Changeset 200416 in webkit


Ignore:
Timestamp:
May 4, 2016 8:48:16 AM (8 years ago)
Author:
Chris Dumez
Message:

Unreviewed, rolling out r200383 and r200406.

Seems to have caused crashes on iOS / ARMv7s

Reverted changesets:

"Speed up JSGlobalObject initialization by making some
properties lazy"
​https://bugs.webkit.org/show_bug.cgi?id=157045
​http://trac.webkit.org/changeset/200383

"REGRESSION(r200383): Setting lazily initialized properties
across frame boundaries crashes"
​https://bugs.webkit.org/show_bug.cgi?id=157333
​http://trac.webkit.org/changeset/200406

Location:
trunk
Files:
7 deleted
41 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r200415 r200416  
     12016-05-04  Chris Dumez  <cdumez@apple.com>
     2
     3        Unreviewed, rolling out r200383 and r200406.
     4
     5        Seems to have caused crashes on iOS / ARMv7s
     6
     7        Reverted changesets:
     8
     9        "Speed up JSGlobalObject initialization by making some
     10        properties lazy"
     11        https://bugs.webkit.org/show_bug.cgi?id=157045
     12        http://trac.webkit.org/changeset/200383
     13
     14        "REGRESSION(r200383): Setting lazily initialized properties
     15        across frame boundaries crashes"
     16        https://bugs.webkit.org/show_bug.cgi?id=157333
     17        http://trac.webkit.org/changeset/200406
     18
    1192016-05-04  Joanmarie Diggs  <jdiggs@igalia.com>
    220

  • trunk/Source/JavaScriptCore/API/JSCallbackFunction.cpp

    r200383 r200416  
    11/*
    2  * Copyright (C) 2006, 2008, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    5959JSCallbackFunction* JSCallbackFunction::create(VM& vm, JSGlobalObject* globalObject, JSObjectCallAsFunctionCallback callback, const String& name)
    6060{
    61     Structure* structure = globalObject->callbackFunctionStructure();
    62     JSCallbackFunction* function = new (NotNull, allocateCell<JSCallbackFunction>(vm.heap)) JSCallbackFunction(vm, structure, callback);
     61    JSCallbackFunction* function = new (NotNull, allocateCell<JSCallbackFunction>(vm.heap)) JSCallbackFunction(vm, globalObject->callbackFunctionStructure(), callback);
    6362    function->finishCreation(vm, name);
    6463    return function;

  • trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.h

    r200383 r200416  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6363
    6464protected:
    65     ObjCCallbackFunction(VM&, Structure*, JSObjectCallAsFunctionCallback, JSObjectCallAsConstructorCallback, std::unique_ptr<ObjCCallbackFunctionImpl>);
     65    ObjCCallbackFunction(VM&, JSGlobalObject*, JSObjectCallAsFunctionCallback, JSObjectCallAsConstructorCallback, std::unique_ptr<ObjCCallbackFunctionImpl>);
    6666
    6767private:

  • trunk/Source/JavaScriptCore/API/ObjCCallbackFunction.mm

    r200383 r200416  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    499499const JSC::ClassInfo ObjCCallbackFunction::s_info = { "CallbackFunction", &Base::s_info, 0, CREATE_METHOD_TABLE(ObjCCallbackFunction) };
    500500
    501 ObjCCallbackFunction::ObjCCallbackFunction(JSC::VM& vm, JSC::Structure* structure, JSObjectCallAsFunctionCallback functionCallback, JSObjectCallAsConstructorCallback constructCallback, std::unique_ptr<ObjCCallbackFunctionImpl> impl)
    502     : Base(vm, structure)
     501ObjCCallbackFunction::ObjCCallbackFunction(JSC::VM& vm, JSC::JSGlobalObject* globalObject, JSObjectCallAsFunctionCallback functionCallback, JSObjectCallAsConstructorCallback constructCallback, std::unique_ptr<ObjCCallbackFunctionImpl> impl)
     502    : Base(vm, globalObject->objcCallbackFunctionStructure())
    503503    , m_functionCallback(functionCallback)
    504504    , m_constructCallback(constructCallback)
    … …  
    509509ObjCCallbackFunction* ObjCCallbackFunction::create(JSC::VM& vm, JSC::JSGlobalObject* globalObject, const String& name, std::unique_ptr<ObjCCallbackFunctionImpl> impl)
    510510{
    511     Structure* structure = globalObject->objcCallbackFunctionStructure();
    512     ObjCCallbackFunction* function = new (NotNull, allocateCell<ObjCCallbackFunction>(vm.heap)) ObjCCallbackFunction(vm, structure, objCCallbackFunctionCallAsFunction, objCCallbackFunctionCallAsConstructor, WTFMove(impl));
     511    ObjCCallbackFunction* function = new (NotNull, allocateCell<ObjCCallbackFunction>(vm.heap)) ObjCCallbackFunction(vm, globalObject, objCCallbackFunctionCallAsFunction, objCCallbackFunctionCallAsConstructor, WTFMove(impl));
    513512    function->finishCreation(vm, name);
    514513    return function;

