⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 267364 in webkit


Ignore:
Timestamp:
Sep 21, 2020, 1:41:07 PM (6 years ago)
Author:
keith_miller@apple.com
Message:

Functions should consistently enumerate length before name
​https://bugs.webkit.org/show_bug.cgi?id=216789

Reviewed by Yusuke Suzuki.

Source/JavaScriptCore:

In ​https://github.com/tc39/ecma262/pull/2116, which has been
approved to be merged into the main JS spec, it's expected that
all functions should have their length property enumerated before
the name property. To ensure this invariant, this patch moves the
length set into InternalFunction::finishCreation.

There are no new tests since tests will be added to test262 when
the spec PR is merged. Adding tests to stress just means we will
have the same test twice, which seems like a waste.

  • API/JSCallbackFunction.cpp:

(JSC::JSCallbackFunction::finishCreation):

  • API/ObjCCallbackFunction.mm:

(JSC::ObjCCallbackFunction::create):

  • API/glib/JSCCallbackFunction.cpp:

(JSC::JSCCallbackFunction::create):

  • runtime/AggregateErrorConstructor.cpp:

(JSC::AggregateErrorConstructor::finishCreation):

  • runtime/ArrayConstructor.cpp:

(JSC::ArrayConstructor::finishCreation):

  • runtime/AsyncFunctionConstructor.cpp:

(JSC::AsyncFunctionConstructor::finishCreation):

  • runtime/AsyncGeneratorFunctionConstructor.cpp:

(JSC::AsyncGeneratorFunctionConstructor::finishCreation):

  • runtime/BigIntConstructor.cpp:

(JSC::BigIntConstructor::finishCreation):

  • runtime/BooleanConstructor.cpp:

(JSC::BooleanConstructor::finishCreation):

  • runtime/DateConstructor.cpp:

(JSC::DateConstructor::finishCreation):

  • runtime/ErrorConstructor.cpp:

(JSC::ErrorConstructor::finishCreation):

  • runtime/FinalizationRegistryConstructor.cpp:

(JSC::FinalizationRegistryConstructor::finishCreation):

  • runtime/FunctionConstructor.cpp:

(JSC::FunctionConstructor::finishCreation):

  • runtime/FunctionPrototype.cpp:

(JSC::FunctionPrototype::finishCreation):

  • runtime/GeneratorFunctionConstructor.cpp:

(JSC::GeneratorFunctionConstructor::finishCreation):

  • runtime/InternalFunction.cpp:

(JSC::InternalFunction::finishCreation):
(JSC::InternalFunction::createFunctionThatMasqueradesAsUndefined):

  • runtime/InternalFunction.h:
  • runtime/IntlCollatorConstructor.cpp:

(JSC::IntlCollatorConstructor::finishCreation):

  • runtime/IntlDateTimeFormatConstructor.cpp:

(JSC::IntlDateTimeFormatConstructor::finishCreation):

  • runtime/IntlDisplayNamesConstructor.cpp:

(JSC::IntlDisplayNamesConstructor::finishCreation):

  • runtime/IntlLocaleConstructor.cpp:

(JSC::IntlLocaleConstructor::finishCreation):

  • runtime/IntlNumberFormatConstructor.cpp:

(JSC::IntlNumberFormatConstructor::finishCreation):

  • runtime/IntlPluralRulesConstructor.cpp:

(JSC::IntlPluralRulesConstructor::finishCreation):

  • runtime/IntlRelativeTimeFormatConstructor.cpp:

(JSC::IntlRelativeTimeFormatConstructor::finishCreation):

  • runtime/IntlSegmenterConstructor.cpp:

(JSC::IntlSegmenterConstructor::finishCreation):

  • runtime/JSArrayBufferConstructor.cpp:

(JSC::JSGenericArrayBufferConstructor<sharingMode>::finishCreation):

  • runtime/JSGenericTypedArrayViewConstructorInlines.h:

(JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):

  • runtime/JSTypedArrayViewConstructor.cpp:

(JSC::JSTypedArrayViewConstructor::finishCreation):

  • runtime/MapConstructor.cpp:

(JSC::MapConstructor::finishCreation):

  • runtime/NativeErrorConstructor.cpp:

(JSC::NativeErrorConstructorBase::finishCreation):

  • runtime/NullGetterFunction.h:
  • runtime/NullSetterFunction.h:
  • runtime/NumberConstructor.cpp:

(JSC::NumberConstructor::finishCreation):

  • runtime/ObjectConstructor.cpp:

(JSC::ObjectConstructor::finishCreation):

  • runtime/ProxyConstructor.cpp:

(JSC::ProxyConstructor::finishCreation):

  • runtime/ProxyRevoke.cpp:

(JSC::ProxyRevoke::finishCreation):

  • runtime/RegExpConstructor.cpp:

(JSC::RegExpConstructor::finishCreation):

  • runtime/SetConstructor.cpp:

(JSC::SetConstructor::finishCreation):

  • runtime/StringConstructor.cpp:

(JSC::StringConstructor::finishCreation):

  • runtime/SymbolConstructor.cpp:

(JSC::SymbolConstructor::finishCreation):

  • runtime/WeakMapConstructor.cpp:

(JSC::WeakMapConstructor::finishCreation):

  • runtime/WeakObjectRefConstructor.cpp:

(JSC::WeakObjectRefConstructor::finishCreation):

  • runtime/WeakSetConstructor.cpp:

(JSC::WeakSetConstructor::finishCreation):

  • wasm/js/WebAssemblyCompileErrorConstructor.cpp:

(JSC::WebAssemblyCompileErrorConstructor::finishCreation):

  • wasm/js/WebAssemblyGlobalConstructor.cpp:

(JSC::WebAssemblyGlobalConstructor::finishCreation):

  • wasm/js/WebAssemblyInstanceConstructor.cpp:

(JSC::WebAssemblyInstanceConstructor::finishCreation):

  • wasm/js/WebAssemblyLinkErrorConstructor.cpp:

(JSC::WebAssemblyLinkErrorConstructor::finishCreation):

  • wasm/js/WebAssemblyMemoryConstructor.cpp:

(JSC::WebAssemblyMemoryConstructor::finishCreation):

  • wasm/js/WebAssemblyModuleConstructor.cpp:

(JSC::WebAssemblyModuleConstructor::finishCreation):

  • wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:

(JSC::WebAssemblyRuntimeErrorConstructor::finishCreation):

  • wasm/js/WebAssemblyTableConstructor.cpp:

(JSC::WebAssemblyTableConstructor::finishCreation):

Source/WebCore:

RuntimeMethod inherits from InternalFunction which now sets length by default.
RuntimeMethod intercepts length in getOwnPropertySlot so the value we pick
doesn't actually matter. Technically, this uses a little extra memory but
that's not too big of a deal because RuntimeMethod's are rare (and I believe
deprecated).

