isolate->native_context()->set_error_to_string(*to_string_fun);
    1344         222 :       isolate->native_context()->set_initial_error_prototype(*prototype);
    1345             :     } else {
    1346             :       DCHECK(isolate->native_context()->error_to_string()->IsJSFunction());
    1347             : 
    1348        1998 :       JSObject::AddProperty(isolate, prototype, factory->toString_string(),
    1349         999 :                             isolate->error_to_string(), DONT_ENUM);
    1350             : 
    1351         999 :       Handle<JSFunction> global_error = isolate->error_function();
    1352        1998 :       CHECK(JSReceiver::SetPrototype(error_fun, global_error, false,
    1353             :                                      kThrowOnError)
    1354             :                 .FromMaybe(false));
    1355        2997 :       CHECK(JSReceiver::SetPrototype(prototype,
    1356             :                                      handle(global_error->prototype(), isolate),
    1357             :                                      false, kThrowOnError)
    1358             :                 .FromMaybe(false));
    1359             :     }
    1360             :   }
    1361             : 
    1362             :   Handle<Map> initial_map(error_fun->initial_map(), isolate);
    1363        1110 :   Map::EnsureDescriptorSlack(isolate, initial_map, 1);
    1364             : 
    1365             :   {
    1366             :     Handle<AccessorInfo> info = factory->error_stack_accessor();
    1367             :     Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
    1368        1110 :                                                 info, DONT_ENUM);
    1369        1110 :     initial_map->AppendDescriptor(isolate, &d);
    1370             :   }
    1371        1110 : }
    1372             : 
    1373             : namespace {
    1374             : 
    1375         555 : void InstallMakeError(Isolate* isolate, int builtin_id, int context_index) {
    1376             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1377             :       isolate->factory()->empty_string(), isolate->factory()->the_hole_value(),
    1378         555 :       JS_OBJECT_TYPE, JSObject::kHeaderSize, 0, builtin_id, MUTABLE);
    1379             : 
    1380         555 :   Handle<JSFunction> function = isolate->factory()->NewFunction(args);
    1381             :   function->shared()->DontAdaptArguments();
    1382        1665 :   isolate->native_context()->set(context_index, *function);
    1383         555 : }
    1384             : 
    1385             : }  // namespace
    1386             : 
    1387             : // This is only called if we are not using snapshots.  The equivalent
    1388             : // work in the snapshot case is done in HookUpGlobalObject.
    1389         111 : void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
    1390             :                                Handle<JSFunction> empty_function) {
    1391             :   // --- N a t i v e   C o n t e x t ---
    1392             :   // Use the empty scope info.
    1393         222 :   native_context()->set_scope_info(empty_function->shared()->scope_info());
    1394         111 :   native_context()->set_previous(Context());
    1395             :   // Set extension and global object.
    1396         222 :   native_context()->set_extension(*global_object);
    1397             :   // Security setup: Set the security token of the native context to the global
    1398             :   // object. This makes the security check between two different contexts fail
    1399             :   // by default even in case of global object reinitialization.
    1400         222 :   native_context()->set_security_token(*global_object);
    1401             : 
    1402         111 :   Factory* factory = isolate_->factory();
    1403             : 
    1404             :   Handle<ScriptContextTable> script_context_table =
    1405         111 :       factory->NewScriptContextTable();
    1406         111 :   native_context()->set_script_context_table(*script_context_table);
    1407         111 :   InstallGlobalThisBinding();
    1408             : 
    1409             :   {  // --- O b j e c t ---
    1410             :     Handle<String> object_name = factory->Object_string();
    1411         111 :     Handle<JSFunction> object_function = isolate_->object_function();
    1412         222 :     JSObject::AddProperty(isolate_, global_object, object_name, object_function,
    1413         111 :                           DONT_ENUM);
    1414             : 
    1415             :     SimpleInstallFunction(isolate_, object_function, "assign",
    1416         111 :                           Builtins::kObjectAssign, 2, false);
    1417             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertyDescriptor",
    1418         111 :                           Builtins::kObjectGetOwnPropertyDescriptor, 2, false);
    1419             :     SimpleInstallFunction(isolate_, object_function,
    1420             :                           "getOwnPropertyDescriptors",
    1421         111 :                           Builtins::kObjectGetOwnPropertyDescriptors, 1, false);
    1422             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertyNames",
    1423         111 :                           Builtins::kObjectGetOwnPropertyNames, 1, true);
    1424             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertySymbols",
    1425         111 :                           Builtins::kObjectGetOwnPropertySymbols, 1, false);
    1426             :     SimpleInstallFunction(isolate_, object_function, "is", Builtins::kObjectIs,
    1427         111 :                           2, true);
    1428             :     SimpleInstallFunction(isolate_, object_function, "preventExtensions",
    1429         111 :                           Builtins::kObjectPreventExtensions, 1, false);
    1430             :     SimpleInstallFunction(isolate_, object_function, "seal",
    1431         111 :                           Builtins::kObjectSeal, 1, false);
    1432             : 
    1433             :     Handle<JSFunction> object_create = SimpleInstallFunction(
    1434         111 :         isolate_, object_function, "create", Builtins::kObjectCreate, 2, false);
    1435         111 :     native_context()->set_object_create(*object_create);
    1436             : 
    1437             :     Handle<JSFunction> object_define_properties =
    1438             :         SimpleInstallFunction(isolate_, object_function, "defineProperties",
    1439         111 :                               Builtins::kObjectDefineProperties, 2, true);
    1440         111 :     native_context()->set_object_define_properties(*object_define_properties);
    1441             : 
    1442             :     Handle<JSFunction> object_define_property =
    1443             :         SimpleInstallFunction(isolate_, object_function, "defineProperty",
    1444         111 :                               Builtins::kObjectDefineProperty, 3, true);
    1445         111 :     native_context()->set_object_define_property(*object_define_property);
    1446             : 
    1447             :     SimpleInstallFunction(isolate_, object_function, "freeze",
    1448         111 :                           Builtins::kObjectFreeze, 1, false);
    1449             : 
    1450             :     Handle<JSFunction> object_get_prototype_of =
    1451             :         SimpleInstallFunction(isolate_, object_function, "getPrototypeOf",
    1452         111 :                               Builtins::kObjectGetPrototypeOf, 1, false);
    1453         111 :     native_context()->set_object_get_prototype_of(*object_get_prototype_of);
    1454             :     SimpleInstallFunction(isolate_, object_function, "setPrototypeOf",
    1455         111 :                           Builtins::kObjectSetPrototypeOf, 2, false);
    1456             : 
    1457             :     SimpleInstallFunction(isolate_, object_function, "isExtensible",
    1458         111 :                           Builtins::kObjectIsExtensible, 1, false);
    1459             :     SimpleInstallFunction(isolate_, object_function, "isFrozen",
    1460         111 :                           Builtins::kObjectIsFrozen, 1, false);
    1461             : 
    1462             :     Handle<JSFunction> object_is_sealed =
    1463             :         SimpleInstallFunction(isolate_, object_function, "isSealed",
    1464         111 :                               Builtins::kObjectIsSealed, 1, false);
    1465         111 :     native_context()->set_object_is_sealed(*object_is_sealed);
    1466             : 
    1467             :     Handle<JSFunction> object_keys = SimpleInstallFunction(
    1468         111 :         isolate_, object_function, "keys", Builtins::kObjectKeys, 1, true);
    1469         111 :     native_context()->set_object_keys(*object_keys);
    1470             :     SimpleInstallFunction(isolate_, object_function, "entries",
    1471         111 :                           Builtins::kObjectEntries, 1, true);
    1472             :     SimpleInstallFunction(isolate_, object_function, "values",
    1473         111 :                           Builtins::kObjectValues, 1, true);
    1474             : 
    1475         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1476             :                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
    1477         111 :                           true);
    1478         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1479             :                           "__defineSetter__", Builtins::kObjectDefineSetter, 2,
    1480         111 :                           true);
    1481         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1482             :                           "hasOwnProperty",
    1483         111 :                           Builtins::kObjectPrototypeHasOwnProperty, 1, true);
    1484         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1485             :                           "__lookupGetter__", Builtins::kObjectLookupGetter, 1,
    1486         111 :                           true);
    1487         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1488             :                           "__lookupSetter__", Builtins::kObjectLookupSetter, 1,
    1489         111 :                           true);
    1490         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1491             :                           "isPrototypeOf",
    1492         111 :                           Builtins::kObjectPrototypeIsPrototypeOf, 1, true);
    1493             :     SimpleInstallFunction(
    1494         111 :         isolate_, isolate_->initial_object_prototype(), "propertyIsEnumerable",
    1495         111 :         Builtins::kObjectPrototypePropertyIsEnumerable, 1, false);
    1496             :     Handle<JSFunction> object_to_string = SimpleInstallFunction(
    1497         111 :         isolate_, isolate_->initial_object_prototype(), "toString",
    1498         111 :         Builtins::kObjectPrototypeToString, 0, true);
    1499         111 :     native_context()->set_object_to_string(*object_to_string);
    1500         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1501             :                           "valueOf", Builtins::kObjectPrototypeValueOf, 0,
    1502         111 :                           true);
    1503             : 
    1504         111 :     SimpleInstallGetterSetter(
    1505         111 :         isolate_, isolate_->initial_object_prototype(), factory->proto_string(),
    1506         111 :         Builtins::kObjectPrototypeGetProto, Builtins::kObjectPrototypeSetProto);
    1507             : 
    1508         111 :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1509             :                           "toLocaleString",
    1510         111 :                           Builtins::kObjectPrototypeToLocaleString, 0, true);
    1511             :   }
    1512             : 
    1513         222 :   Handle<JSObject> global(native_context()->global_object(), isolate());
    1514             : 
    1515             :   {  // --- F u n c t i o n ---
    1516         111 :     Handle<JSFunction> prototype = empty_function;
    1517             :     Handle<JSFunction> function_fun =
    1518             :         InstallFunction(isolate_, global, "Function", JS_FUNCTION_TYPE,
    1519             :                         JSFunction::kSizeWithPrototype, 0, prototype,
    1520         111 :                         Builtins::kFunctionConstructor);
    1521             :     // Function instances are sloppy by default.
    1522         333 :     function_fun->set_prototype_or_initial_map(
    1523         333 :         *isolate_->sloppy_function_map());
    1524             :     function_fun->shared()->DontAdaptArguments();
    1525             :     function_fun->shared()->set_length(1);
    1526         111 :     InstallWithIntrinsicDefaultProto(isolate_, function_fun,
    1527         111 :                                      Context::FUNCTION_FUNCTION_INDEX);
    1528             : 
    1529             :     // Setup the methods on the %FunctionPrototype%.
    1530         222 :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1531         111 :                           function_fun, DONT_ENUM);
    1532             :     SimpleInstallFunction(isolate_, prototype, "apply",
    1533         111 :                           Builtins::kFunctionPrototypeApply, 2, false);
    1534             :     SimpleInstallFunction(isolate_, prototype, "bind",
    1535         111 :                           Builtins::kFastFunctionPrototypeBind, 1, false);
    1536             :     SimpleInstallFunction(isolate_, prototype, "call",
    1537         111 :                           Builtins::kFunctionPrototypeCall, 1, false);
    1538             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1539         111 :                           Builtins::kFunctionPrototypeToString, 0, false);
    1540             : 
    1541             :     // Install the @@hasInstance function.
    1542             :     Handle<JSFunction> has_instance = InstallFunctionAtSymbol(
    1543             :         isolate_, prototype, factory->has_instance_symbol(),
    1544             :         "[Symbol.hasInstance]", Builtins::kFunctionPrototypeHasInstance, 1,
    1545             :         true,
    1546         111 :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY));
    1547         111 :     native_context()->set_function_has_instance(*has_instance);
    1548             : 
    1549             :     // Complete setting up function maps.
    1550             :     {
    1551         222 :       isolate_->sloppy_function_map()->SetConstructor(*function_fun);
    1552         222 :       isolate_->sloppy_function_with_name_map()->SetConstructor(*function_fun);
    1553         333 :       isolate_->sloppy_function_with_readonly_prototype_map()->SetConstructor(
    1554         111 :           *function_fun);
    1555             : 
    1556         222 :       isolate_->strict_function_map()->SetConstructor(*function_fun);
    1557         222 :       isolate_->strict_function_with_name_map()->SetConstructor(*function_fun);
    1558         222 :       strict_function_with_home_object_map_->SetConstructor(*function_fun);
    1559         333 :       strict_function_with_name_and_home_object_map_->SetConstructor(
    1560         111 :           *function_fun);
    1561         333 :       isolate_->strict_function_with_readonly_prototype_map()->SetConstructor(
    1562         111 :           *function_fun);
    1563             : 
    1564         222 :       isolate_->class_function_map()->SetConstructor(*function_fun);
    1565             :     }
    1566             :   }
    1567             : 
    1568             :   {  // --- A s y n c F r o m S y n c I t e r a t o r
    1569             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1570             :         isolate_, Builtins::kAsyncIteratorValueUnwrap, factory->empty_string(),
    1571         111 :         1);
    1572         111 :     native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
    1573             :   }
    1574             : 
    1575             :   {  // --- A s y n c G e n e r a t o r ---
    1576             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1577             :         isolate_, Builtins::kAsyncGeneratorAwaitResolveClosure,
    1578         111 :         factory->empty_string(), 1);
    1579         111 :     native_context()->set_async_generator_await_resolve_shared_fun(*info);
    1580             : 
    1581             :     info = SimpleCreateSharedFunctionInfo(
    1582             :         isolate_, Builtins::kAsyncGeneratorAwaitRejectClosure,
    1583         111 :         factory->empty_string(), 1);
    1584         111 :     native_context()->set_async_generator_await_reject_shared_fun(*info);
    1585             : 
    1586             :     info = SimpleCreateSharedFunctionInfo(
    1587             :         isolate_, Builtins::kAsyncGeneratorYieldResolveClosure,
    1588         111 :         factory->empty_string(), 1);
    1589         111 :     native_context()->set_async_generator_yield_resolve_shared_fun(*info);
    1590             : 
    1591             :     info = SimpleCreateSharedFunctionInfo(
    1592             :         isolate_, Builtins::kAsyncGeneratorReturnResolveClosure,
    1593         111 :         factory->empty_string(), 1);
    1594         111 :     native_context()->set_async_generator_return_resolve_shared_fun(*info);
    1595             : 
    1596             :     info = SimpleCreateSharedFunctionInfo(
    1597             :         isolate_, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
    1598         111 :         factory->empty_string(), 1);
    1599         222 :     native_context()->set_async_generator_return_closed_resolve_shared_fun(
    1600         111 :         *info);
    1601             : 
    1602             :     info = SimpleCreateSharedFunctionInfo(
    1603             :         isolate_, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
    1604         111 :         factory->empty_string(), 1);
    1605         222 :     native_context()->set_async_generator_return_closed_reject_shared_fun(
    1606         111 :         *info);
    1607             :   }
    1608             : 
    1609             :   Handle<JSFunction> array_prototype_to_string_fun;
    1610             :   {  // --- A r r a y ---
    1611             :     Handle<JSFunction> array_function = InstallFunction(
    1612             :         isolate_, global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
    1613         222 :         isolate_->initial_object_prototype(), Builtins::kArrayConstructor);
    1614             :     array_function->shared()->DontAdaptArguments();
    1615             : 
    1616             :     // This seems a bit hackish, but we need to make sure Array.length
    1617             :     // is 1.
    1618             :     array_function->shared()->set_length(1);
    1619             : 
    1620             :     Handle<Map> initial_map(array_function->initial_map(), isolate());
    1621             : 
    1622             :     // This assert protects an optimization in
    1623             :     // HGraphBuilder::JSArrayBuilder::EmitMapCode()
    1624             :     DCHECK(initial_map->elements_kind() == GetInitialFastElementsKind());
    1625         111 :     Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
    1626             : 
    1627             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1628             :         DONT_ENUM | DONT_DELETE);
    1629             : 
    1630             :     STATIC_ASSERT(JSArray::kLengthDescriptorIndex == 0);
    1631             :     {  // Add length.
    1632             :       Descriptor d = Descriptor::AccessorConstant(
    1633         111 :           factory->length_string(), factory->array_length_accessor(), attribs);
    1634         111 :       initial_map->AppendDescriptor(isolate(), &d);
    1635             :     }
    1636             : 
    1637         111 :     InstallWithIntrinsicDefaultProto(isolate_, array_function,
    1638         111 :                                      Context::ARRAY_FUNCTION_INDEX);
    1639         111 :     InstallSpeciesGetter(isolate_, array_function);
    1640             : 
    1641             :     // Cache the array maps, needed by ArrayConstructorStub
    1642         111 :     CacheInitialJSArrayMaps(native_context(), initial_map);
    1643             : 
    1644             :     // Set up %ArrayPrototype%.
    1645             :     // The %ArrayPrototype% has TERMINAL_FAST_ELEMENTS_KIND in order to ensure
    1646             :     // that constant functions stay constant after turning prototype to setup
    1647             :     // mode and back when constant field tracking is enabled.
    1648             :     Handle<JSArray> proto = factory->NewJSArray(0, TERMINAL_FAST_ELEMENTS_KIND,
    1649             :                                                 AllocationType::kOld);
    1650         111 :     JSFunction::SetPrototype(array_function, proto);
    1651         222 :     native_context()->set_initial_array_prototype(*proto);
    1652             : 
    1653             :     Handle<JSFunction> is_arraylike = SimpleInstallFunction(
    1654         111 :         isolate_, array_function, "isArray", Builtins::kArrayIsArray, 1, true);
    1655         111 :     native_context()->set_is_arraylike(*is_arraylike);
    1656             : 
    1657             :     SimpleInstallFunction(isolate_, array_function, "from",
    1658         111 :                           Builtins::kArrayFrom, 1, false);
    1659             :     SimpleInstallFunction(isolate_, array_function, "of", Builtins::kArrayOf, 0,
    1660         111 :                           false);
    1661             : 
    1662         222 :     JSObject::AddProperty(isolate_, proto, factory->constructor_string(),
    1663         111 :                           array_function, DONT_ENUM);
    1664             : 
    1665             :     SimpleInstallFunction(isolate_, proto, "concat", Builtins::kArrayConcat, 1,
    1666         111 :                           false);
    1667             :     SimpleInstallFunction(isolate_, proto, "copyWithin",
    1668         111 :                           Builtins::kArrayPrototypeCopyWithin, 2, false);
    1669             :     SimpleInstallFunction(isolate_, proto, "fill",
    1670         111 :                           Builtins::kArrayPrototypeFill, 1, false);
    1671             :     SimpleInstallFunction(isolate_, proto, "find",
    1672         111 :                           Builtins::kArrayPrototypeFind, 1, false);
    1673             :     SimpleInstallFunction(isolate_, proto, "findIndex",
    1674         111 :                           Builtins::kArrayPrototypeFindIndex, 1, false);
    1675             :     SimpleInstallFunction(isolate_, proto, "lastIndexOf",
    1676         111 :                           Builtins::kArrayPrototypeLastIndexOf, 1, false);
    1677             :     SimpleInstallFunction(isolate_, proto, "pop", Builtins::kArrayPrototypePop,
    1678         111 :                           0, false);
    1679             :     SimpleInstallFunction(isolate_, proto, "push",
    1680         111 :                           Builtins::kArrayPrototypePush, 1, false);
    1681             :     SimpleInstallFunction(isolate_, proto, "reverse",
    1682         111 :                           Builtins::kArrayPrototypeReverse, 0, false);
    1683             :     SimpleInstallFunction(isolate_, proto, "shift",
    1684         111 :                           Builtins::kArrayPrototypeShift, 0, false);
    1685             :     SimpleInstallFunction(isolate_, proto, "unshift",
    1686         111 :                           Builtins::kArrayPrototypeUnshift, 1, false);
    1687             :     SimpleInstallFunction(isolate_, proto, "slice",
    1688         111 :                           Builtins::kArrayPrototypeSlice, 2, false);
    1689             :     SimpleInstallFunction(isolate_, proto, "sort",
    1690         111 :                           Builtins::kArrayPrototypeSort, 1, false);
    1691             :     SimpleInstallFunction(isolate_, proto, "splice",
    1692         111 :                           Builtins::kArrayPrototypeSplice, 2, false);
    1693             :     SimpleInstallFunction(isolate_, proto, "includes", Builtins::kArrayIncludes,
    1694         111 :                           1, false);
    1695             :     SimpleInstallFunction(isolate_, proto, "indexOf", Builtins::kArrayIndexOf,
    1696         111 :                           1, false);
    1697             :     SimpleInstallFunction(isolate_, proto, "join",
    1698         111 :                           Builtins::kArrayPrototypeJoin, 1, false);
    1699             : 
    1700             :     {  // Set up iterator-related properties.
    1701             :       Handle<JSFunction> keys = InstallFunctionWithBuiltinId(
    1702         111 :           isolate_, proto, "keys", Builtins::kArrayPrototypeKeys, 0, true);
    1703         111 :       native_context()->set_array_keys_iterator(*keys);
    1704             : 
    1705             :       Handle<JSFunction> entries = InstallFunctionWithBuiltinId(
    1706             :           isolate_, proto, "entries", Builtins::kArrayPrototypeEntries, 0,
    1707         111 :           true);
    1708         111 :       native_context()->set_array_entries_iterator(*entries);
    1709             : 
    1710             :       Handle<JSFunction> values = InstallFunctionWithBuiltinId(
    1711         111 :           isolate_, proto, "values", Builtins::kArrayPrototypeValues, 0, true);
    1712         222 :       JSObject::AddProperty(isolate_, proto, factory->iterator_symbol(), values,
    1713         111 :                             DONT_ENUM);
    1714         111 :       native_context()->set_array_values_iterator(*values);
    1715             :     }
    1716             : 
    1717             :     Handle<JSFunction> for_each_fun = SimpleInstallFunction(
    1718         111 :         isolate_, proto, "forEach", Builtins::kArrayForEach, 1, false);
    1719         111 :     native_context()->set_array_for_each_iterator(*for_each_fun);
    1720             :     SimpleInstallFunction(isolate_, proto, "filter", Builtins::kArrayFilter, 1,
    1721         111 :                           false);
    1722             :     SimpleInstallFunction(isolate_, proto, "flat",
    1723         111 :                           Builtins::kArrayPrototypeFlat, 0, false);
    1724             :     SimpleInstallFunction(isolate_, proto, "flatMap",
    1725         111 :                           Builtins::kArrayPrototypeFlatMap, 1, false);
    1726             :     SimpleInstallFunction(isolate_, proto, "map", Builtins::kArrayMap, 1,
    1727         111 :                           false);
    1728             :     SimpleInstallFunction(isolate_, proto, "every", Builtins::kArrayEvery, 1,
    1729         111 :                           false);
    1730             :     SimpleInstallFunction(isolate_, proto, "some", Builtins::kArraySome, 1,
    1731         111 :                           false);
    1732             :     SimpleInstallFunction(isolate_, proto, "reduce", Builtins::kArrayReduce, 1,
    1733         111 :                           false);
    1734             :     SimpleInstallFunction(isolate_, proto, "reduceRight",
    1735         111 :                           Builtins::kArrayReduceRight, 1, false);
    1736             :     SimpleInstallFunction(isolate_, proto, "toLocaleString",
    1737         111 :                           Builtins::kArrayPrototypeToLocaleString, 0, false);
    1738             :     array_prototype_to_string_fun =
    1739             :         SimpleInstallFunction(isolate_, proto, "toString",
    1740         111 :                               Builtins::kArrayPrototypeToString, 0, false);
    1741             : 
    1742         111 :     Handle<JSObject> unscopables = factory->NewJSObjectWithNullProto();
    1743         111 :     InstallTrueValuedProperty(isolate_, unscopables, "copyWithin");
    1744         111 :     InstallTrueValuedProperty(isolate_, unscopables, "entries");
    1745         111 :     InstallTrueValuedProperty(isolate_, unscopables, "fill");
    1746         111 :     InstallTrueValuedProperty(isolate_, unscopables, "find");
    1747         111 :     InstallTrueValuedProperty(isolate_, unscopables, "findIndex");
    1748         111 :     InstallTrueValuedProperty(isolate_, unscopables, "flat");
    1749         111 :     InstallTrueValuedProperty(isolate_, unscopables, "flatMap");
    1750         111 :     InstallTrueValuedProperty(isolate_, unscopables, "includes");
    1751         111 :     InstallTrueValuedProperty(isolate_, unscopables, "keys");
    1752         111 :     InstallTrueValuedProperty(isolate_, unscopables, "values");
    1753         111 :     JSObject::MigrateSlowToFast(unscopables, 0, "Bootstrapping");
    1754         222 :     JSObject::AddProperty(
    1755             :         isolate_, proto, factory->unscopables_symbol(), unscopables,
    1756         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1757             : 
    1758         111 :     Handle<Map> map(proto->map(), isolate_);
    1759         111 :     Map::SetShouldBeFastPrototypeMap(map, true, isolate_);
    1760             :   }
    1761             : 
    1762             :   {  // --- A r r a y I t e r a t o r ---
    1763             :     Handle<JSObject> iterator_prototype(
    1764         222 :         native_context()->initial_iterator_prototype(), isolate());
    1765             : 
    1766             :     Handle<JSObject> array_iterator_prototype =
    1767         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    1768         111 :     JSObject::ForceSetPrototype(array_iterator_prototype, iterator_prototype);
    1769             : 
    1770         111 :     InstallToStringTag(isolate_, array_iterator_prototype,
    1771         111 :                        factory->ArrayIterator_string());
    1772             : 
    1773             :     InstallFunctionWithBuiltinId(isolate_, array_iterator_prototype, "next",
    1774             :                                  Builtins::kArrayIteratorPrototypeNext, 0,
    1775         111 :                                  true);
    1776             : 
    1777             :     Handle<JSFunction> array_iterator_function =
    1778             :         CreateFunction(isolate_, factory->ArrayIterator_string(),
    1779             :                        JS_ARRAY_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
    1780         111 :                        array_iterator_prototype, Builtins::kIllegal);
    1781         111 :     array_iterator_function->shared()->set_native(false);
    1782             : 
    1783         222 :     native_context()->set_initial_array_iterator_map(
    1784         111 :         array_iterator_function->initial_map());
    1785         222 :     native_context()->set_initial_array_iterator_prototype(
    1786         111 :         *array_iterator_prototype);
    1787             :   }
    1788             : 
    1789             :   {  // --- N u m b e r ---
    1790             :     Handle<JSFunction> number_fun = InstallFunction(
    1791             :         isolate_, global, "Number", JS_VALUE_TYPE, JSValue::kSize, 0,
    1792         222 :         isolate_->initial_object_prototype(), Builtins::kNumberConstructor);
    1793             :     number_fun->shared()->DontAdaptArguments();
    1794             :     number_fun->shared()->set_length(1);
    1795         111 :     InstallWithIntrinsicDefaultProto(isolate_, number_fun,
    1796         111 :                                      Context::NUMBER_FUNCTION_INDEX);
    1797             : 
    1798             :     // Create the %NumberPrototype%
    1799             :     Handle<JSValue> prototype = Handle<JSValue>::cast(
    1800         111 :         factory->NewJSObject(number_fun, AllocationType::kOld));
    1801         111 :     prototype->set_value(Smi::kZero);
    1802         111 :     JSFunction::SetPrototype(number_fun, prototype);
    1803             : 
    1804             :     // Install the "constructor" property on the {prototype}.
    1805         222 :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1806         111 :                           number_fun, DONT_ENUM);
    1807             : 
    1808             :     // Install the Number.prototype methods.
    1809             :     SimpleInstallFunction(isolate_, prototype, "toExponential",
    1810         111 :                           Builtins::kNumberPrototypeToExponential, 1, false);
    1811             :     SimpleInstallFunction(isolate_, prototype, "toFixed",
    1812         111 :                           Builtins::kNumberPrototypeToFixed, 1, false);
    1813             :     SimpleInstallFunction(isolate_, prototype, "toPrecision",
    1814         111 :                           Builtins::kNumberPrototypeToPrecision, 1, false);
    1815             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1816         111 :                           Builtins::kNumberPrototypeToString, 1, false);
    1817             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    1818         111 :                           Builtins::kNumberPrototypeValueOf, 0, true);
    1819             : 
    1820             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    1821         111 :                           Builtins::kNumberPrototypeToLocaleString, 0, false);
    1822             : 
    1823             :     // Install the Number functions.
    1824             :     SimpleInstallFunction(isolate_, number_fun, "isFinite",
    1825         111 :                           Builtins::kNumberIsFinite, 1, true);
    1826             :     SimpleInstallFunction(isolate_, number_fun, "isInteger",
    1827         111 :                           Builtins::kNumberIsInteger, 1, true);
    1828             :     SimpleInstallFunction(isolate_, number_fun, "isNaN", Builtins::kNumberIsNaN,
    1829         111 :                           1, true);
    1830             :     SimpleInstallFunction(isolate_, number_fun, "isSafeInteger",
    1831         111 :                           Builtins::kNumberIsSafeInteger, 1, true);
    1832             : 
    1833             :     // Install Number.parseFloat and Global.parseFloat.
    1834             :     Handle<JSFunction> parse_float_fun =
    1835             :         SimpleInstallFunction(isolate_, number_fun, "parseFloat",
    1836         111 :                               Builtins::kNumberParseFloat, 1, true);
    1837         222 :     JSObject::AddProperty(isolate_, global_object, "parseFloat",
    1838         111 :                           parse_float_fun, DONT_ENUM);
    1839             : 
    1840             :     // Install Number.parseInt and Global.parseInt.
