Source/JavaScriptCore/runtime/JSGlobalObject.cpp

   1 /*
   2  * Copyright (C) 2007-2017 Apple Inc. All rights reserved.
   3  * Copyright (C) 2008 Cameron Zwarich (cwzwarich@uwaterloo.ca)
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  *
   9  * 1.  Redistributions of source code must retain the above copyright
  10  *     notice, this list of conditions and the following disclaimer.
  11  * 2.  Redistributions in binary form must reproduce the above copyright
  12  *     notice, this list of conditions and the following disclaimer in the
  13  *     documentation and/or other materials provided with the distribution.
  14  * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
  15  *     its contributors may be used to endorse or promote products derived
  16  *     from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  19  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  20  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  21  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  22  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  23  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  24  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  25  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  28  */
  29
  30 #include "config.h"
  31 #include "JSGlobalObject.h"
  32
  33 #include "ArrayConstructor.h"
  34 #include "ArrayIteratorPrototype.h"
  35 #include "ArrayPrototype.h"
  36 #include "AsyncFromSyncIteratorPrototype.h"
  37 #include "AtomicsObject.h"
  38 #include "AsyncFunctionConstructor.h"
  39 #include "AsyncFunctionPrototype.h"
  40 #include "AsyncGeneratorFunctionConstructor.h"
  41 #include "AsyncGeneratorFunctionPrototype.h"
  42 #include "AsyncGeneratorPrototype.h"
  43 #include "AsyncIteratorPrototype.h"
  44 #include "BigIntConstructor.h"
  45 #include "BigIntObject.h"
  46 #include "BigIntPrototype.h"
  47 #include "BooleanConstructor.h"
  48 #include "BooleanPrototype.h"
  49 #include "BuiltinNames.h"
  50 #include "CatchScope.h"
  51 #include "ClonedArguments.h"
  52 #include "CodeBlock.h"
  53 #include "CodeCache.h"
  54 #include "ConsoleObject.h"
  55 #include "DateConstructor.h"
  56 #include "DatePrototype.h"
  57 #include "Debugger.h"
  58 #include "DebuggerScope.h"
  59 #include "DirectArguments.h"
  60 #include "DirectEvalExecutable.h"
  61 #include "ECMAScriptSpecInternalFunctions.h"
  62 #include "Error.h"
  63 #include "ErrorConstructor.h"
  64 #include "ErrorPrototype.h"
  65 #include "FunctionConstructor.h"
  66 #include "FunctionPrototype.h"
  67 #include "GeneratorFunctionConstructor.h"
  68 #include "GeneratorFunctionPrototype.h"
  69 #include "GeneratorPrototype.h"
  70 #include "GetterSetter.h"
  71 #include "HeapIterationScope.h"
  72 #include "IndirectEvalExecutable.h"
  73 #include "InspectorInstrumentationObject.h"
  74 #include "Interpreter.h"
  75 #include "IteratorPrototype.h"
  76 #include "JSAPIWrapperObject.h"
  77 #include "JSArrayBuffer.h"
  78 #include "JSArrayBufferConstructor.h"
  79 #include "JSArrayBufferPrototype.h"
  80 #include "JSAsyncFunction.h"
  81 #include "JSAsyncGeneratorFunction.h"
  82 #include "JSBigInt.h"
  83 #include "JSBoundFunction.h"
  84 #include "JSCInlines.h"
  85 #include "JSCallbackConstructor.h"
  86 #include "JSCallbackFunction.h"
  87 #include "JSCallbackObject.h"
  88 #include "JSCustomGetterSetterFunction.h"
  89 #include "JSDataView.h"
  90 #include "JSDataViewPrototype.h"
  91 #include "JSDollarVM.h"
  92 #include "JSFunction.h"
  93 #include "JSGeneratorFunction.h"
  94 #include "JSGenericTypedArrayViewConstructorInlines.h"
  95 #include "JSGenericTypedArrayViewInlines.h"
  96 #include "JSGenericTypedArrayViewPrototypeInlines.h"
  97 #include "JSGlobalObjectFunctions.h"
  98 #include "JSInternalPromise.h"
  99 #include "JSInternalPromiseConstructor.h"
 100 #include "JSInternalPromisePrototype.h"
 101 #include "JSJob.h"
 102 #include "JSLexicalEnvironment.h"
 103 #include "JSLock.h"
 104 #include "JSMap.h"
 105 #include "JSModuleEnvironment.h"
 106 #include "JSModuleLoader.h"
 107 #include "JSModuleNamespaceObject.h"
 108 #include "JSModuleRecord.h"
 109 #include "JSNativeStdFunction.h"
 110 #include "JSONObject.h"
 111 #include "JSPromise.h"
 112 #include "JSPromiseConstructor.h"
 113 #include "JSPromisePrototype.h"
 114 #include "JSSet.h"
 115 #include "JSStringIterator.h"
 116 #include "JSTemplateRegistryKey.h"
 117 #include "JSTypedArrayConstructors.h"
 118 #include "JSTypedArrayPrototypes.h"
 119 #include "JSTypedArrayViewConstructor.h"
 120 #include "JSTypedArrayViewPrototype.h"
 121 #include "JSTypedArrays.h"
 122 #include "JSWeakMap.h"
 123 #include "JSWeakSet.h"
 124 #include "JSWebAssembly.h"
 125 #include "JSWithScope.h"
 126 #include "LazyClassStructureInlines.h"
 127 #include "LazyPropertyInlines.h"
 128 #include "Lookup.h"
 129 #include "MapConstructor.h"
 130 #include "MapIteratorPrototype.h"
 131 #include "MapPrototype.h"
 132 #include "MarkedSpaceInlines.h"
 133 #include "MathObject.h"
 134 #include "Microtask.h"
 135 #include "ModuleLoaderPrototype.h"
 136 #include "NativeErrorConstructor.h"
 137 #include "NativeErrorPrototype.h"
 138 #include "NullGetterFunction.h"
 139 #include "NullSetterFunction.h"
 140 #include "NumberConstructor.h"
 141 #include "NumberPrototype.h"
 142 #include "ObjCCallbackFunction.h"
 143 #include "ObjectConstructor.h"
 144 #include "ObjectPropertyChangeAdaptiveWatchpoint.h"
 145 #include "ObjectPropertyConditionSet.h"
 146 #include "ObjectPrototype.h"
 147 #include "ParserError.h"
 148 #include "ProxyConstructor.h"
 149 #include "ProxyObject.h"
 150 #include "ProxyRevoke.h"
 151 #include "ReflectObject.h"
 152 #include "RegExpConstructor.h"
 153 #include "RegExpMatchesArray.h"
 154 #include "RegExpObject.h"
 155 #include "RegExpPrototype.h"
 156 #include "ScopedArguments.h"
 157 #include "SetConstructor.h"
 158 #include "SetIteratorPrototype.h"
 159 #include "SetPrototype.h"
 160 #include "StrictEvalActivation.h"
 161 #include "StringConstructor.h"
 162 #include "StringIteratorPrototype.h"
 163 #include "StringPrototype.h"
 164 #include "Symbol.h"
 165 #include "SymbolConstructor.h"
 166 #include "SymbolObject.h"
 167 #include "SymbolPrototype.h"
 168 #include "VariableWriteFireDetail.h"
 169 #include "WeakGCMapInlines.h"
 170 #include "WeakMapConstructor.h"
 171 #include "WeakMapPrototype.h"
 172 #include "WeakSetConstructor.h"
 173 #include "WeakSetPrototype.h"
 174 #include "WebAssemblyToJSCallee.h"
 175 #include <wtf/RandomNumber.h>
 176
 177 #if ENABLE(INTL)
 178 #include "IntlObject.h"
 179 #include <unicode/ucol.h>
 180 #include <unicode/udat.h>
 181 #include <unicode/unum.h>
 182 #endif // ENABLE(INTL)
 183
 184 #if ENABLE(REMOTE_INSPECTOR)
 185 #include "JSGlobalObjectDebuggable.h"
 186 #include "JSGlobalObjectInspectorController.h"
 187 #endif
 188
 189 namespace JSC {
 190
 191 static JSValue createProxyProperty(VM& vm, JSObject* object)
 192 {
 193     JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
 194     return ProxyConstructor::create(vm, ProxyConstructor::createStructure(vm, global, global->functionPrototype()));
 195 }
 196
 197 static JSValue createJSONProperty(VM& vm, JSObject* object)
 198 {
 199     JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
 200     return JSONObject::create(vm, JSONObject::createStructure(vm, global, global->objectPrototype()));
 201 }
 202
 203 static JSValue createMathProperty(VM& vm, JSObject* object)
 204 {
 205     JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
 206     return MathObject::create(vm, global, MathObject::createStructure(vm, global, global->objectPrototype()));
 207 }
 208
 209 static JSValue createConsoleProperty(VM& vm, JSObject* object)
 210 {
 211     JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
 212     return ConsoleObject::create(vm, global, ConsoleObject::createStructure(vm, global, constructEmptyObject(global->globalExec())));
 213 }
 214
 215 static JSValue createAtomicsProperty(VM& vm, JSObject* object)
 216 {
 217     JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
 218     return AtomicsObject::create(vm, global, AtomicsObject::createStructure(vm, global, global->objectPrototype()));
 219 }
 220
 221 static EncodedJSValue JSC_HOST_CALL makeBoundFunction(ExecState* exec)
 222 {
 223     VM& vm = exec->vm();
 224     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
 225
 226     JSObject* target = asObject(exec->uncheckedArgument(0));
 227     JSValue boundThis = exec->uncheckedArgument(1);
 228     JSValue boundArgs = exec->uncheckedArgument(2);
 229     JSValue length = exec->uncheckedArgument(3);
 230     JSString* name = asString(exec->uncheckedArgument(4));
 231
 232     return JSValue::encode(JSBoundFunction::create(
 233         vm, exec, globalObject, target, boundThis, boundArgs.isCell() ? jsCast<JSArray*>(boundArgs) : nullptr, length.asInt32(), name->value(exec)));
 234 }
 235
 236 static EncodedJSValue JSC_HOST_CALL hasOwnLengthProperty(ExecState* exec)
 237 {
 238     VM& vm = exec->vm();
 239     JSObject* target = asObject(exec->uncheckedArgument(0));
 240     return JSValue::encode(jsBoolean(target->hasOwnProperty(exec, vm.propertyNames->length)));
 241 }
 242
 243 #if !ASSERT_DISABLED
 244 static EncodedJSValue JSC_HOST_CALL assertCall(ExecState* exec)
 245 {
 246     RELEASE_ASSERT(exec->argument(0).isBoolean());
 247     if (exec->argument(0).asBoolean())
 248         return JSValue::encode(jsUndefined());
 249
 250     bool iteratedOnce = false;
 251     CodeBlock* codeBlock = nullptr;
 252     unsigned line;
 253     exec->iterate([&] (StackVisitor& visitor) {
 254         if (!iteratedOnce) {
 255             iteratedOnce = true;
 256             return StackVisitor::Continue;
 257         }
 258
 259         RELEASE_ASSERT(visitor->hasLineAndColumnInfo());
 260         unsigned column;
 261         visitor->computeLineAndColumn(line, column);
 262         codeBlock = visitor->codeBlock();
 263         return StackVisitor::Done;
 264     });
 265     RELEASE_ASSERT(!!codeBlock);
 266     RELEASE_ASSERT_WITH_MESSAGE(false, "JS assertion failed at line %u in:\n%s\n", line, codeBlock->sourceCodeForTools().data());
 267     return JSValue::encode(jsUndefined());
 268 }
 269 #endif
 270
 271 } // namespace JSC
 272
 273 #include "JSGlobalObject.lut.h"
 274
 275 namespace JSC {
 276
 277 const ClassInfo JSGlobalObject::s_info = { "GlobalObject", &Base::s_info, &globalObjectTable, nullptr, CREATE_METHOD_TABLE(JSGlobalObject) };
 278
 279 const GlobalObjectMethodTable JSGlobalObject::s_globalObjectMethodTable = {
 280     &supportsRichSourceInfo,
 281     &shouldInterruptScript,
 282     &javaScriptRuntimeFlags,
 283     nullptr, // queueTaskToEventLoop
 284     &shouldInterruptScriptBeforeTimeout,
 285     nullptr, // moduleLoaderImportModule
 286     nullptr, // moduleLoaderResolve
 287     nullptr, // moduleLoaderFetch
 288     nullptr, // moduleLoaderCreateImportMetaProperties
 289     nullptr, // moduleLoaderEvaluate
 290     nullptr, // promiseRejectionTracker
 291     nullptr, // defaultLanguage
 292 };
 293
 294 /* Source for JSGlobalObject.lut.h
 295 @begin globalObjectTable
 296   isNaN                 JSBuiltin                                    DontEnum|Function 1
 297   isFinite              JSBuiltin                                    DontEnum|Function 1
 298   escape                globalFuncEscape                             DontEnum|Function 1
 299   unescape              globalFuncUnescape                           DontEnum|Function 1
 300   decodeURI             globalFuncDecodeURI                          DontEnum|Function 1
 301   decodeURIComponent    globalFuncDecodeURIComponent                 DontEnum|Function 1
 302   encodeURI             globalFuncEncodeURI                          DontEnum|Function 1
 303   encodeURIComponent    globalFuncEncodeURIComponent                 DontEnum|Function 1
 304   EvalError             JSGlobalObject::m_evalErrorConstructor       DontEnum|CellProperty
