LCOV - code coverage report
Current view: top level - src - bootstrapper.cc (source / functions) Hit Total Coverage
Test: app.info Lines: 2076 2122 97.8 %
Date: 2019-02-19 Functions: 102 119 85.7 %

          Line data    Source code
       1             : // Copyright 2014 the V8 project authors. All rights reserved.
       2             : // Use of this source code is governed by a BSD-style license that can be
       3             : // found in the LICENSE file.
       4             : 
       5             : #include "src/bootstrapper.h"
       6             : 
       7             : #include "src/accessors.h"
       8             : #include "src/api-inl.h"
       9             : #include "src/api-natives.h"
      10             : #include "src/base/ieee754.h"
      11             : #include "src/compiler.h"
      12             : #include "src/counters.h"
      13             : #include "src/debug/debug.h"
      14             : #include "src/extensions/externalize-string-extension.h"
      15             : #include "src/extensions/free-buffer-extension.h"
      16             : #include "src/extensions/gc-extension.h"
      17             : #include "src/extensions/ignition-statistics-extension.h"
      18             : #include "src/extensions/statistics-extension.h"
      19             : #include "src/extensions/trigger-failure-extension.h"
      20             : #include "src/function-kind.h"
      21             : #include "src/heap/heap-inl.h"
      22             : #include "src/isolate-inl.h"
      23             : #include "src/math-random.h"
      24             : #include "src/objects/api-callbacks.h"
      25             : #include "src/objects/arguments.h"
      26             : #include "src/objects/builtin-function-id.h"
      27             : #include "src/objects/hash-table-inl.h"
      28             : #ifdef V8_INTL_SUPPORT
      29             : #include "src/objects/intl-objects.h"
      30             : #endif  // V8_INTL_SUPPORT
      31             : #include "src/objects/js-array-buffer-inl.h"
      32             : #include "src/objects/js-array-inl.h"
      33             : #ifdef V8_INTL_SUPPORT
      34             : #include "src/objects/js-break-iterator.h"
      35             : #include "src/objects/js-collator.h"
      36             : #include "src/objects/js-date-time-format.h"
      37             : #include "src/objects/js-list-format.h"
      38             : #include "src/objects/js-locale.h"
      39             : #include "src/objects/js-number-format.h"
      40             : #include "src/objects/js-plural-rules.h"
      41             : #endif  // V8_INTL_SUPPORT
      42             : #include "src/objects/js-regexp-string-iterator.h"
      43             : #include "src/objects/js-regexp.h"
      44             : #ifdef V8_INTL_SUPPORT
      45             : #include "src/objects/js-relative-time-format.h"
      46             : #include "src/objects/js-segment-iterator.h"
      47             : #include "src/objects/js-segmenter.h"
      48             : #endif  // V8_INTL_SUPPORT
      49             : #include "src/objects/js-weak-refs.h"
      50             : #include "src/objects/property-cell.h"
      51             : #include "src/objects/slots-inl.h"
      52             : #include "src/objects/templates.h"
      53             : #include "src/snapshot/natives.h"
      54             : #include "src/snapshot/snapshot.h"
      55             : #include "src/wasm/wasm-js.h"
      56             : 
      57             : namespace v8 {
      58             : namespace internal {
      59             : 
      60      122082 : void SourceCodeCache::Initialize(Isolate* isolate, bool create_heap_objects) {
      61             :   cache_ = create_heap_objects ? ReadOnlyRoots(isolate).empty_fixed_array()
      62      122138 :                                : FixedArray();
      63      122082 : }
      64             : 
      65           0 : void SourceCodeCache::Iterate(RootVisitor* v) {
      66      561674 :   v->VisitRootPointer(Root::kExtensions, nullptr, FullObjectSlot(&cache_));
      67           0 : }
      68             : 
      69        4450 : bool SourceCodeCache::Lookup(Isolate* isolate, Vector<const char> name,
      70             :                              Handle<SharedFunctionInfo>* handle) {
      71       20594 :   for (int i = 0; i < cache_->length(); i += 2) {
      72        7089 :     SeqOneByteString str = SeqOneByteString::cast(cache_->get(i));
      73        7089 :     if (str->IsUtf8EqualTo(name)) {
      74             :       *handle = Handle<SharedFunctionInfo>(
      75        2484 :           SharedFunctionInfo::cast(cache_->get(i + 1)), isolate);
      76        1242 :       return true;
      77             :     }
      78             :   }
      79             :   return false;
      80             : }
      81             : 
      82        3175 : void SourceCodeCache::Add(Isolate* isolate, Vector<const char> name,
      83             :                           Handle<SharedFunctionInfo> shared) {
      84             :   Factory* factory = isolate->factory();
      85             :   HandleScope scope(isolate);
      86             :   int length = cache_->length();
      87        3176 :   Handle<FixedArray> new_array = factory->NewFixedArray(length + 2, TENURED);
      88        3176 :   cache_->CopyTo(0, *new_array, 0, cache_->length());
      89        3179 :   cache_ = *new_array;
      90             :   Handle<String> str =
      91             :       factory->NewStringFromOneByte(Vector<const uint8_t>::cast(name), TENURED)
      92        6355 :           .ToHandleChecked();
      93             :   DCHECK(!str.is_null());
      94        3176 :   cache_->set(length, *str);
      95        3177 :   cache_->set(length + 1, *shared);
      96        9534 :   Script::cast(shared->script())->set_type(type_);
      97        3174 : }
      98             : 
      99       61049 : Bootstrapper::Bootstrapper(Isolate* isolate)
     100             :     : isolate_(isolate),
     101             :       nesting_(0),
     102      122098 :       extensions_cache_(Script::TYPE_EXTENSION) {}
     103             : 
     104         111 : Handle<String> Bootstrapper::GetNativeSource(NativeType type, int index) {
     105             :   NativesExternalStringResource* resource =
     106         111 :       new NativesExternalStringResource(type, index);
     107             :   Handle<ExternalOneByteString> source_code =
     108         111 :       isolate_->factory()->NewNativeSourceString(resource);
     109             :   DCHECK(source_code->is_uncached());
     110         111 :   return source_code;
     111             : }
     112             : 
     113       61049 : void Bootstrapper::Initialize(bool create_heap_objects) {
     114       61049 :   extensions_cache_.Initialize(isolate_, create_heap_objects);
     115       61049 : }
     116             : 
     117             : 
     118             : static const char* GCFunctionName() {
     119             :   bool flag_given =
     120       59583 :       FLAG_expose_gc_as != nullptr && strlen(FLAG_expose_gc_as) != 0;
     121       59583 :   return flag_given ? FLAG_expose_gc_as : "gc";
     122             : }
     123             : 
     124       59583 : void Bootstrapper::InitializeOncePerProcess() {
     125      238332 :   v8::RegisterExtension(v8::base::make_unique<FreeBufferExtension>());
     126      238332 :   v8::RegisterExtension(v8::base::make_unique<GCExtension>(GCFunctionName()));
     127      238332 :   v8::RegisterExtension(v8::base::make_unique<ExternalizeStringExtension>());
     128      238332 :   v8::RegisterExtension(v8::base::make_unique<StatisticsExtension>());
     129      238332 :   v8::RegisterExtension(v8::base::make_unique<TriggerFailureExtension>());
     130      238332 :   v8::RegisterExtension(v8::base::make_unique<IgnitionStatisticsExtension>());
     131       59583 : }
     132             : 
     133       61033 : void Bootstrapper::TearDown() {
     134       61033 :   extensions_cache_.Initialize(isolate_, false);  // Yes, symmetrical
     135       61033 : }
     136             : 
     137             : class Genesis {
     138             :  public:
     139             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     140             :           v8::Local<v8::ObjectTemplate> global_proxy_template,
     141             :           size_t context_snapshot_index,
     142             :           v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer);
     143             :   Genesis(Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     144             :           v8::Local<v8::ObjectTemplate> global_proxy_template);
     145             :   ~Genesis() = default;
     146             : 
     147             :   Isolate* isolate() const { return isolate_; }
     148             :   Factory* factory() const { return isolate_->factory(); }
     149             :   Builtins* builtins() const { return isolate_->builtins(); }
     150             :   Heap* heap() const { return isolate_->heap(); }
     151             : 
     152             :   Handle<Context> result() { return result_; }
     153             : 
     154             :   Handle<JSGlobalProxy> global_proxy() { return global_proxy_; }
     155             : 
     156             :  private:
     157             :   Handle<NativeContext> native_context() { return native_context_; }
     158             : 
     159             :   // Creates some basic objects. Used for creating a context from scratch.
     160             :   void CreateRoots();
     161             :   // Creates the empty function.  Used for creating a context from scratch.
     162             :   Handle<JSFunction> CreateEmptyFunction();
     163             :   // Returns the %ThrowTypeError% intrinsic function.
     164             :   // See ES#sec-%throwtypeerror% for details.
     165             :   Handle<JSFunction> GetThrowTypeErrorIntrinsic();
     166             : 
     167             :   void CreateSloppyModeFunctionMaps(Handle<JSFunction> empty);
     168             :   void CreateStrictModeFunctionMaps(Handle<JSFunction> empty);
     169             :   void CreateObjectFunction(Handle<JSFunction> empty);
     170             :   void CreateIteratorMaps(Handle<JSFunction> empty);
     171             :   void CreateAsyncIteratorMaps(Handle<JSFunction> empty);
     172             :   void CreateAsyncFunctionMaps(Handle<JSFunction> empty);
     173             :   void CreateJSProxyMaps();
     174             : 
     175             :   // Make the "arguments" and "caller" properties throw a TypeError on access.
     176             :   void AddRestrictedFunctionProperties(Handle<JSFunction> empty);
     177             : 
     178             :   // Creates the global objects using the global proxy and the template passed
     179             :   // in through the API.  We call this regardless of whether we are building a
     180             :   // context from scratch or using a deserialized one from the partial snapshot
     181             :   // but in the latter case we don't use the objects it produces directly, as
     182             :   // we have to use the deserialized ones that are linked together with the
     183             :   // rest of the context snapshot. At the end we link the global proxy and the
     184             :   // context to each other.
     185             :   Handle<JSGlobalObject> CreateNewGlobals(
     186             :       v8::Local<v8::ObjectTemplate> global_proxy_template,
     187             :       Handle<JSGlobalProxy> global_proxy);
     188             :   // Similarly, we want to use the global that has been created by the templates
     189             :   // passed through the API.  The global from the snapshot is detached from the
     190             :   // other objects in the snapshot.
     191             :   void HookUpGlobalObject(Handle<JSGlobalObject> global_object);
     192             :   // Hooks the given global proxy into the context in the case we do not
     193             :   // replace the global object from the deserialized native context.
     194             :   void HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy);
     195             :   // The native context has a ScriptContextTable that store declarative bindings
     196             :   // made in script scopes.  Add a "this" binding to that table pointing to the
     197             :   // global proxy.
     198             :   void InstallGlobalThisBinding();
     199             :   // New context initialization.  Used for creating a context from scratch.
     200             :   void InitializeGlobal(Handle<JSGlobalObject> global_object,
     201             :                         Handle<JSFunction> empty_function);
     202             :   void InitializeExperimentalGlobal();
     203             :   void InitializeIteratorFunctions();
     204             :   void InitializeCallSiteBuiltins();
     205             :   // Depending on the situation, expose and/or get rid of the utils object.
     206             :   void ConfigureUtilsObject();
     207             : 
     208             : #define DECLARE_FEATURE_INITIALIZATION(id, descr) \
     209             :   void InitializeGlobal_##id();
     210             : 
     211             :   HARMONY_INPROGRESS(DECLARE_FEATURE_INITIALIZATION)
     212             :   HARMONY_STAGED(DECLARE_FEATURE_INITIALIZATION)
     213             :   HARMONY_SHIPPING(DECLARE_FEATURE_INITIALIZATION)
     214             : #undef DECLARE_FEATURE_INITIALIZATION
     215             : 
     216             :   enum ArrayBufferKind {
     217             :     ARRAY_BUFFER,
     218             :     SHARED_ARRAY_BUFFER,
     219             :   };
     220             :   Handle<JSFunction> CreateArrayBuffer(Handle<String> name,
     221             :                                        ArrayBufferKind array_buffer_kind);
     222             :   void InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
     223             :                                           const char* name);
     224             :   void InstallInternalPackedArray(Handle<JSObject> target, const char* name);
     225             :   bool InstallNatives();
     226             : 
     227             :   Handle<JSFunction> InstallTypedArray(const char* name,
     228             :                                        ElementsKind elements_kind);
     229             :   bool InstallExtraNatives();
     230             :   void InstallBuiltinFunctionIds();
     231             :   void InitializeNormalizedMapCaches();
     232             : 
     233             :   enum ExtensionTraversalState {
     234             :     UNVISITED, VISITED, INSTALLED
     235             :   };
     236             : 
     237             :   class ExtensionStates {
     238             :    public:
     239             :     ExtensionStates();
     240             :     ExtensionTraversalState get_state(RegisteredExtension* extension);
     241             :     void set_state(RegisteredExtension* extension,
     242             :                    ExtensionTraversalState state);
     243             :    private:
     244             :     base::HashMap map_;
     245             :     DISALLOW_COPY_AND_ASSIGN(ExtensionStates);
     246             :   };
     247             : 
     248             :   // Used both for deserialized and from-scratch contexts to add the extensions
     249             :   // provided.
     250             :   static bool InstallExtensions(Isolate* isolate,
     251             :                                 Handle<Context> native_context,
     252             :                                 v8::ExtensionConfiguration* extensions);
     253             :   static bool InstallAutoExtensions(Isolate* isolate,
     254             :                                     ExtensionStates* extension_states);
     255             :   static bool InstallRequestedExtensions(Isolate* isolate,
     256             :                                          v8::ExtensionConfiguration* extensions,
     257             :                                          ExtensionStates* extension_states);
     258             :   static bool InstallExtension(Isolate* isolate,
     259             :                                const char* name,
     260             :                                ExtensionStates* extension_states);
     261             :   static bool InstallExtension(Isolate* isolate,
     262             :                                v8::RegisteredExtension* current,
     263             :                                ExtensionStates* extension_states);
     264             :   static bool InstallSpecialObjects(Isolate* isolate,
     265             :                                     Handle<Context> native_context);
     266             :   bool ConfigureApiObject(Handle<JSObject> object,
     267             :                           Handle<ObjectTemplateInfo> object_template);
     268             :   bool ConfigureGlobalObjects(
     269             :       v8::Local<v8::ObjectTemplate> global_proxy_template);
     270             : 
     271             :   // Migrates all properties from the 'from' object to the 'to'
     272             :   // object and overrides the prototype in 'to' with the one from
     273             :   // 'from'.
     274             :   void TransferObject(Handle<JSObject> from, Handle<JSObject> to);
     275             :   void TransferNamedProperties(Handle<JSObject> from, Handle<JSObject> to);
     276             :   void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);
     277             : 
     278             :   static bool CompileExtension(Isolate* isolate, v8::Extension* extension);
     279             : 
     280             :   Isolate* isolate_;
     281             :   Handle<Context> result_;
     282             :   Handle<NativeContext> native_context_;
     283             :   Handle<JSGlobalProxy> global_proxy_;
     284             : 
     285             :   // Temporary function maps needed only during bootstrapping.
     286             :   Handle<Map> strict_function_with_home_object_map_;
     287             :   Handle<Map> strict_function_with_name_and_home_object_map_;
     288             : 
     289             :   // %ThrowTypeError%. See ES#sec-%throwtypeerror% for details.
     290             :   Handle<JSFunction> restricted_properties_thrower_;
     291             : 
     292             :   BootstrapperActive active_;
     293             :   friend class Bootstrapper;
     294             : };
     295             : 
     296      280837 : void Bootstrapper::Iterate(RootVisitor* v) {
     297             :   extensions_cache_.Iterate(v);
     298      280837 :   v->Synchronize(VisitorSynchronization::kExtensions);
     299      280837 : }
     300             : 
     301       89797 : Handle<Context> Bootstrapper::CreateEnvironment(
     302             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     303             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
     304             :     v8::ExtensionConfiguration* extensions, size_t context_snapshot_index,
     305             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer) {
     306       89797 :   HandleScope scope(isolate_);
     307             :   Handle<Context> env;
     308             :   {
     309             :     Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template,
     310       89797 :                     context_snapshot_index, embedder_fields_deserializer);
     311             :     env = genesis.result();
     312       89797 :     if (env.is_null() || !InstallExtensions(env, extensions)) {
     313          40 :       return Handle<Context>();
     314             :     }
     315             :   }
     316       89757 :   LogAllMaps();
     317       89757 :   isolate_->heap()->NotifyBootstrapComplete();
     318       89757 :   return scope.CloseAndEscape(env);
     319             : }
     320             : 
     321          18 : Handle<JSGlobalProxy> Bootstrapper::NewRemoteContext(
     322             :     MaybeHandle<JSGlobalProxy> maybe_global_proxy,
     323             :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
     324          18 :   HandleScope scope(isolate_);
     325             :   Handle<JSGlobalProxy> global_proxy;
     326             :   {
     327          18 :     Genesis genesis(isolate_, maybe_global_proxy, global_proxy_template);
     328             :     global_proxy = genesis.global_proxy();
     329          18 :     if (global_proxy.is_null()) return Handle<JSGlobalProxy>();
     330             :   }
     331          18 :   LogAllMaps();
     332          18 :   return scope.CloseAndEscape(global_proxy);
     333             : }
     334             : 
     335       89775 : void Bootstrapper::LogAllMaps() {
     336      179550 :   if (!FLAG_trace_maps || isolate_->initialized_from_snapshot()) return;
     337             :   // Log all created Map objects that are on the heap. For snapshots the Map
     338             :   // logging happens during deserialization in order to avoid printing Maps
     339             :   // multiple times during partial deserialization.
     340           0 :   LOG(isolate_, LogAllMaps());
     341             : }
     342             : 
     343         107 : void Bootstrapper::DetachGlobal(Handle<Context> env) {
     344             :   isolate_->counters()->errors_thrown_per_context()->AddSample(
     345         214 :       env->GetErrorsThrown());
     346             : 
     347         107 :   ReadOnlyRoots roots(isolate_);
     348         214 :   Handle<JSGlobalProxy> global_proxy(JSGlobalProxy::cast(env->global_proxy()),
     349         214 :                                      isolate_);
     350         214 :   global_proxy->set_native_context(roots.null_value());
     351         214 :   JSObject::ForceSetPrototype(global_proxy, isolate_->factory()->null_value());
     352         214 :   global_proxy->map()->SetConstructor(roots.null_value());
     353         107 :   if (FLAG_track_detached_contexts) {
     354         107 :     isolate_->AddDetachedContext(env);
     355             :   }
     356         107 : }
     357             : 
     358             : namespace {
     359             : 
     360        1887 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateSharedFunctionInfo(
     361             :     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len,
     362             :     FunctionKind kind = FunctionKind::kNormalFunction) {
     363             :   Handle<SharedFunctionInfo> shared =
     364             :       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
     365        3774 :                                                           kind);
     366             :   shared->set_internal_formal_parameter_count(len);
     367             :   shared->set_length(len);
     368        1887 :   return shared;
     369             : }
     370             : 
     371         111 : V8_NOINLINE Handle<SharedFunctionInfo> SimpleCreateBuiltinSharedFunctionInfo(
     372             :     Isolate* isolate, Builtins::Name builtin_id, Handle<String> name, int len) {
     373             :   Handle<SharedFunctionInfo> shared =
     374             :       isolate->factory()->NewSharedFunctionInfoForBuiltin(name, builtin_id,
     375         111 :                                                           kNormalFunction);
     376             :   shared->set_internal_formal_parameter_count(len);
     377             :   shared->set_length(len);
     378         111 :   return shared;
     379             : }
     380             : 
     381       98029 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     382             :     Isolate* isolate, Handle<String> name, InstanceType type, int instance_size,
     383             :     int inobject_properties, Handle<Object> prototype,
     384             :     Builtins::Name builtin_id) {
     385             :   Handle<JSFunction> result;
     386             : 
     387             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
     388             :       name, prototype, type, instance_size, inobject_properties, builtin_id,
     389       98029 :       IMMUTABLE);
     390             : 
     391       98029 :   result = isolate->factory()->NewFunction(args);
     392             :   // Make the JSFunction's prototype object fast.
     393             :   JSObject::MakePrototypesFast(handle(result->prototype(), isolate),
     394      196058 :                                kStartAtReceiver, isolate);
     395             : 
     396             :   // Make the resulting JSFunction object fast.
     397       98029 :   JSObject::MakePrototypesFast(result, kStartAtReceiver, isolate);
     398       98029 :   result->shared()->set_native(true);
     399       98029 :   return result;
     400             : }
     401             : 
     402       90162 : V8_NOINLINE Handle<JSFunction> CreateFunction(
     403             :     Isolate* isolate, const char* name, InstanceType type, int instance_size,
     404             :     int inobject_properties, Handle<Object> prototype,
     405             :     Builtins::Name builtin_id) {
     406             :   return CreateFunction(
     407             :       isolate, isolate->factory()->InternalizeUtf8String(name), type,
     408       90162 :       instance_size, inobject_properties, prototype, builtin_id);
     409             : }
     410             : 
     411        5550 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     412             :     Isolate* isolate, Handle<JSObject> target, Handle<String> name,
     413             :     InstanceType type, int instance_size, int inobject_properties,
     414             :     Handle<Object> prototype, Builtins::Name call) {
     415             :   Handle<JSFunction> function = CreateFunction(
     416        5550 :       isolate, name, type, instance_size, inobject_properties, prototype, call);
     417        5550 :   JSObject::AddProperty(isolate, target, name, function, DONT_ENUM);
     418        5550 :   return function;
     419             : }
     420             : 
     421        4440 : V8_NOINLINE Handle<JSFunction> InstallFunction(
     422             :     Isolate* isolate, Handle<JSObject> target, const char* name,
     423             :     InstanceType type, int instance_size, int inobject_properties,
     424             :     Handle<Object> prototype, Builtins::Name call) {
     425             :   return InstallFunction(isolate, target,
     426             :                          isolate->factory()->InternalizeUtf8String(name), type,
     427        4440 :                          instance_size, inobject_properties, prototype, call);
     428             : }
     429             : 
     430      423658 : V8_NOINLINE Handle<JSFunction> SimpleCreateFunction(Isolate* isolate,
     431             :                                                     Handle<String> name,
     432             :                                                     Builtins::Name call,
     433             :                                                     int len, bool adapt) {
     434             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
     435      423658 :       name, call, LanguageMode::kStrict);
     436      423658 :   Handle<JSFunction> fun = isolate->factory()->NewFunction(args);
     437             :   // Make the resulting JSFunction object fast.
     438      423658 :   JSObject::MakePrototypesFast(fun, kStartAtReceiver, isolate);
     439      423658 :   fun->shared()->set_native(true);
     440             : 
     441      423658 :   if (adapt) {
     442      600046 :     fun->shared()->set_internal_formal_parameter_count(len);
     443             :   } else {
     444      247270 :     fun->shared()->DontAdaptArguments();
     445             :   }
     446      847316 :   fun->shared()->set_length(len);
     447      423658 :   return fun;
     448             : }
     449             : 
     450        3108 : V8_NOINLINE Handle<JSFunction> InstallFunctionWithBuiltinId(
     451             :     Isolate* isolate, Handle<JSObject> base, const char* name,
     452             :     Builtins::Name call, int len, bool adapt, BuiltinFunctionId id) {
     453             :   DCHECK_NE(BuiltinFunctionId::kInvalidBuiltinFunctionId, id);
     454             :   Handle<String> internalized_name =
     455        3108 :       isolate->factory()->InternalizeUtf8String(name);
     456             :   Handle<JSFunction> fun =
     457        3108 :       SimpleCreateFunction(isolate, internalized_name, call, len, adapt);
     458        6216 :   fun->shared()->set_builtin_function_id(id);
     459        3108 :   JSObject::AddProperty(isolate, base, internalized_name, fun, DONT_ENUM);
     460        3108 :   return fun;
     461             : }
     462             : 
     463      318529 : V8_NOINLINE Handle<JSFunction> SimpleInstallFunction(
     464             :     Isolate* isolate, Handle<JSObject> base, const char* name,
     465             :     Builtins::Name call, int len, bool adapt,
     466             :     PropertyAttributes attrs = DONT_ENUM) {
     467             :   // Although function name does not have to be internalized the property name
     468             :   // will be internalized during property addition anyway, so do it here now.
     469             :   Handle<String> internalized_name =
     470      318529 :       isolate->factory()->InternalizeUtf8String(name);
     471             :   Handle<JSFunction> fun =
     472      318529 :       SimpleCreateFunction(isolate, internalized_name, call, len, adapt);
     473      318529 :   JSObject::AddProperty(isolate, base, internalized_name, fun, attrs);
     474      318529 :   return fun;
     475             : }
     476             : 
     477       90606 : V8_NOINLINE Handle<JSFunction> InstallFunctionAtSymbol(
     478             :     Isolate* isolate, Handle<JSObject> base, Handle<Symbol> symbol,
     479             :     const char* symbol_string, Builtins::Name call, int len, bool adapt,
     480             :     PropertyAttributes attrs = DONT_ENUM,
     481             :     BuiltinFunctionId id = BuiltinFunctionId::kInvalidBuiltinFunctionId) {
     482             :   Handle<String> internalized_symbol =
     483       90606 :       isolate->factory()->InternalizeUtf8String(symbol_string);
     484             :   Handle<JSFunction> fun =
     485       90606 :       SimpleCreateFunction(isolate, internalized_symbol, call, len, adapt);
     486       90606 :   if (id != BuiltinFunctionId::kInvalidBuiltinFunctionId) {
     487         444 :     fun->shared()->set_builtin_function_id(id);
     488             :   }
     489       90606 :   JSObject::AddProperty(isolate, base, symbol, fun, attrs);
     490       90606 :   return fun;
     491             : }
     492             : 
     493        2220 : V8_NOINLINE void SimpleInstallGetterSetter(Isolate* isolate,
     494             :                                            Handle<JSObject> base,
     495             :                                            Handle<String> name,
     496             :                                            Builtins::Name call_getter,
     497             :                                            Builtins::Name call_setter) {
     498             :   Handle<String> getter_name =
     499        2220 :       Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
     500        4440 :           .ToHandleChecked();
     501             :   Handle<JSFunction> getter =
     502        2220 :       SimpleCreateFunction(isolate, getter_name, call_getter, 0, true);
     503             : 
     504             :   Handle<String> setter_name =
     505        2220 :       Name::ToFunctionName(isolate, name, isolate->factory()->set_string())
     506        4440 :           .ToHandleChecked();
     507             :   Handle<JSFunction> setter =
     508        2220 :       SimpleCreateFunction(isolate, setter_name, call_setter, 1, true);
     509             : 
     510        4440 :   JSObject::DefineAccessor(base, name, getter, setter, DONT_ENUM).Check();
     511        2220 : }
     512             : 
     513        1998 : void SimpleInstallGetterSetter(Isolate* isolate, Handle<JSObject> base,
     514             :                                const char* name, Builtins::Name call_getter,
     515             :                                Builtins::Name call_setter) {
     516             :   SimpleInstallGetterSetter(isolate, base,
     517             :                             isolate->factory()->InternalizeUtf8String(name),
     518        1998 :                             call_getter, call_setter);
     519        1998 : }
     520             : 
     521        6087 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
     522             :     Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
     523             :     Handle<Name> property_name, Builtins::Name call, bool adapt) {
     524             :   Handle<String> getter_name =
     525             :       Name::ToFunctionName(isolate, name, isolate->factory()->get_string())
     526       12174 :           .ToHandleChecked();
     527             :   Handle<JSFunction> getter =
     528        6087 :       SimpleCreateFunction(isolate, getter_name, call, 0, adapt);
     529             : 
     530             :   Handle<Object> setter = isolate->factory()->undefined_value();
     531             : 
     532        6087 :   JSObject::DefineAccessor(base, property_name, getter, setter, DONT_ENUM)
     533       12174 :       .Check();
     534             : 
     535        6087 :   return getter;
     536             : }
     537             : 
     538        5199 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(Isolate* isolate,
     539             :                                                    Handle<JSObject> base,
     540             :                                                    Handle<Name> name,
     541             :                                                    Builtins::Name call,
     542             :                                                    bool adapt) {
     543        5199 :   return SimpleInstallGetter(isolate, base, name, name, call, adapt);
     544             : }
     545             : 
     546        1221 : V8_NOINLINE Handle<JSFunction> SimpleInstallGetter(
     547             :     Isolate* isolate, Handle<JSObject> base, Handle<Name> name,
     548             :     Builtins::Name call, bool adapt, BuiltinFunctionId id) {
     549             :   Handle<JSFunction> fun =
     550        1221 :       SimpleInstallGetter(isolate, base, name, call, adapt);
     551        2442 :   fun->shared()->set_builtin_function_id(id);
     552        1221 :   return fun;
     553             : }
     554             : 
     555       95379 : V8_NOINLINE void InstallConstant(Isolate* isolate, Handle<JSObject> holder,
     556             :                                  const char* name, Handle<Object> value) {
     557             :   JSObject::AddProperty(
     558             :       isolate, holder, isolate->factory()->InternalizeUtf8String(name), value,
     559      190758 :       static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY));
     560       95379 : }
     561             : 
     562        1110 : V8_NOINLINE void InstallTrueValuedProperty(Isolate* isolate,
     563             :                                            Handle<JSObject> holder,
     564             :                                            const char* name) {
     565             :   JSObject::AddProperty(isolate, holder,
     566             :                         isolate->factory()->InternalizeUtf8String(name),
     567        2220 :                         isolate->factory()->true_value(), NONE);
     568        1110 : }
     569             : 
     570         888 : V8_NOINLINE void InstallSpeciesGetter(Isolate* isolate,
     571             :                                       Handle<JSFunction> constructor) {
     572             :   Factory* factory = isolate->factory();
     573             :   // TODO(adamk): We should be able to share a SharedFunctionInfo
     574             :   // between all these JSFunctins.
     575             :   SimpleInstallGetter(isolate, constructor, factory->symbol_species_string(),
     576             :                       factory->species_symbol(), Builtins::kReturnReceiver,
     577         888 :                       true);
     578         888 : }
     579             : 
     580      184839 : V8_NOINLINE void InstallToStringTag(Isolate* isolate, Handle<JSObject> holder,
     581             :                                     Handle<String> value) {
     582             :   JSObject::AddProperty(isolate, holder,
     583             :                         isolate->factory()->to_string_tag_symbol(), value,
     584      184839 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     585      184839 : }
     586             : 
     587      181745 : void InstallToStringTag(Isolate* isolate, Handle<JSObject> holder,
     588             :                         const char* value) {
     589             :   InstallToStringTag(isolate, holder,
     590      181745 :                      isolate->factory()->InternalizeUtf8String(value));
     591      181745 : }
     592             : 
     593             : }  // namespace
     594             : 
     595         999 : Handle<JSFunction> Genesis::CreateEmptyFunction() {
     596             :   // Allocate the function map first and then patch the prototype later.
     597             :   Handle<Map> empty_function_map = factory()->CreateSloppyFunctionMap(
     598         222 :       FUNCTION_WITHOUT_PROTOTYPE, MaybeHandle<JSFunction>());
     599             :   empty_function_map->set_is_prototype_map(true);
     600             :   DCHECK(!empty_function_map->is_dictionary_map());
     601             : 
     602             :   // Allocate ScopeInfo for the empty function.
     603         111 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateForEmptyFunction(isolate());
     604             : 
     605             :   // Allocate the empty function as the prototype for function according to
     606             :   // ES#sec-properties-of-the-function-prototype-object
     607             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
     608         111 :       factory()->empty_string(), empty_function_map, Builtins::kEmptyFunction);
     609         111 :   Handle<JSFunction> empty_function = factory()->NewFunction(args);
     610         111 :   native_context()->set_empty_function(*empty_function);
     611             : 
     612             :   // --- E m p t y ---
     613         111 :   Handle<String> source = factory()->NewStringFromStaticChars("() {}");
     614         111 :   Handle<Script> script = factory()->NewScript(source);
     615             :   script->set_type(Script::TYPE_NATIVE);
     616         111 :   Handle<WeakFixedArray> infos = factory()->NewWeakFixedArray(2);
     617         111 :   script->set_shared_function_infos(*infos);
     618         111 :   empty_function->shared()->set_scope_info(*scope_info);
     619         222 :   empty_function->shared()->DontAdaptArguments();
     620             :   SharedFunctionInfo::SetScript(handle(empty_function->shared(), isolate()),
     621         222 :                                 script, 1);
     622             : 
     623         111 :   return empty_function;
     624             : }
     625             : 
     626         111 : void Genesis::CreateSloppyModeFunctionMaps(Handle<JSFunction> empty) {
     627         111 :   Factory* factory = isolate_->factory();
     628             :   Handle<Map> map;
     629             : 
     630             :   //
     631             :   // Allocate maps for sloppy functions without prototype.
     632             :   //
     633         111 :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     634         111 :   native_context()->set_sloppy_function_without_prototype_map(*map);
     635             : 
     636             :   //
     637             :   // Allocate maps for sloppy functions with readonly prototype.
     638             :   //
     639             :   map =
     640         111 :       factory->CreateSloppyFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     641         111 :   native_context()->set_sloppy_function_with_readonly_prototype_map(*map);
     642             : 
     643             :   //
     644             :   // Allocate maps for sloppy functions with writable prototype.
     645             :   //
     646             :   map = factory->CreateSloppyFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     647         111 :                                          empty);
     648         111 :   native_context()->set_sloppy_function_map(*map);
     649             : 
     650             :   map = factory->CreateSloppyFunctionMap(
     651         111 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     652         111 :   native_context()->set_sloppy_function_with_name_map(*map);
     653         111 : }
     654             : 
     655         777 : Handle<JSFunction> Genesis::GetThrowTypeErrorIntrinsic() {
     656         222 :   if (!restricted_properties_thrower_.is_null()) {
     657         111 :     return restricted_properties_thrower_;
     658             :   }
     659         111 :   Handle<String> name = factory()->empty_string();
     660             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
     661         111 :       name, Builtins::kStrictPoisonPillThrower, i::LanguageMode::kStrict);
     662         111 :   Handle<JSFunction> function = factory()->NewFunction(args);
     663         222 :   function->shared()->DontAdaptArguments();
     664             : 
     665             :   // %ThrowTypeError% must not have a name property.
     666         111 :   if (JSReceiver::DeleteProperty(function, factory()->name_string())
     667         111 :           .IsNothing()) {
     668             :     DCHECK(false);
     669             :   }
     670             : 
     671             :   // length needs to be non configurable.
     672         222 :   Handle<Object> value(Smi::FromInt(function->shared()->GetLength()),
     673             :                        isolate());
     674             :   JSObject::SetOwnPropertyIgnoreAttributes(
     675             :       function, factory()->length_string(), value,
     676         111 :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))
     677         111 :       .Assert();
     678             : 
     679         111 :   if (JSObject::PreventExtensions(function, kThrowOnError).IsNothing()) {
     680             :     DCHECK(false);
     681             :   }
     682             : 
     683         111 :   JSObject::MigrateSlowToFast(function, 0, "Bootstrapping");
     684             : 
     685         111 :   restricted_properties_thrower_ = function;
     686         111 :   return function;
     687             : }
     688             : 
     689         111 : void Genesis::CreateStrictModeFunctionMaps(Handle<JSFunction> empty) {
     690         111 :   Factory* factory = isolate_->factory();
     691             :   Handle<Map> map;
     692             : 
     693             :   //
     694             :   // Allocate maps for strict functions without prototype.
     695             :   //
     696         111 :   map = factory->CreateStrictFunctionMap(FUNCTION_WITHOUT_PROTOTYPE, empty);
     697         111 :   native_context()->set_strict_function_without_prototype_map(*map);
     698             : 
     699         111 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_NAME, empty);
     700         111 :   native_context()->set_method_with_name_map(*map);
     701             : 
     702         111 :   map = factory->CreateStrictFunctionMap(METHOD_WITH_HOME_OBJECT, empty);
     703         111 :   native_context()->set_method_with_home_object_map(*map);
     704             : 
     705             :   map =
     706         111 :       factory->CreateStrictFunctionMap(METHOD_WITH_NAME_AND_HOME_OBJECT, empty);
     707         111 :   native_context()->set_method_with_name_and_home_object_map(*map);
     708             : 
     709             :   //
     710             :   // Allocate maps for strict functions with writable prototype.
     711             :   //
     712             :   map = factory->CreateStrictFunctionMap(FUNCTION_WITH_WRITEABLE_PROTOTYPE,
     713         111 :                                          empty);
     714         111 :   native_context()->set_strict_function_map(*map);
     715             : 
     716             :   map = factory->CreateStrictFunctionMap(
     717         111 :       FUNCTION_WITH_NAME_AND_WRITEABLE_PROTOTYPE, empty);
     718         111 :   native_context()->set_strict_function_with_name_map(*map);
     719             : 
     720             :   strict_function_with_home_object_map_ = factory->CreateStrictFunctionMap(
     721         111 :       FUNCTION_WITH_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     722             :   strict_function_with_name_and_home_object_map_ =
     723             :       factory->CreateStrictFunctionMap(
     724         111 :           FUNCTION_WITH_NAME_AND_HOME_OBJECT_AND_WRITEABLE_PROTOTYPE, empty);
     725             : 
     726             :   //
     727             :   // Allocate maps for strict functions with readonly prototype.
     728             :   //
     729             :   map =
     730         111 :       factory->CreateStrictFunctionMap(FUNCTION_WITH_READONLY_PROTOTYPE, empty);
     731         111 :   native_context()->set_strict_function_with_readonly_prototype_map(*map);
     732             : 
     733             :   //
     734             :   // Allocate map for class functions.
     735             :   //
     736         111 :   map = factory->CreateClassFunctionMap(empty);
     737         111 :   native_context()->set_class_function_map(*map);
     738             : 
     739             :   // Now that the strict mode function map is available, set up the
     740             :   // restricted "arguments" and "caller" getters.
     741         111 :   AddRestrictedFunctionProperties(empty);
     742         111 : }
     743             : 
     744         888 : void Genesis::CreateObjectFunction(Handle<JSFunction> empty_function) {
     745         111 :   Factory* factory = isolate_->factory();
     746             : 
     747             :   // --- O b j e c t ---
     748             :   int inobject_properties = JSObject::kInitialGlobalObjectUnusedPropertiesCount;
     749             :   int instance_size = JSObject::kHeaderSize + kTaggedSize * inobject_properties;
     750             : 
     751             :   Handle<JSFunction> object_fun = CreateFunction(
     752             :       isolate_, factory->Object_string(), JS_OBJECT_TYPE, instance_size,
     753         111 :       inobject_properties, factory->null_value(), Builtins::kObjectConstructor);
     754         222 :   object_fun->shared()->set_length(1);
     755         222 :   object_fun->shared()->DontAdaptArguments();
     756         111 :   native_context()->set_object_function(*object_fun);
     757             : 
     758             :   {
     759             :     // Finish setting up Object function's initial map.
     760         111 :     Map initial_map = object_fun->initial_map();
     761         111 :     initial_map->set_elements_kind(HOLEY_ELEMENTS);
     762             :   }
     763             : 
     764             :   // Allocate a new prototype for the object function.
     765             :   Handle<JSObject> object_function_prototype =
     766         111 :       factory->NewFunctionPrototype(object_fun);
     767             : 
     768             :   Handle<Map> map =
     769             :       Map::Copy(isolate(), handle(object_function_prototype->map(), isolate()),
     770         111 :                 "EmptyObjectPrototype");
     771             :   map->set_is_prototype_map(true);
     772             :   // Ban re-setting Object.prototype.__proto__ to prevent Proxy security bug
     773         111 :   map->set_is_immutable_proto(true);
     774         111 :   object_function_prototype->set_map(*map);
     775             : 
     776             :   // Complete setting up empty function.
     777             :   {
     778         111 :     Handle<Map> empty_function_map(empty_function->map(), isolate_);
     779         111 :     Map::SetPrototype(isolate(), empty_function_map, object_function_prototype);
     780             :   }
     781             : 
     782         111 :   native_context()->set_initial_object_prototype(*object_function_prototype);
     783         111 :   JSFunction::SetPrototype(object_fun, object_function_prototype);
     784             : 
     785             :   {
     786             :     // Set up slow map for Object.create(null) instances without in-object
     787             :     // properties.
     788         333 :     Handle<Map> map(object_fun->initial_map(), isolate_);
     789         111 :     map = Map::CopyInitialMapNormalized(isolate(), map);
     790         111 :     Map::SetPrototype(isolate(), map, factory->null_value());
     791         111 :     native_context()->set_slow_object_with_null_prototype_map(*map);
     792             : 
     793             :     // Set up slow map for literals with too many properties.
     794         111 :     map = Map::Copy(isolate(), map, "slow_object_with_object_prototype_map");
     795         111 :     Map::SetPrototype(isolate(), map, object_function_prototype);
     796         111 :     native_context()->set_slow_object_with_object_prototype_map(*map);
     797             :   }
     798         111 : }
     799             : 
     800             : namespace {
     801             : 
     802         888 : Handle<Map> CreateNonConstructorMap(Isolate* isolate, Handle<Map> source_map,
     803             :                                     Handle<JSObject> prototype,
     804             :                                     const char* reason) {
     805         888 :   Handle<Map> map = Map::Copy(isolate, source_map, reason);
     806             :   // Ensure the resulting map has prototype slot (it is necessary for storing
     807             :   // inital map even when the prototype property is not required).