    1841             :     Handle<JSFunction> parse_int_fun = SimpleInstallFunction(
    1842         111 :         isolate_, number_fun, "parseInt", Builtins::kNumberParseInt, 2, true);
    1843         222 :     JSObject::AddProperty(isolate_, global_object, "parseInt", parse_int_fun,
    1844         111 :                           DONT_ENUM);
    1845             : 
    1846             :     // Install Number constants
    1847             :     const double kMaxValue = 1.7976931348623157e+308;
    1848             :     const double kMinValue = 5e-324;
    1849             :     const double kMinSafeInteger = -kMaxSafeInteger;
    1850             :     const double kEPS = 2.220446049250313e-16;
    1851             : 
    1852         333 :     InstallConstant(isolate_, number_fun, "MAX_VALUE",
    1853         111 :                     factory->NewNumber(kMaxValue));
    1854         333 :     InstallConstant(isolate_, number_fun, "MIN_VALUE",
    1855         111 :                     factory->NewNumber(kMinValue));
    1856         111 :     InstallConstant(isolate_, number_fun, "NaN", factory->nan_value());
    1857         333 :     InstallConstant(isolate_, number_fun, "NEGATIVE_INFINITY",
    1858         111 :                     factory->NewNumber(-V8_INFINITY));
    1859         222 :     InstallConstant(isolate_, number_fun, "POSITIVE_INFINITY",
    1860         111 :                     factory->infinity_value());
    1861         333 :     InstallConstant(isolate_, number_fun, "MAX_SAFE_INTEGER",
    1862         111 :                     factory->NewNumber(kMaxSafeInteger));
    1863         333 :     InstallConstant(isolate_, number_fun, "MIN_SAFE_INTEGER",
    1864         111 :                     factory->NewNumber(kMinSafeInteger));
    1865         222 :     InstallConstant(isolate_, number_fun, "EPSILON", factory->NewNumber(kEPS));
    1866             : 
    1867         111 :     InstallConstant(isolate_, global, "Infinity", factory->infinity_value());
    1868         111 :     InstallConstant(isolate_, global, "NaN", factory->nan_value());
    1869         111 :     InstallConstant(isolate_, global, "undefined", factory->undefined_value());
    1870             :   }
    1871             : 
    1872             :   {  // --- B o o l e a n ---
    1873             :     Handle<JSFunction> boolean_fun = InstallFunction(
    1874             :         isolate_, global, "Boolean", JS_VALUE_TYPE, JSValue::kSize, 0,
    1875         222 :         isolate_->initial_object_prototype(), Builtins::kBooleanConstructor);
    1876             :     boolean_fun->shared()->DontAdaptArguments();
    1877             :     boolean_fun->shared()->set_length(1);
    1878         111 :     InstallWithIntrinsicDefaultProto(isolate_, boolean_fun,
    1879         111 :                                      Context::BOOLEAN_FUNCTION_INDEX);
    1880             : 
    1881             :     // Create the %BooleanPrototype%
    1882             :     Handle<JSValue> prototype = Handle<JSValue>::cast(
    1883         111 :         factory->NewJSObject(boolean_fun, AllocationType::kOld));
    1884         333 :     prototype->set_value(ReadOnlyRoots(isolate_).false_value());
    1885         111 :     JSFunction::SetPrototype(boolean_fun, prototype);
    1886             : 
    1887             :     // Install the "constructor" property on the {prototype}.
    1888         222 :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1889         111 :                           boolean_fun, DONT_ENUM);
    1890             : 
    1891             :     // Install the Boolean.prototype methods.
    1892             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1893         111 :                           Builtins::kBooleanPrototypeToString, 0, true);
    1894             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    1895         111 :                           Builtins::kBooleanPrototypeValueOf, 0, true);
    1896             :   }
    1897             : 
    1898             :   {  // --- S t r i n g ---
    1899             :     Handle<JSFunction> string_fun = InstallFunction(
    1900             :         isolate_, global, "String", JS_VALUE_TYPE, JSValue::kSize, 0,
    1901         222 :         isolate_->initial_object_prototype(), Builtins::kStringConstructor);
    1902             :     string_fun->shared()->DontAdaptArguments();
    1903             :     string_fun->shared()->set_length(1);
    1904         111 :     InstallWithIntrinsicDefaultProto(isolate_, string_fun,
    1905         111 :                                      Context::STRING_FUNCTION_INDEX);
    1906             : 
    1907             :     Handle<Map> string_map = Handle<Map>(
    1908         222 :         native_context()->string_function()->initial_map(), isolate());
    1909         111 :     string_map->set_elements_kind(FAST_STRING_WRAPPER_ELEMENTS);
    1910         111 :     Map::EnsureDescriptorSlack(isolate_, string_map, 1);
    1911             : 
    1912             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1913             :         DONT_ENUM | DONT_DELETE | READ_ONLY);
    1914             : 
    1915             :     {  // Add length.
    1916             :       Descriptor d = Descriptor::AccessorConstant(
    1917         111 :           factory->length_string(), factory->string_length_accessor(), attribs);
    1918         111 :       string_map->AppendDescriptor(isolate(), &d);
    1919             :     }
    1920             : 
    1921             :     // Install the String.fromCharCode function.
    1922             :     SimpleInstallFunction(isolate_, string_fun, "fromCharCode",
    1923         111 :                           Builtins::kStringFromCharCode, 1, false);
    1924             : 
    1925             :     // Install the String.fromCodePoint function.
    1926             :     SimpleInstallFunction(isolate_, string_fun, "fromCodePoint",
    1927         111 :                           Builtins::kStringFromCodePoint, 1, false);
    1928             : 
    1929             :     // Install the String.raw function.
    1930             :     SimpleInstallFunction(isolate_, string_fun, "raw", Builtins::kStringRaw, 1,
    1931         111 :                           false);
    1932             : 
    1933             :     // Create the %StringPrototype%
    1934             :     Handle<JSValue> prototype = Handle<JSValue>::cast(
    1935         111 :         factory->NewJSObject(string_fun, AllocationType::kOld));
    1936         333 :     prototype->set_value(ReadOnlyRoots(isolate_).empty_string());
    1937         111 :     JSFunction::SetPrototype(string_fun, prototype);
    1938         222 :     native_context()->set_initial_string_prototype(*prototype);
    1939             : 
    1940             :     // Install the "constructor" property on the {prototype}.
    1941         222 :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1942         111 :                           string_fun, DONT_ENUM);
    1943             : 
    1944             :     // Install the String.prototype methods.
    1945             :     SimpleInstallFunction(isolate_, prototype, "anchor",
    1946         111 :                           Builtins::kStringPrototypeAnchor, 1, false);
    1947             :     SimpleInstallFunction(isolate_, prototype, "big",
    1948         111 :                           Builtins::kStringPrototypeBig, 0, false);
    1949             :     SimpleInstallFunction(isolate_, prototype, "blink",
    1950         111 :                           Builtins::kStringPrototypeBlink, 0, false);
    1951             :     SimpleInstallFunction(isolate_, prototype, "bold",
    1952         111 :                           Builtins::kStringPrototypeBold, 0, false);
    1953             :     SimpleInstallFunction(isolate_, prototype, "charAt",
    1954         111 :                           Builtins::kStringPrototypeCharAt, 1, true);
    1955             :     SimpleInstallFunction(isolate_, prototype, "charCodeAt",
    1956         111 :                           Builtins::kStringPrototypeCharCodeAt, 1, true);
    1957             :     SimpleInstallFunction(isolate_, prototype, "codePointAt",
    1958         111 :                           Builtins::kStringPrototypeCodePointAt, 1, true);
    1959             :     SimpleInstallFunction(isolate_, prototype, "concat",
    1960         111 :                           Builtins::kStringPrototypeConcat, 1, false);
    1961             :     SimpleInstallFunction(isolate_, prototype, "endsWith",
    1962         111 :                           Builtins::kStringPrototypeEndsWith, 1, false);
    1963             :     SimpleInstallFunction(isolate_, prototype, "fontcolor",
    1964         111 :                           Builtins::kStringPrototypeFontcolor, 1, false);
    1965             :     SimpleInstallFunction(isolate_, prototype, "fontsize",
    1966         111 :                           Builtins::kStringPrototypeFontsize, 1, false);
    1967             :     SimpleInstallFunction(isolate_, prototype, "fixed",
    1968         111 :                           Builtins::kStringPrototypeFixed, 0, false);
    1969             :     SimpleInstallFunction(isolate_, prototype, "includes",
    1970         111 :                           Builtins::kStringPrototypeIncludes, 1, false);
    1971             :     SimpleInstallFunction(isolate_, prototype, "indexOf",
    1972         111 :                           Builtins::kStringPrototypeIndexOf, 1, false);
    1973             :     SimpleInstallFunction(isolate_, prototype, "italics",
    1974         111 :                           Builtins::kStringPrototypeItalics, 0, false);
    1975             :     SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
    1976         111 :                           Builtins::kStringPrototypeLastIndexOf, 1, false);
    1977             :     SimpleInstallFunction(isolate_, prototype, "link",
    1978         111 :                           Builtins::kStringPrototypeLink, 1, false);
    1979             : #ifdef V8_INTL_SUPPORT
    1980             :     SimpleInstallFunction(isolate_, prototype, "localeCompare",
    1981         111 :                           Builtins::kStringPrototypeLocaleCompare, 1, false);
    1982             : #else
    1983             :     SimpleInstallFunction(isolate_, prototype, "localeCompare",
    1984             :                           Builtins::kStringPrototypeLocaleCompare, 1, true);
    1985             : #endif  // V8_INTL_SUPPORT
    1986             :     SimpleInstallFunction(isolate_, prototype, "match",
    1987         111 :                           Builtins::kStringPrototypeMatch, 1, true);
    1988             : #ifdef V8_INTL_SUPPORT
    1989             :     SimpleInstallFunction(isolate_, prototype, "normalize",
    1990         111 :                           Builtins::kStringPrototypeNormalizeIntl, 0, false);
    1991             : #else
    1992             :     SimpleInstallFunction(isolate_, prototype, "normalize",
    1993             :                           Builtins::kStringPrototypeNormalize, 0, false);
    1994             : #endif  // V8_INTL_SUPPORT
    1995             :     SimpleInstallFunction(isolate_, prototype, "padEnd",
    1996         111 :                           Builtins::kStringPrototypePadEnd, 1, false);
    1997             :     SimpleInstallFunction(isolate_, prototype, "padStart",
    1998         111 :                           Builtins::kStringPrototypePadStart, 1, false);
    1999             :     SimpleInstallFunction(isolate_, prototype, "repeat",
    2000         111 :                           Builtins::kStringPrototypeRepeat, 1, true);
    2001             :     SimpleInstallFunction(isolate_, prototype, "replace",
    2002         111 :                           Builtins::kStringPrototypeReplace, 2, true);
    2003             :     SimpleInstallFunction(isolate_, prototype, "search",
    2004         111 :                           Builtins::kStringPrototypeSearch, 1, true);
    2005             :     SimpleInstallFunction(isolate_, prototype, "slice",
    2006         111 :                           Builtins::kStringPrototypeSlice, 2, false);
    2007             :     SimpleInstallFunction(isolate_, prototype, "small",
    2008         111 :                           Builtins::kStringPrototypeSmall, 0, false);
    2009             :     SimpleInstallFunction(isolate_, prototype, "split",
    2010         111 :                           Builtins::kStringPrototypeSplit, 2, false);
    2011             :     SimpleInstallFunction(isolate_, prototype, "strike",
    2012         111 :                           Builtins::kStringPrototypeStrike, 0, false);
    2013             :     SimpleInstallFunction(isolate_, prototype, "sub",
    2014         111 :                           Builtins::kStringPrototypeSub, 0, false);
    2015             :     SimpleInstallFunction(isolate_, prototype, "substr",
    2016         111 :                           Builtins::kStringPrototypeSubstr, 2, false);
    2017             :     SimpleInstallFunction(isolate_, prototype, "substring",
    2018         111 :                           Builtins::kStringPrototypeSubstring, 2, false);
    2019             :     SimpleInstallFunction(isolate_, prototype, "sup",
    2020         111 :                           Builtins::kStringPrototypeSup, 0, false);
    2021             :     SimpleInstallFunction(isolate_, prototype, "startsWith",
    2022         111 :                           Builtins::kStringPrototypeStartsWith, 1, false);
    2023             :     SimpleInstallFunction(isolate_, prototype, "toString",
    2024         111 :                           Builtins::kStringPrototypeToString, 0, true);
    2025             :     SimpleInstallFunction(isolate_, prototype, "trim",
    2026         111 :                           Builtins::kStringPrototypeTrim, 0, false);
    2027             : 
    2028             :     // Install `String.prototype.trimStart` with `trimLeft` alias.
    2029             :     Handle<JSFunction> trim_start_fun =
    2030             :         SimpleInstallFunction(isolate_, prototype, "trimStart",
    2031         111 :                               Builtins::kStringPrototypeTrimStart, 0, false);
    2032         222 :     JSObject::AddProperty(isolate_, prototype, "trimLeft", trim_start_fun,
    2033         111 :                           DONT_ENUM);
    2034             : 
    2035             :     // Install `String.prototype.trimEnd` with `trimRight` alias.
    2036             :     Handle<JSFunction> trim_end_fun =
    2037             :         SimpleInstallFunction(isolate_, prototype, "trimEnd",
    2038         111 :                               Builtins::kStringPrototypeTrimEnd, 0, false);
    2039         222 :     JSObject::AddProperty(isolate_, prototype, "trimRight", trim_end_fun,
    2040         111 :                           DONT_ENUM);
    2041             : 
    2042             :     SimpleInstallFunction(isolate_, prototype, "toLocaleLowerCase",
    2043             :                           Builtins::kStringPrototypeToLocaleLowerCase, 0,
    2044         111 :                           false);
    2045             :     SimpleInstallFunction(isolate_, prototype, "toLocaleUpperCase",
    2046             :                           Builtins::kStringPrototypeToLocaleUpperCase, 0,
    2047         111 :                           false);
    2048             : #ifdef V8_INTL_SUPPORT
    2049             :     SimpleInstallFunction(isolate_, prototype, "toLowerCase",
    2050         111 :                           Builtins::kStringPrototypeToLowerCaseIntl, 0, true);
    2051             :     SimpleInstallFunction(isolate_, prototype, "toUpperCase",
    2052         111 :                           Builtins::kStringPrototypeToUpperCaseIntl, 0, false);
    2053             : #else
    2054             :     SimpleInstallFunction(isolate_, prototype, "toLowerCase",
    2055             :                           Builtins::kStringPrototypeToLowerCase, 0, false);
    2056             :     SimpleInstallFunction(isolate_, prototype, "toUpperCase",
    2057             :                           Builtins::kStringPrototypeToUpperCase, 0, false);
    2058             : #endif
    2059             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    2060         111 :                           Builtins::kStringPrototypeValueOf, 0, true);
    2061             : 
    2062             :     InstallFunctionAtSymbol(
    2063             :         isolate_, prototype, factory->iterator_symbol(), "[Symbol.iterator]",
    2064         111 :         Builtins::kStringPrototypeIterator, 0, true, DONT_ENUM);
    2065             :   }
    2066             : 
    2067             :   {  // --- S t r i n g I t e r a t o r ---
    2068             :     Handle<JSObject> iterator_prototype(
    2069         222 :         native_context()->initial_iterator_prototype(), isolate());
    2070             : 
    2071             :     Handle<JSObject> string_iterator_prototype =
    2072         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    2073         111 :     JSObject::ForceSetPrototype(string_iterator_prototype, iterator_prototype);
    2074             : 
    2075         111 :     InstallToStringTag(isolate_, string_iterator_prototype, "String Iterator");
    2076             : 
    2077             :     InstallFunctionWithBuiltinId(isolate_, string_iterator_prototype, "next",
    2078             :                                  Builtins::kStringIteratorPrototypeNext, 0,
    2079         111 :                                  true);
    2080             : 
    2081             :     Handle<JSFunction> string_iterator_function = CreateFunction(
    2082             :         isolate_, factory->InternalizeUtf8String("StringIterator"),
    2083             :         JS_STRING_ITERATOR_TYPE, JSStringIterator::kSize, 0,
    2084         111 :         string_iterator_prototype, Builtins::kIllegal);
    2085         111 :     string_iterator_function->shared()->set_native(false);
    2086         222 :     native_context()->set_initial_string_iterator_map(
    2087         111 :         string_iterator_function->initial_map());
    2088         222 :     native_context()->set_initial_string_iterator_prototype(
    2089         111 :         *string_iterator_prototype);
    2090             :   }
    2091             : 
    2092             :   {  // --- S y m b o l ---
    2093             :     Handle<JSFunction> symbol_fun = InstallFunction(
    2094             :         isolate_, global, "Symbol", JS_VALUE_TYPE, JSValue::kSize, 0,
    2095         111 :         factory->the_hole_value(), Builtins::kSymbolConstructor);
    2096             :     symbol_fun->shared()->set_length(0);
    2097             :     symbol_fun->shared()->DontAdaptArguments();
    2098         111 :     native_context()->set_symbol_function(*symbol_fun);
    2099             : 
    2100             :     // Install the Symbol.for and Symbol.keyFor functions.
    2101             :     SimpleInstallFunction(isolate_, symbol_fun, "for", Builtins::kSymbolFor, 1,
    2102         111 :                           false);
    2103             :     SimpleInstallFunction(isolate_, symbol_fun, "keyFor",
    2104         111 :                           Builtins::kSymbolKeyFor, 1, false);
    2105             : 
    2106             :     // Install well-known symbols.
    2107         222 :     InstallConstant(isolate_, symbol_fun, "asyncIterator",
    2108         111 :                     factory->async_iterator_symbol());
    2109         222 :     InstallConstant(isolate_, symbol_fun, "hasInstance",
    2110         111 :                     factory->has_instance_symbol());
    2111         222 :     InstallConstant(isolate_, symbol_fun, "isConcatSpreadable",
    2112         111 :                     factory->is_concat_spreadable_symbol());
    2113         222 :     InstallConstant(isolate_, symbol_fun, "iterator",
    2114         111 :                     factory->iterator_symbol());
    2115         111 :     InstallConstant(isolate_, symbol_fun, "match", factory->match_symbol());
    2116         111 :     InstallConstant(isolate_, symbol_fun, "replace", factory->replace_symbol());
    2117         111 :     InstallConstant(isolate_, symbol_fun, "search", factory->search_symbol());
    2118         111 :     InstallConstant(isolate_, symbol_fun, "species", factory->species_symbol());
    2119         111 :     InstallConstant(isolate_, symbol_fun, "split", factory->split_symbol());
    2120         222 :     InstallConstant(isolate_, symbol_fun, "toPrimitive",
    2121         111 :                     factory->to_primitive_symbol());
    2122         222 :     InstallConstant(isolate_, symbol_fun, "toStringTag",
    2123         111 :                     factory->to_string_tag_symbol());
    2124         222 :     InstallConstant(isolate_, symbol_fun, "unscopables",
    2125         111 :                     factory->unscopables_symbol());
    2126             : 
    2127             :     // Setup %SymbolPrototype%.
    2128             :     Handle<JSObject> prototype(JSObject::cast(symbol_fun->instance_prototype()),
    2129         222 :                                isolate());
    2130             : 
    2131         111 :     InstallToStringTag(isolate_, prototype, "Symbol");
    2132             : 
    2133             :     // Install the Symbol.prototype methods.
    2134             :     InstallFunctionWithBuiltinId(isolate_, prototype, "toString",
    2135         111 :                                  Builtins::kSymbolPrototypeToString, 0, true);
    2136             :     InstallFunctionWithBuiltinId(isolate_, prototype, "valueOf",
    2137         111 :                                  Builtins::kSymbolPrototypeValueOf, 0, true);
    2138             : 
    2139             :     // Install the Symbol.prototype.description getter.
    2140             :     SimpleInstallGetter(isolate_, prototype,
    2141             :                         factory->InternalizeUtf8String("description"),
    2142         222 :                         Builtins::kSymbolPrototypeDescriptionGetter, true);
    2143             : 
    2144             :     // Install the @@toPrimitive function.
    2145             :     InstallFunctionAtSymbol(
    2146             :         isolate_, prototype, factory->to_primitive_symbol(),
    2147             :         "[Symbol.toPrimitive]", Builtins::kSymbolPrototypeToPrimitive, 1, true,
    2148         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2149             :   }
    2150             : 
    2151             :   {  // --- D a t e ---
    2152             :     Handle<JSFunction> date_fun = InstallFunction(
    2153             :         isolate_, global, "Date", JS_DATE_TYPE, JSDate::kSize, 0,
    2154         111 :         factory->the_hole_value(), Builtins::kDateConstructor);
    2155         111 :     InstallWithIntrinsicDefaultProto(isolate_, date_fun,
    2156         111 :                                      Context::DATE_FUNCTION_INDEX);
    2157             :     date_fun->shared()->set_length(7);
    2158             :     date_fun->shared()->DontAdaptArguments();
    2159             : 
    2160             :     // Install the Date.now, Date.parse and Date.UTC functions.
    2161             :     SimpleInstallFunction(isolate_, date_fun, "now", Builtins::kDateNow, 0,
    2162         111 :                           false);
    2163             :     SimpleInstallFunction(isolate_, date_fun, "parse", Builtins::kDateParse, 1,
    2164         111 :                           false);
    2165             :     SimpleInstallFunction(isolate_, date_fun, "UTC", Builtins::kDateUTC, 7,
    2166         111 :                           false);
    2167             : 
    2168             :     // Setup %DatePrototype%.
    2169             :     Handle<JSObject> prototype(JSObject::cast(date_fun->instance_prototype()),
    2170         222 :                                isolate());
    2171             : 
    2172             :     // Install the Date.prototype methods.
    2173             :     SimpleInstallFunction(isolate_, prototype, "toString",
    2174         111 :                           Builtins::kDatePrototypeToString, 0, false);
    2175             :     SimpleInstallFunction(isolate_, prototype, "toDateString",
    2176         111 :                           Builtins::kDatePrototypeToDateString, 0, false);
    2177             :     SimpleInstallFunction(isolate_, prototype, "toTimeString",
    2178         111 :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2179             :     SimpleInstallFunction(isolate_, prototype, "toISOString",
    2180         111 :                           Builtins::kDatePrototypeToISOString, 0, false);
    2181             :     Handle<JSFunction> to_utc_string =
    2182             :         SimpleInstallFunction(isolate_, prototype, "toUTCString",
    2183         111 :                               Builtins::kDatePrototypeToUTCString, 0, false);
    2184         222 :     JSObject::AddProperty(isolate_, prototype, "toGMTString", to_utc_string,
    2185         111 :                           DONT_ENUM);
    2186             :     SimpleInstallFunction(isolate_, prototype, "getDate",
    2187         111 :                           Builtins::kDatePrototypeGetDate, 0, true);
    2188             :     SimpleInstallFunction(isolate_, prototype, "setDate",
    2189         111 :                           Builtins::kDatePrototypeSetDate, 1, false);
    2190             :     SimpleInstallFunction(isolate_, prototype, "getDay",
    2191         111 :                           Builtins::kDatePrototypeGetDay, 0, true);
    2192             :     SimpleInstallFunction(isolate_, prototype, "getFullYear",
    2193         111 :                           Builtins::kDatePrototypeGetFullYear, 0, true);
    2194             :     SimpleInstallFunction(isolate_, prototype, "setFullYear",
    2195         111 :                           Builtins::kDatePrototypeSetFullYear, 3, false);
    2196             :     SimpleInstallFunction(isolate_, prototype, "getHours",
    2197         111 :                           Builtins::kDatePrototypeGetHours, 0, true);
    2198             :     SimpleInstallFunction(isolate_, prototype, "setHours",
    2199         111 :                           Builtins::kDatePrototypeSetHours, 4, false);
    2200             :     SimpleInstallFunction(isolate_, prototype, "getMilliseconds",
    2201         111 :                           Builtins::kDatePrototypeGetMilliseconds, 0, true);
    2202             :     SimpleInstallFunction(isolate_, prototype, "setMilliseconds",
    2203         111 :                           Builtins::kDatePrototypeSetMilliseconds, 1, false);
    2204             :     SimpleInstallFunction(isolate_, prototype, "getMinutes",
    2205         111 :                           Builtins::kDatePrototypeGetMinutes, 0, true);
    2206             :     SimpleInstallFunction(isolate_, prototype, "setMinutes",
    2207         111 :                           Builtins::kDatePrototypeSetMinutes, 3, false);
    2208             :     SimpleInstallFunction(isolate_, prototype, "getMonth",
    2209         111 :                           Builtins::kDatePrototypeGetMonth, 0, true);
    2210             :     SimpleInstallFunction(isolate_, prototype, "setMonth",
    2211         111 :                           Builtins::kDatePrototypeSetMonth, 2, false);
    2212             :     SimpleInstallFunction(isolate_, prototype, "getSeconds",
    2213         111 :                           Builtins::kDatePrototypeGetSeconds, 0, true);
    2214             :     SimpleInstallFunction(isolate_, prototype, "setSeconds",
    2215         111 :                           Builtins::kDatePrototypeSetSeconds, 2, false);
    2216             :     SimpleInstallFunction(isolate_, prototype, "getTime",
    2217         111 :                           Builtins::kDatePrototypeGetTime, 0, true);
    2218             :     SimpleInstallFunction(isolate_, prototype, "setTime",
    2219         111 :                           Builtins::kDatePrototypeSetTime, 1, false);
    2220             :     SimpleInstallFunction(isolate_, prototype, "getTimezoneOffset",
    2221         111 :                           Builtins::kDatePrototypeGetTimezoneOffset, 0, true);
    2222             :     SimpleInstallFunction(isolate_, prototype, "getUTCDate",
    2223         111 :                           Builtins::kDatePrototypeGetUTCDate, 0, true);
    2224             :     SimpleInstallFunction(isolate_, prototype, "setUTCDate",
    2225         111 :                           Builtins::kDatePrototypeSetUTCDate, 1, false);
    2226             :     SimpleInstallFunction(isolate_, prototype, "getUTCDay",
    2227         111 :                           Builtins::kDatePrototypeGetUTCDay, 0, true);
    2228             :     SimpleInstallFunction(isolate_, prototype, "getUTCFullYear",
    2229         111 :                           Builtins::kDatePrototypeGetUTCFullYear, 0, true);
    2230             :     SimpleInstallFunction(isolate_, prototype, "setUTCFullYear",
    2231         111 :                           Builtins::kDatePrototypeSetUTCFullYear, 3, false);
    2232             :     SimpleInstallFunction(isolate_, prototype, "getUTCHours",
    2233         111 :                           Builtins::kDatePrototypeGetUTCHours, 0, true);
    2234             :     SimpleInstallFunction(isolate_, prototype, "setUTCHours",
    2235         111 :                           Builtins::kDatePrototypeSetUTCHours, 4, false);
    2236             :     SimpleInstallFunction(isolate_, prototype, "getUTCMilliseconds",
    2237         111 :                           Builtins::kDatePrototypeGetUTCMilliseconds, 0, true);
    2238             :     SimpleInstallFunction(isolate_, prototype, "setUTCMilliseconds",
    2239         111 :                           Builtins::kDatePrototypeSetUTCMilliseconds, 1, false);
    2240             :     SimpleInstallFunction(isolate_, prototype, "getUTCMinutes",
    2241         111 :                           Builtins::kDatePrototypeGetUTCMinutes, 0, true);
    2242             :     SimpleInstallFunction(isolate_, prototype, "setUTCMinutes",
    2243         111 :                           Builtins::kDatePrototypeSetUTCMinutes, 3, false);
    2244             :     SimpleInstallFunction(isolate_, prototype, "getUTCMonth",
    2245         111 :                           Builtins::kDatePrototypeGetUTCMonth, 0, true);
    2246             :     SimpleInstallFunction(isolate_, prototype, "setUTCMonth",
    2247         111 :                           Builtins::kDatePrototypeSetUTCMonth, 2, false);
    2248             :     SimpleInstallFunction(isolate_, prototype, "getUTCSeconds",
    2249         111 :                           Builtins::kDatePrototypeGetUTCSeconds, 0, true);
    2250             :     SimpleInstallFunction(isolate_, prototype, "setUTCSeconds",
    2251         111 :                           Builtins::kDatePrototypeSetUTCSeconds, 2, false);
    2252             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    2253         111 :                           Builtins::kDatePrototypeValueOf, 0, true);
    2254             :     SimpleInstallFunction(isolate_, prototype, "getYear",
    2255         111 :                           Builtins::kDatePrototypeGetYear, 0, true);
    2256             :     SimpleInstallFunction(isolate_, prototype, "setYear",
    2257         111 :                           Builtins::kDatePrototypeSetYear, 1, false);
    2258             :     SimpleInstallFunction(isolate_, prototype, "toJSON",
    2259         111 :                           Builtins::kDatePrototypeToJson, 1, false);
    2260             : 
    2261             : #ifdef V8_INTL_SUPPORT
    2262             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    2263         111 :                           Builtins::kDatePrototypeToLocaleString, 0, false);
    2264             :     SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
    2265         111 :                           Builtins::kDatePrototypeToLocaleDateString, 0, false);
    2266             :     SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
    2267         111 :                           Builtins::kDatePrototypeToLocaleTimeString, 0, false);
    2268             : #else
    2269             :     // Install Intl fallback functions.
    2270             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    2271             :                           Builtins::kDatePrototypeToString, 0, false);
    2272             :     SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
    2273             :                           Builtins::kDatePrototypeToDateString, 0, false);
    2274             :     SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
    2275             :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2276             : #endif  // V8_INTL_SUPPORT
    2277             : 
    2278             :     // Install the @@toPrimitive function.
    2279             :     InstallFunctionAtSymbol(
    2280             :         isolate_, prototype, factory->to_primitive_symbol(),
    2281             :         "[Symbol.toPrimitive]", Builtins::kDatePrototypeToPrimitive, 1, true,
    2282         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2283             :   }
    2284             : 
    2285             :   {
    2286             :     Handle<SharedFunctionInfo> info = SimpleCreateBuiltinSharedFunctionInfo(
    2287             :         isolate_, Builtins::kPromiseGetCapabilitiesExecutor,
    2288         111 :         factory->empty_string(), 2);
    2289         111 :     native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
    2290             :   }
    2291             : 
    2292             :   {  // -- P r o m i s e
    2293             :     Handle<JSFunction> promise_fun = InstallFunction(
    2294             :         isolate_, global, "Promise", JS_PROMISE_TYPE,
    2295             :         JSPromise::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    2296         111 :         Builtins::kPromiseConstructor);
    2297         111 :     InstallWithIntrinsicDefaultProto(isolate_, promise_fun,
    2298         111 :                                      Context::PROMISE_FUNCTION_INDEX);
    2299             : 
    2300         111 :     Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate_);
    2301             :     shared->set_internal_formal_parameter_count(1);
    2302             :     shared->set_length(1);
    2303             : 
    2304         111 :     InstallSpeciesGetter(isolate_, promise_fun);
    2305             : 
    2306             :     Handle<JSFunction> promise_all = InstallFunctionWithBuiltinId(
    2307         111 :         isolate_, promise_fun, "all", Builtins::kPromiseAll, 1, true);
    2308         111 :     native_context()->set_promise_all(*promise_all);
    2309             : 
    2310             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "race",
    2311         111 :                                  Builtins::kPromiseRace, 1, true);
    2312             : 
    2313             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "resolve",
    2314         111 :                                  Builtins::kPromiseResolveTrampoline, 1, true);
    2315             : 
    2316             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "reject",
    2317         111 :                                  Builtins::kPromiseReject, 1, true);
    2318             : 
    2319             :     // Setup %PromisePrototype%.
