Source/JavaScriptCore/runtime/JSGlobalObject.cpp

   1 /*
   2  * Copyright (C) 2007-2009, 2014-2016 Apple Inc. All rights reserved.
   3  * Copyright (C) 2008 Cameron Zwarich (cwzwarich@uwaterloo.ca)
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1.  Redistributions of source code must retain the above copyright
  10  *     notice, this list of conditions and the following disclaimer.
  11  * 2.  Redistributions in binary form must reproduce the above copyright
  12  *     notice, this list of conditions and the following disclaimer in the
  13  *     documentation and/or other materials provided with the distribution.
  14  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  15  *     its contributors may be used to endorse or promote products derived
  16  *     from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  19  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  20  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  21  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  22  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  23  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  24  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #include "config.h"
  31 #include "JSGlobalObject.h"
  32
  33 #include "ArrayConstructor.h"
  34 #include "ArrayIteratorPrototype.h"
  35 #include "ArrayPrototype.h"
  36 #include "BooleanConstructor.h"
  37 #include "BooleanPrototype.h"
  38 #include "BuiltinNames.h"
  39 #include "ClonedArguments.h"
  40 #include "CodeBlock.h"
  41 #include "CodeCache.h"
  42 #include "ConsoleObject.h"
  43 #include "DateConstructor.h"
  44 #include "DatePrototype.h"
  45 #include "Debugger.h"
  46 #include "DebuggerScope.h"
  47 #include "DirectArguments.h"
  48 #include "ECMAScriptSpecInternalFunctions.h"
  49 #include "Error.h"
  50 #include "ErrorConstructor.h"
  51 #include "ErrorPrototype.h"
  52 #include "FunctionConstructor.h"
  53 #include "FunctionPrototype.h"
  54 #include "GeneratorFunctionConstructor.h"
  55 #include "GeneratorFunctionPrototype.h"
  56 #include "GeneratorPrototype.h"
  57 #include "GetterSetter.h"
  58 #include "HeapIterationScope.h"
  59 #include "InspectorInstrumentationObject.h"
  60 #include "Interpreter.h"
  61 #include "IteratorPrototype.h"
  62 #include "JSAPIWrapperObject.h"
  63 #include "JSArrayBuffer.h"
  64 #include "JSArrayBufferConstructor.h"
  65 #include "JSArrayBufferPrototype.h"
  66 #include "JSArrayIterator.h"
  67 #include "JSBoundFunction.h"
  68 #include "JSBoundSlotBaseFunction.h"
  69 #include "JSCInlines.h"
  70 #include "JSCallbackConstructor.h"
  71 #include "JSCallbackFunction.h"
  72 #include "JSCallbackObject.h"
  73 #include "JSDataView.h"
  74 #include "JSDataViewPrototype.h"
  75 #include "JSDollarVM.h"
  76 #include "JSDollarVMPrototype.h"
  77 #include "JSFunction.h"
  78 #include "JSGeneratorFunction.h"
  79 #include "JSGenericTypedArrayViewConstructorInlines.h"
  80 #include "JSGenericTypedArrayViewInlines.h"
  81 #include "JSGenericTypedArrayViewPrototypeInlines.h"
  82 #include "JSGlobalObjectFunctions.h"
  83 #include "JSInternalPromise.h"
  84 #include "JSInternalPromiseConstructor.h"
  85 #include "JSInternalPromisePrototype.h"
  86 #include "JSJob.h"
  87 #include "JSLexicalEnvironment.h"
  88 #include "JSLock.h"
  89 #include "JSMap.h"
  90 #include "JSMapIterator.h"
  91 #include "JSModuleEnvironment.h"
  92 #include "JSModuleNamespaceObject.h"
  93 #include "JSModuleRecord.h"
  94 #include "JSNativeStdFunction.h"
  95 #include "JSONObject.h"
  96 #include "JSPromise.h"
  97 #include "JSPromiseConstructor.h"
  98 #include "JSPromisePrototype.h"
  99 #include "JSPropertyNameIterator.h"
 100 #include "JSSet.h"
 101 #include "JSSetIterator.h"
 102 #include "JSStringIterator.h"
 103 #include "JSTemplateRegistryKey.h"
 104 #include "JSTypedArrayConstructors.h"
 105 #include "JSTypedArrayPrototypes.h"
 106 #include "JSTypedArrayViewConstructor.h"
 107 #include "JSTypedArrayViewPrototype.h"
 108 #include "JSTypedArrays.h"
 109 #include "JSWASMModule.h"
 110 #include "JSWeakMap.h"
 111 #include "JSWeakSet.h"
 112 #include "JSWithScope.h"
 113 #include "LegacyProfiler.h"
 114 #include "Lookup.h"
 115 #include "MapConstructor.h"
 116 #include "MapIteratorPrototype.h"
 117 #include "MapPrototype.h"
 118 #include "MathObject.h"
 119 #include "Microtask.h"
 120 #include "ModuleLoaderObject.h"
 121 #include "NativeErrorConstructor.h"
 122 #include "NativeErrorPrototype.h"
 123 #include "NullGetterFunction.h"
 124 #include "NullSetterFunction.h"
 125 #include "NumberConstructor.h"
 126 #include "NumberPrototype.h"
 127 #include "ObjCCallbackFunction.h"
 128 #include "ObjectConstructor.h"
 129 #include "ObjectPrototype.h"
 130 #include "ParserError.h"
 131 #include "ProxyConstructor.h"
 132 #include "ProxyObject.h"
 133 #include "ProxyRevoke.h"
 134 #include "ReflectObject.h"
 135 #include "RegExpConstructor.h"
 136 #include "RegExpMatchesArray.h"
 137 #include "RegExpObject.h"
 138 #include "RegExpPrototype.h"
 139 #include "ScopedArguments.h"
 140 #include "SetConstructor.h"
 141 #include "SetIteratorPrototype.h"
 142 #include "SetPrototype.h"
 143 #include "StrictEvalActivation.h"
 144 #include "StringConstructor.h"
 145 #include "StringIteratorPrototype.h"
 146 #include "StringPrototype.h"
 147 #include "Symbol.h"
 148 #include "SymbolConstructor.h"
 149 #include "SymbolPrototype.h"
 150 #include "VariableWriteFireDetail.h"
 151 #include "WeakGCMapInlines.h"
 152 #include "WeakMapConstructor.h"
 153 #include "WeakMapPrototype.h"
 154 #include "WeakSetConstructor.h"
 155 #include "WeakSetPrototype.h"
 156 #include <wtf/RandomNumber.h>
 157
 158 #if ENABLE(INTL)
 159 #include "IntlObject.h"
 160 #include <unicode/ucol.h>
 161 #include <unicode/udat.h>
 162 #include <unicode/unum.h>
 163 #endif // ENABLE(INTL)
 164
 165 #if ENABLE(REMOTE_INSPECTOR)
 166 #include "JSGlobalObjectDebuggable.h"
 167 #include "JSGlobalObjectInspectorController.h"
 168 #endif
 169
 170 #if ENABLE(WEB_REPLAY)
 171 #include "EmptyInputCursor.h"
 172 #include "JSReplayInputs.h"
 173 #endif
 174
 175 #include "JSGlobalObject.lut.h"
 176
 177 namespace JSC {
 178
 179 const ClassInfo JSGlobalObject::s_info = { "GlobalObject", &Base::s_info, &globalObjectTable, CREATE_METHOD_TABLE(JSGlobalObject) };
 180
 181 const GlobalObjectMethodTable JSGlobalObject::s_globalObjectMethodTable = { &allowsAccessFrom, &supportsLegacyProfiling, &supportsRichSourceInfo, &shouldInterruptScript, &javaScriptRuntimeFlags, nullptr, &shouldInterruptScriptBeforeTimeout, nullptr, nullptr, nullptr, nullptr, nullptr, nullptr };
 182
 183 /* Source for JSGlobalObject.lut.h
 184 @begin globalObjectTable
 185   parseFloat            globalFuncParseFloat            DontEnum|Function 1
 186   isNaN                 globalFuncIsNaN                 DontEnum|Function 1
 187   isFinite              globalFuncIsFinite              DontEnum|Function 1
 188   escape                globalFuncEscape                DontEnum|Function 1
 189   unescape              globalFuncUnescape              DontEnum|Function 1
 190   decodeURI             globalFuncDecodeURI             DontEnum|Function 1
 191   decodeURIComponent    globalFuncDecodeURIComponent    DontEnum|Function 1
 192   encodeURI             globalFuncEncodeURI             DontEnum|Function 1
 193   encodeURIComponent    globalFuncEncodeURIComponent    DontEnum|Function 1
 194 @end
 195 */
 196
 197 static EncodedJSValue JSC_HOST_CALL getTemplateObject(ExecState* exec)
 198 {
 199     JSValue thisValue = exec->thisValue();
 200     ASSERT(thisValue.inherits(JSTemplateRegistryKey::info()));
 201     return JSValue::encode(exec->lexicalGlobalObject()->templateRegistry().getTemplateObject(exec, jsCast<JSTemplateRegistryKey*>(thisValue)->templateRegistryKey()));
 202 }
 203
 204
 205 static EncodedJSValue JSC_HOST_CALL enqueueJob(ExecState* exec)
 206 {
 207     VM& vm = exec->vm();
 208     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
 209
 210     JSValue job = exec->argument(0);
 211     JSValue arguments = exec->argument(1);
 212     ASSERT(arguments.inherits(JSArray::info()));
 213
 214     globalObject->queueMicrotask(createJSJob(vm, job, jsCast<JSArray*>(arguments)));
 215
 216     return JSValue::encode(jsUndefined());
 217 }
 218
 219 JSGlobalObject::JSGlobalObject(VM& vm, Structure* structure, const GlobalObjectMethodTable* globalObjectMethodTable)
 220     : Base(vm, structure, 0)
 221     , m_vm(vm)
 222 #if ENABLE(WEB_REPLAY)
 223     , m_inputCursor(EmptyInputCursor::create())
 224 #endif
 225     , m_masqueradesAsUndefinedWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
 226     , m_havingABadTimeWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
 227     , m_varInjectionWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
 228     , m_weakRandom(Options::forceWeakRandomSeed() ? Options::forcedWeakRandomSeed() : static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
 229     , m_templateRegistry(vm)
 230     , m_evalEnabled(true)
 231     , m_runtimeFlags()
 232     , m_consoleClient(nullptr)
 233     , m_globalObjectMethodTable(globalObjectMethodTable ? globalObjectMethodTable : &s_globalObjectMethodTable)
 234 {
 235 }
 236
 237 JSGlobalObject::~JSGlobalObject()
 238 {
 239 #if ENABLE(REMOTE_INSPECTOR)
 240     m_inspectorController->globalObjectDestroyed();
 241 #endif
 242
 243     if (m_debugger)
 244         m_debugger->detach(this, Debugger::GlobalObjectIsDestructing);
 245
 246     if (LegacyProfiler* profiler = vm().enabledProfiler())
 247         profiler->stopProfiling(this);
 248 }
 249
 250 void JSGlobalObject::destroy(JSCell* cell)
 251 {
 252     static_cast<JSGlobalObject*>(cell)->JSGlobalObject::~JSGlobalObject();
 253 }
 254
 255 void JSGlobalObject::setGlobalThis(VM& vm, JSObject* globalThis)
 256 {
 257     m_globalThis.set(vm, this, globalThis);
 258 }
 259
 260 static JSObject* getGetterById(ExecState* exec, JSObject* base, const Identifier& ident)
 261 {
 262     JSValue baseValue = JSValue(base);
 263     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
 264     baseValue.getPropertySlot(exec, ident, slot);
 265     return slot.getPureResult().toObject(exec);
 266 }
 267
 268 void JSGlobalObject::init(VM& vm)
 269 {
 270     ASSERT(vm.currentThreadIsHoldingAPILock());
 271
 272     JSGlobalObject::globalExec()->init(0, 0, CallFrame::noCaller(), 0, 0);
 273
 274     m_debugger = 0;
 275
 276 #if ENABLE(REMOTE_INSPECTOR)
 277     m_inspectorController = std::make_unique<Inspector::JSGlobalObjectInspectorController>(*this);
 278     m_inspectorDebuggable = std::make_unique<JSGlobalObjectDebuggable>(*this);
 279     m_inspectorDebuggable->init();
 280     m_consoleClient = m_inspectorController->consoleClient();
 281 #endif
 282
 283     ExecState* exec = JSGlobalObject::globalExec();
 284
 285     m_functionPrototype.set(vm, this, FunctionPrototype::create(vm, FunctionPrototype::createStructure(vm, this, jsNull()))); // The real prototype will be set once ObjectPrototype is created.