     808         888 :   if (!map->has_prototype_slot()) {
     809             :     // Re-set the unused property fields after changing the instance size.
     810             :     // TODO(ulan): Do not change instance size after map creation.
     811           0 :     int unused_property_fields = map->UnusedPropertyFields();
     812           0 :     map->set_instance_size(map->instance_size() + kTaggedSize);
     813             :     // The prototype slot shifts the in-object properties area by one slot.
     814             :     map->SetInObjectPropertiesStartInWords(
     815           0 :         map->GetInObjectPropertiesStartInWords() + 1);
     816             :     map->set_has_prototype_slot(true);
     817           0 :     map->SetInObjectUnusedPropertyFields(unused_property_fields);
     818             :   }
     819             :   map->set_is_constructor(false);
     820         888 :   Map::SetPrototype(isolate, map, prototype);
     821         888 :   return map;
     822             : }
     823             : 
     824             : }  // namespace
     825             : 
     826        2664 : void Genesis::CreateIteratorMaps(Handle<JSFunction> empty) {
     827             :   // Create iterator-related meta-objects.
     828             :   Handle<JSObject> iterator_prototype =
     829         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     830             : 
     831             :   InstallFunctionAtSymbol(isolate(), iterator_prototype,
     832             :                           factory()->iterator_symbol(), "[Symbol.iterator]",
     833         111 :                           Builtins::kReturnReceiver, 0, true);
     834         111 :   native_context()->set_initial_iterator_prototype(*iterator_prototype);
     835             : 
     836             :   Handle<JSObject> generator_object_prototype =
     837         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     838         222 :   native_context()->set_initial_generator_prototype(
     839         111 :       *generator_object_prototype);
     840         111 :   JSObject::ForceSetPrototype(generator_object_prototype, iterator_prototype);
     841             :   Handle<JSObject> generator_function_prototype =
     842         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     843         111 :   JSObject::ForceSetPrototype(generator_function_prototype, empty);
     844             : 
     845             :   InstallToStringTag(isolate(), generator_function_prototype,
     846         111 :                      "GeneratorFunction");
     847             :   JSObject::AddProperty(isolate(), generator_function_prototype,
     848             :                         factory()->prototype_string(),
     849             :                         generator_object_prototype,
     850         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     851             : 
     852             :   JSObject::AddProperty(isolate(), generator_object_prototype,
     853             :                         factory()->constructor_string(),
     854             :                         generator_function_prototype,
     855         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     856         111 :   InstallToStringTag(isolate(), generator_object_prototype, "Generator");
     857             :   SimpleInstallFunction(isolate(), generator_object_prototype, "next",
     858         111 :                         Builtins::kGeneratorPrototypeNext, 1, false);
     859             :   SimpleInstallFunction(isolate(), generator_object_prototype, "return",
     860         111 :                         Builtins::kGeneratorPrototypeReturn, 1, false);
     861             :   SimpleInstallFunction(isolate(), generator_object_prototype, "throw",
     862         111 :                         Builtins::kGeneratorPrototypeThrow, 1, false);
     863             : 
     864             :   // Internal version of generator_prototype_next, flagged as non-native such
     865             :   // that it doesn't show up in Error traces.
     866             :   Handle<JSFunction> generator_next_internal =
     867             :       SimpleCreateFunction(isolate(), factory()->next_string(),
     868         111 :                            Builtins::kGeneratorPrototypeNext, 1, false);
     869         111 :   generator_next_internal->shared()->set_native(false);
     870         111 :   native_context()->set_generator_next_internal(*generator_next_internal);
     871             : 
     872             :   // Create maps for generator functions and their prototypes.  Store those
     873             :   // maps in the native context. The "prototype" property descriptor is
     874             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     875             :   // 04-14-15, section 25.2.4.3).
     876             :   // Generator functions do not have "caller" or "arguments" accessors.
     877             :   Handle<Map> map;
     878             :   map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
     879             :                                 generator_function_prototype,
     880         222 :                                 "GeneratorFunction");
     881         111 :   native_context()->set_generator_function_map(*map);
     882             : 
     883             :   map = CreateNonConstructorMap(
     884             :       isolate(), isolate()->strict_function_with_name_map(),
     885         222 :       generator_function_prototype, "GeneratorFunction with name");
     886         111 :   native_context()->set_generator_function_with_name_map(*map);
     887             : 
     888             :   map = CreateNonConstructorMap(
     889             :       isolate(), strict_function_with_home_object_map_,
     890         111 :       generator_function_prototype, "GeneratorFunction with home object");
     891         111 :   native_context()->set_generator_function_with_home_object_map(*map);
     892             : 
     893             :   map = CreateNonConstructorMap(isolate(),
     894             :                                 strict_function_with_name_and_home_object_map_,
     895             :                                 generator_function_prototype,
     896         111 :                                 "GeneratorFunction with name and home object");
     897         111 :   native_context()->set_generator_function_with_name_and_home_object_map(*map);
     898             : 
     899         222 :   Handle<JSFunction> object_function(native_context()->object_function(),
     900         111 :                                      isolate());
     901         111 :   Handle<Map> generator_object_prototype_map = Map::Create(isolate(), 0);
     902             :   Map::SetPrototype(isolate(), generator_object_prototype_map,
     903         111 :                     generator_object_prototype);
     904         222 :   native_context()->set_generator_object_prototype_map(
     905         111 :       *generator_object_prototype_map);
     906         111 : }
     907             : 
     908        3441 : void Genesis::CreateAsyncIteratorMaps(Handle<JSFunction> empty) {
     909             :   // %AsyncIteratorPrototype%
     910             :   // proposal-async-iteration/#sec-asynciteratorprototype
     911             :   Handle<JSObject> async_iterator_prototype =
     912         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     913             : 
     914             :   InstallFunctionAtSymbol(
     915             :       isolate(), async_iterator_prototype, factory()->async_iterator_symbol(),
     916         111 :       "[Symbol.asyncIterator]", Builtins::kReturnReceiver, 0, true);
     917             : 
     918             :   // %AsyncFromSyncIteratorPrototype%
     919             :   // proposal-async-iteration/#sec-%asyncfromsynciteratorprototype%-object
     920             :   Handle<JSObject> async_from_sync_iterator_prototype =
     921         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     922             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "next",
     923         111 :                         Builtins::kAsyncFromSyncIteratorPrototypeNext, 1, true);
     924             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "return",
     925             :                         Builtins::kAsyncFromSyncIteratorPrototypeReturn, 1,
     926         111 :                         true);
     927             :   SimpleInstallFunction(isolate(), async_from_sync_iterator_prototype, "throw",
     928             :                         Builtins::kAsyncFromSyncIteratorPrototypeThrow, 1,
     929         111 :                         true);
     930             : 
     931             :   InstallToStringTag(isolate(), async_from_sync_iterator_prototype,
     932         111 :                      "Async-from-Sync Iterator");
     933             : 
     934             :   JSObject::ForceSetPrototype(async_from_sync_iterator_prototype,
     935         111 :                               async_iterator_prototype);
     936             : 
     937             :   Handle<Map> async_from_sync_iterator_map = factory()->NewMap(
     938         111 :       JS_ASYNC_FROM_SYNC_ITERATOR_TYPE, JSAsyncFromSyncIterator::kSize);
     939             :   Map::SetPrototype(isolate(), async_from_sync_iterator_map,
     940         111 :                     async_from_sync_iterator_prototype);
     941         222 :   native_context()->set_async_from_sync_iterator_map(
     942         111 :       *async_from_sync_iterator_map);
     943             : 
     944             :   // Async Generators
     945             :   Handle<JSObject> async_generator_object_prototype =
     946         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     947             :   Handle<JSObject> async_generator_function_prototype =
     948         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
     949             : 
     950             :   // %AsyncGenerator% / %AsyncGeneratorFunction%.prototype
     951         111 :   JSObject::ForceSetPrototype(async_generator_function_prototype, empty);
     952             : 
     953             :   // The value of AsyncGeneratorFunction.prototype.prototype is the
     954             :   //     %AsyncGeneratorPrototype% intrinsic object.
     955             :   // This property has the attributes
     956             :   //     { [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.
     957             :   JSObject::AddProperty(isolate(), async_generator_function_prototype,
     958             :                         factory()->prototype_string(),
     959             :                         async_generator_object_prototype,
     960         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     961             :   JSObject::AddProperty(isolate(), async_generator_object_prototype,
     962             :                         factory()->constructor_string(),
     963             :                         async_generator_function_prototype,
     964         111 :                         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
     965             :   InstallToStringTag(isolate(), async_generator_function_prototype,
     966         111 :                      "AsyncGeneratorFunction");
     967             : 
     968             :   // %AsyncGeneratorPrototype%
     969             :   JSObject::ForceSetPrototype(async_generator_object_prototype,
     970         111 :                               async_iterator_prototype);
     971         222 :   native_context()->set_initial_async_generator_prototype(
     972         111 :       *async_generator_object_prototype);
     973             : 
     974             :   InstallToStringTag(isolate(), async_generator_object_prototype,
     975         111 :                      "AsyncGenerator");
     976             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "next",
     977         111 :                         Builtins::kAsyncGeneratorPrototypeNext, 1, false);
     978             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "return",
     979         111 :                         Builtins::kAsyncGeneratorPrototypeReturn, 1, false);
     980             :   SimpleInstallFunction(isolate(), async_generator_object_prototype, "throw",
     981         111 :                         Builtins::kAsyncGeneratorPrototypeThrow, 1, false);
     982             : 
     983             :   // Create maps for generator functions and their prototypes.  Store those
     984             :   // maps in the native context. The "prototype" property descriptor is
     985             :   // writable, non-enumerable, and non-configurable (as per ES6 draft
     986             :   // 04-14-15, section 25.2.4.3).
     987             :   // Async Generator functions do not have "caller" or "arguments" accessors.
     988             :   Handle<Map> map;
     989             :   map = CreateNonConstructorMap(isolate(), isolate()->strict_function_map(),
     990             :                                 async_generator_function_prototype,
     991         222 :                                 "AsyncGeneratorFunction");
     992         111 :   native_context()->set_async_generator_function_map(*map);
     993             : 
     994             :   map = CreateNonConstructorMap(
     995             :       isolate(), isolate()->strict_function_with_name_map(),
     996         222 :       async_generator_function_prototype, "AsyncGeneratorFunction with name");
     997         111 :   native_context()->set_async_generator_function_with_name_map(*map);
     998             : 
     999             :   map =
    1000             :       CreateNonConstructorMap(isolate(), strict_function_with_home_object_map_,
    1001             :                               async_generator_function_prototype,
    1002         111 :                               "AsyncGeneratorFunction with home object");
    1003         111 :   native_context()->set_async_generator_function_with_home_object_map(*map);
    1004             : 
    1005             :   map = CreateNonConstructorMap(
    1006             :       isolate(), strict_function_with_name_and_home_object_map_,
    1007             :       async_generator_function_prototype,
    1008         111 :       "AsyncGeneratorFunction with name and home object");
    1009         222 :   native_context()->set_async_generator_function_with_name_and_home_object_map(
    1010         111 :       *map);
    1011             : 
    1012         222 :   Handle<JSFunction> object_function(native_context()->object_function(),
    1013         111 :                                      isolate());
    1014         111 :   Handle<Map> async_generator_object_prototype_map = Map::Create(isolate(), 0);
    1015             :   Map::SetPrototype(isolate(), async_generator_object_prototype_map,
    1016         111 :                     async_generator_object_prototype);
    1017         222 :   native_context()->set_async_generator_object_prototype_map(
    1018         111 :       *async_generator_object_prototype_map);
    1019         111 : }
    1020             : 
    1021        1665 : void Genesis::CreateAsyncFunctionMaps(Handle<JSFunction> empty) {
    1022             :   // %AsyncFunctionPrototype% intrinsic
    1023             :   Handle<JSObject> async_function_prototype =
    1024         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    1025         111 :   JSObject::ForceSetPrototype(async_function_prototype, empty);
    1026             : 
    1027         111 :   InstallToStringTag(isolate(), async_function_prototype, "AsyncFunction");
    1028             : 
    1029             :   Handle<Map> map =
    1030             :       Map::Copy(isolate(), isolate()->strict_function_without_prototype_map(),
    1031         222 :                 "AsyncFunction");
    1032         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1033         111 :   native_context()->set_async_function_map(*map);
    1034             : 
    1035             :   map = Map::Copy(isolate(), isolate()->method_with_name_map(),
    1036         222 :                   "AsyncFunction with name");
    1037         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1038         111 :   native_context()->set_async_function_with_name_map(*map);
    1039             : 
    1040             :   map = Map::Copy(isolate(), isolate()->method_with_home_object_map(),
    1041         222 :                   "AsyncFunction with home object");
    1042         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1043         111 :   native_context()->set_async_function_with_home_object_map(*map);
    1044             : 
    1045             :   map = Map::Copy(isolate(), isolate()->method_with_name_and_home_object_map(),
    1046         222 :                   "AsyncFunction with name and home object");
    1047         111 :   Map::SetPrototype(isolate(), map, async_function_prototype);
    1048         111 :   native_context()->set_async_function_with_name_and_home_object_map(*map);
    1049         111 : }
    1050             : 
    1051         888 : void Genesis::CreateJSProxyMaps() {
    1052             :   // Allocate maps for all Proxy types.
    1053             :   // Next to the default proxy, we need maps indicating callable and
    1054             :   // constructable proxies.
    1055             :   Handle<Map> proxy_map = factory()->NewMap(JS_PROXY_TYPE, JSProxy::kSize,
    1056         111 :                                             TERMINAL_FAST_ELEMENTS_KIND);
    1057         111 :   proxy_map->set_is_dictionary_map(true);
    1058         111 :   proxy_map->set_may_have_interesting_symbols(true);
    1059         111 :   native_context()->set_proxy_map(*proxy_map);
    1060             : 
    1061             :   Handle<Map> proxy_callable_map =
    1062         111 :       Map::Copy(isolate_, proxy_map, "callable Proxy");
    1063             :   proxy_callable_map->set_is_callable(true);
    1064         111 :   native_context()->set_proxy_callable_map(*proxy_callable_map);
    1065         222 :   proxy_callable_map->SetConstructor(native_context()->function_function());
    1066             : 
    1067             :   Handle<Map> proxy_constructor_map =
    1068         111 :       Map::Copy(isolate_, proxy_callable_map, "constructor Proxy");
    1069             :   proxy_constructor_map->set_is_constructor(true);
    1070         111 :   native_context()->set_proxy_constructor_map(*proxy_constructor_map);
    1071             : 
    1072             :   {
    1073             :     Handle<Map> map =
    1074             :         factory()->NewMap(JS_OBJECT_TYPE, JSProxyRevocableResult::kSize,
    1075         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 2);
    1076         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    1077             : 
    1078             :     {  // proxy
    1079             :       Descriptor d = Descriptor::DataField(isolate(), factory()->proxy_string(),
    1080             :                                            JSProxyRevocableResult::kProxyIndex,
    1081         111 :                                            NONE, Representation::Tagged());
    1082         111 :       map->AppendDescriptor(isolate(), &d);
    1083             :     }
    1084             :     {  // revoke
    1085             :       Descriptor d = Descriptor::DataField(
    1086             :           isolate(), factory()->revoke_string(),
    1087         111 :           JSProxyRevocableResult::kRevokeIndex, NONE, Representation::Tagged());
    1088         111 :       map->AppendDescriptor(isolate(), &d);
    1089             :     }
    1090             : 
    1091         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    1092         222 :     map->SetConstructor(native_context()->object_function());
    1093             : 
    1094         111 :     native_context()->set_proxy_revocable_result_map(*map);
    1095             :   }
    1096         111 : }
    1097             : 
    1098             : namespace {
    1099         222 : void ReplaceAccessors(Isolate* isolate, Handle<Map> map, Handle<String> name,
    1100             :                       PropertyAttributes attributes,
    1101             :                       Handle<AccessorPair> accessor_pair) {
    1102         222 :   DescriptorArray descriptors = map->instance_descriptors();
    1103             :   int idx = descriptors->SearchWithCache(isolate, *name, *map);
    1104         222 :   Descriptor d = Descriptor::AccessorConstant(name, accessor_pair, attributes);
    1105         222 :   descriptors->Replace(idx, &d);
    1106         222 : }
    1107             : }  // namespace
    1108             : 
    1109         555 : void Genesis::AddRestrictedFunctionProperties(Handle<JSFunction> empty) {
    1110             :   PropertyAttributes rw_attribs = static_cast<PropertyAttributes>(DONT_ENUM);
    1111         111 :   Handle<JSFunction> thrower = GetThrowTypeErrorIntrinsic();
    1112         111 :   Handle<AccessorPair> accessors = factory()->NewAccessorPair();
    1113         222 :   accessors->set_getter(*thrower);
    1114         222 :   accessors->set_setter(*thrower);
    1115             : 
    1116             :   Handle<Map> map(empty->map(), isolate());
    1117             :   ReplaceAccessors(isolate(), map, factory()->arguments_string(), rw_attribs,
    1118         111 :                    accessors);
    1119             :   ReplaceAccessors(isolate(), map, factory()->caller_string(), rw_attribs,
    1120         111 :                    accessors);
    1121         111 : }
    1122             : 
    1123       89797 : static void AddToWeakNativeContextList(Isolate* isolate, Context context) {
    1124             :   DCHECK(context->IsNativeContext());
    1125             :   Heap* heap = isolate->heap();
    1126             : #ifdef DEBUG
    1127             :   { // NOLINT
    1128             :     DCHECK(context->next_context_link()->IsUndefined(isolate));
    1129             :     // Check that context is not in the list yet.
    1130             :     for (Object current = heap->native_contexts_list();
    1131             :          !current->IsUndefined(isolate);
    1132             :          current = Context::cast(current)->next_context_link()) {
    1133             :       DCHECK(current != context);
    1134             :     }
    1135             :   }
    1136             : #endif
    1137             :   context->set(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list(),
    1138             :                UPDATE_WEAK_WRITE_BARRIER);
    1139             :   heap->set_native_contexts_list(context);
    1140       89797 : }
    1141             : 
    1142             : 
    1143         444 : void Genesis::CreateRoots() {
    1144             :   // Allocate the native context FixedArray first and then patch the
    1145             :   // closure and extension object later (we need the empty function
    1146             :   // and the global object, but in order to create those, we need the
    1147             :   // native context).
    1148         111 :   native_context_ = factory()->NewNativeContext();
    1149         222 :   AddToWeakNativeContextList(isolate(), *native_context());
    1150             :   isolate()->set_context(*native_context());
    1151             : 
    1152             :   // Allocate the message listeners object.
    1153             :   {
    1154         111 :     Handle<TemplateList> list = TemplateList::New(isolate(), 1);
    1155         111 :     native_context()->set_message_listeners(*list);
    1156             :   }
    1157         111 : }
    1158             : 
    1159             : 
    1160         333 : void Genesis::InstallGlobalThisBinding() {
    1161             :   Handle<ScriptContextTable> script_contexts(
    1162         222 :       native_context()->script_context_table(), isolate());
    1163         111 :   Handle<ScopeInfo> scope_info = ScopeInfo::CreateGlobalThisBinding(isolate());
    1164             :   Handle<Context> context =
    1165         111 :       factory()->NewScriptContext(native_context(), scope_info);
    1166             : 
    1167             :   // Go ahead and hook it up while we're at it.
    1168         111 :   int slot = scope_info->ReceiverContextSlotIndex();
    1169             :   DCHECK_EQ(slot, Context::MIN_CONTEXT_SLOTS);
    1170         333 :   context->set(slot, native_context()->global_proxy());
    1171             : 
    1172             :   Handle<ScriptContextTable> new_script_contexts =
    1173         111 :       ScriptContextTable::Extend(script_contexts, context);
    1174         111 :   native_context()->set_script_context_table(*new_script_contexts);
    1175         111 : }
    1176             : 
    1177             : 
    1178       89757 : Handle<JSGlobalObject> Genesis::CreateNewGlobals(
    1179             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    1180      738698 :     Handle<JSGlobalProxy> global_proxy) {
    1181             :   // The argument global_proxy_template aka data is an ObjectTemplateInfo.
    1182             :   // It has a constructor pointer that points at global_constructor which is a
    1183             :   // FunctionTemplateInfo.
    1184             :   // The global_proxy_constructor is used to (re)initialize the
    1185             :   // global_proxy. The global_proxy_constructor also has a prototype_template
    1186             :   // pointer that points at js_global_object_template which is an
    1187             :   // ObjectTemplateInfo.
    1188             :   // That in turn has a constructor pointer that points at
    1189             :   // js_global_object_constructor which is a FunctionTemplateInfo.
    1190             :   // js_global_object_constructor is used to make js_global_object_function
    1191             :   // js_global_object_function is used to make the new global_object.
    1192             :   //
    1193             :   // --- G l o b a l ---
    1194             :   // Step 1: Create a fresh JSGlobalObject.
    1195             :   Handle<JSFunction> js_global_object_function;
    1196             :   Handle<ObjectTemplateInfo> js_global_object_template;
    1197       89757 :   if (!global_proxy_template.IsEmpty()) {
    1198             :     // Get prototype template of the global_proxy_template.
    1199             :     Handle<ObjectTemplateInfo> data =
    1200             :         v8::Utils::OpenHandle(*global_proxy_template);
    1201             :     Handle<FunctionTemplateInfo> global_constructor =
    1202             :         Handle<FunctionTemplateInfo>(
    1203             :             FunctionTemplateInfo::cast(data->constructor()), isolate());
    1204             :     Handle<Object> proto_template(global_constructor->GetPrototypeTemplate(),
    1205      110400 :                                   isolate());
    1206      110400 :     if (!proto_template->IsUndefined(isolate())) {
    1207             :       js_global_object_template =
    1208       55200 :           Handle<ObjectTemplateInfo>::cast(proto_template);
    1209             :     }
    1210             :   }
    1211             : 
    1212       89757 :   if (js_global_object_template.is_null()) {
    1213       34557 :     Handle<String> name = factory()->empty_string();
    1214             :     Handle<JSObject> prototype =
    1215       69114 :         factory()->NewFunctionPrototype(isolate()->object_function());
    1216             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1217             :         name, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize, 0,
    1218       34557 :         Builtins::kIllegal, MUTABLE);
    1219       34557 :     js_global_object_function = factory()->NewFunction(args);
    1220             : #ifdef DEBUG
    1221             :     LookupIterator it(isolate(), prototype, factory()->constructor_string(),
    1222             :                       LookupIterator::OWN_SKIP_INTERCEPTOR);
    1223             :     Handle<Object> value = Object::GetProperty(&it).ToHandleChecked();
    1224             :     DCHECK(it.IsFound());
    1225             :     DCHECK_EQ(*isolate()->object_function(), *value);
    1226             : #endif
    1227             :   } else {
    1228             :     Handle<FunctionTemplateInfo> js_global_object_constructor(
    1229             :         FunctionTemplateInfo::cast(js_global_object_template->constructor()),
    1230             :         isolate());
    1231             :     js_global_object_function = ApiNatives::CreateApiFunction(
    1232             :         isolate(), js_global_object_constructor, factory()->the_hole_value(),
    1233      110400 :         JS_GLOBAL_OBJECT_TYPE);
    1234             :   }
    1235             : 
    1236      179514 :   js_global_object_function->initial_map()->set_is_prototype_map(true);
    1237       89757 :   js_global_object_function->initial_map()->set_is_dictionary_map(true);
    1238      179514 :   js_global_object_function->initial_map()->set_may_have_interesting_symbols(
    1239       89757 :       true);
    1240             :   Handle<JSGlobalObject> global_object =
    1241       89757 :       factory()->NewJSGlobalObject(js_global_object_function);
    1242             : 
    1243             :   // Step 2: (re)initialize the global proxy object.
    1244             :   Handle<JSFunction> global_proxy_function;
    1245       89757 :   if (global_proxy_template.IsEmpty()) {
    1246       34557 :     Handle<String> name = factory()->empty_string();
    1247             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1248             :         name, factory()->the_hole_value(), JS_GLOBAL_PROXY_TYPE,
    1249             :         JSGlobalProxy::SizeWithEmbedderFields(0), 0, Builtins::kIllegal,
    1250       34557 :         MUTABLE);
    1251       34557 :     global_proxy_function = factory()->NewFunction(args);
    1252             :   } else {
    1253             :     Handle<ObjectTemplateInfo> data =
    1254             :         v8::Utils::OpenHandle(*global_proxy_template);
    1255             :     Handle<FunctionTemplateInfo> global_constructor(
    1256             :         FunctionTemplateInfo::cast(data->constructor()), isolate());
    1257             :     global_proxy_function = ApiNatives::CreateApiFunction(
    1258             :         isolate(), global_constructor, factory()->the_hole_value(),
    1259      110400 :         JS_GLOBAL_PROXY_TYPE);
    1260             :   }
    1261      179512 :   global_proxy_function->initial_map()->set_is_access_check_needed(true);
    1262       89756 :   global_proxy_function->initial_map()->set_has_hidden_prototype(true);
    1263       89756 :   global_proxy_function->initial_map()->set_may_have_interesting_symbols(true);
    1264       89756 :   native_context()->set_global_proxy_function(*global_proxy_function);
    1265             : 
    1266             :   // Set global_proxy.__proto__ to js_global after ConfigureGlobalObjects
    1267             :   // Return the global proxy.
    1268             : 
    1269       89756 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1270             : 
    1271             :   // Set the native context for the global object.
    1272       89757 :   global_object->set_native_context(*native_context());
    1273      179514 :   global_object->set_global_proxy(*global_proxy);
    1274             :   // Set the native context of the global proxy.
    1275      179514 :   global_proxy->set_native_context(*native_context());
    1276             :   // Set the global proxy of the native context. If the native context has been
    1277             :   // deserialized, the global proxy is already correctly set up by the
    1278             :   // deserializer. Otherwise it's undefined.
    1279             :   DCHECK(native_context()
    1280             :              ->get(Context::GLOBAL_PROXY_INDEX)
    1281             :              ->IsUndefined(isolate()) ||
    1282             :          native_context()->global_proxy() == *global_proxy);
    1283       89757 :   native_context()->set_global_proxy(*global_proxy);
    1284             : 
    1285       89757 :   return global_object;
    1286             : }
    1287             : 
    1288         120 : void Genesis::HookUpGlobalProxy(Handle<JSGlobalProxy> global_proxy) {
    1289             :   // Re-initialize the global proxy with the global proxy function from the
    1290             :   // snapshot, and then set up the link to the native context.
    1291             :   Handle<JSFunction> global_proxy_function(
    1292          80 :       native_context()->global_proxy_function(), isolate());
    1293          40 :   factory()->ReinitializeJSGlobalProxy(global_proxy, global_proxy_function);
    1294             :   Handle<JSObject> global_object(
    1295          80 :       JSObject::cast(native_context()->global_object()), isolate());
    1296          40 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    1297          80 :   global_proxy->set_native_context(*native_context());
    1298             :   DCHECK(native_context()->global_proxy() == *global_proxy);
    1299          40 : }
    1300             : 
    1301       89646 : void Genesis::HookUpGlobalObject(Handle<JSGlobalObject> global_object) {
    1302             :   Handle<JSGlobalObject> global_object_from_snapshot(
    1303      179292 :       JSGlobalObject::cast(native_context()->extension()), isolate());
    1304      179292 :   native_context()->set_extension(*global_object);
    1305      179292 :   native_context()->set_security_token(*global_object);
    1306             : 
    1307       89646 :   TransferNamedProperties(global_object_from_snapshot, global_object);
    1308       89646 :   TransferIndexedProperties(global_object_from_snapshot, global_object);
    1309       89646 : }
    1310             : 
    1311        4743 : static void InstallWithIntrinsicDefaultProto(Isolate* isolate,
    1312             :                                              Handle<JSFunction> function,
    1313             :                                              int context_index) {
    1314             :   Handle<Smi> index(Smi::FromInt(context_index), isolate);
    1315             :   JSObject::AddProperty(isolate, function,
    1316             :                         isolate->factory()->native_context_index_symbol(),
    1317        4743 :                         index, NONE);
    1318       14229 :   isolate->native_context()->set(context_index, *function);
    1319        4743 : }
    1320             : 
    1321        1110 : static void InstallError(Isolate* isolate, Handle<JSObject> global,
    1322             :                          Handle<String> name, int context_index) {
    1323             :   Factory* factory = isolate->factory();
    1324             : 
    1325             :   Handle<JSFunction> error_fun = InstallFunction(
    1326             :       isolate, global, name, JS_ERROR_TYPE, JSObject::kHeaderSize, 0,
    1327        1110 :       factory->the_hole_value(), Builtins::kErrorConstructor);
    1328        2220 :   error_fun->shared()->DontAdaptArguments();
    1329        2220 :   error_fun->shared()->set_length(1);
    1330             : 
    1331        1110 :   if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1332             :     SimpleInstallFunction(isolate, error_fun, "captureStackTrace",
    1333         111 :                           Builtins::kErrorCaptureStackTrace, 2, false);
    1334             :   }
    1335             : 
    1336        1110 :   InstallWithIntrinsicDefaultProto(isolate, error_fun, context_index);
    1337             : 
    1338             :   {
    1339             :     // Setup %XXXErrorPrototype%.
    1340             :     Handle<JSObject> prototype(JSObject::cast(error_fun->instance_prototype()),
    1341        2220 :                                isolate);
    1342             : 
    1343             :     JSObject::AddProperty(isolate, prototype, factory->name_string(), name,
    1344        1110 :                           DONT_ENUM);
    1345             :     JSObject::AddProperty(isolate, prototype, factory->message_string(),
    1346        1110 :                           factory->empty_string(), DONT_ENUM);
    1347             : 
    1348        1110 :     if (context_index == Context::ERROR_FUNCTION_INDEX) {
    1349             :       Handle<JSFunction> to_string_fun =
    1350             :           SimpleInstallFunction(isolate, prototype, "toString",
    1351         111 :                                 Builtins::kErrorPrototypeToString, 0, true);
    1352         222 :       isolate->native_context()->set_error_to_string(*to_string_fun);
    1353         222 :       isolate->native_context()->set_initial_error_prototype(*prototype);
    1354             :     } else {
    1355             :       DCHECK(isolate->native_context()->error_to_string()->IsJSFunction());
    1356             : 
    1357             :       JSObject::AddProperty(isolate, prototype, factory->toString_string(),
    1358        1998 :                             isolate->error_to_string(), DONT_ENUM);
    1359             : 
    1360         999 :       Handle<JSFunction> global_error = isolate->error_function();
    1361        1998 :       CHECK(JSReceiver::SetPrototype(error_fun, global_error, false,
    1362             :                                      kThrowOnError)
    1363             :                 .FromMaybe(false));
    1364        2997 :       CHECK(JSReceiver::SetPrototype(prototype,
    1365             :                                      handle(global_error->prototype(), isolate),
    1366             :                                      false, kThrowOnError)
    1367             :                 .FromMaybe(false));
    1368             :     }
    1369             :   }
    1370             : 
    1371        2220 :   Handle<Map> initial_map(error_fun->initial_map(), isolate);
    1372        1110 :   Map::EnsureDescriptorSlack(isolate, initial_map, 1);
    1373             : 
    1374             :   {
    1375             :     Handle<AccessorInfo> info = factory->error_stack_accessor();
    1376             :     Descriptor d = Descriptor::AccessorConstant(handle(info->name(), isolate),
    1377        2220 :                                                 info, DONT_ENUM);
    1378        1110 :     initial_map->AppendDescriptor(isolate, &d);
    1379             :   }
    1380        1110 : }
    1381             : 
    1382             : namespace {
    1383             : 
    1384         555 : void InstallMakeError(Isolate* isolate, int builtin_id, int context_index) {
    1385             :   NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    1386             :       isolate->factory()->empty_string(), isolate->factory()->the_hole_value(),
    1387         555 :       JS_OBJECT_TYPE, JSObject::kHeaderSize, 0, builtin_id, MUTABLE);
    1388             : 
    1389         555 :   Handle<JSFunction> function = isolate->factory()->NewFunction(args);
    1390        1110 :   function->shared()->DontAdaptArguments();
    1391        1665 :   isolate->native_context()->set(context_index, *function);
    1392         555 : }
    1393             : 
    1394             : }  // namespace
    1395             : 
    1396             : // This is only called if we are not using snapshots.  The equivalent
    1397             : // work in the snapshot case is done in HookUpGlobalObject.
    1398         111 : void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
    1399        6660 :                                Handle<JSFunction> empty_function) {
    1400             :   // --- N a t i v e   C o n t e x t ---
    1401             :   // Use the empty scope info.
    1402         222 :   native_context()->set_scope_info(empty_function->shared()->scope_info());
    1403         111 :   native_context()->set_previous(Context());
    1404             :   // Set extension and global object.
    1405         222 :   native_context()->set_extension(*global_object);
    1406             :   // Security setup: Set the security token of the native context to the global
    1407             :   // object. This makes the security check between two different contexts fail
    1408             :   // by default even in case of global object reinitialization.
    1409         222 :   native_context()->set_security_token(*global_object);
    1410             : 
    1411         111 :   Factory* factory = isolate_->factory();
    1412             : 
    1413             :   Handle<ScriptContextTable> script_context_table =
    1414         111 :       factory->NewScriptContextTable();
    1415         111 :   native_context()->set_script_context_table(*script_context_table);
    1416         111 :   InstallGlobalThisBinding();
    1417             : 
    1418             :   {  // --- O b j e c t ---
    1419             :     Handle<String> object_name = factory->Object_string();
    1420         111 :     Handle<JSFunction> object_function = isolate_->object_function();
    1421             :     JSObject::AddProperty(isolate_, global_object, object_name, object_function,
    1422         111 :                           DONT_ENUM);
    1423             : 
    1424             :     SimpleInstallFunction(isolate_, object_function, "assign",
    1425         111 :                           Builtins::kObjectAssign, 2, false);
    1426             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertyDescriptor",
    1427         111 :                           Builtins::kObjectGetOwnPropertyDescriptor, 2, false);
    1428             :     SimpleInstallFunction(isolate_, object_function,
    1429             :                           "getOwnPropertyDescriptors",
    1430         111 :                           Builtins::kObjectGetOwnPropertyDescriptors, 1, false);
    1431             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertyNames",
    1432         111 :                           Builtins::kObjectGetOwnPropertyNames, 1, true);
    1433             :     SimpleInstallFunction(isolate_, object_function, "getOwnPropertySymbols",
    1434         111 :                           Builtins::kObjectGetOwnPropertySymbols, 1, false);
    1435             :     SimpleInstallFunction(isolate_, object_function, "is", Builtins::kObjectIs,
    1436         111 :                           2, true);
    1437             :     SimpleInstallFunction(isolate_, object_function, "preventExtensions",
    1438         111 :                           Builtins::kObjectPreventExtensions, 1, false);
    1439             :     SimpleInstallFunction(isolate_, object_function, "seal",
    1440         111 :                           Builtins::kObjectSeal, 1, false);
    1441             : 
    1442             :     Handle<JSFunction> object_create = SimpleInstallFunction(
    1443         111 :         isolate_, object_function, "create", Builtins::kObjectCreate, 2, false);
    1444         111 :     native_context()->set_object_create(*object_create);
    1445             : 
    1446             :     Handle<JSFunction> object_define_properties =
    1447             :         SimpleInstallFunction(isolate_, object_function, "defineProperties",
    1448         111 :                               Builtins::kObjectDefineProperties, 2, true);
    1449         111 :     native_context()->set_object_define_properties(*object_define_properties);
    1450             : 
    1451             :     Handle<JSFunction> object_define_property =
    1452             :         SimpleInstallFunction(isolate_, object_function, "defineProperty",
    1453         111 :                               Builtins::kObjectDefineProperty, 3, true);
    1454         111 :     native_context()->set_object_define_property(*object_define_property);
    1455             : 
    1456             :     SimpleInstallFunction(isolate_, object_function, "freeze",
    1457         111 :                           Builtins::kObjectFreeze, 1, false);
    1458             : 
    1459             :     Handle<JSFunction> object_get_prototype_of =
    1460             :         SimpleInstallFunction(isolate_, object_function, "getPrototypeOf",
    1461         111 :                               Builtins::kObjectGetPrototypeOf, 1, false);
    1462         111 :     native_context()->set_object_get_prototype_of(*object_get_prototype_of);
    1463             :     SimpleInstallFunction(isolate_, object_function, "setPrototypeOf",
    1464         111 :                           Builtins::kObjectSetPrototypeOf, 2, false);
    1465             : 
    1466             :     SimpleInstallFunction(isolate_, object_function, "isExtensible",
    1467         111 :                           Builtins::kObjectIsExtensible, 1, false);
    1468             :     SimpleInstallFunction(isolate_, object_function, "isFrozen",
    1469         111 :                           Builtins::kObjectIsFrozen, 1, false);
    1470             : 
    1471             :     Handle<JSFunction> object_is_sealed =
    1472             :         SimpleInstallFunction(isolate_, object_function, "isSealed",
    1473         111 :                               Builtins::kObjectIsSealed, 1, false);
    1474         111 :     native_context()->set_object_is_sealed(*object_is_sealed);
    1475             : 
    1476             :     Handle<JSFunction> object_keys = SimpleInstallFunction(
    1477         111 :         isolate_, object_function, "keys", Builtins::kObjectKeys, 1, true);
    1478         111 :     native_context()->set_object_keys(*object_keys);
    1479             :     SimpleInstallFunction(isolate_, object_function, "entries",
    1480         111 :                           Builtins::kObjectEntries, 1, true);
    1481             :     SimpleInstallFunction(isolate_, object_function, "values",
    1482         111 :                           Builtins::kObjectValues, 1, true);
    1483             : 
    1484             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1485             :                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
    1486         111 :                           true);
    1487             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1488             :                           "__defineSetter__", Builtins::kObjectDefineSetter, 2,
    1489         111 :                           true);
    1490             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1491             :                           "hasOwnProperty",
    1492         111 :                           Builtins::kObjectPrototypeHasOwnProperty, 1, true);
    1493             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1494             :                           "__lookupGetter__", Builtins::kObjectLookupGetter, 1,
    1495         111 :                           true);
    1496             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1497             :                           "__lookupSetter__", Builtins::kObjectLookupSetter, 1,
    1498         111 :                           true);
    1499             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1500             :                           "isPrototypeOf",
    1501         111 :                           Builtins::kObjectPrototypeIsPrototypeOf, 1, true);
    1502             :     SimpleInstallFunction(
    1503             :         isolate_, isolate_->initial_object_prototype(), "propertyIsEnumerable",
    1504         111 :         Builtins::kObjectPrototypePropertyIsEnumerable, 1, false);
    1505             :     Handle<JSFunction> object_to_string = SimpleInstallFunction(
    1506             :         isolate_, isolate_->initial_object_prototype(), "toString",
    1507         111 :         Builtins::kObjectPrototypeToString, 0, true);
    1508         111 :     native_context()->set_object_to_string(*object_to_string);
    1509             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1510             :                           "valueOf", Builtins::kObjectPrototypeValueOf, 0,
    1511         111 :                           true);
    1512             : 
    1513             :     SimpleInstallGetterSetter(
    1514             :         isolate_, isolate_->initial_object_prototype(), factory->proto_string(),
    1515         111 :         Builtins::kObjectPrototypeGetProto, Builtins::kObjectPrototypeSetProto);
    1516             : 
    1517             :     SimpleInstallFunction(isolate_, isolate_->initial_object_prototype(),
    1518             :                           "toLocaleString",
    1519         111 :                           Builtins::kObjectPrototypeToLocaleString, 0, true);
    1520             :   }
    1521             : 
    1522         222 :   Handle<JSObject> global(native_context()->global_object(), isolate());
    1523             : 
    1524             :   {  // --- F u n c t i o n ---
    1525         111 :     Handle<JSFunction> prototype = empty_function;
    1526             :     Handle<JSFunction> function_fun =
    1527             :         InstallFunction(isolate_, global, "Function", JS_FUNCTION_TYPE,
    1528             :                         JSFunction::kSizeWithPrototype, 0, prototype,
    1529         111 :                         Builtins::kFunctionConstructor);
    1530             :     // Function instances are sloppy by default.
    1531             :     function_fun->set_prototype_or_initial_map(
    1532         333 :         *isolate_->sloppy_function_map());
    1533         222 :     function_fun->shared()->DontAdaptArguments();
    1534         222 :     function_fun->shared()->set_length(1);
    1535             :     InstallWithIntrinsicDefaultProto(isolate_, function_fun,
    1536         111 :                                      Context::FUNCTION_FUNCTION_INDEX);
    1537             : 
    1538             :     // Setup the methods on the %FunctionPrototype%.