    2320             :     Handle<JSObject> prototype(
    2321         222 :         JSObject::cast(promise_fun->instance_prototype()), isolate());
    2322         111 :     native_context()->set_promise_prototype(*prototype);
    2323             : 
    2324         111 :     InstallToStringTag(isolate_, prototype, factory->Promise_string());
    2325             : 
    2326             :     Handle<JSFunction> promise_then = InstallFunctionWithBuiltinId(
    2327         111 :         isolate_, prototype, "then", Builtins::kPromisePrototypeThen, 2, true);
    2328         111 :     native_context()->set_promise_then(*promise_then);
    2329             : 
    2330             :     Handle<JSFunction> promise_catch =
    2331             :         InstallFunctionWithBuiltinId(isolate_, prototype, "catch",
    2332         111 :                                      Builtins::kPromisePrototypeCatch, 1, true);
    2333         111 :     native_context()->set_promise_catch(*promise_catch);
    2334             : 
    2335             :     InstallFunctionWithBuiltinId(isolate_, prototype, "finally",
    2336         111 :                                  Builtins::kPromisePrototypeFinally, 1, true);
    2337             : 
    2338             :     {
    2339             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2340             :           isolate(), Builtins::kPromiseThenFinally,
    2341         222 :           isolate_->factory()->empty_string(), 1);
    2342         111 :       info->set_native(true);
    2343         111 :       native_context()->set_promise_then_finally_shared_fun(*info);
    2344             :     }
    2345             : 
    2346             :     {
    2347             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2348             :           isolate(), Builtins::kPromiseCatchFinally,
    2349         222 :           isolate_->factory()->empty_string(), 1);
    2350         111 :       info->set_native(true);
    2351         111 :       native_context()->set_promise_catch_finally_shared_fun(*info);
    2352             :     }
    2353             : 
    2354             :     {
    2355             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2356             :           isolate(), Builtins::kPromiseValueThunkFinally,
    2357         222 :           isolate_->factory()->empty_string(), 0);
    2358         111 :       native_context()->set_promise_value_thunk_finally_shared_fun(*info);
    2359             :     }
    2360             : 
    2361             :     {
    2362             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2363             :           isolate(), Builtins::kPromiseThrowerFinally,
    2364         222 :           isolate_->factory()->empty_string(), 0);
    2365         111 :       native_context()->set_promise_thrower_finally_shared_fun(*info);
    2366             :     }
    2367             : 
    2368             :     // Force the Promise constructor to fast properties, so that we can use the
    2369             :     // fast paths for various things like
    2370             :     //
    2371             :     //   x instanceof Promise
    2372             :     //
    2373             :     // etc. We should probably come up with a more principled approach once
    2374             :     // the JavaScript builtins are gone.
    2375             :     JSObject::MigrateSlowToFast(Handle<JSObject>::cast(promise_fun), 0,
    2376         111 :                                 "Bootstrapping");
    2377             : 
    2378             :     Handle<Map> prototype_map(prototype->map(), isolate());
    2379         111 :     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
    2380             : 
    2381             :     {  // Internal: IsPromise
    2382             :       Handle<JSFunction> function = SimpleCreateFunction(
    2383         111 :           isolate_, factory->empty_string(), Builtins::kIsPromise, 1, false);
    2384         111 :       native_context()->set_is_promise(*function);
    2385             :     }
    2386             : 
    2387             :     {
    2388             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2389             :           isolate_, Builtins::kPromiseCapabilityDefaultResolve,
    2390         111 :           factory->empty_string(), 1, FunctionKind::kConciseMethod);
    2391         111 :       info->set_native(true);
    2392         222 :       info->set_function_map_index(
    2393         111 :           Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
    2394         222 :       native_context()->set_promise_capability_default_resolve_shared_fun(
    2395         111 :           *info);
    2396             : 
    2397             :       info = SimpleCreateSharedFunctionInfo(
    2398             :           isolate_, Builtins::kPromiseCapabilityDefaultReject,
    2399         111 :           factory->empty_string(), 1, FunctionKind::kConciseMethod);
    2400         111 :       info->set_native(true);
    2401         222 :       info->set_function_map_index(
    2402         111 :           Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
    2403         111 :       native_context()->set_promise_capability_default_reject_shared_fun(*info);
    2404             :     }
    2405             : 
    2406             :     {
    2407             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2408             :           isolate_, Builtins::kPromiseAllResolveElementClosure,
    2409         111 :           factory->empty_string(), 1);
    2410         111 :       native_context()->set_promise_all_resolve_element_shared_fun(*info);
    2411             :     }
    2412             : 
    2413             :     // Force the Promise constructor to fast properties, so that we can use the
    2414             :     // fast paths for various things like
    2415             :     //
    2416             :     //   x instanceof Promise
    2417             :     //
    2418             :     // etc. We should probably come up with a more principled approach once
    2419             :     // the JavaScript builtins are gone.
    2420         111 :     JSObject::MigrateSlowToFast(promise_fun, 0, "Bootstrapping");
    2421             :   }
    2422             : 
    2423             :   {  // -- R e g E x p
    2424             :     // Builtin functions for RegExp.prototype.
    2425             :     Handle<JSFunction> regexp_fun = InstallFunction(
    2426             :         isolate_, global, "RegExp", JS_REGEXP_TYPE,
    2427             :         JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kTaggedSize,
    2428             :         JSRegExp::kInObjectFieldCount, factory->the_hole_value(),
    2429         111 :         Builtins::kRegExpConstructor);
    2430         111 :     InstallWithIntrinsicDefaultProto(isolate_, regexp_fun,
    2431         111 :                                      Context::REGEXP_FUNCTION_INDEX);
    2432             : 
    2433         111 :     Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate_);
    2434             :     shared->set_internal_formal_parameter_count(2);
    2435             :     shared->set_length(2);
    2436             : 
    2437             :     {
    2438             :       // Setup %RegExpPrototype%.
    2439             :       Handle<JSObject> prototype(
    2440         222 :           JSObject::cast(regexp_fun->instance_prototype()), isolate());
    2441         111 :       native_context()->set_regexp_prototype(*prototype);
    2442             : 
    2443             :       {
    2444             :         Handle<JSFunction> fun =
    2445             :             SimpleInstallFunction(isolate_, prototype, "exec",
    2446         111 :                                   Builtins::kRegExpPrototypeExec, 1, true);
    2447             :         // Check that index of "exec" function in JSRegExp is correct.
    2448             :         DCHECK_EQ(JSRegExp::kExecFunctionDescriptorIndex,
    2449             :                   prototype->map()->LastAdded());
    2450             : 
    2451         111 :         native_context()->set_regexp_exec_function(*fun);
    2452             :       }
    2453             : 
    2454             :       SimpleInstallGetter(isolate_, prototype, factory->dotAll_string(),
    2455         111 :                           Builtins::kRegExpPrototypeDotAllGetter, true);
    2456             :       SimpleInstallGetter(isolate_, prototype, factory->flags_string(),
    2457         111 :                           Builtins::kRegExpPrototypeFlagsGetter, true);
    2458             :       SimpleInstallGetter(isolate_, prototype, factory->global_string(),
    2459         111 :                           Builtins::kRegExpPrototypeGlobalGetter, true);
    2460             :       SimpleInstallGetter(isolate_, prototype, factory->ignoreCase_string(),
    2461         111 :                           Builtins::kRegExpPrototypeIgnoreCaseGetter, true);
    2462             :       SimpleInstallGetter(isolate_, prototype, factory->multiline_string(),
    2463         111 :                           Builtins::kRegExpPrototypeMultilineGetter, true);
    2464             :       SimpleInstallGetter(isolate_, prototype, factory->source_string(),
    2465         111 :                           Builtins::kRegExpPrototypeSourceGetter, true);
    2466             :       SimpleInstallGetter(isolate_, prototype, factory->sticky_string(),
    2467         111 :                           Builtins::kRegExpPrototypeStickyGetter, true);
    2468             :       SimpleInstallGetter(isolate_, prototype, factory->unicode_string(),
    2469         111 :                           Builtins::kRegExpPrototypeUnicodeGetter, true);
    2470             : 
    2471             :       SimpleInstallFunction(isolate_, prototype, "compile",
    2472         111 :                             Builtins::kRegExpPrototypeCompile, 2, true);
    2473             :       SimpleInstallFunction(isolate_, prototype, "toString",
    2474         111 :                             Builtins::kRegExpPrototypeToString, 0, false);
    2475             :       SimpleInstallFunction(isolate_, prototype, "test",
    2476         111 :                             Builtins::kRegExpPrototypeTest, 1, true);
    2477             : 
    2478             :       InstallFunctionAtSymbol(isolate_, prototype, factory->match_symbol(),
    2479             :                               "[Symbol.match]", Builtins::kRegExpPrototypeMatch,
    2480         111 :                               1, true);
    2481             :       DCHECK_EQ(JSRegExp::kSymbolMatchFunctionDescriptorIndex,
    2482             :                 prototype->map()->LastAdded());
    2483             : 
    2484             :       InstallFunctionAtSymbol(isolate_, prototype, factory->replace_symbol(),
    2485             :                               "[Symbol.replace]",
    2486         111 :                               Builtins::kRegExpPrototypeReplace, 2, false);
    2487             :       DCHECK_EQ(JSRegExp::kSymbolReplaceFunctionDescriptorIndex,
    2488             :                 prototype->map()->LastAdded());
    2489             : 
    2490             :       InstallFunctionAtSymbol(isolate_, prototype, factory->search_symbol(),
    2491             :                               "[Symbol.search]",
    2492         111 :                               Builtins::kRegExpPrototypeSearch, 1, true);
    2493             :       DCHECK_EQ(JSRegExp::kSymbolSearchFunctionDescriptorIndex,
    2494             :                 prototype->map()->LastAdded());
    2495             : 
    2496             :       InstallFunctionAtSymbol(isolate_, prototype, factory->split_symbol(),
    2497             :                               "[Symbol.split]", Builtins::kRegExpPrototypeSplit,
    2498         111 :                               2, false);
    2499             :       DCHECK_EQ(JSRegExp::kSymbolSplitFunctionDescriptorIndex,
    2500             :                 prototype->map()->LastAdded());
    2501             : 
    2502             :       Handle<Map> prototype_map(prototype->map(), isolate());
    2503         111 :       Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
    2504             : 
    2505             :       // Store the initial RegExp.prototype map. This is used in fast-path
    2506             :       // checks. Do not alter the prototype after this point.
    2507         111 :       native_context()->set_regexp_prototype_map(*prototype_map);
    2508             :     }
    2509             : 
    2510             :     {
    2511             :       // RegExp getters and setters.
    2512             : 
    2513         111 :       InstallSpeciesGetter(isolate_, regexp_fun);
    2514             : 
    2515             :       // Static properties set by a successful match.
    2516             : 
    2517         222 :       SimpleInstallGetterSetter(isolate_, regexp_fun, factory->input_string(),
    2518             :                                 Builtins::kRegExpInputGetter,
    2519         111 :                                 Builtins::kRegExpInputSetter);
    2520         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$_",
    2521             :                                 Builtins::kRegExpInputGetter,
    2522             :                                 Builtins::kRegExpInputSetter);
    2523             : 
    2524         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "lastMatch",
    2525             :                                 Builtins::kRegExpLastMatchGetter,
    2526             :                                 Builtins::kEmptyFunction);
    2527         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$&",
    2528             :                                 Builtins::kRegExpLastMatchGetter,
    2529             :                                 Builtins::kEmptyFunction);
    2530             : 
    2531         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "lastParen",
    2532             :                                 Builtins::kRegExpLastParenGetter,
    2533             :                                 Builtins::kEmptyFunction);
    2534         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$+",
    2535             :                                 Builtins::kRegExpLastParenGetter,
    2536             :                                 Builtins::kEmptyFunction);
    2537             : 
    2538         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "leftContext",
    2539             :                                 Builtins::kRegExpLeftContextGetter,
    2540             :                                 Builtins::kEmptyFunction);
    2541         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$`",
    2542             :                                 Builtins::kRegExpLeftContextGetter,
    2543             :                                 Builtins::kEmptyFunction);
    2544             : 
    2545         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "rightContext",
    2546             :                                 Builtins::kRegExpRightContextGetter,
    2547             :                                 Builtins::kEmptyFunction);
    2548         111 :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$'",
    2549             :                                 Builtins::kRegExpRightContextGetter,
    2550             :                                 Builtins::kEmptyFunction);
    2551             : 
    2552             : #define INSTALL_CAPTURE_GETTER(i)                                \
    2553             :   SimpleInstallGetterSetter(isolate_, regexp_fun, "$" #i,        \
    2554             :                             Builtins::kRegExpCapture##i##Getter, \
    2555             :                             Builtins::kEmptyFunction)
    2556         111 :       INSTALL_CAPTURE_GETTER(1);
    2557         111 :       INSTALL_CAPTURE_GETTER(2);
    2558         111 :       INSTALL_CAPTURE_GETTER(3);
    2559         111 :       INSTALL_CAPTURE_GETTER(4);
    2560         111 :       INSTALL_CAPTURE_GETTER(5);
    2561         111 :       INSTALL_CAPTURE_GETTER(6);
    2562         111 :       INSTALL_CAPTURE_GETTER(7);
    2563         111 :       INSTALL_CAPTURE_GETTER(8);
    2564         111 :       INSTALL_CAPTURE_GETTER(9);
    2565             : #undef INSTALL_CAPTURE_GETTER
    2566             :     }
    2567             : 
    2568             :     DCHECK(regexp_fun->has_initial_map());
    2569             :     Handle<Map> initial_map(regexp_fun->initial_map(), isolate());
    2570             : 
    2571             :     DCHECK_EQ(1, initial_map->GetInObjectProperties());
    2572             : 
    2573         111 :     Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
    2574             : 
    2575             :     // ECMA-262, section 15.10.7.5.
    2576             :     PropertyAttributes writable =
    2577             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
    2578             :     Descriptor d = Descriptor::DataField(isolate(), factory->lastIndex_string(),
    2579             :                                          JSRegExp::kLastIndexFieldIndex,
    2580         111 :                                          writable, Representation::Tagged());
    2581         111 :     initial_map->AppendDescriptor(isolate(), &d);
    2582             : 
    2583             :     // Create the last match info.
    2584         111 :     Handle<RegExpMatchInfo> last_match_info = factory->NewRegExpMatchInfo();
    2585         111 :     native_context()->set_regexp_last_match_info(*last_match_info);
    2586             : 
    2587             :     // Force the RegExp constructor to fast properties, so that we can use the
    2588             :     // fast paths for various things like
    2589             :     //
    2590             :     //   x instanceof RegExp
    2591             :     //
    2592             :     // etc. We should probably come up with a more principled approach once
    2593             :     // the JavaScript builtins are gone.
    2594         111 :     JSObject::MigrateSlowToFast(regexp_fun, 0, "Bootstrapping");
    2595             :   }
    2596             : 
    2597             :   {  // -- E r r o r
    2598         111 :     InstallError(isolate_, global, factory->Error_string(),
    2599         111 :                  Context::ERROR_FUNCTION_INDEX);
    2600         111 :     InstallMakeError(isolate_, Builtins::kMakeError, Context::MAKE_ERROR_INDEX);
    2601             :   }
    2602             : 
    2603             :   {  // -- E v a l E r r o r
    2604         111 :     InstallError(isolate_, global, factory->EvalError_string(),
    2605         111 :                  Context::EVAL_ERROR_FUNCTION_INDEX);
    2606             :   }
    2607             : 
    2608             :   {  // -- R a n g e E r r o r
    2609         111 :     InstallError(isolate_, global, factory->RangeError_string(),
    2610         111 :                  Context::RANGE_ERROR_FUNCTION_INDEX);
    2611         111 :     InstallMakeError(isolate_, Builtins::kMakeRangeError,
    2612         111 :                      Context::MAKE_RANGE_ERROR_INDEX);
    2613             :   }
    2614             : 
    2615             :   {  // -- R e f e r e n c e E r r o r
    2616         111 :     InstallError(isolate_, global, factory->ReferenceError_string(),
    2617         111 :                  Context::REFERENCE_ERROR_FUNCTION_INDEX);
    2618             :   }
    2619             : 
    2620             :   {  // -- S y n t a x E r r o r
    2621         111 :     InstallError(isolate_, global, factory->SyntaxError_string(),
    2622         111 :                  Context::SYNTAX_ERROR_FUNCTION_INDEX);
    2623         111 :     InstallMakeError(isolate_, Builtins::kMakeSyntaxError,
    2624         111 :                      Context::MAKE_SYNTAX_ERROR_INDEX);
    2625             :   }
    2626             : 
    2627             :   {  // -- T y p e E r r o r
    2628         111 :     InstallError(isolate_, global, factory->TypeError_string(),
    2629         111 :                  Context::TYPE_ERROR_FUNCTION_INDEX);
    2630         111 :     InstallMakeError(isolate_, Builtins::kMakeTypeError,
    2631         111 :                      Context::MAKE_TYPE_ERROR_INDEX);
    2632             :   }
    2633             : 
    2634             :   {  // -- U R I E r r o r
    2635         111 :     InstallError(isolate_, global, factory->URIError_string(),
    2636         111 :                  Context::URI_ERROR_FUNCTION_INDEX);
    2637         111 :     InstallMakeError(isolate_, Builtins::kMakeURIError,
    2638         111 :                      Context::MAKE_URI_ERROR_INDEX);
    2639             :   }
    2640             : 
    2641             :   {  // -- C o m p i l e E r r o r
    2642         111 :     Handle<JSObject> dummy = factory->NewJSObject(isolate_->object_function());
    2643         111 :     InstallError(isolate_, dummy, factory->CompileError_string(),
    2644         111 :                  Context::WASM_COMPILE_ERROR_FUNCTION_INDEX);
    2645             : 
    2646             :     // -- L i n k E r r o r
    2647         111 :     InstallError(isolate_, dummy, factory->LinkError_string(),
    2648         111 :                  Context::WASM_LINK_ERROR_FUNCTION_INDEX);
    2649             : 
    2650             :     // -- R u n t i m e E r r o r
    2651         111 :     InstallError(isolate_, dummy, factory->RuntimeError_string(),
    2652         111 :                  Context::WASM_RUNTIME_ERROR_FUNCTION_INDEX);
    2653             :   }
    2654             : 
    2655             :   // Initialize the embedder data slot.
    2656             :   // TODO(ishell): microtask queue pointer will be moved from native context
    2657             :   // to the embedder data array so we don't need an empty embedder data array.
    2658         111 :   Handle<EmbedderDataArray> embedder_data = factory->NewEmbedderDataArray(0);
    2659         222 :   native_context()->set_embedder_data(*embedder_data);
    2660             : 
    2661             :   {  // -- J S O N
    2662             :     Handle<JSObject> json_object =
    2663         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    2664         111 :     JSObject::AddProperty(isolate_, global, "JSON", json_object, DONT_ENUM);
    2665             :     SimpleInstallFunction(isolate_, json_object, "parse", Builtins::kJsonParse,
    2666         111 :                           2, false);
    2667             :     SimpleInstallFunction(isolate_, json_object, "stringify",
    2668         111 :                           Builtins::kJsonStringify, 3, true);
    2669         111 :     InstallToStringTag(isolate_, json_object, "JSON");
    2670             :   }
    2671             : 
    2672             :   {  // -- M a t h
    2673             :     Handle<JSObject> math =
    2674         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    2675         111 :     JSObject::AddProperty(isolate_, global, "Math", math, DONT_ENUM);
    2676         111 :     SimpleInstallFunction(isolate_, math, "abs", Builtins::kMathAbs, 1, true);
    2677         111 :     SimpleInstallFunction(isolate_, math, "acos", Builtins::kMathAcos, 1, true);
    2678             :     SimpleInstallFunction(isolate_, math, "acosh", Builtins::kMathAcosh, 1,
    2679         111 :                           true);
    2680         111 :     SimpleInstallFunction(isolate_, math, "asin", Builtins::kMathAsin, 1, true);
    2681             :     SimpleInstallFunction(isolate_, math, "asinh", Builtins::kMathAsinh, 1,
    2682         111 :                           true);
    2683         111 :     SimpleInstallFunction(isolate_, math, "atan", Builtins::kMathAtan, 1, true);
    2684             :     SimpleInstallFunction(isolate_, math, "atanh", Builtins::kMathAtanh, 1,
    2685         111 :                           true);
    2686             :     SimpleInstallFunction(isolate_, math, "atan2", Builtins::kMathAtan2, 2,
    2687         111 :                           true);
    2688         111 :     SimpleInstallFunction(isolate_, math, "ceil", Builtins::kMathCeil, 1, true);
    2689         111 :     SimpleInstallFunction(isolate_, math, "cbrt", Builtins::kMathCbrt, 1, true);
    2690             :     SimpleInstallFunction(isolate_, math, "expm1", Builtins::kMathExpm1, 1,
    2691         111 :                           true);
    2692             :     SimpleInstallFunction(isolate_, math, "clz32", Builtins::kMathClz32, 1,
    2693         111 :                           true);
    2694         111 :     SimpleInstallFunction(isolate_, math, "cos", Builtins::kMathCos, 1, true);
    2695         111 :     SimpleInstallFunction(isolate_, math, "cosh", Builtins::kMathCosh, 1, true);
    2696         111 :     SimpleInstallFunction(isolate_, math, "exp", Builtins::kMathExp, 1, true);
    2697             :     Handle<JSFunction> math_floor = SimpleInstallFunction(
    2698         111 :         isolate_, math, "floor", Builtins::kMathFloor, 1, true);
    2699         111 :     native_context()->set_math_floor(*math_floor);
    2700             :     SimpleInstallFunction(isolate_, math, "fround", Builtins::kMathFround, 1,
    2701         111 :                           true);
    2702             :     SimpleInstallFunction(isolate_, math, "hypot", Builtins::kMathHypot, 2,
    2703         111 :                           false);
    2704         111 :     SimpleInstallFunction(isolate_, math, "imul", Builtins::kMathImul, 2, true);
    2705         111 :     SimpleInstallFunction(isolate_, math, "log", Builtins::kMathLog, 1, true);
    2706             :     SimpleInstallFunction(isolate_, math, "log1p", Builtins::kMathLog1p, 1,
    2707         111 :                           true);
    2708         111 :     SimpleInstallFunction(isolate_, math, "log2", Builtins::kMathLog2, 1, true);
    2709             :     SimpleInstallFunction(isolate_, math, "log10", Builtins::kMathLog10, 1,
    2710         111 :                           true);
    2711         111 :     SimpleInstallFunction(isolate_, math, "max", Builtins::kMathMax, 2, false);
    2712         111 :     SimpleInstallFunction(isolate_, math, "min", Builtins::kMathMin, 2, false);
    2713             :     Handle<JSFunction> math_pow = SimpleInstallFunction(
    2714         111 :         isolate_, math, "pow", Builtins::kMathPow, 2, true);
    2715         111 :     native_context()->set_math_pow(*math_pow);
    2716             :     SimpleInstallFunction(isolate_, math, "random", Builtins::kMathRandom, 0,
    2717         111 :                           true);
    2718             :     SimpleInstallFunction(isolate_, math, "round", Builtins::kMathRound, 1,
    2719         111 :                           true);
    2720         111 :     SimpleInstallFunction(isolate_, math, "sign", Builtins::kMathSign, 1, true);
    2721         111 :     SimpleInstallFunction(isolate_, math, "sin", Builtins::kMathSin, 1, true);
    2722         111 :     SimpleInstallFunction(isolate_, math, "sinh", Builtins::kMathSinh, 1, true);
    2723         111 :     SimpleInstallFunction(isolate_, math, "sqrt", Builtins::kMathSqrt, 1, true);
    2724         111 :     SimpleInstallFunction(isolate_, math, "tan", Builtins::kMathTan, 1, true);
    2725         111 :     SimpleInstallFunction(isolate_, math, "tanh", Builtins::kMathTanh, 1, true);
    2726             :     SimpleInstallFunction(isolate_, math, "trunc", Builtins::kMathTrunc, 1,
    2727         111 :                           true);
    2728             : 
    2729             :     // Install math constants.