  • trunk/Source/JavaScriptCore/CMakeLists.txt

    r200383 r200416  
    741741    runtime/JSWithScope.cpp
    742742    runtime/JSWrapperObject.cpp
    743     runtime/LazyClassStructure.cpp
    744743    runtime/LiteralParser.cpp
    745744    runtime/Lookup.cpp

  • trunk/Source/JavaScriptCore/ChangeLog

    r200409 r200416  
     12016-05-04  Chris Dumez  <cdumez@apple.com>
     2
     3        Unreviewed, rolling out r200383 and r200406.
     4
     5        Seems to have caused crashes on iOS / ARMv7s
     6
     7        Reverted changesets:
     8
     9        "Speed up JSGlobalObject initialization by making some
     10        properties lazy"
     11        https://bugs.webkit.org/show_bug.cgi?id=157045
     12        http://trac.webkit.org/changeset/200383
     13
     14        "REGRESSION(r200383): Setting lazily initialized properties
     15        across frame boundaries crashes"
     16        https://bugs.webkit.org/show_bug.cgi?id=157333
     17        http://trac.webkit.org/changeset/200406
     18
    1192016-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
    220

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r200383 r200416  
    19961996                DC2143071CA32E55000A8869 /* ICStats.h in Headers */ = {isa = PBXBuildFile; fileRef = DC2143061CA32E52000A8869 /* ICStats.h */; };
    19971997                DC2143081CA32E58000A8869 /* ICStats.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DC2143051CA32E52000A8869 /* ICStats.cpp */; };
    1998                 DCF3D5691CD2946D003D5C65 /* LazyClassStructure.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DCF3D5641CD29468003D5C65 /* LazyClassStructure.cpp */; };
    1999                 DCF3D56A1CD29470003D5C65 /* LazyClassStructure.h in Headers */ = {isa = PBXBuildFile; fileRef = DCF3D5651CD29468003D5C65 /* LazyClassStructure.h */; settings = {ATTRIBUTES = (Private, ); }; };
    2000                 DCF3D56B1CD29472003D5C65 /* LazyClassStructureInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = DCF3D5661CD29468003D5C65 /* LazyClassStructureInlines.h */; };
    2001                 DCF3D56C1CD29475003D5C65 /* LazyProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = DCF3D5671CD29468003D5C65 /* LazyProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
    2002                 DCF3D56D1CD29476003D5C65 /* LazyPropertyInlines.h in Headers */ = {isa = PBXBuildFile; fileRef = DCF3D5681CD29468003D5C65 /* LazyPropertyInlines.h */; };
    20031998                DE26E9031CB5DD0500D2BE82 /* BuiltinExecutableCreator.h in Headers */ = {isa = PBXBuildFile; fileRef = DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */; };
    20041999                DE26E9071CB5DEFB00D2BE82 /* BuiltinExecutableCreator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = DE26E9061CB5DD9600D2BE82 /* BuiltinExecutableCreator.cpp */; };
    … …  
    42104205                DC2143051CA32E52000A8869 /* ICStats.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ICStats.cpp; sourceTree = "<group>"; };
    42114206                DC2143061CA32E52000A8869 /* ICStats.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ICStats.h; sourceTree = "<group>"; };
    4212                 DCF3D5641CD29468003D5C65 /* LazyClassStructure.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LazyClassStructure.cpp; sourceTree = "<group>"; };
    4213                 DCF3D5651CD29468003D5C65 /* LazyClassStructure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyClassStructure.h; sourceTree = "<group>"; };
    4214                 DCF3D5661CD29468003D5C65 /* LazyClassStructureInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyClassStructureInlines.h; sourceTree = "<group>"; };
    4215                 DCF3D5671CD29468003D5C65 /* LazyProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyProperty.h; sourceTree = "<group>"; };
    4216                 DCF3D5681CD29468003D5C65 /* LazyPropertyInlines.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LazyPropertyInlines.h; sourceTree = "<group>"; };
    42174207                DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BuiltinExecutableCreator.h; sourceTree = "<group>"; };
    42184208                DE26E9061CB5DD9600D2BE82 /* BuiltinExecutableCreator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BuiltinExecutableCreator.cpp; sourceTree = "<group>"; };
    … …  
    55075497                        isa = PBXGroup;
    55085498                        children = (
    5509                                 DCF3D5641CD29468003D5C65 /* LazyClassStructure.cpp */,
    5510                                 DCF3D5651CD29468003D5C65 /* LazyClassStructure.h */,
    5511                                 DCF3D5661CD29468003D5C65 /* LazyClassStructureInlines.h */,
    5512                                 DCF3D5671CD29468003D5C65 /* LazyProperty.h */,
    5513                                 DCF3D5681CD29468003D5C65 /* LazyPropertyInlines.h */,
    55145499                                BCF605110E203EF800B9A64D /* ArgList.cpp */,
    55155500                                BCF605120E203EF800B9A64D /* ArgList.h */,
    … …  
    71437128                                0FFC99D1184EC8AD009C10AB /* ConstantMode.h in Headers */,
    71447129                                E354622B1B6065D100545386 /* ConstructAbility.h in Headers */,
    7145                                 DCF3D56D1CD29476003D5C65 /* LazyPropertyInlines.h in Headers */,
    71467130                                BC18C3F60E16F5CD00B34460 /* ConstructData.h in Headers */,
    71477131                                A57D23F21891B5B40031C7FA /* ContentSearchUtilities.h in Headers */,
    … …  
    77877771                                BC18C4310E16F5CD00B34460 /* Lexer.h in Headers */,
    77887772                                BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */,
    7789                                 DCF3D56B1CD29472003D5C65 /* LazyClassStructureInlines.h in Headers */,
    77907773                                FE187A021BFBE5610038BBCA /* JITMulGenerator.h in Headers */,
    77917774                                86D3B3C310159D7F002865E7 /* LinkBuffer.h in Headers */,
    … …  
    78657848                                86F3EEBF168CDE930077B92A /* ObjcRuntimeExtras.h in Headers */,
    78667849                                14CA958D16AB50FA00938A06 /* ObjectAllocationProfile.h in Headers */,
    7867                                 DCF3D56C1CD29475003D5C65 /* LazyProperty.h in Headers */,
    78687850                                BC18C4450E16F5CD00B34460 /* ObjectConstructor.h in Headers */,
    78697851                                996B73221BDA08EF00331B84 /* ObjectConstructor.lut.h in Headers */,
    … …  
    78817863                                93052C350FB792190048FDC3 /* ParserArena.h in Headers */,
    78827864                                0FCCAE4516D0CF7400D0C65B /* ParserError.h in Headers */,
    7883                                 DCF3D56A1CD29470003D5C65 /* LazyClassStructure.h in Headers */,
    78847865                                A77F1825164192C700640A47 /* ParserModes.h in Headers */,
    78857866                                65303D641447B9E100D3F904 /* ParserTokens.h in Headers */,
    … …  
    89478928                                FE1C0FFF1B194FD100B53FCA /* Exception.cpp in Sources */,
    89488929                                0F12DE0F1979D5FD0006FF4E /* ExceptionFuzz.cpp in Sources */,
    8949                                 DCF3D5691CD2946D003D5C65 /* LazyClassStructure.cpp in Sources */,
    89508930                                1429D8780ED21ACD00B89619 /* ExceptionHelpers.cpp in Sources */,
    89518931                                86CA032E1038E8440028A609 /* Executable.cpp in Sources */,