    1539             :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1540         111 :                           function_fun, DONT_ENUM);
    1541             :     SimpleInstallFunction(isolate_, prototype, "apply",
    1542         111 :                           Builtins::kFunctionPrototypeApply, 2, false);
    1543             :     SimpleInstallFunction(isolate_, prototype, "bind",
    1544         111 :                           Builtins::kFastFunctionPrototypeBind, 1, false);
    1545             :     SimpleInstallFunction(isolate_, prototype, "call",
    1546         111 :                           Builtins::kFunctionPrototypeCall, 1, false);
    1547             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1548         111 :                           Builtins::kFunctionPrototypeToString, 0, false);
    1549             : 
    1550             :     // Install the @@hasInstance function.
    1551             :     Handle<JSFunction> has_instance = InstallFunctionAtSymbol(
    1552             :         isolate_, prototype, factory->has_instance_symbol(),
    1553             :         "[Symbol.hasInstance]", Builtins::kFunctionPrototypeHasInstance, 1,
    1554             :         true,
    1555             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY),
    1556         111 :         BuiltinFunctionId::kFunctionHasInstance);
    1557         111 :     native_context()->set_function_has_instance(*has_instance);
    1558             : 
    1559             :     // Complete setting up function maps.
    1560             :     {
    1561         222 :       isolate_->sloppy_function_map()->SetConstructor(*function_fun);
    1562         222 :       isolate_->sloppy_function_with_name_map()->SetConstructor(*function_fun);
    1563         222 :       isolate_->sloppy_function_with_readonly_prototype_map()->SetConstructor(
    1564         333 :           *function_fun);
    1565             : 
    1566         222 :       isolate_->strict_function_map()->SetConstructor(*function_fun);
    1567         222 :       isolate_->strict_function_with_name_map()->SetConstructor(*function_fun);
    1568         222 :       strict_function_with_home_object_map_->SetConstructor(*function_fun);
    1569             :       strict_function_with_name_and_home_object_map_->SetConstructor(
    1570         222 :           *function_fun);
    1571         222 :       isolate_->strict_function_with_readonly_prototype_map()->SetConstructor(
    1572         333 :           *function_fun);
    1573             : 
    1574         222 :       isolate_->class_function_map()->SetConstructor(*function_fun);
    1575             :     }
    1576             :   }
    1577             : 
    1578             :   {  // --- A s y n c F r o m S y n c I t e r a t o r
    1579             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1580             :         isolate_, Builtins::kAsyncIteratorValueUnwrap, factory->empty_string(),
    1581         111 :         1);
    1582         111 :     native_context()->set_async_iterator_value_unwrap_shared_fun(*info);
    1583             :   }
    1584             : 
    1585             :   {  // --- A s y n c G e n e r a t o r ---
    1586             :     Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    1587             :         isolate_, Builtins::kAsyncGeneratorAwaitResolveClosure,
    1588         111 :         factory->empty_string(), 1);
    1589         111 :     native_context()->set_async_generator_await_resolve_shared_fun(*info);
    1590             : 
    1591             :     info = SimpleCreateSharedFunctionInfo(
    1592             :         isolate_, Builtins::kAsyncGeneratorAwaitRejectClosure,
    1593         111 :         factory->empty_string(), 1);
    1594         111 :     native_context()->set_async_generator_await_reject_shared_fun(*info);
    1595             : 
    1596             :     info = SimpleCreateSharedFunctionInfo(
    1597             :         isolate_, Builtins::kAsyncGeneratorYieldResolveClosure,
    1598         111 :         factory->empty_string(), 1);
    1599         111 :     native_context()->set_async_generator_yield_resolve_shared_fun(*info);
    1600             : 
    1601             :     info = SimpleCreateSharedFunctionInfo(
    1602             :         isolate_, Builtins::kAsyncGeneratorReturnResolveClosure,
    1603         111 :         factory->empty_string(), 1);
    1604         111 :     native_context()->set_async_generator_return_resolve_shared_fun(*info);
    1605             : 
    1606             :     info = SimpleCreateSharedFunctionInfo(
    1607             :         isolate_, Builtins::kAsyncGeneratorReturnClosedResolveClosure,
    1608         111 :         factory->empty_string(), 1);
    1609         222 :     native_context()->set_async_generator_return_closed_resolve_shared_fun(
    1610         111 :         *info);
    1611             : 
    1612             :     info = SimpleCreateSharedFunctionInfo(
    1613             :         isolate_, Builtins::kAsyncGeneratorReturnClosedRejectClosure,
    1614         111 :         factory->empty_string(), 1);
    1615         222 :     native_context()->set_async_generator_return_closed_reject_shared_fun(
    1616         111 :         *info);
    1617             :   }
    1618             : 
    1619             :   Handle<JSFunction> array_prototype_to_string_fun;
    1620             :   {  // --- A r r a y ---
    1621             :     Handle<JSFunction> array_function = InstallFunction(
    1622             :         isolate_, global, "Array", JS_ARRAY_TYPE, JSArray::kSize, 0,
    1623         222 :         isolate_->initial_object_prototype(), Builtins::kArrayConstructor);
    1624         222 :     array_function->shared()->DontAdaptArguments();
    1625         222 :     array_function->shared()->set_builtin_function_id(
    1626         222 :         BuiltinFunctionId::kArrayConstructor);
    1627             : 
    1628             :     // This seems a bit hackish, but we need to make sure Array.length
    1629             :     // is 1.
    1630         222 :     array_function->shared()->set_length(1);
    1631             : 
    1632         222 :     Handle<Map> initial_map(array_function->initial_map(), isolate());
    1633             : 
    1634             :     // This assert protects an optimization in
    1635             :     // HGraphBuilder::JSArrayBuilder::EmitMapCode()
    1636             :     DCHECK(initial_map->elements_kind() == GetInitialFastElementsKind());
    1637         111 :     Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
    1638             : 
    1639             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1640             :         DONT_ENUM | DONT_DELETE);
    1641             : 
    1642             :     STATIC_ASSERT(JSArray::kLengthDescriptorIndex == 0);
    1643             :     {  // Add length.
    1644             :       Descriptor d = Descriptor::AccessorConstant(
    1645         111 :           factory->length_string(), factory->array_length_accessor(), attribs);
    1646         111 :       initial_map->AppendDescriptor(isolate(), &d);
    1647             :     }
    1648             : 
    1649             :     InstallWithIntrinsicDefaultProto(isolate_, array_function,
    1650         111 :                                      Context::ARRAY_FUNCTION_INDEX);
    1651         111 :     InstallSpeciesGetter(isolate_, array_function);
    1652             : 
    1653             :     // Cache the array maps, needed by ArrayConstructorStub
    1654         111 :     CacheInitialJSArrayMaps(native_context(), initial_map);
    1655             : 
    1656             :     // Set up %ArrayPrototype%.
    1657             :     // The %ArrayPrototype% has TERMINAL_FAST_ELEMENTS_KIND in order to ensure
    1658             :     // that constant functions stay constant after turning prototype to setup
    1659             :     // mode and back when constant field tracking is enabled.
    1660             :     Handle<JSArray> proto =
    1661         111 :         factory->NewJSArray(0, TERMINAL_FAST_ELEMENTS_KIND, TENURED);
    1662         111 :     JSFunction::SetPrototype(array_function, proto);
    1663         222 :     native_context()->set_initial_array_prototype(*proto);
    1664             : 
    1665             :     Handle<JSFunction> is_arraylike = SimpleInstallFunction(
    1666         111 :         isolate_, array_function, "isArray", Builtins::kArrayIsArray, 1, true);
    1667         111 :     native_context()->set_is_arraylike(*is_arraylike);
    1668             : 
    1669             :     SimpleInstallFunction(isolate_, array_function, "from",
    1670         111 :                           Builtins::kArrayFrom, 1, false);
    1671             :     SimpleInstallFunction(isolate_, array_function, "of", Builtins::kArrayOf, 0,
    1672         111 :                           false);
    1673             : 
    1674             :     JSObject::AddProperty(isolate_, proto, factory->constructor_string(),
    1675         111 :                           array_function, DONT_ENUM);
    1676             : 
    1677             :     SimpleInstallFunction(isolate_, proto, "concat", Builtins::kArrayConcat, 1,
    1678         111 :                           false);
    1679             :     SimpleInstallFunction(isolate_, proto, "copyWithin",
    1680         111 :                           Builtins::kArrayPrototypeCopyWithin, 2, false);
    1681             :     SimpleInstallFunction(isolate_, proto, "fill",
    1682         111 :                           Builtins::kArrayPrototypeFill, 1, false);
    1683             :     SimpleInstallFunction(isolate_, proto, "find",
    1684         111 :                           Builtins::kArrayPrototypeFind, 1, false);
    1685             :     SimpleInstallFunction(isolate_, proto, "findIndex",
    1686         111 :                           Builtins::kArrayPrototypeFindIndex, 1, false);
    1687             :     SimpleInstallFunction(isolate_, proto, "lastIndexOf",
    1688         111 :                           Builtins::kArrayPrototypeLastIndexOf, 1, false);
    1689             :     SimpleInstallFunction(isolate_, proto, "pop", Builtins::kArrayPrototypePop,
    1690         111 :                           0, false);
    1691             :     SimpleInstallFunction(isolate_, proto, "push",
    1692         111 :                           Builtins::kArrayPrototypePush, 1, false);
    1693             :     SimpleInstallFunction(isolate_, proto, "reverse",
    1694         111 :                           Builtins::kArrayPrototypeReverse, 0, false);
    1695             :     SimpleInstallFunction(isolate_, proto, "shift",
    1696         111 :                           Builtins::kArrayPrototypeShift, 0, false);
    1697             :     SimpleInstallFunction(isolate_, proto, "unshift",
    1698         111 :                           Builtins::kArrayPrototypeUnshift, 1, false);
    1699             :     SimpleInstallFunction(isolate_, proto, "slice",
    1700         111 :                           Builtins::kArrayPrototypeSlice, 2, false);
    1701             :     SimpleInstallFunction(isolate_, proto, "sort",
    1702         111 :                           Builtins::kArrayPrototypeSort, 1, false);
    1703             :     SimpleInstallFunction(isolate_, proto, "splice",
    1704         111 :                           Builtins::kArrayPrototypeSplice, 2, false);
    1705             :     SimpleInstallFunction(isolate_, proto, "includes", Builtins::kArrayIncludes,
    1706         111 :                           1, false);
    1707             :     SimpleInstallFunction(isolate_, proto, "indexOf", Builtins::kArrayIndexOf,
    1708         111 :                           1, false);
    1709             :     SimpleInstallFunction(isolate_, proto, "join",
    1710         111 :                           Builtins::kArrayPrototypeJoin, 1, false);
    1711             : 
    1712             :     {  // Set up iterator-related properties.
    1713             :       Handle<JSFunction> keys = InstallFunctionWithBuiltinId(
    1714             :           isolate_, proto, "keys", Builtins::kArrayPrototypeKeys, 0, true,
    1715         111 :           BuiltinFunctionId::kArrayKeys);
    1716         111 :       native_context()->set_array_keys_iterator(*keys);
    1717             : 
    1718             :       Handle<JSFunction> entries = InstallFunctionWithBuiltinId(
    1719             :           isolate_, proto, "entries", Builtins::kArrayPrototypeEntries, 0, true,
    1720         111 :           BuiltinFunctionId::kArrayEntries);
    1721         111 :       native_context()->set_array_entries_iterator(*entries);
    1722             : 
    1723             :       Handle<JSFunction> values = InstallFunctionWithBuiltinId(
    1724             :           isolate_, proto, "values", Builtins::kArrayPrototypeValues, 0, true,
    1725         111 :           BuiltinFunctionId::kArrayValues);
    1726             :       JSObject::AddProperty(isolate_, proto, factory->iterator_symbol(), values,
    1727         111 :                             DONT_ENUM);
    1728         111 :       native_context()->set_array_values_iterator(*values);
    1729             :     }
    1730             : 
    1731             :     Handle<JSFunction> for_each_fun = SimpleInstallFunction(
    1732         111 :         isolate_, proto, "forEach", Builtins::kArrayForEach, 1, false);
    1733         111 :     native_context()->set_array_for_each_iterator(*for_each_fun);
    1734             :     SimpleInstallFunction(isolate_, proto, "filter", Builtins::kArrayFilter, 1,
    1735         111 :                           false);
    1736             :     SimpleInstallFunction(isolate_, proto, "flat",
    1737         111 :                           Builtins::kArrayPrototypeFlat, 0, false);
    1738             :     SimpleInstallFunction(isolate_, proto, "flatMap",
    1739         111 :                           Builtins::kArrayPrototypeFlatMap, 1, false);
    1740             :     SimpleInstallFunction(isolate_, proto, "map", Builtins::kArrayMap, 1,
    1741         111 :                           false);
    1742             :     SimpleInstallFunction(isolate_, proto, "every", Builtins::kArrayEvery, 1,
    1743         111 :                           false);
    1744             :     SimpleInstallFunction(isolate_, proto, "some", Builtins::kArraySome, 1,
    1745         111 :                           false);
    1746             :     SimpleInstallFunction(isolate_, proto, "reduce", Builtins::kArrayReduce, 1,
    1747         111 :                           false);
    1748             :     SimpleInstallFunction(isolate_, proto, "reduceRight",
    1749         111 :                           Builtins::kArrayReduceRight, 1, false);
    1750             :     SimpleInstallFunction(isolate_, proto, "toLocaleString",
    1751         111 :                           Builtins::kArrayPrototypeToLocaleString, 0, false);
    1752             :     array_prototype_to_string_fun =
    1753             :         SimpleInstallFunction(isolate_, proto, "toString",
    1754         111 :                               Builtins::kArrayPrototypeToString, 0, false);
    1755             : 
    1756         111 :     Handle<JSObject> unscopables = factory->NewJSObjectWithNullProto();
    1757         111 :     InstallTrueValuedProperty(isolate_, unscopables, "copyWithin");
    1758         111 :     InstallTrueValuedProperty(isolate_, unscopables, "entries");
    1759         111 :     InstallTrueValuedProperty(isolate_, unscopables, "fill");
    1760         111 :     InstallTrueValuedProperty(isolate_, unscopables, "find");
    1761         111 :     InstallTrueValuedProperty(isolate_, unscopables, "findIndex");
    1762         111 :     InstallTrueValuedProperty(isolate_, unscopables, "flat");
    1763         111 :     InstallTrueValuedProperty(isolate_, unscopables, "flatMap");
    1764         111 :     InstallTrueValuedProperty(isolate_, unscopables, "includes");
    1765         111 :     InstallTrueValuedProperty(isolate_, unscopables, "keys");
    1766         111 :     InstallTrueValuedProperty(isolate_, unscopables, "values");
    1767         111 :     JSObject::MigrateSlowToFast(unscopables, 0, "Bootstrapping");
    1768             :     JSObject::AddProperty(
    1769             :         isolate_, proto, factory->unscopables_symbol(), unscopables,
    1770         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    1771             : 
    1772         111 :     Handle<Map> map(proto->map(), isolate_);
    1773         111 :     Map::SetShouldBeFastPrototypeMap(map, true, isolate_);
    1774             :   }
    1775             : 
    1776             :   {  // --- A r r a y I t e r a t o r ---
    1777             :     Handle<JSObject> iterator_prototype(
    1778         222 :         native_context()->initial_iterator_prototype(), isolate());
    1779             : 
    1780             :     Handle<JSObject> array_iterator_prototype =
    1781         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    1782         111 :     JSObject::ForceSetPrototype(array_iterator_prototype, iterator_prototype);
    1783             : 
    1784             :     InstallToStringTag(isolate_, array_iterator_prototype,
    1785         111 :                        factory->ArrayIterator_string());
    1786             : 
    1787             :     InstallFunctionWithBuiltinId(isolate_, array_iterator_prototype, "next",
    1788             :                                  Builtins::kArrayIteratorPrototypeNext, 0, true,
    1789         111 :                                  BuiltinFunctionId::kArrayIteratorNext);
    1790             : 
    1791             :     Handle<JSFunction> array_iterator_function =
    1792             :         CreateFunction(isolate_, factory->ArrayIterator_string(),
    1793             :                        JS_ARRAY_ITERATOR_TYPE, JSArrayIterator::kSize, 0,
    1794         111 :                        array_iterator_prototype, Builtins::kIllegal);
    1795         111 :     array_iterator_function->shared()->set_native(false);
    1796             : 
    1797         222 :     native_context()->set_initial_array_iterator_map(
    1798         333 :         array_iterator_function->initial_map());
    1799         222 :     native_context()->set_initial_array_iterator_prototype(
    1800         111 :         *array_iterator_prototype);
    1801             :   }
    1802             : 
    1803             :   {  // --- N u m b e r ---
    1804             :     Handle<JSFunction> number_fun = InstallFunction(
    1805             :         isolate_, global, "Number", JS_VALUE_TYPE, JSValue::kSize, 0,
    1806         222 :         isolate_->initial_object_prototype(), Builtins::kNumberConstructor);
    1807         222 :     number_fun->shared()->set_builtin_function_id(
    1808         222 :         BuiltinFunctionId::kNumberConstructor);
    1809         222 :     number_fun->shared()->DontAdaptArguments();
    1810         222 :     number_fun->shared()->set_length(1);
    1811             :     InstallWithIntrinsicDefaultProto(isolate_, number_fun,
    1812         111 :                                      Context::NUMBER_FUNCTION_INDEX);
    1813             : 
    1814             :     // Create the %NumberPrototype%
    1815             :     Handle<JSValue> prototype =
    1816         111 :         Handle<JSValue>::cast(factory->NewJSObject(number_fun, TENURED));
    1817         111 :     prototype->set_value(Smi::kZero);
    1818         111 :     JSFunction::SetPrototype(number_fun, prototype);
    1819             : 
    1820             :     // Install the "constructor" property on the {prototype}.
    1821             :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1822         111 :                           number_fun, DONT_ENUM);
    1823             : 
    1824             :     // Install the Number.prototype methods.
    1825             :     SimpleInstallFunction(isolate_, prototype, "toExponential",
    1826         111 :                           Builtins::kNumberPrototypeToExponential, 1, false);
    1827             :     SimpleInstallFunction(isolate_, prototype, "toFixed",
    1828         111 :                           Builtins::kNumberPrototypeToFixed, 1, false);
    1829             :     SimpleInstallFunction(isolate_, prototype, "toPrecision",
    1830         111 :                           Builtins::kNumberPrototypeToPrecision, 1, false);
    1831             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1832         111 :                           Builtins::kNumberPrototypeToString, 1, false);
    1833             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    1834         111 :                           Builtins::kNumberPrototypeValueOf, 0, true);
    1835             : 
    1836             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    1837         111 :                           Builtins::kNumberPrototypeToLocaleString, 0, false);
    1838             : 
    1839             :     // Install the Number functions.
    1840             :     SimpleInstallFunction(isolate_, number_fun, "isFinite",
    1841         111 :                           Builtins::kNumberIsFinite, 1, true);
    1842             :     SimpleInstallFunction(isolate_, number_fun, "isInteger",
    1843         111 :                           Builtins::kNumberIsInteger, 1, true);
    1844             :     SimpleInstallFunction(isolate_, number_fun, "isNaN", Builtins::kNumberIsNaN,
    1845         111 :                           1, true);
    1846             :     SimpleInstallFunction(isolate_, number_fun, "isSafeInteger",
    1847         111 :                           Builtins::kNumberIsSafeInteger, 1, true);
    1848             : 
    1849             :     // Install Number.parseFloat and Global.parseFloat.
    1850             :     Handle<JSFunction> parse_float_fun =
    1851             :         SimpleInstallFunction(isolate_, number_fun, "parseFloat",
    1852         111 :                               Builtins::kNumberParseFloat, 1, true);
    1853             :     JSObject::AddProperty(isolate_, global_object, "parseFloat",
    1854         111 :                           parse_float_fun, DONT_ENUM);
    1855             : 
    1856             :     // Install Number.parseInt and Global.parseInt.
    1857             :     Handle<JSFunction> parse_int_fun = SimpleInstallFunction(
    1858         111 :         isolate_, number_fun, "parseInt", Builtins::kNumberParseInt, 2, true);
    1859             :     JSObject::AddProperty(isolate_, global_object, "parseInt", parse_int_fun,
    1860         111 :                           DONT_ENUM);
    1861             : 
    1862             :     // Install Number constants
    1863             :     const double kMaxValue = 1.7976931348623157e+308;
    1864             :     const double kMinValue = 5e-324;
    1865             :     const double kMinSafeInteger = -kMaxSafeInteger;
    1866             :     const double kEPS = 2.220446049250313e-16;
    1867             : 
    1868             :     InstallConstant(isolate_, number_fun, "MAX_VALUE",
    1869         222 :                     factory->NewNumber(kMaxValue));
    1870             :     InstallConstant(isolate_, number_fun, "MIN_VALUE",
    1871         222 :                     factory->NewNumber(kMinValue));
    1872         111 :     InstallConstant(isolate_, number_fun, "NaN", factory->nan_value());
    1873             :     InstallConstant(isolate_, number_fun, "NEGATIVE_INFINITY",
    1874         222 :                     factory->NewNumber(-V8_INFINITY));
    1875             :     InstallConstant(isolate_, number_fun, "POSITIVE_INFINITY",
    1876         111 :                     factory->infinity_value());
    1877             :     InstallConstant(isolate_, number_fun, "MAX_SAFE_INTEGER",
    1878         222 :                     factory->NewNumber(kMaxSafeInteger));
    1879             :     InstallConstant(isolate_, number_fun, "MIN_SAFE_INTEGER",
    1880         222 :                     factory->NewNumber(kMinSafeInteger));
    1881         222 :     InstallConstant(isolate_, number_fun, "EPSILON", factory->NewNumber(kEPS));
    1882             : 
    1883         111 :     InstallConstant(isolate_, global, "Infinity", factory->infinity_value());
    1884         111 :     InstallConstant(isolate_, global, "NaN", factory->nan_value());
    1885         111 :     InstallConstant(isolate_, global, "undefined", factory->undefined_value());
    1886             :   }
    1887             : 
    1888             :   {  // --- B o o l e a n ---
    1889             :     Handle<JSFunction> boolean_fun = InstallFunction(
    1890             :         isolate_, global, "Boolean", JS_VALUE_TYPE, JSValue::kSize, 0,
    1891         222 :         isolate_->initial_object_prototype(), Builtins::kBooleanConstructor);
    1892         222 :     boolean_fun->shared()->DontAdaptArguments();
    1893         222 :     boolean_fun->shared()->set_length(1);
    1894             :     InstallWithIntrinsicDefaultProto(isolate_, boolean_fun,
    1895         111 :                                      Context::BOOLEAN_FUNCTION_INDEX);
    1896             : 
    1897             :     // Create the %BooleanPrototype%
    1898             :     Handle<JSValue> prototype =
    1899         111 :         Handle<JSValue>::cast(factory->NewJSObject(boolean_fun, TENURED));
    1900         333 :     prototype->set_value(ReadOnlyRoots(isolate_).false_value());
    1901         111 :     JSFunction::SetPrototype(boolean_fun, prototype);
    1902             : 
    1903             :     // Install the "constructor" property on the {prototype}.
    1904             :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1905         111 :                           boolean_fun, DONT_ENUM);
    1906             : 
    1907             :     // Install the Boolean.prototype methods.
    1908             :     SimpleInstallFunction(isolate_, prototype, "toString",
    1909         111 :                           Builtins::kBooleanPrototypeToString, 0, true);
    1910             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    1911         111 :                           Builtins::kBooleanPrototypeValueOf, 0, true);
    1912             :   }
    1913             : 
    1914             :   {  // --- S t r i n g ---
    1915             :     Handle<JSFunction> string_fun = InstallFunction(
    1916             :         isolate_, global, "String", JS_VALUE_TYPE, JSValue::kSize, 0,
    1917         222 :         isolate_->initial_object_prototype(), Builtins::kStringConstructor);
    1918         222 :     string_fun->shared()->set_builtin_function_id(
    1919         222 :         BuiltinFunctionId::kStringConstructor);
    1920         222 :     string_fun->shared()->DontAdaptArguments();
    1921         222 :     string_fun->shared()->set_length(1);
    1922             :     InstallWithIntrinsicDefaultProto(isolate_, string_fun,
    1923         111 :                                      Context::STRING_FUNCTION_INDEX);
    1924             : 
    1925             :     Handle<Map> string_map = Handle<Map>(
    1926         222 :         native_context()->string_function()->initial_map(), isolate());
    1927         111 :     string_map->set_elements_kind(FAST_STRING_WRAPPER_ELEMENTS);
    1928         111 :     Map::EnsureDescriptorSlack(isolate_, string_map, 1);
    1929             : 
    1930             :     PropertyAttributes attribs = static_cast<PropertyAttributes>(
    1931             :         DONT_ENUM | DONT_DELETE | READ_ONLY);
    1932             : 
    1933             :     {  // Add length.
    1934             :       Descriptor d = Descriptor::AccessorConstant(
    1935         111 :           factory->length_string(), factory->string_length_accessor(), attribs);
    1936         111 :       string_map->AppendDescriptor(isolate(), &d);
    1937             :     }
    1938             : 
    1939             :     // Install the String.fromCharCode function.
    1940             :     SimpleInstallFunction(isolate_, string_fun, "fromCharCode",
    1941         111 :                           Builtins::kStringFromCharCode, 1, false);
    1942             : 
    1943             :     // Install the String.fromCodePoint function.
    1944             :     SimpleInstallFunction(isolate_, string_fun, "fromCodePoint",
    1945         111 :                           Builtins::kStringFromCodePoint, 1, false);
    1946             : 
    1947             :     // Install the String.raw function.
    1948             :     SimpleInstallFunction(isolate_, string_fun, "raw", Builtins::kStringRaw, 1,
    1949         111 :                           false);
    1950             : 
    1951             :     // Create the %StringPrototype%
    1952             :     Handle<JSValue> prototype =
    1953         111 :         Handle<JSValue>::cast(factory->NewJSObject(string_fun, TENURED));
    1954         333 :     prototype->set_value(ReadOnlyRoots(isolate_).empty_string());
    1955         111 :     JSFunction::SetPrototype(string_fun, prototype);
    1956         222 :     native_context()->set_initial_string_prototype(*prototype);
    1957             : 
    1958             :     // Install the "constructor" property on the {prototype}.
    1959             :     JSObject::AddProperty(isolate_, prototype, factory->constructor_string(),
    1960         111 :                           string_fun, DONT_ENUM);
    1961             : 
    1962             :     // Install the String.prototype methods.
    1963             :     SimpleInstallFunction(isolate_, prototype, "anchor",
    1964         111 :                           Builtins::kStringPrototypeAnchor, 1, true);
    1965             :     SimpleInstallFunction(isolate_, prototype, "big",
    1966         111 :                           Builtins::kStringPrototypeBig, 0, true);
    1967             :     SimpleInstallFunction(isolate_, prototype, "blink",
    1968         111 :                           Builtins::kStringPrototypeBlink, 0, true);
    1969             :     SimpleInstallFunction(isolate_, prototype, "bold",
    1970         111 :                           Builtins::kStringPrototypeBold, 0, true);
    1971             :     SimpleInstallFunction(isolate_, prototype, "charAt",
    1972         111 :                           Builtins::kStringPrototypeCharAt, 1, true);
    1973             :     SimpleInstallFunction(isolate_, prototype, "charCodeAt",
    1974         111 :                           Builtins::kStringPrototypeCharCodeAt, 1, true);
    1975             :     SimpleInstallFunction(isolate_, prototype, "codePointAt",
    1976         111 :                           Builtins::kStringPrototypeCodePointAt, 1, true);
    1977             :     SimpleInstallFunction(isolate_, prototype, "concat",
    1978         111 :                           Builtins::kStringPrototypeConcat, 1, false);
    1979             :     SimpleInstallFunction(isolate_, prototype, "endsWith",
    1980         111 :                           Builtins::kStringPrototypeEndsWith, 1, false);
    1981             :     SimpleInstallFunction(isolate_, prototype, "fontcolor",
    1982         111 :                           Builtins::kStringPrototypeFontcolor, 1, true);
    1983             :     SimpleInstallFunction(isolate_, prototype, "fontsize",
    1984         111 :                           Builtins::kStringPrototypeFontsize, 1, true);
    1985             :     SimpleInstallFunction(isolate_, prototype, "fixed",
    1986         111 :                           Builtins::kStringPrototypeFixed, 0, true);
    1987             :     SimpleInstallFunction(isolate_, prototype, "includes",
    1988         111 :                           Builtins::kStringPrototypeIncludes, 1, false);
    1989             :     SimpleInstallFunction(isolate_, prototype, "indexOf",
    1990         111 :                           Builtins::kStringPrototypeIndexOf, 1, false);
    1991             :     SimpleInstallFunction(isolate_, prototype, "italics",
    1992         111 :                           Builtins::kStringPrototypeItalics, 0, true);
    1993             :     SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
    1994         111 :                           Builtins::kStringPrototypeLastIndexOf, 1, false);
    1995             :     SimpleInstallFunction(isolate_, prototype, "link",
    1996         111 :                           Builtins::kStringPrototypeLink, 1, true);
    1997             : #ifdef V8_INTL_SUPPORT
    1998             :     SimpleInstallFunction(isolate_, prototype, "localeCompare",
    1999         111 :                           Builtins::kStringPrototypeLocaleCompare, 1, false);
    2000             : #else
    2001             :     SimpleInstallFunction(isolate_, prototype, "localeCompare",
    2002             :                           Builtins::kStringPrototypeLocaleCompare, 1, true);
    2003             : #endif  // V8_INTL_SUPPORT
    2004             :     SimpleInstallFunction(isolate_, prototype, "match",
    2005         111 :                           Builtins::kStringPrototypeMatch, 1, true);
    2006             : #ifdef V8_INTL_SUPPORT
    2007             :     SimpleInstallFunction(isolate_, prototype, "normalize",
    2008         111 :                           Builtins::kStringPrototypeNormalizeIntl, 0, false);
    2009             : #else
    2010             :     SimpleInstallFunction(isolate_, prototype, "normalize",
    2011             :                           Builtins::kStringPrototypeNormalize, 0, false);
    2012             : #endif  // V8_INTL_SUPPORT
    2013             :     SimpleInstallFunction(isolate_, prototype, "padEnd",
    2014         111 :                           Builtins::kStringPrototypePadEnd, 1, false);
    2015             :     SimpleInstallFunction(isolate_, prototype, "padStart",
    2016         111 :                           Builtins::kStringPrototypePadStart, 1, false);
    2017             :     SimpleInstallFunction(isolate_, prototype, "repeat",
    2018         111 :                           Builtins::kStringPrototypeRepeat, 1, true);
    2019             :     SimpleInstallFunction(isolate_, prototype, "replace",
    2020         111 :                           Builtins::kStringPrototypeReplace, 2, true);
    2021             :     SimpleInstallFunction(isolate_, prototype, "search",
    2022         111 :                           Builtins::kStringPrototypeSearch, 1, true);
    2023             :     SimpleInstallFunction(isolate_, prototype, "slice",
    2024         111 :                           Builtins::kStringPrototypeSlice, 2, false);
    2025             :     SimpleInstallFunction(isolate_, prototype, "small",
    2026         111 :                           Builtins::kStringPrototypeSmall, 0, true);
    2027             :     SimpleInstallFunction(isolate_, prototype, "split",
    2028         111 :                           Builtins::kStringPrototypeSplit, 2, false);
    2029             :     SimpleInstallFunction(isolate_, prototype, "strike",
    2030         111 :                           Builtins::kStringPrototypeStrike, 0, true);
    2031             :     SimpleInstallFunction(isolate_, prototype, "sub",
    2032         111 :                           Builtins::kStringPrototypeSub, 0, true);
    2033             :     SimpleInstallFunction(isolate_, prototype, "substr",
    2034         111 :                           Builtins::kStringPrototypeSubstr, 2, false);
    2035             :     SimpleInstallFunction(isolate_, prototype, "substring",
    2036         111 :                           Builtins::kStringPrototypeSubstring, 2, false);
    2037             :     SimpleInstallFunction(isolate_, prototype, "sup",
    2038         111 :                           Builtins::kStringPrototypeSup, 0, true);
    2039             :     SimpleInstallFunction(isolate_, prototype, "startsWith",
    2040         111 :                           Builtins::kStringPrototypeStartsWith, 1, false);
    2041             :     SimpleInstallFunction(isolate_, prototype, "toString",
    2042         111 :                           Builtins::kStringPrototypeToString, 0, true);
    2043             :     SimpleInstallFunction(isolate_, prototype, "trim",
    2044         111 :                           Builtins::kStringPrototypeTrim, 0, false);
    2045             : 
    2046             :     // Install `String.prototype.trimStart` with `trimLeft` alias.
    2047             :     Handle<JSFunction> trim_start_fun =
    2048             :         SimpleInstallFunction(isolate_, prototype, "trimStart",
    2049         111 :                               Builtins::kStringPrototypeTrimStart, 0, false);
    2050             :     JSObject::AddProperty(isolate_, prototype, "trimLeft", trim_start_fun,
    2051         111 :                           DONT_ENUM);
    2052             : 
    2053             :     // Install `String.prototype.trimEnd` with `trimRight` alias.
    2054             :     Handle<JSFunction> trim_end_fun =
    2055             :         SimpleInstallFunction(isolate_, prototype, "trimEnd",
    2056         111 :                               Builtins::kStringPrototypeTrimEnd, 0, false);
    2057             :     JSObject::AddProperty(isolate_, prototype, "trimRight", trim_end_fun,
    2058         111 :                           DONT_ENUM);
    2059             : 
    2060             :     SimpleInstallFunction(isolate_, prototype, "toLocaleLowerCase",
    2061             :                           Builtins::kStringPrototypeToLocaleLowerCase, 0,
    2062         111 :                           false);
    2063             :     SimpleInstallFunction(isolate_, prototype, "toLocaleUpperCase",
    2064             :                           Builtins::kStringPrototypeToLocaleUpperCase, 0,
    2065         111 :                           false);
    2066             : #ifdef V8_INTL_SUPPORT
    2067             :     SimpleInstallFunction(isolate_, prototype, "toLowerCase",
    2068         111 :                           Builtins::kStringPrototypeToLowerCaseIntl, 0, true);
    2069             :     SimpleInstallFunction(isolate_, prototype, "toUpperCase",
    2070         111 :                           Builtins::kStringPrototypeToUpperCaseIntl, 0, false);
    2071             : #else
    2072             :     SimpleInstallFunction(isolate_, prototype, "toLowerCase",
    2073             :                           Builtins::kStringPrototypeToLowerCase, 0, false);
    2074             :     SimpleInstallFunction(isolate_, prototype, "toUpperCase",
    2075             :                           Builtins::kStringPrototypeToUpperCase, 0, false);
    2076             : #endif
    2077             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    2078         111 :                           Builtins::kStringPrototypeValueOf, 0, true);
    2079             : 
    2080             :     InstallFunctionAtSymbol(isolate_, prototype, factory->iterator_symbol(),
    2081             :                             "[Symbol.iterator]",
    2082             :                             Builtins::kStringPrototypeIterator, 0, true,
    2083         111 :                             DONT_ENUM, BuiltinFunctionId::kStringIterator);
    2084             :   }
    2085             : 
    2086             :   {  // --- S t r i n g I t e r a t o r ---
    2087             :     Handle<JSObject> iterator_prototype(
    2088         222 :         native_context()->initial_iterator_prototype(), isolate());
    2089             : 
    2090             :     Handle<JSObject> string_iterator_prototype =
    2091         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    2092         111 :     JSObject::ForceSetPrototype(string_iterator_prototype, iterator_prototype);
    2093             : 
    2094         111 :     InstallToStringTag(isolate_, string_iterator_prototype, "String Iterator");
    2095             : 
    2096             :     InstallFunctionWithBuiltinId(isolate_, string_iterator_prototype, "next",
    2097             :                                  Builtins::kStringIteratorPrototypeNext, 0,
    2098         111 :                                  true, BuiltinFunctionId::kStringIteratorNext);
    2099             : 
    2100             :     Handle<JSFunction> string_iterator_function = CreateFunction(
    2101             :         isolate_, factory->InternalizeUtf8String("StringIterator"),
    2102             :         JS_STRING_ITERATOR_TYPE, JSStringIterator::kSize, 0,
    2103         111 :         string_iterator_prototype, Builtins::kIllegal);
    2104         111 :     string_iterator_function->shared()->set_native(false);
    2105         222 :     native_context()->set_initial_string_iterator_map(
    2106         333 :         string_iterator_function->initial_map());
    2107         222 :     native_context()->set_initial_string_iterator_prototype(
    2108         111 :         *string_iterator_prototype);
    2109             :   }
    2110             : 
    2111             :   {  // --- S y m b o l ---
    2112             :     Handle<JSFunction> symbol_fun = InstallFunction(
    2113             :         isolate_, global, "Symbol", JS_VALUE_TYPE, JSValue::kSize, 0,
    2114         111 :         factory->the_hole_value(), Builtins::kSymbolConstructor);
    2115         222 :     symbol_fun->shared()->set_builtin_function_id(
    2116         222 :         BuiltinFunctionId::kSymbolConstructor);
    2117         222 :     symbol_fun->shared()->set_length(0);
    2118         222 :     symbol_fun->shared()->DontAdaptArguments();
    2119         111 :     native_context()->set_symbol_function(*symbol_fun);
    2120             : 
    2121             :     // Install the Symbol.for and Symbol.keyFor functions.
    2122             :     SimpleInstallFunction(isolate_, symbol_fun, "for", Builtins::kSymbolFor, 1,
    2123         111 :                           false);
    2124             :     SimpleInstallFunction(isolate_, symbol_fun, "keyFor",
    2125         111 :                           Builtins::kSymbolKeyFor, 1, false);
    2126             : 
    2127             :     // Install well-known symbols.
    2128             :     InstallConstant(isolate_, symbol_fun, "asyncIterator",
    2129         111 :                     factory->async_iterator_symbol());
    2130             :     InstallConstant(isolate_, symbol_fun, "hasInstance",
    2131         111 :                     factory->has_instance_symbol());
    2132             :     InstallConstant(isolate_, symbol_fun, "isConcatSpreadable",
    2133         111 :                     factory->is_concat_spreadable_symbol());
    2134             :     InstallConstant(isolate_, symbol_fun, "iterator",
    2135         111 :                     factory->iterator_symbol());
    2136         111 :     InstallConstant(isolate_, symbol_fun, "match", factory->match_symbol());
    2137         111 :     InstallConstant(isolate_, symbol_fun, "replace", factory->replace_symbol());
    2138         111 :     InstallConstant(isolate_, symbol_fun, "search", factory->search_symbol());
    2139         111 :     InstallConstant(isolate_, symbol_fun, "species", factory->species_symbol());
    2140         111 :     InstallConstant(isolate_, symbol_fun, "split", factory->split_symbol());
    2141             :     InstallConstant(isolate_, symbol_fun, "toPrimitive",
    2142         111 :                     factory->to_primitive_symbol());
    2143             :     InstallConstant(isolate_, symbol_fun, "toStringTag",
    2144         111 :                     factory->to_string_tag_symbol());
    2145             :     InstallConstant(isolate_, symbol_fun, "unscopables",
    2146         111 :                     factory->unscopables_symbol());
    2147             : 
    2148             :     // Setup %SymbolPrototype%.
    2149             :     Handle<JSObject> prototype(JSObject::cast(symbol_fun->instance_prototype()),
    2150         222 :                                isolate());
    2151             : 
    2152         111 :     InstallToStringTag(isolate_, prototype, "Symbol");
    2153             : 
    2154             :     // Install the Symbol.prototype methods.
    2155             :     InstallFunctionWithBuiltinId(isolate_, prototype, "toString",
    2156             :                                  Builtins::kSymbolPrototypeToString, 0, true,
    2157         111 :                                  BuiltinFunctionId::kSymbolPrototypeToString);
    2158             :     InstallFunctionWithBuiltinId(isolate_, prototype, "valueOf",
    2159             :                                  Builtins::kSymbolPrototypeValueOf, 0, true,
    2160         111 :                                  BuiltinFunctionId::kSymbolPrototypeValueOf);
    2161             : 
    2162             :     // Install the Symbol.prototype.description getter.
    2163             :     SimpleInstallGetter(isolate_, prototype,
    2164             :                         factory->InternalizeUtf8String("description"),
    2165         222 :                         Builtins::kSymbolPrototypeDescriptionGetter, true);
    2166             : 
    2167             :     // Install the @@toPrimitive function.
    2168             :     InstallFunctionAtSymbol(
    2169             :         isolate_, prototype, factory->to_primitive_symbol(),
    2170             :         "[Symbol.toPrimitive]", Builtins::kSymbolPrototypeToPrimitive, 1, true,
    2171         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2172             :   }
    2173             : 
    2174             :   {  // --- D a t e ---
    2175             :     Handle<JSFunction> date_fun = InstallFunction(
    2176             :         isolate_, global, "Date", JS_DATE_TYPE, JSDate::kSize, 0,
    2177         111 :         factory->the_hole_value(), Builtins::kDateConstructor);
    2178             :     InstallWithIntrinsicDefaultProto(isolate_, date_fun,
    2179         111 :                                      Context::DATE_FUNCTION_INDEX);
    2180         222 :     date_fun->shared()->set_length(7);
    2181         222 :     date_fun->shared()->DontAdaptArguments();
    2182             : 
    2183             :     // Install the Date.now, Date.parse and Date.UTC functions.