 305   ReferenceError        JSGlobalObject::m_referenceErrorConstructor  DontEnum|CellProperty
 306   SyntaxError           JSGlobalObject::m_syntaxErrorConstructor     DontEnum|CellProperty
 307   URIError              JSGlobalObject::m_URIErrorConstructor        DontEnum|CellProperty
 308   Proxy                 createProxyProperty                          DontEnum|PropertyCallback
 309   JSON                  createJSONProperty                           DontEnum|PropertyCallback
 310   Math                  createMathProperty                           DontEnum|PropertyCallback
 311   Atomics               createAtomicsProperty                        DontEnum|PropertyCallback
 312   console               createConsoleProperty                        DontEnum|PropertyCallback
 313   Int8Array             JSGlobalObject::m_typedArrayInt8             DontEnum|ClassStructure
 314   Int16Array            JSGlobalObject::m_typedArrayInt16            DontEnum|ClassStructure
 315   Int32Array            JSGlobalObject::m_typedArrayInt32            DontEnum|ClassStructure
 316   Uint8Array            JSGlobalObject::m_typedArrayUint8            DontEnum|ClassStructure
 317   Uint8ClampedArray     JSGlobalObject::m_typedArrayUint8Clamped     DontEnum|ClassStructure
 318   Uint16Array           JSGlobalObject::m_typedArrayUint16           DontEnum|ClassStructure
 319   Uint32Array           JSGlobalObject::m_typedArrayUint32           DontEnum|ClassStructure
 320   Float32Array          JSGlobalObject::m_typedArrayFloat32          DontEnum|ClassStructure
 321   Float64Array          JSGlobalObject::m_typedArrayFloat64          DontEnum|ClassStructure
 322   DataView              JSGlobalObject::m_typedArrayDataView         DontEnum|ClassStructure
 323   Date                  JSGlobalObject::m_dateStructure              DontEnum|ClassStructure
 324   Boolean               JSGlobalObject::m_booleanObjectStructure     DontEnum|ClassStructure
 325   Number                JSGlobalObject::m_numberObjectStructure      DontEnum|ClassStructure
 326   WeakMap               JSGlobalObject::m_weakMapStructure           DontEnum|ClassStructure
 327   WeakSet               JSGlobalObject::m_weakSetStructure           DontEnum|ClassStructure
 328 @end
 329 */
 330
 331 static EncodedJSValue JSC_HOST_CALL enqueueJob(ExecState* exec)
 332 {
 333     VM& vm = exec->vm();
 334     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
 335
 336     JSValue job = exec->argument(0);
 337     JSValue arguments = exec->argument(1);
 338     ASSERT(arguments.inherits(vm, JSArray::info()));
 339
 340     globalObject->queueMicrotask(createJSJob(vm, job, jsCast<JSArray*>(arguments)));
 341
 342     return JSValue::encode(jsUndefined());
 343 }
 344
 345 JSGlobalObject::JSGlobalObject(VM& vm, Structure* structure, const GlobalObjectMethodTable* globalObjectMethodTable)
 346     : Base(vm, structure, 0)
 347     , m_vm(vm)
 348     , m_masqueradesAsUndefinedWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
 349     , m_havingABadTimeWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
 350     , m_varInjectionWatchpoint(adoptRef(new WatchpointSet(IsWatched)))
 351     , m_weakRandom(Options::forceWeakRandomSeed() ? Options::forcedWeakRandomSeed() : static_cast<unsigned>(randomNumber() * (std::numeric_limits<unsigned>::max() + 1.0)))
 352     , m_arrayIteratorProtocolWatchpoint(IsWatched)
 353     , m_mapIteratorProtocolWatchpoint(IsWatched)
 354     , m_setIteratorProtocolWatchpoint(IsWatched)
 355     , m_stringIteratorProtocolWatchpoint(IsWatched)
 356     , m_mapSetWatchpoint(IsWatched)
 357     , m_setAddWatchpoint(IsWatched)
 358     , m_arraySpeciesWatchpoint(ClearWatchpoint)
 359     , m_numberToStringWatchpoint(IsWatched)
 360     , m_templateRegistry(vm)
 361     , m_runtimeFlags()
 362     , m_globalObjectMethodTable(globalObjectMethodTable ? globalObjectMethodTable : &s_globalObjectMethodTable)
 363 {
 364 }
 365
 366 JSGlobalObject::~JSGlobalObject()
 367 {
 368 #if ENABLE(REMOTE_INSPECTOR)
 369     m_inspectorController->globalObjectDestroyed();
 370 #endif
 371
 372     if (m_debugger)
 373         m_debugger->detach(this, Debugger::GlobalObjectIsDestructing);
 374 }
 375
 376 void JSGlobalObject::destroy(JSCell* cell)
 377 {
 378     static_cast<JSGlobalObject*>(cell)->JSGlobalObject::~JSGlobalObject();
 379 }
 380
 381 void JSGlobalObject::setGlobalThis(VM& vm, JSObject* globalThis)
 382 {
 383     m_globalThis.set(vm, this, globalThis);
 384 }
 385
 386 static JSObject* getGetterById(ExecState* exec, JSObject* base, const Identifier& ident)
 387 {
 388     JSValue baseValue = JSValue(base);
 389     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
 390     baseValue.getPropertySlot(exec, ident, slot);
 391     return slot.getPureResult().toObject(exec);
 392 }
 393
 394 void JSGlobalObject::init(VM& vm)
 395 {
 396     ASSERT(vm.currentThreadIsHoldingAPILock());
 397     auto catchScope = DECLARE_CATCH_SCOPE(vm);
 398
 399     Base::setStructure(vm, Structure::toCacheableDictionaryTransition(vm, structure()));
 400
 401     m_debugger = 0;
 402
 403 #if ENABLE(REMOTE_INSPECTOR)
 404     m_inspectorController = std::make_unique<Inspector::JSGlobalObjectInspectorController>(*this);
 405     m_inspectorDebuggable = std::make_unique<JSGlobalObjectDebuggable>(*this);
 406     m_inspectorDebuggable->init();
 407     m_consoleClient = m_inspectorController->consoleClient();
 408 #endif
 409
 410     m_functionPrototype.set(vm, this, FunctionPrototype::create(vm, FunctionPrototype::createStructure(vm, this, jsNull()))); // The real prototype will be set once ObjectPrototype is created.
 411     m_calleeStructure.set(vm, this, JSCallee::createStructure(vm, this, jsNull()));
 412
 413     m_globalLexicalEnvironment.set(vm, this, JSGlobalLexicalEnvironment::create(vm, JSGlobalLexicalEnvironment::createStructure(vm, this), this));
 414     // Need to create the callee structure (above) before creating the callee.
 415     JSCallee* globalCallee = JSCallee::create(vm, this, globalScope());
 416     m_globalCallee.set(vm, this, globalCallee);
 417
 418     ExecState::initGlobalExec(JSGlobalObject::globalExec(), globalCallee);
 419     ExecState* exec = JSGlobalObject::globalExec();
 420
 421     m_strictFunctionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
 422     m_sloppyFunctionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
 423     m_arrowFunctionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
 424     m_customGetterSetterFunctionStructure.initLater(
 425         [] (const Initializer<Structure>& init) {
 426             init.set(JSCustomGetterSetterFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
 427         });
 428     m_boundFunctionStructure.initLater(
 429         [] (const Initializer<Structure>& init) {
 430             init.set(JSBoundFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
 431         });
 432     m_getterSetterStructure.set(vm, this, GetterSetter::createStructure(vm, this, jsNull()));
 433     m_nativeStdFunctionStructure.initLater(
 434         [] (const Initializer<Structure>& init) {
 435             init.set(JSNativeStdFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
 436         });
 437     JSFunction* callFunction = nullptr;
 438     JSFunction* applyFunction = nullptr;
 439     JSFunction* hasInstanceSymbolFunction = nullptr;
 440     m_functionPrototype->addFunctionProperties(exec, this, &callFunction, &applyFunction, &hasInstanceSymbolFunction);
 441     m_callFunction.set(vm, this, callFunction);
 442     m_applyFunction.set(vm, this, applyFunction);
 443     m_arrayProtoToStringFunction.initLater(
 444         [] (const Initializer<JSFunction>& init) {
 445             init.set(JSFunction::create(init.vm, init.owner, 0, init.vm.propertyNames->toString.string(), arrayProtoFuncToString, NoIntrinsic));
 446         });
 447     m_arrayProtoValuesFunction.initLater(
 448         [] (const Initializer<JSFunction>& init) {
 449             init.set(JSFunction::create(init.vm, arrayPrototypeValuesCodeGenerator(init.vm), init.owner));
 450         });
 451     m_initializePromiseFunction.initLater(
 452         [] (const Initializer<JSFunction>& init) {
 453             init.set(JSFunction::create(init.vm, promiseOperationsInitializePromiseCodeGenerator(init.vm), init.owner));
 454         });
 455
 456     m_iteratorProtocolFunction.initLater(
 457         [] (const Initializer<JSFunction>& init) {
 458             init.set(JSFunction::create(init.vm, iteratorHelpersPerformIterationCodeGenerator(init.vm), init.owner));
 459         });
 460
 461     m_promiseResolveFunction.initLater(
 462         [] (const Initializer<JSFunction>& init) {
 463             init.set(JSFunction::create(init.vm, promiseConstructorResolveCodeGenerator(init.vm), init.owner));
 464         });
 465
 466     m_newPromiseCapabilityFunction.set(vm, this, JSFunction::create(vm, promiseOperationsNewPromiseCapabilityCodeGenerator(vm), this));
 467     m_functionProtoHasInstanceSymbolFunction.set(vm, this, hasInstanceSymbolFunction);
 468     m_throwTypeErrorGetterSetter.initLater(
 469         [] (const Initializer<GetterSetter>& init) {
 470             JSFunction* thrower = init.owner->throwTypeErrorFunction();
 471             GetterSetter* getterSetter = GetterSetter::create(init.vm, init.owner);
 472             getterSetter->setGetter(init.vm, init.owner, thrower);
 473             getterSetter->setSetter(init.vm, init.owner, thrower);
 474             init.set(getterSetter);
 475         });
 476
 477     m_nullGetterFunction.set(vm, this, NullGetterFunction::create(vm, NullGetterFunction::createStructure(vm, this, m_functionPrototype.get())));
 478     m_nullSetterFunction.set(vm, this, NullSetterFunction::create(vm, NullSetterFunction::createStructure(vm, this, m_functionPrototype.get())));
 479     m_objectPrototype.set(vm, this, ObjectPrototype::create(vm, this, ObjectPrototype::createStructure(vm, this, jsNull())));
 480     GetterSetter* protoAccessor = GetterSetter::create(vm, this);
 481     protoAccessor->setGetter(vm, this, JSFunction::create(vm, this, 0, makeString("get ", vm.propertyNames->underscoreProto.string()), globalFuncProtoGetter, UnderscoreProtoIntrinsic));
 482     protoAccessor->setSetter(vm, this, JSFunction::create(vm, this, 0, makeString("set ", vm.propertyNames->underscoreProto.string()), globalFuncProtoSetter));
 483     m_objectPrototype->putDirectNonIndexAccessor(vm, vm.propertyNames->underscoreProto, protoAccessor, PropertyAttribute::Accessor | PropertyAttribute::DontEnum);
 484     m_functionPrototype->structure()->setPrototypeWithoutTransition(vm, m_objectPrototype.get());
 485     m_objectStructureForObjectConstructor.set(vm, this, vm.structureCache.emptyObjectStructureForPrototype(this, m_objectPrototype.get(), JSFinalObject::defaultInlineCapacity()));
 486     m_objectProtoValueOfFunction.set(vm, this, jsCast<JSFunction*>(objectPrototype()->getDirect(vm, vm.propertyNames->valueOf)));
 487
 488     JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeErrorArgumentsCalleeAndCaller);
 489     GetterSetter* getterSetter = GetterSetter::create(vm, this);
 490     getterSetter->setGetter(vm, this, thrower);
 491     getterSetter->setSetter(vm, this, thrower);
 492     m_throwTypeErrorArgumentsCalleeAndCallerGetterSetter.set(vm, this, getterSetter);
 493
 494     m_functionPrototype->initRestrictedProperties(exec, this);
 495
 496     m_speciesGetterSetter.set(vm, this, GetterSetter::create(vm, this));
 497     m_speciesGetterSetter->setGetter(vm, this, JSFunction::create(vm, globalOperationsSpeciesGetterCodeGenerator(vm), this));
 498
 499     m_typedArrayProto.initLater(
 500         [] (const Initializer<JSTypedArrayViewPrototype>& init) {
 501             init.set(JSTypedArrayViewPrototype::create(init.vm, init.owner, JSTypedArrayViewPrototype::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get())));
 502
 503             // Make sure that the constructor gets initialized, too.