  • trunk/Source/JavaScriptCore/create_hash_table

    r200383 r200416  
    66#                  David Faure <faure@kde.org>
    77# Modified (c) 2004 by Nikolas Zimmermann <wildfox@kde.org>
    8 # Copyright (C) 2007, 2008, 2009, 2015-2016 Apple Inc. All rights reserved.
     8# Copyright (C) 2007, 2008, 2009, 2015 Apple Inc. All rights reserved.
    99#
    1010# This library is free software; you can redistribute it and/or
    … …  
    9898            $hasSetter = "true";
    9999            push(@values, { "type" => "Accessor", "get" => $get, "put" => $put });
    100         } elsif ($att =~ m/CellProperty/) {
    101             my $property = $val;
    102             push(@values, { "type" => "CellProperty", "property" => $property });
    103         } elsif ($att =~ m/ClassStructure/) {
    104             my $property = $val;
    105             push(@values, { "type" => "ClassStructure", "property" => $property });
    106         } elsif ($att =~ m/PropertyCallback/) {
    107             my $cback = $val;
    108             push(@values, { "type" => "PropertyCallback", "cback" => $cback });
    109100        } elsif (length($att)) {
    110101            my $get = $val;
    … …  
    308299            $firstValue = $values[$i]{"value"};
    309300            $secondValue = "0";
    310         } elsif ($values[$i]{"type"} eq "CellProperty" || $values[$i]{"type"} eq "ClassStructure") {
    311             $values[$i]{"property"} =~ /\A([a-zA-Z0-9_]+)::(.*)\Z/ or die;
    312             $firstValue = "OBJECT_OFFSETOF($1, $2)";
    313             $secondValue = "0";
    314         } elsif ($values[$i]{"type"} eq "PropertyCallback") {
    315             $firstCastStr = "static_cast<LazyPropertyCallback>";
    316             $firstValue = $values[$i]{"cback"};
    317             $secondValue = "0";
    318301        }
    319302