    2730         111 :     double const kE = base::ieee754::exp(1.0);
    2731             :     double const kPI = 3.1415926535897932;
    2732         111 :     InstallConstant(isolate_, math, "E", factory->NewNumber(kE));
    2733         111 :     InstallConstant(isolate_, math, "LN10",
    2734         111 :                     factory->NewNumber(base::ieee754::log(10.0)));
    2735         111 :     InstallConstant(isolate_, math, "LN2",
    2736         111 :                     factory->NewNumber(base::ieee754::log(2.0)));
    2737         111 :     InstallConstant(isolate_, math, "LOG10E",
    2738         111 :                     factory->NewNumber(base::ieee754::log10(kE)));
    2739         111 :     InstallConstant(isolate_, math, "LOG2E",
    2740         111 :                     factory->NewNumber(base::ieee754::log2(kE)));
    2741         111 :     InstallConstant(isolate_, math, "PI", factory->NewNumber(kPI));
    2742         111 :     InstallConstant(isolate_, math, "SQRT1_2",
    2743         111 :                     factory->NewNumber(std::sqrt(0.5)));
    2744         111 :     InstallConstant(isolate_, math, "SQRT2",
    2745         111 :                     factory->NewNumber(std::sqrt(2.0)));
    2746         111 :     InstallToStringTag(isolate_, math, "Math");
    2747             :   }
    2748             : 
    2749             :   {  // -- C o n s o l e
    2750         111 :     Handle<String> name = factory->InternalizeUtf8String("console");
    2751             :     NewFunctionArgs args = NewFunctionArgs::ForFunctionWithoutCode(
    2752         111 :         name, isolate_->strict_function_map(), LanguageMode::kStrict);
    2753         111 :     Handle<JSFunction> cons = factory->NewFunction(args);
    2754             : 
    2755         111 :     Handle<JSObject> empty = factory->NewJSObject(isolate_->object_function());
    2756         111 :     JSFunction::SetPrototype(cons, empty);
    2757             : 
    2758         111 :     Handle<JSObject> console = factory->NewJSObject(cons, AllocationType::kOld);
    2759             :     DCHECK(console->IsJSObject());
    2760         111 :     JSObject::AddProperty(isolate_, global, name, console, DONT_ENUM);
    2761             :     SimpleInstallFunction(isolate_, console, "debug", Builtins::kConsoleDebug,
    2762         111 :                           1, false, NONE);
    2763             :     SimpleInstallFunction(isolate_, console, "error", Builtins::kConsoleError,
    2764         111 :                           1, false, NONE);
    2765             :     SimpleInstallFunction(isolate_, console, "info", Builtins::kConsoleInfo, 1,
    2766         111 :                           false, NONE);
    2767             :     SimpleInstallFunction(isolate_, console, "log", Builtins::kConsoleLog, 1,
    2768         111 :                           false, NONE);
    2769             :     SimpleInstallFunction(isolate_, console, "warn", Builtins::kConsoleWarn, 1,
    2770         111 :                           false, NONE);
    2771             :     SimpleInstallFunction(isolate_, console, "dir", Builtins::kConsoleDir, 1,
    2772         111 :                           false, NONE);
    2773             :     SimpleInstallFunction(isolate_, console, "dirxml", Builtins::kConsoleDirXml,
    2774         111 :                           1, false, NONE);
    2775             :     SimpleInstallFunction(isolate_, console, "table", Builtins::kConsoleTable,
    2776         111 :                           1, false, NONE);
    2777             :     SimpleInstallFunction(isolate_, console, "trace", Builtins::kConsoleTrace,
    2778         111 :                           1, false, NONE);
    2779             :     SimpleInstallFunction(isolate_, console, "group", Builtins::kConsoleGroup,
    2780         111 :                           1, false, NONE);
    2781             :     SimpleInstallFunction(isolate_, console, "groupCollapsed",
    2782         111 :                           Builtins::kConsoleGroupCollapsed, 1, false, NONE);
    2783             :     SimpleInstallFunction(isolate_, console, "groupEnd",
    2784         111 :                           Builtins::kConsoleGroupEnd, 1, false, NONE);
    2785             :     SimpleInstallFunction(isolate_, console, "clear", Builtins::kConsoleClear,
    2786         111 :                           1, false, NONE);
    2787             :     SimpleInstallFunction(isolate_, console, "count", Builtins::kConsoleCount,
    2788         111 :                           1, false, NONE);
    2789             :     SimpleInstallFunction(isolate_, console, "countReset",
    2790         111 :                           Builtins::kConsoleCountReset, 1, false, NONE);
    2791             :     SimpleInstallFunction(isolate_, console, "assert",
    2792         111 :                           Builtins::kFastConsoleAssert, 1, false, NONE);
    2793             :     SimpleInstallFunction(isolate_, console, "profile",
    2794         111 :                           Builtins::kConsoleProfile, 1, false, NONE);
    2795             :     SimpleInstallFunction(isolate_, console, "profileEnd",
    2796         111 :                           Builtins::kConsoleProfileEnd, 1, false, NONE);
    2797             :     SimpleInstallFunction(isolate_, console, "time", Builtins::kConsoleTime, 1,
    2798         111 :                           false, NONE);
    2799             :     SimpleInstallFunction(isolate_, console, "timeLog",
    2800         111 :                           Builtins::kConsoleTimeLog, 1, false, NONE);
    2801             :     SimpleInstallFunction(isolate_, console, "timeEnd",
    2802         111 :                           Builtins::kConsoleTimeEnd, 1, false, NONE);
    2803             :     SimpleInstallFunction(isolate_, console, "timeStamp",
    2804         111 :                           Builtins::kConsoleTimeStamp, 1, false, NONE);
    2805             :     SimpleInstallFunction(isolate_, console, "context",
    2806         111 :                           Builtins::kConsoleContext, 1, true, NONE);
    2807         111 :     InstallToStringTag(isolate_, console, "Object");
    2808             :   }
    2809             : 
    2810             : #ifdef V8_INTL_SUPPORT
    2811             :   {  // -- I n t l
    2812             :     Handle<JSObject> intl =
    2813         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    2814         111 :     JSObject::AddProperty(isolate_, global, "Intl", intl, DONT_ENUM);
    2815             : 
    2816             :     SimpleInstallFunction(isolate(), intl, "getCanonicalLocales",
    2817         111 :                           Builtins::kIntlGetCanonicalLocales, 1, false);
    2818             : 
    2819             :     {  // -- D a t e T i m e F o r m a t
    2820             :       Handle<JSFunction> date_time_format_constructor = InstallFunction(
    2821             :           isolate_, intl, "DateTimeFormat", JS_INTL_DATE_TIME_FORMAT_TYPE,
    2822             :           JSDateTimeFormat::kSize, 0, factory->the_hole_value(),
    2823         111 :           Builtins::kDateTimeFormatConstructor);
    2824             :       date_time_format_constructor->shared()->set_length(0);
    2825             :       date_time_format_constructor->shared()->DontAdaptArguments();
    2826         111 :       InstallWithIntrinsicDefaultProto(
    2827             :           isolate_, date_time_format_constructor,
    2828         111 :           Context::INTL_DATE_TIME_FORMAT_FUNCTION_INDEX);
    2829             : 
    2830             :       SimpleInstallFunction(
    2831             :           isolate(), date_time_format_constructor, "supportedLocalesOf",
    2832         111 :           Builtins::kDateTimeFormatSupportedLocalesOf, 1, false);
    2833             : 
    2834             :       Handle<JSObject> prototype(
    2835         333 :           JSObject::cast(date_time_format_constructor->prototype()), isolate_);
    2836             : 
    2837         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2838             : 
    2839             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2840             :                             Builtins::kDateTimeFormatPrototypeResolvedOptions,
    2841         111 :                             0, false);
    2842             : 
    2843             :       SimpleInstallFunction(isolate_, prototype, "formatToParts",
    2844             :                             Builtins::kDateTimeFormatPrototypeFormatToParts, 1,
    2845         111 :                             false);
    2846             : 
    2847             :       SimpleInstallGetter(isolate_, prototype, factory->format_string(),
    2848         111 :                           Builtins::kDateTimeFormatPrototypeFormat, false);
    2849             :     }
    2850             : 
    2851             :     {  // -- N u m b e r F o r m a t
    2852             :       Handle<JSFunction> number_format_constructor = InstallFunction(
    2853             :           isolate_, intl, "NumberFormat", JS_INTL_NUMBER_FORMAT_TYPE,
    2854             :           JSNumberFormat::kSize, 0, factory->the_hole_value(),
    2855         111 :           Builtins::kNumberFormatConstructor);
    2856             :       number_format_constructor->shared()->set_length(0);
    2857             :       number_format_constructor->shared()->DontAdaptArguments();
    2858         111 :       InstallWithIntrinsicDefaultProto(
    2859             :           isolate_, number_format_constructor,
    2860         111 :           Context::INTL_NUMBER_FORMAT_FUNCTION_INDEX);
    2861             : 
    2862             :       SimpleInstallFunction(
    2863             :           isolate(), number_format_constructor, "supportedLocalesOf",
    2864         111 :           Builtins::kNumberFormatSupportedLocalesOf, 1, false);
    2865             : 
    2866             :       Handle<JSObject> prototype(
    2867         333 :           JSObject::cast(number_format_constructor->prototype()), isolate_);
    2868             : 
    2869         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2870             : 
    2871             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2872             :                             Builtins::kNumberFormatPrototypeResolvedOptions, 0,
    2873         111 :                             false);
    2874             : 
    2875             :       SimpleInstallFunction(isolate_, prototype, "formatToParts",
    2876             :                             Builtins::kNumberFormatPrototypeFormatToParts, 1,
    2877         111 :                             false);
    2878             :       SimpleInstallGetter(isolate_, prototype, factory->format_string(),
    2879         111 :                           Builtins::kNumberFormatPrototypeFormatNumber, false);
    2880             :     }
    2881             : 
    2882             :     {  // -- C o l l a t o r
    2883             :       Handle<JSFunction> collator_constructor = InstallFunction(
    2884             :           isolate_, intl, "Collator", JS_INTL_COLLATOR_TYPE, JSCollator::kSize,
    2885         111 :           0, factory->the_hole_value(), Builtins::kCollatorConstructor);
    2886             :       collator_constructor->shared()->DontAdaptArguments();
    2887         111 :       InstallWithIntrinsicDefaultProto(isolate_, collator_constructor,
    2888         111 :                                        Context::INTL_COLLATOR_FUNCTION_INDEX);
    2889             : 
    2890             :       SimpleInstallFunction(isolate(), collator_constructor,
    2891             :                             "supportedLocalesOf",
    2892         111 :                             Builtins::kCollatorSupportedLocalesOf, 1, false);
    2893             : 
    2894             :       Handle<JSObject> prototype(
    2895         333 :           JSObject::cast(collator_constructor->prototype()), isolate_);
    2896             : 
    2897         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2898             : 
    2899             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2900             :                             Builtins::kCollatorPrototypeResolvedOptions, 0,
    2901         111 :                             false);
    2902             : 
    2903             :       SimpleInstallGetter(isolate_, prototype, factory->compare_string(),
    2904         111 :                           Builtins::kCollatorPrototypeCompare, false);
    2905             :     }
    2906             : 
    2907             :     {  // -- V 8 B r e a k I t e r a t o r
    2908             :       Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
    2909             :           isolate_, intl, "v8BreakIterator", JS_INTL_V8_BREAK_ITERATOR_TYPE,
    2910             :           JSV8BreakIterator::kSize, 0, factory->the_hole_value(),
    2911         111 :           Builtins::kV8BreakIteratorConstructor);
    2912             :       v8_break_iterator_constructor->shared()->DontAdaptArguments();
    2913             : 
    2914             :       SimpleInstallFunction(
    2915             :           isolate_, v8_break_iterator_constructor, "supportedLocalesOf",
    2916         111 :           Builtins::kV8BreakIteratorSupportedLocalesOf, 1, false);
    2917             : 
    2918             :       Handle<JSObject> prototype(
    2919         333 :           JSObject::cast(v8_break_iterator_constructor->prototype()), isolate_);
    2920             : 
    2921         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2922             : 
    2923             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2924             :                             Builtins::kV8BreakIteratorPrototypeResolvedOptions,
    2925         111 :                             0, false);
    2926             : 
    2927             :       SimpleInstallGetter(isolate_, prototype, factory->adoptText_string(),
    2928         111 :                           Builtins::kV8BreakIteratorPrototypeAdoptText, false);
    2929             : 
    2930             :       SimpleInstallGetter(isolate_, prototype, factory->first_string(),
    2931         111 :                           Builtins::kV8BreakIteratorPrototypeFirst, false);
    2932             : 
    2933             :       SimpleInstallGetter(isolate_, prototype, factory->next_string(),
    2934         111 :                           Builtins::kV8BreakIteratorPrototypeNext, false);
    2935             : 
    2936             :       SimpleInstallGetter(isolate_, prototype, factory->current_string(),
    2937         111 :                           Builtins::kV8BreakIteratorPrototypeCurrent, false);
    2938             : 
    2939             :       SimpleInstallGetter(isolate_, prototype, factory->breakType_string(),
    2940         111 :                           Builtins::kV8BreakIteratorPrototypeBreakType, false);
    2941             :     }
    2942             : 
    2943             :     {  // -- P l u r a l R u l e s
    2944             :       Handle<JSFunction> plural_rules_constructor = InstallFunction(
    2945             :           isolate_, intl, "PluralRules", JS_INTL_PLURAL_RULES_TYPE,
    2946             :           JSPluralRules::kSize, 0, factory->the_hole_value(),
    2947         111 :           Builtins::kPluralRulesConstructor);
    2948             :       plural_rules_constructor->shared()->DontAdaptArguments();
    2949             : 
    2950             :       SimpleInstallFunction(isolate(), plural_rules_constructor,
    2951             :                             "supportedLocalesOf",
    2952         111 :                             Builtins::kPluralRulesSupportedLocalesOf, 1, false);
    2953             : 
    2954             :       Handle<JSObject> prototype(
    2955         333 :           JSObject::cast(plural_rules_constructor->prototype()), isolate_);
    2956             : 
    2957         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2958             : 
    2959             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2960             :                             Builtins::kPluralRulesPrototypeResolvedOptions, 0,
    2961         111 :                             false);
    2962             : 
    2963             :       SimpleInstallFunction(isolate_, prototype, "select",
    2964         111 :                             Builtins::kPluralRulesPrototypeSelect, 1, false);
    2965             :     }
    2966             : 
    2967             :     {  // -- R e l a t i v e T i m e F o r m a t e
    2968             :       Handle<JSFunction> relative_time_format_fun = InstallFunction(
    2969             :           isolate(), intl, "RelativeTimeFormat",
    2970             :           JS_INTL_RELATIVE_TIME_FORMAT_TYPE, JSRelativeTimeFormat::kSize, 0,
    2971         111 :           factory->the_hole_value(), Builtins::kRelativeTimeFormatConstructor);
    2972             :       relative_time_format_fun->shared()->set_length(0);
    2973             :       relative_time_format_fun->shared()->DontAdaptArguments();
    2974             : 
    2975             :       SimpleInstallFunction(
    2976             :           isolate(), relative_time_format_fun, "supportedLocalesOf",
    2977         111 :           Builtins::kRelativeTimeFormatSupportedLocalesOf, 1, false);
    2978             : 
    2979             :       // Setup %RelativeTimeFormatPrototype%.
    2980             :       Handle<JSObject> prototype(
    2981             :           JSObject::cast(relative_time_format_fun->instance_prototype()),
    2982         222 :           isolate());
    2983             : 
    2984             :       InstallToStringTag(isolate(), prototype, "Intl.RelativeTimeFormat");
    2985             : 
    2986             :       SimpleInstallFunction(
    2987             :           isolate(), prototype, "resolvedOptions",
    2988         111 :           Builtins::kRelativeTimeFormatPrototypeResolvedOptions, 0, false);
    2989             :       SimpleInstallFunction(isolate(), prototype, "format",
    2990             :                             Builtins::kRelativeTimeFormatPrototypeFormat, 2,
    2991         111 :                             false);
    2992             :       SimpleInstallFunction(isolate(), prototype, "formatToParts",
    2993             :                             Builtins::kRelativeTimeFormatPrototypeFormatToParts,
    2994         111 :                             2, false);
    2995             :     }
    2996             : 
    2997             :     {  // -- L i s t F o r m a t
    2998             :       Handle<JSFunction> list_format_fun = InstallFunction(
    2999             :           isolate(), intl, "ListFormat", JS_INTL_LIST_FORMAT_TYPE,
    3000             :           JSListFormat::kSize, 0, factory->the_hole_value(),
    3001         111 :           Builtins::kListFormatConstructor);
    3002             :       list_format_fun->shared()->set_length(0);
    3003             :       list_format_fun->shared()->DontAdaptArguments();
    3004             : 
    3005             :       SimpleInstallFunction(isolate(), list_format_fun, "supportedLocalesOf",
    3006         111 :                             Builtins::kListFormatSupportedLocalesOf, 1, false);
    3007             : 
    3008             :       // Setup %ListFormatPrototype%.
    3009             :       Handle<JSObject> prototype(
    3010         222 :           JSObject::cast(list_format_fun->instance_prototype()), isolate());
    3011             : 
    3012             :       InstallToStringTag(isolate(), prototype, "Intl.ListFormat");
    3013             : 
    3014             :       SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    3015             :                             Builtins::kListFormatPrototypeResolvedOptions, 0,
    3016         111 :                             false);
    3017             :       SimpleInstallFunction(isolate(), prototype, "format",
    3018         111 :                             Builtins::kListFormatPrototypeFormat, 1, false);
    3019             :       SimpleInstallFunction(isolate(), prototype, "formatToParts",
    3020             :                             Builtins::kListFormatPrototypeFormatToParts, 1,
    3021         111 :                             false);
    3022             :     }
    3023             :   }
    3024             : #endif  // V8_INTL_SUPPORT
    3025             : 
    3026             :   {  // -- A r r a y B u f f e r
    3027             :     Handle<String> name = factory->ArrayBuffer_string();
    3028         111 :     Handle<JSFunction> array_buffer_fun = CreateArrayBuffer(name, ARRAY_BUFFER);
    3029         111 :     JSObject::AddProperty(isolate_, global, name, array_buffer_fun, DONT_ENUM);
    3030         111 :     InstallWithIntrinsicDefaultProto(isolate_, array_buffer_fun,
    3031         111 :                                      Context::ARRAY_BUFFER_FUN_INDEX);
    3032         111 :     InstallSpeciesGetter(isolate_, array_buffer_fun);
    3033             : 
    3034             :     Handle<JSFunction> array_buffer_noinit_fun = SimpleCreateFunction(
    3035             :         isolate_,
    3036             :         factory->InternalizeUtf8String(
    3037             :             "arrayBufferConstructor_DoNotInitialize"),
    3038         111 :         Builtins::kArrayBufferConstructor_DoNotInitialize, 1, false);
    3039         111 :     native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun);
    3040             :   }
    3041             : 
    3042             :   {  // -- S h a r e d A r r a y B u f f e r
    3043         111 :     Handle<String> name = factory->SharedArrayBuffer_string();
    3044             :     Handle<JSFunction> shared_array_buffer_fun =
    3045         111 :         CreateArrayBuffer(name, SHARED_ARRAY_BUFFER);
    3046         111 :     InstallWithIntrinsicDefaultProto(isolate_, shared_array_buffer_fun,
    3047         111 :                                      Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
    3048         111 :     InstallSpeciesGetter(isolate_, shared_array_buffer_fun);
    3049             :   }
    3050             : 
    3051             :   {  // -- A t o m i c s
    3052             :     Handle<JSObject> atomics_object =
    3053         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    3054         111 :     native_context()->set_atomics_object(*atomics_object);
    3055             : 
    3056             :     SimpleInstallFunction(isolate_, atomics_object, "load",
    3057         111 :                           Builtins::kAtomicsLoad, 2, true);
    3058             :     SimpleInstallFunction(isolate_, atomics_object, "store",
    3059         111 :                           Builtins::kAtomicsStore, 3, true);
    3060             :     SimpleInstallFunction(isolate_, atomics_object, "add",
    3061         111 :                           Builtins::kAtomicsAdd, 3, true);
    3062             :     SimpleInstallFunction(isolate_, atomics_object, "sub",
    3063         111 :                           Builtins::kAtomicsSub, 3, true);
    3064             :     SimpleInstallFunction(isolate_, atomics_object, "and",
    3065         111 :                           Builtins::kAtomicsAnd, 3, true);
    3066             :     SimpleInstallFunction(isolate_, atomics_object, "or", Builtins::kAtomicsOr,
    3067         111 :                           3, true);
    3068             :     SimpleInstallFunction(isolate_, atomics_object, "xor",
    3069         111 :                           Builtins::kAtomicsXor, 3, true);
    3070             :     SimpleInstallFunction(isolate_, atomics_object, "exchange",
    3071         111 :                           Builtins::kAtomicsExchange, 3, true);
    3072             :     SimpleInstallFunction(isolate_, atomics_object, "compareExchange",
    3073         111 :                           Builtins::kAtomicsCompareExchange, 4, true);
    3074             :     SimpleInstallFunction(isolate_, atomics_object, "isLockFree",
    3075         111 :                           Builtins::kAtomicsIsLockFree, 1, true);
    3076             :     SimpleInstallFunction(isolate_, atomics_object, "wait",
    3077         111 :                           Builtins::kAtomicsWait, 4, true);
    3078             :     SimpleInstallFunction(isolate_, atomics_object, "wake",
    3079         111 :                           Builtins::kAtomicsWake, 3, true);
    3080             :     SimpleInstallFunction(isolate_, atomics_object, "notify",
    3081         111 :                           Builtins::kAtomicsNotify, 3, true);
    3082             :   }
    3083             : 
    3084             :   {  // -- T y p e d A r r a y
    3085             :     Handle<JSFunction> typed_array_fun = CreateFunction(
    3086             :         isolate_, factory->InternalizeUtf8String("TypedArray"),
    3087             :         JS_TYPED_ARRAY_TYPE, JSTypedArray::kHeaderSize, 0,
    3088         111 :         factory->the_hole_value(), Builtins::kTypedArrayBaseConstructor);
    3089         111 :     typed_array_fun->shared()->set_native(false);
    3090             :     typed_array_fun->shared()->set_length(0);
    3091         111 :     InstallSpeciesGetter(isolate_, typed_array_fun);
    3092         111 :     native_context()->set_typed_array_function(*typed_array_fun);
    3093             : 
    3094             :     SimpleInstallFunction(isolate_, typed_array_fun, "of",
    3095         111 :                           Builtins::kTypedArrayOf, 0, false);
    3096             :     SimpleInstallFunction(isolate_, typed_array_fun, "from",
    3097         111 :                           Builtins::kTypedArrayFrom, 1, false);
    3098             : 
    3099             :     // Setup %TypedArrayPrototype%.
    3100             :     Handle<JSObject> prototype(
    3101         222 :         JSObject::cast(typed_array_fun->instance_prototype()), isolate());
    3102         111 :     native_context()->set_typed_array_prototype(*prototype);
    3103             : 
    3104             :     // Install the "buffer", "byteOffset", "byteLength", "length"
    3105             :     // and @@toStringTag getters on the {prototype}.
    3106             :     SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
    3107         111 :                         Builtins::kTypedArrayPrototypeBuffer, false);
    3108             :     SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
    3109         111 :                         Builtins::kTypedArrayPrototypeByteLength, true);
    3110             :     SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
    3111         111 :                         Builtins::kTypedArrayPrototypeByteOffset, true);
    3112             :     SimpleInstallGetter(isolate_, prototype, factory->length_string(),
    3113         111 :                         Builtins::kTypedArrayPrototypeLength, true);
    3114             :     SimpleInstallGetter(isolate_, prototype, factory->to_string_tag_symbol(),
    3115         111 :                         Builtins::kTypedArrayPrototypeToStringTag, true);
    3116             : 
    3117             :     // Install "keys", "values" and "entries" methods on the {prototype}.
    3118             :     InstallFunctionWithBuiltinId(isolate_, prototype, "entries",
    3119             :                                  Builtins::kTypedArrayPrototypeEntries, 0,
    3120         111 :                                  true);
    3121             : 
    3122             :     InstallFunctionWithBuiltinId(isolate_, prototype, "keys",
    3123         111 :                                  Builtins::kTypedArrayPrototypeKeys, 0, true);
    3124             : 
    3125             :     Handle<JSFunction> values = InstallFunctionWithBuiltinId(
    3126             :         isolate_, prototype, "values", Builtins::kTypedArrayPrototypeValues, 0,
    3127         111 :         true);
    3128         222 :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3129         111 :                           values, DONT_ENUM);
    3130             : 
    3131             :     // TODO(caitp): alphasort accessors/methods
    3132             :     SimpleInstallFunction(isolate_, prototype, "copyWithin",
    3133         111 :                           Builtins::kTypedArrayPrototypeCopyWithin, 2, false);
    3134             :     SimpleInstallFunction(isolate_, prototype, "every",
    3135         111 :                           Builtins::kTypedArrayPrototypeEvery, 1, false);
    3136             :     SimpleInstallFunction(isolate_, prototype, "fill",
    3137         111 :                           Builtins::kTypedArrayPrototypeFill, 1, false);
    3138             :     SimpleInstallFunction(isolate_, prototype, "filter",
    3139         111 :                           Builtins::kTypedArrayPrototypeFilter, 1, false);
    3140             :     SimpleInstallFunction(isolate_, prototype, "find",
    3141         111 :                           Builtins::kTypedArrayPrototypeFind, 1, false);
    3142             :     SimpleInstallFunction(isolate_, prototype, "findIndex",
    3143         111 :                           Builtins::kTypedArrayPrototypeFindIndex, 1, false);
    3144             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3145         111 :                           Builtins::kTypedArrayPrototypeForEach, 1, false);
    3146             :     SimpleInstallFunction(isolate_, prototype, "includes",
    3147         111 :                           Builtins::kTypedArrayPrototypeIncludes, 1, false);
    3148             :     SimpleInstallFunction(isolate_, prototype, "indexOf",
    3149         111 :                           Builtins::kTypedArrayPrototypeIndexOf, 1, false);
    3150             :     SimpleInstallFunction(isolate_, prototype, "join",
    3151         111 :                           Builtins::kTypedArrayPrototypeJoin, 1, false);
    3152             :     SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
    3153         111 :                           Builtins::kTypedArrayPrototypeLastIndexOf, 1, false);
    3154             :     SimpleInstallFunction(isolate_, prototype, "map",
    3155         111 :                           Builtins::kTypedArrayPrototypeMap, 1, false);
    3156             :     SimpleInstallFunction(isolate_, prototype, "reverse",
    3157         111 :                           Builtins::kTypedArrayPrototypeReverse, 0, false);
    3158             :     SimpleInstallFunction(isolate_, prototype, "reduce",
    3159         111 :                           Builtins::kTypedArrayPrototypeReduce, 1, false);
    3160             :     SimpleInstallFunction(isolate_, prototype, "reduceRight",
    3161         111 :                           Builtins::kTypedArrayPrototypeReduceRight, 1, false);
    3162             :     SimpleInstallFunction(isolate_, prototype, "set",
    3163         111 :                           Builtins::kTypedArrayPrototypeSet, 1, false);
    3164             :     SimpleInstallFunction(isolate_, prototype, "slice",
    3165         111 :                           Builtins::kTypedArrayPrototypeSlice, 2, false);
    3166             :     SimpleInstallFunction(isolate_, prototype, "some",
    3167         111 :                           Builtins::kTypedArrayPrototypeSome, 1, false);
    3168             :     SimpleInstallFunction(isolate_, prototype, "sort",
    3169         111 :                           Builtins::kTypedArrayPrototypeSort, 1, false);
    3170             :     SimpleInstallFunction(isolate_, prototype, "subarray",
    3171         111 :                           Builtins::kTypedArrayPrototypeSubArray, 2, false);
    3172             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    3173             :                           Builtins::kTypedArrayPrototypeToLocaleString, 0,
    3174         111 :                           false);
    3175         222 :     JSObject::AddProperty(isolate_, prototype, factory->toString_string(),
    3176         111 :                           array_prototype_to_string_fun, DONT_ENUM);
    3177             :   }
    3178             : 
    3179             :   {  // -- T y p e d A r r a y s
    3180             : #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype)                   \
    3181             :   {                                                                    \
    3182             :     Handle<JSFunction> fun =                                           \
    3183             :         InstallTypedArray(#Type "Array", TYPE##_ELEMENTS);             \
    3184             :     InstallWithIntrinsicDefaultProto(isolate_, fun,                    \
    3185             :                                      Context::TYPE##_ARRAY_FUN_INDEX); \
    3186             :   }
    3187         111 :     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
    3188             : #undef INSTALL_TYPED_ARRAY
    3189             :   }
    3190             : 
    3191             :   {  // -- D a t a V i e w
    3192             :     Handle<JSFunction> data_view_fun = InstallFunction(
    3193             :         isolate_, global, "DataView", JS_DATA_VIEW_TYPE,
    3194             :         JSDataView::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    3195         111 :         Builtins::kDataViewConstructor);
    3196         111 :     InstallWithIntrinsicDefaultProto(isolate_, data_view_fun,
    3197         111 :                                      Context::DATA_VIEW_FUN_INDEX);
    3198             :     data_view_fun->shared()->set_length(1);
    3199             :     data_view_fun->shared()->DontAdaptArguments();
    3200             : 
    3201             :     // Setup %DataViewPrototype%.
    3202             :     Handle<JSObject> prototype(
    3203         222 :         JSObject::cast(data_view_fun->instance_prototype()), isolate());
    3204             : 
    3205         111 :     InstallToStringTag(isolate_, prototype, "DataView");
    3206             : 
    3207             :     // Install the "buffer", "byteOffset" and "byteLength" getters
    3208             :     // on the {prototype}.
    3209             :     SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
    3210         111 :                         Builtins::kDataViewPrototypeGetBuffer, false);
    3211             :     SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
    3212         111 :                         Builtins::kDataViewPrototypeGetByteLength, false);
    3213             :     SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
    3214         111 :                         Builtins::kDataViewPrototypeGetByteOffset, false);
    3215             : 
    3216             :     SimpleInstallFunction(isolate_, prototype, "getInt8",
    3217         111 :                           Builtins::kDataViewPrototypeGetInt8, 1, false);
    3218             :     SimpleInstallFunction(isolate_, prototype, "setInt8",
    3219         111 :                           Builtins::kDataViewPrototypeSetInt8, 2, false);
    3220             :     SimpleInstallFunction(isolate_, prototype, "getUint8",
    3221         111 :                           Builtins::kDataViewPrototypeGetUint8, 1, false);
    3222             :     SimpleInstallFunction(isolate_, prototype, "setUint8",
    3223         111 :                           Builtins::kDataViewPrototypeSetUint8, 2, false);
    3224             :     SimpleInstallFunction(isolate_, prototype, "getInt16",
    3225         111 :                           Builtins::kDataViewPrototypeGetInt16, 1, false);
    3226             :     SimpleInstallFunction(isolate_, prototype, "setInt16",
    3227         111 :                           Builtins::kDataViewPrototypeSetInt16, 2, false);
    3228             :     SimpleInstallFunction(isolate_, prototype, "getUint16",
    3229         111 :                           Builtins::kDataViewPrototypeGetUint16, 1, false);
    3230             :     SimpleInstallFunction(isolate_, prototype, "setUint16",
    3231         111 :                           Builtins::kDataViewPrototypeSetUint16, 2, false);
    3232             :     SimpleInstallFunction(isolate_, prototype, "getInt32",
    3233         111 :                           Builtins::kDataViewPrototypeGetInt32, 1, false);
    3234             :     SimpleInstallFunction(isolate_, prototype, "setInt32",
    3235         111 :                           Builtins::kDataViewPrototypeSetInt32, 2, false);
    3236             :     SimpleInstallFunction(isolate_, prototype, "getUint32",
    3237         111 :                           Builtins::kDataViewPrototypeGetUint32, 1, false);
    3238             :     SimpleInstallFunction(isolate_, prototype, "setUint32",
    3239         111 :                           Builtins::kDataViewPrototypeSetUint32, 2, false);
    3240             :     SimpleInstallFunction(isolate_, prototype, "getFloat32",
    3241         111 :                           Builtins::kDataViewPrototypeGetFloat32, 1, false);
    3242             :     SimpleInstallFunction(isolate_, prototype, "setFloat32",
    3243         111 :                           Builtins::kDataViewPrototypeSetFloat32, 2, false);
    3244             :     SimpleInstallFunction(isolate_, prototype, "getFloat64",
    3245         111 :                           Builtins::kDataViewPrototypeGetFloat64, 1, false);
    3246             :     SimpleInstallFunction(isolate_, prototype, "setFloat64",
    3247         111 :                           Builtins::kDataViewPrototypeSetFloat64, 2, false);
    3248             :     SimpleInstallFunction(isolate_, prototype, "getBigInt64",
    3249         111 :                           Builtins::kDataViewPrototypeGetBigInt64, 1, false);
    3250             :     SimpleInstallFunction(isolate_, prototype, "setBigInt64",
    3251         111 :                           Builtins::kDataViewPrototypeSetBigInt64, 2, false);
    3252             :     SimpleInstallFunction(isolate_, prototype, "getBigUint64",
    3253         111 :                           Builtins::kDataViewPrototypeGetBigUint64, 1, false);
    3254             :     SimpleInstallFunction(isolate_, prototype, "setBigUint64",
    3255         111 :                           Builtins::kDataViewPrototypeSetBigUint64, 2, false);
    3256             :   }
    3257             : 
    3258             :   {  // -- M a p
    3259             :     Handle<JSFunction> js_map_fun =
    3260             :         InstallFunction(isolate_, global, "Map", JS_MAP_TYPE, JSMap::kSize, 0,
    3261         111 :                         factory->the_hole_value(), Builtins::kMapConstructor);
    3262         111 :     InstallWithIntrinsicDefaultProto(isolate_, js_map_fun,
    3263         111 :                                      Context::JS_MAP_FUN_INDEX);
    3264             : 
    3265         111 :     Handle<SharedFunctionInfo> shared(js_map_fun->shared(), isolate_);
    3266             :     shared->DontAdaptArguments();
    3267             :     shared->set_length(0);
    3268             : 
    3269             :     // Setup %MapPrototype%.
    3270             :     Handle<JSObject> prototype(JSObject::cast(js_map_fun->instance_prototype()),
    3271         222 :                                isolate());
    3272             : 
    3273         111 :     InstallToStringTag(isolate_, prototype, factory->Map_string());
    3274             : 
    3275             :     Handle<JSFunction> map_get = SimpleInstallFunction(
    3276         111 :         isolate_, prototype, "get", Builtins::kMapPrototypeGet, 1, true);
    3277         111 :     native_context()->set_map_get(*map_get);
    3278             : 
    3279             :     Handle<JSFunction> map_set = SimpleInstallFunction(
    3280         111 :         isolate_, prototype, "set", Builtins::kMapPrototypeSet, 2, true);
    3281             :     // Check that index of "set" function in JSCollection is correct.
    3282             :     DCHECK_EQ(JSCollection::kAddFunctionDescriptorIndex,
    3283             :               prototype->map()->LastAdded());
    3284         111 :     native_context()->set_map_set(*map_set);
    3285             : 
    3286             :     Handle<JSFunction> map_has = SimpleInstallFunction(
    3287         111 :         isolate_, prototype, "has", Builtins::kMapPrototypeHas, 1, true);
    3288         111 :     native_context()->set_map_has(*map_has);
    3289             : 
    3290             :     Handle<JSFunction> map_delete = SimpleInstallFunction(
    3291         111 :         isolate_, prototype, "delete", Builtins::kMapPrototypeDelete, 1, true);
    3292         111 :     native_context()->set_map_delete(*map_delete);
    3293             : 
    3294             :     SimpleInstallFunction(isolate_, prototype, "clear",
    3295         111 :                           Builtins::kMapPrototypeClear, 0, true);
    3296             :     Handle<JSFunction> entries =
    3297             :         SimpleInstallFunction(isolate_, prototype, "entries",
    3298         111 :                               Builtins::kMapPrototypeEntries, 0, true);
    3299         222 :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3300         111 :                           entries, DONT_ENUM);
    3301             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3302         111 :                           Builtins::kMapPrototypeForEach, 1, false);
    3303             :     SimpleInstallFunction(isolate_, prototype, "keys",
    3304         111 :                           Builtins::kMapPrototypeKeys, 0, true);
    3305             :     SimpleInstallGetter(isolate_, prototype,
    3306             :                         factory->InternalizeUtf8String("size"),
    3307         222 :                         Builtins::kMapPrototypeGetSize, true);
    3308             :     SimpleInstallFunction(isolate_, prototype, "values",
    3309         111 :                           Builtins::kMapPrototypeValues, 0, true);
    3310             : 
    3311         111 :     native_context()->set_initial_map_prototype_map(prototype->map());
    3312             : 
    3313         111 :     InstallSpeciesGetter(isolate_, js_map_fun);
    3314             :   }
    3315             : 
    3316             :   {  // -- B i g I n t
    3317             :     Handle<JSFunction> bigint_fun = InstallFunction(
    3318             :         isolate_, global, "BigInt", JS_VALUE_TYPE, JSValue::kSize, 0,
    3319         111 :         factory->the_hole_value(), Builtins::kBigIntConstructor);
    3320             :     bigint_fun->shared()->DontAdaptArguments();
    3321             :     bigint_fun->shared()->set_length(1);
    3322         111 :     InstallWithIntrinsicDefaultProto(isolate_, bigint_fun,
    3323         111 :                                      Context::BIGINT_FUNCTION_INDEX);
    3324             : 
    3325             :     // Install the properties of the BigInt constructor.