 504             init.owner->m_typedArraySuperConstructor.get(init.owner);
 505         });
 506     m_typedArraySuperConstructor.initLater(
 507         [] (const Initializer<JSTypedArrayViewConstructor>& init) {
 508             JSTypedArrayViewPrototype* prototype = init.owner->m_typedArrayProto.get(init.owner);
 509             JSTypedArrayViewConstructor* constructor = JSTypedArrayViewConstructor::create(init.vm, init.owner, JSTypedArrayViewConstructor::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()), prototype, init.owner->m_speciesGetterSetter.get());
 510             prototype->putDirectWithoutTransition(init.vm, init.vm.propertyNames->constructor, constructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 511             init.set(constructor);
 512         });
 513
 514 #define INIT_TYPED_ARRAY_LATER(type) \
 515     m_typedArray ## type.initLater( \
 516         [] (LazyClassStructure::Initializer& init) { \
 517             init.setPrototype(JS ## type ## ArrayPrototype::create(init.vm, init.global, JS ## type ## ArrayPrototype::createStructure(init.vm, init.global, init.global->m_typedArrayProto.get(init.global)))); \
 518             init.setStructure(JS ## type ## Array::createStructure(init.vm, init.global, init.prototype)); \
 519             init.setConstructor(JS ## type ## ArrayConstructor::create(init.vm, init.global, JS ## type ## ArrayConstructor::createStructure(init.vm, init.global, init.global->m_typedArraySuperConstructor.get(init.global)), init.prototype, ASCIILiteral(#type "Array"), typedArrayConstructorAllocate ## type ## ArrayCodeGenerator(init.vm))); \
 520             init.global->putDirectWithoutTransition(init.vm, init.vm.propertyNames->builtinNames().type ## ArrayPrivateName(), init.constructor, static_cast<unsigned>(PropertyAttribute::DontEnum)); \
 521         });
 522     FOR_EACH_TYPED_ARRAY_TYPE_EXCLUDING_DATA_VIEW(INIT_TYPED_ARRAY_LATER)
 523 #undef INIT_TYPED_ARRAY_LATER
 524
 525     m_typedArrayDataView.initLater(
 526         [] (LazyClassStructure::Initializer& init) {
 527             init.setPrototype(JSDataViewPrototype::create(init.vm, JSDataViewPrototype::createStructure(init.vm, init.global, init.global->m_objectPrototype.get())));
 528             init.setStructure(JSDataView::createStructure(init.vm, init.global, init.prototype));
 529             init.setConstructor(JSDataViewConstructor::create(init.vm, init.global, JSDataViewConstructor::createStructure(init.vm, init.global, init.global->m_functionPrototype.get()), init.prototype, ASCIILiteral("DataView"), nullptr));
 530         });
 531
 532     m_lexicalEnvironmentStructure.set(vm, this, JSLexicalEnvironment::createStructure(vm, this));
 533     m_moduleEnvironmentStructure.initLater(
 534         [] (const Initializer<Structure>& init) {
 535             init.set(JSModuleEnvironment::createStructure(init.vm, init.owner));
 536         });
 537     m_strictEvalActivationStructure.set(vm, this, StrictEvalActivation::createStructure(vm, this, jsNull()));
 538     m_debuggerScopeStructure.initLater(
 539         [] (const Initializer<Structure>& init) {
 540             init.set(DebuggerScope::createStructure(init.vm, init.owner));
 541         });
 542     m_withScopeStructure.initLater(
 543         [] (const Initializer<Structure>& init) {
 544             init.set(JSWithScope::createStructure(init.vm, init.owner, jsNull()));
 545         });
 546
 547     m_nullPrototypeObjectStructure.initLater(
 548         [] (const Initializer<Structure>& init) {
 549             init.set(JSFinalObject::createStructure(init.vm, init.owner, jsNull(), JSFinalObject::defaultInlineCapacity()));
 550         });
 551
 552     m_callbackFunctionStructure.initLater(
 553         [] (const Initializer<Structure>& init) {
 554             init.set(JSCallbackFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
 555         });
 556     m_directArgumentsStructure.set(vm, this, DirectArguments::createStructure(vm, this, m_objectPrototype.get()));
 557     m_scopedArgumentsStructure.set(vm, this, ScopedArguments::createStructure(vm, this, m_objectPrototype.get()));
 558     m_clonedArgumentsStructure.set(vm, this, ClonedArguments::createStructure(vm, this, m_objectPrototype.get()));
 559     m_callbackConstructorStructure.initLater(
 560         [] (const Initializer<Structure>& init) {
 561             init.set(JSCallbackConstructor::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
 562         });
 563     m_callbackObjectStructure.initLater(
 564         [] (const Initializer<Structure>& init) {
 565             init.set(JSCallbackObject<JSDestructibleObject>::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
 566         });
 567
 568 #if JSC_OBJC_API_ENABLED
 569     m_objcCallbackFunctionStructure.initLater(
 570         [] (const Initializer<Structure>& init) {
 571             init.set(ObjCCallbackFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
 572         });
 573     m_objcWrapperObjectStructure.initLater(
 574         [] (const Initializer<Structure>& init) {
 575             init.set(JSCallbackObject<JSAPIWrapperObject>::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
 576         });
 577 #endif
 578
 579     m_arrayPrototype.set(vm, this, ArrayPrototype::create(vm, this, ArrayPrototype::createStructure(vm, this, m_objectPrototype.get())));
 580
 581     m_originalArrayStructureForIndexingShape[UndecidedShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithUndecided));
 582     m_originalArrayStructureForIndexingShape[Int32Shape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithInt32));
 583     m_originalArrayStructureForIndexingShape[DoubleShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithDouble));
 584     m_originalArrayStructureForIndexingShape[ContiguousShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithContiguous));
 585     m_originalArrayStructureForIndexingShape[ArrayStorageShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithArrayStorage));
 586     m_originalArrayStructureForIndexingShape[SlowPutArrayStorageShape >> IndexingShapeShift].set(vm, this, JSArray::createStructure(vm, this, m_arrayPrototype.get(), ArrayWithSlowPutArrayStorage));
 587     for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
 588         m_arrayStructureForIndexingShapeDuringAllocation[i] = m_originalArrayStructureForIndexingShape[i];
 589
 590     m_regExpPrototype.set(vm, this, RegExpPrototype::create(vm, this, RegExpPrototype::createStructure(vm, this, m_objectPrototype.get())));
 591     m_regExpStructure.set(vm, this, RegExpObject::createStructure(vm, this, m_regExpPrototype.get()));
 592     m_regExpMatchesArrayStructure.set(vm, this, createRegExpMatchesArrayStructure(vm, this));
 593     m_regExpMatchesArrayWithGroupsStructure.set(vm, this, createRegExpMatchesArrayWithGroupsStructure(vm, this));
 594
 595     m_moduleRecordStructure.set(vm, this, JSModuleRecord::createStructure(vm, this, jsNull()));
 596     m_moduleNamespaceObjectStructure.set(vm, this, JSModuleNamespaceObject::createStructure(vm, this, jsNull()));
 597     {
 598         bool isCallable = false;
 599         m_proxyObjectStructure.set(vm, this, ProxyObject::createStructure(vm, this, jsNull(), isCallable));
 600         isCallable = true;
 601         m_callableProxyObjectStructure.set(vm, this, ProxyObject::createStructure(vm, this, jsNull(), isCallable));
 602     }
 603     m_proxyRevokeStructure.set(vm, this, ProxyRevoke::createStructure(vm, this, m_functionPrototype.get()));
 604
 605     m_parseIntFunction.set(vm, this, JSFunction::create(vm, this, 2, vm.propertyNames->parseInt.string(), globalFuncParseInt, ParseIntIntrinsic));
 606     putDirectWithoutTransition(vm, vm.propertyNames->parseInt, m_parseIntFunction.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 607     m_parseFloatFunction.set(vm, this, JSFunction::create(vm, this, 1, vm.propertyNames->parseFloat.string(), globalFuncParseFloat, NoIntrinsic));
 608     putDirectWithoutTransition(vm, vm.propertyNames->parseFloat, m_parseFloatFunction.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 609
 610     m_arrayBufferPrototype.set(vm, this, JSArrayBufferPrototype::create(vm, this, JSArrayBufferPrototype::createStructure(vm, this, m_objectPrototype.get()), ArrayBufferSharingMode::Default));
 611     m_arrayBufferStructure.set(vm, this, JSArrayBuffer::createStructure(vm, this, m_arrayBufferPrototype.get()));
 612 #if ENABLE(SHARED_ARRAY_BUFFER)
 613     m_sharedArrayBufferPrototype.set(vm, this, JSArrayBufferPrototype::create(vm, this, JSArrayBufferPrototype::createStructure(vm, this, m_objectPrototype.get()), ArrayBufferSharingMode::Shared));
 614     m_sharedArrayBufferStructure.set(vm, this, JSArrayBuffer::createStructure(vm, this, m_sharedArrayBufferPrototype.get()));
 615 #endif
 616
 617     m_iteratorPrototype.set(vm, this, IteratorPrototype::create(vm, this, IteratorPrototype::createStructure(vm, this, m_objectPrototype.get())));
 618     m_asyncIteratorPrototype.set(vm, this, AsyncIteratorPrototype::create(vm, this, AsyncIteratorPrototype::createStructure(vm, this, m_objectPrototype.get())));
 619
 620     m_generatorPrototype.set(vm, this, GeneratorPrototype::create(vm, this, GeneratorPrototype::createStructure(vm, this, m_iteratorPrototype.get())));
 621     m_asyncGeneratorPrototype.set(vm, this, AsyncGeneratorPrototype::create(vm, this, AsyncGeneratorPrototype::createStructure(vm, this, m_asyncIteratorPrototype.get())));
 622
 623 #define CREATE_PROTOTYPE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
 624 m_ ## lowerName ## Prototype.set(vm, this, capitalName##Prototype::create(vm, this, capitalName##Prototype::createStructure(vm, this, m_ ## prototypeBase ## Prototype.get()))); \
 625 m_ ## properName ## Structure.set(vm, this, instanceType::createStructure(vm, this, m_ ## lowerName ## Prototype.get()));
 626
 627     FOR_EACH_SIMPLE_BUILTIN_TYPE(CREATE_PROTOTYPE_FOR_SIMPLE_TYPE)
 628
 629     if (UNLIKELY(Options::useBigInt()))
 630         FOR_BIG_INT_BUILTIN_TYPE_WITH_CONSTRUCTOR(CREATE_PROTOTYPE_FOR_SIMPLE_TYPE)
 631
 632     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(CREATE_PROTOTYPE_FOR_SIMPLE_TYPE)
 633
 634 #undef CREATE_PROTOTYPE_FOR_SIMPLE_TYPE
 635
 636 #define CREATE_PROTOTYPE_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
 637     m_ ## properName ## Structure.initLater(\
 638         [] (LazyClassStructure::Initializer& init) { \
 639             init.setPrototype(capitalName##Prototype::create(init.vm, init.global, capitalName##Prototype::createStructure(init.vm, init.global, init.global->m_ ## prototypeBase ## Prototype.get()))); \
 640             init.setStructure(instanceType::createStructure(init.vm, init.global, init.prototype)); \
 641             init.setConstructor(capitalName ## Constructor::create(init.vm, capitalName ## Constructor::createStructure(init.vm, init.global, init.global->m_functionPrototype.get()), jsCast<capitalName ## Prototype*>(init.prototype), init.global->m_speciesGetterSetter.get())); \
 642         });
 643
 644     FOR_EACH_LAZY_BUILTIN_TYPE(CREATE_PROTOTYPE_FOR_LAZY_TYPE)
 645
 646 #undef CREATE_PROTOTYPE_FOR_LAZY_TYPE
 647
 648     m_moduleLoaderPrototype.set(vm, this, ModuleLoaderPrototype::create(vm, this, ModuleLoaderPrototype::createStructure(vm, this, m_objectPrototype.get())));
 649
 650     // Constructors
 651
 652     ObjectConstructor* objectConstructor = ObjectConstructor::create(vm, this, ObjectConstructor::createStructure(vm, this, m_functionPrototype.get()), m_objectPrototype.get());
 653     m_objectConstructor.set(vm, this, objectConstructor);
 654
 655     JSFunction* throwTypeErrorFunction = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeError);
 656     m_throwTypeErrorFunction.set(vm, this, throwTypeErrorFunction);
 657
 658     JSCell* functionConstructor = FunctionConstructor::create(vm, FunctionConstructor::createStructure(vm, this, m_functionPrototype.get()), m_functionPrototype.get());
 659
 660     ArrayConstructor* arrayConstructor = ArrayConstructor::create(vm, this, ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_arrayPrototype.get(), m_speciesGetterSetter.get());
 661     m_arrayConstructor.set(vm, this, arrayConstructor);
 662
 663     m_regExpConstructor.set(vm, this, RegExpConstructor::create(vm, RegExpConstructor::createStructure(vm, this, m_functionPrototype.get()), m_regExpPrototype.get(), m_speciesGetterSetter.get()));
 664
 665     JSArrayBufferConstructor* arrayBufferConstructor = JSArrayBufferConstructor::create(vm, JSArrayBufferConstructor::createStructure(vm, this, m_functionPrototype.get()), m_arrayBufferPrototype.get(), m_speciesGetterSetter.get(), ArrayBufferSharingMode::Default);
 666     m_arrayBufferPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, arrayBufferConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 667 #if ENABLE(SHARED_ARRAY_BUFFER)
 668     JSArrayBufferConstructor* sharedArrayBufferConstructor = nullptr;