 286     m_calleeStructure.set(vm, this, JSCallee::createStructure(vm, this, jsNull()));
 287
 288     m_globalLexicalEnvironment.set(vm, this, JSGlobalLexicalEnvironment::create(vm, JSGlobalLexicalEnvironment::createStructure(vm, this), this));
 289     // Need to create the callee structure (above) before creating the callee.
 290     m_globalCallee.set(vm, this, JSCallee::create(vm, this, globalScope()));
 291     exec->setCallee(m_globalCallee.get());
 292
 293     m_functionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
 294     m_boundSlotBaseFunctionStructure.set(vm, this, JSBoundSlotBaseFunction::createStructure(vm, this, m_functionPrototype.get()));
 295     m_boundFunctionStructure.set(vm, this, JSBoundFunction::createStructure(vm, this, m_functionPrototype.get()));
 296     m_getterSetterStructure.set(vm, this, GetterSetter::createStructure(vm, this, jsNull()));
 297     m_nativeStdFunctionStructure.set(vm, this, JSNativeStdFunction::createStructure(vm, this, m_functionPrototype.get()));
 298     m_namedFunctionStructure.set(vm, this, Structure::addPropertyTransition(vm, m_functionStructure.get(), vm.propertyNames->name, DontDelete | ReadOnly | DontEnum, m_functionNameOffset));
 299     m_internalFunctionStructure.set(vm, this, InternalFunction::createStructure(vm, this, m_functionPrototype.get()));
 300     JSFunction* callFunction = 0;
 301     JSFunction* applyFunction = 0;
 302     JSFunction* hasInstanceSymbolFunction = 0;
 303     m_functionPrototype->addFunctionProperties(exec, this, &callFunction, &applyFunction, &hasInstanceSymbolFunction);
 304     m_callFunction.set(vm, this, callFunction);
 305     m_applyFunction.set(vm, this, applyFunction);
 306     m_arrayProtoValuesFunction.set(vm, this, JSFunction::create(vm, this, 0, vm.propertyNames->values.string(), arrayProtoFuncValues));
 307     m_initializePromiseFunction.set(vm, this, JSFunction::createBuiltinFunction(vm, promiseOperationsInitializePromiseCodeGenerator(vm), this));
 308     m_newPromiseCapabilityFunction.set(vm, this, JSFunction::createBuiltinFunction(vm, promiseOperationsNewPromiseCapabilityCodeGenerator(vm), this));
 309     m_functionProtoHasInstanceSymbolFunction.set(vm, this, hasInstanceSymbolFunction);
 310     m_nullGetterFunction.set(vm, this, NullGetterFunction::create(vm, NullGetterFunction::createStructure(vm, this, m_functionPrototype.get())));
 311     m_nullSetterFunction.set(vm, this, NullSetterFunction::create(vm, NullSetterFunction::createStructure(vm, this, m_functionPrototype.get())));
 312     m_objectPrototype.set(vm, this, ObjectPrototype::create(vm, this, ObjectPrototype::createStructure(vm, this, jsNull())));
 313     GetterSetter* protoAccessor = GetterSetter::create(vm, this);
 314     protoAccessor->setGetter(vm, this, JSFunction::create(vm, this, 0, makeString("get ", vm.propertyNames->underscoreProto.string()), globalFuncProtoGetter));
 315     protoAccessor->setSetter(vm, this, JSFunction::create(vm, this, 0, makeString("set ", vm.propertyNames->underscoreProto.string()), globalFuncProtoSetter));
 316     m_objectPrototype->putDirectNonIndexAccessor(vm, vm.propertyNames->underscoreProto, protoAccessor, Accessor | DontEnum);
 317     m_functionPrototype->structure()->setPrototypeWithoutTransition(vm, m_objectPrototype.get());
 318
 319     JSTypedArrayViewPrototype* typedArrayProto = JSTypedArrayViewPrototype::create(vm, this, JSTypedArrayViewPrototype::createStructure(vm, this, m_objectPrototype.get()));
 320
 321     m_typedArrays[toIndex(TypeInt8)].prototype.set(vm, this, JSInt8ArrayPrototype::create(vm, this, JSInt8ArrayPrototype::createStructure(vm, this, typedArrayProto)));
 322     m_typedArrays[toIndex(TypeInt16)].prototype.set(vm, this, JSInt16ArrayPrototype::create(vm, this, JSInt16ArrayPrototype::createStructure(vm, this, typedArrayProto)));
 323     m_typedArrays[toIndex(TypeInt32)].prototype.set(vm, this, JSInt32ArrayPrototype::create(vm, this, JSInt32ArrayPrototype::createStructure(vm, this, typedArrayProto)));
 324     m_typedArrays[toIndex(TypeUint8)].prototype.set(vm, this, JSUint8ArrayPrototype::create(vm, this, JSUint8ArrayPrototype::createStructure(vm, this, typedArrayProto)));
 325     m_typedArrays[toIndex(TypeUint8Clamped)].prototype.set(vm, this, JSUint8ClampedArrayPrototype::create(vm, this, JSUint8ClampedArrayPrototype::createStructure(vm, this, typedArrayProto)));
 326     m_typedArrays[toIndex(TypeUint16)].prototype.set(vm, this, JSUint16ArrayPrototype::create(vm, this, JSUint16ArrayPrototype::createStructure(vm, this, typedArrayProto)));
 327     m_typedArrays[toIndex(TypeUint32)].prototype.set(vm, this, JSUint32ArrayPrototype::create(vm, this, JSUint32ArrayPrototype::createStructure(vm, this, typedArrayProto)));
 328     m_typedArrays[toIndex(TypeFloat32)].prototype.set(vm, this, JSFloat32ArrayPrototype::create(vm, this, JSFloat32ArrayPrototype::createStructure(vm, this, typedArrayProto)));
 329     m_typedArrays[toIndex(TypeFloat64)].prototype.set(vm, this, JSFloat64ArrayPrototype::create(vm, this, JSFloat64ArrayPrototype::createStructure(vm, this, typedArrayProto)));
 330     m_typedArrays[toIndex(TypeDataView)].prototype.set(vm, this, JSDataViewPrototype::create(vm, JSDataViewPrototype::createStructure(vm, this, m_objectPrototype.get())));
 331
 332     m_typedArrays[toIndex(TypeInt8)].structure.set(vm, this, JSInt8Array::createStructure(vm, this, m_typedArrays[toIndex(TypeInt8)].prototype.get()));
 333     m_typedArrays[toIndex(TypeInt16)].structure.set(vm, this, JSInt16Array::createStructure(vm, this, m_typedArrays[toIndex(TypeInt16)].prototype.get()));
 334     m_typedArrays[toIndex(TypeInt32)].structure.set(vm, this, JSInt32Array::createStructure(vm, this, m_typedArrays[toIndex(TypeInt32)].prototype.get()));
 335     m_typedArrays[toIndex(TypeUint8)].structure.set(vm, this, JSUint8Array::createStructure(vm, this, m_typedArrays[toIndex(TypeUint8)].prototype.get()));
 336     m_typedArrays[toIndex(TypeUint8Clamped)].structure.set(vm, this, JSUint8ClampedArray::createStructure(vm, this, m_typedArrays[toIndex(TypeUint8Clamped)].prototype.get()));
 337     m_typedArrays[toIndex(TypeUint16)].structure.set(vm, this, JSUint16Array::createStructure(vm, this, m_typedArrays[toIndex(TypeUint16)].prototype.get()));
 338     m_typedArrays[toIndex(TypeUint32)].structure.set(vm, this, JSUint32Array::createStructure(vm, this, m_typedArrays[toIndex(TypeUint32)].prototype.get()));
 339     m_typedArrays[toIndex(TypeFloat32)].structure.set(vm, this, JSFloat32Array::createStructure(vm, this, m_typedArrays[toIndex(TypeFloat32)].prototype.get()));
 340     m_typedArrays[toIndex(TypeFloat64)].structure.set(vm, this, JSFloat64Array::createStructure(vm, this, m_typedArrays[toIndex(TypeFloat64)].prototype.get()));
 341     m_typedArrays[toIndex(TypeDataView)].structure.set(vm, this, JSDataView::createStructure(vm, this, m_typedArrays[toIndex(TypeDataView)].prototype.get()));
 342
 343     m_lexicalEnvironmentStructure.set(vm, this, JSLexicalEnvironment::createStructure(vm, this));
 344     m_moduleEnvironmentStructure.set(vm, this, JSModuleEnvironment::createStructure(vm, this));
 345     m_strictEvalActivationStructure.set(vm, this, StrictEvalActivation::createStructure(vm, this, jsNull()));
 346     m_debuggerScopeStructure.set(m_vm, this, DebuggerScope::createStructure(m_vm, this));
 347     m_withScopeStructure.set(vm, this, JSWithScope::createStructure(vm, this, jsNull()));
 348
 349     m_nullPrototypeObjectStructure.set(vm, this, JSFinalObject::createStructure(vm, this, jsNull(), JSFinalObject::defaultInlineCapacity()));
 350
 351     m_callbackFunctionStructure.set(vm, this, JSCallbackFunction::createStructure(vm, this, m_functionPrototype.get()));
 352     m_directArgumentsStructure.set(vm, this, DirectArguments::createStructure(vm, this, m_objectPrototype.get()));
 353     m_scopedArgumentsStructure.set(vm, this, ScopedArguments::createStructure(vm, this, m_objectPrototype.get()));
 354     m_clonedArgumentsStructure.set(vm, this, ClonedArguments::createStructure(vm, this, m_objectPrototype.get()));
 355     m_callbackConstructorStructure.set(vm, this, JSCallbackConstructor::createStructure(vm, this, m_objectPrototype.get()));
 356     m_callbackObjectStructure.set(vm, this, JSCallbackObject<JSDestructibleObject>::createStructure(vm, this, m_objectPrototype.get()));
 357
 358 #if JSC_OBJC_API_ENABLED
 359     m_objcCallbackFunctionStructure.set(vm, this, ObjCCallbackFunction::createStructure(vm, this, m_functionPrototype.get()));
 360     m_objcWrapperObjectStructure.set(vm, this, JSCallbackObject<JSAPIWrapperObject>::createStructure(vm, this, m_objectPrototype.get()));
 361 #endif
 362
 363     m_arrayPrototype.set(vm, this, ArrayPrototype::create(vm, this, ArrayPrototype::createStructure(vm, this, m_objectPrototype.get())));
 364
 365     m_originalArrayStructureForIndexingShape[UndecidedShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithUndecided));
 366     m_originalArrayStructureForIndexingShape[Int32Shape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithInt32));
 367     m_originalArrayStructureForIndexingShape[DoubleShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithDouble));
 368     m_originalArrayStructureForIndexingShape[ContiguousShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithContiguous));
 369     m_originalArrayStructureForIndexingShape[ArrayStorageShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithArrayStorage));
 370     m_originalArrayStructureForIndexingShape[SlowPutArrayStorageShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithSlowPutArrayStorage));
 371     for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
 372         m_arrayStructureForIndexingShapeDuringAllocation[i] = m_originalArrayStructureForIndexingShape[i];
 373
 374     m_regExpPrototype.set(vm, this, RegExpPrototype::create(vm, this, RegExpPrototype::createStructure(vm, this, m_objectPrototype.get())));
 375     m_regExpStructure.set(vm, this, RegExpObject::createStructure(vm, this, m_regExpPrototype.get()));