  • bridge/runtime_method.cpp:

(JSC::RuntimeMethod::finishCreation):

Source/WebKit:

JSNPMethod inherits from InternalFunction which now sets length by default.
I chose 0 because it looks like this function doesn't directly look at any
arguments and I doubt anyone is looking at the length anyway.

  • WebProcess/Plugins/Netscape/JSNPMethod.cpp:

(WebKit::JSNPMethod::finishCreation):

Location:
trunk/Source
Files:
56 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp

    r261895 r267364  
    4444void JSCallbackFunction::finishCreation(VM& vm, const String& name)
    4545{
    46     Base::finishCreation(vm, name);
     46    Base::finishCreation(vm, 0, name);
    4747    ASSERT(inherits(vm, info()));
    4848}

  • trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.mm

    r261569 r267364  
    548548    Structure* structure = globalObject->objcCallbackFunctionStructure();
    549549    ObjCCallbackFunction* function = new (NotNull, allocateCell<ObjCCallbackFunction>(vm.heap)) ObjCCallbackFunction(vm, structure, objCCallbackFunctionCallAsFunction, objCCallbackFunctionCallAsConstructor, WTFMove(impl));
    550     function->finishCreation(vm, name);
     550    function->finishCreation(vm, 0, name);
    551551    return function;
    552552}

  • trunk/Source/JavaScriptCore/API/glib/JSCCallbackFunction.cpp

    r252875 r267364  
    5757    Structure* structure = globalObject->glibCallbackFunctionStructure();
    5858    JSCCallbackFunction* function = new (NotNull, allocateCell<JSCCallbackFunction>(vm.heap)) JSCCallbackFunction(vm, structure, type, jscClass, WTFMove(closure), returnType, WTFMove(parameters));
    59     function->finishCreation(vm, name);
     59    function->finishCreation(vm, 0, name);
    6060    return function;
    6161}