 669     sharedArrayBufferConstructor = JSArrayBufferConstructor::create(vm, JSArrayBufferConstructor::createStructure(vm, this, m_functionPrototype.get()), m_sharedArrayBufferPrototype.get(), m_speciesGetterSetter.get(), ArrayBufferSharingMode::Shared);
 670     m_sharedArrayBufferPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, sharedArrayBufferConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 671 #endif
 672 #define CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
 673 capitalName ## Constructor* lowerName ## Constructor = capitalName ## Constructor::create(vm, capitalName ## Constructor::createStructure(vm, this, m_functionPrototype.get()), m_ ## lowerName ## Prototype.get(), m_speciesGetterSetter.get()); \
 674 m_ ## lowerName ## Prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, lowerName ## Constructor, static_cast<unsigned>(PropertyAttribute::DontEnum)); \
 675
 676     FOR_EACH_SIMPLE_BUILTIN_TYPE(CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE)
 677     BigIntConstructor* bigIntConstructor = nullptr;
 678     if (UNLIKELY(Options::useBigInt())) {
 679         bigIntConstructor = BigIntConstructor::create(vm, BigIntConstructor::createStructure(vm, this, m_functionPrototype.get()), m_bigIntPrototype.get(), m_speciesGetterSetter.get());
 680         m_bigIntPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, bigIntConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 681     }
 682
 683 #undef CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE
 684
 685     m_errorConstructor.set(vm, this, errorConstructor);
 686     m_promiseConstructor.set(vm, this, promiseConstructor);
 687     m_internalPromiseConstructor.set(vm, this, internalPromiseConstructor);
 688
 689     m_nativeErrorPrototypeStructure.set(vm, this, NativeErrorPrototype::createStructure(vm, this, m_errorPrototype.get()));
 690     m_nativeErrorStructure.set(vm, this, NativeErrorConstructor::createStructure(vm, this, errorConstructor));
 691     m_evalErrorConstructor.initLater(
 692         [] (const Initializer<NativeErrorConstructor>& init) {
 693             init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("EvalError")));
 694         });
 695     m_rangeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, m_nativeErrorStructure.get(), m_nativeErrorPrototypeStructure.get(), ASCIILiteral("RangeError")));
 696     m_referenceErrorConstructor.initLater(
 697         [] (const Initializer<NativeErrorConstructor>& init) {
 698             init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("ReferenceError")));
 699         });
 700     m_syntaxErrorConstructor.initLater(
 701         [] (const Initializer<NativeErrorConstructor>& init) {
 702             init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("SyntaxError")));
 703         });
 704     m_typeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, m_nativeErrorStructure.get(), m_nativeErrorPrototypeStructure.get(), ASCIILiteral("TypeError")));
 705     m_URIErrorConstructor.initLater(
 706         [] (const Initializer<NativeErrorConstructor>& init) {
 707             init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("URIError")));
 708         });
 709
 710     m_generatorFunctionPrototype.set(vm, this, GeneratorFunctionPrototype::create(vm, GeneratorFunctionPrototype::createStructure(vm, this, m_functionPrototype.get())));
 711     GeneratorFunctionConstructor* generatorFunctionConstructor = GeneratorFunctionConstructor::create(vm, GeneratorFunctionConstructor::createStructure(vm, this, functionConstructor), m_generatorFunctionPrototype.get());
 712     m_generatorFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, generatorFunctionConstructor, PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 713     m_generatorFunctionStructure.set(vm, this, JSGeneratorFunction::createStructure(vm, this, m_generatorFunctionPrototype.get()));
 714
 715     m_generatorPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_generatorFunctionPrototype.get(), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 716     m_generatorFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->prototype, m_generatorPrototype.get(), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 717
 718     m_asyncFunctionPrototype.set(vm, this, AsyncFunctionPrototype::create(vm, AsyncFunctionPrototype::createStructure(vm, this, m_functionPrototype.get())));
 719     AsyncFunctionConstructor* asyncFunctionConstructor = AsyncFunctionConstructor::create(vm, AsyncFunctionConstructor::createStructure(vm, this, functionConstructor), m_asyncFunctionPrototype.get());
 720     m_asyncFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, asyncFunctionConstructor, PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 721     m_asyncFunctionStructure.set(vm, this, JSAsyncFunction::createStructure(vm, this, m_asyncFunctionPrototype.get()));
 722
 723     m_asyncGeneratorFunctionPrototype.set(vm, this, AsyncGeneratorFunctionPrototype::create(vm, AsyncGeneratorFunctionPrototype::createStructure(vm, this, m_functionPrototype.get())));
 724     AsyncGeneratorFunctionConstructor* asyncGeneratorFunctionConstructor = AsyncGeneratorFunctionConstructor::create(vm, AsyncGeneratorFunctionConstructor::createStructure(vm, this, functionConstructor), m_asyncGeneratorFunctionPrototype.get());
 725     m_asyncGeneratorFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, asyncGeneratorFunctionConstructor, PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 726     m_asyncGeneratorFunctionStructure.set(vm, this, JSAsyncGeneratorFunction::createStructure(vm, this, m_asyncGeneratorFunctionPrototype.get()));
 727
 728     m_asyncGeneratorPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_asyncGeneratorFunctionPrototype.get(), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 729     m_asyncGeneratorFunctionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->prototype, m_asyncGeneratorPrototype.get(), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 730
 731
 732     m_objectPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, objectConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 733     m_functionPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, functionConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 734     m_arrayPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, arrayConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 735     m_regExpPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_regExpConstructor.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 736
 737     putDirectWithoutTransition(vm, vm.propertyNames->Object, objectConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 738     putDirectWithoutTransition(vm, vm.propertyNames->Function, functionConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 739     putDirectWithoutTransition(vm, vm.propertyNames->Array, arrayConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 740     putDirectWithoutTransition(vm, vm.propertyNames->RegExp, m_regExpConstructor.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 741     putDirectWithoutTransition(vm, vm.propertyNames->RangeError, m_rangeErrorConstructor.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 742     putDirectWithoutTransition(vm, vm.propertyNames->TypeError, m_typeErrorConstructor.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 743
 744     putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().ObjectPrivateName(), objectConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
 745     putDirectWithoutTransition(vm, vm.propertyNames->builtinNames().ArrayPrivateName(), arrayConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
 746
 747     putDirectWithoutTransition(vm, vm.propertyNames->ArrayBuffer, arrayBufferConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 748 #if ENABLE(SHARED_ARRAY_BUFFER)
 749     putDirectWithoutTransition(vm, vm.propertyNames->SharedArrayBuffer, sharedArrayBufferConstructor, static_cast<unsigned>(PropertyAttribute::DontEnum));
 750 #endif
 751
 752 #define PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
 753 putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Constructor, static_cast<unsigned>(PropertyAttribute::DontEnum)); \
 754
 755     FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR(PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE)
 756     if (UNLIKELY(Options::useBigInt()))
 757         FOR_BIG_INT_BUILTIN_TYPE_WITH_CONSTRUCTOR(PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE)
 758
 759 #undef PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE
 760     m_iteratorResultObjectStructure.set(vm, this, createIteratorResultObjectStructure(vm, *this));
 761
 762     m_evalFunction.set(vm, this, JSFunction::create(vm, this, 1, vm.propertyNames->eval.string(), globalFuncEval));
 763     putDirectWithoutTransition(vm, vm.propertyNames->eval, m_evalFunction.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 764
 765 #if ENABLE(INTL)
 766     IntlObject* intl = IntlObject::create(vm, this, IntlObject::createStructure(vm, this, m_objectPrototype.get()));
 767     putDirectWithoutTransition(vm, vm.propertyNames->Intl, intl, static_cast<unsigned>(PropertyAttribute::DontEnum));
 768 #endif // ENABLE(INTL)
 769     ReflectObject* reflectObject = ReflectObject::create(vm, this, ReflectObject::createStructure(vm, this, m_objectPrototype.get()));
 770     putDirectWithoutTransition(vm, vm.propertyNames->Reflect, reflectObject, static_cast<unsigned>(PropertyAttribute::DontEnum));
 771
 772     m_moduleLoaderStructure.set(vm, this, JSModuleLoader::createStructure(vm, this, m_moduleLoaderPrototype.get()));
 773     m_moduleLoader.set(vm, this, JSModuleLoader::create(globalExec(), vm, this, m_moduleLoaderStructure.get()));
 774     if (Options::exposeInternalModuleLoader())
 775         putDirectWithoutTransition(vm, vm.propertyNames->Loader, m_moduleLoader.get(), static_cast<unsigned>(PropertyAttribute::DontEnum));
 776
 777     JSFunction* builtinLog = JSFunction::create(vm, this, 1, vm.propertyNames->emptyIdentifier.string(), globalFuncBuiltinLog);
 778
 779     JSFunction* privateFuncAbs = JSFunction::create(vm, this, 0, String(), mathProtoFuncAbs, AbsIntrinsic);
 780     JSFunction* privateFuncFloor = JSFunction::create(vm, this, 0, String(), mathProtoFuncFloor, FloorIntrinsic);
 781     JSFunction* privateFuncTrunc = JSFunction::create(vm, this, 0, String(), mathProtoFuncTrunc, TruncIntrinsic);
 782
 783     JSFunction* privateFuncGetOwnPropertyNames = JSFunction::create(vm, this, 0, String(), objectConstructorGetOwnPropertyNames);
 784     JSFunction* privateFuncPropertyIsEnumerable = JSFunction::create(vm, this, 0, String(), globalFuncPropertyIsEnumerable);
 785     JSFunction* privateFuncImportModule = JSFunction::create(vm, this, 0, String(), globalFuncImportModule);
 786     JSFunction* privateFuncTypedArrayLength = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncLength);
 787     JSFunction* privateFuncTypedArrayGetOriginalConstructor = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncGetOriginalConstructor);
 788     JSFunction* privateFuncTypedArraySort = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncSort);
 789     JSFunction* privateFuncIsTypedArrayView = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncIsTypedArrayView, IsTypedArrayViewIntrinsic);
 790     JSFunction* privateFuncTypedArraySubarrayCreate = JSFunction::create(vm, this, 0, String(), typedArrayViewPrivateFuncSubarrayCreate);
 791     JSFunction* privateFuncIsBoundFunction = JSFunction::create(vm, this, 0, String(), isBoundFunction);
 792     JSFunction* privateFuncHasInstanceBoundFunction = JSFunction::create(vm, this, 0, String(), hasInstanceBoundFunction);
 793     JSFunction* privateFuncInstanceOf = JSFunction::create(vm, this, 0, String(), objectPrivateFuncInstanceOf);
 794     JSFunction* privateFuncThisTimeValue = JSFunction::create(vm, this, 0, String(), dateProtoFuncGetTime);
 795     JSFunction* privateFuncThisNumberValue = JSFunction::create(vm, this, 0, String(), numberProtoFuncValueOf);
 796     JSFunction* privateFuncIsArrayConstructor = JSFunction::create(vm, this, 0, String(), arrayConstructorPrivateFuncIsArrayConstructor);
 797     JSFunction* privateFuncIsArraySlow = JSFunction::create(vm, this, 0, String(), arrayConstructorPrivateFuncIsArraySlow);
 798     JSFunction* privateFuncConcatMemcpy = JSFunction::create(vm, this, 0, String(), arrayProtoPrivateFuncConcatMemcpy);
 799     JSFunction* privateFuncAppendMemcpy = JSFunction::create(vm, this, 0, String(), arrayProtoPrivateFuncAppendMemcpy);
 800     JSFunction* privateFuncMapBucketHead = JSFunction::create(vm, this, 0, String(), mapPrivateFuncMapBucketHead, JSMapBucketHeadIntrinsic);
 801     JSFunction* privateFuncMapBucketNext = JSFunction::create(vm, this, 0, String(), mapPrivateFuncMapBucketNext, JSMapBucketNextIntrinsic);
 802     JSFunction* privateFuncMapBucketKey = JSFunction::create(vm, this, 0, String(), mapPrivateFuncMapBucketKey, JSMapBucketKeyIntrinsic);