    3326             :     // asUintN(bits, bigint)
    3327             :     SimpleInstallFunction(isolate_, bigint_fun, "asUintN",
    3328         111 :                           Builtins::kBigIntAsUintN, 2, false);
    3329             :     // asIntN(bits, bigint)
    3330             :     SimpleInstallFunction(isolate_, bigint_fun, "asIntN",
    3331         111 :                           Builtins::kBigIntAsIntN, 2, false);
    3332             : 
    3333             :     // Set up the %BigIntPrototype%.
    3334             :     Handle<JSObject> prototype(JSObject::cast(bigint_fun->instance_prototype()),
    3335         333 :                                isolate_);
    3336         111 :     JSFunction::SetPrototype(bigint_fun, prototype);
    3337             : 
    3338             :     // Install the properties of the BigInt.prototype.
    3339             :     // "constructor" is created implicitly by InstallFunction() above.
    3340             :     // toLocaleString([reserved1 [, reserved2]])
    3341             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    3342         111 :                           Builtins::kBigIntPrototypeToLocaleString, 0, false);
    3343             :     // toString([radix])
    3344             :     SimpleInstallFunction(isolate_, prototype, "toString",
    3345         111 :                           Builtins::kBigIntPrototypeToString, 0, false);
    3346             :     // valueOf()
    3347             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    3348         111 :                           Builtins::kBigIntPrototypeValueOf, 0, false);
    3349             :     // @@toStringTag
    3350         111 :     InstallToStringTag(isolate_, prototype, factory->BigInt_string());
    3351             :   }
    3352             : 
    3353             :   {  // -- S e t
    3354             :     Handle<JSFunction> js_set_fun =
    3355             :         InstallFunction(isolate_, global, "Set", JS_SET_TYPE, JSSet::kSize, 0,
    3356         111 :                         factory->the_hole_value(), Builtins::kSetConstructor);
    3357         111 :     InstallWithIntrinsicDefaultProto(isolate_, js_set_fun,
    3358         111 :                                      Context::JS_SET_FUN_INDEX);
    3359             : 
    3360         111 :     Handle<SharedFunctionInfo> shared(js_set_fun->shared(), isolate_);
    3361             :     shared->DontAdaptArguments();
    3362             :     shared->set_length(0);
    3363             : 
    3364             :     // Setup %SetPrototype%.
    3365             :     Handle<JSObject> prototype(JSObject::cast(js_set_fun->instance_prototype()),
    3366         222 :                                isolate());
    3367             : 
    3368         111 :     InstallToStringTag(isolate_, prototype, factory->Set_string());
    3369             : 
    3370             :     Handle<JSFunction> set_has = SimpleInstallFunction(
    3371         111 :         isolate_, prototype, "has", Builtins::kSetPrototypeHas, 1, true);
    3372         111 :     native_context()->set_set_has(*set_has);
    3373             : 
    3374             :     Handle<JSFunction> set_add = SimpleInstallFunction(
    3375         111 :         isolate_, prototype, "add", Builtins::kSetPrototypeAdd, 1, true);
    3376             :     // Check that index of "add" function in JSCollection is correct.
    3377             :     DCHECK_EQ(JSCollection::kAddFunctionDescriptorIndex,
    3378             :               prototype->map()->LastAdded());
    3379         111 :     native_context()->set_set_add(*set_add);
    3380             : 
    3381             :     Handle<JSFunction> set_delete = SimpleInstallFunction(
    3382         111 :         isolate_, prototype, "delete", Builtins::kSetPrototypeDelete, 1, true);
    3383         111 :     native_context()->set_set_delete(*set_delete);
    3384             : 
    3385             :     SimpleInstallFunction(isolate_, prototype, "clear",
    3386         111 :                           Builtins::kSetPrototypeClear, 0, true);
    3387             :     SimpleInstallFunction(isolate_, prototype, "entries",
    3388         111 :                           Builtins::kSetPrototypeEntries, 0, true);
    3389             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3390         111 :                           Builtins::kSetPrototypeForEach, 1, false);
    3391             :     SimpleInstallGetter(isolate_, prototype,
    3392             :                         factory->InternalizeUtf8String("size"),
    3393         222 :                         Builtins::kSetPrototypeGetSize, true);
    3394             :     Handle<JSFunction> values = SimpleInstallFunction(
    3395         111 :         isolate_, prototype, "values", Builtins::kSetPrototypeValues, 0, true);
    3396         222 :     JSObject::AddProperty(isolate_, prototype, factory->keys_string(), values,
    3397         111 :                           DONT_ENUM);
    3398         222 :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3399         111 :                           values, DONT_ENUM);
    3400             : 
    3401         111 :     native_context()->set_initial_set_prototype_map(prototype->map());
    3402         111 :     native_context()->set_initial_set_prototype(*prototype);
    3403             : 
    3404         111 :     InstallSpeciesGetter(isolate_, js_set_fun);
    3405             :   }
    3406             : 
    3407             :   {  // -- J S M o d u l e N a m e s p a c e
    3408             :     Handle<Map> map = factory->NewMap(
    3409             :         JS_MODULE_NAMESPACE_TYPE, JSModuleNamespace::kSize,
    3410         111 :         TERMINAL_FAST_ELEMENTS_KIND, JSModuleNamespace::kInObjectFieldCount);
    3411         222 :     Map::SetPrototype(isolate(), map, isolate_->factory()->null_value());
    3412         111 :     Map::EnsureDescriptorSlack(isolate_, map, 1);
    3413         111 :     native_context()->set_js_module_namespace_map(*map);
    3414             : 
    3415             :     {  // Install @@toStringTag.
    3416             :       PropertyAttributes attribs =
    3417             :           static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY);
    3418             :       Descriptor d =
    3419             :           Descriptor::DataField(isolate(), factory->to_string_tag_symbol(),
    3420             :                                 JSModuleNamespace::kToStringTagFieldIndex,
    3421         111 :                                 attribs, Representation::Tagged());
    3422         111 :       map->AppendDescriptor(isolate(), &d);
    3423             :     }
    3424             :   }
    3425             : 
    3426             :   {  // -- I t e r a t o r R e s u l t
    3427             :     Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSIteratorResult::kSize,
    3428         111 :                                       TERMINAL_FAST_ELEMENTS_KIND, 2);
    3429         222 :     Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
    3430         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3431             : 
    3432             :     {  // value
    3433             :       Descriptor d = Descriptor::DataField(isolate(), factory->value_string(),
    3434             :                                            JSIteratorResult::kValueIndex, NONE,
    3435         111 :                                            Representation::Tagged());
    3436         111 :       map->AppendDescriptor(isolate(), &d);
    3437             :     }
    3438             : 
    3439             :     {  // done
    3440             :       Descriptor d = Descriptor::DataField(isolate(), factory->done_string(),
    3441             :                                            JSIteratorResult::kDoneIndex, NONE,
    3442         111 :                                            Representation::Tagged());
    3443         111 :       map->AppendDescriptor(isolate(), &d);
    3444             :     }
    3445             : 
    3446         222 :     map->SetConstructor(native_context()->object_function());
    3447         111 :     native_context()->set_iterator_result_map(*map);
    3448             :   }
    3449             : 
    3450             :   {  // -- W e a k M a p
    3451             :     Handle<JSFunction> cons = InstallFunction(
    3452             :         isolate_, global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize, 0,
    3453         111 :         factory->the_hole_value(), Builtins::kWeakMapConstructor);
    3454         111 :     InstallWithIntrinsicDefaultProto(isolate_, cons,
    3455         111 :                                      Context::JS_WEAK_MAP_FUN_INDEX);
    3456             : 
    3457         111 :     Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
    3458             :     shared->DontAdaptArguments();
    3459             :     shared->set_length(0);
    3460             : 
    3461             :     // Setup %WeakMapPrototype%.
    3462             :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
    3463         222 :                                isolate());
    3464             : 
    3465             :     SimpleInstallFunction(isolate_, prototype, "delete",
    3466         111 :                           Builtins::kWeakMapPrototypeDelete, 1, true);
    3467             :     Handle<JSFunction> weakmap_get = SimpleInstallFunction(
    3468         111 :         isolate_, prototype, "get", Builtins::kWeakMapGet, 1, true);
    3469         111 :     native_context()->set_weakmap_get(*weakmap_get);
    3470             : 
    3471             :     Handle<JSFunction> weakmap_set = SimpleInstallFunction(
    3472         111 :         isolate_, prototype, "set", Builtins::kWeakMapPrototypeSet, 2, true);
    3473             :     // Check that index of "set" function in JSWeakCollection is correct.
    3474             :     DCHECK_EQ(JSWeakCollection::kAddFunctionDescriptorIndex,
    3475             :               prototype->map()->LastAdded());
    3476             : 
    3477         111 :     native_context()->set_weakmap_set(*weakmap_set);
    3478             :     SimpleInstallFunction(isolate_, prototype, "has",
    3479         111 :                           Builtins::kWeakMapPrototypeHas, 1, true);
    3480             : 
    3481         111 :     InstallToStringTag(isolate_, prototype, "WeakMap");
    3482             : 
    3483         111 :     native_context()->set_initial_weakmap_prototype_map(prototype->map());
    3484             :   }
    3485             : 
    3486             :   {  // -- W e a k S e t
    3487             :     Handle<JSFunction> cons = InstallFunction(
    3488             :         isolate_, global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize, 0,
    3489         111 :         factory->the_hole_value(), Builtins::kWeakSetConstructor);
    3490         111 :     InstallWithIntrinsicDefaultProto(isolate_, cons,
    3491         111 :                                      Context::JS_WEAK_SET_FUN_INDEX);
    3492             : 
    3493         111 :     Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
    3494             :     shared->DontAdaptArguments();
    3495             :     shared->set_length(0);
    3496             : 
    3497             :     // Setup %WeakSetPrototype%.
    3498             :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
    3499         222 :                                isolate());
    3500             : 
    3501             :     SimpleInstallFunction(isolate_, prototype, "delete",
    3502         111 :                           Builtins::kWeakSetPrototypeDelete, 1, true);
    3503             :     SimpleInstallFunction(isolate_, prototype, "has",
    3504         111 :                           Builtins::kWeakSetPrototypeHas, 1, true);
    3505             : 
    3506             :     Handle<JSFunction> weakset_add = SimpleInstallFunction(
    3507         111 :         isolate_, prototype, "add", Builtins::kWeakSetPrototypeAdd, 1, true);
    3508             :     // Check that index of "add" function in JSWeakCollection is correct.
    3509             :     DCHECK_EQ(JSWeakCollection::kAddFunctionDescriptorIndex,
    3510             :               prototype->map()->LastAdded());
    3511             : 
    3512         111 :     native_context()->set_weakset_add(*weakset_add);
    3513             : 
    3514         111 :     InstallToStringTag(isolate_, prototype,
    3515         111 :                        factory->InternalizeUtf8String("WeakSet"));
    3516             : 
    3517         111 :     native_context()->set_initial_weakset_prototype_map(prototype->map());
    3518             :   }
    3519             : 
    3520             :   {  // -- P r o x y
    3521         111 :     CreateJSProxyMaps();
    3522             :     // Proxy function map has prototype slot for storing initial map but does
    3523             :     // not have a prototype property.
    3524             :     Handle<Map> proxy_function_map = Map::Copy(
    3525         111 :         isolate_, isolate_->strict_function_without_prototype_map(), "Proxy");
    3526             :     proxy_function_map->set_is_constructor(true);
    3527             : 
    3528             :     Handle<String> name = factory->Proxy_string();
    3529             : 
    3530             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
    3531         111 :         name, proxy_function_map, Builtins::kProxyConstructor);
    3532         111 :     Handle<JSFunction> proxy_function = factory->NewFunction(args);
    3533             : 
    3534         222 :     isolate_->proxy_map()->SetConstructor(*proxy_function);
    3535             : 
    3536             :     proxy_function->shared()->set_internal_formal_parameter_count(2);
    3537             :     proxy_function->shared()->set_length(2);
    3538             : 
    3539         111 :     native_context()->set_proxy_function(*proxy_function);
    3540         111 :     JSObject::AddProperty(isolate_, global, name, proxy_function, DONT_ENUM);
    3541             : 
    3542             :     DCHECK(!proxy_function->has_prototype_property());
    3543             : 
    3544             :     SimpleInstallFunction(isolate_, proxy_function, "revocable",
    3545         111 :                           Builtins::kProxyRevocable, 2, true);
    3546             : 
    3547             :     {  // Internal: ProxyRevoke
    3548             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    3549         111 :           isolate_, Builtins::kProxyRevoke, factory->empty_string(), 0);
    3550         111 :       native_context()->set_proxy_revoke_shared_fun(*info);
    3551             :     }
    3552             :   }
    3553             : 
    3554             :   {  // -- R e f l e c t
    3555         111 :     Handle<String> reflect_string = factory->InternalizeUtf8String("Reflect");
    3556             :     Handle<JSObject> reflect =
    3557         111 :         factory->NewJSObject(isolate_->object_function(), AllocationType::kOld);
    3558         111 :     JSObject::AddProperty(isolate_, global, reflect_string, reflect, DONT_ENUM);
    3559             : 
    3560             :     Handle<JSFunction> define_property =
    3561             :         SimpleInstallFunction(isolate_, reflect, "defineProperty",
    3562         111 :                               Builtins::kReflectDefineProperty, 3, true);
    3563         111 :     native_context()->set_reflect_define_property(*define_property);
    3564             : 
    3565             :     Handle<JSFunction> delete_property =
    3566             :         SimpleInstallFunction(isolate_, reflect, "deleteProperty",
    3567         111 :                               Builtins::kReflectDeleteProperty, 2, true);
    3568         111 :     native_context()->set_reflect_delete_property(*delete_property);
    3569             : 
    3570             :     Handle<JSFunction> apply = SimpleInstallFunction(
    3571         111 :         isolate_, reflect, "apply", Builtins::kReflectApply, 3, false);
    3572         111 :     native_context()->set_reflect_apply(*apply);
    3573             : 
    3574             :     Handle<JSFunction> construct = SimpleInstallFunction(
    3575         111 :         isolate_, reflect, "construct", Builtins::kReflectConstruct, 2, false);
    3576         111 :     native_context()->set_reflect_construct(*construct);
    3577             : 
    3578             :     SimpleInstallFunction(isolate_, reflect, "get", Builtins::kReflectGet, 2,
    3579         111 :                           false);
    3580             :     SimpleInstallFunction(isolate_, reflect, "getOwnPropertyDescriptor",
    3581         111 :                           Builtins::kReflectGetOwnPropertyDescriptor, 2, true);
    3582             :     SimpleInstallFunction(isolate_, reflect, "getPrototypeOf",
    3583         111 :                           Builtins::kReflectGetPrototypeOf, 1, true);
    3584             :     SimpleInstallFunction(isolate_, reflect, "has", Builtins::kReflectHas, 2,
    3585         111 :                           true);
    3586             :     SimpleInstallFunction(isolate_, reflect, "isExtensible",
    3587         111 :                           Builtins::kReflectIsExtensible, 1, true);
    3588             :     SimpleInstallFunction(isolate_, reflect, "ownKeys",
    3589         111 :                           Builtins::kReflectOwnKeys, 1, true);
    3590             :     SimpleInstallFunction(isolate_, reflect, "preventExtensions",
    3591         111 :                           Builtins::kReflectPreventExtensions, 1, true);
    3592             :     SimpleInstallFunction(isolate_, reflect, "set", Builtins::kReflectSet, 3,
    3593         111 :                           false);
    3594             :     SimpleInstallFunction(isolate_, reflect, "setPrototypeOf",
    3595         111 :                           Builtins::kReflectSetPrototypeOf, 2, true);
    3596             :   }
    3597             : 
    3598             :   {  // --- B o u n d F u n c t i o n
    3599             :     Handle<Map> map =
    3600             :         factory->NewMap(JS_BOUND_FUNCTION_TYPE, JSBoundFunction::kSize,
    3601         111 :                         TERMINAL_FAST_ELEMENTS_KIND, 0);
    3602         222 :     map->SetConstructor(native_context()->object_function());
    3603             :     map->set_is_callable(true);
    3604         111 :     Map::SetPrototype(isolate(), map, empty_function);
    3605             : 
    3606             :     PropertyAttributes roc_attribs =
    3607             :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
    3608         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3609             : 
    3610             :     {  // length
    3611             :       Descriptor d = Descriptor::AccessorConstant(
    3612             :           factory->length_string(), factory->bound_function_length_accessor(),
    3613         111 :           roc_attribs);
    3614         111 :       map->AppendDescriptor(isolate(), &d);
    3615             :     }
    3616             : 
    3617             :     {  // name
    3618             :       Descriptor d = Descriptor::AccessorConstant(
    3619             :           factory->name_string(), factory->bound_function_name_accessor(),
    3620         111 :           roc_attribs);
    3621         111 :       map->AppendDescriptor(isolate(), &d);
    3622             :     }
    3623         111 :     native_context()->set_bound_function_without_constructor_map(*map);
    3624             : 
    3625         111 :     map = Map::Copy(isolate_, map, "IsConstructor");
    3626             :     map->set_is_constructor(true);
    3627         111 :     native_context()->set_bound_function_with_constructor_map(*map);
    3628             :   }
    3629             : 
    3630             :   {  // --- sloppy arguments map
    3631         111 :     Handle<String> arguments_string = factory->Arguments_string();
    3632             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    3633         111 :         arguments_string, isolate_->initial_object_prototype(),
    3634             :         JS_ARGUMENTS_TYPE, JSSloppyArgumentsObject::kSize, 2,
    3635         222 :         Builtins::kIllegal, MUTABLE);
    3636         111 :     Handle<JSFunction> function = factory->NewFunction(args);
    3637             :     Handle<Map> map(function->initial_map(), isolate());
    3638             : 
    3639             :     // Create the descriptor array for the arguments object.
    3640         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3641             : 
    3642             :     {  // length
    3643             :       Descriptor d =
    3644             :           Descriptor::DataField(isolate(), factory->length_string(),
    3645             :                                 JSSloppyArgumentsObject::kLengthIndex,
    3646         111 :                                 DONT_ENUM, Representation::Tagged());
    3647         111 :       map->AppendDescriptor(isolate(), &d);
    3648             :     }
    3649             :     {  // callee
    3650             :       Descriptor d =
    3651             :           Descriptor::DataField(isolate(), factory->callee_string(),
    3652             :                                 JSSloppyArgumentsObject::kCalleeIndex,
    3653         111 :                                 DONT_ENUM, Representation::Tagged());
    3654         111 :       map->AppendDescriptor(isolate(), &d);
    3655             :     }
    3656             :     // @@iterator method is added later.
    3657             : 
    3658         111 :     native_context()->set_sloppy_arguments_map(*map);
    3659             : 
    3660             :     DCHECK(!map->is_dictionary_map());
    3661             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3662             :   }
    3663             : 
    3664             :   {  // --- fast and slow aliased arguments map
    3665         111 :     Handle<Map> map = isolate_->sloppy_arguments_map();
    3666         111 :     map = Map::Copy(isolate_, map, "FastAliasedArguments");
    3667         111 :     map->set_elements_kind(FAST_SLOPPY_ARGUMENTS_ELEMENTS);
    3668             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3669         111 :     native_context()->set_fast_aliased_arguments_map(*map);
    3670             : 
    3671         111 :     map = Map::Copy(isolate_, map, "SlowAliasedArguments");
    3672         111 :     map->set_elements_kind(SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
    3673             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3674         111 :     native_context()->set_slow_aliased_arguments_map(*map);
    3675             :   }
    3676             : 
    3677             :   {  // --- strict mode arguments map
    3678             :     const PropertyAttributes attributes =
    3679             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3680             : 
    3681             :     // Create the ThrowTypeError function.
    3682         111 :     Handle<AccessorPair> callee = factory->NewAccessorPair();
    3683             : 
    3684         111 :     Handle<JSFunction> poison = GetThrowTypeErrorIntrinsic();
    3685             : 
    3686             :     // Install the ThrowTypeError function.
    3687         222 :     callee->set_getter(*poison);
    3688         222 :     callee->set_setter(*poison);
    3689             : 
    3690             :     // Create the map. Allocate one in-object field for length.
    3691             :     Handle<Map> map = factory->NewMap(
    3692         111 :         JS_ARGUMENTS_TYPE, JSStrictArgumentsObject::kSize, PACKED_ELEMENTS, 1);
    3693             :     // Create the descriptor array for the arguments object.
    3694         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3695             : 
    3696             :     {  // length
    3697             :       Descriptor d =
    3698             :           Descriptor::DataField(isolate(), factory->length_string(),
    3699             :                                 JSStrictArgumentsObject::kLengthIndex,
    3700         111 :                                 DONT_ENUM, Representation::Tagged());
    3701         111 :       map->AppendDescriptor(isolate(), &d);
    3702             :     }
    3703             :     {  // callee
    3704             :       Descriptor d = Descriptor::AccessorConstant(factory->callee_string(),
    3705         111 :                                                   callee, attributes);
    3706         111 :       map->AppendDescriptor(isolate(), &d);
    3707             :     }
    3708             :     // @@iterator method is added later.
    3709             : 
    3710             :     DCHECK_EQ(native_context()->object_function()->prototype(),
    3711             :               *isolate_->initial_object_prototype());
    3712         222 :     Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
    3713             : 
    3714             :     // Copy constructor from the sloppy arguments boilerplate.
    3715         333 :     map->SetConstructor(
    3716         333 :         native_context()->sloppy_arguments_map()->GetConstructor());
    3717             : 
    3718         111 :     native_context()->set_strict_arguments_map(*map);
    3719             : 
    3720             :     DCHECK(!map->is_dictionary_map());
    3721             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3722             :   }
    3723             : 
    3724             :   {  // --- context extension
    3725             :     // Create a function for the context extension objects.
    3726             :     Handle<JSFunction> context_extension_fun =
    3727             :         CreateFunction(isolate_, factory->empty_string(),
    3728             :                        JS_CONTEXT_EXTENSION_OBJECT_TYPE, JSObject::kHeaderSize,
    3729         111 :                        0, factory->the_hole_value(), Builtins::kIllegal);
    3730         111 :     native_context()->set_context_extension_function(*context_extension_fun);
    3731             :   }
    3732             : 
    3733             :   {
    3734             :     // Set up the call-as-function delegate.
    3735             :     Handle<JSFunction> delegate =
    3736             :         SimpleCreateFunction(isolate_, factory->empty_string(),
    3737         111 :                              Builtins::kHandleApiCallAsFunction, 0, false);
    3738         111 :     native_context()->set_call_as_function_delegate(*delegate);
    3739             :   }
    3740             : 
    3741             :   {
    3742             :     // Set up the call-as-constructor delegate.
    3743             :     Handle<JSFunction> delegate =
    3744             :         SimpleCreateFunction(isolate_, factory->empty_string(),
    3745         111 :                              Builtins::kHandleApiCallAsConstructor, 0, false);
    3746         111 :     native_context()->set_call_as_constructor_delegate(*delegate);
    3747             :   }
    3748         111 : }  // NOLINT(readability/fn_size)
    3749             : 
    3750        1221 : Handle<JSFunction> Genesis::InstallTypedArray(const char* name,
    3751             :                                               ElementsKind elements_kind) {
    3752             :   Handle<JSObject> global =
    3753        2442 :       Handle<JSObject>(native_context()->global_object(), isolate());
    3754             : 
    3755        1221 :   Handle<JSObject> typed_array_prototype = isolate()->typed_array_prototype();
    3756        1221 :   Handle<JSFunction> typed_array_function = isolate()->typed_array_function();
    3757             : 
    3758             :   Handle<JSFunction> result = InstallFunction(
    3759             :       isolate(), global, name, JS_TYPED_ARRAY_TYPE,
    3760             :       JSTypedArray::kSizeWithEmbedderFields, 0, factory()->the_hole_value(),
    3761        1221 :       Builtins::kTypedArrayConstructor);
    3762        2442 :   result->initial_map()->set_elements_kind(elements_kind);
    3763             : 
    3764             :   result->shared()->DontAdaptArguments();
    3765             :   result->shared()->set_length(3);
    3766             : 
    3767        2442 :   CHECK(JSObject::SetPrototype(result, typed_array_function, false, kDontThrow)
    3768             :             .FromJust());
    3769             : 
    3770             :   Handle<Smi> bytes_per_element(
    3771        1221 :       Smi::FromInt(1 << ElementsKindToShiftSize(elements_kind)), isolate());
    3772             : 
    3773        1221 :   InstallConstant(isolate(), result, "BYTES_PER_ELEMENT", bytes_per_element);
    3774             : 
    3775             :   // Setup prototype object.
    3776             :   DCHECK(result->prototype()->IsJSObject());
    3777        2442 :   Handle<JSObject> prototype(JSObject::cast(result->prototype()), isolate());
    3778             : 
    3779        2442 :   CHECK(JSObject::SetPrototype(prototype, typed_array_prototype, false,
    3780             :                                kDontThrow)
    3781             :             .FromJust());
    3782             : 
    3783        1221 :   InstallConstant(isolate(), prototype, "BYTES_PER_ELEMENT", bytes_per_element);
    3784        1221 :   return result;
    3785             : }
    3786             : 
    3787             : 
    3788       90174 : void Genesis::InitializeExperimentalGlobal() {
    3789             : #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
    3790             : 
    3791       90174 :   HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
    3792       90174 :   HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
    3793       90174 :   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
    3794             : #undef FEATURE_INITIALIZE_GLOBAL
    3795       90174 : }
    3796             : 
    3797         111 : bool Bootstrapper::CompileExtraBuiltin(Isolate* isolate, int index) {
    3798             :   HandleScope scope(isolate);
    3799         111 :   Vector<const char> name = ExtraNatives::GetScriptName(index);
    3800             :   Handle<String> source_code =
    3801         111 :       isolate->bootstrapper()->GetNativeSource(EXTRAS, index);
    3802         111 :   Handle<Object> global = isolate->global_object();
    3803         111 :   Handle<Object> binding = isolate->extras_binding_object();
    3804         111 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3805         111 :   Handle<Object> args[] = {global, binding, extras_utils};
    3806             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3807         222 :                                      arraysize(args), args, EXTENSION_CODE);
    3808             : }
    3809             : 
    3810             : 
    3811         111 : bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
    3812             :                                  Handle<String> source, int argc,
    3813             :                                  Handle<Object> argv[],
    3814             :                                  NativesFlag natives_flag) {
    3815             :   SuppressDebug compiling_natives(isolate->debug());
    3816             : 
    3817             :   Handle<Context> context(isolate->context(), isolate);
    3818             :   Handle<String> script_name =
    3819         222 :       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
    3820             :   MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3821             :       Compiler::GetSharedFunctionInfoForScript(
    3822             :           isolate, source, Compiler::ScriptDetails(script_name),
    3823             :           ScriptOriginOptions(), nullptr, nullptr,
    3824             :           ScriptCompiler::kNoCompileOptions, ScriptCompiler::kNoCacheNoReason,
    3825         111 :           natives_flag);
    3826             :   Handle<SharedFunctionInfo> function_info;
    3827         111 :   if (!maybe_function_info.ToHandle(&function_info)) return false;
    3828             : 
    3829             :   DCHECK(context->IsNativeContext());
    3830             : 
    3831             :   Handle<JSFunction> fun =
    3832             :       isolate->factory()->NewFunctionFromSharedFunctionInfo(function_info,
    3833         111 :                                                             context);
    3834             :   Handle<Object> receiver = isolate->factory()->undefined_value();
    3835             : 
    3836             :   // For non-extension scripts, run script to get the function wrapper.
    3837             :   Handle<Object> wrapper;
    3838         333 :   if (!Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3839         111 :                           Execution::MessageHandling::kKeepPending, nullptr)
    3840             :            .ToHandle(&wrapper)) {
    3841             :     return false;
    3842             :   }
    3843             :   // Then run the function wrapper.
    3844         222 :   return !Execution::TryCall(isolate, Handle<JSFunction>::cast(wrapper),
    3845             :                              receiver, argc, argv,
    3846         111 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3847         111 :               .is_null();
    3848             : }
    3849             : 
    3850             : 
    3851        4570 : bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
    3852             :   Factory* factory = isolate->factory();
    3853             :   HandleScope scope(isolate);
    3854             :   Handle<SharedFunctionInfo> function_info;
    3855             : 
    3856             :   Handle<String> source =
    3857             :       isolate->factory()
    3858        9143 :           ->NewExternalStringFromOneByte(extension->source())
    3859        4573 :           .ToHandleChecked();
    3860             :   DCHECK(source->IsOneByteRepresentation());
    3861             : 
    3862             :   // If we can't find the function in the cache, we compile a new
    3863             :   // function and insert it into the cache.
    3864        4573 :   Vector<const char> name = CStrVector(extension->name());
    3865             :   SourceCodeCache* cache = isolate->bootstrapper()->extensions_cache();
    3866             :   Handle<Context> context(isolate->context(), isolate);
    3867             :   DCHECK(context->IsNativeContext());
    3868             : 
    3869        4573 :   if (!cache->Lookup(isolate, name, &function_info)) {
    3870             :     Handle<String> script_name =
    3871        6500 :         factory->NewStringFromUtf8(name).ToHandleChecked();
    3872             :     MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3873             :         Compiler::GetSharedFunctionInfoForScript(
    3874             :             isolate, source, Compiler::ScriptDetails(script_name),
    3875             :             ScriptOriginOptions(), extension, nullptr,
    3876             :             ScriptCompiler::kNoCompileOptions,
    3877        3249 :             ScriptCompiler::kNoCacheBecauseV8Extension, EXTENSION_CODE);
    3878        3243 :     if (!maybe_function_info.ToHandle(&function_info)) return false;
    3879        3213 :     cache->Add(isolate, name, function_info);
    3880             :   }
    3881             : 
    3882             :   // Set up the function context. Conceptually, we should clone the
    3883             :   // function before overwriting the context but since we're in a
    3884             :   // single-threaded environment it is not strictly necessary.