  • trunk/Source/JavaScriptCore/ChangeLog

    r267348 r267364  
     12020-09-21  Keith Miller  <keith_miller@apple.com>
     2
     3        Functions should consistently enumerate length before name
     4        https://bugs.webkit.org/show_bug.cgi?id=216789
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        In https://github.com/tc39/ecma262/pull/2116, which has been
     9        approved to be merged into the main JS spec, it's expected that
     10        all functions should have their length property enumerated before
     11        the name property. To ensure this invariant, this patch moves the
     12        length set into InternalFunction::finishCreation.
     13
     14        There are no new tests since tests will be added to test262 when
     15        the spec PR is merged. Adding tests to stress just means we will
     16        have the same test twice, which seems like a waste.
     17
     18        * API/JSCallbackFunction.cpp:
     19        (JSC::JSCallbackFunction::finishCreation):
     20        * API/ObjCCallbackFunction.mm:
     21        (JSC::ObjCCallbackFunction::create):
     22        * API/glib/JSCCallbackFunction.cpp:
     23        (JSC::JSCCallbackFunction::create):
     24        * runtime/AggregateErrorConstructor.cpp:
     25        (JSC::AggregateErrorConstructor::finishCreation):
     26        * runtime/ArrayConstructor.cpp:
     27        (JSC::ArrayConstructor::finishCreation):
     28        * runtime/AsyncFunctionConstructor.cpp:
     29        (JSC::AsyncFunctionConstructor::finishCreation):
     30        * runtime/AsyncGeneratorFunctionConstructor.cpp:
     31        (JSC::AsyncGeneratorFunctionConstructor::finishCreation):
     32        * runtime/BigIntConstructor.cpp:
     33        (JSC::BigIntConstructor::finishCreation):
     34        * runtime/BooleanConstructor.cpp:
     35        (JSC::BooleanConstructor::finishCreation):
     36        * runtime/DateConstructor.cpp:
     37        (JSC::DateConstructor::finishCreation):
     38        * runtime/ErrorConstructor.cpp:
     39        (JSC::ErrorConstructor::finishCreation):
     40        * runtime/FinalizationRegistryConstructor.cpp:
     41        (JSC::FinalizationRegistryConstructor::finishCreation):
     42        * runtime/FunctionConstructor.cpp:
     43        (JSC::FunctionConstructor::finishCreation):
     44        * runtime/FunctionPrototype.cpp:
     45        (JSC::FunctionPrototype::finishCreation):
     46        * runtime/GeneratorFunctionConstructor.cpp:
     47        (JSC::GeneratorFunctionConstructor::finishCreation):
     48        * runtime/InternalFunction.cpp:
     49        (JSC::InternalFunction::finishCreation):
     50        (JSC::InternalFunction::createFunctionThatMasqueradesAsUndefined):
     51        * runtime/InternalFunction.h:
     52        * runtime/IntlCollatorConstructor.cpp:
     53        (JSC::IntlCollatorConstructor::finishCreation):
     54        * runtime/IntlDateTimeFormatConstructor.cpp:
     55        (JSC::IntlDateTimeFormatConstructor::finishCreation):
     56        * runtime/IntlDisplayNamesConstructor.cpp:
     57        (JSC::IntlDisplayNamesConstructor::finishCreation):
     58        * runtime/IntlLocaleConstructor.cpp:
     59        (JSC::IntlLocaleConstructor::finishCreation):
     60        * runtime/IntlNumberFormatConstructor.cpp:
     61        (JSC::IntlNumberFormatConstructor::finishCreation):
     62        * runtime/IntlPluralRulesConstructor.cpp:
     63        (JSC::IntlPluralRulesConstructor::finishCreation):
     64        * runtime/IntlRelativeTimeFormatConstructor.cpp:
     65        (JSC::IntlRelativeTimeFormatConstructor::finishCreation):
     66        * runtime/IntlSegmenterConstructor.cpp:
     67        (JSC::IntlSegmenterConstructor::finishCreation):
     68        * runtime/JSArrayBufferConstructor.cpp:
     69        (JSC::JSGenericArrayBufferConstructor<sharingMode>::finishCreation):
     70        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
     71        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
     72        * runtime/JSTypedArrayViewConstructor.cpp:
     73        (JSC::JSTypedArrayViewConstructor::finishCreation):
     74        * runtime/MapConstructor.cpp:
     75        (JSC::MapConstructor::finishCreation):
     76        * runtime/NativeErrorConstructor.cpp:
     77        (JSC::NativeErrorConstructorBase::finishCreation):
     78        * runtime/NullGetterFunction.h:
     79        * runtime/NullSetterFunction.h:
     80        * runtime/NumberConstructor.cpp:
     81        (JSC::NumberConstructor::finishCreation):
     82        * runtime/ObjectConstructor.cpp:
     83        (JSC::ObjectConstructor::finishCreation):
     84        * runtime/ProxyConstructor.cpp:
     85        (JSC::ProxyConstructor::finishCreation):
     86        * runtime/ProxyRevoke.cpp:
     87        (JSC::ProxyRevoke::finishCreation):
     88        * runtime/RegExpConstructor.cpp:
     89        (JSC::RegExpConstructor::finishCreation):
     90        * runtime/SetConstructor.cpp:
     91        (JSC::SetConstructor::finishCreation):
     92        * runtime/StringConstructor.cpp:
     93        (JSC::StringConstructor::finishCreation):
     94        * runtime/SymbolConstructor.cpp:
     95        (JSC::SymbolConstructor::finishCreation):
     96        * runtime/WeakMapConstructor.cpp:
     97        (JSC::WeakMapConstructor::finishCreation):
     98        * runtime/WeakObjectRefConstructor.cpp:
     99        (JSC::WeakObjectRefConstructor::finishCreation):
     100        * runtime/WeakSetConstructor.cpp:
     101        (JSC::WeakSetConstructor::finishCreation):
     102        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
     103        (JSC::WebAssemblyCompileErrorConstructor::finishCreation):
     104        * wasm/js/WebAssemblyGlobalConstructor.cpp:
     105        (JSC::WebAssemblyGlobalConstructor::finishCreation):
     106        * wasm/js/WebAssemblyInstanceConstructor.cpp:
     107        (JSC::WebAssemblyInstanceConstructor::finishCreation):
     108        * wasm/js/WebAssemblyLinkErrorConstructor.cpp:
     109        (JSC::WebAssemblyLinkErrorConstructor::finishCreation):
     110        * wasm/js/WebAssemblyMemoryConstructor.cpp:
     111        (JSC::WebAssemblyMemoryConstructor::finishCreation):
     112        * wasm/js/WebAssemblyModuleConstructor.cpp:
     113        (JSC::WebAssemblyModuleConstructor::finishCreation):
     114        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
     115        (JSC::WebAssemblyRuntimeErrorConstructor::finishCreation):
     116        * wasm/js/WebAssemblyTableConstructor.cpp:
     117        (JSC::WebAssemblyTableConstructor::finishCreation):
     118
    11192020-09-21  Yusuke Suzuki  <ysuzuki@apple.com>
    2120

  • trunk/Source/JavaScriptCore/runtime/AggregateErrorConstructor.cpp

    r261895 r267364  
    5050void AggregateErrorConstructor::finishCreation(VM& vm, AggregateErrorPrototype* prototype)
    5151{
    52     Base::finishCreation(vm, errorTypeName(ErrorType::AggregateError), NameAdditionMode::WithoutStructureTransition);
     52    Base::finishCreation(vm, 2, errorTypeName(ErrorType::AggregateError), PropertyAdditionMode::WithoutStructureTransition);
    5353    ASSERT(inherits(vm, info()));
    5454
    55     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(2), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    5655    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    5756}

  • trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp

    r261895 r267364  
    5454void ArrayConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, ArrayPrototype* arrayPrototype, GetterSetter* speciesSymbol)
    5555{
    56     Base::finishCreation(vm, vm.propertyNames->Array.string(), NameAdditionMode::WithoutStructureTransition);
     56    Base::finishCreation(vm, 1, vm.propertyNames->Array.string(), PropertyAdditionMode::WithoutStructureTransition);
    5757    putDirectWithoutTransition(vm, vm.propertyNames->prototype, arrayPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    58     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    5958    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6059    JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->isArray, arrayConstructorIsArrayCodeGenerator, static_cast<unsigned>(PropertyAttribute::DontEnum));

  • trunk/Source/JavaScriptCore/runtime/AsyncFunctionConstructor.cpp

    r261895 r267364  
    5656void AsyncFunctionConstructor::finishCreation(VM& vm, AsyncFunctionPrototype* prototype)
    5757{
    58     Base::finishCreation(vm, "AsyncFunction"_s, NameAdditionMode::WithoutStructureTransition);
     58    Base::finishCreation(vm, 1, "AsyncFunction"_s, PropertyAdditionMode::WithoutStructureTransition);
    5959    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    60     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6160}
    6261