  • trunk/Source/JavaScriptCore/debugger/DebuggerScope.cpp

    r200383 r200416  
    11/*
    2  * Copyright (C) 2008-2009, 2014, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2009, 2014 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3737const ClassInfo DebuggerScope::s_info = { "DebuggerScope", &Base::s_info, 0, CREATE_METHOD_TABLE(DebuggerScope) };
    3838
    39 DebuggerScope* DebuggerScope::create(VM& vm, JSScope* scope)
    40 {
    41     Structure* structure = scope->globalObject()->debuggerScopeStructure();
    42     DebuggerScope* debuggerScope = new (NotNull, allocateCell<DebuggerScope>(vm.heap)) DebuggerScope(vm, structure, scope);
    43     debuggerScope->finishCreation(vm);
    44     return debuggerScope;
    45 }
    46 
    47 DebuggerScope::DebuggerScope(VM& vm, Structure* structure, JSScope* scope)
    48     : JSNonFinalObject(vm, structure)
     39DebuggerScope::DebuggerScope(VM& vm, JSScope* scope)
     40    : JSNonFinalObject(vm, scope->globalObject()->debuggerScopeStructure())
    4941{
    5042    ASSERT(scope);

  • trunk/Source/JavaScriptCore/debugger/DebuggerScope.h

    r200383 r200416  
    11/*
    2  * Copyright (C) 2008-2009, 2014, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2008-2009, 2014 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3939    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
    4040
    41     JS_EXPORT_PRIVATE static DebuggerScope* create(VM& vm, JSScope* scope);
     41    static DebuggerScope* create(VM& vm, JSScope* scope)
     42    {
     43        DebuggerScope* debuggerScope = new (NotNull, allocateCell<DebuggerScope>(vm.heap)) DebuggerScope(vm, scope);
     44        debuggerScope->finishCreation(vm);
     45        return debuggerScope;
     46    }
    4247
    4348    static void visitChildren(JSCell*, SlotVisitor&);
    … …  
    9297
    9398private:
    94     DebuggerScope(VM&, Structure*, JSScope*);
    95     void finishCreation(VM&);
     99    JS_EXPORT_PRIVATE DebuggerScope(VM&, JSScope*);
     100    JS_EXPORT_PRIVATE void finishCreation(VM&);
    96101
    97102    JSScope* jsScope() const { return m_scope.get(); }

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h

    r200383 r200416  
    18671867        forNode(node).set(
    18681868            m_graph,
    1869             m_graph.globalObjectFor(node->origin.semantic)->typedArrayStructureConcurrently(
     1869            m_graph.globalObjectFor(node->origin.semantic)->typedArrayStructure(
    18701870                node->typedArrayType()));
    18711871        break;

  • trunk/Source/JavaScriptCore/dfg/DFGAbstractValue.cpp

    r200383 r200416  
    11/*
    2  * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013-2015 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    7878void AbstractValue::set(Graph& graph, Structure* structure)
    7979{
    80     RELEASE_ASSERT(structure);
    81    
    8280    m_structure = structure;
    8381    m_arrayModes = asArrayModes(structure->indexingType());

  • trunk/Source/JavaScriptCore/dfg/DFGArrayMode.cpp

    r200383 r200416  
    324324        default:
    325325            CRASH();
    326             return nullptr;
     326            return 0;
    327327        }
    328328    }
    … …  
    331331        TypedArrayType type = typedArrayType();
    332332        if (type == NotTypedArray)
    333             return nullptr;
    334        
    335         return globalObject->typedArrayStructureConcurrently(type);
    336     }
    337        
    338     default:
    339         return nullptr;
     333            return 0;
     334       
     335        return globalObject->typedArrayStructure(type);
     336    }
     337       
     338    default:
     339        return 0;
    340340    }
    341341}

  • trunk/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

    r200383 r200416  
    25752575   
    25762576    if (argumentCountIncludingThis != 2)
    2577         return false;
    2578    
    2579     if (!function->globalObject()->typedArrayStructureConcurrently(type))
    25802577        return false;
    25812578

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp

    r200383 r200416  
    67646764    JSGlobalObject* globalObject = m_jit.graph().globalObjectFor(node->origin.semantic);
    67656765    TypedArrayType type = node->typedArrayType();
    6766     Structure* structure = globalObject->typedArrayStructureConcurrently(type);
    6767     RELEASE_ASSERT(structure);
     6766    Structure* structure = globalObject->typedArrayStructure(type);
    67686767   
    67696768    SpeculateInt32Operand size(this, node->child1());

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp

    r200383 r200416  
    38053805            callOperation(
    38063806                operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
    3807                 resultGPR, globalObject->typedArrayStructureConcurrently(node->typedArrayType()),
     3807                resultGPR, globalObject->typedArrayStructure(node->typedArrayType()),
    38083808                argumentTagGPR, argumentPayloadGPR);
    38093809            m_jit.exceptionCheck();

  • trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp

    r200383 r200416  
    38623862            callOperation(
    38633863                operationNewTypedArrayWithOneArgumentForType(node->typedArrayType()),
    3864                 resultGPR, globalObject->typedArrayStructureConcurrently(node->typedArrayType()),
     3864                resultGPR, globalObject->typedArrayStructure(node->typedArrayType()),
    38653865                argumentGPR);
    38663866            m_jit.exceptionCheck();