 803     JSFunction* privateFuncMapBucketValue = JSFunction::create(vm, this, 0, String(), mapPrivateFuncMapBucketValue, JSMapBucketValueIntrinsic);
 804     JSFunction* privateFuncSetBucketHead = JSFunction::create(vm, this, 0, String(), setPrivateFuncSetBucketHead, JSSetBucketHeadIntrinsic);
 805     JSFunction* privateFuncSetBucketNext = JSFunction::create(vm, this, 0, String(), setPrivateFuncSetBucketNext, JSSetBucketNextIntrinsic);
 806     JSFunction* privateFuncSetBucketKey = JSFunction::create(vm, this, 0, String(), setPrivateFuncSetBucketKey, JSSetBucketKeyIntrinsic);
 807
 808     JSObject* regExpProtoFlagsGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->flags);
 809     catchScope.assertNoException();
 810     JSObject* regExpProtoGlobalGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->global);
 811     catchScope.assertNoException();
 812     m_regExpProtoGlobalGetter.set(vm, this, regExpProtoGlobalGetterObject);
 813     JSObject* regExpProtoIgnoreCaseGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->ignoreCase);
 814     catchScope.assertNoException();
 815     JSObject* regExpProtoMultilineGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->multiline);
 816     catchScope.assertNoException();
 817     JSObject* regExpProtoSourceGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->source);
 818     catchScope.assertNoException();
 819     JSObject* regExpProtoStickyGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->sticky);
 820     catchScope.assertNoException();
 821     JSObject* regExpProtoUnicodeGetterObject = getGetterById(exec, m_regExpPrototype.get(), vm.propertyNames->unicode);
 822     catchScope.assertNoException();
 823     m_regExpProtoUnicodeGetter.set(vm, this, regExpProtoUnicodeGetterObject);
 824     JSObject* builtinRegExpExec = asObject(m_regExpPrototype->getDirect(vm, vm.propertyNames->exec).asCell());
 825     m_regExpProtoExec.set(vm, this, builtinRegExpExec);
 826     JSObject* regExpSymbolReplace = asObject(m_regExpPrototype->getDirect(vm, vm.propertyNames->replaceSymbol).asCell());
 827     m_regExpProtoSymbolReplace.set(vm, this, regExpSymbolReplace);
 828
 829 #define CREATE_PRIVATE_GLOBAL_FUNCTION(name, code) JSFunction* name ## PrivateFunction = JSFunction::create(vm, code ## CodeGenerator(vm), this);
 830     JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(CREATE_PRIVATE_GLOBAL_FUNCTION)
 831 #undef CREATE_PRIVATE_GLOBAL_FUNCTION
 832
 833     JSObject* arrayIteratorPrototype = ArrayIteratorPrototype::create(vm, this, ArrayIteratorPrototype::createStructure(vm, this, m_iteratorPrototype.get()));
 834     createArrayIteratorPrivateFunction->putDirect(vm, vm.propertyNames->prototype, arrayIteratorPrototype);
 835
 836     JSObject* asyncFromSyncIteratorPrototype = AsyncFromSyncIteratorPrototype::create(vm, this, AsyncFromSyncIteratorPrototype::createStructure(vm, this, m_iteratorPrototype.get()));
 837     AsyncFromSyncIteratorConstructorPrivateFunction->putDirect(vm, vm.propertyNames->prototype, asyncFromSyncIteratorPrototype);
 838
 839     JSObject* mapIteratorPrototype = MapIteratorPrototype::create(vm, this, MapIteratorPrototype::createStructure(vm, this, m_iteratorPrototype.get()));
 840     createMapIteratorPrivateFunction->putDirect(vm, vm.propertyNames->prototype, mapIteratorPrototype);
 841
 842     JSObject* setIteratorPrototype = SetIteratorPrototype::create(vm, this, SetIteratorPrototype::createStructure(vm, this, m_iteratorPrototype.get()));
 843     createSetIteratorPrivateFunction->putDirect(vm, vm.propertyNames->prototype, setIteratorPrototype);
 844
 845     GlobalPropertyInfo staticGlobals[] = {
 846 #define INIT_PRIVATE_GLOBAL(name, code) GlobalPropertyInfo(vm.propertyNames->builtinNames().name ## PrivateName(), name ## PrivateFunction, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 847         JSC_FOREACH_BUILTIN_FUNCTION_PRIVATE_GLOBAL_NAME(INIT_PRIVATE_GLOBAL)
 848 #undef INIT_PRIVATE_GLOBAL
 849         GlobalPropertyInfo(vm.propertyNames->NaN, jsNaN(), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 850         GlobalPropertyInfo(vm.propertyNames->Infinity, jsNumber(std::numeric_limits<double>::infinity()), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 851         GlobalPropertyInfo(vm.propertyNames->undefinedKeyword, jsUndefined(), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 852         GlobalPropertyInfo(vm.propertyNames->builtinNames().getOwnPropertyNamesPrivateName(), privateFuncGetOwnPropertyNames, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 853         GlobalPropertyInfo(vm.propertyNames->builtinNames().propertyIsEnumerablePrivateName(), privateFuncPropertyIsEnumerable, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 854         GlobalPropertyInfo(vm.propertyNames->builtinNames().importModulePrivateName(), privateFuncImportModule, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 855         GlobalPropertyInfo(vm.propertyNames->builtinNames().enqueueJobPrivateName(), JSFunction::create(vm, this, 0, String(), enqueueJob), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 856         GlobalPropertyInfo(vm.propertyNames->builtinNames().ErrorPrivateName(), m_errorConstructor.get(), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 857         GlobalPropertyInfo(vm.propertyNames->builtinNames().RangeErrorPrivateName(), m_rangeErrorConstructor.get(), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 858         GlobalPropertyInfo(vm.propertyNames->builtinNames().TypeErrorPrivateName(), m_typeErrorConstructor.get(), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 859         GlobalPropertyInfo(vm.propertyNames->builtinNames().typedArrayLengthPrivateName(), privateFuncTypedArrayLength, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 860         GlobalPropertyInfo(vm.propertyNames->builtinNames().typedArrayGetOriginalConstructorPrivateName(), privateFuncTypedArrayGetOriginalConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 861         GlobalPropertyInfo(vm.propertyNames->builtinNames().typedArraySortPrivateName(), privateFuncTypedArraySort, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 862         GlobalPropertyInfo(vm.propertyNames->builtinNames().isTypedArrayViewPrivateName(), privateFuncIsTypedArrayView, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 863         GlobalPropertyInfo(vm.propertyNames->builtinNames().typedArraySubarrayCreatePrivateName(), privateFuncTypedArraySubarrayCreate, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 864         GlobalPropertyInfo(vm.propertyNames->builtinNames().isBoundFunctionPrivateName(), privateFuncIsBoundFunction, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 865         GlobalPropertyInfo(vm.propertyNames->builtinNames().hasInstanceBoundFunctionPrivateName(), privateFuncHasInstanceBoundFunction, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 866         GlobalPropertyInfo(vm.propertyNames->builtinNames().instanceOfPrivateName(), privateFuncInstanceOf, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 867         GlobalPropertyInfo(vm.propertyNames->builtinNames().BuiltinLogPrivateName(), builtinLog, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 868         GlobalPropertyInfo(vm.propertyNames->builtinNames().NumberPrivateName(), numberConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 869         GlobalPropertyInfo(vm.propertyNames->builtinNames().RegExpPrivateName(), m_regExpConstructor.get(), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 870         GlobalPropertyInfo(vm.propertyNames->builtinNames().StringPrivateName(), stringConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 871         GlobalPropertyInfo(vm.propertyNames->builtinNames().absPrivateName(), privateFuncAbs, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 872         GlobalPropertyInfo(vm.propertyNames->builtinNames().floorPrivateName(), privateFuncFloor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 873         GlobalPropertyInfo(vm.propertyNames->builtinNames().truncPrivateName(), privateFuncTrunc, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 874         GlobalPropertyInfo(vm.propertyNames->builtinNames().PromisePrivateName(), promiseConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 875         GlobalPropertyInfo(vm.propertyNames->builtinNames().ReflectPrivateName(), reflectObject, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 876         GlobalPropertyInfo(vm.propertyNames->builtinNames().InternalPromisePrivateName(), internalPromiseConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 877
 878         GlobalPropertyInfo(vm.propertyNames->builtinNames().repeatCharacterPrivateName(), JSFunction::create(vm, this, 2, String(), stringProtoFuncRepeatCharacter), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 879         GlobalPropertyInfo(vm.propertyNames->builtinNames().isArrayPrivateName(), arrayConstructor->getDirect(vm, vm.propertyNames->isArray), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 880         GlobalPropertyInfo(vm.propertyNames->builtinNames().isArraySlowPrivateName(), privateFuncIsArraySlow, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 881         GlobalPropertyInfo(vm.propertyNames->builtinNames().isArrayConstructorPrivateName(), privateFuncIsArrayConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 882         GlobalPropertyInfo(vm.propertyNames->builtinNames().concatMemcpyPrivateName(), privateFuncConcatMemcpy, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 883         GlobalPropertyInfo(vm.propertyNames->builtinNames().appendMemcpyPrivateName(), privateFuncAppendMemcpy, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 884
 885         GlobalPropertyInfo(vm.propertyNames->builtinNames().hostPromiseRejectionTrackerPrivateName(), JSFunction::create(vm, this, 2, String(), globalFuncHostPromiseRejectionTracker), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 886         GlobalPropertyInfo(vm.propertyNames->builtinNames().InspectorInstrumentationPrivateName(), InspectorInstrumentationObject::create(vm, this, InspectorInstrumentationObject::createStructure(vm, this, m_objectPrototype.get())), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 887         GlobalPropertyInfo(vm.propertyNames->builtinNames().MapPrivateName(), mapConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 888         GlobalPropertyInfo(vm.propertyNames->builtinNames().SetPrivateName(), setConstructor, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 889         GlobalPropertyInfo(vm.propertyNames->builtinNames().thisTimeValuePrivateName(), privateFuncThisTimeValue, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 890         GlobalPropertyInfo(vm.propertyNames->builtinNames().thisNumberValuePrivateName(), privateFuncThisNumberValue, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 891 #if ENABLE(INTL)
 892         GlobalPropertyInfo(vm.propertyNames->builtinNames().CollatorPrivateName(), intl->getDirect(vm, vm.propertyNames->Collator), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 893         GlobalPropertyInfo(vm.propertyNames->builtinNames().DateTimeFormatPrivateName(), intl->getDirect(vm, vm.propertyNames->DateTimeFormat), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 894         GlobalPropertyInfo(vm.propertyNames->builtinNames().NumberFormatPrivateName(), intl->getDirect(vm, vm.propertyNames->NumberFormat), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 895 #endif // ENABLE(INTL)
 896
 897         GlobalPropertyInfo(vm.propertyNames->builtinNames().isConstructorPrivateName(), JSFunction::create(vm, this, 1, String(), esSpecIsConstructor, NoIntrinsic), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 898
 899         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoFlagsGetterPrivateName(), regExpProtoFlagsGetterObject, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 900         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoGlobalGetterPrivateName(), regExpProtoGlobalGetterObject, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 901         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoIgnoreCaseGetterPrivateName(), regExpProtoIgnoreCaseGetterObject, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 902         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoMultilineGetterPrivateName(), regExpProtoMultilineGetterObject, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 903         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoSourceGetterPrivateName(), regExpProtoSourceGetterObject, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 904         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoStickyGetterPrivateName(), regExpProtoStickyGetterObject, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 905         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpProtoUnicodeGetterPrivateName(), regExpProtoUnicodeGetterObject, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 906
 907         // RegExp.prototype helpers.