    3885             :   Handle<JSFunction> fun =
    3886        4535 :       factory->NewFunctionFromSharedFunctionInfo(function_info, context);
    3887             : 
    3888             :   // Call function using either the runtime object or the global
    3889             :   // object as the receiver. Provide no parameters.
    3890        4535 :   Handle<Object> receiver = isolate->global_object();
    3891        9074 :   return !Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3892        4540 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3893        4540 :               .is_null();
    3894             : }
    3895             : 
    3896       90479 : void Genesis::ConfigureUtilsObject() {
    3897             :   // We still need the utils object after deserialization.
    3898       90785 :   if (isolate()->serializer_enabled()) return;
    3899             : 
    3900             :   // The utils object can be removed for cases that reach this point.
    3901       90173 :   HeapObject undefined = ReadOnlyRoots(heap()).undefined_value();
    3902       90173 :   native_context()->set_extras_utils_object(undefined);
    3903             : }
    3904             : 
    3905         111 : void Genesis::InitializeIteratorFunctions() {
    3906         111 :   Isolate* isolate = isolate_;
    3907             :   Factory* factory = isolate->factory();
    3908             :   HandleScope scope(isolate);
    3909         111 :   Handle<NativeContext> native_context = isolate->native_context();
    3910             :   Handle<JSObject> iterator_prototype(
    3911         222 :       native_context->initial_iterator_prototype(), isolate);
    3912             : 
    3913             :   {  // -- G e n e r a t o r
    3914         111 :     PrototypeIterator iter(isolate, native_context->generator_function_map());
    3915             :     Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>(),
    3916             :                                                   isolate);
    3917             :     Handle<JSFunction> generator_function_function = CreateFunction(
    3918             :         isolate, "GeneratorFunction", JS_FUNCTION_TYPE,
    3919             :         JSFunction::kSizeWithPrototype, 0, generator_function_prototype,
    3920         111 :         Builtins::kGeneratorFunctionConstructor);
    3921         222 :     generator_function_function->set_prototype_or_initial_map(
    3922         333 :         native_context->generator_function_map());
    3923             :     generator_function_function->shared()->DontAdaptArguments();
    3924             :     generator_function_function->shared()->set_length(1);
    3925             :     InstallWithIntrinsicDefaultProto(
    3926             :         isolate, generator_function_function,
    3927         111 :         Context::GENERATOR_FUNCTION_FUNCTION_INDEX);
    3928             : 
    3929         222 :     JSObject::ForceSetPrototype(generator_function_function,
    3930         111 :                                 isolate->function_function());
    3931         111 :     JSObject::AddProperty(
    3932             :         isolate, generator_function_prototype, factory->constructor_string(),
    3933             :         generator_function_function,
    3934         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3935             : 
    3936         333 :     native_context->generator_function_map()->SetConstructor(
    3937         111 :         *generator_function_function);
    3938             :   }
    3939             : 
    3940             :   {  // -- A s y n c G e n e r a t o r
    3941             :     PrototypeIterator iter(isolate,
    3942         111 :                            native_context->async_generator_function_map());
    3943             :     Handle<JSObject> async_generator_function_prototype(
    3944             :         iter.GetCurrent<JSObject>(), isolate);
    3945             : 
    3946             :     Handle<JSFunction> async_generator_function_function = CreateFunction(
    3947             :         isolate, "AsyncGeneratorFunction", JS_FUNCTION_TYPE,
    3948             :         JSFunction::kSizeWithPrototype, 0, async_generator_function_prototype,
    3949         111 :         Builtins::kAsyncGeneratorFunctionConstructor);
    3950         222 :     async_generator_function_function->set_prototype_or_initial_map(
    3951         333 :         native_context->async_generator_function_map());
    3952             :     async_generator_function_function->shared()->DontAdaptArguments();
    3953             :     async_generator_function_function->shared()->set_length(1);
    3954             :     InstallWithIntrinsicDefaultProto(
    3955             :         isolate, async_generator_function_function,
    3956         111 :         Context::ASYNC_GENERATOR_FUNCTION_FUNCTION_INDEX);
    3957             : 
    3958         222 :     JSObject::ForceSetPrototype(async_generator_function_function,
    3959         111 :                                 isolate->function_function());
    3960             : 
    3961         111 :     JSObject::AddProperty(
    3962             :         isolate, async_generator_function_prototype,
    3963             :         factory->constructor_string(), async_generator_function_function,
    3964         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    3965             : 
    3966         333 :     native_context->async_generator_function_map()->SetConstructor(
    3967         111 :         *async_generator_function_function);
    3968             :   }
    3969             : 
    3970             :   {  // -- S e t I t e r a t o r
    3971             :     // Setup %SetIteratorPrototype%.
    3972             :     Handle<JSObject> prototype =
    3973         111 :         factory->NewJSObject(isolate->object_function(), AllocationType::kOld);
    3974         111 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    3975             : 
    3976         111 :     InstallToStringTag(isolate, prototype, factory->SetIterator_string());
    3977             : 
    3978             :     // Install the next function on the {prototype}.
    3979             :     InstallFunctionWithBuiltinId(isolate, prototype, "next",
    3980         111 :                                  Builtins::kSetIteratorPrototypeNext, 0, true);
    3981         111 :     native_context->set_initial_set_iterator_prototype(*prototype);
    3982             : 
    3983             :     // Setup SetIterator constructor.
    3984             :     Handle<JSFunction> set_iterator_function =
    3985             :         CreateFunction(isolate, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
    3986         111 :                        JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
    3987         111 :     set_iterator_function->shared()->set_native(false);
    3988             : 
    3989             :     Handle<Map> set_value_iterator_map(set_iterator_function->initial_map(),
    3990             :                                        isolate);
    3991         111 :     native_context->set_set_value_iterator_map(*set_value_iterator_map);
    3992             : 
    3993             :     Handle<Map> set_key_value_iterator_map = Map::Copy(
    3994         111 :         isolate, set_value_iterator_map, "JS_SET_KEY_VALUE_ITERATOR_TYPE");
    3995             :     set_key_value_iterator_map->set_instance_type(
    3996             :         JS_SET_KEY_VALUE_ITERATOR_TYPE);
    3997         111 :     native_context->set_set_key_value_iterator_map(*set_key_value_iterator_map);
    3998             :   }
    3999             : 
    4000             :   {  // -- M a p I t e r a t o r
    4001             :     // Setup %MapIteratorPrototype%.
    4002             :     Handle<JSObject> prototype =
    4003         111 :         factory->NewJSObject(isolate->object_function(), AllocationType::kOld);
    4004         111 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4005             : 
    4006         111 :     InstallToStringTag(isolate, prototype, factory->MapIterator_string());
    4007             : 
    4008             :     // Install the next function on the {prototype}.
    4009             :     InstallFunctionWithBuiltinId(isolate, prototype, "next",
    4010         111 :                                  Builtins::kMapIteratorPrototypeNext, 0, true);
    4011         111 :     native_context->set_initial_map_iterator_prototype(*prototype);
    4012             : 
    4013             :     // Setup MapIterator constructor.
    4014             :     Handle<JSFunction> map_iterator_function =
    4015             :         CreateFunction(isolate, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
    4016         111 :                        JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
    4017         111 :     map_iterator_function->shared()->set_native(false);
    4018             : 
    4019             :     Handle<Map> map_key_iterator_map(map_iterator_function->initial_map(),
    4020             :                                      isolate);
    4021         111 :     native_context->set_map_key_iterator_map(*map_key_iterator_map);
    4022             : 
    4023             :     Handle<Map> map_key_value_iterator_map = Map::Copy(
    4024         111 :         isolate, map_key_iterator_map, "JS_MAP_KEY_VALUE_ITERATOR_TYPE");
    4025             :     map_key_value_iterator_map->set_instance_type(
    4026             :         JS_MAP_KEY_VALUE_ITERATOR_TYPE);
    4027         111 :     native_context->set_map_key_value_iterator_map(*map_key_value_iterator_map);
    4028             : 
    4029             :     Handle<Map> map_value_iterator_map =
    4030         111 :         Map::Copy(isolate, map_key_iterator_map, "JS_MAP_VALUE_ITERATOR_TYPE");
    4031             :     map_value_iterator_map->set_instance_type(JS_MAP_VALUE_ITERATOR_TYPE);
    4032         111 :     native_context->set_map_value_iterator_map(*map_value_iterator_map);
    4033             :   }
    4034             : 
    4035             :   {  // -- A s y n c F u n c t i o n
    4036             :     // Builtin functions for AsyncFunction.
    4037         111 :     PrototypeIterator iter(isolate, native_context->async_function_map());
    4038             :     Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>(),
    4039             :                                               isolate);
    4040             : 
    4041             :     Handle<JSFunction> async_function_constructor = CreateFunction(
    4042             :         isolate, "AsyncFunction", JS_FUNCTION_TYPE,
    4043             :         JSFunction::kSizeWithPrototype, 0, async_function_prototype,
    4044         111 :         Builtins::kAsyncFunctionConstructor);
    4045         222 :     async_function_constructor->set_prototype_or_initial_map(
    4046         333 :         native_context->async_function_map());
    4047             :     async_function_constructor->shared()->DontAdaptArguments();
    4048             :     async_function_constructor->shared()->set_length(1);
    4049         111 :     native_context->set_async_function_constructor(*async_function_constructor);
    4050         222 :     JSObject::ForceSetPrototype(async_function_constructor,
    4051         111 :                                 isolate->function_function());
    4052             : 
    4053         111 :     JSObject::AddProperty(
    4054             :         isolate, async_function_prototype, factory->constructor_string(),
    4055             :         async_function_constructor,
    4056         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4057             : 
    4058         111 :     JSFunction::SetPrototype(async_function_constructor,
    4059         111 :                              async_function_prototype);
    4060             : 
    4061             :     // Async functions don't have a prototype, but they use generator objects
    4062             :     // under the hood to model the suspend/resume (in await). Instead of using
    4063             :     // the "prototype" / initial_map machinery (like for (async) generators),
    4064             :     // there's one global (per native context) map here that is used for the
    4065             :     // async function generator objects. These objects never escape to user
    4066             :     // JavaScript anyways.
    4067             :     Handle<Map> async_function_object_map = factory->NewMap(
    4068         111 :         JS_ASYNC_FUNCTION_OBJECT_TYPE, JSAsyncFunctionObject::kSize);
    4069         111 :     native_context->set_async_function_object_map(*async_function_object_map);
    4070             : 
    4071             :     {
    4072             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4073             :           isolate, Builtins::kAsyncFunctionAwaitRejectClosure,
    4074         111 :           factory->empty_string(), 1);
    4075         111 :       native_context->set_async_function_await_reject_shared_fun(*info);
    4076             :     }
    4077             : 
    4078             :     {
    4079             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4080             :           isolate, Builtins::kAsyncFunctionAwaitResolveClosure,
    4081         111 :           factory->empty_string(), 1);
    4082         111 :       native_context->set_async_function_await_resolve_shared_fun(*info);
    4083             :     }
    4084             :   }
    4085         111 : }
    4086             : 
    4087         111 : void Genesis::InitializeCallSiteBuiltins() {
    4088             :   Factory* factory = isolate()->factory();
    4089             :   HandleScope scope(isolate());
    4090             :   // -- C a l l S i t e
    4091             :   // Builtin functions for CallSite.
    4092             : 
    4093             :   // CallSites are a special case; the constructor is for our private use
    4094             :   // only, therefore we set it up as a builtin that throws. Internally, we use
    4095             :   // CallSiteUtils::Construct to create CallSite objects.
    4096             : 
    4097             :   Handle<JSFunction> callsite_fun = CreateFunction(
    4098             :       isolate(), "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize, 0,
    4099         111 :       factory->the_hole_value(), Builtins::kUnsupportedThrower);
    4100             :   callsite_fun->shared()->DontAdaptArguments();
    4101         222 :   isolate()->native_context()->set_callsite_function(*callsite_fun);
    4102             : 
    4103             :   // Setup CallSite.prototype.
    4104             :   Handle<JSObject> prototype(JSObject::cast(callsite_fun->instance_prototype()),
    4105         222 :                              isolate());
    4106             : 
    4107             :   struct FunctionInfo {
    4108             :     const char* name;
    4109             :     Builtins::Name id;
    4110             :   };
    4111             : 
    4112             :   FunctionInfo infos[] = {
    4113             :       {"getColumnNumber", Builtins::kCallSitePrototypeGetColumnNumber},
    4114             :       {"getEvalOrigin", Builtins::kCallSitePrototypeGetEvalOrigin},
    4115             :       {"getFileName", Builtins::kCallSitePrototypeGetFileName},
    4116             :       {"getFunction", Builtins::kCallSitePrototypeGetFunction},
    4117             :       {"getFunctionName", Builtins::kCallSitePrototypeGetFunctionName},
    4118             :       {"getLineNumber", Builtins::kCallSitePrototypeGetLineNumber},
    4119             :       {"getMethodName", Builtins::kCallSitePrototypeGetMethodName},
    4120             :       {"getPosition", Builtins::kCallSitePrototypeGetPosition},
    4121             :       {"getPromiseIndex", Builtins::kCallSitePrototypeGetPromiseIndex},
    4122             :       {"getScriptNameOrSourceURL",
    4123             :        Builtins::kCallSitePrototypeGetScriptNameOrSourceURL},
    4124             :       {"getThis", Builtins::kCallSitePrototypeGetThis},
    4125             :       {"getTypeName", Builtins::kCallSitePrototypeGetTypeName},
    4126             :       {"isAsync", Builtins::kCallSitePrototypeIsAsync},
    4127             :       {"isConstructor", Builtins::kCallSitePrototypeIsConstructor},
    4128             :       {"isEval", Builtins::kCallSitePrototypeIsEval},
    4129             :       {"isNative", Builtins::kCallSitePrototypeIsNative},
    4130             :       {"isPromiseAll", Builtins::kCallSitePrototypeIsPromiseAll},
    4131             :       {"isToplevel", Builtins::kCallSitePrototypeIsToplevel},
    4132         111 :       {"toString", Builtins::kCallSitePrototypeToString}};
    4133             : 
    4134             :   PropertyAttributes attrs =
    4135             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    4136             : 
    4137             :   Handle<JSFunction> fun;
    4138        4329 :   for (const FunctionInfo& info : infos) {
    4139        2109 :     SimpleInstallFunction(isolate(), prototype, info.name, info.id, 0, true,
    4140        2109 :                           attrs);
    4141             :   }
    4142         111 : }
    4143             : 
    4144             : #define EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(id) \
    4145             :   void Genesis::InitializeGlobal_##id() {}
    4146             : 
    4147           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_namespace_exports)
    4148           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_public_fields)
    4149           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_fields)
    4150           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_methods)
    4151           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_static_fields)
    4152           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_class_fields)
    4153           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
    4154           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_meta)
    4155           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_numeric_separator)
    4156           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_json_stringify)
    4157           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_sequence)
    4158           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_await_optimization)
    4159           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_hashbang)
    4160             : 
    4161             : #ifdef V8_INTL_SUPPORT
    4162           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_bigint)
    4163           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_datetime_style)
    4164             : #endif  // V8_INTL_SUPPORT
    4165             : 
    4166             : #undef EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE
    4167             : 
    4168       90173 : void Genesis::InitializeGlobal_harmony_global() {
    4169       90173 :   if (!FLAG_harmony_global) return;
    4170             : 
    4171             :   Factory* factory = isolate()->factory();
    4172      180348 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4173      180348 :   Handle<JSGlobalProxy> global_proxy(native_context()->global_proxy(),
    4174       90174 :                                      isolate());
    4175      180348 :   JSObject::AddProperty(isolate_, global, factory->globalThis_string(),
    4176       90174 :                         global_proxy, DONT_ENUM);
    4177             : }
    4178             : 
    4179       90174 : void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
    4180       90174 :   if (!FLAG_harmony_sharedarraybuffer) return;
    4181             : 
    4182      180348 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4183             : 
    4184      270522 :   JSObject::AddProperty(isolate_, global, "SharedArrayBuffer",
    4185       90174 :                         isolate()->shared_array_buffer_fun(), DONT_ENUM);
    4186             : 
    4187      270522 :   JSObject::AddProperty(isolate_, global, "Atomics",
    4188       90174 :                         isolate()->atomics_object(), DONT_ENUM);
    4189       90174 :   InstallToStringTag(isolate_, isolate()->atomics_object(), "Atomics");
    4190             : }
    4191             : 
    4192       90174 : void Genesis::InitializeGlobal_harmony_string_matchall() {
    4193       90174 :   if (!FLAG_harmony_string_matchall) return;
    4194             : 
    4195             :   {  // String.prototype.matchAll
    4196      180347 :     Handle<JSFunction> string_fun(native_context()->string_function(),
    4197       90174 :                                   isolate());
    4198             :     Handle<JSObject> string_prototype(
    4199      180347 :         JSObject::cast(string_fun->instance_prototype()), isolate());
    4200             : 
    4201             :     SimpleInstallFunction(isolate(), string_prototype, "matchAll",
    4202       90174 :                           Builtins::kStringPrototypeMatchAll, 1, true);
    4203             :   }
    4204             : 
    4205             :   {  // RegExp.prototype[@@matchAll]
    4206      180348 :     Handle<JSFunction> regexp_fun(native_context()->regexp_function(),
    4207       90174 :                                   isolate());
    4208             :     Handle<JSObject> regexp_prototype(
    4209      180348 :         JSObject::cast(regexp_fun->instance_prototype()), isolate());
    4210             :     InstallFunctionAtSymbol(isolate(), regexp_prototype,
    4211             :                             factory()->match_all_symbol(), "[Symbol.matchAll]",
    4212       90174 :                             Builtins::kRegExpPrototypeMatchAll, 1, true);
    4213             :     Handle<Map> regexp_prototype_map(regexp_prototype->map(), isolate());
    4214       90173 :     Map::SetShouldBeFastPrototypeMap(regexp_prototype_map, true, isolate());
    4215       90173 :     native_context()->set_regexp_prototype_map(*regexp_prototype_map);
    4216             :     DCHECK_EQ(JSRegExp::kSymbolMatchAllFunctionDescriptorIndex,
    4217             :               regexp_prototype->map()->LastAdded());
    4218             :   }
    4219             : 
    4220             :   {  // --- R e g E x p S t r i n g  I t e r a t o r ---
    4221             :     Handle<JSObject> iterator_prototype(
    4222      180347 :         native_context()->initial_iterator_prototype(), isolate());
    4223             : 
    4224             :     Handle<JSObject> regexp_string_iterator_prototype = factory()->NewJSObject(
    4225       90174 :         isolate()->object_function(), AllocationType::kOld);
    4226       90173 :     JSObject::ForceSetPrototype(regexp_string_iterator_prototype,
    4227       90173 :                                 iterator_prototype);
    4228             : 
    4229             :     InstallToStringTag(isolate(), regexp_string_iterator_prototype,
    4230             :                        "RegExp String Iterator");
    4231             : 
    4232             :     SimpleInstallFunction(isolate(), regexp_string_iterator_prototype, "next",
    4233             :                           Builtins::kRegExpStringIteratorPrototypeNext, 0,
    4234       90174 :                           true);
    4235             : 
    4236             :     Handle<JSFunction> regexp_string_iterator_function = CreateFunction(
    4237             :         isolate(), "RegExpStringIterator", JS_REGEXP_STRING_ITERATOR_TYPE,
    4238             :         JSRegExpStringIterator::kSize, 0, regexp_string_iterator_prototype,
    4239       90174 :         Builtins::kIllegal);
    4240       90173 :     regexp_string_iterator_function->shared()->set_native(false);
    4241      180347 :     native_context()->set_initial_regexp_string_iterator_prototype_map(
    4242       90173 :         regexp_string_iterator_function->initial_map());
    4243             :   }
    4244             : 
    4245             :   {  // @@matchAll Symbol
    4246      180347 :     Handle<JSFunction> symbol_fun(native_context()->symbol_function(),
    4247       90174 :                                   isolate());
    4248       90174 :     InstallConstant(isolate(), symbol_fun, "matchAll",
    4249       90173 :                     factory()->match_all_symbol());
    4250             :   }
    4251             : }
    4252             : 
    4253       90174 : void Genesis::InitializeGlobal_harmony_weak_refs() {
    4254       90174 :   if (!FLAG_harmony_weak_refs) return;
    4255             : 
    4256             :   Factory* factory = isolate()->factory();
    4257         872 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4258             : 
    4259             :   {
    4260             :     // Create %FinalizationGroupPrototype%
    4261             :     Handle<String> finalization_group_name =
    4262         436 :         factory->NewStringFromStaticChars("FinalizationGroup");
    4263             :     Handle<JSObject> finalization_group_prototype = factory->NewJSObject(
    4264         436 :         isolate()->object_function(), AllocationType::kOld);
    4265             : 
    4266             :     // Create %FinalizationGroup%
    4267             :     Handle<JSFunction> finalization_group_fun = CreateFunction(
    4268             :         isolate(), finalization_group_name, JS_FINALIZATION_GROUP_TYPE,
    4269             :         JSFinalizationGroup::kSize, 0, finalization_group_prototype,
    4270         436 :         Builtins::kFinalizationGroupConstructor);
    4271             : 
    4272             :     finalization_group_fun->shared()->DontAdaptArguments();
    4273             :     finalization_group_fun->shared()->set_length(1);
    4274             : 
    4275             :     // Install the "constructor" property on the prototype.
    4276         436 :     JSObject::AddProperty(isolate(), finalization_group_prototype,
    4277             :                           factory->constructor_string(), finalization_group_fun,
    4278         436 :                           DONT_ENUM);
    4279             : 
    4280             :     InstallToStringTag(isolate(), finalization_group_prototype,
    4281         436 :                        finalization_group_name);
    4282             : 
    4283         436 :     JSObject::AddProperty(isolate(), global, finalization_group_name,
    4284         436 :                           finalization_group_fun, DONT_ENUM);
    4285             : 
    4286             :     SimpleInstallFunction(isolate(), finalization_group_prototype, "register",
    4287         436 :                           Builtins::kFinalizationGroupRegister, 3, false);
    4288             : 
    4289             :     SimpleInstallFunction(isolate(), finalization_group_prototype, "unregister",
    4290         436 :                           Builtins::kFinalizationGroupUnregister, 1, false);
    4291             : 
    4292             :     SimpleInstallFunction(isolate(), finalization_group_prototype,
    4293             :                           "cleanupSome",
    4294         436 :                           Builtins::kFinalizationGroupCleanupSome, 0, false);
    4295             :   }
    4296             :   {
    4297             :     // Create %WeakRefPrototype%
    4298             :     Handle<Map> weak_ref_map =
    4299         436 :         factory->NewMap(JS_WEAK_REF_TYPE, JSWeakRef::kSize);
    4300             :     DCHECK(weak_ref_map->IsJSObjectMap());
    4301         436 :     native_context()->set_js_weak_ref_map(*weak_ref_map);
    4302             : 
    4303             :     Handle<JSObject> weak_ref_prototype = factory->NewJSObject(
    4304         436 :         isolate()->object_function(), AllocationType::kOld);
    4305         436 :     Map::SetPrototype(isolate(), weak_ref_map, weak_ref_prototype);
    4306             : 
    4307             :     InstallToStringTag(isolate(), weak_ref_prototype,
    4308         436 :                        factory->WeakRef_string());
    4309             : 
    4310             :     SimpleInstallFunction(isolate(), weak_ref_prototype, "deref",
    4311         436 :                           Builtins::kWeakRefDeref, 0, false);
    4312             : 
    4313             :     // Create %WeakRef%
    4314         436 :     Handle<String> weak_ref_name = factory->InternalizeUtf8String("WeakRef");
    4315             :     Handle<JSFunction> weak_ref_fun = CreateFunction(
    4316             :         isolate(), weak_ref_name, JS_WEAK_REF_TYPE, JSWeakRef::kSize, 0,
    4317         436 :         weak_ref_prototype, Builtins::kWeakRefConstructor);
    4318             : 
    4319             :     weak_ref_fun->shared()->DontAdaptArguments();
    4320             :     weak_ref_fun->shared()->set_length(1);
    4321             : 
    4322             :     // Install the "constructor" property on the prototype.
    4323         436 :     JSObject::AddProperty(isolate(), weak_ref_prototype,
    4324             :                           factory->constructor_string(), weak_ref_fun,
    4325         436 :                           DONT_ENUM);
    4326             : 
    4327         436 :     JSObject::AddProperty(isolate(), global, weak_ref_name, weak_ref_fun,
    4328         436 :                           DONT_ENUM);
    4329             :   }
    4330             : 
    4331             :   {
    4332             :     // Create cleanup iterator for JSFinalizationGroup.
    4333             :     Handle<JSObject> iterator_prototype(
    4334         872 :         native_context()->initial_iterator_prototype(), isolate());
    4335             : 
    4336             :     Handle<JSObject> cleanup_iterator_prototype = factory->NewJSObject(
    4337         436 :         isolate()->object_function(), AllocationType::kOld);
    4338         436 :     JSObject::ForceSetPrototype(cleanup_iterator_prototype, iterator_prototype);
    4339             : 
    4340             :     InstallToStringTag(isolate(), cleanup_iterator_prototype,
    4341             :                        "JSFinalizationGroupCleanupIterator");
    4342             : 
    4343             :     SimpleInstallFunction(isolate(), cleanup_iterator_prototype, "next",
    4344             :                           Builtins::kFinalizationGroupCleanupIteratorNext, 0,
    4345         436 :                           true);
    4346             :     Handle<Map> cleanup_iterator_map =
    4347             :         factory->NewMap(JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE,
    4348         436 :                         JSFinalizationGroupCleanupIterator::kSize);
    4349         436 :     Map::SetPrototype(isolate(), cleanup_iterator_map,
    4350         436 :                       cleanup_iterator_prototype);
    4351         872 :     native_context()->set_js_finalization_group_cleanup_iterator_map(
    4352         436 :         *cleanup_iterator_map);
    4353             :   }
    4354             : }
    4355             : 
    4356             : #ifdef V8_INTL_SUPPORT
    4357       90173 : void Genesis::InitializeGlobal_harmony_locale() {
    4358       90173 :   if (!FLAG_harmony_locale) return;
    4359             : 
    4360             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4361      180348 :       JSReceiver::GetProperty(
    4362             :           isolate(),
    4363      180348 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4364      270521 :           factory()->InternalizeUtf8String("Intl"))
    4365       90174 :           .ToHandleChecked());
    4366             : 
    4367             :   Handle<JSFunction> locale_fun = InstallFunction(
    4368             :       isolate(), intl, "Locale", JS_INTL_LOCALE_TYPE, JSLocale::kSize, 0,
    4369       90174 :       factory()->the_hole_value(), Builtins::kLocaleConstructor);
    4370             :   InstallWithIntrinsicDefaultProto(isolate(), locale_fun,
    4371       90174 :                                    Context::INTL_LOCALE_FUNCTION_INDEX);
    4372             :   locale_fun->shared()->set_length(1);
    4373             :   locale_fun->shared()->DontAdaptArguments();
    4374             : 
    4375             :   // Setup %LocalePrototype%.
    4376             :   Handle<JSObject> prototype(JSObject::cast(locale_fun->instance_prototype()),
    4377      180348 :                              isolate());
    4378             : 
    4379             :   InstallToStringTag(isolate(), prototype, "Intl.Locale");
    4380             : 
    4381             :   SimpleInstallFunction(isolate(), prototype, "toString",
    4382       90173 :                         Builtins::kLocalePrototypeToString, 0, false);
    4383             :   SimpleInstallFunction(isolate(), prototype, "maximize",
    4384       90174 :                         Builtins::kLocalePrototypeMaximize, 0, false);
    4385             :   SimpleInstallFunction(isolate(), prototype, "minimize",
    4386       90174 :                         Builtins::kLocalePrototypeMinimize, 0, false);
    4387             :   // Base locale getters.
    4388             :   SimpleInstallGetter(isolate(), prototype, factory()->language_string(),
    4389       90173 :                       Builtins::kLocalePrototypeLanguage, true);
    4390             :   SimpleInstallGetter(isolate(), prototype, factory()->script_string(),
    4391       90173 :                       Builtins::kLocalePrototypeScript, true);
    4392             :   SimpleInstallGetter(isolate(), prototype, factory()->region_string(),
    4393       90174 :                       Builtins::kLocalePrototypeRegion, true);
    4394             :   SimpleInstallGetter(isolate(), prototype, factory()->baseName_string(),
    4395       90174 :                       Builtins::kLocalePrototypeBaseName, true);
    4396             :   // Unicode extension getters.
    4397             :   SimpleInstallGetter(isolate(), prototype, factory()->calendar_string(),
    4398       90174 :                       Builtins::kLocalePrototypeCalendar, true);
    4399             :   SimpleInstallGetter(isolate(), prototype, factory()->caseFirst_string(),
    4400       90174 :                       Builtins::kLocalePrototypeCaseFirst, true);
    4401             :   SimpleInstallGetter(isolate(), prototype, factory()->collation_string(),
    4402       90174 :                       Builtins::kLocalePrototypeCollation, true);
    4403             :   SimpleInstallGetter(isolate(), prototype, factory()->hourCycle_string(),
    4404       90174 :                       Builtins::kLocalePrototypeHourCycle, true);
    4405             :   SimpleInstallGetter(isolate(), prototype, factory()->numeric_string(),
    4406       90174 :                       Builtins::kLocalePrototypeNumeric, true);
    4407             :   SimpleInstallGetter(isolate(), prototype, factory()->numberingSystem_string(),
    4408       90174 :                       Builtins::kLocalePrototypeNumberingSystem, true);
    4409             : }
    4410             : 
    4411       90174 : void Genesis::InitializeGlobal_harmony_intl_segmenter() {
    4412      179763 :   if (!FLAG_harmony_intl_segmenter) return;
    4413             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4414        1170 :       JSReceiver::GetProperty(
    4415             :           isolate(),
    4416        1170 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4417        1755 :           factory()->InternalizeUtf8String("Intl"))
    4418         585 :           .ToHandleChecked());
    4419             : 
    4420             :   Handle<JSFunction> segmenter_fun = InstallFunction(
    4421             :       isolate(), intl, "Segmenter", JS_INTL_SEGMENTER_TYPE, JSSegmenter::kSize,
    4422         585 :       0, factory()->the_hole_value(), Builtins::kSegmenterConstructor);
    4423             :   segmenter_fun->shared()->set_length(0);
    4424             :   segmenter_fun->shared()->DontAdaptArguments();
    4425             : 
    4426             :   SimpleInstallFunction(isolate(), segmenter_fun, "supportedLocalesOf",
    4427         585 :                         Builtins::kSegmenterSupportedLocalesOf, 1, false);
    4428             : 
    4429             :   {
    4430             :     // Setup %SegmenterPrototype%.