  • trunk/Source/JavaScriptCore/dfg/DFGStructureRegistrationPhase.cpp

    r200383 r200416  
    11/*
    2  * Copyright (C) 2014-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2014, 2015 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    121121                   
    122122                case NewTypedArray:
    123                     registerStructure(m_graph.globalObjectFor(node->origin.semantic)->typedArrayStructureConcurrently(node->typedArrayType()));
     123                    registerStructure(m_graph.globalObjectFor(node->origin.semantic)->typedArrayStructure(node->typedArrayType()));
    124124                    break;
    125125                   

  • trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp

    r200383 r200416  
    39093909        switch (m_node->child1().useKind()) {
    39103910        case Int32Use: {
    3911             Structure* structure = globalObject->typedArrayStructureConcurrently(type);
     3911            Structure* structure = globalObject->typedArrayStructure(type);
    39123912
    39133913            LValue size = lowInt32(m_node->child1());
    … …  
    39703970            LValue result = vmCall(
    39713971                m_out.intPtr, m_out.operation(operationNewTypedArrayWithOneArgumentForType(type)),
    3972                 m_callFrame, weakPointer(globalObject->typedArrayStructureConcurrently(type)), argument);
     3972                m_callFrame, weakPointer(globalObject->typedArrayStructure(type)), argument);
    39733973
    39743974            setJSValue(result);

  • trunk/Source/JavaScriptCore/runtime/ClonedArguments.cpp

    r200383 r200416  
    11/*
    2  * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    159159        if (isStrictMode) {
    160160            if (ident == vm.propertyNames->callee) {
    161                 slot.setGetterSlot(thisObject, DontDelete | DontEnum | Accessor, thisObject->globalObject()->throwTypeErrorGetterSetter());
     161                slot.setGetterSlot(thisObject, DontDelete | DontEnum | Accessor, thisObject->globalObject()->throwTypeErrorGetterSetter(vm));
    162162                return true;
    163163            }
    164164            if (ident == vm.propertyNames->caller) {
    165                 slot.setGetterSlot(thisObject, DontDelete | DontEnum | Accessor, thisObject->globalObject()->throwTypeErrorGetterSetter());
     165                slot.setGetterSlot(thisObject, DontDelete | DontEnum | Accessor, thisObject->globalObject()->throwTypeErrorGetterSetter(vm));
    166166                return true;
    167167            }
    … …  
    239239   
    240240    if (isStrictMode) {
    241         putDirectAccessor(exec, vm.propertyNames->callee, globalObject()->throwTypeErrorGetterSetter(), DontDelete | DontEnum | Accessor);
    242         putDirectAccessor(exec, vm.propertyNames->caller, globalObject()->throwTypeErrorGetterSetter(), DontDelete | DontEnum | Accessor);
     241        putDirectAccessor(exec, vm.propertyNames->callee, globalObject()->throwTypeErrorGetterSetter(vm), DontDelete | DontEnum | Accessor);
     242        putDirectAccessor(exec, vm.propertyNames->caller, globalObject()->throwTypeErrorGetterSetter(vm), DontDelete | DontEnum | Accessor);
    243243    } else
    244244        putDirect(vm, vm.propertyNames->callee, JSValue(m_callee.get()));

  • trunk/Source/JavaScriptCore/runtime/CommonSlowPaths.cpp

    r200383 r200416  
    763763    int scopeReg = pc[3].u.operand;
    764764    JSScope* currentScope = exec->uncheckedR(scopeReg).Register::scope();
    765     RETURN(JSWithScope::create(vm, exec->lexicalGlobalObject(), newScope, currentScope));
     765    RETURN(JSWithScope::create(exec, newScope, currentScope));
    766766}
    767767

  • trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp

    r200383 r200416  
    105105    if (thisValue.inherits(InternalFunction::info())) {
    106106        InternalFunction* function = asInternalFunction(thisValue);
    107         return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(), "() {\n    [native code]\n}"));
     107        return JSValue::encode(jsMakeNontrivialString(exec, "function ", function->name(exec), "() {\n    [native code]\n}"));
    108108    }
    109109

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.cpp

    r200383 r200416  
    5959}
    6060
    61 const String& InternalFunction::name()
     61const String& InternalFunction::name(ExecState*)
    6262{
    6363    const String& name = m_originalName->tryGetValue();
    … …  
    8989        return explicitName;
    9090   
    91     return name();
     91    return name(exec);
    9292}
    9393

  • trunk/Source/JavaScriptCore/runtime/InternalFunction.h

    r200383 r200416  
    4141    JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
    4242
    43     JS_EXPORT_PRIVATE const String& name();
     43    JS_EXPORT_PRIVATE const String& name(ExecState*);
    4444    const String displayName(ExecState*);
    4545    const String calculatedDisplayName(ExecState*);

  • trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp

    r200383 r200416  
    197197    ASSERT(inherits(info()));
    198198
    199     putDirectNonIndexAccessor(vm, vm.propertyNames->arguments, globalObject()->throwTypeErrorGetterSetter(), DontDelete | DontEnum | Accessor);
    200     putDirectNonIndexAccessor(vm, vm.propertyNames->caller, globalObject()->throwTypeErrorGetterSetter(), DontDelete | DontEnum | Accessor);
     199    putDirectNonIndexAccessor(vm, vm.propertyNames->arguments, globalObject()->throwTypeErrorGetterSetter(vm), DontDelete | DontEnum | Accessor);
     200    putDirectNonIndexAccessor(vm, vm.propertyNames->caller, globalObject()->throwTypeErrorGetterSetter(vm), DontDelete | DontEnum | Accessor);
    201201}
    202202

  • trunk/Source/JavaScriptCore/runtime/JSBoundSlotBaseFunction.cpp

    r200383 r200416  
    6565    NativeExecutable* executable = vm.getHostFunction(boundSlotBaseFunctionCall, callHostFunctionAsConstructor, name);
    6666
    67     Structure* structure = globalObject->boundSlotBaseFunctionStructure();
    68     JSBoundSlotBaseFunction* function = new (NotNull, allocateCell<JSBoundSlotBaseFunction>(vm.heap)) JSBoundSlotBaseFunction(vm, globalObject, structure, type);
     67    JSBoundSlotBaseFunction* function = new (NotNull, allocateCell<JSBoundSlotBaseFunction>(vm.heap)) JSBoundSlotBaseFunction(vm, globalObject, globalObject->boundSlotBaseFunctionStructure(), type);
    6968
    7069    // Can't do this during initialization because getHostFunction might do a GC allocation.

  • trunk/Source/JavaScriptCore/runtime/JSFunction.cpp

    r200383 r200416  
    320320}
    321321
    322 static GetterSetter* getThrowTypeErrorGetterSetter(JSFunction* function)
     322static GetterSetter* getThrowTypeErrorGetterSetter(ExecState* exec, JSFunction* function)
    323323{
    324324    return function->jsExecutable()->isClassConstructorFunction() || function->jsExecutable()->parseMode() == SourceParseMode::MethodMode
    325         ? function->globalObject()->throwTypeErrorArgumentsAndCallerGetterSetter()
    326         : function->globalObject()->throwTypeErrorGetterSetter();
     325        ? function->globalObject()->throwTypeErrorArgumentsAndCallerGetterSetter(exec->vm())
     326        : function->globalObject()->throwTypeErrorGetterSetter(exec->vm());
    327327}
    328328
    … …  
    376376            bool result = Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
    377377            if (!result) {
    378                 GetterSetter* errorGetterSetter = getThrowTypeErrorGetterSetter(thisObject);
     378                GetterSetter* errorGetterSetter = getThrowTypeErrorGetterSetter(exec, thisObject);
    379379                thisObject->putDirectAccessor(exec, propertyName, errorGetterSetter, DontDelete | DontEnum | Accessor);
    380380                result = Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
    … …  
    391391            bool result = Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
    392392            if (!result) {
    393                 GetterSetter* errorGetterSetter = getThrowTypeErrorGetterSetter(thisObject);
     393                GetterSetter* errorGetterSetter = getThrowTypeErrorGetterSetter(exec, thisObject);
    394394                thisObject->putDirectAccessor(exec, propertyName, errorGetterSetter, DontDelete | DontEnum | Accessor);
    395395                result = Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
    … …  
    500500            PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
    501501            if (!Base::getOwnPropertySlot(thisObject, exec, propertyName, slot))
    502                 thisObject->putDirectAccessor(exec, propertyName, thisObject->globalObject()->throwTypeErrorGetterSetter(), DontDelete | DontEnum | Accessor);
     502                thisObject->putDirectAccessor(exec, propertyName, thisObject->globalObject()->throwTypeErrorGetterSetter(exec->vm()), DontDelete | DontEnum | Accessor);
    503503            return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
    504504        }
    … …  
    508508            PropertySlot slot(thisObject, PropertySlot::InternalMethodType::VMInquiry);
    509509            if (!Base::getOwnPropertySlot(thisObject, exec, propertyName, slot))
    510                 thisObject->putDirectAccessor(exec, propertyName, thisObject->globalObject()->throwTypeErrorGetterSetter(), DontDelete | DontEnum | Accessor);
     510                thisObject->putDirectAccessor(exec, propertyName, thisObject->globalObject()->throwTypeErrorGetterSetter(exec->vm()), DontDelete | DontEnum | Accessor);
    511511            return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
    512512        }

  • trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h

    r200383 r200416  
    222222EncodedJSValue JSC_HOST_CALL constructGenericTypedArrayView(ExecState* exec)
    223223{
    224     InternalFunction* function = asInternalFunction(exec->callee());
    225     Structure* parentStructure = function->globalObject()->typedArrayStructure(ViewClass::TypedArrayStorageType);
    226     Structure* structure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), parentStructure);
     224    Structure* structure = InternalFunction::createSubclassStructure(exec, exec->newTarget(), asInternalFunction(exec->callee())->globalObject()->typedArrayStructure(ViewClass::TypedArrayStorageType));
    227225    if (exec->hadException())
    228226        return JSValue::encode(JSValue());