 376     m_regExpMatchesArrayStructure.set(vm, this, createRegExpMatchesArrayStructure(vm, this));
 377     m_regExpMatchesArraySlowPutStructure.set(vm, this, createRegExpMatchesArraySlowPutStructure(vm, this));
 378
 379     m_moduleRecordStructure.set(vm, this, JSModuleRecord::createStructure(vm, this, m_objectPrototype.get()));
 380     m_moduleNamespaceObjectStructure.set(vm, this, JSModuleNamespaceObject::createStructure(vm, this, jsNull()));
 381     {
 382         bool isCallable = false;
 383         m_proxyObjectStructure.set(vm, this, ProxyObject::createStructure(vm, this, m_objectPrototype.get(), isCallable));
 384         isCallable = true;
 385         m_callableProxyObjectStructure.set(vm, this, ProxyObject::createStructure(vm, this, m_objectPrototype.get(), isCallable));
 386     }
 387     m_proxyRevokeStructure.set(vm, this, ProxyRevoke::createStructure(vm, this, m_functionPrototype.get()));
 388
 389 #if ENABLE(WEBASSEMBLY)
 390     m_wasmModuleStructure.set(vm, this, JSWASMModule::createStructure(vm, this));
 391 #endif
 392
 393     m_parseIntFunction.set(vm, this, JSFunction::create(vm, this, 2, vm.propertyNames->parseInt.string(), globalFuncParseInt, NoIntrinsic));
 394     putDirectWithoutTransition(vm, vm.propertyNames->parseInt, m_parseIntFunction.get(), DontEnum);
 395
 396 #define CREATE_PROTOTYPE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
 397 m_ ## lowerName ## Prototype.set(vm, this, capitalName##Prototype::create(vm, this, capitalName##Prototype::createStructure(vm, this, m_objectPrototype.get()))); \
 398 m_ ## properName ## Structure.set(vm, this, instanceType::createStructure(vm, this, m_ ## lowerName ## Prototype.get()));
 399
 400     FOR_EACH_SIMPLE_BUILTIN_TYPE(CREATE_PROTOTYPE_FOR_SIMPLE_TYPE)
 401
 402 #undef CREATE_PROTOTYPE_FOR_SIMPLE_TYPE
 403
 404     m_iteratorPrototype.set(vm, this, IteratorPrototype::create(vm, this, IteratorPrototype::createStructure(vm, this, m_objectPrototype.get())));
 405
 406 #define CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
 407 m_ ## lowerName ## Prototype.set(vm, this, capitalName##Prototype::create(vm, this, capitalName##Prototype::createStructure(vm, this, m_iteratorPrototype.get()))); \
 408 m_ ## properName ## Structure.set(vm, this, instanceType::createStructure(vm, this, m_ ## lowerName ## Prototype.get()));
 409
 410     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE)
 411     m_propertyNameIteratorStructure.set(vm, this, JSPropertyNameIterator::createStructure(vm, this, m_iteratorPrototype.get()));
 412     m_generatorPrototype.set(vm, this, GeneratorPrototype::create(vm, this, GeneratorPrototype::createStructure(vm, this, m_iteratorPrototype.get())));
 413
 414 #undef CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE
 415
 416     // Constructors
 417
 418     GetterSetter* speciesGetterSetter = GetterSetter::create(vm, this);
 419     speciesGetterSetter->setGetter(vm, this, JSFunction::createBuiltinFunction(vm, globalObjectSpeciesGetterCodeGenerator(vm), this, "get [Symbol.species]"));
 420
 421     ObjectConstructor* objectConstructor = ObjectConstructor::create(vm, this, ObjectConstructor::createStructure(vm, this, m_functionPrototype.get()), m_objectPrototype.get());
 422     m_objectConstructor.set(vm, this, objectConstructor);
 423
 424     JSFunction* definePropertyFunction = m_objectConstructor->addDefineProperty(exec, this);
 425     m_definePropertyFunction.set(vm, this, definePropertyFunction);
 426
 427     JSCell* functionConstructor = FunctionConstructor::create(vm, FunctionConstructor::createStructure(vm, this, m_functionPrototype.get()), m_functionPrototype.get());
 428     JSObject* arrayConstructor = ArrayConstructor::create(vm, this, ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_arrayPrototype.get(), speciesGetterSetter);
 429
 430     m_regExpConstructor.set(vm, this, RegExpConstructor::create(vm, RegExpConstructor::createStructure(vm, this, m_functionPrototype.get()), m_regExpPrototype.get(), speciesGetterSetter));
 431
 432 #define CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
 433 capitalName ## Constructor* lowerName ## Constructor = capitalName ## Constructor::create(vm, capitalName ## Constructor::createStructure(vm, this, m_functionPrototype.get()), m_ ## lowerName ## Prototype.get(), speciesGetterSetter); \
 434 m_ ## lowerName ## Prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, lowerName ## Constructor, DontEnum); \
 435
 436     FOR_EACH_SIMPLE_BUILTIN_TYPE(CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE)
 437
 438 #undef CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE
 439
 440     m_errorConstructor.set(vm, this, errorConstructor);
 441     m_promiseConstructor.set(vm, this, promiseConstructor);
 442     m_internalPromiseConstructor.set(vm, this, internalPromiseConstructor);
 443
 444     Structure* nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(vm, this, m_errorPrototype.get());
 445     Structure* nativeErrorStructure = NativeErrorConstructor::createStructure(vm, this, m_functionPrototype.get());
 446     m_evalErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("EvalError")));
 447     m_rangeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("RangeError")));
 448     m_referenceErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("ReferenceError")));
 449     m_syntaxErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("SyntaxError")));
 450     m_typeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("TypeError")));
 451     m_URIErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("URIError")));
 452
 453     m_generatorFunctionPrototype.set(vm, this, GeneratorFunctionPrototype::create(vm, GeneratorFunctionPrototype::createStructure(vm, this, m_functionPrototype.get())));
 454     GeneratorFunctionConstructor* generatorFunctionConstructor = GeneratorFunctionConstructor::create(vm, GeneratorFunctionConstructor::createStructure(vm, this, functionConstructor), m_generatorFunctionPrototype.get());
 455     m_generatorFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, generatorFunctionConstructor, DontEnum);
 456     m_generatorFunctionStructure.set(vm, this, JSGeneratorFunction::createStructure(vm, this, m_generatorFunctionPrototype.get()));
 457
 458     m_generatorPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_generatorFunctionPrototype.get(), DontEnum);
 459     m_generatorFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->prototype, m_generatorPrototype.get(), DontEnum);
 460
 461     m_objectPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, objectConstructor, DontEnum);
 462     m_functionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, functionConstructor, DontEnum);
 463     m_arrayPrototype->setConstructor(vm, arrayConstructor, DontEnum);
 464     m_regExpPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_regExpConstructor.get(), DontEnum);
 465
 466     putDirectWithoutTransition(vm, vm.propertyNames->Object, objectConstructor, DontEnum);
 467     putDirectWithoutTransition(vm, vm.propertyNames->Function, functionConstructor, DontEnum);
 468     putDirectWithoutTransition(vm, vm.propertyNames->Array, arrayConstructor, DontEnum);
 469     putDirectWithoutTransition(vm, vm.propertyNames->RegExp, m_regExpConstructor.get(), DontEnum);
 470     putDirectWithoutTransition(vm, vm.propertyNames->EvalError, m_evalErrorConstructor.get(), DontEnum);
 471     putDirectWithoutTransition(vm, vm.propertyNames->RangeError, m_rangeErrorConstructor.get(), DontEnum);
 472     putDirectWithoutTransition(vm, vm.propertyNames->ReferenceError, m_referenceErrorConstructor.get(), DontEnum);
 473     putDirectWithoutTransition(vm, vm.propertyNames->SyntaxError, m_syntaxErrorConstructor.get(), DontEnum);
 474     putDirectWithoutTransition(vm, vm.propertyNames->TypeError, m_typeErrorConstructor.get(), DontEnum);
 475     putDirectWithoutTransition(vm, vm.propertyNames->URIError, m_URIErrorConstructor.get(), DontEnum);
 476
 477     putDirectWithoutTransition(vm, vm.propertyNames->Proxy, ProxyConstructor::create(vm, ProxyConstructor::createStructure(vm, this, m_functionPrototype.get())), DontEnum);
 478
 479
 480 #define PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
 481 putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Constructor, DontEnum); \
 482
 483     FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR(PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE)
 484
 485 #undef PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE
 486     m_iteratorResultObjectStructure.set(vm, this, createIteratorResultObjectStructure(vm, *this));
 487
 488     m_evalFunction.set(vm, this, JSFunction::create(vm, this, 1, vm.propertyNames->eval.string(), globalFuncEval));
 489     putDirectWithoutTransition(vm, vm.propertyNames->eval, m_evalFunction.get(), DontEnum);
 490
 491 #if ENABLE(INTL)
 492     IntlObject* intl = IntlObject::create(vm, this, IntlObject::createStructure(vm, this, m_objectPrototype.get()));
 493     putDirectWithoutTransition(vm, vm.propertyNames->Intl, intl, DontEnum);
 494 #endif // ENABLE(INTL)
 495     putDirectWithoutTransition(vm, vm.propertyNames->JSON, JSONObject::create(vm, JSONObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum);
 496     putDirectWithoutTransition(vm, vm.propertyNames->Math, MathObject::create(vm, this, MathObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum);
 497     ReflectObject* reflectObject = ReflectObject::create(vm, this, ReflectObject::createStructure(vm, this, m_objectPrototype.get()));
 498     putDirectWithoutTransition(vm, vm.propertyNames->Reflect, reflectObject, DontEnum);
 499
 500     putDirectWithoutTransition(vm, vm.propertyNames->console, ConsoleObject::create(vm, this, ConsoleObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum);
 501
 502     JSTypedArrayViewConstructor* typedArraySuperConstructor = JSTypedArrayViewConstructor::create(vm, this, JSTypedArrayViewConstructor::createStructure(vm, this, m_functionPrototype.get()), typedArrayProto, speciesGetterSetter);