    2184             :     SimpleInstallFunction(isolate_, date_fun, "now", Builtins::kDateNow, 0,
    2185         111 :                           false);
    2186             :     SimpleInstallFunction(isolate_, date_fun, "parse", Builtins::kDateParse, 1,
    2187         111 :                           false);
    2188             :     SimpleInstallFunction(isolate_, date_fun, "UTC", Builtins::kDateUTC, 7,
    2189         111 :                           false);
    2190             : 
    2191             :     // Setup %DatePrototype%.
    2192             :     Handle<JSObject> prototype(JSObject::cast(date_fun->instance_prototype()),
    2193         222 :                                isolate());
    2194             : 
    2195             :     // Install the Date.prototype methods.
    2196             :     SimpleInstallFunction(isolate_, prototype, "toString",
    2197         111 :                           Builtins::kDatePrototypeToString, 0, false);
    2198             :     SimpleInstallFunction(isolate_, prototype, "toDateString",
    2199         111 :                           Builtins::kDatePrototypeToDateString, 0, false);
    2200             :     SimpleInstallFunction(isolate_, prototype, "toTimeString",
    2201         111 :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2202             :     SimpleInstallFunction(isolate_, prototype, "toISOString",
    2203         111 :                           Builtins::kDatePrototypeToISOString, 0, false);
    2204             :     Handle<JSFunction> to_utc_string =
    2205             :         SimpleInstallFunction(isolate_, prototype, "toUTCString",
    2206         111 :                               Builtins::kDatePrototypeToUTCString, 0, false);
    2207             :     JSObject::AddProperty(isolate_, prototype, "toGMTString", to_utc_string,
    2208         111 :                           DONT_ENUM);
    2209             :     SimpleInstallFunction(isolate_, prototype, "getDate",
    2210         111 :                           Builtins::kDatePrototypeGetDate, 0, true);
    2211             :     SimpleInstallFunction(isolate_, prototype, "setDate",
    2212         111 :                           Builtins::kDatePrototypeSetDate, 1, false);
    2213             :     SimpleInstallFunction(isolate_, prototype, "getDay",
    2214         111 :                           Builtins::kDatePrototypeGetDay, 0, true);
    2215             :     SimpleInstallFunction(isolate_, prototype, "getFullYear",
    2216         111 :                           Builtins::kDatePrototypeGetFullYear, 0, true);
    2217             :     SimpleInstallFunction(isolate_, prototype, "setFullYear",
    2218         111 :                           Builtins::kDatePrototypeSetFullYear, 3, false);
    2219             :     SimpleInstallFunction(isolate_, prototype, "getHours",
    2220         111 :                           Builtins::kDatePrototypeGetHours, 0, true);
    2221             :     SimpleInstallFunction(isolate_, prototype, "setHours",
    2222         111 :                           Builtins::kDatePrototypeSetHours, 4, false);
    2223             :     SimpleInstallFunction(isolate_, prototype, "getMilliseconds",
    2224         111 :                           Builtins::kDatePrototypeGetMilliseconds, 0, true);
    2225             :     SimpleInstallFunction(isolate_, prototype, "setMilliseconds",
    2226         111 :                           Builtins::kDatePrototypeSetMilliseconds, 1, false);
    2227             :     SimpleInstallFunction(isolate_, prototype, "getMinutes",
    2228         111 :                           Builtins::kDatePrototypeGetMinutes, 0, true);
    2229             :     SimpleInstallFunction(isolate_, prototype, "setMinutes",
    2230         111 :                           Builtins::kDatePrototypeSetMinutes, 3, false);
    2231             :     SimpleInstallFunction(isolate_, prototype, "getMonth",
    2232         111 :                           Builtins::kDatePrototypeGetMonth, 0, true);
    2233             :     SimpleInstallFunction(isolate_, prototype, "setMonth",
    2234         111 :                           Builtins::kDatePrototypeSetMonth, 2, false);
    2235             :     SimpleInstallFunction(isolate_, prototype, "getSeconds",
    2236         111 :                           Builtins::kDatePrototypeGetSeconds, 0, true);
    2237             :     SimpleInstallFunction(isolate_, prototype, "setSeconds",
    2238         111 :                           Builtins::kDatePrototypeSetSeconds, 2, false);
    2239             :     SimpleInstallFunction(isolate_, prototype, "getTime",
    2240         111 :                           Builtins::kDatePrototypeGetTime, 0, true);
    2241             :     SimpleInstallFunction(isolate_, prototype, "setTime",
    2242         111 :                           Builtins::kDatePrototypeSetTime, 1, false);
    2243             :     SimpleInstallFunction(isolate_, prototype, "getTimezoneOffset",
    2244         111 :                           Builtins::kDatePrototypeGetTimezoneOffset, 0, true);
    2245             :     SimpleInstallFunction(isolate_, prototype, "getUTCDate",
    2246         111 :                           Builtins::kDatePrototypeGetUTCDate, 0, true);
    2247             :     SimpleInstallFunction(isolate_, prototype, "setUTCDate",
    2248         111 :                           Builtins::kDatePrototypeSetUTCDate, 1, false);
    2249             :     SimpleInstallFunction(isolate_, prototype, "getUTCDay",
    2250         111 :                           Builtins::kDatePrototypeGetUTCDay, 0, true);
    2251             :     SimpleInstallFunction(isolate_, prototype, "getUTCFullYear",
    2252         111 :                           Builtins::kDatePrototypeGetUTCFullYear, 0, true);
    2253             :     SimpleInstallFunction(isolate_, prototype, "setUTCFullYear",
    2254         111 :                           Builtins::kDatePrototypeSetUTCFullYear, 3, false);
    2255             :     SimpleInstallFunction(isolate_, prototype, "getUTCHours",
    2256         111 :                           Builtins::kDatePrototypeGetUTCHours, 0, true);
    2257             :     SimpleInstallFunction(isolate_, prototype, "setUTCHours",
    2258         111 :                           Builtins::kDatePrototypeSetUTCHours, 4, false);
    2259             :     SimpleInstallFunction(isolate_, prototype, "getUTCMilliseconds",
    2260         111 :                           Builtins::kDatePrototypeGetUTCMilliseconds, 0, true);
    2261             :     SimpleInstallFunction(isolate_, prototype, "setUTCMilliseconds",
    2262         111 :                           Builtins::kDatePrototypeSetUTCMilliseconds, 1, false);
    2263             :     SimpleInstallFunction(isolate_, prototype, "getUTCMinutes",
    2264         111 :                           Builtins::kDatePrototypeGetUTCMinutes, 0, true);
    2265             :     SimpleInstallFunction(isolate_, prototype, "setUTCMinutes",
    2266         111 :                           Builtins::kDatePrototypeSetUTCMinutes, 3, false);
    2267             :     SimpleInstallFunction(isolate_, prototype, "getUTCMonth",
    2268         111 :                           Builtins::kDatePrototypeGetUTCMonth, 0, true);
    2269             :     SimpleInstallFunction(isolate_, prototype, "setUTCMonth",
    2270         111 :                           Builtins::kDatePrototypeSetUTCMonth, 2, false);
    2271             :     SimpleInstallFunction(isolate_, prototype, "getUTCSeconds",
    2272         111 :                           Builtins::kDatePrototypeGetUTCSeconds, 0, true);
    2273             :     SimpleInstallFunction(isolate_, prototype, "setUTCSeconds",
    2274         111 :                           Builtins::kDatePrototypeSetUTCSeconds, 2, false);
    2275             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    2276         111 :                           Builtins::kDatePrototypeValueOf, 0, true);
    2277             :     SimpleInstallFunction(isolate_, prototype, "getYear",
    2278         111 :                           Builtins::kDatePrototypeGetYear, 0, true);
    2279             :     SimpleInstallFunction(isolate_, prototype, "setYear",
    2280         111 :                           Builtins::kDatePrototypeSetYear, 1, false);
    2281             :     SimpleInstallFunction(isolate_, prototype, "toJSON",
    2282         111 :                           Builtins::kDatePrototypeToJson, 1, false);
    2283             : 
    2284             : #ifdef V8_INTL_SUPPORT
    2285             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    2286         111 :                           Builtins::kDatePrototypeToLocaleString, 0, false);
    2287             :     SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
    2288         111 :                           Builtins::kDatePrototypeToLocaleDateString, 0, false);
    2289             :     SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
    2290         111 :                           Builtins::kDatePrototypeToLocaleTimeString, 0, false);
    2291             : #else
    2292             :     // Install Intl fallback functions.
    2293             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    2294             :                           Builtins::kDatePrototypeToString, 0, false);
    2295             :     SimpleInstallFunction(isolate_, prototype, "toLocaleDateString",
    2296             :                           Builtins::kDatePrototypeToDateString, 0, false);
    2297             :     SimpleInstallFunction(isolate_, prototype, "toLocaleTimeString",
    2298             :                           Builtins::kDatePrototypeToTimeString, 0, false);
    2299             : #endif  // V8_INTL_SUPPORT
    2300             : 
    2301             :     // Install the @@toPrimitive function.
    2302             :     InstallFunctionAtSymbol(
    2303             :         isolate_, prototype, factory->to_primitive_symbol(),
    2304             :         "[Symbol.toPrimitive]", Builtins::kDatePrototypeToPrimitive, 1, true,
    2305         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    2306             :   }
    2307             : 
    2308             :   {
    2309             :     Handle<SharedFunctionInfo> info = SimpleCreateBuiltinSharedFunctionInfo(
    2310             :         isolate_, Builtins::kPromiseGetCapabilitiesExecutor,
    2311         111 :         factory->empty_string(), 2);
    2312         111 :     native_context()->set_promise_get_capabilities_executor_shared_fun(*info);
    2313             :   }
    2314             : 
    2315             :   {  // -- P r o m i s e
    2316             :     Handle<JSFunction> promise_fun = InstallFunction(
    2317             :         isolate_, global, "Promise", JS_PROMISE_TYPE,
    2318             :         JSPromise::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    2319         111 :         Builtins::kPromiseConstructor);
    2320             :     InstallWithIntrinsicDefaultProto(isolate_, promise_fun,
    2321         111 :                                      Context::PROMISE_FUNCTION_INDEX);
    2322             : 
    2323         333 :     Handle<SharedFunctionInfo> shared(promise_fun->shared(), isolate_);
    2324             :     shared->set_internal_formal_parameter_count(1);
    2325             :     shared->set_length(1);
    2326             : 
    2327         111 :     InstallSpeciesGetter(isolate_, promise_fun);
    2328             : 
    2329             :     Handle<JSFunction> promise_all = InstallFunctionWithBuiltinId(
    2330             :         isolate_, promise_fun, "all", Builtins::kPromiseAll, 1, true,
    2331         111 :         BuiltinFunctionId::kPromiseAll);
    2332         111 :     native_context()->set_promise_all(*promise_all);
    2333             : 
    2334             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "race",
    2335             :                                  Builtins::kPromiseRace, 1, true,
    2336         111 :                                  BuiltinFunctionId::kPromiseRace);
    2337             : 
    2338             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "resolve",
    2339             :                                  Builtins::kPromiseResolveTrampoline, 1, true,
    2340         111 :                                  BuiltinFunctionId::kPromiseResolve);
    2341             : 
    2342             :     InstallFunctionWithBuiltinId(isolate_, promise_fun, "reject",
    2343             :                                  Builtins::kPromiseReject, 1, true,
    2344         111 :                                  BuiltinFunctionId::kPromiseReject);
    2345             : 
    2346             :     // Setup %PromisePrototype%.
    2347             :     Handle<JSObject> prototype(
    2348         222 :         JSObject::cast(promise_fun->instance_prototype()), isolate());
    2349         111 :     native_context()->set_promise_prototype(*prototype);
    2350             : 
    2351         111 :     InstallToStringTag(isolate_, prototype, factory->Promise_string());
    2352             : 
    2353             :     Handle<JSFunction> promise_then = InstallFunctionWithBuiltinId(
    2354             :         isolate_, prototype, "then", Builtins::kPromisePrototypeThen, 2, true,
    2355         111 :         BuiltinFunctionId::kPromisePrototypeThen);
    2356         111 :     native_context()->set_promise_then(*promise_then);
    2357             : 
    2358             :     Handle<JSFunction> promise_catch = InstallFunctionWithBuiltinId(
    2359             :         isolate_, prototype, "catch", Builtins::kPromisePrototypeCatch, 1, true,
    2360         111 :         BuiltinFunctionId::kPromisePrototypeCatch);
    2361         111 :     native_context()->set_promise_catch(*promise_catch);
    2362             : 
    2363             :     InstallFunctionWithBuiltinId(isolate_, prototype, "finally",
    2364             :                                  Builtins::kPromisePrototypeFinally, 1, true,
    2365         111 :                                  BuiltinFunctionId::kPromisePrototypeFinally);
    2366             : 
    2367             :     {
    2368             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2369             :           isolate(), Builtins::kPromiseThenFinally,
    2370         222 :           isolate_->factory()->empty_string(), 1);
    2371         111 :       info->set_native(true);
    2372         111 :       native_context()->set_promise_then_finally_shared_fun(*info);
    2373             :     }
    2374             : 
    2375             :     {
    2376             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2377             :           isolate(), Builtins::kPromiseCatchFinally,
    2378         222 :           isolate_->factory()->empty_string(), 1);
    2379         111 :       info->set_native(true);
    2380         111 :       native_context()->set_promise_catch_finally_shared_fun(*info);
    2381             :     }
    2382             : 
    2383             :     {
    2384             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2385             :           isolate(), Builtins::kPromiseValueThunkFinally,
    2386         222 :           isolate_->factory()->empty_string(), 0);
    2387         111 :       native_context()->set_promise_value_thunk_finally_shared_fun(*info);
    2388             :     }
    2389             : 
    2390             :     {
    2391             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2392             :           isolate(), Builtins::kPromiseThrowerFinally,
    2393         222 :           isolate_->factory()->empty_string(), 0);
    2394         111 :       native_context()->set_promise_thrower_finally_shared_fun(*info);
    2395             :     }
    2396             : 
    2397             :     // Force the Promise constructor to fast properties, so that we can use the
    2398             :     // fast paths for various things like
    2399             :     //
    2400             :     //   x instanceof Promise
    2401             :     //
    2402             :     // etc. We should probably come up with a more principled approach once
    2403             :     // the JavaScript builtins are gone.
    2404             :     JSObject::MigrateSlowToFast(Handle<JSObject>::cast(promise_fun), 0,
    2405         111 :                                 "Bootstrapping");
    2406             : 
    2407             :     Handle<Map> prototype_map(prototype->map(), isolate());
    2408         111 :     Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
    2409             : 
    2410             :     {  // Internal: IsPromise
    2411             :       Handle<JSFunction> function = SimpleCreateFunction(
    2412         111 :           isolate_, factory->empty_string(), Builtins::kIsPromise, 1, false);
    2413         111 :       native_context()->set_is_promise(*function);
    2414             :     }
    2415             : 
    2416             :     {
    2417             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2418             :           isolate_, Builtins::kPromiseCapabilityDefaultResolve,
    2419         111 :           factory->empty_string(), 1, FunctionKind::kConciseMethod);
    2420         111 :       info->set_native(true);
    2421             :       info->set_function_map_index(
    2422         111 :           Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
    2423         222 :       native_context()->set_promise_capability_default_resolve_shared_fun(
    2424         111 :           *info);
    2425             : 
    2426             :       info = SimpleCreateSharedFunctionInfo(
    2427             :           isolate_, Builtins::kPromiseCapabilityDefaultReject,
    2428         111 :           factory->empty_string(), 1, FunctionKind::kConciseMethod);
    2429         111 :       info->set_native(true);
    2430             :       info->set_function_map_index(
    2431         111 :           Context::STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX);
    2432         111 :       native_context()->set_promise_capability_default_reject_shared_fun(*info);
    2433             :     }
    2434             : 
    2435             :     {
    2436             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    2437             :           isolate_, Builtins::kPromiseAllResolveElementClosure,
    2438         111 :           factory->empty_string(), 1);
    2439         111 :       native_context()->set_promise_all_resolve_element_shared_fun(*info);
    2440             :     }
    2441             : 
    2442             :     // Force the Promise constructor to fast properties, so that we can use the
    2443             :     // fast paths for various things like
    2444             :     //
    2445             :     //   x instanceof Promise
    2446             :     //
    2447             :     // etc. We should probably come up with a more principled approach once
    2448             :     // the JavaScript builtins are gone.
    2449         111 :     JSObject::MigrateSlowToFast(promise_fun, 0, "Bootstrapping");
    2450             :   }
    2451             : 
    2452             :   {  // -- R e g E x p
    2453             :     // Builtin functions for RegExp.prototype.
    2454             :     Handle<JSFunction> regexp_fun = InstallFunction(
    2455             :         isolate_, global, "RegExp", JS_REGEXP_TYPE,
    2456             :         JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kTaggedSize,
    2457             :         JSRegExp::kInObjectFieldCount, factory->the_hole_value(),
    2458         111 :         Builtins::kRegExpConstructor);
    2459             :     InstallWithIntrinsicDefaultProto(isolate_, regexp_fun,
    2460         111 :                                      Context::REGEXP_FUNCTION_INDEX);
    2461             : 
    2462         333 :     Handle<SharedFunctionInfo> shared(regexp_fun->shared(), isolate_);
    2463             :     shared->set_internal_formal_parameter_count(2);
    2464             :     shared->set_length(2);
    2465             : 
    2466             :     {
    2467             :       // Setup %RegExpPrototype%.
    2468             :       Handle<JSObject> prototype(
    2469         222 :           JSObject::cast(regexp_fun->instance_prototype()), isolate());
    2470         111 :       native_context()->set_regexp_prototype(*prototype);
    2471             : 
    2472             :       {
    2473             :         Handle<JSFunction> fun =
    2474             :             SimpleInstallFunction(isolate_, prototype, "exec",
    2475         111 :                                   Builtins::kRegExpPrototypeExec, 1, true);
    2476             :         // Check that index of "exec" function in JSRegExp is correct.
    2477             :         DCHECK_EQ(JSRegExp::kExecFunctionDescriptorIndex,
    2478             :                   prototype->map()->LastAdded());
    2479             : 
    2480         111 :         native_context()->set_regexp_exec_function(*fun);
    2481             :       }
    2482             : 
    2483             :       SimpleInstallGetter(isolate_, prototype, factory->dotAll_string(),
    2484         111 :                           Builtins::kRegExpPrototypeDotAllGetter, true);
    2485             :       SimpleInstallGetter(isolate_, prototype, factory->flags_string(),
    2486         111 :                           Builtins::kRegExpPrototypeFlagsGetter, true);
    2487             :       SimpleInstallGetter(isolate_, prototype, factory->global_string(),
    2488         111 :                           Builtins::kRegExpPrototypeGlobalGetter, true);
    2489             :       SimpleInstallGetter(isolate_, prototype, factory->ignoreCase_string(),
    2490         111 :                           Builtins::kRegExpPrototypeIgnoreCaseGetter, true);
    2491             :       SimpleInstallGetter(isolate_, prototype, factory->multiline_string(),
    2492         111 :                           Builtins::kRegExpPrototypeMultilineGetter, true);
    2493             :       SimpleInstallGetter(isolate_, prototype, factory->source_string(),
    2494         111 :                           Builtins::kRegExpPrototypeSourceGetter, true);
    2495             :       SimpleInstallGetter(isolate_, prototype, factory->sticky_string(),
    2496         111 :                           Builtins::kRegExpPrototypeStickyGetter, true);
    2497             :       SimpleInstallGetter(isolate_, prototype, factory->unicode_string(),
    2498         111 :                           Builtins::kRegExpPrototypeUnicodeGetter, true);
    2499             : 
    2500             :       SimpleInstallFunction(isolate_, prototype, "compile",
    2501         111 :                             Builtins::kRegExpPrototypeCompile, 2, true);
    2502             :       SimpleInstallFunction(isolate_, prototype, "toString",
    2503         111 :                             Builtins::kRegExpPrototypeToString, 0, false);
    2504             :       SimpleInstallFunction(isolate_, prototype, "test",
    2505         111 :                             Builtins::kRegExpPrototypeTest, 1, true);
    2506             : 
    2507             :       InstallFunctionAtSymbol(isolate_, prototype, factory->match_symbol(),
    2508             :                               "[Symbol.match]", Builtins::kRegExpPrototypeMatch,
    2509         111 :                               1, true);
    2510             :       DCHECK_EQ(JSRegExp::kSymbolMatchFunctionDescriptorIndex,
    2511             :                 prototype->map()->LastAdded());
    2512             : 
    2513             :       InstallFunctionAtSymbol(isolate_, prototype, factory->replace_symbol(),
    2514             :                               "[Symbol.replace]",
    2515         111 :                               Builtins::kRegExpPrototypeReplace, 2, false);
    2516             :       DCHECK_EQ(JSRegExp::kSymbolReplaceFunctionDescriptorIndex,
    2517             :                 prototype->map()->LastAdded());
    2518             : 
    2519             :       InstallFunctionAtSymbol(isolate_, prototype, factory->search_symbol(),
    2520             :                               "[Symbol.search]",
    2521         111 :                               Builtins::kRegExpPrototypeSearch, 1, true);
    2522             :       DCHECK_EQ(JSRegExp::kSymbolSearchFunctionDescriptorIndex,
    2523             :                 prototype->map()->LastAdded());
    2524             : 
    2525             :       InstallFunctionAtSymbol(isolate_, prototype, factory->split_symbol(),
    2526             :                               "[Symbol.split]", Builtins::kRegExpPrototypeSplit,
    2527         111 :                               2, false);
    2528             :       DCHECK_EQ(JSRegExp::kSymbolSplitFunctionDescriptorIndex,
    2529             :                 prototype->map()->LastAdded());
    2530             : 
    2531             :       Handle<Map> prototype_map(prototype->map(), isolate());
    2532         111 :       Map::SetShouldBeFastPrototypeMap(prototype_map, true, isolate_);
    2533             : 
    2534             :       // Store the initial RegExp.prototype map. This is used in fast-path
    2535             :       // checks. Do not alter the prototype after this point.
    2536         111 :       native_context()->set_regexp_prototype_map(*prototype_map);
    2537             :     }
    2538             : 
    2539             :     {
    2540             :       // RegExp getters and setters.
    2541             : 
    2542         111 :       InstallSpeciesGetter(isolate_, regexp_fun);
    2543             : 
    2544             :       // Static properties set by a successful match.
    2545             : 
    2546             :       SimpleInstallGetterSetter(isolate_, regexp_fun, factory->input_string(),
    2547             :                                 Builtins::kRegExpInputGetter,
    2548         111 :                                 Builtins::kRegExpInputSetter);
    2549             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$_",
    2550             :                                 Builtins::kRegExpInputGetter,
    2551         111 :                                 Builtins::kRegExpInputSetter);
    2552             : 
    2553             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "lastMatch",
    2554             :                                 Builtins::kRegExpLastMatchGetter,
    2555         111 :                                 Builtins::kEmptyFunction);
    2556             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$&",
    2557             :                                 Builtins::kRegExpLastMatchGetter,
    2558         111 :                                 Builtins::kEmptyFunction);
    2559             : 
    2560             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "lastParen",
    2561             :                                 Builtins::kRegExpLastParenGetter,
    2562         111 :                                 Builtins::kEmptyFunction);
    2563             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$+",
    2564             :                                 Builtins::kRegExpLastParenGetter,
    2565         111 :                                 Builtins::kEmptyFunction);
    2566             : 
    2567             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "leftContext",
    2568             :                                 Builtins::kRegExpLeftContextGetter,
    2569         111 :                                 Builtins::kEmptyFunction);
    2570             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$`",
    2571             :                                 Builtins::kRegExpLeftContextGetter,
    2572         111 :                                 Builtins::kEmptyFunction);
    2573             : 
    2574             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "rightContext",
    2575             :                                 Builtins::kRegExpRightContextGetter,
    2576         111 :                                 Builtins::kEmptyFunction);
    2577             :       SimpleInstallGetterSetter(isolate_, regexp_fun, "$'",
    2578             :                                 Builtins::kRegExpRightContextGetter,
    2579         111 :                                 Builtins::kEmptyFunction);
    2580             : 
    2581             : #define INSTALL_CAPTURE_GETTER(i)                                \
    2582             :   SimpleInstallGetterSetter(isolate_, regexp_fun, "$" #i,        \
    2583             :                             Builtins::kRegExpCapture##i##Getter, \
    2584             :                             Builtins::kEmptyFunction)
    2585         111 :       INSTALL_CAPTURE_GETTER(1);
    2586         111 :       INSTALL_CAPTURE_GETTER(2);
    2587         111 :       INSTALL_CAPTURE_GETTER(3);
    2588         111 :       INSTALL_CAPTURE_GETTER(4);
    2589         111 :       INSTALL_CAPTURE_GETTER(5);
    2590         111 :       INSTALL_CAPTURE_GETTER(6);
    2591         111 :       INSTALL_CAPTURE_GETTER(7);
    2592         111 :       INSTALL_CAPTURE_GETTER(8);
    2593         111 :       INSTALL_CAPTURE_GETTER(9);
    2594             : #undef INSTALL_CAPTURE_GETTER
    2595             :     }
    2596             : 
    2597             :     DCHECK(regexp_fun->has_initial_map());
    2598         222 :     Handle<Map> initial_map(regexp_fun->initial_map(), isolate());
    2599             : 
    2600             :     DCHECK_EQ(1, initial_map->GetInObjectProperties());
    2601             : 
    2602         111 :     Map::EnsureDescriptorSlack(isolate_, initial_map, 1);
    2603             : 
    2604             :     // ECMA-262, section 15.10.7.5.
    2605             :     PropertyAttributes writable =
    2606             :         static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);
    2607             :     Descriptor d = Descriptor::DataField(isolate(), factory->lastIndex_string(),
    2608             :                                          JSRegExp::kLastIndexFieldIndex,
    2609         111 :                                          writable, Representation::Tagged());
    2610         111 :     initial_map->AppendDescriptor(isolate(), &d);
    2611             : 
    2612             :     // Create the last match info.
    2613         111 :     Handle<RegExpMatchInfo> last_match_info = factory->NewRegExpMatchInfo();
    2614         111 :     native_context()->set_regexp_last_match_info(*last_match_info);
    2615             : 
    2616             :     // Force the RegExp constructor to fast properties, so that we can use the
    2617             :     // fast paths for various things like
    2618             :     //
    2619             :     //   x instanceof RegExp
    2620             :     //
    2621             :     // etc. We should probably come up with a more principled approach once
    2622             :     // the JavaScript builtins are gone.
    2623         111 :     JSObject::MigrateSlowToFast(regexp_fun, 0, "Bootstrapping");
    2624             :   }
    2625             : 
    2626             :   {  // -- E r r o r
    2627             :     InstallError(isolate_, global, factory->Error_string(),
    2628         111 :                  Context::ERROR_FUNCTION_INDEX);
    2629         111 :     InstallMakeError(isolate_, Builtins::kMakeError, Context::MAKE_ERROR_INDEX);
    2630             :   }
    2631             : 
    2632             :   {  // -- E v a l E r r o r
    2633             :     InstallError(isolate_, global, factory->EvalError_string(),
    2634         111 :                  Context::EVAL_ERROR_FUNCTION_INDEX);
    2635             :   }
    2636             : 
    2637             :   {  // -- R a n g e E r r o r
    2638             :     InstallError(isolate_, global, factory->RangeError_string(),
    2639         111 :                  Context::RANGE_ERROR_FUNCTION_INDEX);
    2640             :     InstallMakeError(isolate_, Builtins::kMakeRangeError,
    2641         111 :                      Context::MAKE_RANGE_ERROR_INDEX);
    2642             :   }
    2643             : 
    2644             :   {  // -- R e f e r e n c e E r r o r
    2645             :     InstallError(isolate_, global, factory->ReferenceError_string(),
    2646         111 :                  Context::REFERENCE_ERROR_FUNCTION_INDEX);
    2647             :   }
    2648             : 
    2649             :   {  // -- S y n t a x E r r o r
    2650             :     InstallError(isolate_, global, factory->SyntaxError_string(),
    2651         111 :                  Context::SYNTAX_ERROR_FUNCTION_INDEX);
    2652             :     InstallMakeError(isolate_, Builtins::kMakeSyntaxError,
    2653         111 :                      Context::MAKE_SYNTAX_ERROR_INDEX);
    2654             :   }
    2655             : 
    2656             :   {  // -- T y p e E r r o r
    2657             :     InstallError(isolate_, global, factory->TypeError_string(),
    2658         111 :                  Context::TYPE_ERROR_FUNCTION_INDEX);
    2659             :     InstallMakeError(isolate_, Builtins::kMakeTypeError,
    2660         111 :                      Context::MAKE_TYPE_ERROR_INDEX);
    2661             :   }
    2662             : 
    2663             :   {  // -- U R I E r r o r
    2664             :     InstallError(isolate_, global, factory->URIError_string(),
    2665         111 :                  Context::URI_ERROR_FUNCTION_INDEX);
    2666             :     InstallMakeError(isolate_, Builtins::kMakeURIError,
    2667         111 :                      Context::MAKE_URI_ERROR_INDEX);
    2668             :   }
    2669             : 
    2670             :   {  // -- C o m p i l e E r r o r
    2671         111 :     Handle<JSObject> dummy = factory->NewJSObject(isolate_->object_function());
    2672             :     InstallError(isolate_, dummy, factory->CompileError_string(),
    2673         111 :                  Context::WASM_COMPILE_ERROR_FUNCTION_INDEX);
    2674             : 
    2675             :     // -- L i n k E r r o r
    2676             :     InstallError(isolate_, dummy, factory->LinkError_string(),
    2677         111 :                  Context::WASM_LINK_ERROR_FUNCTION_INDEX);
    2678             : 
    2679             :     // -- R u n t i m e E r r o r
    2680             :     InstallError(isolate_, dummy, factory->RuntimeError_string(),
    2681         111 :                  Context::WASM_RUNTIME_ERROR_FUNCTION_INDEX);
    2682             :   }
    2683             : 
    2684             :   // Initialize the embedder data slot.
    2685             :   // TODO(ishell): microtask queue pointer will be moved from native context
    2686             :   // to the embedder data array so we don't need an empty embedder data array.
    2687         111 :   Handle<EmbedderDataArray> embedder_data = factory->NewEmbedderDataArray(0);
    2688         222 :   native_context()->set_embedder_data(*embedder_data);
    2689             : 
    2690             :   {  // -- J S O N
    2691             :     Handle<JSObject> json_object =
    2692         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    2693         111 :     JSObject::AddProperty(isolate_, global, "JSON", json_object, DONT_ENUM);
    2694             :     SimpleInstallFunction(isolate_, json_object, "parse", Builtins::kJsonParse,
    2695         111 :                           2, false);
    2696             :     SimpleInstallFunction(isolate_, json_object, "stringify",
    2697         111 :                           Builtins::kJsonStringify, 3, true);
    2698         111 :     InstallToStringTag(isolate_, json_object, "JSON");
    2699             :   }
    2700             : 
    2701             :   {  // -- M a t h
    2702             :     Handle<JSObject> math =
    2703         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    2704         111 :     JSObject::AddProperty(isolate_, global, "Math", math, DONT_ENUM);
    2705         111 :     SimpleInstallFunction(isolate_, math, "abs", Builtins::kMathAbs, 1, true);
    2706         111 :     SimpleInstallFunction(isolate_, math, "acos", Builtins::kMathAcos, 1, true);
    2707             :     SimpleInstallFunction(isolate_, math, "acosh", Builtins::kMathAcosh, 1,
    2708         111 :                           true);
    2709         111 :     SimpleInstallFunction(isolate_, math, "asin", Builtins::kMathAsin, 1, true);
    2710             :     SimpleInstallFunction(isolate_, math, "asinh", Builtins::kMathAsinh, 1,
    2711         111 :                           true);
    2712         111 :     SimpleInstallFunction(isolate_, math, "atan", Builtins::kMathAtan, 1, true);
    2713             :     SimpleInstallFunction(isolate_, math, "atanh", Builtins::kMathAtanh, 1,
    2714         111 :                           true);
    2715             :     SimpleInstallFunction(isolate_, math, "atan2", Builtins::kMathAtan2, 2,
    2716         111 :                           true);
    2717         111 :     SimpleInstallFunction(isolate_, math, "ceil", Builtins::kMathCeil, 1, true);
    2718         111 :     SimpleInstallFunction(isolate_, math, "cbrt", Builtins::kMathCbrt, 1, true);
    2719             :     SimpleInstallFunction(isolate_, math, "expm1", Builtins::kMathExpm1, 1,
    2720         111 :                           true);
    2721             :     SimpleInstallFunction(isolate_, math, "clz32", Builtins::kMathClz32, 1,
    2722         111 :                           true);
    2723         111 :     SimpleInstallFunction(isolate_, math, "cos", Builtins::kMathCos, 1, true);
    2724         111 :     SimpleInstallFunction(isolate_, math, "cosh", Builtins::kMathCosh, 1, true);
    2725         111 :     SimpleInstallFunction(isolate_, math, "exp", Builtins::kMathExp, 1, true);
    2726             :     Handle<JSFunction> math_floor = SimpleInstallFunction(
    2727         111 :         isolate_, math, "floor", Builtins::kMathFloor, 1, true);
    2728         111 :     native_context()->set_math_floor(*math_floor);
    2729             :     SimpleInstallFunction(isolate_, math, "fround", Builtins::kMathFround, 1,
    2730         111 :                           true);
    2731             :     SimpleInstallFunction(isolate_, math, "hypot", Builtins::kMathHypot, 2,
    2732         111 :                           false);
    2733         111 :     SimpleInstallFunction(isolate_, math, "imul", Builtins::kMathImul, 2, true);
    2734         111 :     SimpleInstallFunction(isolate_, math, "log", Builtins::kMathLog, 1, true);
    2735             :     SimpleInstallFunction(isolate_, math, "log1p", Builtins::kMathLog1p, 1,
    2736         111 :                           true);
    2737         111 :     SimpleInstallFunction(isolate_, math, "log2", Builtins::kMathLog2, 1, true);
    2738             :     SimpleInstallFunction(isolate_, math, "log10", Builtins::kMathLog10, 1,
    2739         111 :                           true);
    2740         111 :     SimpleInstallFunction(isolate_, math, "max", Builtins::kMathMax, 2, false);
    2741         111 :     SimpleInstallFunction(isolate_, math, "min", Builtins::kMathMin, 2, false);
    2742             :     Handle<JSFunction> math_pow = SimpleInstallFunction(
    2743         111 :         isolate_, math, "pow", Builtins::kMathPow, 2, true);
    2744         111 :     native_context()->set_math_pow(*math_pow);
    2745             :     SimpleInstallFunction(isolate_, math, "random", Builtins::kMathRandom, 0,
    2746         111 :                           true);
    2747             :     SimpleInstallFunction(isolate_, math, "round", Builtins::kMathRound, 1,
    2748         111 :                           true);
    2749         111 :     SimpleInstallFunction(isolate_, math, "sign", Builtins::kMathSign, 1, true);
    2750         111 :     SimpleInstallFunction(isolate_, math, "sin", Builtins::kMathSin, 1, true);
    2751         111 :     SimpleInstallFunction(isolate_, math, "sinh", Builtins::kMathSinh, 1, true);
    2752         111 :     SimpleInstallFunction(isolate_, math, "sqrt", Builtins::kMathSqrt, 1, true);
    2753         111 :     SimpleInstallFunction(isolate_, math, "tan", Builtins::kMathTan, 1, true);
    2754         111 :     SimpleInstallFunction(isolate_, math, "tanh", Builtins::kMathTanh, 1, true);
    2755             :     SimpleInstallFunction(isolate_, math, "trunc", Builtins::kMathTrunc, 1,
    2756         111 :                           true);
    2757             : 
    2758             :     // Install math constants.