    4431             :     Handle<JSObject> prototype(
    4432        1170 :         JSObject::cast(segmenter_fun->instance_prototype()), isolate());
    4433             : 
    4434             :     InstallToStringTag(isolate(), prototype, "Intl.Segmenter");
    4435             : 
    4436             :     SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    4437             :                           Builtins::kSegmenterPrototypeResolvedOptions, 0,
    4438         585 :                           false);
    4439             : 
    4440             :     SimpleInstallFunction(isolate(), prototype, "segment",
    4441         585 :                           Builtins::kSegmenterPrototypeSegment, 1, false);
    4442             :   }
    4443             : 
    4444             :   {
    4445             :     // Setup %SegmentIteratorPrototype%.
    4446             :     Handle<JSObject> iterator_prototype(
    4447        1170 :         native_context()->initial_iterator_prototype(), isolate());
    4448             : 
    4449             :     Handle<JSObject> prototype = factory()->NewJSObject(
    4450         585 :         isolate()->object_function(), AllocationType::kOld);
    4451         585 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4452             : 
    4453             :     InstallToStringTag(isolate(), prototype,
    4454         585 :                        factory()->SegmentIterator_string());
    4455             : 
    4456             :     SimpleInstallFunction(isolate(), prototype, "next",
    4457         585 :                           Builtins::kSegmentIteratorPrototypeNext, 0, false);
    4458             : 
    4459             :     SimpleInstallFunction(isolate(), prototype, "following",
    4460             :                           Builtins::kSegmentIteratorPrototypeFollowing, 0,
    4461         585 :                           false);
    4462             : 
    4463             :     SimpleInstallFunction(isolate(), prototype, "preceding",
    4464             :                           Builtins::kSegmentIteratorPrototypePreceding, 0,
    4465         585 :                           false);
    4466             : 
    4467             :     SimpleInstallGetter(isolate(), prototype, factory()->index_string(),
    4468         585 :                         Builtins::kSegmentIteratorPrototypeIndex, false);
    4469             : 
    4470             :     SimpleInstallGetter(isolate(), prototype, factory()->breakType_string(),
    4471         585 :                         Builtins::kSegmentIteratorPrototypeBreakType, false);
    4472             : 
    4473             :     // Setup SegmentIterator constructor.
    4474             :     Handle<String> name_string =
    4475        1170 :         Name::ToFunctionName(isolate(),
    4476         585 :                              isolate()->factory()->SegmentIterator_string())
    4477         585 :             .ToHandleChecked();
    4478             :     Handle<JSFunction> segment_iterator_fun = CreateFunction(
    4479             :         isolate(), name_string, JS_INTL_SEGMENT_ITERATOR_TYPE,
    4480         585 :         JSSegmentIterator::kSize, 0, prototype, Builtins::kIllegal);
    4481         585 :     segment_iterator_fun->shared()->set_native(false);
    4482             : 
    4483             :     Handle<Map> segment_iterator_map(segment_iterator_fun->initial_map(),
    4484             :                                      isolate());
    4485         585 :     native_context()->set_intl_segment_iterator_map(*segment_iterator_map);
    4486             :   }
    4487             : }
    4488             : 
    4489             : #endif  // V8_INTL_SUPPORT
    4490             : 
    4491       90173 : void Genesis::InitializeGlobal_harmony_object_from_entries() {
    4492       90173 :   if (!FLAG_harmony_object_from_entries) return;
    4493             :   SimpleInstallFunction(isolate(), isolate()->object_function(), "fromEntries",
    4494      180346 :                         Builtins::kObjectFromEntries, 1, false);
    4495             : }
    4496             : 
    4497         222 : Handle<JSFunction> Genesis::CreateArrayBuffer(
    4498             :     Handle<String> name, ArrayBufferKind array_buffer_kind) {
    4499             :   // Create the %ArrayBufferPrototype%
    4500             :   // Setup the {prototype} with the given {name} for @@toStringTag.
    4501             :   Handle<JSObject> prototype = factory()->NewJSObject(
    4502         222 :       isolate()->object_function(), AllocationType::kOld);
    4503         222 :   InstallToStringTag(isolate(), prototype, name);
    4504             : 
    4505             :   // Allocate the constructor with the given {prototype}.
    4506             :   Handle<JSFunction> array_buffer_fun =
    4507             :       CreateFunction(isolate(), name, JS_ARRAY_BUFFER_TYPE,
    4508             :                      JSArrayBuffer::kSizeWithEmbedderFields, 0, prototype,
    4509         222 :                      Builtins::kArrayBufferConstructor);
    4510             :   array_buffer_fun->shared()->DontAdaptArguments();
    4511             :   array_buffer_fun->shared()->set_length(1);
    4512             : 
    4513             :   // Install the "constructor" property on the {prototype}.
    4514         222 :   JSObject::AddProperty(isolate(), prototype, factory()->constructor_string(),
    4515         222 :                         array_buffer_fun, DONT_ENUM);
    4516             : 
    4517         222 :   switch (array_buffer_kind) {
    4518             :     case ARRAY_BUFFER:
    4519             :       InstallFunctionWithBuiltinId(isolate(), array_buffer_fun, "isView",
    4520         111 :                                    Builtins::kArrayBufferIsView, 1, true);
    4521             : 
    4522             :       // Install the "byteLength" getter on the {prototype}.
    4523             :       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
    4524         111 :                           Builtins::kArrayBufferPrototypeGetByteLength, false);
    4525             : 
    4526             :       SimpleInstallFunction(isolate(), prototype, "slice",
    4527         111 :                             Builtins::kArrayBufferPrototypeSlice, 2, true);
    4528         111 :       break;
    4529             : 
    4530             :     case SHARED_ARRAY_BUFFER:
    4531             :       // Install the "byteLength" getter on the {prototype}.
    4532             :       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
    4533             :                           Builtins::kSharedArrayBufferPrototypeGetByteLength,
    4534         111 :                           false);
    4535             : 
    4536             :       SimpleInstallFunction(isolate(), prototype, "slice",
    4537             :                             Builtins::kSharedArrayBufferPrototypeSlice, 2,
    4538         111 :                             true);
    4539         111 :       break;
    4540             :   }
    4541             : 
    4542         222 :   return array_buffer_fun;
    4543             : }
    4544             : 
    4545         666 : void Genesis::InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
    4546             :                                                  const char* function_name) {
    4547        1332 :   Handle<JSObject> array_prototype(native_context()->initial_array_prototype(),
    4548         666 :                                    isolate());
    4549             :   Handle<Object> func =
    4550        1332 :       JSReceiver::GetProperty(isolate(), array_prototype, function_name)
    4551         666 :           .ToHandleChecked();
    4552             :   JSObject::AddProperty(isolate(), prototype, function_name, func,
    4553         666 :                         ALL_ATTRIBUTES_MASK);
    4554         666 : }
    4555             : 
    4556         111 : void Genesis::InstallInternalPackedArray(Handle<JSObject> target,
    4557             :                                          const char* name) {
    4558             :   // --- I n t e r n a l   A r r a y ---
    4559             :   // An array constructor on the builtins object that works like
    4560             :   // the public Array constructor, except that its prototype
    4561             :   // doesn't inherit from Object.prototype.
    4562             :   // To be used only for internal work by builtins. Instances
    4563             :   // must not be leaked to user code.
    4564             :   Handle<JSObject> prototype = factory()->NewJSObject(
    4565         111 :       isolate()->object_function(), AllocationType::kOld);
    4566             :   Handle<JSFunction> array_function =
    4567             :       InstallFunction(isolate(), target, name, JS_ARRAY_TYPE, JSArray::kSize, 0,
    4568         111 :                       prototype, Builtins::kInternalArrayConstructor);
    4569             : 
    4570             :   array_function->shared()->DontAdaptArguments();
    4571             : 
    4572             :   Handle<Map> original_map(array_function->initial_map(), isolate());
    4573         111 :   Handle<Map> initial_map = Map::Copy(isolate(), original_map, "InternalArray");
    4574         111 :   initial_map->set_elements_kind(PACKED_ELEMENTS);
    4575         111 :   JSFunction::SetInitialMap(array_function, initial_map, prototype);
    4576             : 
    4577             :   // Make "length" magic on instances.
    4578         111 :   Map::EnsureDescriptorSlack(isolate(), initial_map, 1);
    4579             : 
    4580             :   PropertyAttributes attribs = static_cast<PropertyAttributes>(
    4581             :       DONT_ENUM | DONT_DELETE);
    4582             : 
    4583             :   {  // Add length.
    4584             :     Descriptor d = Descriptor::AccessorConstant(
    4585             :         factory()->length_string(), factory()->array_length_accessor(),
    4586         111 :         attribs);
    4587         111 :     initial_map->AppendDescriptor(isolate(), &d);
    4588             :   }
    4589             : 
    4590             :   JSObject::NormalizeProperties(
    4591             :       prototype, KEEP_INOBJECT_PROPERTIES, 6,
    4592         111 :       "OptimizeInternalPackedArrayPrototypeForAdding");
    4593         111 :   InstallInternalPackedArrayFunction(prototype, "push");
    4594         111 :   InstallInternalPackedArrayFunction(prototype, "pop");
    4595         111 :   InstallInternalPackedArrayFunction(prototype, "shift");
    4596         111 :   InstallInternalPackedArrayFunction(prototype, "unshift");
    4597         111 :   InstallInternalPackedArrayFunction(prototype, "splice");
    4598         111 :   InstallInternalPackedArrayFunction(prototype, "slice");
    4599             : 
    4600         111 :   JSObject::ForceSetPrototype(prototype, factory()->null_value());
    4601         111 :   JSObject::MigrateSlowToFast(prototype, 0, "Bootstrapping");
    4602         111 : }
    4603             : 
    4604         111 : bool Genesis::InstallNatives() {
    4605             :   HandleScope scope(isolate());
    4606             : 
    4607             :   // Set up the extras utils object as a shared container between native
    4608             :   // scripts and extras. (Extras consume things added there by native scripts.)
    4609         111 :   Handle<JSObject> extras_utils = factory()->NewJSObjectWithNullProto();
    4610         222 :   native_context()->set_extras_utils_object(*extras_utils);
    4611             : 
    4612         111 :   InstallInternalPackedArray(extras_utils, "InternalPackedArray");
    4613             : 
    4614             :   // Extras need the ability to store private state on their objects without
    4615             :   // exposing it to the outside world.
    4616             :   SimpleInstallFunction(isolate_, extras_utils, "createPrivateSymbol",
    4617         111 :                         Builtins::kExtrasUtilsCreatePrivateSymbol, 1, false);
    4618             : 
    4619             :   SimpleInstallFunction(isolate_, extras_utils, "uncurryThis",
    4620         111 :                         Builtins::kExtrasUtilsUncurryThis, 1, false);
    4621             : 
    4622             :   SimpleInstallFunction(isolate_, extras_utils, "markPromiseAsHandled",
    4623         111 :                         Builtins::kExtrasUtilsMarkPromiseAsHandled, 1, false);
    4624             : 
    4625             :   SimpleInstallFunction(isolate_, extras_utils, "promiseState",
    4626         111 :                         Builtins::kExtrasUtilsPromiseState, 1, false);
    4627             : 
    4628             :   // [[PromiseState]] values (for extrasUtils.promiseState())
    4629             :   // These values should be kept in sync with PromiseStatus in globals.h
    4630         111 :   JSObject::AddProperty(
    4631             :       isolate(), extras_utils, "kPROMISE_PENDING",
    4632             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kPending)),
    4633         111 :       DONT_ENUM);
    4634         111 :   JSObject::AddProperty(
    4635             :       isolate(), extras_utils, "kPROMISE_FULFILLED",
    4636             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kFulfilled)),
    4637         111 :       DONT_ENUM);
    4638         111 :   JSObject::AddProperty(
    4639             :       isolate(), extras_utils, "kPROMISE_REJECTED",
    4640             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kRejected)),
    4641         111 :       DONT_ENUM);
    4642             : 
    4643             :   // v8.createPromise(parent)
    4644             :   Handle<JSFunction> promise_internal_constructor =
    4645             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4646         111 :                            Builtins::kPromiseInternalConstructor, 1, true);
    4647         111 :   promise_internal_constructor->shared()->set_native(false);
    4648         111 :   JSObject::AddProperty(isolate(), extras_utils, "createPromise",
    4649         111 :                         promise_internal_constructor, DONT_ENUM);
    4650             : 
    4651             :   // v8.rejectPromise(promise, reason)
    4652             :   Handle<JSFunction> promise_internal_reject =
    4653             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4654         111 :                            Builtins::kPromiseInternalReject, 2, true);
    4655         111 :   promise_internal_reject->shared()->set_native(false);
    4656         111 :   JSObject::AddProperty(isolate(), extras_utils, "rejectPromise",
    4657         111 :                         promise_internal_reject, DONT_ENUM);
    4658             : 
    4659             :   // v8.resolvePromise(promise, resolution)
    4660             :   Handle<JSFunction> promise_internal_resolve =
    4661             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4662         111 :                            Builtins::kPromiseInternalResolve, 2, true);
    4663         111 :   promise_internal_resolve->shared()->set_native(false);
    4664         111 :   JSObject::AddProperty(isolate(), extras_utils, "resolvePromise",
    4665         111 :                         promise_internal_resolve, DONT_ENUM);
    4666             : 
    4667         222 :   JSObject::AddProperty(isolate(), extras_utils, "isPromise",
    4668         111 :                         isolate()->is_promise(), DONT_ENUM);
    4669             : 
    4670             :   JSObject::MigrateSlowToFast(Handle<JSObject>::cast(extras_utils), 0,
    4671         111 :                               "Bootstrapping");
    4672             : 
    4673             :   {
    4674             :     // Builtin function for OpaqueReference -- a JSValue-based object,
    4675             :     // that keeps its field isolated from JavaScript code. It may store
    4676             :     // objects, that JavaScript code may not access.
    4677             :     Handle<JSObject> prototype = factory()->NewJSObject(
    4678         111 :         isolate()->object_function(), AllocationType::kOld);
    4679             :     Handle<JSFunction> opaque_reference_fun =
    4680             :         CreateFunction(isolate(), factory()->empty_string(), JS_VALUE_TYPE,
    4681         111 :                        JSValue::kSize, 0, prototype, Builtins::kIllegal);
    4682         111 :     native_context()->set_opaque_reference_function(*opaque_reference_fun);
    4683             :   }
    4684             : 
    4685             :   auto fast_template_instantiations_cache = isolate()->factory()->NewFixedArray(
    4686         111 :       TemplateInfo::kFastTemplateInstantiationsCacheSize);
    4687         222 :   native_context()->set_fast_template_instantiations_cache(
    4688         111 :       *fast_template_instantiations_cache);
    4689             : 
    4690             :   auto slow_template_instantiations_cache = SimpleNumberDictionary::New(
    4691         111 :       isolate(), ApiNatives::kInitialFunctionCacheSize);
    4692         222 :   native_context()->set_slow_template_instantiations_cache(
    4693         111 :       *slow_template_instantiations_cache);
    4694             : 
    4695             :   // Store the map for the %ObjectPrototype% after the natives has been compiled
    4696             :   // and the Object function has been set up.
    4697             :   {
    4698         222 :     Handle<JSFunction> object_function(native_context()->object_function(),
    4699         111 :                                        isolate());
    4700             :     DCHECK(JSObject::cast(object_function->initial_map()->prototype())
    4701             :                ->HasFastProperties());
    4702         222 :     native_context()->set_object_function_prototype_map(
    4703         111 :         HeapObject::cast(object_function->initial_map()->prototype())->map());
    4704             :   }
    4705             : 
    4706             :   // Store the map for the %StringPrototype% after the natives has been compiled
    4707             :   // and the String function has been set up.
    4708         222 :   Handle<JSFunction> string_function(native_context()->string_function(),
    4709         111 :                                      isolate());
    4710             :   JSObject string_function_prototype =
    4711             :       JSObject::cast(string_function->initial_map()->prototype());
    4712             :   DCHECK(string_function_prototype->HasFastProperties());
    4713         222 :   native_context()->set_string_function_prototype_map(
    4714         111 :       string_function_prototype->map());
    4715             : 
    4716             :   Handle<JSGlobalObject> global_object =
    4717         222 :       handle(native_context()->global_object(), isolate());
    4718             : 
    4719             :   // Install Global.decodeURI.
    4720             :   InstallFunctionWithBuiltinId(isolate(), global_object, "decodeURI",
    4721         111 :                                Builtins::kGlobalDecodeURI, 1, false);
    4722             : 
    4723             :   // Install Global.decodeURIComponent.
    4724             :   InstallFunctionWithBuiltinId(isolate(), global_object, "decodeURIComponent",
    4725         111 :                                Builtins::kGlobalDecodeURIComponent, 1, false);
    4726             : 
    4727             :   // Install Global.encodeURI.
    4728             :   InstallFunctionWithBuiltinId(isolate(), global_object, "encodeURI",
    4729         111 :                                Builtins::kGlobalEncodeURI, 1, false);
    4730             : 
    4731             :   // Install Global.encodeURIComponent.
    4732             :   InstallFunctionWithBuiltinId(isolate(), global_object, "encodeURIComponent",
    4733         111 :                                Builtins::kGlobalEncodeURIComponent, 1, false);
    4734             : 
    4735             :   // Install Global.escape.
    4736             :   InstallFunctionWithBuiltinId(isolate(), global_object, "escape",
    4737         111 :                                Builtins::kGlobalEscape, 1, false);
    4738             : 
    4739             :   // Install Global.unescape.
    4740             :   InstallFunctionWithBuiltinId(isolate(), global_object, "unescape",
    4741         111 :                                Builtins::kGlobalUnescape, 1, false);
    4742             : 
    4743             :   // Install Global.eval.
    4744             :   {
    4745             :     Handle<JSFunction> eval = SimpleInstallFunction(
    4746         111 :         isolate(), global_object, "eval", Builtins::kGlobalEval, 1, false);
    4747         111 :     native_context()->set_global_eval_fun(*eval);
    4748             :   }
    4749             : 
    4750             :   // Install Global.isFinite
    4751             :   InstallFunctionWithBuiltinId(isolate(), global_object, "isFinite",
    4752         111 :                                Builtins::kGlobalIsFinite, 1, true);
    4753             : 
    4754             :   // Install Global.isNaN
    4755             :   InstallFunctionWithBuiltinId(isolate(), global_object, "isNaN",
    4756         111 :                                Builtins::kGlobalIsNaN, 1, true);
    4757             : 
    4758             :   // Install Array builtin functions.
    4759             :   {
    4760         222 :     Handle<JSFunction> array_constructor(native_context()->array_function(),
    4761         111 :                                          isolate());
    4762             :     Handle<JSArray> proto(JSArray::cast(array_constructor->prototype()),
    4763         222 :                           isolate());
    4764             : 
    4765             :     // Verification of important array prototype properties.
    4766             :     Object length = proto->length();
    4767         111 :     CHECK(length->IsSmi());
    4768         111 :     CHECK_EQ(Smi::ToInt(length), 0);
    4769         222 :     CHECK(proto->HasSmiOrObjectElements());
    4770             :     // This is necessary to enable fast checks for absence of elements
    4771             :     // on Array.prototype and below.
    4772         222 :     proto->set_elements(ReadOnlyRoots(heap()).empty_fixed_array());
    4773             :   }
    4774             : 
    4775             :   // Create a map for accessor property descriptors (a variant of JSObject
    4776             :   // that predefines four properties get, set, configurable and enumerable).
    4777             :   {
    4778             :     // AccessorPropertyDescriptor initial map.
    4779             :     Handle<Map> map =
    4780             :         factory()->NewMap(JS_OBJECT_TYPE, JSAccessorPropertyDescriptor::kSize,
    4781         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4782             :     // Create the descriptor array for the property descriptor object.
    4783         111 :     Map::EnsureDescriptorSlack(isolate(), map, 4);
    4784             : 
    4785             :     {  // get
    4786             :       Descriptor d =
    4787             :           Descriptor::DataField(isolate(), factory()->get_string(),
    4788             :                                 JSAccessorPropertyDescriptor::kGetIndex, NONE,
    4789         111 :                                 Representation::Tagged());
    4790         111 :       map->AppendDescriptor(isolate(), &d);
    4791             :     }
    4792             :     {  // set
    4793             :       Descriptor d =
    4794             :           Descriptor::DataField(isolate(), factory()->set_string(),
    4795             :                                 JSAccessorPropertyDescriptor::kSetIndex, NONE,
    4796         111 :                                 Representation::Tagged());
    4797         111 :       map->AppendDescriptor(isolate(), &d);
    4798             :     }
    4799             :     {  // enumerable
    4800             :       Descriptor d =
    4801             :           Descriptor::DataField(isolate(), factory()->enumerable_string(),
    4802             :                                 JSAccessorPropertyDescriptor::kEnumerableIndex,
    4803         111 :                                 NONE, Representation::Tagged());
    4804         111 :       map->AppendDescriptor(isolate(), &d);
    4805             :     }
    4806             :     {  // configurable
    4807             :       Descriptor d = Descriptor::DataField(
    4808             :           isolate(), factory()->configurable_string(),
    4809             :           JSAccessorPropertyDescriptor::kConfigurableIndex, NONE,
    4810         111 :           Representation::Tagged());
    4811         111 :       map->AppendDescriptor(isolate(), &d);
    4812             :     }
    4813             : 
    4814         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    4815         222 :     map->SetConstructor(native_context()->object_function());
    4816             : 
    4817         111 :     native_context()->set_accessor_property_descriptor_map(*map);
    4818             :   }
    4819             : 
    4820             :   // Create a map for data property descriptors (a variant of JSObject
    4821             :   // that predefines four properties value, writable, configurable and
    4822             :   // enumerable).
    4823             :   {
    4824             :     // DataPropertyDescriptor initial map.
    4825             :     Handle<Map> map =
    4826             :         factory()->NewMap(JS_OBJECT_TYPE, JSDataPropertyDescriptor::kSize,
    4827         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4828             :     // Create the descriptor array for the property descriptor object.
    4829         111 :     Map::EnsureDescriptorSlack(isolate(), map, 4);
    4830             : 
    4831             :     {  // value
    4832             :       Descriptor d =
    4833             :           Descriptor::DataField(isolate(), factory()->value_string(),
    4834             :                                 JSDataPropertyDescriptor::kValueIndex, NONE,
    4835         111 :                                 Representation::Tagged());
    4836         111 :       map->AppendDescriptor(isolate(), &d);
    4837             :     }
    4838             :     {  // writable
    4839             :       Descriptor d =
    4840             :           Descriptor::DataField(isolate(), factory()->writable_string(),
    4841             :                                 JSDataPropertyDescriptor::kWritableIndex, NONE,
    4842         111 :                                 Representation::Tagged());
    4843         111 :       map->AppendDescriptor(isolate(), &d);
    4844             :     }
    4845             :     {  // enumerable
    4846             :       Descriptor d =
    4847             :           Descriptor::DataField(isolate(), factory()->enumerable_string(),
    4848             :                                 JSDataPropertyDescriptor::kEnumerableIndex,
    4849         111 :                                 NONE, Representation::Tagged());
    4850         111 :       map->AppendDescriptor(isolate(), &d);
    4851             :     }
    4852             :     {  // configurable
    4853             :       Descriptor d =
    4854             :           Descriptor::DataField(isolate(), factory()->configurable_string(),
    4855             :                                 JSDataPropertyDescriptor::kConfigurableIndex,
    4856         111 :                                 NONE, Representation::Tagged());
    4857         111 :       map->AppendDescriptor(isolate(), &d);
    4858             :     }
    4859             : 
    4860         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    4861         222 :     map->SetConstructor(native_context()->object_function());
    4862             : 
    4863         111 :     native_context()->set_data_property_descriptor_map(*map);
    4864             :   }
    4865             : 
    4866             :   // Create a constructor for RegExp results (a variant of Array that
    4867             :   // predefines the properties index, input, and groups).
    4868             :   {
    4869             :     // JSRegExpResult initial map.
    4870             : 
    4871             :     // Find global.Array.prototype to inherit from.
    4872         222 :     Handle<JSFunction> array_constructor(native_context()->array_function(),
    4873         111 :                                          isolate());
    4874             :     Handle<JSObject> array_prototype(
    4875         222 :         JSObject::cast(array_constructor->instance_prototype()), isolate());
    4876             : 
    4877             :     // Add initial map.
    4878             :     Handle<Map> initial_map = factory()->NewMap(
    4879             :         JS_ARRAY_TYPE, JSRegExpResult::kSize, TERMINAL_FAST_ELEMENTS_KIND,
    4880         111 :         JSRegExpResult::kInObjectPropertyCount);
    4881         222 :     initial_map->SetConstructor(*array_constructor);
    4882             : 
    4883             :     // Set prototype on map.
    4884         111 :     initial_map->set_has_non_instance_prototype(false);
    4885         111 :     Map::SetPrototype(isolate(), initial_map, array_prototype);
    4886             : 
    4887             :     // Update map with length accessor from Array and add "index", "input" and
    4888             :     // "groups".
    4889             :     Map::EnsureDescriptorSlack(isolate(), initial_map,
    4890         111 :                                JSRegExpResult::kInObjectPropertyCount + 1);
    4891             : 
    4892             :     // length descriptor.
    4893             :     {
    4894         111 :       JSFunction array_function = native_context()->array_function();
    4895             :       Handle<DescriptorArray> array_descriptors(
    4896             :           array_function->initial_map()->instance_descriptors(), isolate());
    4897             :       Handle<String> length = factory()->length_string();
    4898         222 :       int old = array_descriptors->SearchWithCache(
    4899             :           isolate(), *length, array_function->initial_map());
    4900             :       DCHECK_NE(old, DescriptorArray::kNotFound);
    4901             :       Descriptor d = Descriptor::AccessorConstant(
    4902             :           length, handle(array_descriptors->GetStrongValue(old), isolate()),
    4903         333 :           array_descriptors->GetDetails(old).attributes());
    4904         111 :       initial_map->AppendDescriptor(isolate(), &d);
    4905             :     }
    4906             : 
    4907             :     // index descriptor.
    4908             :     {
    4909             :       Descriptor d = Descriptor::DataField(isolate(), factory()->index_string(),
    4910             :                                            JSRegExpResult::kIndexIndex, NONE,
    4911         111 :                                            Representation::Tagged());
    4912         111 :       initial_map->AppendDescriptor(isolate(), &d);
    4913             :     }
    4914             : 
    4915             :     // input descriptor.
    4916             :     {
    4917             :       Descriptor d = Descriptor::DataField(isolate(), factory()->input_string(),
    4918             :                                            JSRegExpResult::kInputIndex, NONE,
    4919         111 :                                            Representation::Tagged());
    4920         111 :       initial_map->AppendDescriptor(isolate(), &d);
    4921             :     }
    4922             : 
    4923             :     // groups descriptor.
    4924             :     {
    4925             :       Descriptor d = Descriptor::DataField(
    4926             :           isolate(), factory()->groups_string(), JSRegExpResult::kGroupsIndex,
    4927         111 :           NONE, Representation::Tagged());
    4928         111 :       initial_map->AppendDescriptor(isolate(), &d);
    4929             :     }
    4930             : 
    4931         111 :     native_context()->set_regexp_result_map(*initial_map);
    4932             :   }
    4933             : 
    4934             :   // Add @@iterator method to the arguments object maps.
    4935             :   {
    4936             :     PropertyAttributes attribs = DONT_ENUM;
    4937             :     Handle<AccessorInfo> arguments_iterator =
    4938             :         factory()->arguments_iterator_accessor();
    4939             :     {
    4940             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4941         111 :                                                   arguments_iterator, attribs);
    4942         222 :       Handle<Map> map(native_context()->sloppy_arguments_map(), isolate());
    4943         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    4944         111 :       map->AppendDescriptor(isolate(), &d);
    4945             :     }
    4946             :     {
    4947             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4948         111 :                                                   arguments_iterator, attribs);
    4949         222 :       Handle<Map> map(native_context()->fast_aliased_arguments_map(),
    4950         111 :                       isolate());
    4951         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    4952         111 :       map->AppendDescriptor(isolate(), &d);
    4953             :     }
    4954             :     {
    4955             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4956         111 :                                                   arguments_iterator, attribs);
    4957         222 :       Handle<Map> map(native_context()->slow_aliased_arguments_map(),
    4958         111 :                       isolate());
    4959         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    4960         111 :       map->AppendDescriptor(isolate(), &d);
    4961             :     }
    4962             :     {
    4963             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    4964         111 :                                                   arguments_iterator, attribs);
    4965         222 :       Handle<Map> map(native_context()->strict_arguments_map(), isolate());
    4966         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    4967         111 :       map->AppendDescriptor(isolate(), &d);
    4968             :     }
    4969             :   }
    4970             : 
    4971         111 :   return true;
    4972             : }
    4973             : 
    4974         111 : bool Genesis::InstallExtraNatives() {
    4975             :   HandleScope scope(isolate());
    4976             : 
    4977         111 :   Handle<JSObject> extras_binding = factory()->NewJSObjectWithNullProto();
    4978             : 
    4979             :   // binding.isTraceCategoryEnabled(category)
    4980             :   SimpleInstallFunction(isolate(), extras_binding, "isTraceCategoryEnabled",
    4981         111 :                         Builtins::kIsTraceCategoryEnabled, 1, true);
    4982             : 
    4983             :   // binding.trace(phase, category, name, id, data)
    4984             :   SimpleInstallFunction(isolate(), extras_binding, "trace", Builtins::kTrace, 5,
    4985         111 :                         true);
    4986             : 
    4987         111 :   native_context()->set_extras_binding_object(*extras_binding);
    4988             : 
    4989         333 :   for (int i = 0; i < ExtraNatives::GetBuiltinsCount(); i++) {
    4990         111 :     if (!Bootstrapper::CompileExtraBuiltin(isolate(), i)) return false;
    4991             :   }
    4992             : 
    4993             :   return true;
    4994             : }
    4995             : 
    4996         111 : void Genesis::InitializeNormalizedMapCaches() {
    4997         111 :   Handle<NormalizedMapCache> cache = NormalizedMapCache::New(isolate());
    4998         222 :   native_context()->set_normalized_map_cache(*cache);
    4999         111 : }
    5000             : 
    5001             : 
    5002       90479 : bool Bootstrapper::InstallExtensions(Handle<Context> native_context,
    5003             :                                      v8::ExtensionConfiguration* extensions) {
    5004             :   // Don't install extensions into the snapshot.