  • trunk/Source/JavaScriptCore/runtime/AsyncGeneratorFunctionConstructor.cpp

    r261895 r267364  
    5656void AsyncGeneratorFunctionConstructor::finishCreation(VM& vm, AsyncGeneratorFunctionPrototype* prototype)
    5757{
    58     Base::finishCreation(vm, "AsyncGeneratorFunction"_s, NameAdditionMode::WithoutStructureTransition);
     58    Base::finishCreation(vm, 1, "AsyncGeneratorFunction"_s, PropertyAdditionMode::WithoutStructureTransition);
    5959    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    60 
    61     // Number of arguments for constructor
    62     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6360}
    6461

  • trunk/Source/JavaScriptCore/runtime/BigIntConstructor.cpp

    r262342 r267364  
    6464void BigIntConstructor::finishCreation(VM& vm, BigIntPrototype* bigIntPrototype)
    6565{
    66     Base::finishCreation(vm, "BigInt"_s, NameAdditionMode::WithoutStructureTransition);
     66    Base::finishCreation(vm, 1, "BigInt"_s, PropertyAdditionMode::WithoutStructureTransition);
    6767    ASSERT(inherits(vm, info()));
    6868
    6969    putDirectWithoutTransition(vm, vm.propertyNames->prototype, bigIntPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    70     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    7170}
    7271

  • trunk/Source/JavaScriptCore/runtime/BooleanConstructor.cpp

    r261895 r267364  
    6262void BooleanConstructor::finishCreation(VM& vm, BooleanPrototype* booleanPrototype)
    6363{
    64     Base::finishCreation(vm, vm.propertyNames->Boolean.string(), NameAdditionMode::WithoutStructureTransition);
     64    Base::finishCreation(vm, 1, vm.propertyNames->Boolean.string(), PropertyAdditionMode::WithoutStructureTransition);
    6565    putDirectWithoutTransition(vm, vm.propertyNames->prototype, booleanPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    66     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6766}
    6867

  • trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp

    r262535 r267364  
    6363void DateConstructor::finishCreation(VM& vm, DatePrototype* datePrototype)
    6464{
    65     Base::finishCreation(vm, vm.propertyNames->Date.string(), NameAdditionMode::WithoutStructureTransition);
     65    Base::finishCreation(vm, 7, vm.propertyNames->Date.string(), PropertyAdditionMode::WithoutStructureTransition);
    6666    putDirectWithoutTransition(vm, vm.propertyNames->prototype, datePrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    67     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(7), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6867}
    6968

  • trunk/Source/JavaScriptCore/runtime/ErrorConstructor.cpp

    r261895 r267364  
    4141void ErrorConstructor::finishCreation(VM& vm, ErrorPrototype* errorPrototype)
    4242{
    43     Base::finishCreation(vm, vm.propertyNames->Error.string(), NameAdditionMode::WithoutStructureTransition);
     43    Base::finishCreation(vm, 1, vm.propertyNames->Error.string(), PropertyAdditionMode::WithoutStructureTransition);
    4444    // ECMA 15.11.3.1 Error.prototype
    4545    putDirectWithoutTransition(vm, vm.propertyNames->prototype, errorPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    46     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4746    putDirectWithoutTransition(vm, vm.propertyNames->stackTraceLimit, jsNumber(globalObject()->stackTraceLimit().valueOr(Options::defaultErrorStackTraceLimit())), static_cast<unsigned>(PropertyAttribute::None));
    4847}

  • trunk/Source/JavaScriptCore/runtime/FinalizationRegistryConstructor.cpp

    r264617 r267364  
    4242void FinalizationRegistryConstructor::finishCreation(VM& vm, FinalizationRegistryPrototype* prototype)
    4343{
    44     Base::finishCreation(vm, "FinalizationRegistry"_s, NameAdditionMode::WithoutStructureTransition);
     44    Base::finishCreation(vm, 1, "FinalizationRegistry"_s, PropertyAdditionMode::WithoutStructureTransition);
    4545    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    46     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4746}
    4847

  • trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp

    r264304 r267364  
    5858void FunctionConstructor::finishCreation(VM& vm, FunctionPrototype* functionPrototype)
    5959{
    60     Base::finishCreation(vm, vm.propertyNames->Function.string(), NameAdditionMode::WithoutStructureTransition);
     60    Base::finishCreation(vm, 1, vm.propertyNames->Function.string(), PropertyAdditionMode::WithoutStructureTransition);
    6161    putDirectWithoutTransition(vm, vm.propertyNames->prototype, functionPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    62     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6362}
    6463

  • trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp

    r266018 r267364  
    4848void FunctionPrototype::finishCreation(VM& vm, const String& name)
    4949{
    50     Base::finishCreation(vm, name, NameAdditionMode::WithoutStructureTransition);
     50    Base::finishCreation(vm, 0, name, PropertyAdditionMode::WithoutStructureTransition);
    5151    ASSERT(inherits(vm, info()));
    52     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    5352}
    5453

  • trunk/Source/JavaScriptCore/runtime/GeneratorFunctionConstructor.cpp

    r261895 r267364  
    5656void GeneratorFunctionConstructor::finishCreation(VM& vm, GeneratorFunctionPrototype* generatorFunctionPrototype)
    5757{
    58     Base::finishCreation(vm, "GeneratorFunction"_s, NameAdditionMode::WithoutStructureTransition);
     58    Base::finishCreation(vm, 1, "GeneratorFunction"_s, PropertyAdditionMode::WithoutStructureTransition);
    5959    putDirectWithoutTransition(vm, vm.propertyNames->prototype, generatorFunctionPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    60     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6160}
    6261