 503     typedArrayProto->putDirectWithoutTransition(vm, vm.propertyNames->constructor, typedArraySuperConstructor, DontEnum);
 504
 505     m_typedArrays[toIndex(TypeInt8)].constructor.set(vm , this, JSInt8ArrayConstructor::create(vm, this, JSInt8ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt8)].prototype.get(), ASCIILiteral("Int8Array"), typedArrayConstructorAllocateInt8ArrayCodeGenerator(vm)));
 506     m_typedArrays[toIndex(TypeInt16)].constructor.set(vm, this, JSInt16ArrayConstructor::create(vm, this, JSInt16ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt16)].prototype.get(), ASCIILiteral("Int16Array"), typedArrayConstructorAllocateInt16ArrayCodeGenerator(vm)));
 507     m_typedArrays[toIndex(TypeInt32)].constructor.set(vm, this, JSInt32ArrayConstructor::create(vm, this, JSInt32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt32)].prototype.get(), ASCIILiteral("Int32Array"), typedArrayConstructorAllocateInt32ArrayCodeGenerator(vm)));
 508     m_typedArrays[toIndex(TypeUint8)].constructor.set(vm, this, JSUint8ArrayConstructor::create(vm, this, JSUint8ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint8)].prototype.get(), ASCIILiteral("Uint8Array"), typedArrayConstructorAllocateUint8ArrayCodeGenerator(vm)));
 509     m_typedArrays[toIndex(TypeUint8Clamped)].constructor.set(vm, this, JSUint8ClampedArrayConstructor::create(vm, this, JSUint8ClampedArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint8Clamped)].prototype.get(), ASCIILiteral("Uint8ClampedArray"), typedArrayConstructorAllocateUint8ClampedArrayCodeGenerator(vm)));
 510     m_typedArrays[toIndex(TypeUint16)].constructor.set(vm, this, JSUint16ArrayConstructor::create(vm, this, JSUint16ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint16)].prototype.get(), ASCIILiteral("Uint16Array"), typedArrayConstructorAllocateUint16ArrayCodeGenerator(vm)));
 511     m_typedArrays[toIndex(TypeUint32)].constructor.set(vm, this, JSUint32ArrayConstructor::create(vm, this, JSUint32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint32)].prototype.get(), ASCIILiteral("Uint32Array"), typedArrayConstructorAllocateUint32ArrayCodeGenerator(vm)));
 512     m_typedArrays[toIndex(TypeFloat32)].constructor.set(vm, this, JSFloat32ArrayConstructor::create(vm, this, JSFloat32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeFloat32)].prototype.get(), ASCIILiteral("Float32Array"), typedArrayConstructorAllocateFloat32ArrayCodeGenerator(vm)));
 513     m_typedArrays[toIndex(TypeFloat64)].constructor.set(vm, this, JSFloat64ArrayConstructor::create(vm, this, JSFloat64ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeFloat64)].prototype.get(), ASCIILiteral("Float64Array"), typedArrayConstructorAllocateFloat64ArrayCodeGenerator(vm)));
 514     m_typedArrays[toIndex(TypeDataView)].constructor.set(vm, this, JSDataViewConstructor::create(vm, this, JSDataViewConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeDataView)].prototype.get(), ASCIILiteral("DataView"), nullptr));
 515
 516     for (unsigned typedArrayIndex = NUMBER_OF_TYPED_ARRAY_TYPES; typedArrayIndex--;) {
 517         m_typedArrays[typedArrayIndex].prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_typedArrays[typedArrayIndex].constructor.get(), DontEnum);
 518         putDirectWithoutTransition(vm, Identifier::fromString(exec, m_typedArrays[typedArrayIndex].constructor.get()->name(exec)), m_typedArrays[typedArrayIndex].constructor.get(), DontEnum);
 519     }
 520
 521     putDirectWithoutTransition(vm, vm.propertyNames->Int8ArrayPrivateName, m_typedArrays[toIndex(TypeInt8)].constructor.get(), DontEnum);
 522     putDirectWithoutTransition(vm, vm.propertyNames->Int16ArrayPrivateName, m_typedArrays[toIndex(TypeInt16)].constructor.get(), DontEnum);
 523     putDirectWithoutTransition(vm, vm.propertyNames->Int32ArrayPrivateName, m_typedArrays[toIndex(TypeInt32)].constructor.get(), DontEnum);
 524     putDirectWithoutTransition(vm, vm.propertyNames->Uint8ArrayPrivateName, m_typedArrays[toIndex(TypeUint8)].constructor.get(), DontEnum);
 525     putDirectWithoutTransition(vm, vm.propertyNames->Uint8ClampedArrayPrivateName, m_typedArrays[toIndex(TypeUint8Clamped)].constructor.get(), DontEnum);
 526     putDirectWithoutTransition(vm, vm.propertyNames->Uint16ArrayPrivateName, m_typedArrays[toIndex(TypeUint16)].constructor.get(), DontEnum);
 527     putDirectWithoutTransition(vm, vm.propertyNames->Uint32ArrayPrivateName, m_typedArrays[toIndex(TypeUint32)].constructor.get(), DontEnum);
 528     putDirectWithoutTransition(vm, vm.propertyNames->Float32ArrayPrivateName, m_typedArrays[toIndex(TypeFloat32)].constructor.get(), DontEnum);
 529     putDirectWithoutTransition(vm, vm.propertyNames->Float64ArrayPrivateName, m_typedArrays[toIndex(TypeFloat64)].constructor.get(), DontEnum);
 530
 531     m_moduleLoader.set(vm, this, ModuleLoaderObject::create(vm, this, ModuleLoaderObject::createStructure(vm, this, m_objectPrototype.get())));
 532     if (Options::exposeInternalModuleLoader())
 533         putDirectWithoutTransition(vm, vm.propertyNames->Loader, m_moduleLoader.get(), DontEnum);
 534
 535     JSFunction* builtinLog = JSFunction::create(vm, this, 1, vm.propertyNames->emptyIdentifier.string(), globalFuncBuiltinLog);
 536
 537     JSFunction* privateFuncAbs = JSFunction::create(vm, this, 0, String(), mathProtoFuncAbs, AbsIntrinsic);
 538     JSFunction* privateFuncFloor = JSFunction::create(vm, this, 0, String(), mathProtoFuncFloor, FloorIntrinsic);
 539     JSFunction* privateFuncIsFinite = JSFunction::create(vm, this, 0, String(), globalFuncIsFinite);
 540     JSFunction* privateFuncIsNaN = JSFunction::create(vm, this, 0, String(), globalFuncIsNaN);
 541     JSFunction* privateFuncTrunc = JSFunction::create(vm, this, 0, String(), mathProtoFuncTrunc, TruncIntrinsic);
 542
 543     JSFunction* privateFuncGetTemplateObject = JSFunction::create(vm, this, 0, String(), getTemplateObject);
 544     JSFunction* privateFuncToLength = JSFunction::createBuiltinFunction(vm, globalObjectToLengthCodeGenerator(vm), this);
 545     JSFunction* privateFuncToInteger = JSFunction::createBuiltinFunction(vm, globalObjectToIntegerCodeGenerator(vm), this);
 546     JSFunction* privateFuncTypedArrayLength = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncLength);
 547     JSFunction* privateFuncTypedArrayGetOriginalConstructor = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncGetOriginalConstructor);
 548     JSFunction* privateFuncTypedArraySort = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncSort);
 549     JSFunction* privateFuncIsBoundFunction = JSFunction::create(vm, this, 0, String(), isBoundFunction);
 550     JSFunction* privateFuncHasInstanceBoundFunction = JSFunction::create(vm, this, 0, String(), hasInstanceBoundFunction);
 551     JSFunction* privateFuncInstanceOf = JSFunction::create(vm, this, 0, String(), objectPrivateFuncInstanceOf);
 552     JSFunction* privateFuncThisTimeValue = JSFunction::create(vm, this, 0, String(), dateProtoFuncGetTime);
 553     JSFunction* privateFuncThisNumberValue = JSFunction::create(vm, this, 0, String(), numberProtoFuncValueOf);
 554     JSFunction* privateFuncIsArrayConstructor = JSFunction::create(vm, this, 0, String(), arrayConstructorPrivateFuncIsArrayConstructor);
 555
 556     JSObject* regExpProtoFlagsGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->flags);
 557     JSObject* regExpProtoGlobalGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->global);
 558     m_regExpProtoGlobalGetter.set(vm, this, regExpProtoGlobalGetterObject);
 559     JSObject* regExpProtoIgnoreCaseGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->ignoreCase);
 560     JSObject* regExpProtoMultilineGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->multiline);
 561     JSObject* regExpProtoSourceGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->source);
 562     JSObject* regExpProtoStickyGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->sticky);
 563     JSObject* regExpProtoUnicodeGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->unicode);
 564     m_regExpProtoUnicodeGetter.set(vm, this, regExpProtoUnicodeGetterObject);
 565     JSObject* builtinRegExpExec = asObject(m_regExpPrototype->getDirect(vm, vm.propertyNames->exec).asCell());
 566     m_regExpProtoExec.set(vm, this, builtinRegExpExec);
 567     JSObject* regExpSymbolReplace = asObject(m_regExpPrototype->getDirect(vm, vm.propertyNames->replaceSymbol).asCell());
 568     m_regExpProtoSymbolReplace.set(vm, this, regExpSymbolReplace);
 569
 570     GlobalPropertyInfo staticGlobals[] = {
 571         GlobalPropertyInfo(vm.propertyNames->NaN, jsNaN(), DontEnum | DontDelete | ReadOnly),
 572         GlobalPropertyInfo(vm.propertyNames->Infinity, jsNumber(std::numeric_limits<double>::infinity()), DontEnum | DontDelete | ReadOnly),
 573         GlobalPropertyInfo(vm.propertyNames->undefinedKeyword, jsUndefined(), DontEnum | DontDelete | ReadOnly),
 574         GlobalPropertyInfo(vm.propertyNames->ObjectPrivateName, objectConstructor, DontEnum | DontDelete | ReadOnly),
 575         GlobalPropertyInfo(vm.propertyNames->ownEnumerablePropertyKeysPrivateName, JSFunction::create(vm, this, 0, String(), ownEnumerablePropertyKeys), DontEnum | DontDelete | ReadOnly),
 576         GlobalPropertyInfo(vm.propertyNames->getTemplateObjectPrivateName, privateFuncGetTemplateObject, DontEnum | DontDelete | ReadOnly),
 577         GlobalPropertyInfo(vm.propertyNames->enqueueJobPrivateName, JSFunction::create(vm, this, 0, String(), enqueueJob), DontEnum | DontDelete | ReadOnly),
 578         GlobalPropertyInfo(vm.propertyNames->ErrorPrivateName, m_errorConstructor.get(), DontEnum | DontDelete | ReadOnly),
 579         GlobalPropertyInfo(vm.propertyNames->RangeErrorPrivateName, m_rangeErrorConstructor.get(), DontEnum | DontDelete | ReadOnly),
 580         GlobalPropertyInfo(vm.propertyNames->TypeErrorPrivateName, m_typeErrorConstructor.get(), DontEnum | DontDelete | ReadOnly),