    5005       90479 :   if (isolate_->serializer_enabled()) return true;
    5006             :   BootstrapperActive active(this);
    5007       90173 :   SaveAndSwitchContext saved_context(isolate_, *native_context);
    5008      180308 :   return Genesis::InstallExtensions(isolate_, native_context, extensions) &&
    5009       90134 :          Genesis::InstallSpecialObjects(isolate_, native_context);
    5010             : }
    5011             : 
    5012       90134 : bool Genesis::InstallSpecialObjects(Isolate* isolate,
    5013             :                                     Handle<Context> native_context) {
    5014             :   HandleScope scope(isolate);
    5015             : 
    5016       90134 :   Handle<JSObject> Error = isolate->error_function();
    5017             :   Handle<String> name = isolate->factory()->stackTraceLimit_string();
    5018       90134 :   Handle<Smi> stack_trace_limit(Smi::FromInt(FLAG_stack_trace_limit), isolate);
    5019       90133 :   JSObject::AddProperty(isolate, Error, name, stack_trace_limit, NONE);
    5020             : 
    5021       90131 :   if (FLAG_expose_wasm) {
    5022             :     // Install the internal data structures into the isolate and expose on
    5023             :     // the global object.
    5024       80500 :     WasmJs::Install(isolate, true);
    5025        9631 :   } else if (FLAG_validate_asm) {
    5026             :     // Install the internal data structures only; these are needed for asm.js
    5027             :     // translated to WASM to work correctly.
    5028          25 :     WasmJs::Install(isolate, false);
    5029             :   }
    5030             : 
    5031       90134 :   return true;
    5032             : }
    5033             : 
    5034             : 
    5035             : static uint32_t Hash(RegisteredExtension* extension) {
    5036             :   return v8::internal::ComputePointerHash(extension);
    5037             : }
    5038             : 
    5039           0 : Genesis::ExtensionStates::ExtensionStates() : map_(8) {}
    5040             : 
    5041        4642 : Genesis::ExtensionTraversalState Genesis::ExtensionStates::get_state(
    5042             :     RegisteredExtension* extension) {
    5043             :   base::HashMap::Entry* entry = map_.Lookup(extension, Hash(extension));
    5044        4642 :   if (entry == nullptr) {
    5045             :     return UNVISITED;
    5046             :   }
    5047             :   return static_cast<ExtensionTraversalState>(
    5048          59 :       reinterpret_cast<intptr_t>(entry->value));
    5049             : }
    5050             : 
    5051        9152 : void Genesis::ExtensionStates::set_state(RegisteredExtension* extension,
    5052             :                                          ExtensionTraversalState state) {
    5053       18303 :   map_.LookupOrInsert(extension, Hash(extension))->value =
    5054        9151 :       reinterpret_cast<void*>(static_cast<intptr_t>(state));
    5055        9151 : }
    5056             : 
    5057       90173 : bool Genesis::InstallExtensions(Isolate* isolate,
    5058             :                                 Handle<Context> native_context,
    5059             :                                 v8::ExtensionConfiguration* extensions) {
    5060             :   ExtensionStates extension_states;  // All extensions have state UNVISITED.
    5061      180347 :   return InstallAutoExtensions(isolate, &extension_states) &&
    5062       90174 :          (!FLAG_expose_free_buffer ||
    5063       90174 :           InstallExtension(isolate, "v8/free-buffer", &extension_states)) &&
    5064       92682 :          (!FLAG_expose_gc ||
    5065       92682 :           InstallExtension(isolate, "v8/gc", &extension_states)) &&
    5066       90296 :          (!FLAG_expose_externalize_string ||
    5067       90296 :           InstallExtension(isolate, "v8/externalize", &extension_states)) &&
    5068           0 :          (!TracingFlags::is_gc_stats_enabled() ||
    5069       90174 :           InstallExtension(isolate, "v8/statistics", &extension_states)) &&
    5070       90175 :          (!FLAG_expose_trigger_failure ||
    5071       90175 :           InstallExtension(isolate, "v8/trigger-failure", &extension_states)) &&
    5072       90183 :          (!FLAG_trace_ignition_dispatches ||
    5073           9 :           InstallExtension(isolate, "v8/ignition-statistics",
    5074      180348 :                            &extension_states)) &&
    5075      180348 :          InstallRequestedExtensions(isolate, extensions, &extension_states);
    5076             : }
    5077             : 
    5078             : 
    5079       90173 : bool Genesis::InstallAutoExtensions(Isolate* isolate,
    5080             :                                     ExtensionStates* extension_states) {
    5081      645201 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5082      735374 :        it != nullptr; it = it->next()) {
    5083      645220 :     if (it->extension()->auto_enable() &&
    5084          20 :         !InstallExtension(isolate, it, extension_states)) {
    5085             :       return false;
    5086             :     }
    5087             :   }
    5088             :   return true;
    5089             : }
    5090             : 
    5091             : 
    5092       90174 : bool Genesis::InstallRequestedExtensions(Isolate* isolate,
    5093             :                                          v8::ExtensionConfiguration* extensions,
    5094             :                                          ExtensionStates* extension_states) {
    5095       93840 :   for (const char** it = extensions->begin(); it != extensions->end(); ++it) {
    5096        1873 :     if (!InstallExtension(isolate, *it, extension_states)) return false;
    5097             :   }
    5098             :   return true;
    5099             : }
    5100             : 
    5101             : 
    5102             : // Installs a named extension.  This methods is unoptimized and does
    5103             : // not scale well if we want to support a large number of extensions.
    5104        4622 : bool Genesis::InstallExtension(Isolate* isolate,
    5105             :                                const char* name,
    5106             :                                ExtensionStates* extension_states) {
    5107       17278 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5108       21900 :        it != nullptr; it = it->next()) {
    5109       21900 :     if (strcmp(name, it->extension()->name()) == 0) {
    5110        4622 :       return InstallExtension(isolate, it, extension_states);
    5111             :     }
    5112             :   }
    5113             :   return Utils::ApiCheck(false,
    5114             :                          "v8::Context::New()",
    5115           0 :                          "Cannot find required extension");
    5116             : }
    5117             : 
    5118             : 
    5119        4642 : bool Genesis::InstallExtension(Isolate* isolate,
    5120             :                                v8::RegisteredExtension* current,
    5121             :                                ExtensionStates* extension_states) {
    5122             :   HandleScope scope(isolate);
    5123             : 
    5124        4642 :   if (extension_states->get_state(current) == INSTALLED) return true;
    5125             :   // The current node has already been visited so there must be a
    5126             :   // cycle in the dependency graph; fail.
    5127        4588 :   if (!Utils::ApiCheck(extension_states->get_state(current) != VISITED,
    5128             :                        "v8::Context::New()",
    5129             :                        "Circular extension dependency")) {
    5130             :     return false;
    5131             :   }
    5132             :   DCHECK(extension_states->get_state(current) == UNVISITED);
    5133        4583 :   extension_states->set_state(current, VISITED);
    5134             :   v8::Extension* extension = current->extension();
    5135             :   // Install the extension's dependencies
    5136        4773 :   for (int i = 0; i < extension->dependency_count(); i++) {
    5137         106 :     if (!InstallExtension(isolate,
    5138         106 :                           extension->dependencies()[i],
    5139             :                           extension_states)) {
    5140             :       return false;
    5141             :     }
    5142             :   }
    5143             :   // We do not expect this to throw an exception. Change this if it does.
    5144        4571 :   bool result = CompileExtension(isolate, extension);
    5145             :   DCHECK(isolate->has_pending_exception() != result);
    5146        4569 :   if (!result) {
    5147             :     // We print out the name of the extension that fail to install.
    5148             :     // When an error is thrown during bootstrapping we automatically print
    5149             :     // the line number at which this happened to the console in the isolate
    5150             :     // error throwing functionality.
    5151             :     base::OS::PrintError("Error installing extension '%s'.\n",
    5152          35 :                          current->extension()->name());
    5153             :     isolate->clear_pending_exception();
    5154             :   }
    5155        4569 :   extension_states->set_state(current, INSTALLED);
    5156        4570 :   return result;
    5157             : }
    5158             : 
    5159             : 
    5160       90440 : bool Genesis::ConfigureGlobalObjects(
    5161             :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
    5162      180880 :   Handle<JSObject> global_proxy(native_context()->global_proxy(), isolate());
    5163      180880 :   Handle<JSObject> global_object(native_context()->global_object(), isolate());
    5164             : 
    5165       90440 :   if (!global_proxy_template.IsEmpty()) {
    5166             :     // Configure the global proxy object.
    5167             :     Handle<ObjectTemplateInfo> global_proxy_data =
    5168             :         v8::Utils::OpenHandle(*global_proxy_template);
    5169       55764 :     if (!ConfigureApiObject(global_proxy, global_proxy_data)) return false;
    5170             : 
    5171             :     // Configure the global object.
    5172             :     Handle<FunctionTemplateInfo> proxy_constructor(
    5173             :         FunctionTemplateInfo::cast(global_proxy_data->constructor()),
    5174             :         isolate());
    5175      111528 :     if (!proxy_constructor->GetPrototypeTemplate()->IsUndefined(isolate())) {
    5176             :       Handle<ObjectTemplateInfo> global_object_data(
    5177             :           ObjectTemplateInfo::cast(proxy_constructor->GetPrototypeTemplate()),
    5178      111528 :           isolate());
    5179       55764 :       if (!ConfigureApiObject(global_object, global_object_data)) return false;
    5180             :     }
    5181             :   }
    5182             : 
    5183       90440 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5184             : 
    5185      180880 :   native_context()->set_array_buffer_map(
    5186      271320 :       native_context()->array_buffer_fun()->initial_map());
    5187             : 
    5188      180880 :   Handle<JSFunction> js_map_fun(native_context()->js_map_fun(), isolate());
    5189      180880 :   Handle<JSFunction> js_set_fun(native_context()->js_set_fun(), isolate());
    5190             :   // Force the Map/Set constructor to fast properties, so that we can use the
    5191             :   // fast paths for various things like
    5192             :   //
    5193             :   //   x instanceof Map
    5194             :   //   x instanceof Set
    5195             :   //
    5196             :   // etc. We should probably come up with a more principled approach once
    5197             :   // the JavaScript builtins are gone.
    5198       90440 :   JSObject::MigrateSlowToFast(js_map_fun, 0, "Bootstrapping");
    5199       90440 :   JSObject::MigrateSlowToFast(js_set_fun, 0, "Bootstrapping");
    5200             : 
    5201       90440 :   native_context()->set_js_map_map(js_map_fun->initial_map());
    5202       90440 :   native_context()->set_js_set_map(js_set_fun->initial_map());
    5203             : 
    5204       90440 :   return true;
    5205             : }
    5206             : 
    5207             : 
    5208      111528 : bool Genesis::ConfigureApiObject(Handle<JSObject> object,
    5209             :                                  Handle<ObjectTemplateInfo> object_template) {
    5210             :   DCHECK(!object_template.is_null());
    5211             :   DCHECK(FunctionTemplateInfo::cast(object_template->constructor())
    5212             :              ->IsTemplateFor(object->map()));;
    5213             : 
    5214             :   MaybeHandle<JSObject> maybe_obj =
    5215      111528 :       ApiNatives::InstantiateObject(object->GetIsolate(), object_template);
    5216             :   Handle<JSObject> instantiated_template;
    5217      111528 :   if (!maybe_obj.ToHandle(&instantiated_template)) {
    5218             :     DCHECK(isolate()->has_pending_exception());
    5219             :     isolate()->clear_pending_exception();
    5220           0 :     return false;
    5221             :   }
    5222      111528 :   TransferObject(instantiated_template, object);
    5223      111528 :   return true;
    5224             : }
    5225             : 
    5226     5815857 : static bool PropertyAlreadyExists(Isolate* isolate, Handle<JSObject> to,
    5227             :                                   Handle<Name> key) {
    5228     5815857 :   LookupIterator it(isolate, to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    5229     5815853 :   CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    5230     5815853 :   return it.IsFound();
    5231             : }
    5232             : 
    5233      201857 : void Genesis::TransferNamedProperties(Handle<JSObject> from,
    5234             :                                       Handle<JSObject> to) {
    5235             :   // If JSObject::AddProperty asserts due to already existing property,
    5236             :   // it is likely due to both global objects sharing property name(s).
    5237             :   // Merging those two global objects is impossible.
    5238             :   // The global template must not create properties that already exist
    5239             :   // in the snapshotted global object.
    5240      201857 :   if (from->HasFastProperties()) {
    5241             :     Handle<DescriptorArray> descs =
    5242             :         Handle<DescriptorArray>(from->map()->instance_descriptors(), isolate());
    5243     1806440 :     for (int i = 0; i < from->map()->NumberOfOwnDescriptors(); i++) {
    5244      847456 :       PropertyDetails details = descs->GetDetails(i);
    5245      847456 :       if (details.location() == kField) {
    5246      847292 :         if (details.kind() == kData) {
    5247             :           HandleScope inner(isolate());
    5248     1694584 :           Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
    5249             :           // If the property is already there we skip it.
    5250      847292 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5251      847287 :           FieldIndex index = FieldIndex::ForDescriptor(from->map(), i);
    5252             :           Handle<Object> value =
    5253      847287 :               JSObject::FastPropertyAt(from, details.representation(), index);
    5254             :           JSObject::AddProperty(isolate(), to, key, value,
    5255      847287 :                                 details.attributes());
    5256             :         } else {
    5257             :           DCHECK_EQ(kAccessor, details.kind());
    5258           0 :           UNREACHABLE();
    5259             :         }
    5260             : 
    5261             :       } else {
    5262             :         DCHECK_EQ(kDescriptor, details.location());
    5263         164 :         if (details.kind() == kData) {
    5264             :           DCHECK(!FLAG_track_constant_fields);
    5265             :           HandleScope inner(isolate());
    5266           0 :           Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
    5267             :           // If the property is already there we skip it.
    5268           0 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5269           0 :           Handle<Object> value(descs->GetStrongValue(i), isolate());
    5270             :           JSObject::AddProperty(isolate(), to, key, value,
    5271           0 :                                 details.attributes());
    5272             :         } else {
    5273             :           DCHECK_EQ(kAccessor, details.kind());
    5274         328 :           Handle<Name> key(descs->GetKey(i), isolate());
    5275             :           // If the property is already there we skip it.
    5276         164 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5277             :           HandleScope inner(isolate());
    5278             :           DCHECK(!to->HasFastProperties());
    5279             :           // Add to dictionary.
    5280         328 :           Handle<Object> value(descs->GetStrongValue(i), isolate());
    5281             :           PropertyDetails d(kAccessor, details.attributes(),
    5282             :                             PropertyCellType::kMutable);
    5283         164 :           JSObject::SetNormalizedProperty(to, key, value, d);
    5284             :         }
    5285             :       }
    5286             :     }
    5287       90329 :   } else if (from->IsJSGlobalObject()) {
    5288             :     // Copy all keys and values in enumeration order.
    5289             :     Handle<GlobalDictionary> properties(
    5290      180658 :         JSGlobalObject::cast(*from)->global_dictionary(), isolate());
    5291             :     Handle<FixedArray> indices =
    5292       90329 :         GlobalDictionary::IterationIndices(isolate(), properties);
    5293    10027115 :     for (int i = 0; i < indices->length(); i++) {
    5294             :       int index = Smi::ToInt(indices->get(i));
    5295             :       Handle<PropertyCell> cell(properties->CellAt(index), isolate());
    5296             :       Handle<Name> key(cell->name(), isolate());
    5297             :       // If the property is already there we skip it.
    5298     4968403 :       if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5299             :       // Set the property.
    5300             :       Handle<Object> value(cell->value(), isolate());
    5301     4968400 :       if (value->IsTheHole(isolate())) continue;
    5302             :       PropertyDetails details = cell->property_details();
    5303     4968398 :       if (details.kind() != kData) continue;
    5304     4968399 :       JSObject::AddProperty(isolate(), to, key, value, details.attributes());
    5305             :     }
    5306             :   } else {
    5307             :     // Copy all keys and values in enumeration order.
    5308             :     Handle<NameDictionary> properties =
    5309           0 :         Handle<NameDictionary>(from->property_dictionary(), isolate());
    5310             :     Handle<FixedArray> key_indices =
    5311           0 :         NameDictionary::IterationIndices(isolate(), properties);
    5312             :     ReadOnlyRoots roots(isolate());
    5313           0 :     for (int i = 0; i < key_indices->length(); i++) {
    5314             :       int key_index = Smi::ToInt(key_indices->get(i));
    5315           0 :       Object raw_key = properties->KeyAt(key_index);
    5316             :       DCHECK(properties->IsKey(roots, raw_key));
    5317             :       DCHECK(raw_key->IsName());
    5318             :       Handle<Name> key(Name::cast(raw_key), isolate());
    5319             :       // If the property is already there we skip it.
    5320           0 :       if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5321             :       // Set the property.
    5322             :       Handle<Object> value =
    5323           0 :           Handle<Object>(properties->ValueAt(key_index), isolate());
    5324             :       DCHECK(!value->IsCell());
    5325             :       DCHECK(!value->IsTheHole(isolate()));
    5326           0 :       PropertyDetails details = properties->DetailsAt(key_index);
    5327             :       DCHECK_EQ(kData, details.kind());
    5328           0 :       JSObject::AddProperty(isolate(), to, key, value, details.attributes());
    5329             :     }
    5330             :   }
    5331      201855 : }
    5332             : 
    5333             : 
    5334      201857 : void Genesis::TransferIndexedProperties(Handle<JSObject> from,
    5335             :                                         Handle<JSObject> to) {
    5336             :   // Cloning the elements array is sufficient.
    5337             :   Handle<FixedArray> from_elements =
    5338             :       Handle<FixedArray>(FixedArray::cast(from->elements()), isolate());
    5339      201857 :   Handle<FixedArray> to_elements = factory()->CopyFixedArray(from_elements);
    5340      403714 :   to->set_elements(*to_elements);
    5341      201857 : }
    5342             : 
    5343             : 
    5344      111528 : void Genesis::TransferObject(Handle<JSObject> from, Handle<JSObject> to) {
    5345             :   HandleScope outer(isolate());
    5346             : 
    5347             :   DCHECK(!from->IsJSArray());
    5348             :   DCHECK(!to->IsJSArray());
    5349             : 
    5350      111528 :   TransferNamedProperties(from, to);
    5351      111528 :   TransferIndexedProperties(from, to);
    5352             : 
    5353             :   // Transfer the prototype (new map is needed).
    5354             :   Handle<Object> proto(from->map()->prototype(), isolate());
    5355      111528 :   JSObject::ForceSetPrototype(to, proto);
    5356      111528 : }
    5357             : 
    5358       90479 : Genesis::Genesis(
    5359             :     Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5360             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    5361             :     size_t context_snapshot_index,
    5362             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer,
    5363             :     v8::MicrotaskQueue* microtask_queue)
    5364       90479 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5365       90479 :   RuntimeCallTimerScope rcs_timer(isolate, RuntimeCallCounterId::kGenesis);
    5366       90479 :   result_ = Handle<Context>::null();
    5367       90479 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5368             : 
    5369             :   // Before creating the roots we must save the context and restore it
    5370             :   // on all function exits.
    5371      180959 :   SaveContext saved_context(isolate);
    5372             : 
    5373             :   // The deserializer needs to hook up references to the global proxy.
    5374             :   // Create an uninitialized global proxy now if we don't have one
    5375             :   // and initialize it later in CreateNewGlobals.
    5376             :   Handle<JSGlobalProxy> global_proxy;
    5377       90479 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5378             :     int instance_size = 0;
    5379       90410 :     if (context_snapshot_index > 0) {
    5380             :       // The global proxy function to reinitialize this global proxy is in the
    5381             :       // context that is yet to be deserialized. We need to prepare a global
    5382             :       // proxy of the correct size.
    5383             :       Object size = isolate->heap()->serialized_global_proxy_sizes()->get(
    5384          35 :           static_cast<int>(context_snapshot_index) - 1);
    5385             :       instance_size = Smi::ToInt(size);
    5386             :     } else {
    5387       90375 :       instance_size = JSGlobalProxy::SizeWithEmbedderFields(
    5388             :           global_proxy_template.IsEmpty()
    5389             :               ? 0
    5390             :               : global_proxy_template->InternalFieldCount());
    5391             :     }
    5392             :     global_proxy =
    5393       90410 :         isolate->factory()->NewUninitializedJSGlobalProxy(instance_size);
    5394             :   }
    5395             : 
    5396             :   // We can only de-serialize a context if the isolate was initialized from
    5397             :   // a snapshot. Otherwise we have to build the context from scratch.
    5398             :   // Also create a context from scratch to expose natives, if required by flag.
    5399             :   DCHECK(native_context_.is_null());
    5400       90480 :   if (isolate->initialized_from_snapshot()) {
    5401             :     Handle<Context> context;
    5402      180828 :     if (Snapshot::NewContextFromSnapshot(isolate, global_proxy,
    5403             :                                          context_snapshot_index,
    5404             :                                          embedder_fields_deserializer)
    5405             :             .ToHandle(&context)) {
    5406       90369 :       native_context_ = Handle<NativeContext>::cast(context);
    5407             :     }
    5408             :   }
    5409             : 
    5410       90480 :   if (!native_context().is_null()) {
    5411       90369 :     AddToWeakNativeContextList(isolate, *native_context());
    5412             :     isolate->set_context(*native_context());
    5413       90369 :     isolate->counters()->contexts_created_by_snapshot()->Increment();
    5414             : 
    5415       90369 :     if (context_snapshot_index == 0) {
    5416             :       Handle<JSGlobalObject> global_object =
    5417       90329 :           CreateNewGlobals(global_proxy_template, global_proxy);
    5418       90329 :       HookUpGlobalObject(global_object);
    5419             : 
    5420       90329 :       if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5421             :     } else {
    5422             :       // The global proxy needs to be integrated into the native context.
    5423          40 :       HookUpGlobalProxy(global_proxy);
    5424             :     }
    5425             :     DCHECK(!global_proxy->IsDetachedFrom(native_context()->global_object()));
    5426             :   } else {
    5427             :     base::ElapsedTimer timer;
    5428         111 :     if (FLAG_profile_deserialization) timer.Start();
    5429             :     DCHECK_EQ(0u, context_snapshot_index);
    5430             :     // We get here if there was no context snapshot.
    5431         111 :     CreateRoots();
    5432         111 :     MathRandom::InitializeContext(isolate, native_context());
    5433         111 :     Handle<JSFunction> empty_function = CreateEmptyFunction();
    5434         111 :     CreateSloppyModeFunctionMaps(empty_function);
    5435         111 :     CreateStrictModeFunctionMaps(empty_function);
    5436         111 :     CreateObjectFunction(empty_function);
    5437         111 :     CreateIteratorMaps(empty_function);
    5438         111 :     CreateAsyncIteratorMaps(empty_function);
    5439         111 :     CreateAsyncFunctionMaps(empty_function);
    5440             :     Handle<JSGlobalObject> global_object =
    5441         111 :         CreateNewGlobals(global_proxy_template, global_proxy);
    5442         111 :     InitializeGlobal(global_object, empty_function);
    5443         111 :     InitializeNormalizedMapCaches();
    5444         111 :     InitializeIteratorFunctions();
    5445         111 :     InitializeCallSiteBuiltins();
    5446             : 
    5447         111 :     if (!InstallNatives()) return;
    5448         111 :     if (!InstallExtraNatives()) return;
    5449         111 :     if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5450             : 
    5451         111 :     isolate->counters()->contexts_created_from_scratch()->Increment();
    5452             : 
    5453         111 :     if (FLAG_profile_deserialization) {
    5454           0 :       double ms = timer.Elapsed().InMillisecondsF();
    5455           0 :       PrintF("[Initializing context from scratch took %0.3f ms]\n", ms);
    5456             :     }
    5457             :   }
    5458             : 
    5459       90480 :   native_context()->set_microtask_queue(
    5460             :       microtask_queue ? static_cast<MicrotaskQueue*>(microtask_queue)
    5461             :                       : isolate->default_microtask_queue());
    5462             : 
    5463             :   // Install experimental natives. Do not include them into the
    5464             :   // snapshot as we should be able to turn them off at runtime. Re-installing
    5465             :   // them after they have already been deserialized would also fail.
    5466       90480 :     if (!isolate->serializer_enabled()) {
    5467       90174 :       InitializeExperimentalGlobal();
    5468             : 
    5469             :       // Store String.prototype's map again in case it has been changed by
    5470             :       // experimental natives.
    5471      180348 :       Handle<JSFunction> string_function(native_context()->string_function(),
    5472       90174 :                                          isolate);
    5473             :       JSObject string_function_prototype =
    5474             :           JSObject::cast(string_function->initial_map()->prototype());
    5475             :       DCHECK(string_function_prototype->HasFastProperties());
    5476      180348 :       native_context()->set_string_function_prototype_map(
    5477       90174 :           string_function_prototype->map());
    5478             :     }
    5479             : 
    5480       90480 :   if (FLAG_disallow_code_generation_from_strings) {
    5481          18 :     native_context()->set_allow_code_gen_from_strings(
    5482          27 :         ReadOnlyRoots(isolate).false_value());
    5483             :   }
    5484             : 
    5485       90480 :   ConfigureUtilsObject();
    5486             : 
    5487             :   // We created new functions, which may require debug instrumentation.
    5488       90480 :   if (isolate->debug()->is_active()) {
    5489         150 :     isolate->debug()->InstallDebugBreakTrampoline();
    5490             :   }
    5491             : 
    5492       90480 :   native_context()->ResetErrorsThrown();
    5493       90480 :   result_ = native_context();
    5494             : }
    5495             : 
    5496          18 : Genesis::Genesis(Isolate* isolate,
    5497             :                  MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5498             :                  v8::Local<v8::ObjectTemplate> global_proxy_template)
    5499          18 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5500          18 :   result_ = Handle<Context>::null();
    5501          18 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5502             : 
    5503             :   // Before creating the roots we must save the context and restore it
    5504             :   // on all function exits.
    5505          36 :   SaveContext saved_context(isolate);
    5506             : 
    5507          18 :   const int proxy_size = JSGlobalProxy::SizeWithEmbedderFields(
    5508             :       global_proxy_template->InternalFieldCount());
    5509             : 
    5510             :   Handle<JSGlobalProxy> global_proxy;
    5511          18 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5512          13 :     global_proxy = factory()->NewUninitializedJSGlobalProxy(proxy_size);
    5513             :   }
    5514             : 
    5515             :   // Create a remote object as the global object.
    5516             :   Handle<ObjectTemplateInfo> global_proxy_data =
    5517             :       Utils::OpenHandle(*global_proxy_template);
    5518             :   Handle<FunctionTemplateInfo> global_constructor(
    5519             :       FunctionTemplateInfo::cast(global_proxy_data->constructor()), isolate);
    5520             : 
    5521             :   Handle<ObjectTemplateInfo> global_object_template(
    5522             :       ObjectTemplateInfo::cast(global_constructor->GetPrototypeTemplate()),
    5523          36 :       isolate);
    5524             :   Handle<JSObject> global_object =
    5525          36 :       ApiNatives::InstantiateRemoteObject(
    5526             :           global_object_template).ToHandleChecked();
    5527             : 
    5528             :   // (Re)initialize the global proxy object.
    5529             :   DCHECK_EQ(global_proxy_data->embedder_field_count(),
    5530             :             global_proxy_template->InternalFieldCount());
    5531             :   Handle<Map> global_proxy_map = isolate->factory()->NewMap(
    5532          18 :       JS_GLOBAL_PROXY_TYPE, proxy_size, TERMINAL_FAST_ELEMENTS_KIND);
    5533             :   global_proxy_map->set_is_access_check_needed(true);
    5534          18 :   global_proxy_map->set_has_hidden_prototype(true);
    5535          18 :   global_proxy_map->set_may_have_interesting_symbols(true);
    5536             : 
    5537             :   // A remote global proxy has no native context.
    5538          36 :   global_proxy->set_native_context(ReadOnlyRoots(heap()).null_value());
    5539             : 
    5540             :   // Configure the hidden prototype chain of the global proxy.
    5541          18 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5542          36 :   global_proxy->map()->SetConstructor(*global_constructor);
    5543             :   // TODO(dcheng): This is a hack. Why does this need to be manually called
    5544             :   // here? Line 4812 should have taken care of it?
    5545          18 :   global_proxy->map()->set_has_hidden_prototype(true);
    5546             : 
    5547          18 :   global_proxy_ = global_proxy;
    5548          18 : }
    5549             : 
    5550             : // Support for thread preemption.
    5551             : 
    5552             : // Reserve space for statics needing saving and restoring.
    5553        1133 : int Bootstrapper::ArchiveSpacePerThread() {
    5554        1133 :   return sizeof(NestingCounterType);
    5555             : }
    5556             : 
    5557             : 
    5558             : // Archive statics that are thread-local.
    5559       32437 : char* Bootstrapper::ArchiveState(char* to) {
    5560       32437 :   *reinterpret_cast<NestingCounterType*>(to) = nesting_;
    5561       32437 :   nesting_ = 0;
    5562       32437 :   return to + sizeof(NestingCounterType);
    5563             : }
    5564             : 
    5565             : 
    5566             : // Restore statics that are thread-local.
    5567       32437 : char* Bootstrapper::RestoreState(char* from) {
    5568       32437 :   nesting_ = *reinterpret_cast<NestingCounterType*>(from);
    5569       32437 :   return from + sizeof(NestingCounterType);
    5570             : }
    5571             : 
    5572             : 
    5573             : // Called when the top-level V8 mutex is destroyed.
    5574        5918 : void Bootstrapper::FreeThreadResources() {
    5575             :   DCHECK(!IsActive());
    5576        5918 : }
    5577             : 
    5578             : }  // namespace internal
    5579      120216 : }  // namespace v8

Generated by: LCOV version 1.10