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp

    r266210 r267364  
    4444}
    4545
    46 void InternalFunction::finishCreation(VM& vm, const String& name, NameAdditionMode nameAdditionMode)
     46void InternalFunction::finishCreation(VM& vm, unsigned length, const String& name, PropertyAdditionMode nameAdditionMode)
    4747{
    4848    Base::finishCreation(vm);
    … …  
    5252    ASSERT(methodTable(vm)->getConstructData == InternalFunction::info()->methodTable.getConstructData);
    5353    ASSERT(type() == InternalFunctionType || type() == NullSetterFunctionType);
     54
    5455    JSString* nameString = jsString(vm, name);
    5556    m_originalName.set(vm, this, nameString);
    56     if (nameAdditionMode == NameAdditionMode::WithStructureTransition)
     57    // The enumeration order is length followed by name. So, we make sure to add the properties in that order.
     58    if (nameAdditionMode == PropertyAdditionMode::WithStructureTransition) {
     59        putDirect(vm, vm.propertyNames->length, jsNumber(length), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    5760        putDirect(vm, vm.propertyNames->name, nameString, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    58     else
     61    } else {
     62        putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(length), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    5963        putDirectWithoutTransition(vm, vm.propertyNames->name, nameString, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     64    }
    6065}
    6166
    … …  
    160165    globalObject->masqueradesAsUndefinedWatchpoint()->fireAll(globalObject->vm(), "Allocated masquerading object");
    161166    InternalFunction* function = new (NotNull, allocateCell<InternalFunction>(vm.heap)) InternalFunction(vm, structure, nativeFunction);
    162     function->finishCreation(vm, name, NameAdditionMode::WithoutStructureTransition);
    163     function->putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(length), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     167    function->finishCreation(vm, length, name, PropertyAdditionMode::WithoutStructureTransition);
    164168    return function;
    165169}

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.h

    r266210 r267364  
    8787    JS_EXPORT_PRIVATE InternalFunction(VM&, Structure*, NativeFunction functionForCall, NativeFunction functionForConstruct = nullptr);
    8888
    89     enum class NameAdditionMode { WithStructureTransition, WithoutStructureTransition };
    90     JS_EXPORT_PRIVATE void finishCreation(VM&, const String& name, NameAdditionMode = NameAdditionMode::WithStructureTransition);
     89    enum class PropertyAdditionMode { WithStructureTransition, WithoutStructureTransition };
     90    JS_EXPORT_PRIVATE void finishCreation(VM&, unsigned length, const String& name, PropertyAdditionMode = PropertyAdditionMode::WithStructureTransition);
    9191
    9292    JS_EXPORT_PRIVATE static CallData getConstructData(JSCell*);

  • trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp

    r261895 r267364  
    7676void IntlCollatorConstructor::finishCreation(VM& vm, IntlCollatorPrototype* collatorPrototype)
    7777{
    78     Base::finishCreation(vm, "Collator"_s, NameAdditionMode::WithoutStructureTransition);
     78    Base::finishCreation(vm, 0, "Collator"_s, PropertyAdditionMode::WithoutStructureTransition);
    7979    putDirectWithoutTransition(vm, vm.propertyNames->prototype, collatorPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    80     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    8180    collatorPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
    8281}

  • trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp

    r266655 r267364  
    7575void IntlDateTimeFormatConstructor::finishCreation(VM& vm, IntlDateTimeFormatPrototype* dateTimeFormatPrototype)
    7676{
    77     Base::finishCreation(vm, "DateTimeFormat"_s, NameAdditionMode::WithoutStructureTransition);
     77    Base::finishCreation(vm, 0, "DateTimeFormat"_s, PropertyAdditionMode::WithoutStructureTransition);
    7878    putDirectWithoutTransition(vm, vm.propertyNames->prototype, dateTimeFormatPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    79     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    8079}
    8180

  • trunk/Source/JavaScriptCore/runtime/IntlDisplayNamesConstructor.cpp

    r264639 r267364  
    7373void IntlDisplayNamesConstructor::finishCreation(VM& vm, IntlDisplayNamesPrototype* displayNamesPrototype)
    7474{
    75     Base::finishCreation(vm, "DisplayNames"_s, NameAdditionMode::WithoutStructureTransition);
     75    Base::finishCreation(vm, 2, "DisplayNames"_s, PropertyAdditionMode::WithoutStructureTransition);
    7676    putDirectWithoutTransition(vm, vm.propertyNames->prototype, displayNamesPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    77     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(2), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    7877    displayNamesPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
    7978}

  • trunk/Source/JavaScriptCore/runtime/IntlLocaleConstructor.cpp

    r261895 r267364  
    5959void IntlLocaleConstructor::finishCreation(VM& vm, IntlLocalePrototype* localePrototype)
    6060{
    61     Base::finishCreation(vm, "Locale"_s, NameAdditionMode::WithoutStructureTransition);
     61    Base::finishCreation(vm, 1, "Locale"_s, PropertyAdditionMode::WithoutStructureTransition);
    6262    putDirectWithoutTransition(vm, vm.propertyNames->prototype, localePrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    63     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6463    localePrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
    6564}

  • trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp

    r266655 r267364  
    7575void IntlNumberFormatConstructor::finishCreation(VM& vm, IntlNumberFormatPrototype* numberFormatPrototype)
    7676{
    77     Base::finishCreation(vm, "NumberFormat"_s, NameAdditionMode::WithoutStructureTransition);
     77    Base::finishCreation(vm, 0, "NumberFormat"_s, PropertyAdditionMode::WithoutStructureTransition);
    7878    putDirectWithoutTransition(vm, vm.propertyNames->prototype, numberFormatPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    79     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    8079}
    8180

  • trunk/Source/JavaScriptCore/runtime/IntlPluralRulesConstructor.cpp

    r261895 r267364  
    7575void IntlPluralRulesConstructor::finishCreation(VM& vm, IntlPluralRulesPrototype* pluralRulesPrototype)
    7676{
    77     Base::finishCreation(vm, "PluralRules"_s, NameAdditionMode::WithoutStructureTransition);
     77    Base::finishCreation(vm, 0, "PluralRules"_s, PropertyAdditionMode::WithoutStructureTransition);
    7878    putDirectWithoutTransition(vm, vm.propertyNames->prototype, pluralRulesPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    79     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    8079    pluralRulesPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
    8180}