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r200383 r200416  
    111111#include "JSWeakSet.h"
    112112#include "JSWithScope.h"
    113 #include "LazyClassStructureInlines.h"
    114 #include "LazyPropertyInlines.h"
    115113#include "LegacyProfiler.h"
    116114#include "Lookup.h"
    … …  
    175173#endif
    176174
    177 namespace JSC {
    178 
    179 static JSValue createProxyProperty(VM& vm, JSObject* object)
    180 {
    181     JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
    182     return ProxyConstructor::create(vm, ProxyConstructor::createStructure(vm, global, global->functionPrototype()));
    183 }
    184 
    185 static JSValue createJSONProperty(VM& vm, JSObject* object)
    186 {
    187     JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
    188     return JSONObject::create(vm, JSONObject::createStructure(vm, global, global->objectPrototype()));
    189 }
    190 
    191 static JSValue createMathProperty(VM& vm, JSObject* object)
    192 {
    193     JSGlobalObject* global = jsCast<JSGlobalObject*>(object);
    194     return MathObject::create(vm, global, MathObject::createStructure(vm, global, global->objectPrototype()));
    195 }
    196 
    197 } // namespace JSC
    198 
    199175#include "JSGlobalObject.lut.h"
    200176
    … …  
    207183/* Source for JSGlobalObject.lut.h
    208184@begin globalObjectTable
    209   parseFloat            globalFuncParseFloat                         DontEnum|Function 1
    210   isNaN                 globalFuncIsNaN                              DontEnum|Function 1
    211   isFinite              globalFuncIsFinite                           DontEnum|Function 1
    212   escape                globalFuncEscape                             DontEnum|Function 1
    213   unescape              globalFuncUnescape                           DontEnum|Function 1
    214   decodeURI             globalFuncDecodeURI                          DontEnum|Function 1
    215   decodeURIComponent    globalFuncDecodeURIComponent                 DontEnum|Function 1
    216   encodeURI             globalFuncEncodeURI                          DontEnum|Function 1
    217   encodeURIComponent    globalFuncEncodeURIComponent                 DontEnum|Function 1
    218   EvalError             JSGlobalObject::m_evalErrorConstructor       DontEnum|CellProperty
    219   ReferenceError        JSGlobalObject::m_referenceErrorConstructor  DontEnum|CellProperty
    220   SyntaxError           JSGlobalObject::m_syntaxErrorConstructor     DontEnum|CellProperty
    221   URIError              JSGlobalObject::m_URIErrorConstructor        DontEnum|CellProperty
    222   Proxy                 createProxyProperty                          DontEnum|PropertyCallback
    223   JSON                  createJSONProperty                           DontEnum|PropertyCallback
    224   Math                  createMathProperty                           DontEnum|PropertyCallback
    225   Int8Array             JSGlobalObject::m_typedArrayInt8             DontEnum|ClassStructure
    226   Int16Array            JSGlobalObject::m_typedArrayInt16            DontEnum|ClassStructure
    227   Int32Array            JSGlobalObject::m_typedArrayInt32            DontEnum|ClassStructure
    228   Uint8Array            JSGlobalObject::m_typedArrayUint8            DontEnum|ClassStructure
    229   Uint8ClampedArray     JSGlobalObject::m_typedArrayUint8Clamped     DontEnum|ClassStructure
    230   Uint16Array           JSGlobalObject::m_typedArrayUint16           DontEnum|ClassStructure
    231   Uint32Array           JSGlobalObject::m_typedArrayUint32           DontEnum|ClassStructure
    232   Float32Array          JSGlobalObject::m_typedArrayFloat32          DontEnum|ClassStructure
    233   Float64Array          JSGlobalObject::m_typedArrayFloat64          DontEnum|ClassStructure
    234   DataView              JSGlobalObject::m_typedArrayDataView         DontEnum|ClassStructure
    235   Set                   JSGlobalObject::m_setStructure               DontEnum|ClassStructure
    236   Map                   JSGlobalObject::m_mapStructure               DontEnum|ClassStructure
    237   Date                  JSGlobalObject::m_dateStructure              DontEnum|ClassStructure
    238   Boolean               JSGlobalObject::m_booleanObjectStructure     DontEnum|ClassStructure
    239   Number                JSGlobalObject::m_numberObjectStructure      DontEnum|ClassStructure
    240   WeakMap               JSGlobalObject::m_weakMapStructure           DontEnum|ClassStructure
    241   WeakSet               JSGlobalObject::m_weakSetStructure           DontEnum|ClassStructure
     185  parseFloat            globalFuncParseFloat            DontEnum|Function 1
     186  isNaN                 globalFuncIsNaN                 DontEnum|Function 1
     187  isFinite              globalFuncIsFinite              DontEnum|Function 1