 908         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpBuiltinExecPrivateName(), builtinRegExpExec, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 909         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpCreatePrivateName(), JSFunction::create(vm, this, 2, String(), esSpecRegExpCreate, NoIntrinsic), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 910         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpMatchFastPrivateName(), JSFunction::create(vm, this, 1, String(), regExpProtoFuncMatchFast), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 911         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpSearchFastPrivateName(), JSFunction::create(vm, this, 1, String(), regExpProtoFuncSearchFast), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 912         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpSplitFastPrivateName(), JSFunction::create(vm, this, 2, String(), regExpProtoFuncSplitFast), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 913         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpPrototypeSymbolReplacePrivateName(), m_regExpPrototype->getDirect(vm, vm.propertyNames->replaceSymbol), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 914         GlobalPropertyInfo(vm.propertyNames->builtinNames().regExpTestFastPrivateName(), JSFunction::create(vm, this, 1, String(), regExpProtoFuncTestFast, RegExpTestFastIntrinsic), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 915
 916         // String.prototype helpers.
 917         GlobalPropertyInfo(vm.propertyNames->builtinNames().stringIncludesInternalPrivateName(), JSFunction::create(vm, this, 1, String(), builtinStringIncludesInternal), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 918         GlobalPropertyInfo(vm.propertyNames->builtinNames().stringSplitFastPrivateName(), JSFunction::create(vm, this, 2, String(), stringProtoFuncSplitFast), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 919         GlobalPropertyInfo(vm.propertyNames->builtinNames().stringSubstrInternalPrivateName(), JSFunction::create(vm, this, 2, String(), builtinStringSubstrInternal), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 920
 921         // Function prototype helpers.
 922         GlobalPropertyInfo(vm.propertyNames->builtinNames().makeBoundFunctionPrivateName(), JSFunction::create(vm, this, 5, String(), makeBoundFunction), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 923         GlobalPropertyInfo(vm.propertyNames->builtinNames().hasOwnLengthPropertyPrivateName(), JSFunction::create(vm, this, 1, String(), hasOwnLengthProperty), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 924
 925         // Map and Set helpers.
 926         GlobalPropertyInfo(vm.propertyNames->builtinNames().mapBucketHeadPrivateName(), privateFuncMapBucketHead, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 927         GlobalPropertyInfo(vm.propertyNames->builtinNames().mapBucketNextPrivateName(), privateFuncMapBucketNext, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 928         GlobalPropertyInfo(vm.propertyNames->builtinNames().mapBucketKeyPrivateName(), privateFuncMapBucketKey, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 929         GlobalPropertyInfo(vm.propertyNames->builtinNames().mapBucketValuePrivateName(), privateFuncMapBucketValue, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 930         GlobalPropertyInfo(vm.propertyNames->builtinNames().setBucketHeadPrivateName(), privateFuncSetBucketHead, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 931         GlobalPropertyInfo(vm.propertyNames->builtinNames().setBucketNextPrivateName(), privateFuncSetBucketNext, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 932         GlobalPropertyInfo(vm.propertyNames->builtinNames().setBucketKeyPrivateName(), privateFuncSetBucketKey, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 933 #if !ASSERT_DISABLED
 934         GlobalPropertyInfo(vm.propertyNames->builtinNames().assertPrivateName(), JSFunction::create(vm, this, 1, String(), assertCall), PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 935 #endif
 936     };
 937     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
 938
 939     m_specialPointers[Special::CallFunction] = m_callFunction.get();
 940     m_specialPointers[Special::ApplyFunction] = m_applyFunction.get();
 941     m_specialPointers[Special::ObjectConstructor] = objectConstructor;
 942     m_specialPointers[Special::ArrayConstructor] = arrayConstructor;
 943
 944     m_linkTimeConstants[static_cast<unsigned>(LinkTimeConstant::ThrowTypeErrorFunction)] = m_throwTypeErrorFunction.get();
 945
 946     if (UNLIKELY(Options::useDollarVM())) {
 947         m_dollarVMStructure.set(vm, this, JSDollarVM::createStructure(vm, this, m_objectPrototype.get()));
 948         JSDollarVM* dollarVM = JSDollarVM::create(vm, m_dollarVMStructure.get());
 949
 950         GlobalPropertyInfo extraStaticGlobals[] = {
 951             GlobalPropertyInfo(vm.propertyNames->builtinNames().dollarVMPrivateName(), dollarVM, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly),
 952         };
 953         addStaticGlobals(extraStaticGlobals, WTF_ARRAY_LENGTH(extraStaticGlobals));
 954
 955         putDirectWithoutTransition(vm, Identifier::fromString(exec, "$vm"), dollarVM, static_cast<unsigned>(PropertyAttribute::DontEnum));
 956     }
 957
 958 #if ENABLE(WEBASSEMBLY)
 959     if (Options::useWebAssembly()) {
 960         auto* webAssemblyPrototype = WebAssemblyPrototype::create(vm, this, WebAssemblyPrototype::createStructure(vm, this, m_objectPrototype.get()));
 961         m_webAssemblyStructure.set(vm, this, JSWebAssembly::createStructure(vm, this, webAssemblyPrototype));
 962         m_webAssemblyModuleRecordStructure.set(vm, this, WebAssemblyModuleRecord::createStructure(vm, this, m_objectPrototype.get()));
 963         m_webAssemblyFunctionStructure.set(vm, this, WebAssemblyFunction::createStructure(vm, this, m_functionPrototype.get()));
 964         m_webAssemblyWrapperFunctionStructure.set(vm, this, WebAssemblyWrapperFunction::createStructure(vm, this, m_functionPrototype.get()));
 965         m_webAssemblyToJSCalleeStructure.set(vm, this, WebAssemblyToJSCallee::createStructure(vm, this, jsNull()));
 966         auto* webAssembly = JSWebAssembly::create(vm, this, m_webAssemblyStructure.get());
 967         putDirectWithoutTransition(vm, Identifier::fromString(exec, "WebAssembly"), webAssembly, static_cast<unsigned>(PropertyAttribute::DontEnum));
 968
 969 #define CREATE_WEBASSEMBLY_CONSTRUCTOR(capitalName, lowerName, properName, instanceType, jsName, prototypeBase) do { \
 970         typedef capitalName ## Prototype Prototype; \
 971         typedef capitalName ## Constructor Constructor; \
 972         typedef JS ## capitalName JSObj; \
 973         auto* base = m_ ## prototypeBase ## Prototype.get(); \
 974         auto* prototype = Prototype::create(vm, this, Prototype::createStructure(vm, this, base)); \
 975         auto* structure = JSObj::createStructure(vm, this, prototype); \
 976         auto* constructor = Constructor::create(vm, Constructor::createStructure(vm, this, this->functionPrototype()), prototype); \
 977         prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, constructor, static_cast<unsigned>(PropertyAttribute::DontEnum)); \
 978         m_ ## lowerName ## Prototype.set(vm, this, prototype); \
 979         m_ ## properName ## Structure.set(vm, this, structure); \
 980         webAssembly->putDirectWithoutTransition(vm, Identifier::fromString(this->globalExec(), #jsName), constructor, static_cast<unsigned>(PropertyAttribute::DontEnum)); \
 981     } while (0);
 982
 983         FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(CREATE_WEBASSEMBLY_CONSTRUCTOR)
 984
 985 #undef CREATE_WEBASSEMBLY_CONSTRUCTOR
 986     }
 987 #endif // ENABLE(WEBASSEMBLY)
 988
 989     {
 990         ExecState* exec = globalExec();
 991
 992         auto setupAdaptiveWatchpoint = [&] (JSObject* base, const Identifier& ident) -> ObjectPropertyCondition {
 993             // Performing these gets should not throw.
 994             PropertySlot slot(base, PropertySlot::InternalMethodType::Get);
 995             bool result = base->getOwnPropertySlot(base, exec, ident, slot);
 996             ASSERT_UNUSED(result, result);
 997             catchScope.assertNoException();
 998             RELEASE_ASSERT(slot.isCacheableValue());
 999             JSValue functionValue = slot.getValue(exec, ident);
1000             catchScope.assertNoException();
1001             ASSERT(jsDynamicCast<JSFunction*>(vm, functionValue));
1002
1003             ObjectPropertyCondition condition = generateConditionForSelfEquivalence(m_vm, nullptr, base, ident.impl());
1004             RELEASE_ASSERT(condition.requiredValue() == functionValue);
1005
1006             bool isWatchable = condition.isWatchable(PropertyCondition::EnsureWatchability);
1007             RELEASE_ASSERT(isWatchable); // We allow this to install the necessary watchpoints.
1008
1009             return condition;
1010         };
1011
1012         {
1013             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(arrayIteratorPrototype, m_vm.propertyNames->next);
1014             m_arrayIteratorPrototypeNext = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_arrayIteratorProtocolWatchpoint);
1015             m_arrayIteratorPrototypeNext->install();
1016         }
1017         {
1018             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(this->arrayPrototype(), m_vm.propertyNames->iteratorSymbol);
1019             m_arrayPrototypeSymbolIteratorWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_arrayIteratorProtocolWatchpoint);
1020             m_arrayPrototypeSymbolIteratorWatchpoint->install();
1021         }
1022
1023         {
1024             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(mapIteratorPrototype, m_vm.propertyNames->next);
1025             m_mapIteratorPrototypeNextWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_mapIteratorProtocolWatchpoint);
1026             m_mapIteratorPrototypeNextWatchpoint->install();
1027         }
1028         {
1029             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(m_mapPrototype.get(), m_vm.propertyNames->iteratorSymbol);
1030             m_mapPrototypeSymbolIteratorWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_mapIteratorProtocolWatchpoint);
1031             m_mapPrototypeSymbolIteratorWatchpoint->install();
1032         }
1033
1034         {
1035             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(setIteratorPrototype, m_vm.propertyNames->next);
1036             m_setIteratorPrototypeNextWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_setIteratorProtocolWatchpoint);
1037             m_setIteratorPrototypeNextWatchpoint->install();
1038         }
1039         {
1040             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(m_setPrototype.get(), m_vm.propertyNames->iteratorSymbol);
1041             m_setPrototypeSymbolIteratorWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_setIteratorProtocolWatchpoint);
1042             m_setPrototypeSymbolIteratorWatchpoint->install();
1043         }
1044
1045         {
1046             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(m_stringIteratorPrototype.get(), m_vm.propertyNames->next);
1047             m_stringIteratorPrototypeNextWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_stringIteratorProtocolWatchpoint);
1048             m_stringIteratorPrototypeNextWatchpoint->install();
1049         }
1050         {
1051             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(m_stringPrototype.get(), m_vm.propertyNames->iteratorSymbol);
1052             m_stringPrototypeSymbolIteratorWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_stringIteratorProtocolWatchpoint);
1053             m_stringPrototypeSymbolIteratorWatchpoint->install();
1054         }
1055
1056         {
1057             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(m_mapPrototype.get(), m_vm.propertyNames->set);
1058             m_mapPrototypeSetWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_mapSetWatchpoint);
1059             m_mapPrototypeSetWatchpoint->install();
1060         }
1061
1062         {
1063             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(m_setPrototype.get(), m_vm.propertyNames->add);
1064             m_setPrototypeAddWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_setAddWatchpoint);
1065             m_setPrototypeAddWatchpoint->install();
1066         }
1067
1068         {
1069             ObjectPropertyCondition condition = setupAdaptiveWatchpoint(numberPrototype(), m_vm.propertyNames->toString);
1070             m_numberPrototypeToStringWatchpoint = std::make_unique<ObjectPropertyChangeAdaptiveWatchpoint<InlineWatchpointSet>>(vm, condition, m_numberToStringWatchpoint);
1071             m_numberPrototypeToStringWatchpoint->install();
1072             m_numberProtoToStringFunction.set(vm, this, jsCast<JSFunction*>(numberPrototype()->getDirect(vm, vm.propertyNames->toString)));
1073         }
1074     }
1075
1076     resetPrototype(vm, getPrototypeDirect(vm));
1077 }
1078
1079 bool JSGlobalObject::put(JSCell* cell, ExecState* exec, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
1080 {
1081     VM& vm = exec->vm();
1082     auto scope = DECLARE_THROW_SCOPE(vm);
1083     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(cell);
1084     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(thisObject));
1085
1086     if (UNLIKELY(isThisValueAltered(slot, thisObject))) {
1087         scope.release();
1088         return ordinarySetSlow(exec, thisObject, propertyName, value, slot.thisValue(), slot.isStrictMode());
1089     }
1090
1091     bool shouldThrowReadOnlyError = slot.isStrictMode();
1092     bool ignoreReadOnlyErrors = false;
1093     bool putResult = false;
1094     bool done = symbolTablePutTouchWatchpointSet(thisObject, exec, propertyName, value, shouldThrowReadOnlyError, ignoreReadOnlyErrors, putResult);
1095     EXCEPTION_ASSERT((!!scope.exception() == (done && !putResult)) || !shouldThrowReadOnlyError);
1096     if (done)
1097         return putResult;
1098     scope.release();
1099     return Base::put(thisObject, exec, propertyName, value, slot);
1100 }
1101
1102 bool JSGlobalObject::defineOwnProperty(JSObject* object, ExecState* exec, PropertyName propertyName, const PropertyDescriptor& descriptor, bool shouldThrow)
1103 {
1104     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(object);
1105     PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
1106     // silently ignore attempts to add accessors aliasing vars.