    2759         111 :     double const kE = base::ieee754::exp(1.0);
    2760             :     double const kPI = 3.1415926535897932;
    2761         111 :     InstallConstant(isolate_, math, "E", factory->NewNumber(kE));
    2762             :     InstallConstant(isolate_, math, "LN10",
    2763         111 :                     factory->NewNumber(base::ieee754::log(10.0)));
    2764             :     InstallConstant(isolate_, math, "LN2",
    2765         111 :                     factory->NewNumber(base::ieee754::log(2.0)));
    2766             :     InstallConstant(isolate_, math, "LOG10E",
    2767         111 :                     factory->NewNumber(base::ieee754::log10(kE)));
    2768             :     InstallConstant(isolate_, math, "LOG2E",
    2769         111 :                     factory->NewNumber(base::ieee754::log2(kE)));
    2770         111 :     InstallConstant(isolate_, math, "PI", factory->NewNumber(kPI));
    2771             :     InstallConstant(isolate_, math, "SQRT1_2",
    2772         111 :                     factory->NewNumber(std::sqrt(0.5)));
    2773             :     InstallConstant(isolate_, math, "SQRT2",
    2774         111 :                     factory->NewNumber(std::sqrt(2.0)));
    2775         111 :     InstallToStringTag(isolate_, math, "Math");
    2776             :   }
    2777             : 
    2778             :   {  // -- C o n s o l e
    2779         111 :     Handle<String> name = factory->InternalizeUtf8String("console");
    2780             :     NewFunctionArgs args = NewFunctionArgs::ForFunctionWithoutCode(
    2781         111 :         name, isolate_->strict_function_map(), LanguageMode::kStrict);
    2782         111 :     Handle<JSFunction> cons = factory->NewFunction(args);
    2783             : 
    2784         111 :     Handle<JSObject> empty = factory->NewJSObject(isolate_->object_function());
    2785         111 :     JSFunction::SetPrototype(cons, empty);
    2786             : 
    2787         111 :     Handle<JSObject> console = factory->NewJSObject(cons, TENURED);
    2788             :     DCHECK(console->IsJSObject());
    2789         111 :     JSObject::AddProperty(isolate_, global, name, console, DONT_ENUM);
    2790             :     SimpleInstallFunction(isolate_, console, "debug", Builtins::kConsoleDebug,
    2791         111 :                           1, false, NONE);
    2792             :     SimpleInstallFunction(isolate_, console, "error", Builtins::kConsoleError,
    2793         111 :                           1, false, NONE);
    2794             :     SimpleInstallFunction(isolate_, console, "info", Builtins::kConsoleInfo, 1,
    2795         111 :                           false, NONE);
    2796             :     SimpleInstallFunction(isolate_, console, "log", Builtins::kConsoleLog, 1,
    2797         111 :                           false, NONE);
    2798             :     SimpleInstallFunction(isolate_, console, "warn", Builtins::kConsoleWarn, 1,
    2799         111 :                           false, NONE);
    2800             :     SimpleInstallFunction(isolate_, console, "dir", Builtins::kConsoleDir, 1,
    2801         111 :                           false, NONE);
    2802             :     SimpleInstallFunction(isolate_, console, "dirxml", Builtins::kConsoleDirXml,
    2803         111 :                           1, false, NONE);
    2804             :     SimpleInstallFunction(isolate_, console, "table", Builtins::kConsoleTable,
    2805         111 :                           1, false, NONE);
    2806             :     SimpleInstallFunction(isolate_, console, "trace", Builtins::kConsoleTrace,
    2807         111 :                           1, false, NONE);
    2808             :     SimpleInstallFunction(isolate_, console, "group", Builtins::kConsoleGroup,
    2809         111 :                           1, false, NONE);
    2810             :     SimpleInstallFunction(isolate_, console, "groupCollapsed",
    2811         111 :                           Builtins::kConsoleGroupCollapsed, 1, false, NONE);
    2812             :     SimpleInstallFunction(isolate_, console, "groupEnd",
    2813         111 :                           Builtins::kConsoleGroupEnd, 1, false, NONE);
    2814             :     SimpleInstallFunction(isolate_, console, "clear", Builtins::kConsoleClear,
    2815         111 :                           1, false, NONE);
    2816             :     SimpleInstallFunction(isolate_, console, "count", Builtins::kConsoleCount,
    2817         111 :                           1, false, NONE);
    2818             :     SimpleInstallFunction(isolate_, console, "countReset",
    2819         111 :                           Builtins::kConsoleCountReset, 1, false, NONE);
    2820             :     SimpleInstallFunction(isolate_, console, "assert",
    2821         111 :                           Builtins::kFastConsoleAssert, 1, false, NONE);
    2822             :     SimpleInstallFunction(isolate_, console, "profile",
    2823         111 :                           Builtins::kConsoleProfile, 1, false, NONE);
    2824             :     SimpleInstallFunction(isolate_, console, "profileEnd",
    2825         111 :                           Builtins::kConsoleProfileEnd, 1, false, NONE);
    2826             :     SimpleInstallFunction(isolate_, console, "time", Builtins::kConsoleTime, 1,
    2827         111 :                           false, NONE);
    2828             :     SimpleInstallFunction(isolate_, console, "timeLog",
    2829         111 :                           Builtins::kConsoleTimeLog, 1, false, NONE);
    2830             :     SimpleInstallFunction(isolate_, console, "timeEnd",
    2831         111 :                           Builtins::kConsoleTimeEnd, 1, false, NONE);
    2832             :     SimpleInstallFunction(isolate_, console, "timeStamp",
    2833         111 :                           Builtins::kConsoleTimeStamp, 1, false, NONE);
    2834             :     SimpleInstallFunction(isolate_, console, "context",
    2835         111 :                           Builtins::kConsoleContext, 1, true, NONE);
    2836         111 :     InstallToStringTag(isolate_, console, "Object");
    2837             :   }
    2838             : 
    2839             : #ifdef V8_INTL_SUPPORT
    2840             :   {  // -- I n t l
    2841             :     Handle<JSObject> intl =
    2842         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    2843         111 :     JSObject::AddProperty(isolate_, global, "Intl", intl, DONT_ENUM);
    2844             : 
    2845             :     SimpleInstallFunction(isolate(), intl, "getCanonicalLocales",
    2846         111 :                           Builtins::kIntlGetCanonicalLocales, 1, false);
    2847             : 
    2848             :     {  // -- D a t e T i m e F o r m a t
    2849             :       Handle<JSFunction> date_time_format_constructor = InstallFunction(
    2850             :           isolate_, intl, "DateTimeFormat", JS_INTL_DATE_TIME_FORMAT_TYPE,
    2851             :           JSDateTimeFormat::kSize, 0, factory->the_hole_value(),
    2852         111 :           Builtins::kDateTimeFormatConstructor);
    2853         222 :       date_time_format_constructor->shared()->set_length(0);
    2854         222 :       date_time_format_constructor->shared()->DontAdaptArguments();
    2855             :       InstallWithIntrinsicDefaultProto(
    2856             :           isolate_, date_time_format_constructor,
    2857         111 :           Context::INTL_DATE_TIME_FORMAT_FUNCTION_INDEX);
    2858             : 
    2859             :       SimpleInstallFunction(
    2860             :           isolate(), date_time_format_constructor, "supportedLocalesOf",
    2861         111 :           Builtins::kDateTimeFormatSupportedLocalesOf, 1, false);
    2862             : 
    2863             :       Handle<JSObject> prototype(
    2864         333 :           JSObject::cast(date_time_format_constructor->prototype()), isolate_);
    2865             : 
    2866         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2867             : 
    2868             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2869             :                             Builtins::kDateTimeFormatPrototypeResolvedOptions,
    2870         111 :                             0, false);
    2871             : 
    2872             :       SimpleInstallFunction(isolate_, prototype, "formatToParts",
    2873             :                             Builtins::kDateTimeFormatPrototypeFormatToParts, 1,
    2874         111 :                             false);
    2875             : 
    2876             :       SimpleInstallGetter(isolate_, prototype,
    2877             :                           factory->InternalizeUtf8String("format"),
    2878         222 :                           Builtins::kDateTimeFormatPrototypeFormat, false);
    2879             :     }
    2880             : 
    2881             :     {  // -- N u m b e r F o r m a t
    2882             :       Handle<JSFunction> number_format_constructor = InstallFunction(
    2883             :           isolate_, intl, "NumberFormat", JS_INTL_NUMBER_FORMAT_TYPE,
    2884             :           JSNumberFormat::kSize, 0, factory->the_hole_value(),
    2885         111 :           Builtins::kNumberFormatConstructor);
    2886         222 :       number_format_constructor->shared()->set_length(0);
    2887         222 :       number_format_constructor->shared()->DontAdaptArguments();
    2888             :       InstallWithIntrinsicDefaultProto(
    2889             :           isolate_, number_format_constructor,
    2890         111 :           Context::INTL_NUMBER_FORMAT_FUNCTION_INDEX);
    2891             : 
    2892             :       SimpleInstallFunction(
    2893             :           isolate(), number_format_constructor, "supportedLocalesOf",
    2894         111 :           Builtins::kNumberFormatSupportedLocalesOf, 1, false);
    2895             : 
    2896             :       Handle<JSObject> prototype(
    2897         333 :           JSObject::cast(number_format_constructor->prototype()), isolate_);
    2898             : 
    2899         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2900             : 
    2901             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2902             :                             Builtins::kNumberFormatPrototypeResolvedOptions, 0,
    2903         111 :                             false);
    2904             : 
    2905             :       SimpleInstallFunction(isolate_, prototype, "formatToParts",
    2906             :                             Builtins::kNumberFormatPrototypeFormatToParts, 1,
    2907         111 :                             false);
    2908             :       SimpleInstallGetter(isolate_, prototype,
    2909             :                           factory->InternalizeUtf8String("format"),
    2910         222 :                           Builtins::kNumberFormatPrototypeFormatNumber, false);
    2911             :     }
    2912             : 
    2913             :     {  // -- C o l l a t o r
    2914             :       Handle<JSFunction> collator_constructor = InstallFunction(
    2915             :           isolate_, intl, "Collator", JS_INTL_COLLATOR_TYPE, JSCollator::kSize,
    2916         111 :           0, factory->the_hole_value(), Builtins::kCollatorConstructor);
    2917         222 :       collator_constructor->shared()->DontAdaptArguments();
    2918             :       InstallWithIntrinsicDefaultProto(isolate_, collator_constructor,
    2919         111 :                                        Context::INTL_COLLATOR_FUNCTION_INDEX);
    2920             : 
    2921             :       SimpleInstallFunction(isolate(), collator_constructor,
    2922             :                             "supportedLocalesOf",
    2923         111 :                             Builtins::kCollatorSupportedLocalesOf, 1, false);
    2924             : 
    2925             :       Handle<JSObject> prototype(
    2926         333 :           JSObject::cast(collator_constructor->prototype()), isolate_);
    2927             : 
    2928         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2929             : 
    2930             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2931             :                             Builtins::kCollatorPrototypeResolvedOptions, 0,
    2932         111 :                             false);
    2933             : 
    2934             :       SimpleInstallGetter(isolate_, prototype,
    2935             :                           factory->InternalizeUtf8String("compare"),
    2936         222 :                           Builtins::kCollatorPrototypeCompare, false);
    2937             :     }
    2938             : 
    2939             :     {  // -- V 8 B r e a k I t e r a t o r
    2940             :       Handle<JSFunction> v8_break_iterator_constructor = InstallFunction(
    2941             :           isolate_, intl, "v8BreakIterator", JS_INTL_V8_BREAK_ITERATOR_TYPE,
    2942             :           JSV8BreakIterator::kSize, 0, factory->the_hole_value(),
    2943         111 :           Builtins::kV8BreakIteratorConstructor);
    2944         222 :       v8_break_iterator_constructor->shared()->DontAdaptArguments();
    2945             : 
    2946             :       SimpleInstallFunction(
    2947             :           isolate_, v8_break_iterator_constructor, "supportedLocalesOf",
    2948         111 :           Builtins::kV8BreakIteratorSupportedLocalesOf, 1, false);
    2949             : 
    2950             :       Handle<JSObject> prototype(
    2951         333 :           JSObject::cast(v8_break_iterator_constructor->prototype()), isolate_);
    2952             : 
    2953         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2954             : 
    2955             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2956             :                             Builtins::kV8BreakIteratorPrototypeResolvedOptions,
    2957         111 :                             0, false);
    2958             : 
    2959             :       SimpleInstallGetter(isolate_, prototype,
    2960             :                           factory->InternalizeUtf8String("adoptText"),
    2961         222 :                           Builtins::kV8BreakIteratorPrototypeAdoptText, false);
    2962             : 
    2963             :       SimpleInstallGetter(isolate_, prototype,
    2964             :                           factory->InternalizeUtf8String("first"),
    2965         222 :                           Builtins::kV8BreakIteratorPrototypeFirst, false);
    2966             : 
    2967             :       SimpleInstallGetter(isolate_, prototype,
    2968             :                           factory->InternalizeUtf8String("next"),
    2969         222 :                           Builtins::kV8BreakIteratorPrototypeNext, false);
    2970             : 
    2971             :       SimpleInstallGetter(isolate_, prototype,
    2972             :                           factory->InternalizeUtf8String("current"),
    2973         222 :                           Builtins::kV8BreakIteratorPrototypeCurrent, false);
    2974             : 
    2975             :       SimpleInstallGetter(isolate_, prototype,
    2976             :                           factory->InternalizeUtf8String("breakType"),
    2977         222 :                           Builtins::kV8BreakIteratorPrototypeBreakType, false);
    2978             :     }
    2979             : 
    2980             :     {  // -- P l u r a l R u l e s
    2981             :       Handle<JSFunction> plural_rules_constructor = InstallFunction(
    2982             :           isolate_, intl, "PluralRules", JS_INTL_PLURAL_RULES_TYPE,
    2983             :           JSPluralRules::kSize, 0, factory->the_hole_value(),
    2984         111 :           Builtins::kPluralRulesConstructor);
    2985         222 :       plural_rules_constructor->shared()->DontAdaptArguments();
    2986             : 
    2987             :       SimpleInstallFunction(isolate(), plural_rules_constructor,
    2988             :                             "supportedLocalesOf",
    2989         111 :                             Builtins::kPluralRulesSupportedLocalesOf, 1, false);
    2990             : 
    2991             :       Handle<JSObject> prototype(
    2992         333 :           JSObject::cast(plural_rules_constructor->prototype()), isolate_);
    2993             : 
    2994         111 :       InstallToStringTag(isolate_, prototype, factory->Object_string());
    2995             : 
    2996             :       SimpleInstallFunction(isolate_, prototype, "resolvedOptions",
    2997             :                             Builtins::kPluralRulesPrototypeResolvedOptions, 0,
    2998         111 :                             false);
    2999             : 
    3000             :       SimpleInstallFunction(isolate_, prototype, "select",
    3001         111 :                             Builtins::kPluralRulesPrototypeSelect, 1, false);
    3002             :     }
    3003             : 
    3004             :     {  // -- R e l a t i v e T i m e F o r m a t e
    3005             :       Handle<JSFunction> relative_time_format_fun = InstallFunction(
    3006             :           isolate(), intl, "RelativeTimeFormat",
    3007             :           JS_INTL_RELATIVE_TIME_FORMAT_TYPE, JSRelativeTimeFormat::kSize, 0,
    3008         111 :           factory->the_hole_value(), Builtins::kRelativeTimeFormatConstructor);
    3009         222 :       relative_time_format_fun->shared()->set_length(0);
    3010         222 :       relative_time_format_fun->shared()->DontAdaptArguments();
    3011             : 
    3012             :       SimpleInstallFunction(
    3013             :           isolate(), relative_time_format_fun, "supportedLocalesOf",
    3014         111 :           Builtins::kRelativeTimeFormatSupportedLocalesOf, 1, false);
    3015             : 
    3016             :       // Setup %RelativeTimeFormatPrototype%.
    3017             :       Handle<JSObject> prototype(
    3018             :           JSObject::cast(relative_time_format_fun->instance_prototype()),
    3019         222 :           isolate());
    3020             : 
    3021         111 :       InstallToStringTag(isolate(), prototype, "Intl.RelativeTimeFormat");
    3022             : 
    3023             :       SimpleInstallFunction(
    3024             :           isolate(), prototype, "resolvedOptions",
    3025         111 :           Builtins::kRelativeTimeFormatPrototypeResolvedOptions, 0, false);
    3026             :       SimpleInstallFunction(isolate(), prototype, "format",
    3027             :                             Builtins::kRelativeTimeFormatPrototypeFormat, 2,
    3028         111 :                             false);
    3029             :       SimpleInstallFunction(isolate(), prototype, "formatToParts",
    3030             :                             Builtins::kRelativeTimeFormatPrototypeFormatToParts,
    3031         111 :                             2, false);
    3032             :     }
    3033             : 
    3034             :     {  // -- L i s t F o r m a t
    3035             :       Handle<JSFunction> list_format_fun = InstallFunction(
    3036             :           isolate(), intl, "ListFormat", JS_INTL_LIST_FORMAT_TYPE,
    3037             :           JSListFormat::kSize, 0, factory->the_hole_value(),
    3038         111 :           Builtins::kListFormatConstructor);
    3039         222 :       list_format_fun->shared()->set_length(0);
    3040         222 :       list_format_fun->shared()->DontAdaptArguments();
    3041             : 
    3042             :       SimpleInstallFunction(isolate(), list_format_fun, "supportedLocalesOf",
    3043         111 :                             Builtins::kListFormatSupportedLocalesOf, 1, false);
    3044             : 
    3045             :       // Setup %ListFormatPrototype%.
    3046             :       Handle<JSObject> prototype(
    3047         222 :           JSObject::cast(list_format_fun->instance_prototype()), isolate());
    3048             : 
    3049         111 :       InstallToStringTag(isolate(), prototype, "Intl.ListFormat");
    3050             : 
    3051             :       SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    3052             :                             Builtins::kListFormatPrototypeResolvedOptions, 0,
    3053         111 :                             false);
    3054             :       SimpleInstallFunction(isolate(), prototype, "format",
    3055         111 :                             Builtins::kListFormatPrototypeFormat, 1, false);
    3056             :       SimpleInstallFunction(isolate(), prototype, "formatToParts",
    3057             :                             Builtins::kListFormatPrototypeFormatToParts, 1,
    3058         111 :                             false);
    3059             :     }
    3060             :   }
    3061             : #endif  // V8_INTL_SUPPORT
    3062             : 
    3063             :   {  // -- A r r a y B u f f e r
    3064             :     Handle<String> name = factory->ArrayBuffer_string();
    3065         111 :     Handle<JSFunction> array_buffer_fun = CreateArrayBuffer(name, ARRAY_BUFFER);
    3066         111 :     JSObject::AddProperty(isolate_, global, name, array_buffer_fun, DONT_ENUM);
    3067             :     InstallWithIntrinsicDefaultProto(isolate_, array_buffer_fun,
    3068         111 :                                      Context::ARRAY_BUFFER_FUN_INDEX);
    3069         111 :     InstallSpeciesGetter(isolate_, array_buffer_fun);
    3070             : 
    3071             :     Handle<JSFunction> array_buffer_noinit_fun = SimpleCreateFunction(
    3072             :         isolate_,
    3073             :         factory->InternalizeUtf8String(
    3074             :             "arrayBufferConstructor_DoNotInitialize"),
    3075         111 :         Builtins::kArrayBufferConstructor_DoNotInitialize, 1, false);
    3076         111 :     native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun);
    3077             :   }
    3078             : 
    3079             :   {  // -- S h a r e d A r r a y B u f f e r
    3080         111 :     Handle<String> name = factory->SharedArrayBuffer_string();
    3081             :     Handle<JSFunction> shared_array_buffer_fun =
    3082         111 :         CreateArrayBuffer(name, SHARED_ARRAY_BUFFER);
    3083             :     InstallWithIntrinsicDefaultProto(isolate_, shared_array_buffer_fun,
    3084         111 :                                      Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
    3085         111 :     InstallSpeciesGetter(isolate_, shared_array_buffer_fun);
    3086             :   }
    3087             : 
    3088             :   {  // -- A t o m i c s
    3089             :     Handle<JSObject> atomics_object =
    3090         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    3091         111 :     native_context()->set_atomics_object(*atomics_object);
    3092             : 
    3093             :     SimpleInstallFunction(isolate_, atomics_object, "load",
    3094         111 :                           Builtins::kAtomicsLoad, 2, true);
    3095             :     SimpleInstallFunction(isolate_, atomics_object, "store",
    3096         111 :                           Builtins::kAtomicsStore, 3, true);
    3097             :     SimpleInstallFunction(isolate_, atomics_object, "add",
    3098         111 :                           Builtins::kAtomicsAdd, 3, true);
    3099             :     SimpleInstallFunction(isolate_, atomics_object, "sub",
    3100         111 :                           Builtins::kAtomicsSub, 3, true);
    3101             :     SimpleInstallFunction(isolate_, atomics_object, "and",
    3102         111 :                           Builtins::kAtomicsAnd, 3, true);
    3103             :     SimpleInstallFunction(isolate_, atomics_object, "or", Builtins::kAtomicsOr,
    3104         111 :                           3, true);
    3105             :     SimpleInstallFunction(isolate_, atomics_object, "xor",
    3106         111 :                           Builtins::kAtomicsXor, 3, true);
    3107             :     SimpleInstallFunction(isolate_, atomics_object, "exchange",
    3108         111 :                           Builtins::kAtomicsExchange, 3, true);
    3109             :     SimpleInstallFunction(isolate_, atomics_object, "compareExchange",
    3110         111 :                           Builtins::kAtomicsCompareExchange, 4, true);
    3111             :     SimpleInstallFunction(isolate_, atomics_object, "isLockFree",
    3112         111 :                           Builtins::kAtomicsIsLockFree, 1, true);
    3113             :     SimpleInstallFunction(isolate_, atomics_object, "wait",
    3114         111 :                           Builtins::kAtomicsWait, 4, true);
    3115             :     SimpleInstallFunction(isolate_, atomics_object, "wake",
    3116         111 :                           Builtins::kAtomicsWake, 3, true);
    3117             :     SimpleInstallFunction(isolate_, atomics_object, "notify",
    3118         111 :                           Builtins::kAtomicsNotify, 3, true);
    3119             :   }
    3120             : 
    3121             :   {  // -- T y p e d A r r a y
    3122             :     Handle<JSFunction> typed_array_fun = CreateFunction(
    3123             :         isolate_, factory->InternalizeUtf8String("TypedArray"),
    3124             :         JS_TYPED_ARRAY_TYPE, JSTypedArray::kHeaderSize, 0,
    3125         111 :         factory->the_hole_value(), Builtins::kTypedArrayBaseConstructor);
    3126         111 :     typed_array_fun->shared()->set_native(false);
    3127         222 :     typed_array_fun->shared()->set_length(0);
    3128         111 :     InstallSpeciesGetter(isolate_, typed_array_fun);
    3129         111 :     native_context()->set_typed_array_function(*typed_array_fun);
    3130             : 
    3131             :     SimpleInstallFunction(isolate_, typed_array_fun, "of",
    3132         111 :                           Builtins::kTypedArrayOf, 0, false);
    3133             :     SimpleInstallFunction(isolate_, typed_array_fun, "from",
    3134         111 :                           Builtins::kTypedArrayFrom, 1, false);
    3135             : 
    3136             :     // Setup %TypedArrayPrototype%.
    3137             :     Handle<JSObject> prototype(
    3138         222 :         JSObject::cast(typed_array_fun->instance_prototype()), isolate());
    3139         111 :     native_context()->set_typed_array_prototype(*prototype);
    3140             : 
    3141             :     // Install the "buffer", "byteOffset", "byteLength", "length"
    3142             :     // and @@toStringTag getters on the {prototype}.
    3143             :     SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
    3144         111 :                         Builtins::kTypedArrayPrototypeBuffer, false);
    3145             :     SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
    3146             :                         Builtins::kTypedArrayPrototypeByteLength, true,
    3147         111 :                         BuiltinFunctionId::kTypedArrayByteLength);
    3148             :     SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
    3149             :                         Builtins::kTypedArrayPrototypeByteOffset, true,
    3150         111 :                         BuiltinFunctionId::kTypedArrayByteOffset);
    3151             :     SimpleInstallGetter(isolate_, prototype, factory->length_string(),
    3152             :                         Builtins::kTypedArrayPrototypeLength, true,
    3153         111 :                         BuiltinFunctionId::kTypedArrayLength);
    3154             :     SimpleInstallGetter(isolate_, prototype, factory->to_string_tag_symbol(),
    3155             :                         Builtins::kTypedArrayPrototypeToStringTag, true,
    3156         111 :                         BuiltinFunctionId::kTypedArrayToStringTag);
    3157             : 
    3158             :     // Install "keys", "values" and "entries" methods on the {prototype}.
    3159             :     InstallFunctionWithBuiltinId(isolate_, prototype, "entries",
    3160             :                                  Builtins::kTypedArrayPrototypeEntries, 0, true,
    3161         111 :                                  BuiltinFunctionId::kTypedArrayEntries);
    3162             : 
    3163             :     InstallFunctionWithBuiltinId(isolate_, prototype, "keys",
    3164             :                                  Builtins::kTypedArrayPrototypeKeys, 0, true,
    3165         111 :                                  BuiltinFunctionId::kTypedArrayKeys);
    3166             : 
    3167             :     Handle<JSFunction> values = InstallFunctionWithBuiltinId(
    3168             :         isolate_, prototype, "values", Builtins::kTypedArrayPrototypeValues, 0,
    3169         111 :         true, BuiltinFunctionId::kTypedArrayValues);
    3170             :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3171         111 :                           values, DONT_ENUM);
    3172             : 
    3173             :     // TODO(caitp): alphasort accessors/methods
    3174             :     SimpleInstallFunction(isolate_, prototype, "copyWithin",
    3175         111 :                           Builtins::kTypedArrayPrototypeCopyWithin, 2, false);
    3176             :     SimpleInstallFunction(isolate_, prototype, "every",
    3177         111 :                           Builtins::kTypedArrayPrototypeEvery, 1, false);
    3178             :     SimpleInstallFunction(isolate_, prototype, "fill",
    3179         111 :                           Builtins::kTypedArrayPrototypeFill, 1, false);
    3180             :     SimpleInstallFunction(isolate_, prototype, "filter",
    3181         111 :                           Builtins::kTypedArrayPrototypeFilter, 1, false);
    3182             :     SimpleInstallFunction(isolate_, prototype, "find",
    3183         111 :                           Builtins::kTypedArrayPrototypeFind, 1, false);
    3184             :     SimpleInstallFunction(isolate_, prototype, "findIndex",
    3185         111 :                           Builtins::kTypedArrayPrototypeFindIndex, 1, false);
    3186             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3187         111 :                           Builtins::kTypedArrayPrototypeForEach, 1, false);
    3188             :     SimpleInstallFunction(isolate_, prototype, "includes",
    3189         111 :                           Builtins::kTypedArrayPrototypeIncludes, 1, false);
    3190             :     SimpleInstallFunction(isolate_, prototype, "indexOf",
    3191         111 :                           Builtins::kTypedArrayPrototypeIndexOf, 1, false);
    3192             :     SimpleInstallFunction(isolate_, prototype, "join",
    3193         111 :                           Builtins::kTypedArrayPrototypeJoin, 1, false);
    3194             :     SimpleInstallFunction(isolate_, prototype, "lastIndexOf",
    3195         111 :                           Builtins::kTypedArrayPrototypeLastIndexOf, 1, false);
    3196             :     SimpleInstallFunction(isolate_, prototype, "map",
    3197         111 :                           Builtins::kTypedArrayPrototypeMap, 1, false);
    3198             :     SimpleInstallFunction(isolate_, prototype, "reverse",
    3199         111 :                           Builtins::kTypedArrayPrototypeReverse, 0, false);
    3200             :     SimpleInstallFunction(isolate_, prototype, "reduce",
    3201         111 :                           Builtins::kTypedArrayPrototypeReduce, 1, false);
    3202             :     SimpleInstallFunction(isolate_, prototype, "reduceRight",
    3203         111 :                           Builtins::kTypedArrayPrototypeReduceRight, 1, false);
    3204             :     SimpleInstallFunction(isolate_, prototype, "set",
    3205         111 :                           Builtins::kTypedArrayPrototypeSet, 1, false);
    3206             :     SimpleInstallFunction(isolate_, prototype, "slice",
    3207         111 :                           Builtins::kTypedArrayPrototypeSlice, 2, false);
    3208             :     SimpleInstallFunction(isolate_, prototype, "some",
    3209         111 :                           Builtins::kTypedArrayPrototypeSome, 1, false);
    3210             :     SimpleInstallFunction(isolate_, prototype, "sort",
    3211         111 :                           Builtins::kTypedArrayPrototypeSort, 1, false);
    3212             :     SimpleInstallFunction(isolate_, prototype, "subarray",
    3213         111 :                           Builtins::kTypedArrayPrototypeSubArray, 2, false);
    3214             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    3215             :                           Builtins::kTypedArrayPrototypeToLocaleString, 0,
    3216         111 :                           false);
    3217             :     JSObject::AddProperty(isolate_, prototype, factory->toString_string(),
    3218         111 :                           array_prototype_to_string_fun, DONT_ENUM);
    3219             :   }
    3220             : 
    3221             :   {  // -- T y p e d A r r a y s
    3222             : #define INSTALL_TYPED_ARRAY(Type, type, TYPE, ctype)                   \
    3223             :   {                                                                    \
    3224             :     Handle<JSFunction> fun =                                           \
    3225             :         InstallTypedArray(#Type "Array", TYPE##_ELEMENTS);             \
    3226             :     InstallWithIntrinsicDefaultProto(isolate_, fun,                    \
    3227             :                                      Context::TYPE##_ARRAY_FUN_INDEX); \
    3228             :   }
    3229         111 :     TYPED_ARRAYS(INSTALL_TYPED_ARRAY)
    3230             : #undef INSTALL_TYPED_ARRAY
    3231             :   }
    3232             : 
    3233             :   {  // -- D a t a V i e w
    3234             :     Handle<JSFunction> data_view_fun = InstallFunction(
    3235             :         isolate_, global, "DataView", JS_DATA_VIEW_TYPE,
    3236             :         JSDataView::kSizeWithEmbedderFields, 0, factory->the_hole_value(),
    3237         111 :         Builtins::kDataViewConstructor);
    3238             :     InstallWithIntrinsicDefaultProto(isolate_, data_view_fun,
    3239         111 :                                      Context::DATA_VIEW_FUN_INDEX);
    3240         222 :     data_view_fun->shared()->set_length(1);
    3241         222 :     data_view_fun->shared()->DontAdaptArguments();
    3242             : 
    3243             :     // Setup %DataViewPrototype%.
    3244             :     Handle<JSObject> prototype(
    3245         222 :         JSObject::cast(data_view_fun->instance_prototype()), isolate());
    3246             : 
    3247         111 :     InstallToStringTag(isolate_, prototype, "DataView");
    3248             : 
    3249             :     // Install the "buffer", "byteOffset" and "byteLength" getters
    3250             :     // on the {prototype}.
    3251             :     SimpleInstallGetter(isolate_, prototype, factory->buffer_string(),
    3252             :                         Builtins::kDataViewPrototypeGetBuffer, false,
    3253         111 :                         BuiltinFunctionId::kDataViewBuffer);
    3254             :     SimpleInstallGetter(isolate_, prototype, factory->byte_length_string(),
    3255             :                         Builtins::kDataViewPrototypeGetByteLength, false,
    3256         111 :                         BuiltinFunctionId::kDataViewByteLength);
    3257             :     SimpleInstallGetter(isolate_, prototype, factory->byte_offset_string(),
    3258             :                         Builtins::kDataViewPrototypeGetByteOffset, false,
    3259         111 :                         BuiltinFunctionId::kDataViewByteOffset);
    3260             : 
    3261             :     SimpleInstallFunction(isolate_, prototype, "getInt8",
    3262         111 :                           Builtins::kDataViewPrototypeGetInt8, 1, false);
    3263             :     SimpleInstallFunction(isolate_, prototype, "setInt8",
    3264         111 :                           Builtins::kDataViewPrototypeSetInt8, 2, false);
    3265             :     SimpleInstallFunction(isolate_, prototype, "getUint8",
    3266         111 :                           Builtins::kDataViewPrototypeGetUint8, 1, false);
    3267             :     SimpleInstallFunction(isolate_, prototype, "setUint8",
    3268         111 :                           Builtins::kDataViewPrototypeSetUint8, 2, false);
    3269             :     SimpleInstallFunction(isolate_, prototype, "getInt16",
    3270         111 :                           Builtins::kDataViewPrototypeGetInt16, 1, false);
    3271             :     SimpleInstallFunction(isolate_, prototype, "setInt16",
    3272         111 :                           Builtins::kDataViewPrototypeSetInt16, 2, false);
    3273             :     SimpleInstallFunction(isolate_, prototype, "getUint16",
    3274         111 :                           Builtins::kDataViewPrototypeGetUint16, 1, false);
    3275             :     SimpleInstallFunction(isolate_, prototype, "setUint16",
    3276         111 :                           Builtins::kDataViewPrototypeSetUint16, 2, false);
    3277             :     SimpleInstallFunction(isolate_, prototype, "getInt32",
    3278         111 :                           Builtins::kDataViewPrototypeGetInt32, 1, false);
    3279             :     SimpleInstallFunction(isolate_, prototype, "setInt32",
    3280         111 :                           Builtins::kDataViewPrototypeSetInt32, 2, false);
    3281             :     SimpleInstallFunction(isolate_, prototype, "getUint32",
    3282         111 :                           Builtins::kDataViewPrototypeGetUint32, 1, false);
    3283             :     SimpleInstallFunction(isolate_, prototype, "setUint32",
    3284         111 :                           Builtins::kDataViewPrototypeSetUint32, 2, false);
    3285             :     SimpleInstallFunction(isolate_, prototype, "getFloat32",
    3286         111 :                           Builtins::kDataViewPrototypeGetFloat32, 1, false);
    3287             :     SimpleInstallFunction(isolate_, prototype, "setFloat32",
    3288         111 :                           Builtins::kDataViewPrototypeSetFloat32, 2, false);
    3289             :     SimpleInstallFunction(isolate_, prototype, "getFloat64",
    3290         111 :                           Builtins::kDataViewPrototypeGetFloat64, 1, false);
    3291             :     SimpleInstallFunction(isolate_, prototype, "setFloat64",
    3292         111 :                           Builtins::kDataViewPrototypeSetFloat64, 2, false);
    3293             :     SimpleInstallFunction(isolate_, prototype, "getBigInt64",
    3294         111 :                           Builtins::kDataViewPrototypeGetBigInt64, 1, false);
    3295             :     SimpleInstallFunction(isolate_, prototype, "setBigInt64",
    3296         111 :                           Builtins::kDataViewPrototypeSetBigInt64, 2, false);
    3297             :     SimpleInstallFunction(isolate_, prototype, "getBigUint64",
    3298         111 :                           Builtins::kDataViewPrototypeGetBigUint64, 1, false);
    3299             :     SimpleInstallFunction(isolate_, prototype, "setBigUint64",
    3300         111 :                           Builtins::kDataViewPrototypeSetBigUint64, 2, false);
    3301             :   }
    3302             : 
    3303             :   {  // -- M a p
    3304             :     Handle<JSFunction> js_map_fun =
    3305             :         InstallFunction(isolate_, global, "Map", JS_MAP_TYPE, JSMap::kSize, 0,
    3306         111 :                         factory->the_hole_value(), Builtins::kMapConstructor);
    3307             :     InstallWithIntrinsicDefaultProto(isolate_, js_map_fun,
    3308         111 :                                      Context::JS_MAP_FUN_INDEX);
    3309             : 
    3310         333 :     Handle<SharedFunctionInfo> shared(js_map_fun->shared(), isolate_);
    3311             :     shared->DontAdaptArguments();
    3312             :     shared->set_length(0);
    3313             : 
    3314             :     // Setup %MapPrototype%.
    3315             :     Handle<JSObject> prototype(JSObject::cast(js_map_fun->instance_prototype()),
    3316         222 :                                isolate());
    3317             : 
    3318         111 :     InstallToStringTag(isolate_, prototype, factory->Map_string());
    3319             : 
    3320             :     Handle<JSFunction> map_get = SimpleInstallFunction(
    3321         111 :         isolate_, prototype, "get", Builtins::kMapPrototypeGet, 1, true);
    3322         111 :     native_context()->set_map_get(*map_get);
    3323             : 
    3324             :     Handle<JSFunction> map_set = SimpleInstallFunction(
    3325         111 :         isolate_, prototype, "set", Builtins::kMapPrototypeSet, 2, true);
    3326             :     // Check that index of "set" function in JSCollection is correct.
    3327             :     DCHECK_EQ(JSCollection::kAddFunctionDescriptorIndex,
    3328             :               prototype->map()->LastAdded());
    3329         111 :     native_context()->set_map_set(*map_set);
    3330             : 
    3331             :     Handle<JSFunction> map_has = SimpleInstallFunction(
    3332         111 :         isolate_, prototype, "has", Builtins::kMapPrototypeHas, 1, true);
    3333         111 :     native_context()->set_map_has(*map_has);
    3334             : 
    3335             :     Handle<JSFunction> map_delete = SimpleInstallFunction(
    3336         111 :         isolate_, prototype, "delete", Builtins::kMapPrototypeDelete, 1, true);
    3337         111 :     native_context()->set_map_delete(*map_delete);
    3338             : 
    3339             :     SimpleInstallFunction(isolate_, prototype, "clear",
    3340         111 :                           Builtins::kMapPrototypeClear, 0, true);
    3341             :     Handle<JSFunction> entries =
    3342             :         SimpleInstallFunction(isolate_, prototype, "entries",
    3343         111 :                               Builtins::kMapPrototypeEntries, 0, true);
    3344             :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3345         111 :                           entries, DONT_ENUM);
    3346             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3347         111 :                           Builtins::kMapPrototypeForEach, 1, false);
    3348             :     SimpleInstallFunction(isolate_, prototype, "keys",
    3349         111 :                           Builtins::kMapPrototypeKeys, 0, true);
    3350             :     SimpleInstallGetter(
    3351             :         isolate_, prototype, factory->InternalizeUtf8String("size"),
    3352         222 :         Builtins::kMapPrototypeGetSize, true, BuiltinFunctionId::kMapSize);
    3353             :     SimpleInstallFunction(isolate_, prototype, "values",
    3354         111 :                           Builtins::kMapPrototypeValues, 0, true);
    3355             : 
    3356         111 :     native_context()->set_initial_map_prototype_map(prototype->map());
    3357             : 
    3358         111 :     InstallSpeciesGetter(isolate_, js_map_fun);
    3359             :   }
    3360             : 
    3361             :   {  // -- B i g I n t
    3362             :     Handle<JSFunction> bigint_fun = InstallFunction(
    3363             :         isolate_, global, "BigInt", JS_VALUE_TYPE, JSValue::kSize, 0,
    3364         111 :         factory->the_hole_value(), Builtins::kBigIntConstructor);
    3365         222 :     bigint_fun->shared()->set_builtin_function_id(
    3366         222 :         BuiltinFunctionId::kBigIntConstructor);
    3367         222 :     bigint_fun->shared()->DontAdaptArguments();
    3368         222 :     bigint_fun->shared()->set_length(1);
    3369             :     InstallWithIntrinsicDefaultProto(isolate_, bigint_fun,
    3370         111 :                                      Context::BIGINT_FUNCTION_INDEX);
    3371             : 
    3372             :     // Install the properties of the BigInt constructor.
    3373             :     // asUintN(bits, bigint)
    3374             :     SimpleInstallFunction(isolate_, bigint_fun, "asUintN",
    3375         111 :                           Builtins::kBigIntAsUintN, 2, false);
    3376             :     // asIntN(bits, bigint)
    3377             :     SimpleInstallFunction(isolate_, bigint_fun, "asIntN",
    3378         111 :                           Builtins::kBigIntAsIntN, 2, false);
    3379             : 
    3380             :     // Set up the %BigIntPrototype%.
    3381             :     Handle<JSObject> prototype(JSObject::cast(bigint_fun->instance_prototype()),
    3382         333 :                                isolate_);
    3383         111 :     JSFunction::SetPrototype(bigint_fun, prototype);
    3384             : 
    3385             :     // Install the properties of the BigInt.prototype.
    3386             :     // "constructor" is created implicitly by InstallFunction() above.
    3387             :     // toLocaleString([reserved1 [, reserved2]])
    3388             :     SimpleInstallFunction(isolate_, prototype, "toLocaleString",
    3389         111 :                           Builtins::kBigIntPrototypeToLocaleString, 0, false);
    3390             :     // toString([radix])
    3391             :     SimpleInstallFunction(isolate_, prototype, "toString",
    3392         111 :                           Builtins::kBigIntPrototypeToString, 0, false);
    3393             :     // valueOf()
    3394             :     SimpleInstallFunction(isolate_, prototype, "valueOf",
    3395         111 :                           Builtins::kBigIntPrototypeValueOf, 0, false);
    3396             :     // @@toStringTag
    3397         111 :     InstallToStringTag(isolate_, prototype, factory->BigInt_string());
    3398             :   }
    3399             : 
    3400             :   {  // -- S e t
    3401             :     Handle<JSFunction> js_set_fun =
    3402             :         InstallFunction(isolate_, global, "Set", JS_SET_TYPE, JSSet::kSize, 0,
    3403         111 :                         factory->the_hole_value(), Builtins::kSetConstructor);
    3404             :     InstallWithIntrinsicDefaultProto(isolate_, js_set_fun,
    3405         111 :                                      Context::JS_SET_FUN_INDEX);
    3406             : 
    3407         333 :     Handle<SharedFunctionInfo> shared(js_set_fun->shared(), isolate_);
    3408             :     shared->DontAdaptArguments();
    3409             :     shared->set_length(0);
    3410             : 
    3411             :     // Setup %SetPrototype%.
    3412             :     Handle<JSObject> prototype(JSObject::cast(js_set_fun->instance_prototype()),
    3413         222 :                                isolate());
    3414             : 
    3415         111 :     InstallToStringTag(isolate_, prototype, factory->Set_string());
    3416             : 
    3417             :     Handle<JSFunction> set_has = SimpleInstallFunction(
    3418         111 :         isolate_, prototype, "has", Builtins::kSetPrototypeHas, 1, true);
    3419         111 :     native_context()->set_set_has(*set_has);
    3420             : 
    3421             :     Handle<JSFunction> set_add = SimpleInstallFunction(
    3422         111 :         isolate_, prototype, "add", Builtins::kSetPrototypeAdd, 1, true);
    3423             :     // Check that index of "add" function in JSCollection is correct.
    3424             :     DCHECK_EQ(JSCollection::kAddFunctionDescriptorIndex,
    3425             :               prototype->map()->LastAdded());
    3426         111 :     native_context()->set_set_add(*set_add);
    3427             : 
    3428             :     Handle<JSFunction> set_delete = SimpleInstallFunction(
    3429         111 :         isolate_, prototype, "delete", Builtins::kSetPrototypeDelete, 1, true);
    3430         111 :     native_context()->set_set_delete(*set_delete);
    3431             : 
    3432             :     SimpleInstallFunction(isolate_, prototype, "clear",
    3433         111 :                           Builtins::kSetPrototypeClear, 0, true);
    3434             :     SimpleInstallFunction(isolate_, prototype, "entries",
    3435         111 :                           Builtins::kSetPrototypeEntries, 0, true);
    3436             :     SimpleInstallFunction(isolate_, prototype, "forEach",
    3437         111 :                           Builtins::kSetPrototypeForEach, 1, false);
    3438             :     SimpleInstallGetter(
    3439             :         isolate_, prototype, factory->InternalizeUtf8String("size"),
    3440         222 :         Builtins::kSetPrototypeGetSize, true, BuiltinFunctionId::kSetSize);
    3441             :     Handle<JSFunction> values = SimpleInstallFunction(
    3442         111 :         isolate_, prototype, "values", Builtins::kSetPrototypeValues, 0, true);
    3443             :     JSObject::AddProperty(isolate_, prototype, factory->keys_string(), values,
    3444         111 :                           DONT_ENUM);
    3445             :     JSObject::AddProperty(isolate_, prototype, factory->iterator_symbol(),
    3446         111 :                           values, DONT_ENUM);
    3447             : 
    3448         111 :     native_context()->set_initial_set_prototype_map(prototype->map());
    3449         111 :     native_context()->set_initial_set_prototype(*prototype);
    3450             : 
    3451         111 :     InstallSpeciesGetter(isolate_, js_set_fun);
    3452             :   }
    3453             : 
    3454             :   {  // -- J S M o d u l e N a m e s p a c e
    3455             :     Handle<Map> map = factory->NewMap(
    3456             :         JS_MODULE_NAMESPACE_TYPE, JSModuleNamespace::kSize,
    3457         111 :         TERMINAL_FAST_ELEMENTS_KIND, JSModuleNamespace::kInObjectFieldCount);
    3458         222 :     Map::SetPrototype(isolate(), map, isolate_->factory()->null_value());
    3459         111 :     Map::EnsureDescriptorSlack(isolate_, map, 1);
    3460         111 :     native_context()->set_js_module_namespace_map(*map);
    3461             : 
    3462             :     {  // Install @@toStringTag.