 581         GlobalPropertyInfo(vm.propertyNames->typedArrayLengthPrivateName, privateFuncTypedArrayLength, DontEnum | DontDelete | ReadOnly),
 582         GlobalPropertyInfo(vm.propertyNames->typedArrayGetOriginalConstructorPrivateName, privateFuncTypedArrayGetOriginalConstructor, DontEnum | DontDelete | ReadOnly),
 583         GlobalPropertyInfo(vm.propertyNames->typedArraySortPrivateName, privateFuncTypedArraySort, DontEnum | DontDelete | ReadOnly),
 584         GlobalPropertyInfo(vm.propertyNames->isBoundFunctionPrivateName, privateFuncIsBoundFunction, DontEnum | DontDelete | ReadOnly),
 585         GlobalPropertyInfo(vm.propertyNames->hasInstanceBoundFunctionPrivateName, privateFuncHasInstanceBoundFunction, DontEnum | DontDelete | ReadOnly),
 586         GlobalPropertyInfo(vm.propertyNames->instanceOfPrivateName, privateFuncInstanceOf, DontEnum | DontDelete | ReadOnly),
 587         GlobalPropertyInfo(vm.propertyNames->BuiltinLogPrivateName, builtinLog, DontEnum | DontDelete | ReadOnly),
 588         GlobalPropertyInfo(vm.propertyNames->ArrayPrivateName, arrayConstructor, DontEnum | DontDelete | ReadOnly),
 589         GlobalPropertyInfo(vm.propertyNames->NumberPrivateName, numberConstructor, DontEnum | DontDelete | ReadOnly),
 590         GlobalPropertyInfo(vm.propertyNames->RegExpPrivateName, m_regExpConstructor.get(), DontEnum | DontDelete | ReadOnly),
 591         GlobalPropertyInfo(vm.propertyNames->StringPrivateName, stringConstructor, DontEnum | DontDelete | ReadOnly),
 592         GlobalPropertyInfo(vm.propertyNames->absPrivateName, privateFuncAbs, DontEnum | DontDelete | ReadOnly),
 593         GlobalPropertyInfo(vm.propertyNames->floorPrivateName, privateFuncFloor, DontEnum | DontDelete | ReadOnly),
 594         GlobalPropertyInfo(vm.propertyNames->truncPrivateName, privateFuncTrunc, DontEnum | DontDelete | ReadOnly),
 595         GlobalPropertyInfo(vm.propertyNames->isFinitePrivateName, privateFuncIsFinite, DontEnum | DontDelete | ReadOnly),
 596         GlobalPropertyInfo(vm.propertyNames->isNaNPrivateName, privateFuncIsNaN, DontEnum | DontDelete | ReadOnly),
 597         GlobalPropertyInfo(vm.propertyNames->PromisePrivateName, promiseConstructor, DontEnum | DontDelete | ReadOnly),
 598         GlobalPropertyInfo(vm.propertyNames->ReflectPrivateName, reflectObject, DontEnum | DontDelete | ReadOnly),
 599         GlobalPropertyInfo(vm.propertyNames->InternalPromisePrivateName, internalPromiseConstructor, DontEnum | DontDelete | ReadOnly),
 600
 601         GlobalPropertyInfo(vm.propertyNames->repeatCharacterPrivateName, JSFunction::create(vm, this, 2, String(), stringProtoFuncRepeatCharacter), DontEnum | DontDelete | ReadOnly),
 602         GlobalPropertyInfo(vm.propertyNames->builtinNames().repeatSlowPathPrivateName(), JSFunction::createBuiltinFunction(vm, stringPrototypeRepeatSlowPathCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 603         GlobalPropertyInfo(vm.propertyNames->builtinNames().repeatCharactersSlowPathPrivateName(), JSFunction::createBuiltinFunction(vm, stringPrototypeRepeatCharactersSlowPathCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 604
 605         GlobalPropertyInfo(vm.propertyNames->isSetPrivateName, JSFunction::create(vm, this, 1, String(), privateFuncIsSet), DontEnum | DontDelete | ReadOnly),
 606         GlobalPropertyInfo(vm.propertyNames->SetIteratorPrivateName, JSFunction::create(vm, this, 1, String(), privateFuncSetIterator), DontEnum | DontDelete | ReadOnly),
 607         GlobalPropertyInfo(vm.propertyNames->setIteratorNextPrivateName, JSFunction::create(vm, this, 0, String(), privateFuncSetIteratorNext), DontEnum | DontDelete | ReadOnly),
 608         GlobalPropertyInfo(vm.propertyNames->isMapPrivateName, JSFunction::create(vm, this, 1, String(), privateFuncIsMap), DontEnum | DontDelete | ReadOnly),
 609         GlobalPropertyInfo(vm.propertyNames->isArrayPrivateName, arrayConstructor->getDirect(vm, vm.propertyNames->isArray), DontEnum | DontDelete | ReadOnly),
 610         GlobalPropertyInfo(vm.propertyNames->isArrayConstructorPrivateName, privateFuncIsArrayConstructor, DontEnum | DontDelete | ReadOnly),
 611         GlobalPropertyInfo(vm.propertyNames->MapIteratorPrivateName, JSFunction::create(vm, this, 1, String(), privateFuncMapIterator), DontEnum | DontDelete | ReadOnly),
 612         GlobalPropertyInfo(vm.propertyNames->mapIteratorNextPrivateName, JSFunction::create(vm, this, 0, String(), privateFuncMapIteratorNext), DontEnum | DontDelete | ReadOnly),
 613
 614         GlobalPropertyInfo(vm.propertyNames->builtinNames().toLengthPrivateName(), privateFuncToLength, DontEnum | DontDelete | ReadOnly),
 615         GlobalPropertyInfo(vm.propertyNames->builtinNames().toIntegerPrivateName(), privateFuncToInteger, DontEnum | DontDelete | ReadOnly),
 616         GlobalPropertyInfo(vm.propertyNames->builtinNames().isDictionaryPrivateName(), JSFunction::createBuiltinFunction(vm, globalObjectIsDictionaryCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 617         GlobalPropertyInfo(vm.propertyNames->builtinNames().isPromisePrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsIsPromiseCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 618         GlobalPropertyInfo(vm.propertyNames->builtinNames().newPromiseReactionPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsNewPromiseReactionCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 619         GlobalPropertyInfo(vm.propertyNames->builtinNames().newPromiseCapabilityPrivateName(), m_newPromiseCapabilityFunction.get(), DontEnum | DontDelete | ReadOnly),
 620         GlobalPropertyInfo(vm.propertyNames->builtinNames().triggerPromiseReactionsPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsTriggerPromiseReactionsCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 621         GlobalPropertyInfo(vm.propertyNames->builtinNames().rejectPromisePrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsRejectPromiseCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 622         GlobalPropertyInfo(vm.propertyNames->builtinNames().fulfillPromisePrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsFulfillPromiseCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 623         GlobalPropertyInfo(vm.propertyNames->builtinNames().createResolvingFunctionsPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsCreateResolvingFunctionsCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 624         GlobalPropertyInfo(vm.propertyNames->builtinNames().promiseReactionJobPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsPromiseReactionJobCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 625         GlobalPropertyInfo(vm.propertyNames->builtinNames().promiseResolveThenableJobPrivateName(), JSFunction::createBuiltinFunction(vm, promiseOperationsPromiseResolveThenableJobCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 626         GlobalPropertyInfo(vm.propertyNames->builtinNames().InspectorInstrumentationPrivateName(), InspectorInstrumentationObject::create(vm, this, InspectorInstrumentationObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum | DontDelete | ReadOnly),
 627         GlobalPropertyInfo(vm.propertyNames->MapPrivateName, mapConstructor, DontEnum | DontDelete | ReadOnly),
 628         GlobalPropertyInfo(vm.propertyNames->builtinNames().generatorResumePrivateName(), JSFunction::createBuiltinFunction(vm, generatorPrototypeGeneratorResumeCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 629         GlobalPropertyInfo(vm.propertyNames->builtinNames().thisTimeValuePrivateName(), privateFuncThisTimeValue, DontEnum | DontDelete | ReadOnly),
 630         GlobalPropertyInfo(vm.propertyNames->builtinNames().thisNumberValuePrivateName(), privateFuncThisNumberValue, DontEnum | DontDelete | ReadOnly),
 631 #if ENABLE(INTL)
 632         GlobalPropertyInfo(vm.propertyNames->builtinNames().CollatorPrivateName(), intl->getDirect(vm, vm.propertyNames->Collator), DontEnum | DontDelete | ReadOnly),
 633         GlobalPropertyInfo(vm.propertyNames->builtinNames().DateTimeFormatPrivateName(), intl->getDirect(vm, vm.propertyNames->DateTimeFormat), DontEnum | DontDelete | ReadOnly),
 634         GlobalPropertyInfo(vm.propertyNames->builtinNames().NumberFormatPrivateName(), intl->getDirect(vm, vm.propertyNames->NumberFormat), DontEnum | DontDelete | ReadOnly),
 635 #endif // ENABLE(INTL)
 636
 637         GlobalPropertyInfo(vm.propertyNames->isConstructorPrivateName, JSFunction::create(vm, this, 1, String(), esSpecIsConstructor, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
 638         GlobalPropertyInfo(vm.propertyNames->isRegExpObjectPrivateName, JSFunction::create(vm, this, 1, String(), esSpecIsRegExpObject, IsRegExpObjectIntrinsic), DontEnum | DontDelete | ReadOnly),
 639         GlobalPropertyInfo(vm.propertyNames->builtinNames().speciesConstructorPrivateName(), JSFunction::createBuiltinFunction(vm, globalObjectSpeciesConstructorCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 640
 641         GlobalPropertyInfo(vm.propertyNames->regExpProtoFlagsGetterPrivateName, regExpProtoFlagsGetterObject, DontEnum | DontDelete | ReadOnly),
 642         GlobalPropertyInfo(vm.propertyNames->regExpProtoGlobalGetterPrivateName, regExpProtoGlobalGetterObject, DontEnum | DontDelete | ReadOnly),
 643         GlobalPropertyInfo(vm.propertyNames->regExpProtoIgnoreCaseGetterPrivateName, regExpProtoIgnoreCaseGetterObject, DontEnum | DontDelete | ReadOnly),
 644         GlobalPropertyInfo(vm.propertyNames->regExpProtoMultilineGetterPrivateName, regExpProtoMultilineGetterObject, DontEnum | DontDelete | ReadOnly),
 645         GlobalPropertyInfo(vm.propertyNames->regExpProtoSourceGetterPrivateName, regExpProtoSourceGetterObject, DontEnum | DontDelete | ReadOnly),
 646         GlobalPropertyInfo(vm.propertyNames->regExpProtoStickyGetterPrivateName, regExpProtoStickyGetterObject, DontEnum | DontDelete | ReadOnly),
 647         GlobalPropertyInfo(vm.propertyNames->regExpProtoUnicodeGetterPrivateName, regExpProtoUnicodeGetterObject, DontEnum | DontDelete | ReadOnly),
 648
 649         // RegExp.prototype helpers.