  • trunk/Source/JavaScriptCore/runtime/IntlRelativeTimeFormatConstructor.cpp

    r261895 r267364  
    7474void IntlRelativeTimeFormatConstructor::finishCreation(VM& vm, IntlRelativeTimeFormatPrototype* relativeTimeFormatPrototype)
    7575{
    76     Base::finishCreation(vm, "RelativeTimeFormat"_s, NameAdditionMode::WithoutStructureTransition);
     76    Base::finishCreation(vm, 0, "RelativeTimeFormat"_s, PropertyAdditionMode::WithoutStructureTransition);
    7777    putDirectWithoutTransition(vm, vm.propertyNames->prototype, relativeTimeFormatPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    78     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    7978    relativeTimeFormatPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
    8079}

  • trunk/Source/JavaScriptCore/runtime/IntlSegmenterConstructor.cpp

    r266032 r267364  
    7373void IntlSegmenterConstructor::finishCreation(VM& vm, IntlSegmenterPrototype* segmenterPrototype)
    7474{
    75     Base::finishCreation(vm, "Segmenter"_s, NameAdditionMode::WithoutStructureTransition);
     75    Base::finishCreation(vm, 0, "Segmenter"_s, PropertyAdditionMode::WithoutStructureTransition);
    7676    putDirectWithoutTransition(vm, vm.propertyNames->prototype, segmenterPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    77     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    7877    segmenterPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
    7978}

  • trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp

    r261895 r267364  
    5858void JSGenericArrayBufferConstructor<sharingMode>::finishCreation(VM& vm, JSArrayBufferPrototype* prototype, GetterSetter* speciesSymbol)
    5959{
    60     Base::finishCreation(vm, arrayBufferSharingModeName(sharingMode), NameAdditionMode::WithoutStructureTransition);
     60    Base::finishCreation(vm, 1, arrayBufferSharingModeName(sharingMode), PropertyAdditionMode::WithoutStructureTransition);
    6161    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    62     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    6362    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6463

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h

    r266529 r267364  
    5353void JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation(VM& vm, JSGlobalObject* globalObject, JSObject* prototype, const String& name, FunctionExecutable* privateAllocator)
    5454{
    55     Base::finishCreation(vm, name, NameAdditionMode::WithoutStructureTransition);
     55    Base::finishCreation(vm, ViewClass::TypedArrayStorageType == TypeDataView ? 1 : 3, name, PropertyAdditionMode::WithoutStructureTransition);
    5656    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    57     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(ViewClass::TypedArrayStorageType == TypeDataView ? 1 : 3), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    5857    putDirectWithoutTransition(vm, vm.propertyNames->BYTES_PER_ELEMENT, jsNumber(ViewClass::elementSize), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly | PropertyAttribute::DontDelete);
    5958

  • trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp

    r261895 r267364  
    4444void JSTypedArrayViewConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, JSTypedArrayViewPrototype* prototype, GetterSetter* speciesSymbol)
    4545{
    46     Base::finishCreation(vm, "TypedArray"_s, NameAdditionMode::WithoutStructureTransition);
     46    Base::finishCreation(vm, 0, "TypedArray"_s, PropertyAdditionMode::WithoutStructureTransition);
    4747    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    48     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4948    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    5049

  • trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp

    r261895 r267364  
    3838void MapConstructor::finishCreation(VM& vm, MapPrototype* mapPrototype, GetterSetter* speciesSymbol)
    3939{
    40     Base::finishCreation(vm, "Map"_s, NameAdditionMode::WithoutStructureTransition);
     40    Base::finishCreation(vm, 0, "Map"_s, PropertyAdditionMode::WithoutStructureTransition);
    4141    putDirectWithoutTransition(vm, vm.propertyNames->prototype, mapPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    42     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4342    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    4443}

  • trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp

    r261895 r267364  
    4040void NativeErrorConstructorBase::finishCreation(VM& vm, NativeErrorPrototype* prototype, ErrorType errorType)
    4141{
    42     Base::finishCreation(vm, errorTypeName(errorType), NameAdditionMode::WithoutStructureTransition);
     42    Base::finishCreation(vm, 1, errorTypeName(errorType), PropertyAdditionMode::WithoutStructureTransition);
    4343    ASSERT(inherits(vm, info()));
    4444   
    45     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4645    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    4746}

  • trunk/Source/JavaScriptCore/runtime/NullGetterFunction.h

    r253019 r267364  
    3838        // Since NullGetterFunction is per JSGlobalObject, we use put-without-transition in InternalFunction::finishCreation.
    3939        NullGetterFunction* function = new (NotNull, allocateCell< NullGetterFunction>(vm.heap))  NullGetterFunction(vm, structure);
    40         function->finishCreation(vm, String(), NameAdditionMode::WithoutStructureTransition);
     40        function->finishCreation(vm, 0, String(), PropertyAdditionMode::WithoutStructureTransition);
    4141        return function;
    4242    }

  • trunk/Source/JavaScriptCore/runtime/NullSetterFunction.h

    r263134 r267364  
    3636    static NullSetterFunction* create(VM& vm, Structure* structure, ECMAMode ecmaMode)
    3737    {
    38         NullSetterFunction* function = new (NotNull, allocateCell< NullSetterFunction>(vm.heap))  NullSetterFunction(vm, structure, ecmaMode);
    39         function->finishCreation(vm, String());
     38        NullSetterFunction* function = new (NotNull, allocateCell<NullSetterFunction>(vm.heap))  NullSetterFunction(vm, structure, ecmaMode);
     39        function->finishCreation(vm, 0, String());
    4040        return function;
    4141    }

  • trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp

    r261895 r267364  
    6060void NumberConstructor::finishCreation(VM& vm, NumberPrototype* numberPrototype)
    6161{
    62     Base::finishCreation(vm, vm.propertyNames->Number.string(), NameAdditionMode::WithoutStructureTransition);
     62    Base::finishCreation(vm, 1, vm.propertyNames->Number.string(), PropertyAdditionMode::WithoutStructureTransition);
    6363    ASSERT(inherits(vm, info()));
    6464
    … …  
    6666
    6767    putDirectWithoutTransition(vm, vm.propertyNames->prototype, numberPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    68     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6968
    7069    putDirectWithoutTransition(vm, Identifier::fromString(vm, "EPSILON"), jsDoubleNumber(std::numeric_limits<double>::epsilon()), PropertyAttribute::DontDelete | PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);

  • trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp

    r267040 r267364  
    9494void ObjectConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, ObjectPrototype* objectPrototype)
    9595{
    96     Base::finishCreation(vm, vm.propertyNames->Object.string(), NameAdditionMode::WithoutStructureTransition);
     96    Base::finishCreation(vm, 1, vm.propertyNames->Object.string(), PropertyAdditionMode::WithoutStructureTransition);
    9797
    9898    putDirectWithoutTransition(vm, vm.propertyNames->prototype, objectPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    99     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    10099
    101100    JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().createPrivateName(), objectConstructorCreate, static_cast<unsigned>(PropertyAttribute::DontEnum), 2);

  • trunk/Source/JavaScriptCore/runtime/ProxyConstructor.cpp

    r261895 r267364  
    7676void ProxyConstructor::finishCreation(VM& vm, const char* name, JSGlobalObject* globalObject)
    7777{
    78     Base::finishCreation(vm, name, NameAdditionMode::WithStructureTransition);
    79     putDirect(vm, vm.propertyNames->length, jsNumber(2), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     78    Base::finishCreation(vm, 2, name, PropertyAdditionMode::WithStructureTransition);
    8079    putDirect(vm, makeIdentifier(vm, "revocable"), JSFunction::create(vm, globalObject, 2, "revocable"_s, makeRevocableProxy));
    8180}

  • trunk/Source/JavaScriptCore/runtime/ProxyRevoke.cpp

    r261895 r267364  
    5252void ProxyRevoke::finishCreation(VM& vm, ProxyObject* proxy)
    5353{
    54     Base::finishCreation(vm, emptyString());
     54    Base::finishCreation(vm, 0, emptyString());
    5555    m_proxy.set(vm, this, proxy);
    56 
    57     putDirect(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    5856}
    5957

  • trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp

    r261895 r267364  
    8787void RegExpConstructor::finishCreation(VM& vm, RegExpPrototype* regExpPrototype, GetterSetter* speciesSymbol)
    8888{
    89     Base::finishCreation(vm, vm.propertyNames->RegExp.string(), NameAdditionMode::WithoutStructureTransition);
     89    Base::finishCreation(vm, 2, vm.propertyNames->RegExp.string(), PropertyAdditionMode::WithoutStructureTransition);
    9090    ASSERT(inherits(vm, info()));
    9191
    9292    putDirectWithoutTransition(vm, vm.propertyNames->prototype, regExpPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    93     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(2), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    9493
    9594    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);

  • trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp

    r261755 r267364  
    3838void SetConstructor::finishCreation(VM& vm, SetPrototype* setPrototype, GetterSetter* speciesSymbol)
    3939{
    40     Base::finishCreation(vm, vm.propertyNames->Set.string(), NameAdditionMode::WithoutStructureTransition);
     40    Base::finishCreation(vm, 0, vm.propertyNames->Set.string(), PropertyAdditionMode::WithoutStructureTransition);
    4141    putDirectWithoutTransition(vm, vm.propertyNames->prototype, setPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    42     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4342    putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    4443}

  • trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp

    r261895 r267364  
    6060void StringConstructor::finishCreation(VM& vm, StringPrototype* stringPrototype)
    6161{
    62     Base::finishCreation(vm, vm.propertyNames->String.string(), NameAdditionMode::WithoutStructureTransition);
     62    Base::finishCreation(vm, 1, vm.propertyNames->String.string(), PropertyAdditionMode::WithoutStructureTransition);
    6363    putDirectWithoutTransition(vm, vm.propertyNames->prototype, stringPrototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
    64     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    6564}
    6665

  • trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp

    r261895 r267364  
    6767void SymbolConstructor::finishCreation(VM& vm, SymbolPrototype* prototype)
    6868{
    69     Base::finishCreation(vm, vm.propertyNames->Symbol.string(), NameAdditionMode::WithoutStructureTransition);
     69    Base::finishCreation(vm, 0, vm.propertyNames->Symbol.string(), PropertyAdditionMode::WithoutStructureTransition);
    7070    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    71     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    7271
    7372    JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_WELL_KNOWN_SYMBOLS)

  • trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp

    r261895 r267364  
    3838void WeakMapConstructor::finishCreation(VM& vm, WeakMapPrototype* prototype)
    3939{
    40     Base::finishCreation(vm, "WeakMap"_s, NameAdditionMode::WithoutStructureTransition);
     40    Base::finishCreation(vm, 0, "WeakMap"_s, PropertyAdditionMode::WithoutStructureTransition);
    4141    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    42     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4342}
    4443

  • trunk/Source/JavaScriptCore/runtime/WeakObjectRefConstructor.cpp

    r261895 r267364  
    3737void WeakObjectRefConstructor::finishCreation(VM& vm, WeakObjectRefPrototype* prototype)
    3838{
    39     Base::finishCreation(vm, "WeakRef"_s, NameAdditionMode::WithoutStructureTransition);
     39    Base::finishCreation(vm, 1, "WeakRef"_s, PropertyAdditionMode::WithoutStructureTransition);
    4040    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    41     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4241}
    4342

  • trunk/Source/JavaScriptCore/runtime/WeakSetConstructor.cpp

    r261755 r267364  
    3838void WeakSetConstructor::finishCreation(VM& vm, WeakSetPrototype* prototype)
    3939{
    40     Base::finishCreation(vm, "WeakSet"_s, NameAdditionMode::WithoutStructureTransition);
     40    Base::finishCreation(vm, 0, "WeakSet"_s, PropertyAdditionMode::WithoutStructureTransition);
    4141    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    42     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
    4342}
    4443