    3463             :       PropertyAttributes attribs =
    3464             :           static_cast<PropertyAttributes>(DONT_DELETE | DONT_ENUM | READ_ONLY);
    3465             :       Descriptor d =
    3466             :           Descriptor::DataField(isolate(), factory->to_string_tag_symbol(),
    3467             :                                 JSModuleNamespace::kToStringTagFieldIndex,
    3468         111 :                                 attribs, Representation::Tagged());
    3469         111 :       map->AppendDescriptor(isolate(), &d);
    3470             :     }
    3471             :   }
    3472             : 
    3473             :   {  // -- I t e r a t o r R e s u l t
    3474             :     Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE, JSIteratorResult::kSize,
    3475         111 :                                       TERMINAL_FAST_ELEMENTS_KIND, 2);
    3476         222 :     Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
    3477         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3478             : 
    3479             :     {  // value
    3480             :       Descriptor d = Descriptor::DataField(isolate(), factory->value_string(),
    3481             :                                            JSIteratorResult::kValueIndex, NONE,
    3482         111 :                                            Representation::Tagged());
    3483         111 :       map->AppendDescriptor(isolate(), &d);
    3484             :     }
    3485             : 
    3486             :     {  // done
    3487             :       Descriptor d = Descriptor::DataField(isolate(), factory->done_string(),
    3488             :                                            JSIteratorResult::kDoneIndex, NONE,
    3489         111 :                                            Representation::Tagged());
    3490         111 :       map->AppendDescriptor(isolate(), &d);
    3491             :     }
    3492             : 
    3493         222 :     map->SetConstructor(native_context()->object_function());
    3494         111 :     native_context()->set_iterator_result_map(*map);
    3495             :   }
    3496             : 
    3497             :   {  // -- W e a k M a p
    3498             :     Handle<JSFunction> cons = InstallFunction(
    3499             :         isolate_, global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize, 0,
    3500         111 :         factory->the_hole_value(), Builtins::kWeakMapConstructor);
    3501             :     InstallWithIntrinsicDefaultProto(isolate_, cons,
    3502         111 :                                      Context::JS_WEAK_MAP_FUN_INDEX);
    3503             : 
    3504         333 :     Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
    3505             :     shared->DontAdaptArguments();
    3506             :     shared->set_length(0);
    3507             : 
    3508             :     // Setup %WeakMapPrototype%.
    3509             :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
    3510         222 :                                isolate());
    3511             : 
    3512             :     SimpleInstallFunction(isolate_, prototype, "delete",
    3513         111 :                           Builtins::kWeakMapPrototypeDelete, 1, true);
    3514             :     Handle<JSFunction> weakmap_get = SimpleInstallFunction(
    3515         111 :         isolate_, prototype, "get", Builtins::kWeakMapGet, 1, true);
    3516         111 :     native_context()->set_weakmap_get(*weakmap_get);
    3517             : 
    3518             :     Handle<JSFunction> weakmap_set = SimpleInstallFunction(
    3519         111 :         isolate_, prototype, "set", Builtins::kWeakMapPrototypeSet, 2, true);
    3520             :     // Check that index of "set" function in JSWeakCollection is correct.
    3521             :     DCHECK_EQ(JSWeakCollection::kAddFunctionDescriptorIndex,
    3522             :               prototype->map()->LastAdded());
    3523             : 
    3524         111 :     native_context()->set_weakmap_set(*weakmap_set);
    3525             :     SimpleInstallFunction(isolate_, prototype, "has", Builtins::kWeakMapHas, 1,
    3526         111 :                           true);
    3527             : 
    3528         111 :     InstallToStringTag(isolate_, prototype, "WeakMap");
    3529             : 
    3530         111 :     native_context()->set_initial_weakmap_prototype_map(prototype->map());
    3531             :   }
    3532             : 
    3533             :   {  // -- W e a k S e t
    3534             :     Handle<JSFunction> cons = InstallFunction(
    3535             :         isolate_, global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize, 0,
    3536         111 :         factory->the_hole_value(), Builtins::kWeakSetConstructor);
    3537             :     InstallWithIntrinsicDefaultProto(isolate_, cons,
    3538         111 :                                      Context::JS_WEAK_SET_FUN_INDEX);
    3539             : 
    3540         333 :     Handle<SharedFunctionInfo> shared(cons->shared(), isolate_);
    3541             :     shared->DontAdaptArguments();
    3542             :     shared->set_length(0);
    3543             : 
    3544             :     // Setup %WeakSetPrototype%.
    3545             :     Handle<JSObject> prototype(JSObject::cast(cons->instance_prototype()),
    3546         222 :                                isolate());
    3547             : 
    3548             :     SimpleInstallFunction(isolate_, prototype, "delete",
    3549         111 :                           Builtins::kWeakSetPrototypeDelete, 1, true);
    3550             :     SimpleInstallFunction(isolate_, prototype, "has", Builtins::kWeakSetHas, 1,
    3551         111 :                           true);
    3552             : 
    3553             :     Handle<JSFunction> weakset_add = SimpleInstallFunction(
    3554         111 :         isolate_, prototype, "add", Builtins::kWeakSetPrototypeAdd, 1, true);
    3555             :     // Check that index of "add" function in JSWeakCollection is correct.
    3556             :     DCHECK_EQ(JSWeakCollection::kAddFunctionDescriptorIndex,
    3557             :               prototype->map()->LastAdded());
    3558             : 
    3559         111 :     native_context()->set_weakset_add(*weakset_add);
    3560             : 
    3561             :     InstallToStringTag(isolate_, prototype,
    3562         111 :                        factory->InternalizeUtf8String("WeakSet"));
    3563             : 
    3564         111 :     native_context()->set_initial_weakset_prototype_map(prototype->map());
    3565             :   }
    3566             : 
    3567             :   {  // -- P r o x y
    3568         111 :     CreateJSProxyMaps();
    3569             :     // Proxy function map has prototype slot for storing initial map but does
    3570             :     // not have a prototype property.
    3571             :     Handle<Map> proxy_function_map = Map::Copy(
    3572         111 :         isolate_, isolate_->strict_function_without_prototype_map(), "Proxy");
    3573             :     proxy_function_map->set_is_constructor(true);
    3574             : 
    3575             :     Handle<String> name = factory->Proxy_string();
    3576             : 
    3577             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltin(
    3578         111 :         name, proxy_function_map, Builtins::kProxyConstructor);
    3579         111 :     Handle<JSFunction> proxy_function = factory->NewFunction(args);
    3580             : 
    3581         222 :     isolate_->proxy_map()->SetConstructor(*proxy_function);
    3582             : 
    3583         222 :     proxy_function->shared()->set_internal_formal_parameter_count(2);
    3584         222 :     proxy_function->shared()->set_length(2);
    3585             : 
    3586         111 :     native_context()->set_proxy_function(*proxy_function);
    3587         111 :     JSObject::AddProperty(isolate_, global, name, proxy_function, DONT_ENUM);
    3588             : 
    3589             :     DCHECK(!proxy_function->has_prototype_property());
    3590             : 
    3591             :     SimpleInstallFunction(isolate_, proxy_function, "revocable",
    3592         111 :                           Builtins::kProxyRevocable, 2, true);
    3593             : 
    3594             :     {  // Internal: ProxyRevoke
    3595             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    3596         111 :           isolate_, Builtins::kProxyRevoke, factory->empty_string(), 0);
    3597         111 :       native_context()->set_proxy_revoke_shared_fun(*info);
    3598             :     }
    3599             :   }
    3600             : 
    3601             :   {  // -- R e f l e c t
    3602         111 :     Handle<String> reflect_string = factory->InternalizeUtf8String("Reflect");
    3603             :     Handle<JSObject> reflect =
    3604         111 :         factory->NewJSObject(isolate_->object_function(), TENURED);
    3605         111 :     JSObject::AddProperty(isolate_, global, reflect_string, reflect, DONT_ENUM);
    3606             : 
    3607             :     Handle<JSFunction> define_property =
    3608             :         SimpleInstallFunction(isolate_, reflect, "defineProperty",
    3609         111 :                               Builtins::kReflectDefineProperty, 3, true);
    3610         111 :     native_context()->set_reflect_define_property(*define_property);
    3611             : 
    3612             :     Handle<JSFunction> delete_property =
    3613             :         SimpleInstallFunction(isolate_, reflect, "deleteProperty",
    3614         111 :                               Builtins::kReflectDeleteProperty, 2, true);
    3615         111 :     native_context()->set_reflect_delete_property(*delete_property);
    3616             : 
    3617             :     Handle<JSFunction> apply = SimpleInstallFunction(
    3618         111 :         isolate_, reflect, "apply", Builtins::kReflectApply, 3, false);
    3619         111 :     native_context()->set_reflect_apply(*apply);
    3620             : 
    3621             :     Handle<JSFunction> construct = SimpleInstallFunction(
    3622         111 :         isolate_, reflect, "construct", Builtins::kReflectConstruct, 2, false);
    3623         111 :     native_context()->set_reflect_construct(*construct);
    3624             : 
    3625             :     SimpleInstallFunction(isolate_, reflect, "get", Builtins::kReflectGet, 2,
    3626         111 :                           false);
    3627             :     SimpleInstallFunction(isolate_, reflect, "getOwnPropertyDescriptor",
    3628         111 :                           Builtins::kReflectGetOwnPropertyDescriptor, 2, true);
    3629             :     SimpleInstallFunction(isolate_, reflect, "getPrototypeOf",
    3630         111 :                           Builtins::kReflectGetPrototypeOf, 1, true);
    3631             :     SimpleInstallFunction(isolate_, reflect, "has", Builtins::kReflectHas, 2,
    3632         111 :                           true);
    3633             :     SimpleInstallFunction(isolate_, reflect, "isExtensible",
    3634         111 :                           Builtins::kReflectIsExtensible, 1, true);
    3635             :     SimpleInstallFunction(isolate_, reflect, "ownKeys",
    3636         111 :                           Builtins::kReflectOwnKeys, 1, true);
    3637             :     SimpleInstallFunction(isolate_, reflect, "preventExtensions",
    3638         111 :                           Builtins::kReflectPreventExtensions, 1, true);
    3639             :     SimpleInstallFunction(isolate_, reflect, "set", Builtins::kReflectSet, 3,
    3640         111 :                           false);
    3641             :     SimpleInstallFunction(isolate_, reflect, "setPrototypeOf",
    3642         111 :                           Builtins::kReflectSetPrototypeOf, 2, true);
    3643             :   }
    3644             : 
    3645             :   {  // --- B o u n d F u n c t i o n
    3646             :     Handle<Map> map =
    3647             :         factory->NewMap(JS_BOUND_FUNCTION_TYPE, JSBoundFunction::kSize,
    3648         111 :                         TERMINAL_FAST_ELEMENTS_KIND, 0);
    3649         222 :     map->SetConstructor(native_context()->object_function());
    3650             :     map->set_is_callable(true);
    3651         111 :     Map::SetPrototype(isolate(), map, empty_function);
    3652             : 
    3653             :     PropertyAttributes roc_attribs =
    3654             :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY);
    3655         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3656             : 
    3657             :     {  // length
    3658             :       Descriptor d = Descriptor::AccessorConstant(
    3659             :           factory->length_string(), factory->bound_function_length_accessor(),
    3660         111 :           roc_attribs);
    3661         111 :       map->AppendDescriptor(isolate(), &d);
    3662             :     }
    3663             : 
    3664             :     {  // name
    3665             :       Descriptor d = Descriptor::AccessorConstant(
    3666             :           factory->name_string(), factory->bound_function_name_accessor(),
    3667         111 :           roc_attribs);
    3668         111 :       map->AppendDescriptor(isolate(), &d);
    3669             :     }
    3670         111 :     native_context()->set_bound_function_without_constructor_map(*map);
    3671             : 
    3672         111 :     map = Map::Copy(isolate_, map, "IsConstructor");
    3673             :     map->set_is_constructor(true);
    3674         111 :     native_context()->set_bound_function_with_constructor_map(*map);
    3675             :   }
    3676             : 
    3677             :   {  // --- sloppy arguments map
    3678         111 :     Handle<String> arguments_string = factory->Arguments_string();
    3679             :     NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithPrototype(
    3680             :         arguments_string, isolate_->initial_object_prototype(),
    3681             :         JS_ARGUMENTS_TYPE, JSSloppyArgumentsObject::kSize, 2,
    3682         222 :         Builtins::kIllegal, MUTABLE);
    3683         111 :     Handle<JSFunction> function = factory->NewFunction(args);
    3684         222 :     Handle<Map> map(function->initial_map(), isolate());
    3685             : 
    3686             :     // Create the descriptor array for the arguments object.
    3687         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3688             : 
    3689             :     {  // length
    3690             :       Descriptor d =
    3691             :           Descriptor::DataField(isolate(), factory->length_string(),
    3692             :                                 JSSloppyArgumentsObject::kLengthIndex,
    3693         111 :                                 DONT_ENUM, Representation::Tagged());
    3694         111 :       map->AppendDescriptor(isolate(), &d);
    3695             :     }
    3696             :     {  // callee
    3697             :       Descriptor d =
    3698             :           Descriptor::DataField(isolate(), factory->callee_string(),
    3699             :                                 JSSloppyArgumentsObject::kCalleeIndex,
    3700         111 :                                 DONT_ENUM, Representation::Tagged());
    3701         111 :       map->AppendDescriptor(isolate(), &d);
    3702             :     }
    3703             :     // @@iterator method is added later.
    3704             : 
    3705         111 :     native_context()->set_sloppy_arguments_map(*map);
    3706             : 
    3707             :     DCHECK(!map->is_dictionary_map());
    3708             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3709             :   }
    3710             : 
    3711             :   {  // --- fast and slow aliased arguments map
    3712         111 :     Handle<Map> map = isolate_->sloppy_arguments_map();
    3713         111 :     map = Map::Copy(isolate_, map, "FastAliasedArguments");
    3714         111 :     map->set_elements_kind(FAST_SLOPPY_ARGUMENTS_ELEMENTS);
    3715             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3716         111 :     native_context()->set_fast_aliased_arguments_map(*map);
    3717             : 
    3718         111 :     map = Map::Copy(isolate_, map, "SlowAliasedArguments");
    3719         111 :     map->set_elements_kind(SLOW_SLOPPY_ARGUMENTS_ELEMENTS);
    3720             :     DCHECK_EQ(2, map->GetInObjectProperties());
    3721         111 :     native_context()->set_slow_aliased_arguments_map(*map);
    3722             :   }
    3723             : 
    3724             :   {  // --- strict mode arguments map
    3725             :     const PropertyAttributes attributes =
    3726             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    3727             : 
    3728             :     // Create the ThrowTypeError function.
    3729         111 :     Handle<AccessorPair> callee = factory->NewAccessorPair();
    3730             : 
    3731         111 :     Handle<JSFunction> poison = GetThrowTypeErrorIntrinsic();
    3732             : 
    3733             :     // Install the ThrowTypeError function.
    3734         222 :     callee->set_getter(*poison);
    3735         222 :     callee->set_setter(*poison);
    3736             : 
    3737             :     // Create the map. Allocate one in-object field for length.
    3738             :     Handle<Map> map = factory->NewMap(
    3739         111 :         JS_ARGUMENTS_TYPE, JSStrictArgumentsObject::kSize, PACKED_ELEMENTS, 1);
    3740             :     // Create the descriptor array for the arguments object.
    3741         111 :     Map::EnsureDescriptorSlack(isolate_, map, 2);
    3742             : 
    3743             :     {  // length
    3744             :       Descriptor d =
    3745             :           Descriptor::DataField(isolate(), factory->length_string(),
    3746             :                                 JSStrictArgumentsObject::kLengthIndex,
    3747         111 :                                 DONT_ENUM, Representation::Tagged());
    3748         111 :       map->AppendDescriptor(isolate(), &d);
    3749             :     }
    3750             :     {  // callee
    3751             :       Descriptor d = Descriptor::AccessorConstant(factory->callee_string(),
    3752         111 :                                                   callee, attributes);
    3753         111 :       map->AppendDescriptor(isolate(), &d);
    3754             :     }
    3755             :     // @@iterator method is added later.
    3756             : 
    3757             :     DCHECK_EQ(native_context()->object_function()->prototype(),
    3758             :               *isolate_->initial_object_prototype());
    3759         222 :     Map::SetPrototype(isolate(), map, isolate_->initial_object_prototype());
    3760             : 
    3761             :     // Copy constructor from the sloppy arguments boilerplate.
    3762             :     map->SetConstructor(
    3763         222 :         native_context()->sloppy_arguments_map()->GetConstructor());
    3764             : 
    3765         111 :     native_context()->set_strict_arguments_map(*map);
    3766             : 
    3767             :     DCHECK(!map->is_dictionary_map());
    3768             :     DCHECK(IsObjectElementsKind(map->elements_kind()));
    3769             :   }
    3770             : 
    3771             :   {  // --- context extension
    3772             :     // Create a function for the context extension objects.
    3773             :     Handle<JSFunction> context_extension_fun =
    3774             :         CreateFunction(isolate_, factory->empty_string(),
    3775             :                        JS_CONTEXT_EXTENSION_OBJECT_TYPE, JSObject::kHeaderSize,
    3776         111 :                        0, factory->the_hole_value(), Builtins::kIllegal);
    3777         111 :     native_context()->set_context_extension_function(*context_extension_fun);
    3778             :   }
    3779             : 
    3780             :   {
    3781             :     // Set up the call-as-function delegate.
    3782             :     Handle<JSFunction> delegate =
    3783             :         SimpleCreateFunction(isolate_, factory->empty_string(),
    3784         111 :                              Builtins::kHandleApiCallAsFunction, 0, false);
    3785         111 :     native_context()->set_call_as_function_delegate(*delegate);
    3786             :   }
    3787             : 
    3788             :   {
    3789             :     // Set up the call-as-constructor delegate.
    3790             :     Handle<JSFunction> delegate =
    3791             :         SimpleCreateFunction(isolate_, factory->empty_string(),
    3792         111 :                              Builtins::kHandleApiCallAsConstructor, 0, false);
    3793         111 :     native_context()->set_call_as_constructor_delegate(*delegate);
    3794             :   }
    3795         111 : }  // NOLINT(readability/fn_size)
    3796             : 
    3797        1221 : Handle<JSFunction> Genesis::InstallTypedArray(const char* name,
    3798        9768 :                                               ElementsKind elements_kind) {
    3799             :   Handle<JSObject> global =
    3800        2442 :       Handle<JSObject>(native_context()->global_object(), isolate());
    3801             : 
    3802        1221 :   Handle<JSObject> typed_array_prototype = isolate()->typed_array_prototype();
    3803        1221 :   Handle<JSFunction> typed_array_function = isolate()->typed_array_function();
    3804             : 
    3805             :   Handle<JSFunction> result = InstallFunction(
    3806             :       isolate(), global, name, JS_TYPED_ARRAY_TYPE,
    3807             :       JSTypedArray::kSizeWithEmbedderFields, 0, factory()->the_hole_value(),
    3808        1221 :       Builtins::kTypedArrayConstructor);
    3809        2442 :   result->initial_map()->set_elements_kind(elements_kind);
    3810             : 
    3811        2442 :   result->shared()->DontAdaptArguments();
    3812        2442 :   result->shared()->set_length(3);
    3813             : 
    3814        2442 :   CHECK(JSObject::SetPrototype(result, typed_array_function, false, kDontThrow)
    3815             :             .FromJust());
    3816             : 
    3817             :   Handle<Smi> bytes_per_element(
    3818        1221 :       Smi::FromInt(1 << ElementsKindToShiftSize(elements_kind)), isolate());
    3819             : 
    3820        1221 :   InstallConstant(isolate(), result, "BYTES_PER_ELEMENT", bytes_per_element);
    3821             : 
    3822             :   // Setup prototype object.
    3823             :   DCHECK(result->prototype()->IsJSObject());
    3824        2442 :   Handle<JSObject> prototype(JSObject::cast(result->prototype()), isolate());
    3825             : 
    3826        2442 :   CHECK(JSObject::SetPrototype(prototype, typed_array_prototype, false,
    3827             :                                kDontThrow)
    3828             :             .FromJust());
    3829             : 
    3830        1221 :   InstallConstant(isolate(), prototype, "BYTES_PER_ELEMENT", bytes_per_element);
    3831        1221 :   return result;
    3832             : }
    3833             : 
    3834             : 
    3835       89496 : void Genesis::InitializeExperimentalGlobal() {
    3836             : #define FEATURE_INITIALIZE_GLOBAL(id, descr) InitializeGlobal_##id();
    3837             : 
    3838       89496 :   HARMONY_INPROGRESS(FEATURE_INITIALIZE_GLOBAL)
    3839       89496 :   HARMONY_STAGED(FEATURE_INITIALIZE_GLOBAL)
    3840       89496 :   HARMONY_SHIPPING(FEATURE_INITIALIZE_GLOBAL)
    3841             : #undef FEATURE_INITIALIZE_GLOBAL
    3842       89496 : }
    3843             : 
    3844         222 : bool Bootstrapper::CompileExtraBuiltin(Isolate* isolate, int index) {
    3845             :   HandleScope scope(isolate);
    3846         111 :   Vector<const char> name = ExtraNatives::GetScriptName(index);
    3847             :   Handle<String> source_code =
    3848         111 :       isolate->bootstrapper()->GetNativeSource(EXTRAS, index);
    3849         111 :   Handle<Object> global = isolate->global_object();
    3850         111 :   Handle<Object> binding = isolate->extras_binding_object();
    3851         111 :   Handle<Object> extras_utils = isolate->extras_utils_object();
    3852         111 :   Handle<Object> args[] = {global, binding, extras_utils};
    3853             :   return Bootstrapper::CompileNative(isolate, name, source_code,
    3854         222 :                                      arraysize(args), args, EXTENSION_CODE);
    3855             : }
    3856             : 
    3857             : 
    3858         111 : bool Bootstrapper::CompileNative(Isolate* isolate, Vector<const char> name,
    3859             :                                  Handle<String> source, int argc,
    3860             :                                  Handle<Object> argv[],
    3861             :                                  NativesFlag natives_flag) {
    3862             :   SuppressDebug compiling_natives(isolate->debug());
    3863             : 
    3864             :   Handle<Context> context(isolate->context(), isolate);
    3865             :   Handle<String> script_name =
    3866         222 :       isolate->factory()->NewStringFromUtf8(name).ToHandleChecked();
    3867             :   MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3868             :       Compiler::GetSharedFunctionInfoForScript(
    3869             :           isolate, source, Compiler::ScriptDetails(script_name),
    3870             :           ScriptOriginOptions(), nullptr, nullptr,
    3871             :           ScriptCompiler::kNoCompileOptions, ScriptCompiler::kNoCacheNoReason,
    3872         111 :           natives_flag);
    3873             :   Handle<SharedFunctionInfo> function_info;
    3874         111 :   if (!maybe_function_info.ToHandle(&function_info)) return false;
    3875             : 
    3876             :   DCHECK(context->IsNativeContext());
    3877             : 
    3878             :   Handle<JSFunction> fun =
    3879             :       isolate->factory()->NewFunctionFromSharedFunctionInfo(function_info,
    3880         111 :                                                             context);
    3881             :   Handle<Object> receiver = isolate->factory()->undefined_value();
    3882             : 
    3883             :   // For non-extension scripts, run script to get the function wrapper.
    3884             :   Handle<Object> wrapper;
    3885         111 :   if (!Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3886         111 :                           Execution::MessageHandling::kKeepPending, nullptr)
    3887         222 :            .ToHandle(&wrapper)) {
    3888             :     return false;
    3889             :   }
    3890             :   // Then run the function wrapper.
    3891             :   return !Execution::TryCall(isolate, Handle<JSFunction>::cast(wrapper),
    3892             :                              receiver, argc, argv,
    3893         222 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3894         222 :               .is_null();
    3895             : }
    3896             : 
    3897             : 
    3898       17796 : bool Genesis::CompileExtension(Isolate* isolate, v8::Extension* extension) {
    3899             :   Factory* factory = isolate->factory();
    3900             :   HandleScope scope(isolate);
    3901             :   Handle<SharedFunctionInfo> function_info;
    3902             : 
    3903             :   Handle<String> source =
    3904             :       isolate->factory()
    3905             :           ->NewExternalStringFromOneByte(extension->source())
    3906        8898 :           .ToHandleChecked();
    3907             :   DCHECK(source->IsOneByteRepresentation());
    3908             : 
    3909             :   // If we can't find the function in the cache, we compile a new
    3910             :   // function and insert it into the cache.
    3911        4451 :   Vector<const char> name = CStrVector(extension->name());
    3912        4451 :   SourceCodeCache* cache = isolate->bootstrapper()->extensions_cache();
    3913             :   Handle<Context> context(isolate->context(), isolate);
    3914             :   DCHECK(context->IsNativeContext());
    3915             : 
    3916        4450 :   if (!cache->Lookup(isolate, name, &function_info)) {
    3917             :     Handle<String> script_name =
    3918        6417 :         factory->NewStringFromUtf8(name).ToHandleChecked();
    3919             :     MaybeHandle<SharedFunctionInfo> maybe_function_info =
    3920             :         Compiler::GetSharedFunctionInfoForScript(
    3921             :             isolate, source, Compiler::ScriptDetails(script_name),
    3922             :             ScriptOriginOptions(), extension, nullptr,
    3923             :             ScriptCompiler::kNoCompileOptions,
    3924        3208 :             ScriptCompiler::kNoCacheBecauseV8Extension, EXTENSION_CODE);
    3925        3207 :     if (!maybe_function_info.ToHandle(&function_info)) return false;
    3926        3177 :     cache->Add(isolate, name, function_info);
    3927             :   }
    3928             : 
    3929             :   // Set up the function context. Conceptually, we should clone the
    3930             :   // function before overwriting the context but since we're in a
    3931             :   // single-threaded environment it is not strictly necessary.
    3932             :   Handle<JSFunction> fun =
    3933        4416 :       factory->NewFunctionFromSharedFunctionInfo(function_info, context);
    3934             : 
    3935             :   // Call function using either the runtime object or the global
    3936             :   // object as the receiver. Provide no parameters.
    3937        4417 :   Handle<Object> receiver = isolate->global_object();
    3938             :   return !Execution::TryCall(isolate, fun, receiver, 0, nullptr,
    3939        4416 :                              Execution::MessageHandling::kKeepPending, nullptr)
    3940        8832 :               .is_null();
    3941             : }
    3942             : 
    3943       14319 : static Handle<JSObject> ResolveBuiltinIdHolder(Isolate* isolate,
    3944             :                                                Handle<Context> native_context,
    3945             :                                                const char* holder_expr) {
    3946             :   Factory* factory = isolate->factory();
    3947       28638 :   Handle<JSGlobalObject> global(native_context->global_object(), isolate);
    3948             :   const char* period_pos = strchr(holder_expr, '.');
    3949       14319 :   if (period_pos == nullptr) {
    3950             :     return Handle<JSObject>::cast(
    3951             :         Object::GetPropertyOrElement(
    3952       10656 :             isolate, global, factory->InternalizeUtf8String(holder_expr))
    3953       10656 :             .ToHandleChecked());
    3954             :   }
    3955        8991 :   const char* inner = period_pos + 1;
    3956             :   DCHECK(!strchr(inner, '.'));
    3957             :   Vector<const char> property(holder_expr,
    3958        8991 :                               static_cast<int>(period_pos - holder_expr));
    3959        8991 :   Handle<String> property_string = factory->InternalizeUtf8String(property);
    3960             :   DCHECK(!property_string.is_null());
    3961             :   Handle<JSObject> object = Handle<JSObject>::cast(
    3962        8991 :       JSReceiver::GetProperty(isolate, global, property_string)
    3963       17982 :           .ToHandleChecked());
    3964        8991 :   if (strcmp("prototype", inner) == 0) {
    3965        8991 :     Handle<JSFunction> function = Handle<JSFunction>::cast(object);
    3966       17982 :     return Handle<JSObject>(JSObject::cast(function->prototype()), isolate);
    3967             :   }
    3968           0 :   Handle<String> inner_string = factory->InternalizeUtf8String(inner);
    3969             :   DCHECK(!inner_string.is_null());
    3970             :   Handle<Object> value =
    3971           0 :       JSReceiver::GetProperty(isolate, object, inner_string).ToHandleChecked();
    3972           0 :   return Handle<JSObject>::cast(value);
    3973             : }
    3974             : 
    3975       89797 : void Genesis::ConfigureUtilsObject() {
    3976             :   // We still need the utils object after deserialization.
    3977       90098 :   if (isolate()->serializer_enabled()) return;
    3978             : 
    3979             :   // The utils object can be removed for cases that reach this point.
    3980      178992 :   HeapObject undefined = ReadOnlyRoots(heap()).undefined_value();
    3981       89496 :   native_context()->set_extras_utils_object(undefined);
    3982             : }
    3983             : 
    3984         111 : void Genesis::InitializeIteratorFunctions() {
    3985         111 :   Isolate* isolate = isolate_;
    3986             :   Factory* factory = isolate->factory();
    3987             :   HandleScope scope(isolate);
    3988         111 :   Handle<NativeContext> native_context = isolate->native_context();
    3989             :   Handle<JSObject> iterator_prototype(
    3990         222 :       native_context->initial_iterator_prototype(), isolate);
    3991             : 
    3992             :   {  // -- G e n e r a t o r
    3993         111 :     PrototypeIterator iter(isolate, native_context->generator_function_map());
    3994             :     Handle<JSObject> generator_function_prototype(iter.GetCurrent<JSObject>(),
    3995         111 :                                                   isolate);
    3996             :     Handle<JSFunction> generator_function_function = CreateFunction(
    3997             :         isolate, "GeneratorFunction", JS_FUNCTION_TYPE,
    3998             :         JSFunction::kSizeWithPrototype, 0, generator_function_prototype,
    3999         111 :         Builtins::kGeneratorFunctionConstructor);
    4000             :     generator_function_function->set_prototype_or_initial_map(
    4001         222 :         native_context->generator_function_map());
    4002         222 :     generator_function_function->shared()->DontAdaptArguments();
    4003         222 :     generator_function_function->shared()->set_length(1);
    4004             :     InstallWithIntrinsicDefaultProto(
    4005             :         isolate, generator_function_function,
    4006         111 :         Context::GENERATOR_FUNCTION_FUNCTION_INDEX);
    4007             : 
    4008             :     JSObject::ForceSetPrototype(generator_function_function,
    4009         222 :                                 isolate->function_function());
    4010             :     JSObject::AddProperty(
    4011             :         isolate, generator_function_prototype, factory->constructor_string(),
    4012             :         generator_function_function,
    4013         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4014             : 
    4015         222 :     native_context->generator_function_map()->SetConstructor(
    4016         333 :         *generator_function_function);
    4017             :   }
    4018             : 
    4019             :   {  // -- A s y n c G e n e r a t o r
    4020             :     PrototypeIterator iter(isolate,
    4021         111 :                            native_context->async_generator_function_map());
    4022             :     Handle<JSObject> async_generator_function_prototype(
    4023         111 :         iter.GetCurrent<JSObject>(), isolate);
    4024             : 
    4025             :     Handle<JSFunction> async_generator_function_function = CreateFunction(
    4026             :         isolate, "AsyncGeneratorFunction", JS_FUNCTION_TYPE,
    4027             :         JSFunction::kSizeWithPrototype, 0, async_generator_function_prototype,
    4028         111 :         Builtins::kAsyncGeneratorFunctionConstructor);
    4029             :     async_generator_function_function->set_prototype_or_initial_map(
    4030         222 :         native_context->async_generator_function_map());
    4031         222 :     async_generator_function_function->shared()->DontAdaptArguments();
    4032         222 :     async_generator_function_function->shared()->set_length(1);
    4033             :     InstallWithIntrinsicDefaultProto(
    4034             :         isolate, async_generator_function_function,
    4035         111 :         Context::ASYNC_GENERATOR_FUNCTION_FUNCTION_INDEX);
    4036             : 
    4037             :     JSObject::ForceSetPrototype(async_generator_function_function,
    4038         222 :                                 isolate->function_function());
    4039             : 
    4040             :     JSObject::AddProperty(
    4041             :         isolate, async_generator_function_prototype,
    4042             :         factory->constructor_string(), async_generator_function_function,
    4043         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4044             : 
    4045         222 :     native_context->async_generator_function_map()->SetConstructor(
    4046         333 :         *async_generator_function_function);
    4047             :   }
    4048             : 
    4049             :   {  // -- S e t I t e r a t o r
    4050             :     // Setup %SetIteratorPrototype%.
    4051             :     Handle<JSObject> prototype =
    4052         111 :         factory->NewJSObject(isolate->object_function(), TENURED);
    4053         111 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4054             : 
    4055         111 :     InstallToStringTag(isolate, prototype, factory->SetIterator_string());
    4056             : 
    4057             :     // Install the next function on the {prototype}.
    4058             :     InstallFunctionWithBuiltinId(isolate, prototype, "next",
    4059             :                                  Builtins::kSetIteratorPrototypeNext, 0, true,
    4060         111 :                                  BuiltinFunctionId::kSetIteratorNext);
    4061         111 :     native_context->set_initial_set_iterator_prototype(*prototype);
    4062             : 
    4063             :     // Setup SetIterator constructor.
    4064             :     Handle<JSFunction> set_iterator_function =
    4065             :         CreateFunction(isolate, "SetIterator", JS_SET_VALUE_ITERATOR_TYPE,
    4066         111 :                        JSSetIterator::kSize, 0, prototype, Builtins::kIllegal);
    4067         111 :     set_iterator_function->shared()->set_native(false);
    4068             : 
    4069             :     Handle<Map> set_value_iterator_map(set_iterator_function->initial_map(),
    4070         222 :                                        isolate);
    4071         111 :     native_context->set_set_value_iterator_map(*set_value_iterator_map);
    4072             : 
    4073             :     Handle<Map> set_key_value_iterator_map = Map::Copy(
    4074         111 :         isolate, set_value_iterator_map, "JS_SET_KEY_VALUE_ITERATOR_TYPE");
    4075             :     set_key_value_iterator_map->set_instance_type(
    4076             :         JS_SET_KEY_VALUE_ITERATOR_TYPE);
    4077         111 :     native_context->set_set_key_value_iterator_map(*set_key_value_iterator_map);
    4078             :   }
    4079             : 
    4080             :   {  // -- M a p I t e r a t o r
    4081             :     // Setup %MapIteratorPrototype%.
    4082             :     Handle<JSObject> prototype =
    4083         111 :         factory->NewJSObject(isolate->object_function(), TENURED);
    4084         111 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4085             : 
    4086         111 :     InstallToStringTag(isolate, prototype, factory->MapIterator_string());
    4087             : 
    4088             :     // Install the next function on the {prototype}.
    4089             :     InstallFunctionWithBuiltinId(isolate, prototype, "next",
    4090             :                                  Builtins::kMapIteratorPrototypeNext, 0, true,
    4091         111 :                                  BuiltinFunctionId::kMapIteratorNext);
    4092         111 :     native_context->set_initial_map_iterator_prototype(*prototype);
    4093             : 
    4094             :     // Setup MapIterator constructor.
    4095             :     Handle<JSFunction> map_iterator_function =
    4096             :         CreateFunction(isolate, "MapIterator", JS_MAP_KEY_ITERATOR_TYPE,
    4097         111 :                        JSMapIterator::kSize, 0, prototype, Builtins::kIllegal);
    4098         111 :     map_iterator_function->shared()->set_native(false);
    4099             : 
    4100             :     Handle<Map> map_key_iterator_map(map_iterator_function->initial_map(),
    4101         222 :                                      isolate);
    4102         111 :     native_context->set_map_key_iterator_map(*map_key_iterator_map);
    4103             : 
    4104             :     Handle<Map> map_key_value_iterator_map = Map::Copy(
    4105         111 :         isolate, map_key_iterator_map, "JS_MAP_KEY_VALUE_ITERATOR_TYPE");
    4106             :     map_key_value_iterator_map->set_instance_type(
    4107             :         JS_MAP_KEY_VALUE_ITERATOR_TYPE);
    4108         111 :     native_context->set_map_key_value_iterator_map(*map_key_value_iterator_map);
    4109             : 
    4110             :     Handle<Map> map_value_iterator_map =
    4111         111 :         Map::Copy(isolate, map_key_iterator_map, "JS_MAP_VALUE_ITERATOR_TYPE");
    4112             :     map_value_iterator_map->set_instance_type(JS_MAP_VALUE_ITERATOR_TYPE);
    4113         111 :     native_context->set_map_value_iterator_map(*map_value_iterator_map);
    4114             :   }
    4115             : 
    4116             :   {  // -- A s y n c F u n c t i o n
    4117             :     // Builtin functions for AsyncFunction.
    4118         111 :     PrototypeIterator iter(isolate, native_context->async_function_map());
    4119             :     Handle<JSObject> async_function_prototype(iter.GetCurrent<JSObject>(),
    4120         111 :                                               isolate);
    4121             : 
    4122             :     Handle<JSFunction> async_function_constructor = CreateFunction(
    4123             :         isolate, "AsyncFunction", JS_FUNCTION_TYPE,
    4124             :         JSFunction::kSizeWithPrototype, 0, async_function_prototype,
    4125         111 :         Builtins::kAsyncFunctionConstructor);
    4126             :     async_function_constructor->set_prototype_or_initial_map(
    4127         222 :         native_context->async_function_map());
    4128         222 :     async_function_constructor->shared()->DontAdaptArguments();
    4129         222 :     async_function_constructor->shared()->set_length(1);
    4130         111 :     native_context->set_async_function_constructor(*async_function_constructor);
    4131             :     JSObject::ForceSetPrototype(async_function_constructor,
    4132         222 :                                 isolate->function_function());
    4133             : 
    4134             :     JSObject::AddProperty(
    4135             :         isolate, async_function_prototype, factory->constructor_string(),
    4136             :         async_function_constructor,
    4137         111 :         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
    4138             : 
    4139             :     JSFunction::SetPrototype(async_function_constructor,
    4140         111 :                              async_function_prototype);
    4141             : 
    4142             :     // Async functions don't have a prototype, but they use generator objects
    4143             :     // under the hood to model the suspend/resume (in await). Instead of using
    4144             :     // the "prototype" / initial_map machinery (like for (async) generators),
    4145             :     // there's one global (per native context) map here that is used for the
    4146             :     // async function generator objects. These objects never escape to user
    4147             :     // JavaScript anyways.
    4148             :     Handle<Map> async_function_object_map = factory->NewMap(
    4149         111 :         JS_ASYNC_FUNCTION_OBJECT_TYPE, JSAsyncFunctionObject::kSize);
    4150         111 :     native_context->set_async_function_object_map(*async_function_object_map);
    4151             : 
    4152             :     {
    4153             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4154             :           isolate, Builtins::kAsyncFunctionAwaitRejectClosure,
    4155         111 :           factory->empty_string(), 1);
    4156         111 :       native_context->set_async_function_await_reject_shared_fun(*info);
    4157             :     }
    4158             : 
    4159             :     {
    4160             :       Handle<SharedFunctionInfo> info = SimpleCreateSharedFunctionInfo(
    4161             :           isolate, Builtins::kAsyncFunctionAwaitResolveClosure,
    4162         111 :           factory->empty_string(), 1);
    4163         111 :       native_context->set_async_function_await_resolve_shared_fun(*info);
    4164             :     }
    4165             :   }
    4166         111 : }
    4167             : 
    4168        2553 : void Genesis::InitializeCallSiteBuiltins() {
    4169             :   Factory* factory = isolate()->factory();
    4170             :   HandleScope scope(isolate());
    4171             :   // -- C a l l S i t e
    4172             :   // Builtin functions for CallSite.
    4173             : 
    4174             :   // CallSites are a special case; the constructor is for our private use
    4175             :   // only, therefore we set it up as a builtin that throws. Internally, we use
    4176             :   // CallSiteUtils::Construct to create CallSite objects.
    4177             : 
    4178             :   Handle<JSFunction> callsite_fun = CreateFunction(
    4179             :       isolate(), "CallSite", JS_OBJECT_TYPE, JSObject::kHeaderSize, 0,
    4180         111 :       factory->the_hole_value(), Builtins::kUnsupportedThrower);
    4181         222 :   callsite_fun->shared()->DontAdaptArguments();
    4182         222 :   isolate()->native_context()->set_callsite_function(*callsite_fun);
    4183             : 
    4184             :   // Setup CallSite.prototype.