 650         GlobalPropertyInfo(vm.propertyNames->regExpBuiltinExecPrivateName, builtinRegExpExec, DontEnum | DontDelete | ReadOnly),
 651         GlobalPropertyInfo(vm.propertyNames->regExpCreatePrivateName, JSFunction::create(vm, this, 2, String(), esSpecRegExpCreate, NoIntrinsic), DontEnum | DontDelete | ReadOnly),
 652         GlobalPropertyInfo(vm.propertyNames->builtinNames().hasObservableSideEffectsForRegExpMatchPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeHasObservableSideEffectsForRegExpMatchCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 653         GlobalPropertyInfo(vm.propertyNames->builtinNames().hasObservableSideEffectsForRegExpSplitPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeHasObservableSideEffectsForRegExpSplitCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 654         GlobalPropertyInfo(vm.propertyNames->builtinNames().advanceStringIndexPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeAdvanceStringIndexCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 655         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpExecPrivateName(), JSFunction::createBuiltinFunction(vm, regExpPrototypeRegExpExecCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 656         GlobalPropertyInfo(vm.propertyNames->regExpMatchFastPrivateName, JSFunction::create(vm, this, 1, String(), regExpProtoFuncMatchFast), DontEnum | DontDelete | ReadOnly),
 657         GlobalPropertyInfo(vm.propertyNames->regExpSearchFastPrivateName, JSFunction::create(vm, this, 1, String(), regExpProtoFuncSearchFast), DontEnum | DontDelete | ReadOnly),
 658         GlobalPropertyInfo(vm.propertyNames->regExpSplitFastPrivateName, JSFunction::create(vm, this, 2, String(), regExpProtoFuncSplitFast), DontEnum | DontDelete | ReadOnly),
 659         GlobalPropertyInfo(vm.propertyNames->regExpPrototypeSymbolReplacePrivateName, m_regExpPrototype->getDirect(vm, vm.propertyNames->replaceSymbol), DontEnum | DontDelete | ReadOnly),
 660         GlobalPropertyInfo(vm.propertyNames->regExpTestFastPrivateName, JSFunction::create(vm, this, 1, String(), regExpProtoFuncTestFast, RegExpTestFastIntrinsic), DontEnum | DontDelete | ReadOnly),
 661
 662         // String.prototype helpers.
 663         GlobalPropertyInfo(vm.propertyNames->builtinNames().hasObservableSideEffectsForStringReplacePrivateName(), JSFunction::createBuiltinFunction(vm, stringPrototypeHasObservableSideEffectsForStringReplaceCodeGenerator(vm), this), DontEnum | DontDelete | ReadOnly),
 664         GlobalPropertyInfo(vm.propertyNames->stringIncludesInternalPrivateName, JSFunction::create(vm, this, 1, String(), builtinStringIncludesInternal), DontEnum | DontDelete | ReadOnly),
 665         GlobalPropertyInfo(vm.propertyNames->stringSplitFastPrivateName, JSFunction::create(vm, this, 2, String(), stringProtoFuncSplitFast), DontEnum | DontDelete | ReadOnly),
 666         GlobalPropertyInfo(vm.propertyNames->stringSubstrInternalPrivateName, JSFunction::create(vm, this, 2, String(), builtinStringSubstrInternal), DontEnum | DontDelete | ReadOnly),
 667     };
 668     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
 669
 670     m_specialPointers[Special::CallFunction] = m_callFunction.get();
 671     m_specialPointers[Special::ApplyFunction] = m_applyFunction.get();
 672     m_specialPointers[Special::ObjectConstructor] = objectConstructor;
 673     m_specialPointers[Special::ArrayConstructor] = arrayConstructor;
 674
 675     m_linkTimeConstants[static_cast<unsigned>(LinkTimeConstant::DefinePropertyFunction)] = m_definePropertyFunction.get();
 676
 677     if (UNLIKELY(Options::useDollarVM())) {
 678         JSDollarVMPrototype* dollarVMPrototype = JSDollarVMPrototype::create(vm, this, JSDollarVMPrototype::createStructure(vm, this, m_objectPrototype.get()));
 679         m_dollarVMStructure.set(vm, this, JSDollarVM::createStructure(vm, this, dollarVMPrototype));
 680         JSDollarVM* dollarVM = JSDollarVM::create(vm, m_dollarVMStructure.get());
 681
 682         GlobalPropertyInfo extraStaticGlobals[] = {
 683             GlobalPropertyInfo(vm.propertyNames->builtinNames().dollarVMPrivateName(), dollarVM, DontEnum | DontDelete | ReadOnly),
 684         };
 685         addStaticGlobals(extraStaticGlobals, WTF_ARRAY_LENGTH(extraStaticGlobals));
 686
 687         putDirectWithoutTransition(vm, Identifier::fromString(exec, "$vm"), dollarVM, DontEnum);
 688     }
 689
 690     resetPrototype(vm, getPrototypeDirect());
 691 }
 692
 693 bool JSGlobalObject::hasLegacyProfiler() const
 694 {
 695     return globalObjectMethodTable()->supportsLegacyProfiling(this);
 696 }
 697
 698 bool JSGlobalObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
 699 {
 700     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(cell);
 701     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
 702
 703     if (UNLIKELY(isThisValueAltered(slot, thisObject)))
 704         return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
 705
 706     bool shouldThrowReadOnlyError = slot.isStrictMode();
 707     bool ignoreReadOnlyErrors = false;
 708     bool putResult = false;
 709     if (symbolTablePutTouchWatchpointSet(thisObject, exec, propertyName, value, shouldThrowReadOnlyError, ignoreReadOnlyErrors, putResult))
 710         return putResult;
 711     return Base::put(thisObject, exec, propertyName, value, slot);
 712 }
 713
 714 bool JSGlobalObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
 715 {
 716     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(object);
 717     PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
 718     // silently ignore attempts to add accessors aliasing vars.
 719     if (descriptor.isAccessorDescriptor() && symbolTableGet(thisObject, propertyName, slot))
 720         return false;
 721     return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
 722 }
 723
 724 void JSGlobalObject::addGlobalVar(const Identifier& ident)
 725 {
 726     ConcurrentJITLocker locker(symbolTable()->m_lock);
 727     SymbolTableEntry entry = symbolTable()->get(locker, ident.impl());
 728     if (!entry.isNull())
 729         return;
 730
 731     ScopeOffset offset = symbolTable()->takeNextScopeOffset(locker);
 732     SymbolTableEntry newEntry(VarOffset(offset), 0);
 733     newEntry.prepareToWatch();
 734     symbolTable()->add(locker, ident.impl(), WTFMove(newEntry));
 735
 736     ScopeOffset offsetForAssert = addVariables(1, jsUndefined());
 737     RELEASE_ASSERT(offsetForAssert == offset);
 738 }
 739
 740 void JSGlobalObject::addFunction(ExecState* exec, const Identifier& propertyName)
 741 {
 742     VM& vm = exec->vm();
 743     removeDirect(vm, propertyName); // Newly declared functions overwrite existing properties.
 744     addGlobalVar(propertyName);
 745 }
 746
 747 static inline JSObject* lastInPrototypeChain(JSObject* object)
 748 {
 749     JSObject* o = object;
 750     while (o->getPrototypeDirect().isObject())
 751         o = asObject(o->getPrototypeDirect());
 752     return o;
 753 }
 754
 755 // Private namespace for helpers for JSGlobalObject::haveABadTime()
 756 namespace {
 757
 758 class ObjectsWithBrokenIndexingFinder : public MarkedBlock::VoidFunctor {
 759 public:
 760     ObjectsWithBrokenIndexingFinder(MarkedArgumentBuffer&, JSGlobalObject*);
 761     IterationStatus operator()(JSCell*);
 762
 763 private:
 764     void visit(JSCell*);
 765
 766     MarkedArgumentBuffer& m_foundObjects;
 767     JSGlobalObject* m_globalObject;
 768 };
 769
 770 ObjectsWithBrokenIndexingFinder::ObjectsWithBrokenIndexingFinder(
 771     MarkedArgumentBuffer& foundObjects, JSGlobalObject* globalObject)
 772     : m_foundObjects(foundObjects)
 773     , m_globalObject(globalObject)
 774 {
 775 }
 776
 777 inline bool hasBrokenIndexing(JSObject* object)
 778 {
 779     // This will change if we have more indexing types.
 780     IndexingType type = object->indexingType();
 781     // This could be made obviously more efficient, but isn't made so right now, because
 782     // we expect this to be an unlikely slow path anyway.
 783     return hasUndecided(type) || hasInt32(type) || hasDouble(type) || hasContiguous(type) || hasArrayStorage(type);
 784 }
 785
 786 inline void ObjectsWithBrokenIndexingFinder::visit(JSCell* cell)
 787 {
 788     if (!cell->isObject())
 789         return;
 790
 791     JSObject* object = asObject(cell);
 792
 793     // Run this filter first, since it's cheap, and ought to filter out a lot of objects.