1107     if (descriptor.isAccessorDescriptor() && symbolTableGet(thisObject, propertyName, slot))
1108         return false;
1109     return Base::defineOwnProperty(thisObject, exec, propertyName, descriptor, shouldThrow);
1110 }
1111
1112 void JSGlobalObject::addGlobalVar(const Identifier& ident)
1113 {
1114     ConcurrentJSLocker locker(symbolTable()->m_lock);
1115     SymbolTableEntry entry = symbolTable()->get(locker, ident.impl());
1116     if (!entry.isNull())
1117         return;
1118
1119     ScopeOffset offset = symbolTable()->takeNextScopeOffset(locker);
1120     SymbolTableEntry newEntry(VarOffset(offset), 0);
1121     newEntry.prepareToWatch();
1122     symbolTable()->add(locker, ident.impl(), WTFMove(newEntry));
1123
1124     ScopeOffset offsetForAssert = addVariables(1, jsUndefined());
1125     RELEASE_ASSERT(offsetForAssert == offset);
1126 }
1127
1128 void JSGlobalObject::addFunction(ExecState* exec, const Identifier& propertyName)
1129 {
1130     VM& vm = exec->vm();
1131     VM::DeletePropertyModeScope scope(vm, VM::DeletePropertyMode::IgnoreConfigurable);
1132     methodTable(vm)->deleteProperty(this, exec, propertyName);
1133     addGlobalVar(propertyName);
1134 }
1135
1136 void JSGlobalObject::setGlobalScopeExtension(JSScope* scope)
1137 {
1138     m_globalScopeExtension.set(vm(), this, scope);
1139 }
1140
1141 void JSGlobalObject::clearGlobalScopeExtension()
1142 {
1143     m_globalScopeExtension.clear();
1144 }
1145
1146 static inline JSObject* lastInPrototypeChain(VM& vm, JSObject* object)
1147 {
1148     JSObject* o = object;
1149     while (o->getPrototypeDirect(vm).isObject())
1150         o = asObject(o->getPrototypeDirect(vm));
1151     return o;
1152 }
1153
1154 // Private namespace for helpers for JSGlobalObject::haveABadTime()
1155 namespace {
1156
1157 class ObjectsWithBrokenIndexingFinder : public MarkedBlock::VoidFunctor {
1158 public:
1159     ObjectsWithBrokenIndexingFinder(MarkedArgumentBuffer&, JSGlobalObject*);
1160     IterationStatus operator()(HeapCell*, HeapCell::Kind) const;
1161
1162 private:
1163     void visit(JSCell*);
1164
1165     MarkedArgumentBuffer& m_foundObjects;
1166     JSGlobalObject* m_globalObject;
1167 };
1168
1169 ObjectsWithBrokenIndexingFinder::ObjectsWithBrokenIndexingFinder(
1170     MarkedArgumentBuffer& foundObjects, JSGlobalObject* globalObject)
1171     : m_foundObjects(foundObjects)
1172     , m_globalObject(globalObject)
1173 {
1174 }
1175
1176 inline bool hasBrokenIndexing(JSObject* object)
1177 {
1178     IndexingType type = object->indexingType();
1179     return type && !hasSlowPutArrayStorage(type);
1180 }
1181
1182 inline void ObjectsWithBrokenIndexingFinder::visit(JSCell* cell)
1183 {
1184     if (!cell->isObject())
1185         return;
1186
1187     JSObject* object = asObject(cell);
1188
1189     // Run this filter first, since it's cheap, and ought to filter out a lot of objects.
1190     if (!hasBrokenIndexing(object))
1191         return;
1192
1193     // We only want to have a bad time in the affected global object, not in the entire
1194     // VM. But we have to be careful, since there may be objects that claim to belong to
1195     // a different global object that have prototypes from our global object.
1196     bool foundGlobalObject = false;
1197     VM& vm = m_globalObject->vm();
1198     for (JSObject* current = object; ;) {
1199         if (current->globalObject() == m_globalObject) {
1200             foundGlobalObject = true;
1201             break;
1202         }
1203
1204         JSValue prototypeValue = current->getPrototypeDirect(vm);
1205         if (prototypeValue.isNull())
1206             break;
1207         current = asObject(prototypeValue);
1208     }
1209     if (!foundGlobalObject)
1210         return;
1211
1212     m_foundObjects.append(object);
1213 }
1214
1215 IterationStatus ObjectsWithBrokenIndexingFinder::operator()(HeapCell* cell, HeapCell::Kind kind) const
1216 {
1217     if (kind == HeapCell::JSCell) {
1218         // FIXME: This const_cast exists because this isn't a C++ lambda.
1219         // https://bugs.webkit.org/show_bug.cgi?id=159644
1220         const_cast<ObjectsWithBrokenIndexingFinder*>(this)->visit(static_cast<JSCell*>(cell));
1221     }
1222     return IterationStatus::Continue;
1223 }
1224
1225 } // end private namespace for helpers for JSGlobalObject::haveABadTime()
1226
1227 void JSGlobalObject::haveABadTime(VM& vm)
1228 {
1229     ASSERT(&vm == &this->vm());
1230
1231     if (isHavingABadTime())
1232         return;
1233
1234     // Make sure that all allocations or indexed storage transitions that are inlining
1235     // the assumption that it's safe to transition to a non-SlowPut array storage don't
1236     // do so anymore.
1237     m_havingABadTimeWatchpoint->fireAll(vm, "Having a bad time");
1238     ASSERT(isHavingABadTime()); // The watchpoint is what tells us that we're having a bad time.
1239
1240     // Make sure that all JSArray allocations that load the appropriate structure from
1241     // this object now load a structure that uses SlowPut.
1242     for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
1243         m_arrayStructureForIndexingShapeDuringAllocation[i].set(vm, this, originalArrayStructureForIndexingType(ArrayWithSlowPutArrayStorage));
1244
1245     // Same for any special array structures.
1246     Structure* slowPutStructure;
1247     slowPutStructure = createRegExpMatchesArraySlowPutStructure(vm, this);
1248     m_regExpMatchesArrayStructure.set(vm, this, slowPutStructure);
1249     slowPutStructure = createRegExpMatchesArrayWithGroupsSlowPutStructure(vm, this);
1250     m_regExpMatchesArrayWithGroupsStructure.set(vm, this, slowPutStructure);
1251     slowPutStructure = ClonedArguments::createSlowPutStructure(vm, this, m_objectPrototype.get());
1252     m_clonedArgumentsStructure.set(vm, this, slowPutStructure);
1253
1254     // Make sure that all objects that have indexed storage switch to the slow kind of
1255     // indexed storage.
1256     MarkedArgumentBuffer foundObjects; // Use MarkedArgumentBuffer because switchToSlowPutArrayStorage() may GC.
1257     ObjectsWithBrokenIndexingFinder finder(foundObjects, this);
1258     {
1259         HeapIterationScope iterationScope(vm.heap);
1260         vm.heap.objectSpace().forEachLiveCell(iterationScope, finder);
1261     }
1262     RELEASE_ASSERT(!foundObjects.hasOverflowed());
1263     while (!foundObjects.isEmpty()) {
1264         JSObject* object = asObject(foundObjects.last());
1265         foundObjects.removeLast();
1266         ASSERT(hasBrokenIndexing(object));
1267         object->switchToSlowPutArrayStorage(vm);
1268     }
1269 }
1270
1271 // Set prototype, and also insert the object prototype at the end of the chain.
1272 void JSGlobalObject::resetPrototype(VM& vm, JSValue prototype)
1273 {
1274     setPrototypeDirect(vm, prototype);
1275
1276     JSObject* oldLastInPrototypeChain = lastInPrototypeChain(vm, this);
1277     JSObject* objectPrototype = m_objectPrototype.get();
1278     if (oldLastInPrototypeChain != objectPrototype)
1279         oldLastInPrototypeChain->setPrototypeDirect(vm, objectPrototype);
1280
1281     // Whenever we change the prototype of the global object, we need to create a new JSProxy with the correct prototype.