    4185             :   Handle<JSObject> prototype(JSObject::cast(callsite_fun->instance_prototype()),
    4186         222 :                              isolate());
    4187             : 
    4188             :   struct FunctionInfo {
    4189             :     const char* name;
    4190             :     Builtins::Name id;
    4191             :   };
    4192             : 
    4193             :   FunctionInfo infos[] = {
    4194             :       {"getColumnNumber", Builtins::kCallSitePrototypeGetColumnNumber},
    4195             :       {"getEvalOrigin", Builtins::kCallSitePrototypeGetEvalOrigin},
    4196             :       {"getFileName", Builtins::kCallSitePrototypeGetFileName},
    4197             :       {"getFunction", Builtins::kCallSitePrototypeGetFunction},
    4198             :       {"getFunctionName", Builtins::kCallSitePrototypeGetFunctionName},
    4199             :       {"getLineNumber", Builtins::kCallSitePrototypeGetLineNumber},
    4200             :       {"getMethodName", Builtins::kCallSitePrototypeGetMethodName},
    4201             :       {"getPosition", Builtins::kCallSitePrototypeGetPosition},
    4202             :       {"getPromiseIndex", Builtins::kCallSitePrototypeGetPromiseIndex},
    4203             :       {"getScriptNameOrSourceURL",
    4204             :        Builtins::kCallSitePrototypeGetScriptNameOrSourceURL},
    4205             :       {"getThis", Builtins::kCallSitePrototypeGetThis},
    4206             :       {"getTypeName", Builtins::kCallSitePrototypeGetTypeName},
    4207             :       {"isAsync", Builtins::kCallSitePrototypeIsAsync},
    4208             :       {"isConstructor", Builtins::kCallSitePrototypeIsConstructor},
    4209             :       {"isEval", Builtins::kCallSitePrototypeIsEval},
    4210             :       {"isNative", Builtins::kCallSitePrototypeIsNative},
    4211             :       {"isPromiseAll", Builtins::kCallSitePrototypeIsPromiseAll},
    4212             :       {"isToplevel", Builtins::kCallSitePrototypeIsToplevel},
    4213         111 :       {"toString", Builtins::kCallSitePrototypeToString}};
    4214             : 
    4215             :   PropertyAttributes attrs =
    4216             :       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
    4217             : 
    4218             :   Handle<JSFunction> fun;
    4219        2220 :   for (const FunctionInfo& info : infos) {
    4220             :     SimpleInstallFunction(isolate(), prototype, info.name, info.id, 0, true,
    4221        4218 :                           attrs);
    4222             :   }
    4223         111 : }
    4224             : 
    4225             : #define EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(id) \
    4226             :   void Genesis::InitializeGlobal_##id() {}
    4227             : 
    4228           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_namespace_exports)
    4229           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_public_fields)
    4230           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_fields)
    4231           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_private_methods)
    4232           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_static_fields)
    4233           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_class_fields)
    4234           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_dynamic_import)
    4235           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_meta)
    4236           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_numeric_separator)
    4237           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_json_stringify)
    4238           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_regexp_sequence)
    4239           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_await_optimization)
    4240           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_hashbang)
    4241             : 
    4242             : #ifdef V8_INTL_SUPPORT
    4243           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_bigint)
    4244           0 : EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_intl_datetime_style)
    4245             : #endif  // V8_INTL_SUPPORT
    4246             : 
    4247             : #undef EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE
    4248             : 
    4249      268488 : void Genesis::InitializeGlobal_harmony_global() {
    4250      178992 :   if (!FLAG_harmony_global) return;
    4251             : 
    4252             :   Factory* factory = isolate()->factory();
    4253      178992 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4254      178992 :   Handle<JSGlobalProxy> global_proxy(native_context()->global_proxy(),
    4255       89496 :                                      isolate());
    4256             :   JSObject::AddProperty(isolate_, global, factory->globalThis_string(),
    4257       89496 :                         global_proxy, DONT_ENUM);
    4258             : }
    4259             : 
    4260      447480 : void Genesis::InitializeGlobal_harmony_sharedarraybuffer() {
    4261      178992 :   if (!FLAG_harmony_sharedarraybuffer) return;
    4262             : 
    4263      178992 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4264             : 
    4265             :   JSObject::AddProperty(isolate_, global, "SharedArrayBuffer",
    4266      178992 :                         isolate()->shared_array_buffer_fun(), DONT_ENUM);
    4267             : 
    4268             :   JSObject::AddProperty(isolate_, global, "Atomics",
    4269      178992 :                         isolate()->atomics_object(), DONT_ENUM);
    4270       89496 :   InstallToStringTag(isolate_, isolate()->atomics_object(), "Atomics");
    4271             : }
    4272             : 
    4273     1521432 : void Genesis::InitializeGlobal_harmony_string_matchall() {
    4274      178992 :   if (!FLAG_harmony_string_matchall) return;
    4275             : 
    4276             :   {  // String.prototype.matchAll
    4277      178992 :     Handle<JSFunction> string_fun(native_context()->string_function(),
    4278       89496 :                                   isolate());
    4279             :     Handle<JSObject> string_prototype(
    4280      178992 :         JSObject::cast(string_fun->instance_prototype()), isolate());
    4281             : 
    4282             :     SimpleInstallFunction(isolate(), string_prototype, "matchAll",
    4283       89496 :                           Builtins::kStringPrototypeMatchAll, 1, true);
    4284             :   }
    4285             : 
    4286             :   {  // RegExp.prototype[@@matchAll]
    4287      178992 :     Handle<JSFunction> regexp_fun(native_context()->regexp_function(),
    4288       89496 :                                   isolate());
    4289             :     Handle<JSObject> regexp_prototype(
    4290      178992 :         JSObject::cast(regexp_fun->instance_prototype()), isolate());
    4291             :     InstallFunctionAtSymbol(isolate(), regexp_prototype,
    4292             :                             factory()->match_all_symbol(), "[Symbol.matchAll]",
    4293       89496 :                             Builtins::kRegExpPrototypeMatchAll, 1, true);
    4294             :     Handle<Map> regexp_prototype_map(regexp_prototype->map(), isolate());
    4295       89496 :     Map::SetShouldBeFastPrototypeMap(regexp_prototype_map, true, isolate());
    4296       89496 :     native_context()->set_regexp_prototype_map(*regexp_prototype_map);
    4297             :     DCHECK_EQ(JSRegExp::kSymbolMatchAllFunctionDescriptorIndex,
    4298             :               regexp_prototype->map()->LastAdded());
    4299             :   }
    4300             : 
    4301             :   {  // --- R e g E x p S t r i n g  I t e r a t o r ---
    4302             :     Handle<JSObject> iterator_prototype(
    4303      178992 :         native_context()->initial_iterator_prototype(), isolate());
    4304             : 
    4305             :     Handle<JSObject> regexp_string_iterator_prototype =
    4306      178992 :         factory()->NewJSObject(isolate()->object_function(), TENURED);
    4307             :     JSObject::ForceSetPrototype(regexp_string_iterator_prototype,
    4308       89496 :                                 iterator_prototype);
    4309             : 
    4310             :     InstallToStringTag(isolate(), regexp_string_iterator_prototype,
    4311       89496 :                        "RegExp String Iterator");
    4312             : 
    4313             :     SimpleInstallFunction(isolate(), regexp_string_iterator_prototype, "next",
    4314             :                           Builtins::kRegExpStringIteratorPrototypeNext, 0,
    4315       89496 :                           true);
    4316             : 
    4317             :     Handle<JSFunction> regexp_string_iterator_function = CreateFunction(
    4318             :         isolate(), "RegExpStringIterator", JS_REGEXP_STRING_ITERATOR_TYPE,
    4319             :         JSRegExpStringIterator::kSize, 0, regexp_string_iterator_prototype,
    4320       89496 :         Builtins::kIllegal);
    4321       89496 :     regexp_string_iterator_function->shared()->set_native(false);
    4322      178992 :     native_context()->set_initial_regexp_string_iterator_prototype_map(
    4323      268488 :         regexp_string_iterator_function->initial_map());
    4324             :   }
    4325             : 
    4326             :   {  // @@matchAll Symbol
    4327      178992 :     Handle<JSFunction> symbol_fun(native_context()->symbol_function(),
    4328       89496 :                                   isolate());
    4329             :     InstallConstant(isolate(), symbol_fun, "matchAll",
    4330       89496 :                     factory()->match_all_symbol());
    4331             :   }
    4332             : }
    4333             : 
    4334       98358 : void Genesis::InitializeGlobal_harmony_weak_refs() {
    4335      178992 :   if (!FLAG_harmony_weak_refs) return;
    4336             : 
    4337             :   Factory* factory = isolate()->factory();
    4338         844 :   Handle<JSGlobalObject> global(native_context()->global_object(), isolate());
    4339             : 
    4340             :   {
    4341             :     // Create %FinalizationGroupPrototype%
    4342             :     Handle<String> finalization_group_name =
    4343         422 :         factory->NewStringFromStaticChars("FinalizationGroup");
    4344             :     Handle<JSObject> finalization_group_prototype =
    4345         422 :         factory->NewJSObject(isolate()->object_function(), TENURED);
    4346             : 
    4347             :     // Create %FinalizationGroup%
    4348             :     Handle<JSFunction> finalization_group_fun = CreateFunction(
    4349             :         isolate(), finalization_group_name, JS_FINALIZATION_GROUP_TYPE,
    4350             :         JSFinalizationGroup::kSize, 0, finalization_group_prototype,
    4351         422 :         Builtins::kFinalizationGroupConstructor);
    4352             : 
    4353         844 :     finalization_group_fun->shared()->DontAdaptArguments();
    4354         844 :     finalization_group_fun->shared()->set_length(1);
    4355             : 
    4356             :     // Install the "constructor" property on the prototype.
    4357             :     JSObject::AddProperty(isolate(), finalization_group_prototype,
    4358             :                           factory->constructor_string(), finalization_group_fun,
    4359         422 :                           DONT_ENUM);
    4360             : 
    4361             :     InstallToStringTag(isolate(), finalization_group_prototype,
    4362         422 :                        finalization_group_name);
    4363             : 
    4364             :     JSObject::AddProperty(isolate(), global, finalization_group_name,
    4365         422 :                           finalization_group_fun, DONT_ENUM);
    4366             : 
    4367             :     SimpleInstallFunction(isolate(), finalization_group_prototype, "register",
    4368         422 :                           Builtins::kFinalizationGroupRegister, 3, false);
    4369             : 
    4370             :     SimpleInstallFunction(isolate(), finalization_group_prototype, "unregister",
    4371         422 :                           Builtins::kFinalizationGroupUnregister, 1, false);
    4372             : 
    4373             :     SimpleInstallFunction(isolate(), finalization_group_prototype,
    4374             :                           "cleanupSome",
    4375         422 :                           Builtins::kFinalizationGroupCleanupSome, 0, false);
    4376             :   }
    4377             :   {
    4378             :     // Create %WeakRefPrototype%
    4379             :     Handle<Map> weak_ref_map =
    4380         422 :         factory->NewMap(JS_WEAK_REF_TYPE, JSWeakRef::kSize);
    4381             :     DCHECK(weak_ref_map->IsJSObjectMap());
    4382         422 :     native_context()->set_js_weak_ref_map(*weak_ref_map);
    4383             : 
    4384             :     Handle<JSObject> weak_ref_prototype =
    4385         422 :         factory->NewJSObject(isolate()->object_function(), TENURED);
    4386         422 :     Map::SetPrototype(isolate(), weak_ref_map, weak_ref_prototype);
    4387             : 
    4388             :     InstallToStringTag(isolate(), weak_ref_prototype,
    4389         422 :                        factory->WeakRef_string());
    4390             : 
    4391             :     SimpleInstallFunction(isolate(), weak_ref_prototype, "deref",
    4392         422 :                           Builtins::kWeakRefDeref, 0, false);
    4393             : 
    4394             :     // Create %WeakRef%
    4395         422 :     Handle<String> weak_ref_name = factory->InternalizeUtf8String("WeakRef");
    4396             :     Handle<JSFunction> weak_ref_fun = CreateFunction(
    4397             :         isolate(), weak_ref_name, JS_WEAK_REF_TYPE, JSWeakRef::kSize, 0,
    4398         422 :         weak_ref_prototype, Builtins::kWeakRefConstructor);
    4399             : 
    4400         844 :     weak_ref_fun->shared()->DontAdaptArguments();
    4401         844 :     weak_ref_fun->shared()->set_length(1);
    4402             : 
    4403             :     // Install the "constructor" property on the prototype.
    4404             :     JSObject::AddProperty(isolate(), weak_ref_prototype,
    4405             :                           factory->constructor_string(), weak_ref_fun,
    4406         422 :                           DONT_ENUM);
    4407             : 
    4408             :     JSObject::AddProperty(isolate(), global, weak_ref_name, weak_ref_fun,
    4409         422 :                           DONT_ENUM);
    4410             :   }
    4411             : 
    4412             :   {
    4413             :     // Create cleanup iterator for JSFinalizationGroup.
    4414             :     Handle<JSObject> iterator_prototype(
    4415         844 :         native_context()->initial_iterator_prototype(), isolate());
    4416             : 
    4417             :     Handle<JSObject> cleanup_iterator_prototype =
    4418         422 :         factory->NewJSObject(isolate()->object_function(), TENURED);
    4419         422 :     JSObject::ForceSetPrototype(cleanup_iterator_prototype, iterator_prototype);
    4420             : 
    4421             :     InstallToStringTag(isolate(), cleanup_iterator_prototype,
    4422         422 :                        "JSFinalizationGroupCleanupIterator");
    4423             : 
    4424             :     SimpleInstallFunction(isolate(), cleanup_iterator_prototype, "next",
    4425             :                           Builtins::kFinalizationGroupCleanupIteratorNext, 0,
    4426         422 :                           true);
    4427             :     Handle<Map> cleanup_iterator_map =
    4428             :         factory->NewMap(JS_FINALIZATION_GROUP_CLEANUP_ITERATOR_TYPE,
    4429         422 :                         JSFinalizationGroupCleanupIterator::kSize);
    4430             :     Map::SetPrototype(isolate(), cleanup_iterator_map,
    4431         422 :                       cleanup_iterator_prototype);
    4432         844 :     native_context()->set_js_finalization_group_cleanup_iterator_map(
    4433         422 :         *cleanup_iterator_map);
    4434             :   }
    4435             : }
    4436             : 
    4437             : #ifdef V8_INTL_SUPPORT
    4438       91926 : void Genesis::InitializeGlobal_harmony_locale() {
    4439      178911 :   if (!FLAG_harmony_locale) return;
    4440             : 
    4441             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4442             :       JSReceiver::GetProperty(
    4443             :           isolate(),
    4444         162 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4445         324 :           factory()->InternalizeUtf8String("Intl"))
    4446         162 :           .ToHandleChecked());
    4447             : 
    4448             :   Handle<JSFunction> locale_fun = InstallFunction(
    4449             :       isolate(), intl, "Locale", JS_INTL_LOCALE_TYPE, JSLocale::kSize, 0,
    4450          81 :       factory()->the_hole_value(), Builtins::kLocaleConstructor);
    4451             :   InstallWithIntrinsicDefaultProto(isolate(), locale_fun,
    4452          81 :                                    Context::INTL_LOCALE_FUNCTION_INDEX);
    4453         162 :   locale_fun->shared()->set_length(1);
    4454         162 :   locale_fun->shared()->DontAdaptArguments();
    4455             : 
    4456             :   // Setup %LocalePrototype%.
    4457             :   Handle<JSObject> prototype(JSObject::cast(locale_fun->instance_prototype()),
    4458         162 :                              isolate());
    4459             : 
    4460          81 :   InstallToStringTag(isolate(), prototype, "Intl.Locale");
    4461             : 
    4462             :   SimpleInstallFunction(isolate(), prototype, "toString",
    4463          81 :                         Builtins::kLocalePrototypeToString, 0, false);
    4464             :   SimpleInstallFunction(isolate(), prototype, "maximize",
    4465          81 :                         Builtins::kLocalePrototypeMaximize, 0, false);
    4466             :   SimpleInstallFunction(isolate(), prototype, "minimize",
    4467          81 :                         Builtins::kLocalePrototypeMinimize, 0, false);
    4468             :   // Base locale getters.
    4469             :   SimpleInstallGetter(isolate(), prototype,
    4470             :                       factory()->InternalizeUtf8String("language"),
    4471         162 :                       Builtins::kLocalePrototypeLanguage, true);
    4472             :   SimpleInstallGetter(isolate(), prototype,
    4473             :                       factory()->InternalizeUtf8String("script"),
    4474         162 :                       Builtins::kLocalePrototypeScript, true);
    4475             :   SimpleInstallGetter(isolate(), prototype,
    4476             :                       factory()->InternalizeUtf8String("region"),
    4477         162 :                       Builtins::kLocalePrototypeRegion, true);
    4478             :   SimpleInstallGetter(isolate(), prototype,
    4479             :                       factory()->InternalizeUtf8String("baseName"),
    4480         162 :                       Builtins::kLocalePrototypeBaseName, true);
    4481             :   // Unicode extension getters.
    4482             :   SimpleInstallGetter(isolate(), prototype,
    4483             :                       factory()->InternalizeUtf8String("calendar"),
    4484         162 :                       Builtins::kLocalePrototypeCalendar, true);
    4485             :   SimpleInstallGetter(isolate(), prototype,
    4486             :                       factory()->InternalizeUtf8String("caseFirst"),
    4487         162 :                       Builtins::kLocalePrototypeCaseFirst, true);
    4488             :   SimpleInstallGetter(isolate(), prototype,
    4489             :                       factory()->InternalizeUtf8String("collation"),
    4490         162 :                       Builtins::kLocalePrototypeCollation, true);
    4491             :   SimpleInstallGetter(isolate(), prototype,
    4492             :                       factory()->InternalizeUtf8String("hourCycle"),
    4493         162 :                       Builtins::kLocalePrototypeHourCycle, true);
    4494             :   SimpleInstallGetter(isolate(), prototype,
    4495             :                       factory()->InternalizeUtf8String("numeric"),
    4496         162 :                       Builtins::kLocalePrototypeNumeric, true);
    4497             :   SimpleInstallGetter(isolate(), prototype,
    4498             :                       factory()->InternalizeUtf8String("numberingSystem"),
    4499         162 :                       Builtins::kLocalePrototypeNumberingSystem, true);
    4500             : }
    4501             : 
    4502      103536 : void Genesis::InitializeGlobal_harmony_intl_segmenter() {
    4503      178407 :   if (!FLAG_harmony_intl_segmenter) return;
    4504             :   Handle<JSObject> intl = Handle<JSObject>::cast(
    4505             :       JSReceiver::GetProperty(
    4506             :           isolate(),
    4507        1170 :           Handle<JSReceiver>(native_context()->global_object(), isolate()),
    4508        2340 :           factory()->InternalizeUtf8String("Intl"))
    4509        1170 :           .ToHandleChecked());
    4510             : 
    4511             :   Handle<JSFunction> segmenter_fun = InstallFunction(
    4512             :       isolate(), intl, "Segmenter", JS_INTL_SEGMENTER_TYPE, JSSegmenter::kSize,
    4513         585 :       0, factory()->the_hole_value(), Builtins::kSegmenterConstructor);
    4514        1170 :   segmenter_fun->shared()->set_length(0);
    4515        1170 :   segmenter_fun->shared()->DontAdaptArguments();
    4516             : 
    4517             :   SimpleInstallFunction(isolate(), segmenter_fun, "supportedLocalesOf",
    4518         585 :                         Builtins::kSegmenterSupportedLocalesOf, 1, false);
    4519             : 
    4520             :   {
    4521             :     // Setup %SegmenterPrototype%.
    4522             :     Handle<JSObject> prototype(
    4523        1170 :         JSObject::cast(segmenter_fun->instance_prototype()), isolate());
    4524             : 
    4525         585 :     InstallToStringTag(isolate(), prototype, "Intl.Segmenter");
    4526             : 
    4527             :     SimpleInstallFunction(isolate(), prototype, "resolvedOptions",
    4528             :                           Builtins::kSegmenterPrototypeResolvedOptions, 0,
    4529         585 :                           false);
    4530             : 
    4531             :     SimpleInstallFunction(isolate(), prototype, "segment",
    4532         585 :                           Builtins::kSegmenterPrototypeSegment, 1, false);
    4533             :   }
    4534             : 
    4535             :   {
    4536             :     // Setup %SegmentIteratorPrototype%.
    4537             :     Handle<JSObject> iterator_prototype(
    4538        1170 :         native_context()->initial_iterator_prototype(), isolate());
    4539             : 
    4540             :     Handle<JSObject> prototype =
    4541        1170 :         factory()->NewJSObject(isolate()->object_function(), TENURED);
    4542         585 :     JSObject::ForceSetPrototype(prototype, iterator_prototype);
    4543             : 
    4544             :     InstallToStringTag(isolate(), prototype,
    4545         585 :                        factory()->SegmentIterator_string());
    4546             : 
    4547             :     SimpleInstallFunction(isolate(), prototype, "next",
    4548         585 :                           Builtins::kSegmentIteratorPrototypeNext, 0, false);
    4549             : 
    4550             :     SimpleInstallFunction(isolate(), prototype, "following",
    4551             :                           Builtins::kSegmentIteratorPrototypeFollowing, 0,
    4552         585 :                           false);
    4553             : 
    4554             :     SimpleInstallFunction(isolate(), prototype, "preceding",
    4555             :                           Builtins::kSegmentIteratorPrototypePreceding, 0,
    4556         585 :                           false);
    4557             : 
    4558             :     SimpleInstallGetter(isolate(), prototype,
    4559             :                         factory()->InternalizeUtf8String("index"),
    4560        1170 :                         Builtins::kSegmentIteratorPrototypeIndex, false);
    4561             : 
    4562             :     SimpleInstallGetter(isolate(), prototype,
    4563             :                         factory()->InternalizeUtf8String("breakType"),
    4564        1170 :                         Builtins::kSegmentIteratorPrototypeBreakType, false);
    4565             : 
    4566             :     // Setup SegmentIterator constructor.
    4567             :     Handle<String> name_string =
    4568             :         Name::ToFunctionName(
    4569             :             isolate(),
    4570        1170 :             isolate()->factory()->InternalizeUtf8String("SegmentIterator"))
    4571        1170 :             .ToHandleChecked();
    4572             :     Handle<JSFunction> segment_iterator_fun = CreateFunction(
    4573             :         isolate(), name_string, JS_INTL_SEGMENT_ITERATOR_TYPE,
    4574         585 :         JSSegmentIterator::kSize, 0, prototype, Builtins::kIllegal);
    4575         585 :     segment_iterator_fun->shared()->set_native(false);
    4576             : 
    4577             :     Handle<Map> segment_iterator_map(segment_iterator_fun->initial_map(),
    4578        1170 :                                      isolate());
    4579         585 :     native_context()->set_intl_segment_iterator_map(*segment_iterator_map);
    4580             :   }
    4581             : }
    4582             : 
    4583             : #endif  // V8_INTL_SUPPORT
    4584             : 
    4585      268488 : void Genesis::InitializeGlobal_harmony_object_from_entries() {
    4586      178992 :   if (!FLAG_harmony_object_from_entries) return;
    4587             :   SimpleInstallFunction(isolate(), isolate()->object_function(), "fromEntries",
    4588      178992 :                         Builtins::kObjectFromEntries, 1, false);
    4589             : }
    4590             : 
    4591         222 : Handle<JSFunction> Genesis::CreateArrayBuffer(
    4592        1665 :     Handle<String> name, ArrayBufferKind array_buffer_kind) {
    4593             :   // Create the %ArrayBufferPrototype%
    4594             :   // Setup the {prototype} with the given {name} for @@toStringTag.
    4595             :   Handle<JSObject> prototype =
    4596         444 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    4597         222 :   InstallToStringTag(isolate(), prototype, name);
    4598             : 
    4599             :   // Allocate the constructor with the given {prototype}.
    4600             :   Handle<JSFunction> array_buffer_fun =
    4601             :       CreateFunction(isolate(), name, JS_ARRAY_BUFFER_TYPE,
    4602             :                      JSArrayBuffer::kSizeWithEmbedderFields, 0, prototype,
    4603         222 :                      Builtins::kArrayBufferConstructor);
    4604         444 :   array_buffer_fun->shared()->DontAdaptArguments();
    4605         444 :   array_buffer_fun->shared()->set_length(1);
    4606             : 
    4607             :   // Install the "constructor" property on the {prototype}.
    4608             :   JSObject::AddProperty(isolate(), prototype, factory()->constructor_string(),
    4609         222 :                         array_buffer_fun, DONT_ENUM);
    4610             : 
    4611         222 :   switch (array_buffer_kind) {
    4612             :     case ARRAY_BUFFER:
    4613             :       InstallFunctionWithBuiltinId(isolate(), array_buffer_fun, "isView",
    4614             :                                    Builtins::kArrayBufferIsView, 1, true,
    4615         111 :                                    BuiltinFunctionId::kArrayBufferIsView);
    4616             : 
    4617             :       // Install the "byteLength" getter on the {prototype}.
    4618             :       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
    4619             :                           Builtins::kArrayBufferPrototypeGetByteLength, false,
    4620         111 :                           BuiltinFunctionId::kArrayBufferByteLength);
    4621             : 
    4622             :       SimpleInstallFunction(isolate(), prototype, "slice",
    4623         111 :                             Builtins::kArrayBufferPrototypeSlice, 2, true);
    4624         111 :       break;
    4625             : 
    4626             :     case SHARED_ARRAY_BUFFER:
    4627             :       // Install the "byteLength" getter on the {prototype}.
    4628             :       SimpleInstallGetter(isolate(), prototype, factory()->byte_length_string(),
    4629             :                           Builtins::kSharedArrayBufferPrototypeGetByteLength,
    4630             :                           false,
    4631         111 :                           BuiltinFunctionId::kSharedArrayBufferByteLength);
    4632             : 
    4633             :       SimpleInstallFunction(isolate(), prototype, "slice",
    4634             :                             Builtins::kSharedArrayBufferPrototypeSlice, 2,
    4635         111 :                             true);
    4636         111 :       break;
    4637             :   }
    4638             : 
    4639         222 :   return array_buffer_fun;
    4640             : }
    4641             : 
    4642         666 : void Genesis::InstallInternalPackedArrayFunction(Handle<JSObject> prototype,
    4643        1998 :                                                  const char* function_name) {
    4644        1332 :   Handle<JSObject> array_prototype(native_context()->initial_array_prototype(),
    4645         666 :                                    isolate());
    4646             :   Handle<Object> func =
    4647         666 :       JSReceiver::GetProperty(isolate(), array_prototype, function_name)
    4648        1332 :           .ToHandleChecked();
    4649             :   JSObject::AddProperty(isolate(), prototype, function_name, func,
    4650         666 :                         ALL_ATTRIBUTES_MASK);
    4651         666 : }
    4652             : 
    4653         111 : void Genesis::InstallInternalPackedArray(Handle<JSObject> target,
    4654         999 :                                          const char* name) {
    4655             :   // --- I n t e r n a l   A r r a y ---
    4656             :   // An array constructor on the builtins object that works like
    4657             :   // the public Array constructor, except that its prototype
    4658             :   // doesn't inherit from Object.prototype.
    4659             :   // To be used only for internal work by builtins. Instances
    4660             :   // must not be leaked to user code.
    4661             :   Handle<JSObject> prototype =
    4662         222 :       factory()->NewJSObject(isolate()->object_function(), TENURED);
    4663             :   Handle<JSFunction> array_function =
    4664             :       InstallFunction(isolate(), target, name, JS_ARRAY_TYPE, JSArray::kSize, 0,
    4665         111 :                       prototype, Builtins::kInternalArrayConstructor);
    4666             : 
    4667         222 :   array_function->shared()->DontAdaptArguments();
    4668             : 
    4669         222 :   Handle<Map> original_map(array_function->initial_map(), isolate());
    4670         111 :   Handle<Map> initial_map = Map::Copy(isolate(), original_map, "InternalArray");
    4671         111 :   initial_map->set_elements_kind(PACKED_ELEMENTS);
    4672         111 :   JSFunction::SetInitialMap(array_function, initial_map, prototype);
    4673             : 
    4674             :   // Make "length" magic on instances.
    4675         111 :   Map::EnsureDescriptorSlack(isolate(), initial_map, 1);
    4676             : 
    4677             :   PropertyAttributes attribs = static_cast<PropertyAttributes>(
    4678             :       DONT_ENUM | DONT_DELETE);
    4679             : 
    4680             :   {  // Add length.
    4681             :     Descriptor d = Descriptor::AccessorConstant(
    4682             :         factory()->length_string(), factory()->array_length_accessor(),
    4683         111 :         attribs);
    4684         111 :     initial_map->AppendDescriptor(isolate(), &d);
    4685             :   }
    4686             : 
    4687             :   JSObject::NormalizeProperties(
    4688             :       prototype, KEEP_INOBJECT_PROPERTIES, 6,
    4689         111 :       "OptimizeInternalPackedArrayPrototypeForAdding");
    4690         111 :   InstallInternalPackedArrayFunction(prototype, "push");
    4691         111 :   InstallInternalPackedArrayFunction(prototype, "pop");
    4692         111 :   InstallInternalPackedArrayFunction(prototype, "shift");
    4693         111 :   InstallInternalPackedArrayFunction(prototype, "unshift");
    4694         111 :   InstallInternalPackedArrayFunction(prototype, "splice");
    4695         111 :   InstallInternalPackedArrayFunction(prototype, "slice");
    4696             : 
    4697         111 :   JSObject::ForceSetPrototype(prototype, factory()->null_value());
    4698         111 :   JSObject::MigrateSlowToFast(prototype, 0, "Bootstrapping");
    4699         111 : }
    4700             : 
    4701       10323 : bool Genesis::InstallNatives() {
    4702             :   HandleScope scope(isolate());
    4703             : 
    4704             :   // Set up the extras utils object as a shared container between native
    4705             :   // scripts and extras. (Extras consume things added there by native scripts.)
    4706             :   Handle<JSObject> extras_utils =
    4707         222 :       factory()->NewJSObject(isolate()->object_function());
    4708         222 :   native_context()->set_extras_utils_object(*extras_utils);
    4709             : 
    4710         111 :   InstallInternalPackedArray(extras_utils, "InternalPackedArray");
    4711             : 
    4712             :   // Extras need the ability to store private state on their objects without
    4713             :   // exposing it to the outside world.
    4714             :   SimpleInstallFunction(isolate_, extras_utils, "createPrivateSymbol",
    4715         111 :                         Builtins::kExtrasUtilsCreatePrivateSymbol, 1, false);
    4716             : 
    4717             :   SimpleInstallFunction(isolate_, extras_utils, "uncurryThis",
    4718         111 :                         Builtins::kExtrasUtilsUncurryThis, 1, false);
    4719             : 
    4720             :   SimpleInstallFunction(isolate_, extras_utils, "markPromiseAsHandled",
    4721         111 :                         Builtins::kExtrasUtilsMarkPromiseAsHandled, 1, false);
    4722             : 
    4723             :   SimpleInstallFunction(isolate_, extras_utils, "promiseState",
    4724         111 :                         Builtins::kExtrasUtilsPromiseState, 1, false);
    4725             : 
    4726             :   // [[PromiseState]] values (for extrasUtils.promiseState())
    4727             :   // These values should be kept in sync with PromiseStatus in globals.h
    4728             :   JSObject::AddProperty(
    4729             :       isolate(), extras_utils, "kPROMISE_PENDING",
    4730             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kPending)),
    4731         222 :       DONT_ENUM);
    4732             :   JSObject::AddProperty(
    4733             :       isolate(), extras_utils, "kPROMISE_FULFILLED",
    4734             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kFulfilled)),
    4735         222 :       DONT_ENUM);
    4736             :   JSObject::AddProperty(
    4737             :       isolate(), extras_utils, "kPROMISE_REJECTED",
    4738             :       factory()->NewNumberFromInt(static_cast<int>(Promise::kRejected)),
    4739         222 :       DONT_ENUM);
    4740             : 
    4741             :   // v8.createPromise(parent)
    4742             :   Handle<JSFunction> promise_internal_constructor =
    4743             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4744         111 :                            Builtins::kPromiseInternalConstructor, 1, true);
    4745         111 :   promise_internal_constructor->shared()->set_native(false);
    4746             :   JSObject::AddProperty(isolate(), extras_utils, "createPromise",
    4747         111 :                         promise_internal_constructor, DONT_ENUM);
    4748             : 
    4749             :   // v8.rejectPromise(promise, reason)
    4750             :   Handle<JSFunction> promise_internal_reject =
    4751             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4752         111 :                            Builtins::kPromiseInternalReject, 2, true);
    4753         111 :   promise_internal_reject->shared()->set_native(false);
    4754             :   JSObject::AddProperty(isolate(), extras_utils, "rejectPromise",
    4755         111 :                         promise_internal_reject, DONT_ENUM);
    4756             : 
    4757             :   // v8.resolvePromise(promise, resolution)
    4758             :   Handle<JSFunction> promise_internal_resolve =
    4759             :       SimpleCreateFunction(isolate(), factory()->empty_string(),
    4760         111 :                            Builtins::kPromiseInternalResolve, 2, true);
    4761         111 :   promise_internal_resolve->shared()->set_native(false);
    4762             :   JSObject::AddProperty(isolate(), extras_utils, "resolvePromise",
    4763         111 :                         promise_internal_resolve, DONT_ENUM);
    4764             : 
    4765             :   JSObject::AddProperty(isolate(), extras_utils, "isPromise",
    4766         222 :                         isolate()->is_promise(), DONT_ENUM);
    4767             : 
    4768             :   JSObject::MigrateSlowToFast(Handle<JSObject>::cast(extras_utils), 0,
    4769         111 :                               "Bootstrapping");
    4770             : 
    4771             :   {
    4772             :     // Builtin function for OpaqueReference -- a JSValue-based object,
    4773             :     // that keeps its field isolated from JavaScript code. It may store
    4774             :     // objects, that JavaScript code may not access.
    4775             :     Handle<JSObject> prototype =
    4776         222 :         factory()->NewJSObject(isolate()->object_function(), TENURED);
    4777             :     Handle<JSFunction> opaque_reference_fun =
    4778             :         CreateFunction(isolate(), factory()->empty_string(), JS_VALUE_TYPE,
    4779         111 :                        JSValue::kSize, 0, prototype, Builtins::kIllegal);
    4780         111 :     native_context()->set_opaque_reference_function(*opaque_reference_fun);
    4781             :   }
    4782             : 
    4783             :   auto fast_template_instantiations_cache = isolate()->factory()->NewFixedArray(
    4784         111 :       TemplateInfo::kFastTemplateInstantiationsCacheSize);
    4785         222 :   native_context()->set_fast_template_instantiations_cache(
    4786         111 :       *fast_template_instantiations_cache);
    4787             : 
    4788             :   auto slow_template_instantiations_cache = SimpleNumberDictionary::New(
    4789         111 :       isolate(), ApiNatives::kInitialFunctionCacheSize);
    4790         222 :   native_context()->set_slow_template_instantiations_cache(
    4791         111 :       *slow_template_instantiations_cache);
    4792             : 
    4793             :   // Store the map for the %ObjectPrototype% after the natives has been compiled
    4794             :   // and the Object function has been set up.
    4795             :   {
    4796         222 :     Handle<JSFunction> object_function(native_context()->object_function(),
    4797         111 :                                        isolate());
    4798             :     DCHECK(JSObject::cast(object_function->initial_map()->prototype())
    4799             :                ->HasFastProperties());
    4800         222 :     native_context()->set_object_function_prototype_map(
    4801         333 :         HeapObject::cast(object_function->initial_map()->prototype())->map());
    4802             :   }
    4803             : 
    4804             :   // Store the map for the %StringPrototype% after the natives has been compiled
    4805             :   // and the String function has been set up.
    4806         222 :   Handle<JSFunction> string_function(native_context()->string_function(),
    4807         111 :                                      isolate());
    4808             :   JSObject string_function_prototype =
    4809         222 :       JSObject::cast(string_function->initial_map()->prototype());
    4810             :   DCHECK(string_function_prototype->HasFastProperties());
    4811         222 :   native_context()->set_string_function_prototype_map(
    4812         111 :       string_function_prototype->map());
    4813             : 
    4814             :   Handle<JSGlobalObject> global_object =
    4815         222 :       handle(native_context()->global_object(), isolate());
    4816             : 
    4817             :   // Install Global.decodeURI.
    4818             :   InstallFunctionWithBuiltinId(isolate(), global_object, "decodeURI",
    4819             :                                Builtins::kGlobalDecodeURI, 1, false,
    4820         111 :                                BuiltinFunctionId::kGlobalDecodeURI);
    4821             : 
    4822             :   // Install Global.decodeURIComponent.
    4823             :   InstallFunctionWithBuiltinId(isolate(), global_object, "decodeURIComponent",
    4824             :                                Builtins::kGlobalDecodeURIComponent, 1, false,
    4825         111 :                                BuiltinFunctionId::kGlobalDecodeURIComponent);
    4826             : 
    4827             :   // Install Global.encodeURI.
    4828             :   InstallFunctionWithBuiltinId(isolate(), global_object, "encodeURI",
    4829             :                                Builtins::kGlobalEncodeURI, 1, false,
    4830         111 :                                BuiltinFunctionId::kGlobalEncodeURI);
    4831             : 
    4832             :   // Install Global.encodeURIComponent.
    4833             :   InstallFunctionWithBuiltinId(isolate(), global_object, "encodeURIComponent",
    4834             :                                Builtins::kGlobalEncodeURIComponent, 1, false,
    4835         111 :                                BuiltinFunctionId::kGlobalEncodeURIComponent);
    4836             : 
    4837             :   // Install Global.escape.
    4838             :   InstallFunctionWithBuiltinId(isolate(), global_object, "escape",
    4839             :                                Builtins::kGlobalEscape, 1, false,
    4840         111 :                                BuiltinFunctionId::kGlobalEscape);
    4841             : 
    4842             :   // Install Global.unescape.
    4843             :   InstallFunctionWithBuiltinId(isolate(), global_object, "unescape",
    4844             :                                Builtins::kGlobalUnescape, 1, false,
    4845         111 :                                BuiltinFunctionId::kGlobalUnescape);
    4846             : 
    4847             :   // Install Global.eval.
    4848             :   {
    4849             :     Handle<JSFunction> eval = SimpleInstallFunction(
    4850         111 :         isolate(), global_object, "eval", Builtins::kGlobalEval, 1, false);
    4851         111 :     native_context()->set_global_eval_fun(*eval);
    4852             :   }
    4853             : 
    4854             :   // Install Global.isFinite
    4855             :   InstallFunctionWithBuiltinId(isolate(), global_object, "isFinite",
    4856             :                                Builtins::kGlobalIsFinite, 1, true,
    4857         111 :                                BuiltinFunctionId::kGlobalIsFinite);
    4858             : 
    4859             :   // Install Global.isNaN
    4860             :   InstallFunctionWithBuiltinId(isolate(), global_object, "isNaN",
    4861             :                                Builtins::kGlobalIsNaN, 1, true,
    4862         111 :                                BuiltinFunctionId::kGlobalIsNaN);
    4863             : 
    4864             :   // Install Array builtin functions.
    4865             :   {
    4866         222 :     Handle<JSFunction> array_constructor(native_context()->array_function(),
    4867         111 :                                          isolate());
    4868             :     Handle<JSArray> proto(JSArray::cast(array_constructor->prototype()),
    4869         222 :                           isolate());
    4870             : 
    4871             :     // Verification of important array prototype properties.
    4872         111 :     Object length = proto->length();
    4873         111 :     CHECK(length->IsSmi());
    4874         111 :     CHECK_EQ(Smi::ToInt(length), 0);
    4875         222 :     CHECK(proto->HasSmiOrObjectElements());
    4876             :     // This is necessary to enable fast checks for absence of elements
    4877             :     // on Array.prototype and below.
    4878         333 :     proto->set_elements(ReadOnlyRoots(heap()).empty_fixed_array());
    4879             :   }
    4880             : 
    4881         111 :   InstallBuiltinFunctionIds();
    4882             : 
    4883             :   // Create a map for accessor property descriptors (a variant of JSObject
    4884             :   // that predefines four properties get, set, configurable and enumerable).
    4885             :   {
    4886             :     // AccessorPropertyDescriptor initial map.
    4887             :     Handle<Map> map =
    4888             :         factory()->NewMap(JS_OBJECT_TYPE, JSAccessorPropertyDescriptor::kSize,
    4889         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4890             :     // Create the descriptor array for the property descriptor object.
    4891         111 :     Map::EnsureDescriptorSlack(isolate(), map, 4);
    4892             : 
    4893             :     {  // get
    4894             :       Descriptor d =
    4895             :           Descriptor::DataField(isolate(), factory()->get_string(),
    4896             :                                 JSAccessorPropertyDescriptor::kGetIndex, NONE,
    4897         111 :                                 Representation::Tagged());
    4898         111 :       map->AppendDescriptor(isolate(), &d);
    4899             :     }
    4900             :     {  // set
    4901             :       Descriptor d =
    4902             :           Descriptor::DataField(isolate(), factory()->set_string(),
    4903             :                                 JSAccessorPropertyDescriptor::kSetIndex, NONE,
    4904         111 :                                 Representation::Tagged());
    4905         111 :       map->AppendDescriptor(isolate(), &d);
    4906             :     }
    4907             :     {  // enumerable
    4908             :       Descriptor d =
    4909             :           Descriptor::DataField(isolate(), factory()->enumerable_string(),
    4910             :                                 JSAccessorPropertyDescriptor::kEnumerableIndex,
    4911         111 :                                 NONE, Representation::Tagged());
    4912         111 :       map->AppendDescriptor(isolate(), &d);
    4913             :     }
    4914             :     {  // configurable
    4915             :       Descriptor d = Descriptor::DataField(
    4916             :           isolate(), factory()->configurable_string(),
    4917             :           JSAccessorPropertyDescriptor::kConfigurableIndex, NONE,
    4918         111 :           Representation::Tagged());
    4919         111 :       map->AppendDescriptor(isolate(), &d);
    4920             :     }
    4921             : 
    4922         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    4923         222 :     map->SetConstructor(native_context()->object_function());
    4924             : 
    4925         111 :     native_context()->set_accessor_property_descriptor_map(*map);
    4926             :   }
    4927             : 
    4928             :   // Create a map for data property descriptors (a variant of JSObject
    4929             :   // that predefines four properties value, writable, configurable and
    4930             :   // enumerable).
    4931             :   {
    4932             :     // DataPropertyDescriptor initial map.
    4933             :     Handle<Map> map =
    4934             :         factory()->NewMap(JS_OBJECT_TYPE, JSDataPropertyDescriptor::kSize,
    4935         111 :                           TERMINAL_FAST_ELEMENTS_KIND, 4);
    4936             :     // Create the descriptor array for the property descriptor object.