 794     if (!hasBrokenIndexing(object))
 795         return;
 796
 797     // We only want to have a bad time in the affected global object, not in the entire
 798     // VM. But we have to be careful, since there may be objects that claim to belong to
 799     // a different global object that have prototypes from our global object.
 800     bool foundGlobalObject = false;
 801     for (JSObject* current = object; ;) {
 802         if (current->globalObject() == m_globalObject) {
 803             foundGlobalObject = true;
 804             break;
 805         }
 806
 807         JSValue prototypeValue = current->getPrototypeDirect();
 808         if (prototypeValue.isNull())
 809             break;
 810         current = asObject(prototypeValue);
 811     }
 812     if (!foundGlobalObject)
 813         return;
 814
 815     m_foundObjects.append(object);
 816 }
 817
 818 IterationStatus ObjectsWithBrokenIndexingFinder::operator()(JSCell* cell)
 819 {
 820     visit(cell);
 821     return IterationStatus::Continue;
 822 }
 823
 824 } // end private namespace for helpers for JSGlobalObject::haveABadTime()
 825
 826 void JSGlobalObject::haveABadTime(VM& vm)
 827 {
 828     ASSERT(&vm == &this->vm());
 829
 830     if (isHavingABadTime())
 831         return;
 832
 833     // Make sure that all allocations or indexed storage transitions that are inlining
 834     // the assumption that it's safe to transition to a non-SlowPut array storage don't
 835     // do so anymore.
 836     m_havingABadTimeWatchpoint->fireAll("Having a bad time");
 837     ASSERT(isHavingABadTime()); // The watchpoint is what tells us that we're having a bad time.
 838
 839     // Make sure that all JSArray allocations that load the appropriate structure from
 840     // this object now load a structure that uses SlowPut.
 841     for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
 842         m_arrayStructureForIndexingShapeDuringAllocation[i].set(vm, this, originalArrayStructureForIndexingType(ArrayWithSlowPutArrayStorage));
 843
 844     // Same for any special array structures.
 845     m_regExpMatchesArrayStructure.set(vm, this, m_regExpMatchesArraySlowPutStructure.get());
 846
 847     // Make sure that all objects that have indexed storage switch to the slow kind of
 848     // indexed storage.
 849     MarkedArgumentBuffer foundObjects; // Use MarkedArgumentBuffer because switchToSlowPutArrayStorage() may GC.
 850     ObjectsWithBrokenIndexingFinder finder(foundObjects, this);
 851     {
 852         HeapIterationScope iterationScope(vm.heap);
 853         vm.heap.objectSpace().forEachLiveCell(iterationScope, finder);
 854     }
 855     while (!foundObjects.isEmpty()) {
 856         JSObject* object = asObject(foundObjects.last());
 857         foundObjects.removeLast();
 858         ASSERT(hasBrokenIndexing(object));
 859         object->switchToSlowPutArrayStorage(vm);
 860     }
 861 }
 862
 863 bool JSGlobalObject::objectPrototypeIsSane()
 864 {
 865     return !hasIndexedProperties(m_objectPrototype->indexingType())
 866         && m_objectPrototype->getPrototypeDirect().isNull();
 867 }
 868
 869 bool JSGlobalObject::arrayPrototypeChainIsSane()
 870 {
 871     return !hasIndexedProperties(m_arrayPrototype->indexingType())
 872         && m_arrayPrototype->getPrototypeDirect() == m_objectPrototype.get()
 873         && objectPrototypeIsSane();
 874 }
 875
 876 bool JSGlobalObject::stringPrototypeChainIsSane()
 877 {
 878     return !hasIndexedProperties(m_stringPrototype->indexingType())
 879         && m_stringPrototype->getPrototypeDirect() == m_objectPrototype.get()
 880         && objectPrototypeIsSane();
 881 }
 882
 883 void JSGlobalObject::createThrowTypeError(VM& vm)
 884 {
 885     JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeError);
 886     GetterSetter* getterSetter = GetterSetter::create(vm, this);
 887     getterSetter->setGetter(vm, this, thrower);
 888     getterSetter->setSetter(vm, this, thrower);
 889     m_throwTypeErrorGetterSetter.set(vm, this, getterSetter);
 890 }
 891
 892 void JSGlobalObject::createThrowTypeErrorArgumentsAndCaller(VM& vm)
 893 {
 894     JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeErrorArgumentsAndCaller);
 895     GetterSetter* getterSetter = GetterSetter::create(vm, this);
 896     getterSetter->setGetter(vm, this, thrower);
 897     getterSetter->setSetter(vm, this, thrower);
 898     m_throwTypeErrorArgumentsAndCallerGetterSetter.set(vm, this, getterSetter);
 899 }
 900
 901 // Set prototype, and also insert the object prototype at the end of the chain.
 902 void JSGlobalObject::resetPrototype(VM& vm, JSValue prototype)
 903 {
 904     setPrototypeDirect(vm, prototype);
 905
 906     JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
 907     JSObject* objectPrototype = m_objectPrototype.get();
 908     if (oldLastInPrototypeChain != objectPrototype)
 909         oldLastInPrototypeChain->setPrototypeDirect(vm, objectPrototype);
 910
 911     // Whenever we change the prototype of the global object, we need to create a new JSProxy with the correct prototype.
 912     setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype, PureForwardingProxyType), this));
 913 }
 914
 915 void JSGlobalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
 916 {
 917     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(cell);
 918     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
 919     Base::visitChildren(thisObject, visitor);
 920
 921     visitor.append(&thisObject->m_globalThis);
 922
 923     visitor.append(&thisObject->m_globalLexicalEnvironment);
 924     visitor.append(&thisObject->m_globalCallee);
 925     visitor.append(&thisObject->m_regExpConstructor);
 926     visitor.append(&thisObject->m_errorConstructor);
 927     visitor.append(&thisObject->m_evalErrorConstructor);
 928     visitor.append(&thisObject->m_rangeErrorConstructor);
 929     visitor.append(&thisObject->m_referenceErrorConstructor);
 930     visitor.append(&thisObject->m_syntaxErrorConstructor);
 931     visitor.append(&thisObject->m_typeErrorConstructor);
 932     visitor.append(&thisObject->m_URIErrorConstructor);
 933     visitor.append(&thisObject->m_objectConstructor);
 934     visitor.append(&thisObject->m_promiseConstructor);
 935     visitor.append(&thisObject->m_internalPromiseConstructor);
 936
 937     visitor.append(&thisObject->m_nullGetterFunction);
 938     visitor.append(&thisObject->m_nullSetterFunction);
 939
 940     visitor.append(&thisObject->m_parseIntFunction);
 941     visitor.append(&thisObject->m_evalFunction);
 942     visitor.append(&thisObject->m_callFunction);
 943     visitor.append(&thisObject->m_applyFunction);
 944     visitor.append(&thisObject->m_definePropertyFunction);
 945     visitor.append(&thisObject->m_arrayProtoValuesFunction);
 946     visitor.append(&thisObject->m_initializePromiseFunction);
 947     visitor.append(&thisObject->m_newPromiseCapabilityFunction);
 948     visitor.append(&thisObject->m_functionProtoHasInstanceSymbolFunction);
 949     visitor.append(&thisObject->m_throwTypeErrorGetterSetter);
 950     visitor.append(&thisObject->m_throwTypeErrorArgumentsAndCallerGetterSetter);
 951     visitor.append(&thisObject->m_moduleLoader);
 952
 953     visitor.append(&thisObject->m_objectPrototype);
 954     visitor.append(&thisObject->m_functionPrototype);
 955     visitor.append(&thisObject->m_arrayPrototype);
 956     visitor.append(&thisObject->m_errorPrototype);
 957     visitor.append(&thisObject->m_iteratorPrototype);
 958     visitor.append(&thisObject->m_generatorFunctionPrototype);
 959     visitor.append(&thisObject->m_generatorPrototype);
 960
 961     visitor.append(&thisObject->m_debuggerScopeStructure);
 962     visitor.append(&thisObject->m_withScopeStructure);
 963     visitor.append(&thisObject->m_strictEvalActivationStructure);
 964     visitor.append(&thisObject->m_lexicalEnvironmentStructure);
 965     visitor.append(&thisObject->m_moduleEnvironmentStructure);
 966     visitor.append(&thisObject->m_directArgumentsStructure);
 967     visitor.append(&thisObject->m_scopedArgumentsStructure);
 968     visitor.append(&thisObject->m_clonedArgumentsStructure);
 969     for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
 970         visitor.append(&thisObject->m_originalArrayStructureForIndexingShape[i]);
 971     for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
 972         visitor.append(&thisObject->m_arrayStructureForIndexingShapeDuringAllocation[i]);
 973     visitor.append(&thisObject->m_booleanObjectStructure);
 974     visitor.append(&thisObject->m_callbackConstructorStructure);
 975     visitor.append(&thisObject->m_callbackFunctionStructure);
 976     visitor.append(&thisObject->m_callbackObjectStructure);
 977     visitor.append(&thisObject->m_propertyNameIteratorStructure);
 978 #if JSC_OBJC_API_ENABLED
 979     visitor.append(&thisObject->m_objcCallbackFunctionStructure);
 980     visitor.append(&thisObject->m_objcWrapperObjectStructure);
 981 #endif
 982     visitor.append(&thisObject->m_nullPrototypeObjectStructure);
 983     visitor.append(&thisObject->m_errorStructure);
 984     visitor.append(&thisObject->m_calleeStructure);
 985     visitor.append(&thisObject->m_functionStructure);
 986     visitor.append(&thisObject->m_boundSlotBaseFunctionStructure);
 987     visitor.append(&thisObject->m_boundFunctionStructure);
 988     visitor.append(&thisObject->m_getterSetterStructure);
 989     visitor.append(&thisObject->m_nativeStdFunctionStructure);
 990     visitor.append(&thisObject->m_namedFunctionStructure);
 991     visitor.append(&thisObject->m_symbolObjectStructure);
 992     visitor.append(&thisObject->m_regExpStructure);
 993     visitor.append(&thisObject->m_generatorFunctionStructure);
 994     visitor.append(&thisObject->m_iteratorResultObjectStructure);
 995     visitor.append(&thisObject->m_regExpMatchesArrayStructure);
 996     visitor.append(&thisObject->m_regExpMatchesArraySlowPutStructure);
 997     visitor.append(&thisObject->m_moduleRecordStructure);
 998     visitor.append(&thisObject->m_moduleNamespaceObjectStructure);