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyCompileErrorConstructor.cpp

    r262492 r267364  
    8080void WebAssemblyCompileErrorConstructor::finishCreation(VM& vm, WebAssemblyCompileErrorPrototype* prototype)
    8181{
    82     Base::finishCreation(vm, "CompileError"_s, NameAdditionMode::WithoutStructureTransition);
     82    Base::finishCreation(vm, 1, "CompileError"_s, PropertyAdditionMode::WithoutStructureTransition);
    8383    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
    84     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    8584}
    8685

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyGlobalConstructor.cpp

    r261755 r267364  
    144144void WebAssemblyGlobalConstructor::finishCreation(VM& vm, WebAssemblyGlobalPrototype* prototype)
    145145{
    146     Base::finishCreation(vm, "Global"_s, NameAdditionMode::WithoutStructureTransition);
     146    Base::finishCreation(vm, 1, "Global"_s, PropertyAdditionMode::WithoutStructureTransition);
    147147    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    148     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    149148}
    150149

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyInstanceConstructor.cpp

    r262492 r267364  
    9898void WebAssemblyInstanceConstructor::finishCreation(VM& vm, WebAssemblyInstancePrototype* prototype)
    9999{
    100     Base::finishCreation(vm, "Instance"_s, NameAdditionMode::WithoutStructureTransition);
     100    Base::finishCreation(vm, 1, "Instance"_s, PropertyAdditionMode::WithoutStructureTransition);
    101101    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    102     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    103102}
    104103

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyLinkErrorConstructor.cpp

    r262492 r267364  
    8080void WebAssemblyLinkErrorConstructor::finishCreation(VM& vm, WebAssemblyLinkErrorPrototype* prototype)
    8181{
    82     Base::finishCreation(vm, "LinkError"_s, NameAdditionMode::WithoutStructureTransition);
     82    Base::finishCreation(vm, 1, "LinkError"_s, PropertyAdditionMode::WithoutStructureTransition);
    8383    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
    84     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    8584}
    8685

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyMemoryConstructor.cpp

    r262098 r267364  
    136136void WebAssemblyMemoryConstructor::finishCreation(VM& vm, WebAssemblyMemoryPrototype* prototype)
    137137{
    138     Base::finishCreation(vm, "Memory"_s, NameAdditionMode::WithoutStructureTransition);
     138    Base::finishCreation(vm, 1, "Memory"_s, PropertyAdditionMode::WithoutStructureTransition);
    139139    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    140     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    141140}
    142141

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleConstructor.cpp

    r262098 r267364  
    201201void WebAssemblyModuleConstructor::finishCreation(VM& vm, WebAssemblyModulePrototype* prototype)
    202202{
    203     Base::finishCreation(vm, "Module"_s, NameAdditionMode::WithoutStructureTransition);
     203    Base::finishCreation(vm, 1, "Module"_s, PropertyAdditionMode::WithoutStructureTransition);
    204204    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    205     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    206205}
    207206

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp

    r262492 r267364  
    8282void WebAssemblyRuntimeErrorConstructor::finishCreation(VM& vm, WebAssemblyRuntimeErrorPrototype* prototype)
    8383{
    84     Base::finishCreation(vm, "RuntimeError"_s, NameAdditionMode::WithoutStructureTransition);
     84    Base::finishCreation(vm, 1, "RuntimeError"_s, PropertyAdditionMode::WithoutStructureTransition);
    8585    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
    86     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    8786}
    8887

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyTableConstructor.cpp

    r262098 r267364  
    128128void WebAssemblyTableConstructor::finishCreation(VM& vm, WebAssemblyTablePrototype* prototype)
    129129{
    130     Base::finishCreation(vm, "Table"_s, NameAdditionMode::WithoutStructureTransition);
     130    Base::finishCreation(vm, 1, "Table"_s, PropertyAdditionMode::WithoutStructureTransition);
    131131    putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
    132     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
    133132}
    134133

  • trunk/Source/WebCore/ChangeLog

    r267363 r267364  
     12020-09-21  Keith Miller  <keith_miller@apple.com>
     2
     3        Functions should consistently enumerate length before name
     4        https://bugs.webkit.org/show_bug.cgi?id=216789
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        RuntimeMethod inherits from InternalFunction which now sets length by default.
     9        RuntimeMethod intercepts length in getOwnPropertySlot so the value we pick
     10        doesn't actually matter. Technically, this uses a little extra memory but
     11        that's not too big of a deal because RuntimeMethod's are rare (and I believe
     12        deprecated).
     13
     14        * bridge/runtime_method.cpp:
     15        (JSC::RuntimeMethod::finishCreation):
     16
    1172020-09-20  Darin Adler  <darin@apple.com>
    218

  • trunk/Source/WebCore/bridge/runtime_method.cpp

    r254010 r267364  
    5555void RuntimeMethod::finishCreation(VM& vm, const String& ident)
    5656{
    57     Base::finishCreation(vm, ident);
     57    Base::finishCreation(vm, 0, ident);
    5858    ASSERT(inherits(vm, info()));
    5959}

  • trunk/Source/WebKit/ChangeLog

    r267363 r267364  
     12020-09-21  Keith Miller  <keith_miller@apple.com>
     2
     3        Functions should consistently enumerate length before name
     4        https://bugs.webkit.org/show_bug.cgi?id=216789
     5
     6        Reviewed by Yusuke Suzuki.
     7
     8        JSNPMethod inherits from InternalFunction which now sets length by default.
     9        I chose 0 because it looks like this function doesn't directly look at any
     10        arguments and I doubt anyone is looking at the length anyway.
     11
     12        * WebProcess/Plugins/Netscape/JSNPMethod.cpp:
     13        (WebKit::JSNPMethod::finishCreation):
     14
    1152020-09-20  Darin Adler  <darin@apple.com>
    216

  • trunk/Source/WebKit/WebProcess/Plugins/Netscape/JSNPMethod.cpp

    r252875 r267364  
    5757void JSNPMethod::finishCreation(VM& vm, const String& name)
    5858{
    59     Base::finishCreation(vm, name);
     59    Base::finishCreation(vm, 0, name);
    6060    ASSERT(inherits(vm, info()));
    6161}
Note: See TracChangeset for help on using the changeset viewer.