1282     setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype, PureForwardingProxyType), this));
1283 }
1284
1285 void JSGlobalObject::visitChildren(JSCell* cell, SlotVisitor& visitor)
1286 {
1287     JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(cell);
1288     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
1289     Base::visitChildren(thisObject, visitor);
1290
1291     visitor.append(thisObject->m_globalThis);
1292
1293     visitor.append(thisObject->m_globalLexicalEnvironment);
1294     visitor.append(thisObject->m_globalScopeExtension);
1295     visitor.append(thisObject->m_globalCallee);
1296     visitor.append(thisObject->m_regExpConstructor);
1297     visitor.append(thisObject->m_errorConstructor);
1298     visitor.append(thisObject->m_nativeErrorPrototypeStructure);
1299     visitor.append(thisObject->m_nativeErrorStructure);
1300     thisObject->m_evalErrorConstructor.visit(visitor);
1301     visitor.append(thisObject->m_rangeErrorConstructor);
1302     thisObject->m_referenceErrorConstructor.visit(visitor);
1303     thisObject->m_syntaxErrorConstructor.visit(visitor);
1304     visitor.append(thisObject->m_typeErrorConstructor);
1305     thisObject->m_URIErrorConstructor.visit(visitor);
1306     visitor.append(thisObject->m_objectConstructor);
1307     visitor.append(thisObject->m_promiseConstructor);
1308
1309     visitor.append(thisObject->m_nullGetterFunction);
1310     visitor.append(thisObject->m_nullSetterFunction);
1311
1312     visitor.append(thisObject->m_parseIntFunction);
1313     visitor.append(thisObject->m_parseFloatFunction);
1314     visitor.append(thisObject->m_evalFunction);
1315     visitor.append(thisObject->m_callFunction);
1316     visitor.append(thisObject->m_applyFunction);
1317     visitor.append(thisObject->m_throwTypeErrorFunction);
1318     thisObject->m_arrayProtoToStringFunction.visit(visitor);
1319     thisObject->m_arrayProtoValuesFunction.visit(visitor);
1320     thisObject->m_initializePromiseFunction.visit(visitor);
1321     thisObject->m_iteratorProtocolFunction.visit(visitor);
1322     thisObject->m_promiseResolveFunction.visit(visitor);
1323     visitor.append(thisObject->m_objectProtoValueOfFunction);
1324     visitor.append(thisObject->m_numberProtoToStringFunction);
1325     visitor.append(thisObject->m_newPromiseCapabilityFunction);
1326     visitor.append(thisObject->m_functionProtoHasInstanceSymbolFunction);
1327     thisObject->m_throwTypeErrorGetterSetter.visit(visitor);
1328     visitor.append(thisObject->m_throwTypeErrorArgumentsCalleeAndCallerGetterSetter);
1329     visitor.append(thisObject->m_moduleLoader);
1330
1331     visitor.append(thisObject->m_objectPrototype);
1332     visitor.append(thisObject->m_functionPrototype);
1333     visitor.append(thisObject->m_arrayPrototype);
1334     visitor.append(thisObject->m_errorPrototype);
1335     visitor.append(thisObject->m_iteratorPrototype);
1336     visitor.append(thisObject->m_generatorFunctionPrototype);
1337     visitor.append(thisObject->m_generatorPrototype);
1338     visitor.append(thisObject->m_asyncFunctionPrototype);
1339     visitor.append(thisObject->m_asyncGeneratorPrototype);
1340     visitor.append(thisObject->m_asyncIteratorPrototype);
1341     visitor.append(thisObject->m_asyncGeneratorFunctionPrototype);
1342     visitor.append(thisObject->m_moduleLoaderPrototype);
1343
1344     thisObject->m_debuggerScopeStructure.visit(visitor);
1345     thisObject->m_withScopeStructure.visit(visitor);
1346     visitor.append(thisObject->m_strictEvalActivationStructure);
1347     visitor.append(thisObject->m_lexicalEnvironmentStructure);
1348     thisObject->m_moduleEnvironmentStructure.visit(visitor);
1349     visitor.append(thisObject->m_directArgumentsStructure);
1350     visitor.append(thisObject->m_scopedArgumentsStructure);
1351     visitor.append(thisObject->m_clonedArgumentsStructure);
1352     visitor.append(thisObject->m_objectStructureForObjectConstructor);
1353     for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
1354         visitor.append(thisObject->m_originalArrayStructureForIndexingShape[i]);
1355     for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
1356         visitor.append(thisObject->m_arrayStructureForIndexingShapeDuringAllocation[i]);
1357     thisObject->m_callbackConstructorStructure.visit(visitor);
1358     thisObject->m_callbackFunctionStructure.visit(visitor);
1359     thisObject->m_callbackObjectStructure.visit(visitor);
1360 #if JSC_OBJC_API_ENABLED
1361     thisObject->m_objcCallbackFunctionStructure.visit(visitor);
1362     thisObject->m_objcWrapperObjectStructure.visit(visitor);
1363 #endif
1364     thisObject->m_nullPrototypeObjectStructure.visit(visitor);
1365     visitor.append(thisObject->m_errorStructure);
1366     visitor.append(thisObject->m_calleeStructure);
1367     visitor.append(thisObject->m_strictFunctionStructure);
1368     visitor.append(thisObject->m_sloppyFunctionStructure);
1369     visitor.append(thisObject->m_arrowFunctionStructure);
1370     thisObject->m_customGetterSetterFunctionStructure.visit(visitor);
1371     thisObject->m_boundFunctionStructure.visit(visitor);
1372     visitor.append(thisObject->m_getterSetterStructure);
1373     thisObject->m_nativeStdFunctionStructure.visit(visitor);
1374     visitor.append(thisObject->m_bigIntObjectStructure);
1375     visitor.append(thisObject->m_symbolObjectStructure);
1376     visitor.append(thisObject->m_regExpStructure);
1377     visitor.append(thisObject->m_generatorFunctionStructure);
1378     visitor.append(thisObject->m_asyncFunctionStructure);
1379     visitor.append(thisObject->m_asyncGeneratorFunctionStructure);
1380     visitor.append(thisObject->m_iteratorResultObjectStructure);
1381     visitor.append(thisObject->m_regExpMatchesArrayStructure);
1382     visitor.append(thisObject->m_regExpMatchesArrayWithGroupsStructure);
1383     visitor.append(thisObject->m_moduleRecordStructure);
1384     visitor.append(thisObject->m_moduleNamespaceObjectStructure);
1385     visitor.append(thisObject->m_dollarVMStructure);
1386     visitor.append(thisObject->m_proxyObjectStructure);
1387     visitor.append(thisObject->m_callableProxyObjectStructure);
1388     visitor.append(thisObject->m_proxyRevokeStructure);
1389     visitor.append(thisObject->m_moduleLoaderStructure);
1390
1391     visitor.append(thisObject->m_arrayBufferPrototype);
1392     visitor.append(thisObject->m_arrayBufferStructure);
1393 #if ENABLE(SHARED_ARRAY_BUFFER)
1394     visitor.append(thisObject->m_sharedArrayBufferPrototype);
1395     visitor.append(thisObject->m_sharedArrayBufferStructure);
1396 #endif
1397
1398 #define VISIT_SIMPLE_TYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
1399     visitor.append(thisObject->m_ ## lowerName ## Prototype); \
1400     visitor.append(thisObject->m_ ## properName ## Structure); \
1401
1402     FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE)
1403     if (UNLIKELY(Options::useBigInt()))
1404         FOR_BIG_INT_BUILTIN_TYPE_WITH_CONSTRUCTOR(VISIT_SIMPLE_TYPE)
1405     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_SIMPLE_TYPE)
1406
1407 #if ENABLE(WEBASSEMBLY)
1408     visitor.append(thisObject->m_webAssemblyStructure);
1409     visitor.append(thisObject->m_webAssemblyModuleRecordStructure);
1410     visitor.append(thisObject->m_webAssemblyFunctionStructure);
1411     visitor.append(thisObject->m_webAssemblyWrapperFunctionStructure);
1412     visitor.append(thisObject->m_webAssemblyToJSCalleeStructure);
1413     FOR_EACH_WEBASSEMBLY_CONSTRUCTOR_TYPE(VISIT_SIMPLE_TYPE)
1414 #endif // ENABLE(WEBASSEMBLY)
1415
1416 #undef VISIT_SIMPLE_TYPE
1417
1418 #define VISIT_LAZY_TYPE(CapitalName, lowerName, properName, instanceType, jsName, prototypeBase) \
1419     thisObject->m_ ## properName ## Structure.visit(visitor);
1420
1421     FOR_EACH_LAZY_BUILTIN_TYPE(VISIT_LAZY_TYPE)
1422
1423 #undef VISIT_LAZY_TYPE
1424
1425     for (unsigned i = NUMBER_OF_TYPED_ARRAY_TYPES; i--;)
1426         thisObject->lazyTypedArrayStructure(indexToTypedArrayType(i)).visit(visitor);
1427
1428     visitor.append(thisObject->m_speciesGetterSetter);
1429     thisObject->m_typedArrayProto.visit(visitor);
1430     thisObject->m_typedArraySuperConstructor.visit(visitor);
1431 }
1432
1433 ExecState* JSGlobalObject::globalExec()
1434 {
1435     return CallFrame::create(m_globalCallFrame);
1436 }
1437
1438 void JSGlobalObject::addStaticGlobals(GlobalPropertyInfo* globals, int count)
1439 {
1440     ScopeOffset startOffset = addVariables(count, jsUndefined());
1441
1442     for (int i = 0; i < count; ++i) {
1443         GlobalPropertyInfo& global = globals[i];
1444         ASSERT(global.attributes & PropertyAttribute::DontDelete);
1445
1446         WatchpointSet* watchpointSet = nullptr;
1447         WriteBarrierBase<Unknown>* variable = nullptr;
1448         {
1449             ConcurrentJSLocker locker(symbolTable()->m_lock);
1450             ScopeOffset offset = symbolTable()->takeNextScopeOffset(locker);
1451             RELEASE_ASSERT(offset == startOffset + i);
1452             SymbolTableEntry newEntry(VarOffset(offset), global.attributes);
1453             newEntry.prepareToWatch();
1454             watchpointSet = newEntry.watchpointSet();
1455             symbolTable()->add(locker, global.identifier.impl(), WTFMove(newEntry));
1456             variable = &variableAt(offset);
1457         }
1458         symbolTablePutTouchWatchpointSet(vm(), this, global.identifier, global.value, variable, watchpointSet);
1459     }
1460 }
1461
1462 bool JSGlobalObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
1463 {
1464     if (Base::getOwnPropertySlot(object, exec, propertyName, slot))
1465         return true;
1466     return symbolTableGet(jsCast<JSGlobalObject*>(object), propertyName, slot);
1467 }
1468
1469 void JSGlobalObject::clearRareData(JSCell* cell)
1470 {
1471     jsCast<JSGlobalObject*>(cell)->m_rareData = nullptr;
1472 }
1473
1474 void slowValidateCell(JSGlobalObject* globalObject)
1475 {
1476     RELEASE_ASSERT(globalObject->isGlobalObject());
1477     ASSERT_GC_OBJECT_INHERITS(globalObject, JSGlobalObject::info());
1478 }
1479
1480 void JSGlobalObject::setRemoteDebuggingEnabled(bool enabled)
1481 {
1482 #if ENABLE(REMOTE_INSPECTOR)
1483     m_inspectorDebuggable->setRemoteDebuggingAllowed(enabled);
1484 #else
1485     UNUSED_PARAM(enabled);
1486 #endif
1487 }
1488
1489 bool JSGlobalObject::remoteDebuggingEnabled() const
1490 {
1491 #if ENABLE(REMOTE_INSPECTOR)
1492     return m_inspectorDebuggable->remoteDebuggingAllowed();
1493 #else
1494     return false;
1495 #endif
1496 }
1497
1498 void JSGlobalObject::setName(const String& name)
1499 {
1500     m_name = name;
1501
1502 #if ENABLE(REMOTE_INSPECTOR)
1503     m_inspectorDebuggable->update();
1504 #endif
1505 }
1506
1507 # if ENABLE(INTL)
1508 const HashSet<String>& JSGlobalObject::intlCollatorAvailableLocales()
1509 {
1510     if (m_intlCollatorAvailableLocales.isEmpty()) {
1511         int32_t count = ucol_countAvailable();
1512         for (int32_t i = 0; i < count; ++i) {
1513             String locale(ucol_getAvailable(i));
1514             convertICULocaleToBCP47LanguageTag(locale);
1515             m_intlCollatorAvailableLocales.add(locale);
1516         }
1517     }
1518     return m_intlCollatorAvailableLocales;
1519 }
1520
1521 const HashSet<String>& JSGlobalObject::intlDateTimeFormatAvailableLocales()
1522 {
1523     if (m_intlDateTimeFormatAvailableLocales.isEmpty()) {
1524         int32_t count = udat_countAvailable();
1525         for (int32_t i = 0; i < count; ++i) {
1526             String locale(udat_getAvailable(i));
1527             convertICULocaleToBCP47LanguageTag(locale);
1528             m_intlDateTimeFormatAvailableLocales.add(locale);
1529         }
1530     }
1531     return m_intlDateTimeFormatAvailableLocales;
1532 }
1533
1534 const HashSet<String>& JSGlobalObject::intlNumberFormatAvailableLocales()
1535 {
1536     if (m_intlNumberFormatAvailableLocales.isEmpty()) {
1537         int32_t count = unum_countAvailable();
1538         for (int32_t i = 0; i < count; ++i) {
1539             String locale(unum_getAvailable(i));
1540             convertICULocaleToBCP47LanguageTag(locale);
1541             m_intlNumberFormatAvailableLocales.add(locale);
1542         }
1543     }
1544     return m_intlNumberFormatAvailableLocales;
1545 }
1546 #endif // ENABLE(INTL)
1547
1548 void JSGlobalObject::queueMicrotask(Ref<Microtask>&& task)
1549 {
1550     if (globalObjectMethodTable()->queueTaskToEventLoop) {
1551         globalObjectMethodTable()->queueTaskToEventLoop(*this, WTFMove(task));
1552         return;
1553     }
1554
1555     vm().queueMicrotask(*this, WTFMove(task));
1556 }
1557
1558 bool JSGlobalObject::hasDebugger() const
1559 {
1560     return m_debugger;
1561 }
1562
1563 bool JSGlobalObject::hasInteractiveDebugger() const
1564 {
1565     return m_debugger && m_debugger->isInteractivelyDebugging();
1566 }
1567
1568 JSGlobalObject* JSGlobalObject::create(VM& vm, Structure* structure)
1569 {
1570     JSGlobalObject* globalObject = new (NotNull, allocateCell<JSGlobalObject>(vm.heap)) JSGlobalObject(vm, structure);
1571     globalObject->finishCreation(vm);
1572     return globalObject;
1573 }
1574
1575 void JSGlobalObject::finishCreation(VM& vm)
1576 {
1577     Base::finishCreation(vm);
1578     structure()->setGlobalObject(vm, this);
1579     m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
1580     init(vm);
1581     setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, getPrototypeDirect(vm), PureForwardingProxyType), this));
1582 }
1583
1584 void JSGlobalObject::finishCreation(VM& vm, JSObject* thisValue)
1585 {
1586     Base::finishCreation(vm);
1587     structure()->setGlobalObject(vm, this);
1588     m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
1589     init(vm);
1590     setGlobalThis(vm, thisValue);
1591 }
1592
1593 } // namespace JSC