 999     visitor.append(&thisObject->m_dollarVMStructure);
1000     visitor.append(&thisObject->m_internalFunctionStructure);
1001     visitor.append(&thisObject->m_proxyObjectStructure);
1002     visitor.append(&thisObject->m_callableProxyObjectStructure);
1003     visitor.append(&thisObject->m_proxyRevokeStructure);
1004 #if ENABLE(WEBASSEMBLY)
1005     visitor.append(&thisObject->m_wasmModuleStructure);
1006 #endif
1007
1008 #define VISIT_SIMPLE_TYPE(CapitalName, lowerName, properName, instanceType, jsName) \
1009     visitor.append(&thisObject->m_ ## lowerName ## Prototype); \
1010     visitor.append(&thisObject->m_ ## properName ## Structure); \
1011
1012     FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE)
1013     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_SIMPLE_TYPE)
1014
1015 #undef VISIT_SIMPLE_TYPE
1016
1017     for (unsigned i = NUMBER_OF_TYPED_ARRAY_TYPES; i--;) {
1018         visitor.append(&thisObject->m_typedArrays[i].prototype);
1019         visitor.append(&thisObject->m_typedArrays[i].constructor);
1020         visitor.append(&thisObject->m_typedArrays[i].structure);
1021     }
1022 }
1023
1024 JSValue JSGlobalObject::toThis(JSCell*, ExecState* exec, ECMAMode ecmaMode)
1025 {
1026     if (ecmaMode == StrictMode)
1027         return jsUndefined();
1028     return exec->globalThisValue();
1029 }
1030
1031 ExecState* JSGlobalObject::globalExec()
1032 {
1033     return CallFrame::create(m_globalCallFrame);
1034 }
1035
1036 void JSGlobalObject::addStaticGlobals(GlobalPropertyInfo* globals, int count)
1037 {
1038     ScopeOffset startOffset = addVariables(count, jsUndefined());
1039
1040     for (int i = 0; i < count; ++i) {
1041         GlobalPropertyInfo& global = globals[i];
1042         ASSERT(global.attributes & DontDelete);
1043
1044         WatchpointSet* watchpointSet = nullptr;
1045         WriteBarrierBase<Unknown>* variable = nullptr;
1046         {
1047             ConcurrentJITLocker locker(symbolTable()->m_lock);
1048             ScopeOffset offset = symbolTable()->takeNextScopeOffset(locker);
1049             RELEASE_ASSERT(offset = startOffset + i);
1050             SymbolTableEntry newEntry(VarOffset(offset), global.attributes);
1051             newEntry.prepareToWatch();
1052             watchpointSet = newEntry.watchpointSet();
1053             symbolTable()->add(locker, global.identifier.impl(), WTFMove(newEntry));
1054             variable = &variableAt(offset);
1055         }
1056         symbolTablePutTouchWatchpointSet(vm(), this, global.identifier, global.value, variable, watchpointSet);
1057     }
1058 }
1059
1060 bool JSGlobalObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
1061 {
1062     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(object);
1063     if (getStaticFunctionSlot<Base>(exec, globalObjectTable, thisObject, propertyName, slot))
1064         return true;
1065     return symbolTableGet(thisObject, propertyName, slot);
1066 }
1067
1068 void JSGlobalObject::clearRareData(JSCell* cell)
1069 {
1070     jsCast<JSGlobalObject*>(cell)->m_rareData = nullptr;
1071 }
1072
1073 void slowValidateCell(JSGlobalObject* globalObject)
1074 {
1075     RELEASE_ASSERT(globalObject->isGlobalObject());
1076     ASSERT_GC_OBJECT_INHERITS(globalObject, JSGlobalObject::info());
1077 }
1078
1079 UnlinkedProgramCodeBlock* JSGlobalObject::createProgramCodeBlock(CallFrame* callFrame, ProgramExecutable* executable, JSObject** exception)
1080 {
1081     ParserError error;
1082     JSParserStrictMode strictMode = executable->isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
1083     DebuggerMode debuggerMode = hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
1084     ProfilerMode profilerMode = hasLegacyProfiler() ? ProfilerOn : ProfilerOff;
1085     UnlinkedProgramCodeBlock* unlinkedCodeBlock = vm().codeCache()->getProgramCodeBlock(
1086         vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, strictMode,
1087         debuggerMode, profilerMode, error);
1088
1089     if (hasDebugger())
1090         debugger()->sourceParsed(callFrame, executable->source().provider(), error.line(), error.message());
1091
1092     if (error.isValid()) {
1093         *exception = error.toErrorObject(this, executable->source());
1094         return nullptr;
1095     }
1096
1097     return unlinkedCodeBlock;
1098 }
1099
1100 UnlinkedEvalCodeBlock* JSGlobalObject::createEvalCodeBlock(CallFrame* callFrame, EvalExecutable* executable, ThisTDZMode thisTDZMode, const VariableEnvironment* variablesUnderTDZ)
1101 {
1102     ParserError error;
1103     JSParserStrictMode strictMode = executable->isStrictMode() ? JSParserStrictMode::Strict : JSParserStrictMode::NotStrict;
1104     DebuggerMode debuggerMode = hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
1105     EvalContextType evalContextType = executable->executableInfo().evalContextType();
1106
1107     ProfilerMode profilerMode = hasLegacyProfiler() ? ProfilerOn : ProfilerOff;
1108     UnlinkedEvalCodeBlock* unlinkedCodeBlock = vm().codeCache()->getEvalCodeBlock(
1109         vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, strictMode, thisTDZMode, debuggerMode, profilerMode, error, evalContextType, variablesUnderTDZ);
1110
1111     if (hasDebugger())
1112         debugger()->sourceParsed(callFrame, executable->source().provider(), error.line(), error.message());
1113
1114     if (error.isValid()) {
1115         throwVMError(callFrame, error.toErrorObject(this, executable->source()));
1116         return nullptr;
1117     }
1118
1119     return unlinkedCodeBlock;
1120 }
1121
1122 UnlinkedModuleProgramCodeBlock* JSGlobalObject::createModuleProgramCodeBlock(CallFrame* callFrame, ModuleProgramExecutable* executable)
1123 {
1124     ParserError error;
1125     DebuggerMode debuggerMode = hasInteractiveDebugger() ? DebuggerOn : DebuggerOff;
1126     ProfilerMode profilerMode = hasLegacyProfiler() ? ProfilerOn : ProfilerOff;
1127     UnlinkedModuleProgramCodeBlock* unlinkedCodeBlock = vm().codeCache()->getModuleProgramCodeBlock(
1128         vm(), executable, executable->source(), JSParserBuiltinMode::NotBuiltin, debuggerMode, profilerMode, error);
1129
1130     if (hasDebugger())
1131         debugger()->sourceParsed(callFrame, executable->source().provider(), error.line(), error.message());
1132
1133     if (error.isValid()) {
1134         throwVMError(callFrame, error.toErrorObject(this, executable->source()));
1135         return nullptr;
1136     }
1137
1138     return unlinkedCodeBlock;
1139 }
1140
1141 void JSGlobalObject::setRemoteDebuggingEnabled(bool enabled)
1142 {
1143 #if ENABLE(REMOTE_INSPECTOR)
1144     m_inspectorDebuggable->setRemoteDebuggingAllowed(enabled);
1145 #else
1146     UNUSED_PARAM(enabled);
1147 #endif
1148 }
1149
1150 bool JSGlobalObject::remoteDebuggingEnabled() const
1151 {
1152 #if ENABLE(REMOTE_INSPECTOR)
1153     return m_inspectorDebuggable->remoteDebuggingAllowed();
1154 #else
1155     return false;
1156 #endif
1157 }
1158
1159 #if ENABLE(WEB_REPLAY)
1160 void JSGlobalObject::setInputCursor(PassRefPtr<InputCursor> prpCursor)
1161 {
1162     m_inputCursor = prpCursor;
1163     ASSERT(m_inputCursor);
1164
1165     InputCursor& cursor = inputCursor();
1166     // Save or set the random seed. This performed here rather than the constructor
1167     // to avoid threading the input cursor through all the abstraction layers.
1168     if (cursor.isCapturing())
1169         cursor.appendInput<SetRandomSeed>(m_weakRandom.seed());
1170     else if (cursor.isReplaying()) {
1171         if (SetRandomSeed* input = cursor.fetchInput<SetRandomSeed>())
1172             m_weakRandom.setSeed(static_cast<unsigned>(input->randomSeed()));
1173     }
1174 }
1175 #endif
1176
1177 void JSGlobalObject::setName(const String& name)
1178 {
1179     m_name = name;
1180
1181 #if ENABLE(REMOTE_INSPECTOR)
1182     m_inspectorDebuggable->update();
1183 #endif
1184 }
1185
1186 # if ENABLE(INTL)
1187 const HashSet<String>& JSGlobalObject::intlCollatorAvailableLocales()
1188 {
1189     if (m_intlCollatorAvailableLocales.isEmpty()) {
1190         int32_t count = ucol_countAvailable();
1191         for (int32_t i = 0; i < count; ++i) {
1192             String locale(ucol_getAvailable(i));
1193             convertICULocaleToBCP47LanguageTag(locale);
1194             m_intlCollatorAvailableLocales.add(locale);
1195         }
1196     }
1197     return m_intlCollatorAvailableLocales;
1198 }
1199
1200 const HashSet<String>& JSGlobalObject::intlDateTimeFormatAvailableLocales()
1201 {
1202     if (m_intlDateTimeFormatAvailableLocales.isEmpty()) {
1203         int32_t count = udat_countAvailable();
1204         for (int32_t i = 0; i < count; ++i) {
1205             String locale(udat_getAvailable(i));
1206             convertICULocaleToBCP47LanguageTag(locale);
1207             m_intlDateTimeFormatAvailableLocales.add(locale);
1208         }
1209     }
1210     return m_intlDateTimeFormatAvailableLocales;
1211 }
1212
1213 const HashSet<String>& JSGlobalObject::intlNumberFormatAvailableLocales()
1214 {
1215     if (m_intlNumberFormatAvailableLocales.isEmpty()) {
1216         int32_t count = unum_countAvailable();
1217         for (int32_t i = 0; i < count; ++i) {
1218             String locale(unum_getAvailable(i));
1219             convertICULocaleToBCP47LanguageTag(locale);
1220             m_intlNumberFormatAvailableLocales.add(locale);
1221         }
1222     }
1223     return m_intlNumberFormatAvailableLocales;
1224 }
1225 #endif // ENABLE(INTL)
1226
1227 void JSGlobalObject::queueMicrotask(PassRefPtr<Microtask> task)
1228 {
1229     if (globalObjectMethodTable()->queueTaskToEventLoop) {
1230         globalObjectMethodTable()->queueTaskToEventLoop(this, task);
1231         return;
1232     }
1233
1234     vm().queueMicrotask(this, task);
1235 }
1236
1237 bool JSGlobalObject::hasDebugger() const
1238 {
1239     return m_debugger;
1240 }
1241
1242 bool JSGlobalObject::hasInteractiveDebugger() const
1243 {
1244     return m_debugger && m_debugger->isInteractivelyDebugging();
1245 }
1246
1247 } // namespace JSC