    4937         111 :     Map::EnsureDescriptorSlack(isolate(), map, 4);
    4938             : 
    4939             :     {  // value
    4940             :       Descriptor d =
    4941             :           Descriptor::DataField(isolate(), factory()->value_string(),
    4942             :                                 JSDataPropertyDescriptor::kValueIndex, NONE,
    4943         111 :                                 Representation::Tagged());
    4944         111 :       map->AppendDescriptor(isolate(), &d);
    4945             :     }
    4946             :     {  // writable
    4947             :       Descriptor d =
    4948             :           Descriptor::DataField(isolate(), factory()->writable_string(),
    4949             :                                 JSDataPropertyDescriptor::kWritableIndex, NONE,
    4950         111 :                                 Representation::Tagged());
    4951         111 :       map->AppendDescriptor(isolate(), &d);
    4952             :     }
    4953             :     {  // enumerable
    4954             :       Descriptor d =
    4955             :           Descriptor::DataField(isolate(), factory()->enumerable_string(),
    4956             :                                 JSDataPropertyDescriptor::kEnumerableIndex,
    4957         111 :                                 NONE, Representation::Tagged());
    4958         111 :       map->AppendDescriptor(isolate(), &d);
    4959             :     }
    4960             :     {  // configurable
    4961             :       Descriptor d =
    4962             :           Descriptor::DataField(isolate(), factory()->configurable_string(),
    4963             :                                 JSDataPropertyDescriptor::kConfigurableIndex,
    4964         111 :                                 NONE, Representation::Tagged());
    4965         111 :       map->AppendDescriptor(isolate(), &d);
    4966             :     }
    4967             : 
    4968         222 :     Map::SetPrototype(isolate(), map, isolate()->initial_object_prototype());
    4969         222 :     map->SetConstructor(native_context()->object_function());
    4970             : 
    4971         111 :     native_context()->set_data_property_descriptor_map(*map);
    4972             :   }
    4973             : 
    4974             :   // Create a constructor for RegExp results (a variant of Array that
    4975             :   // predefines the properties index, input, and groups).
    4976             :   {
    4977             :     // JSRegExpResult initial map.
    4978             : 
    4979             :     // Find global.Array.prototype to inherit from.
    4980         222 :     Handle<JSFunction> array_constructor(native_context()->array_function(),
    4981         111 :                                          isolate());
    4982             :     Handle<JSObject> array_prototype(
    4983         222 :         JSObject::cast(array_constructor->instance_prototype()), isolate());
    4984             : 
    4985             :     // Add initial map.
    4986             :     Handle<Map> initial_map = factory()->NewMap(
    4987             :         JS_ARRAY_TYPE, JSRegExpResult::kSize, TERMINAL_FAST_ELEMENTS_KIND,
    4988         111 :         JSRegExpResult::kInObjectPropertyCount);
    4989         222 :     initial_map->SetConstructor(*array_constructor);
    4990             : 
    4991             :     // Set prototype on map.
    4992             :     initial_map->set_has_non_instance_prototype(false);
    4993         111 :     Map::SetPrototype(isolate(), initial_map, array_prototype);
    4994             : 
    4995             :     // Update map with length accessor from Array and add "index", "input" and
    4996             :     // "groups".
    4997             :     Map::EnsureDescriptorSlack(isolate(), initial_map,
    4998         111 :                                JSRegExpResult::kInObjectPropertyCount + 1);
    4999             : 
    5000             :     // length descriptor.
    5001             :     {
    5002         111 :       JSFunction array_function = native_context()->array_function();
    5003             :       Handle<DescriptorArray> array_descriptors(
    5004         222 :           array_function->initial_map()->instance_descriptors(), isolate());
    5005             :       Handle<String> length = factory()->length_string();
    5006             :       int old = array_descriptors->SearchWithCache(
    5007         333 :           isolate(), *length, array_function->initial_map());
    5008             :       DCHECK_NE(old, DescriptorArray::kNotFound);
    5009             :       Descriptor d = Descriptor::AccessorConstant(
    5010             :           length, handle(array_descriptors->GetStrongValue(old), isolate()),
    5011         333 :           array_descriptors->GetDetails(old).attributes());
    5012         111 :       initial_map->AppendDescriptor(isolate(), &d);
    5013             :     }
    5014             : 
    5015             :     // index descriptor.
    5016             :     {
    5017             :       Descriptor d = Descriptor::DataField(isolate(), factory()->index_string(),
    5018             :                                            JSRegExpResult::kIndexIndex, NONE,
    5019         111 :                                            Representation::Tagged());
    5020         111 :       initial_map->AppendDescriptor(isolate(), &d);
    5021             :     }
    5022             : 
    5023             :     // input descriptor.
    5024             :     {
    5025             :       Descriptor d = Descriptor::DataField(isolate(), factory()->input_string(),
    5026             :                                            JSRegExpResult::kInputIndex, NONE,
    5027         111 :                                            Representation::Tagged());
    5028         111 :       initial_map->AppendDescriptor(isolate(), &d);
    5029             :     }
    5030             : 
    5031             :     // groups descriptor.
    5032             :     {
    5033             :       Descriptor d = Descriptor::DataField(
    5034             :           isolate(), factory()->groups_string(), JSRegExpResult::kGroupsIndex,
    5035         111 :           NONE, Representation::Tagged());
    5036         111 :       initial_map->AppendDescriptor(isolate(), &d);
    5037             :     }
    5038             : 
    5039         111 :     native_context()->set_regexp_result_map(*initial_map);
    5040             :   }
    5041             : 
    5042             :   // Add @@iterator method to the arguments object maps.
    5043             :   {
    5044             :     PropertyAttributes attribs = DONT_ENUM;
    5045             :     Handle<AccessorInfo> arguments_iterator =
    5046             :         factory()->arguments_iterator_accessor();
    5047             :     {
    5048             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5049         111 :                                                   arguments_iterator, attribs);
    5050         222 :       Handle<Map> map(native_context()->sloppy_arguments_map(), isolate());
    5051         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5052         111 :       map->AppendDescriptor(isolate(), &d);
    5053             :     }
    5054             :     {
    5055             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5056         111 :                                                   arguments_iterator, attribs);
    5057         222 :       Handle<Map> map(native_context()->fast_aliased_arguments_map(),
    5058         111 :                       isolate());
    5059         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5060         111 :       map->AppendDescriptor(isolate(), &d);
    5061             :     }
    5062             :     {
    5063             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5064         111 :                                                   arguments_iterator, attribs);
    5065         222 :       Handle<Map> map(native_context()->slow_aliased_arguments_map(),
    5066         111 :                       isolate());
    5067         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5068         111 :       map->AppendDescriptor(isolate(), &d);
    5069             :     }
    5070             :     {
    5071             :       Descriptor d = Descriptor::AccessorConstant(factory()->iterator_symbol(),
    5072         111 :                                                   arguments_iterator, attribs);
    5073         222 :       Handle<Map> map(native_context()->strict_arguments_map(), isolate());
    5074         111 :       Map::EnsureDescriptorSlack(isolate(), map, 1);
    5075         111 :       map->AppendDescriptor(isolate(), &d);
    5076             :     }
    5077             :   }
    5078             : 
    5079         111 :   return true;
    5080             : }
    5081             : 
    5082         666 : bool Genesis::InstallExtraNatives() {
    5083             :   HandleScope scope(isolate());
    5084             : 
    5085             :   Handle<JSObject> extras_binding =
    5086         222 :       factory()->NewJSObject(isolate()->object_function());
    5087             : 
    5088             :   // binding.isTraceCategoryEnabled(category)
    5089             :   SimpleInstallFunction(isolate(), extras_binding, "isTraceCategoryEnabled",
    5090         111 :                         Builtins::kIsTraceCategoryEnabled, 1, true);
    5091             : 
    5092             :   // binding.trace(phase, category, name, id, data)
    5093             :   SimpleInstallFunction(isolate(), extras_binding, "trace", Builtins::kTrace, 5,
    5094         111 :                         true);
    5095             : 
    5096         111 :   native_context()->set_extras_binding_object(*extras_binding);
    5097             : 
    5098         222 :   for (int i = 0; i < ExtraNatives::GetBuiltinsCount(); i++) {
    5099         111 :     if (!Bootstrapper::CompileExtraBuiltin(isolate(), i)) return false;
    5100             :   }
    5101             : 
    5102             :   return true;
    5103             : }
    5104             : 
    5105             : 
    5106       14319 : static void InstallBuiltinFunctionId(Isolate* isolate, Handle<JSObject> holder,
    5107             :                                      const char* function_name,
    5108             :                                      BuiltinFunctionId id) {
    5109             :   Handle<Object> function_object =
    5110       28638 :       JSReceiver::GetProperty(isolate, holder, function_name).ToHandleChecked();
    5111       14319 :   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
    5112       28638 :   function->shared()->set_builtin_function_id(id);
    5113       14319 : }
    5114             : 
    5115             : #define INSTALL_BUILTIN_ID(holder_expr, fun_name, name) \
    5116             :   {#holder_expr, #fun_name, BuiltinFunctionId::k##name},
    5117             : 
    5118       28749 : void Genesis::InstallBuiltinFunctionIds() {
    5119             :   HandleScope scope(isolate());
    5120             :   struct BuiltinFunctionIds {
    5121             :     const char* holder_expr;
    5122             :     const char* fun_name;
    5123             :     BuiltinFunctionId id;
    5124             :   };
    5125             : 
    5126             :   const BuiltinFunctionIds builtins[] = {
    5127         111 :       FUNCTIONS_WITH_ID_LIST(INSTALL_BUILTIN_ID)};
    5128             : 
    5129       14430 :   for (const BuiltinFunctionIds& builtin : builtins) {
    5130             :     Handle<JSObject> holder = ResolveBuiltinIdHolder(
    5131       28638 :         isolate(), native_context(), builtin.holder_expr);
    5132       28638 :     InstallBuiltinFunctionId(isolate(), holder, builtin.fun_name, builtin.id);
    5133             :   }
    5134         111 : }
    5135             : 
    5136             : #undef INSTALL_BUILTIN_ID
    5137             : 
    5138             : 
    5139         111 : void Genesis::InitializeNormalizedMapCaches() {
    5140         111 :   Handle<NormalizedMapCache> cache = NormalizedMapCache::New(isolate());
    5141         222 :   native_context()->set_normalized_map_cache(*cache);
    5142         111 : }
    5143             : 
    5144             : 
    5145       89797 : bool Bootstrapper::InstallExtensions(Handle<Context> native_context,
    5146             :                                      v8::ExtensionConfiguration* extensions) {
    5147             :   // Don't install extensions into the snapshot.
    5148       89797 :   if (isolate_->serializer_enabled()) return true;
    5149             :   BootstrapperActive active(this);
    5150       89496 :   SaveAndSwitchContext saved_context(isolate_, *native_context);
    5151      178952 :   return Genesis::InstallExtensions(isolate_, native_context, extensions) &&
    5152       89456 :          Genesis::InstallSpecialObjects(isolate_, native_context);
    5153             : }
    5154             : 
    5155       89456 : bool Genesis::InstallSpecialObjects(Isolate* isolate,
    5156             :                                     Handle<Context> native_context) {
    5157             :   HandleScope scope(isolate);
    5158             : 
    5159       89456 :   Handle<JSObject> Error = isolate->error_function();
    5160             :   Handle<String> name = isolate->factory()->stackTraceLimit_string();
    5161       89456 :   Handle<Smi> stack_trace_limit(Smi::FromInt(FLAG_stack_trace_limit), isolate);
    5162       89456 :   JSObject::AddProperty(isolate, Error, name, stack_trace_limit, NONE);
    5163             : 
    5164       89456 :   if (FLAG_expose_wasm) {
    5165             :     // Install the internal data structures into the isolate and expose on
    5166             :     // the global object.
    5167       79828 :     WasmJs::Install(isolate, true);
    5168        9628 :   } else if (FLAG_validate_asm) {
    5169             :     // Install the internal data structures only; these are needed for asm.js
    5170             :     // translated to WASM to work correctly.
    5171          25 :     WasmJs::Install(isolate, false);
    5172             :   }
    5173             : 
    5174       89456 :   return true;
    5175             : }
    5176             : 
    5177             : 
    5178             : static uint32_t Hash(RegisteredExtension* extension) {
    5179             :   return v8::internal::ComputePointerHash(extension);
    5180             : }
    5181             : 
    5182           0 : Genesis::ExtensionStates::ExtensionStates() : map_(8) {}
    5183             : 
    5184        4517 : Genesis::ExtensionTraversalState Genesis::ExtensionStates::get_state(
    5185             :     RegisteredExtension* extension) {
    5186        4517 :   base::HashMap::Entry* entry = map_.Lookup(extension, Hash(extension));
    5187        4517 :   if (entry == nullptr) {
    5188             :     return UNVISITED;
    5189             :   }
    5190             :   return static_cast<ExtensionTraversalState>(
    5191          59 :       reinterpret_cast<intptr_t>(entry->value));
    5192             : }
    5193             : 
    5194        8907 : void Genesis::ExtensionStates::set_state(RegisteredExtension* extension,
    5195             :                                          ExtensionTraversalState state) {
    5196       17816 :   map_.LookupOrInsert(extension, Hash(extension))->value =
    5197        8909 :       reinterpret_cast<void*>(static_cast<intptr_t>(state));
    5198        8909 : }
    5199             : 
    5200       89496 : bool Genesis::InstallExtensions(Isolate* isolate,
    5201             :                                 Handle<Context> native_context,
    5202             :                                 v8::ExtensionConfiguration* extensions) {
    5203             :   ExtensionStates extension_states;  // All extensions have state UNVISITED.
    5204      178992 :   return InstallAutoExtensions(isolate, &extension_states) &&
    5205       89496 :          (!FLAG_expose_free_buffer ||
    5206       89496 :           InstallExtension(isolate, "v8/free-buffer", &extension_states)) &&
    5207       91901 :          (!FLAG_expose_gc ||
    5208       91901 :           InstallExtension(isolate, "v8/gc", &extension_states)) &&
    5209       89618 :          (!FLAG_expose_externalize_string ||
    5210       89618 :           InstallExtension(isolate, "v8/externalize", &extension_states)) &&
    5211       89496 :          (!FLAG_gc_stats ||
    5212       89496 :           InstallExtension(isolate, "v8/statistics", &extension_states)) &&
    5213       89497 :          (!FLAG_expose_trigger_failure ||
    5214       89497 :           InstallExtension(isolate, "v8/trigger-failure", &extension_states)) &&
    5215       89505 :          (!FLAG_trace_ignition_dispatches ||
    5216             :           InstallExtension(isolate, "v8/ignition-statistics",
    5217      179001 :                            &extension_states)) &&
    5218      178992 :          InstallRequestedExtensions(isolate, extensions, &extension_states);
    5219             : }
    5220             : 
    5221             : 
    5222       89496 : bool Genesis::InstallAutoExtensions(Isolate* isolate,
    5223             :                                     ExtensionStates* extension_states) {
    5224      730428 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5225             :        it != nullptr; it = it->next()) {
    5226      640952 :     if (it->extension()->auto_enable() &&
    5227          20 :         !InstallExtension(isolate, it, extension_states)) {
    5228             :       return false;
    5229             :     }
    5230             :   }
    5231             :   return true;
    5232             : }
    5233             : 
    5234             : 
    5235       89496 : bool Genesis::InstallRequestedExtensions(Isolate* isolate,
    5236      180808 :                                          v8::ExtensionConfiguration* extensions,
    5237             :                                          ExtensionStates* extension_states) {
    5238      182624 :   for (const char** it = extensions->begin(); it != extensions->end(); ++it) {
    5239        1856 :     if (!InstallExtension(isolate, *it, extension_states)) return false;
    5240             :   }
    5241             :   return true;
    5242             : }
    5243             : 
    5244             : 
    5245             : // Installs a named extension.  This methods is unoptimized and does
    5246             : // not scale well if we want to support a large number of extensions.
    5247        4447 : bool Genesis::InstallExtension(Isolate* isolate,
    5248             :                                const char* name,
    5249             :                                ExtensionStates* extension_states) {
    5250       21098 :   for (v8::RegisteredExtension* it = v8::RegisteredExtension::first_extension();
    5251             :        it != nullptr; it = it->next()) {
    5252       21098 :     if (strcmp(name, it->extension()->name()) == 0) {
    5253        4447 :       return InstallExtension(isolate, it, extension_states);
    5254             :     }
    5255             :   }
    5256             :   return Utils::ApiCheck(false,
    5257             :                          "v8::Context::New()",
    5258           0 :                          "Cannot find required extension");
    5259             : }
    5260             : 
    5261             : 
    5262        4520 : bool Genesis::InstallExtension(Isolate* isolate,
    5263             :                                v8::RegisteredExtension* current,
    5264             :                                ExtensionStates* extension_states) {
    5265             :   HandleScope scope(isolate);
    5266             : 
    5267        4520 :   if (extension_states->get_state(current) == INSTALLED) return true;
    5268             :   // The current node has already been visited so there must be a
    5269             :   // cycle in the dependency graph; fail.
    5270        4464 :   if (!Utils::ApiCheck(extension_states->get_state(current) != VISITED,
    5271             :                        "v8::Context::New()",
    5272        4463 :                        "Circular extension dependency")) {
    5273             :     return false;
    5274             :   }
    5275             :   DCHECK(extension_states->get_state(current) == UNVISITED);
    5276        4459 :   extension_states->set_state(current, VISITED);
    5277        4661 :   v8::Extension* extension = current->extension();
    5278             :   // Install the extension's dependencies
    5279        9110 :   for (int i = 0; i < extension->dependency_count(); i++) {
    5280         106 :     if (!InstallExtension(isolate,
    5281         106 :                           extension->dependencies()[i],
    5282         106 :                           extension_states)) {
    5283             :       return false;
    5284             :     }
    5285             :   }
    5286             :   // We do not expect this to throw an exception. Change this if it does.
    5287        4449 :   bool result = CompileExtension(isolate, extension);
    5288             :   DCHECK(isolate->has_pending_exception() != result);
    5289        4448 :   if (!result) {
    5290             :     // We print out the name of the extension that fail to install.
    5291             :     // When an error is thrown during bootstrapping we automatically print
    5292             :     // the line number at which this happened to the console in the isolate
    5293             :     // error throwing functionality.
    5294             :     base::OS::PrintError("Error installing extension '%s'.\n",
    5295          35 :                          current->extension()->name());
    5296          35 :     isolate->clear_pending_exception();
    5297             :   }
    5298        4448 :   extension_states->set_state(current, INSTALLED);
    5299        4450 :   return result;
    5300             : }
    5301             : 
    5302             : 
    5303       89757 : bool Genesis::ConfigureGlobalObjects(
    5304      524628 :     v8::Local<v8::ObjectTemplate> global_proxy_template) {
    5305             :   Handle<JSObject> global_proxy(
    5306      179514 :       JSObject::cast(native_context()->global_proxy()), isolate());
    5307             :   Handle<JSObject> global_object(
    5308      179514 :       JSObject::cast(native_context()->global_object()), isolate());
    5309             : 
    5310       89757 :   if (!global_proxy_template.IsEmpty()) {
    5311             :     // Configure the global proxy object.
    5312             :     Handle<ObjectTemplateInfo> global_proxy_data =
    5313             :         v8::Utils::OpenHandle(*global_proxy_template);
    5314       55200 :     if (!ConfigureApiObject(global_proxy, global_proxy_data)) return false;
    5315             : 
    5316             :     // Configure the global object.
    5317             :     Handle<FunctionTemplateInfo> proxy_constructor(
    5318             :         FunctionTemplateInfo::cast(global_proxy_data->constructor()),
    5319             :         isolate());
    5320      110400 :     if (!proxy_constructor->GetPrototypeTemplate()->IsUndefined(isolate())) {
    5321             :       Handle<ObjectTemplateInfo> global_object_data(
    5322             :           ObjectTemplateInfo::cast(proxy_constructor->GetPrototypeTemplate()),
    5323      110400 :           isolate());
    5324       55200 :       if (!ConfigureApiObject(global_object, global_object_data)) return false;
    5325             :     }
    5326             :   }
    5327             : 
    5328       89757 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5329             : 
    5330      179514 :   native_context()->set_array_buffer_map(
    5331      269271 :       native_context()->array_buffer_fun()->initial_map());
    5332             : 
    5333      179514 :   Handle<JSFunction> js_map_fun(native_context()->js_map_fun(), isolate());
    5334      179514 :   Handle<JSFunction> js_set_fun(native_context()->js_set_fun(), isolate());
    5335             :   // Force the Map/Set constructor to fast properties, so that we can use the
    5336             :   // fast paths for various things like
    5337             :   //
    5338             :   //   x instanceof Map
    5339             :   //   x instanceof Set
    5340             :   //
    5341             :   // etc. We should probably come up with a more principled approach once
    5342             :   // the JavaScript builtins are gone.
    5343       89757 :   JSObject::MigrateSlowToFast(js_map_fun, 0, "Bootstrapping");
    5344       89757 :   JSObject::MigrateSlowToFast(js_set_fun, 0, "Bootstrapping");
    5345             : 
    5346      179514 :   native_context()->set_js_map_map(js_map_fun->initial_map());
    5347      179514 :   native_context()->set_js_set_map(js_set_fun->initial_map());
    5348             : 
    5349       89757 :   return true;
    5350             : }
    5351             : 
    5352             : 
    5353      110400 : bool Genesis::ConfigureApiObject(Handle<JSObject> object,
    5354           0 :                                  Handle<ObjectTemplateInfo> object_template) {
    5355             :   DCHECK(!object_template.is_null());
    5356             :   DCHECK(FunctionTemplateInfo::cast(object_template->constructor())
    5357             :              ->IsTemplateFor(object->map()));;
    5358             : 
    5359             :   MaybeHandle<JSObject> maybe_obj =
    5360      110400 :       ApiNatives::InstantiateObject(object->GetIsolate(), object_template);
    5361             :   Handle<JSObject> instantiated_template;
    5362      110400 :   if (!maybe_obj.ToHandle(&instantiated_template)) {
    5363             :     DCHECK(isolate()->has_pending_exception());
    5364           0 :     isolate()->clear_pending_exception();
    5365           0 :     return false;
    5366             :   }
    5367      110400 :   TransferObject(instantiated_template, object);
    5368      110400 :   return true;
    5369             : }
    5370             : 
    5371     5770233 : static bool PropertyAlreadyExists(Isolate* isolate, Handle<JSObject> to,
    5372             :                                   Handle<Name> key) {
    5373     5770233 :   LookupIterator it(isolate, to, key, LookupIterator::OWN_SKIP_INTERCEPTOR);
    5374     5770231 :   CHECK_NE(LookupIterator::ACCESS_CHECK, it.state());
    5375     5770231 :   return it.IsFound();
    5376             : }
    5377             : 
    5378      200046 : void Genesis::TransferNamedProperties(Handle<JSObject> from,
    5379    33232372 :                                       Handle<JSObject> to) {
    5380             :   // If JSObject::AddProperty asserts due to already existing property,
    5381             :   // it is likely due to both global objects sharing property name(s).
    5382             :   // Merging those two global objects is impossible.
    5383             :   // The global template must not create properties that already exist
    5384             :   // in the snapshotted global object.
    5385      200046 :   if (from->HasFastProperties()) {
    5386             :     Handle<DescriptorArray> descs =
    5387      220800 :         Handle<DescriptorArray>(from->map()->instance_descriptors(), isolate());
    5388     1899510 :     for (int i = 0; i < from->map()->NumberOfOwnDescriptors(); i++) {
    5389      839355 :       PropertyDetails details = descs->GetDetails(i);
    5390      839355 :       if (details.location() == kField) {
    5391      839191 :         if (details.kind() == kData) {
    5392             :           HandleScope inner(isolate());
    5393     1678382 :           Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
    5394             :           // If the property is already there we skip it.
    5395      839191 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5396      839186 :           FieldIndex index = FieldIndex::ForDescriptor(from->map(), i);
    5397             :           Handle<Object> value =
    5398      839186 :               JSObject::FastPropertyAt(from, details.representation(), index);
    5399             :           JSObject::AddProperty(isolate(), to, key, value,
    5400      839186 :                                 details.attributes());
    5401             :         } else {
    5402             :           DCHECK_EQ(kAccessor, details.kind());
    5403           0 :           UNREACHABLE();
    5404             :         }
    5405             : 
    5406             :       } else {
    5407             :         DCHECK_EQ(kDescriptor, details.location());
    5408         164 :         if (details.kind() == kData) {
    5409             :           DCHECK(!FLAG_track_constant_fields);
    5410             :           HandleScope inner(isolate());
    5411           0 :           Handle<Name> key = Handle<Name>(descs->GetKey(i), isolate());
    5412             :           // If the property is already there we skip it.
    5413           0 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5414           0 :           Handle<Object> value(descs->GetStrongValue(i), isolate());
    5415             :           JSObject::AddProperty(isolate(), to, key, value,
    5416           0 :                                 details.attributes());
    5417             :         } else {
    5418             :           DCHECK_EQ(kAccessor, details.kind());
    5419         328 :           Handle<Name> key(descs->GetKey(i), isolate());
    5420             :           // If the property is already there we skip it.
    5421         164 :           if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5422             :           HandleScope inner(isolate());
    5423             :           DCHECK(!to->HasFastProperties());
    5424             :           // Add to dictionary.
    5425         328 :           Handle<Object> value(descs->GetStrongValue(i), isolate());
    5426             :           PropertyDetails d(kAccessor, details.attributes(),
    5427             :                             PropertyCellType::kMutable);
    5428         164 :           JSObject::SetNormalizedProperty(to, key, value, d);
    5429             :         }
    5430             :       }
    5431             :     }
    5432      179292 :   } else if (from->IsJSGlobalObject()) {
    5433             :     // Copy all keys and values in enumeration order.
    5434             :     Handle<GlobalDictionary> properties(
    5435      179292 :         JSGlobalObject::cast(*from)->global_dictionary(), isolate());
    5436             :     Handle<FixedArray> indices =
    5437       89646 :         GlobalDictionary::IterationIndices(isolate(), properties);
    5438    10041048 :     for (int i = 0; i < indices->length(); i++) {
    5439     4930878 :       int index = Smi::ToInt(indices->get(i));
    5440     9861755 :       Handle<PropertyCell> cell(properties->CellAt(index), isolate());
    5441     9861754 :       Handle<Name> key(cell->name(), isolate());
    5442             :       // If the property is already there we skip it.
    5443     4930877 :       if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5444             :       // Set the property.
    5445             :       Handle<Object> value(cell->value(), isolate());
    5446     9861755 :       if (value->IsTheHole(isolate())) continue;
    5447     4930878 :       PropertyDetails details = cell->property_details();
    5448     4930879 :       if (details.kind() != kData) continue;
    5449     4930879 :       JSObject::AddProperty(isolate(), to, key, value, details.attributes());
    5450             :     }
    5451             :   } else {
    5452             :     // Copy all keys and values in enumeration order.
    5453             :     Handle<NameDictionary> properties =
    5454           0 :         Handle<NameDictionary>(from->property_dictionary(), isolate());
    5455             :     Handle<FixedArray> key_indices =
    5456           0 :         NameDictionary::IterationIndices(isolate(), properties);
    5457             :     ReadOnlyRoots roots(isolate());
    5458           0 :     for (int i = 0; i < key_indices->length(); i++) {
    5459           0 :       int key_index = Smi::ToInt(key_indices->get(i));
    5460           0 :       Object raw_key = properties->KeyAt(key_index);
    5461             :       DCHECK(properties->IsKey(roots, raw_key));
    5462             :       DCHECK(raw_key->IsName());
    5463             :       Handle<Name> key(Name::cast(raw_key), isolate());
    5464             :       // If the property is already there we skip it.
    5465           0 :       if (PropertyAlreadyExists(isolate(), to, key)) continue;
    5466             :       // Set the property.
    5467             :       Handle<Object> value =
    5468           0 :           Handle<Object>(properties->ValueAt(key_index), isolate());
    5469             :       DCHECK(!value->IsCell());
    5470             :       DCHECK(!value->IsTheHole(isolate()));
    5471           0 :       PropertyDetails details = properties->DetailsAt(key_index);
    5472             :       DCHECK_EQ(kData, details.kind());
    5473           0 :       JSObject::AddProperty(isolate(), to, key, value, details.attributes());
    5474             :     }
    5475             :   }
    5476      200046 : }
    5477             : 
    5478             : 
    5479      200046 : void Genesis::TransferIndexedProperties(Handle<JSObject> from,
    5480      400092 :                                         Handle<JSObject> to) {
    5481             :   // Cloning the elements array is sufficient.
    5482             :   Handle<FixedArray> from_elements =
    5483      400092 :       Handle<FixedArray>(FixedArray::cast(from->elements()), isolate());
    5484      200046 :   Handle<FixedArray> to_elements = factory()->CopyFixedArray(from_elements);
    5485      400092 :   to->set_elements(*to_elements);
    5486      200046 : }
    5487             : 
    5488             : 
    5489      220800 : void Genesis::TransferObject(Handle<JSObject> from, Handle<JSObject> to) {
    5490             :   HandleScope outer(isolate());
    5491             : 
    5492             :   DCHECK(!from->IsJSArray());
    5493             :   DCHECK(!to->IsJSArray());
    5494             : 
    5495      110400 :   TransferNamedProperties(from, to);
    5496      110400 :   TransferIndexedProperties(from, to);
    5497             : 
    5498             :   // Transfer the prototype (new map is needed).
    5499             :   Handle<Object> proto(from->map()->prototype(), isolate());
    5500      110400 :   JSObject::ForceSetPrototype(to, proto);
    5501      110400 : }
    5502             : 
    5503       89797 : Genesis::Genesis(
    5504      448985 :     Isolate* isolate, MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5505             :     v8::Local<v8::ObjectTemplate> global_proxy_template,
    5506             :     size_t context_snapshot_index,
    5507             :     v8::DeserializeEmbedderFieldsCallback embedder_fields_deserializer)
    5508       89797 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5509       89797 :   RuntimeCallTimerScope rcs_timer(isolate, RuntimeCallCounterId::kGenesis);
    5510       89797 :   result_ = Handle<Context>::null();
    5511       89797 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5512             : 
    5513             :   // Before creating the roots we must save the context and restore it
    5514             :   // on all function exits.
    5515      179594 :   SaveContext saved_context(isolate);
    5516             : 
    5517             :   // The deserializer needs to hook up references to the global proxy.
    5518             :   // Create an uninitialized global proxy now if we don't have one
    5519             :   // and initialize it later in CreateNewGlobals.
    5520             :   Handle<JSGlobalProxy> global_proxy;
    5521       89797 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5522             :     int instance_size = 0;
    5523       89728 :     if (context_snapshot_index > 0) {
    5524             :       // The global proxy function to reinitialize this global proxy is in the
    5525             :       // context that is yet to be deserialized. We need to prepare a global
    5526             :       // proxy of the correct size.
    5527          35 :       Object size = isolate->heap()->serialized_global_proxy_sizes()->get(
    5528         105 :           static_cast<int>(context_snapshot_index) - 1);
    5529          35 :       instance_size = Smi::ToInt(size);
    5530             :     } else {
    5531             :       instance_size = JSGlobalProxy::SizeWithEmbedderFields(
    5532             :           global_proxy_template.IsEmpty()
    5533             :               ? 0
    5534       89693 :               : global_proxy_template->InternalFieldCount());
    5535             :     }
    5536             :     global_proxy =
    5537       89728 :         isolate->factory()->NewUninitializedJSGlobalProxy(instance_size);
    5538             :   }
    5539             : 
    5540             :   // We can only de-serialize a context if the isolate was initialized from
    5541             :   // a snapshot. Otherwise we have to build the context from scratch.
    5542             :   // Also create a context from scratch to expose natives, if required by flag.
    5543             :   DCHECK(native_context_.is_null());
    5544       89797 :   if (isolate->initialized_from_snapshot()) {
    5545             :     Handle<Context> context;
    5546       89731 :     if (Snapshot::NewContextFromSnapshot(isolate, global_proxy,
    5547             :                                          context_snapshot_index,
    5548             :                                          embedder_fields_deserializer)
    5549      179462 :             .ToHandle(&context)) {
    5550       89686 :       native_context_ = Handle<NativeContext>::cast(context);
    5551             :     }
    5552             :   }
    5553             : 
    5554       89797 :   if (!native_context().is_null()) {
    5555       89686 :     AddToWeakNativeContextList(isolate, *native_context());
    5556             :     isolate->set_context(*native_context());
    5557       89686 :     isolate->counters()->contexts_created_by_snapshot()->Increment();
    5558             : 
    5559       89686 :     if (context_snapshot_index == 0) {
    5560             :       Handle<JSGlobalObject> global_object =
    5561       89646 :           CreateNewGlobals(global_proxy_template, global_proxy);
    5562       89646 :       HookUpGlobalObject(global_object);
    5563             : 
    5564       89646 :       if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5565             :     } else {
    5566             :       // The global proxy needs to be integrated into the native context.
    5567          40 :       HookUpGlobalProxy(global_proxy);
    5568             :     }
    5569             :     DCHECK(!global_proxy->IsDetachedFrom(native_context()->global_object()));
    5570             :   } else {
    5571             :     base::ElapsedTimer timer;
    5572         111 :     if (FLAG_profile_deserialization) timer.Start();
    5573             :     DCHECK_EQ(0u, context_snapshot_index);
    5574             :     // We get here if there was no context snapshot.
    5575         111 :     CreateRoots();
    5576         111 :     MathRandom::InitializeContext(isolate, native_context());
    5577         111 :     Handle<JSFunction> empty_function = CreateEmptyFunction();
    5578         111 :     CreateSloppyModeFunctionMaps(empty_function);
    5579         111 :     CreateStrictModeFunctionMaps(empty_function);
    5580         111 :     CreateObjectFunction(empty_function);
    5581         111 :     CreateIteratorMaps(empty_function);
    5582         111 :     CreateAsyncIteratorMaps(empty_function);
    5583         111 :     CreateAsyncFunctionMaps(empty_function);
    5584             :     Handle<JSGlobalObject> global_object =
    5585         111 :         CreateNewGlobals(global_proxy_template, global_proxy);
    5586         111 :     InitializeGlobal(global_object, empty_function);
    5587         111 :     InitializeNormalizedMapCaches();
    5588         111 :     InitializeIteratorFunctions();
    5589         111 :     InitializeCallSiteBuiltins();
    5590             : 
    5591         111 :     if (!InstallNatives()) return;
    5592         111 :     if (!InstallExtraNatives()) return;
    5593         111 :     if (!ConfigureGlobalObjects(global_proxy_template)) return;
    5594             : 
    5595         111 :     isolate->counters()->contexts_created_from_scratch()->Increment();
    5596             : 
    5597         111 :     if (FLAG_profile_deserialization) {
    5598           0 :       double ms = timer.Elapsed().InMillisecondsF();
    5599           0 :       PrintF("[Initializing context from scratch took %0.3f ms]\n", ms);
    5600             :     }
    5601             :   }
    5602             : 
    5603             :   native_context()->set_microtask_queue(isolate->default_microtask_queue());
    5604             : 
    5605             :   // Install experimental natives. Do not include them into the
    5606             :   // snapshot as we should be able to turn them off at runtime. Re-installing
    5607             :   // them after they have already been deserialized would also fail.
    5608       89797 :     if (!isolate->serializer_enabled()) {
    5609       89496 :       InitializeExperimentalGlobal();
    5610             : 
    5611             :       // Store String.prototype's map again in case it has been changed by
    5612             :       // experimental natives.
    5613      178992 :       Handle<JSFunction> string_function(native_context()->string_function(),
    5614       89496 :                                          isolate);
    5615             :       JSObject string_function_prototype =
    5616      178992 :           JSObject::cast(string_function->initial_map()->prototype());
    5617             :       DCHECK(string_function_prototype->HasFastProperties());
    5618      178992 :       native_context()->set_string_function_prototype_map(
    5619       89496 :           string_function_prototype->map());
    5620             :     }
    5621             : 
    5622       89797 :   if (FLAG_disallow_code_generation_from_strings) {
    5623          18 :     native_context()->set_allow_code_gen_from_strings(
    5624          27 :         ReadOnlyRoots(isolate).false_value());
    5625             :   }
    5626             : 
    5627       89797 :   ConfigureUtilsObject();
    5628             : 
    5629             :   // We created new functions, which may require debug instrumentation.
    5630       89797 :   if (isolate->debug()->is_active()) {
    5631         145 :     isolate->debug()->InstallDebugBreakTrampoline();
    5632             :   }
    5633             : 
    5634       89797 :   native_context()->ResetErrorsThrown();
    5635       89797 :   result_ = native_context();
    5636             : }
    5637             : 
    5638          36 : Genesis::Genesis(Isolate* isolate,
    5639             :                  MaybeHandle<JSGlobalProxy> maybe_global_proxy,
    5640          31 :                  v8::Local<v8::ObjectTemplate> global_proxy_template)
    5641          18 :     : isolate_(isolate), active_(isolate->bootstrapper()) {
    5642          18 :   result_ = Handle<Context>::null();
    5643          18 :   global_proxy_ = Handle<JSGlobalProxy>::null();
    5644             : 
    5645             :   // Before creating the roots we must save the context and restore it
    5646             :   // on all function exits.
    5647          18 :   SaveContext saved_context(isolate);
    5648             : 
    5649             :   const int proxy_size = JSGlobalProxy::SizeWithEmbedderFields(
    5650          18 :       global_proxy_template->InternalFieldCount());
    5651             : 
    5652             :   Handle<JSGlobalProxy> global_proxy;
    5653          18 :   if (!maybe_global_proxy.ToHandle(&global_proxy)) {
    5654          13 :     global_proxy = factory()->NewUninitializedJSGlobalProxy(proxy_size);
    5655             :   }
    5656             : 
    5657             :   // Create a remote object as the global object.
    5658             :   Handle<ObjectTemplateInfo> global_proxy_data =
    5659             :       Utils::OpenHandle(*global_proxy_template);
    5660             :   Handle<FunctionTemplateInfo> global_constructor(
    5661             :       FunctionTemplateInfo::cast(global_proxy_data->constructor()), isolate);
    5662             : 
    5663             :   Handle<ObjectTemplateInfo> global_object_template(
    5664             :       ObjectTemplateInfo::cast(global_constructor->GetPrototypeTemplate()),
    5665          36 :       isolate);
    5666             :   Handle<JSObject> global_object =
    5667             :       ApiNatives::InstantiateRemoteObject(
    5668          36 :           global_object_template).ToHandleChecked();
    5669             : 
    5670             :   // (Re)initialize the global proxy object.
    5671             :   DCHECK_EQ(global_proxy_data->embedder_field_count(),
    5672             :             global_proxy_template->InternalFieldCount());
    5673             :   Handle<Map> global_proxy_map = isolate->factory()->NewMap(
    5674          18 :       JS_GLOBAL_PROXY_TYPE, proxy_size, TERMINAL_FAST_ELEMENTS_KIND);
    5675             :   global_proxy_map->set_is_access_check_needed(true);
    5676          18 :   global_proxy_map->set_has_hidden_prototype(true);
    5677          18 :   global_proxy_map->set_may_have_interesting_symbols(true);
    5678             : 
    5679             :   // A remote global proxy has no native context.
    5680          54 :   global_proxy->set_native_context(ReadOnlyRoots(heap()).null_value());
    5681             : 
    5682             :   // Configure the hidden prototype chain of the global proxy.
    5683          18 :   JSObject::ForceSetPrototype(global_proxy, global_object);
    5684          36 :   global_proxy->map()->SetConstructor(*global_constructor);
    5685             :   // TODO(dcheng): This is a hack. Why does this need to be manually called
    5686             :   // here? Line 4812 should have taken care of it?
    5687          18 :   global_proxy->map()->set_has_hidden_prototype(true);
    5688             : 
    5689          18 :   global_proxy_ = global_proxy;
    5690          18 : }
    5691             : 
    5692             : // Support for thread preemption.
    5693             : 
    5694             : // Reserve space for statics needing saving and restoring.
    5695        1144 : int Bootstrapper::ArchiveSpacePerThread() {
    5696        1144 :   return sizeof(NestingCounterType);
    5697             : }
    5698             : 
    5699             : 
    5700             : // Archive statics that are thread-local.
    5701       23397 : char* Bootstrapper::ArchiveState(char* to) {
    5702       23397 :   *reinterpret_cast<NestingCounterType*>(to) = nesting_;
    5703       23397 :   nesting_ = 0;
    5704       23397 :   return to + sizeof(NestingCounterType);
    5705             : }
    5706             : 
    5707             : 
    5708             : // Restore statics that are thread-local.
    5709       23397 : char* Bootstrapper::RestoreState(char* from) {
    5710       23397 :   nesting_ = *reinterpret_cast<NestingCounterType*>(from);
    5711       23397 :   return from + sizeof(NestingCounterType);
    5712             : }
    5713             : 
    5714             : 
    5715             : // Called when the top-level V8 mutex is destroyed.
    5716        5906 : void Bootstrapper::FreeThreadResources() {
    5717             :   DCHECK(!IsActive());
    5718        5906 : }
    5719             : 
    5720             : }  // namespace internal
    5721      178779 : }  // namespace v8

Generated by: LCOV version 1.10