     188  escape                globalFuncEscape                DontEnum|Function 1
     189  unescape              globalFuncUnescape              DontEnum|Function 1
     190  decodeURI             globalFuncDecodeURI             DontEnum|Function 1
     191  decodeURIComponent    globalFuncDecodeURIComponent    DontEnum|Function 1
     192  encodeURI             globalFuncEncodeURI             DontEnum|Function 1
     193  encodeURIComponent    globalFuncEncodeURIComponent    DontEnum|Function 1
    242194@end
    243195*/
    … …  
    340292
    341293    m_functionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
    342     m_boundSlotBaseFunctionStructure.initLater(
    343         [] (const Initializer<Structure>& init) {
    344             init.set(JSBoundSlotBaseFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
    345         });
    346     m_boundFunctionStructure.initLater(
    347         [] (const Initializer<Structure>& init) {
    348             init.set(JSBoundFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
    349         });
     294    m_boundSlotBaseFunctionStructure.set(vm, this, JSBoundSlotBaseFunction::createStructure(vm, this, m_functionPrototype.get()));
     295    m_boundFunctionStructure.set(vm, this, JSBoundFunction::createStructure(vm, this, m_functionPrototype.get()));
    350296    m_getterSetterStructure.set(vm, this, GetterSetter::createStructure(vm, this, jsNull()));
    351     m_nativeStdFunctionStructure.initLater(
    352         [] (const Initializer<Structure>& init) {
    353             init.set(JSNativeStdFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
    354         });
    355     m_namedFunctionStructure.initLater(
    356         [] (const Initializer<Structure>& init) {
    357             init.set(Structure::addPropertyTransition(init.vm, init.owner->m_functionStructure.get(), init.vm.propertyNames->name, DontDelete | ReadOnly | DontEnum, init.owner->m_functionNameOffset));
    358         });
     297    m_nativeStdFunctionStructure.set(vm, this, JSNativeStdFunction::createStructure(vm, this, m_functionPrototype.get()));
     298    m_namedFunctionStructure.set(vm, this, Structure::addPropertyTransition(vm, m_functionStructure.get(), vm.propertyNames->name, DontDelete | ReadOnly | DontEnum, m_functionNameOffset));
     299    m_internalFunctionStructure.set(vm, this, InternalFunction::createStructure(vm, this, m_functionPrototype.get()));
    359300    JSFunction* callFunction = 0;
    360301    JSFunction* applyFunction = 0;
    … …  
    363304    m_callFunction.set(vm, this, callFunction);
    364305    m_applyFunction.set(vm, this, applyFunction);
    365     m_arrayProtoValuesFunction.initLater(
    366         [] (const Initializer<JSFunction>& init) {
    367             init.set(JSFunction::create(init.vm, init.owner, 0, init.vm.propertyNames->values.string(), arrayProtoFuncValues));
    368         });
    369     m_initializePromiseFunction.initLater(
    370         [] (const Initializer<JSFunction>& init) {
    371             init.set(JSFunction::createBuiltinFunction(init.vm, promiseOperationsInitializePromiseCodeGenerator(init.vm), init.owner));
    372         });
     306    m_arrayProtoValuesFunction.set(vm, this, JSFunction::create(vm, this, 0, vm.propertyNames->values.string(), arrayProtoFuncValues));
     307    m_initializePromiseFunction.set(vm, this, JSFunction::createBuiltinFunction(vm, promiseOperationsInitializePromiseCodeGenerator(vm), this));
    373308    m_newPromiseCapabilityFunction.set(vm, this, JSFunction::createBuiltinFunction(vm, promiseOperationsNewPromiseCapabilityCodeGenerator(vm), this));
    374309    m_functionProtoHasInstanceSymbolFunction.set(vm, this, hasInstanceSymbolFunction);
    375     m_throwTypeErrorGetterSetter.initLater(
    376         [] (const Initializer<GetterSetter>& init) {
    377             JSFunction* thrower = JSFunction::create(init.vm, init.owner, 0, String(), globalFuncThrowTypeError);
    378             GetterSetter* getterSetter = GetterSetter::create(init.vm, init.owner);
    379             getterSetter->setGetter(init.vm, init.owner, thrower);
    380             getterSetter->setSetter(init.vm, init.owner, thrower);
    381             init.set(getterSetter);
    382         });
    383     m_throwTypeErrorArgumentsAndCallerGetterSetter.initLater(
    384         [] (const Initializer<GetterSetter>& init) {
    385             JSFunction* thrower = JSFunction::create(init.vm, init.owner, 0, String(), globalFuncThrowTypeErrorArgumentsAndCaller);
    386             GetterSetter* getterSetter = GetterSetter::create(init.vm, init.owner);
    387             getterSetter->setGetter(init.vm, init.owner, thrower);
    388             getterSetter->setSetter(init.vm, init.owner, thrower);
    389             init.set(getterSetter);
    390         });
    391310    m_nullGetterFunction.set(vm, this, NullGetterFunction::create(vm, NullGetterFunction::createStructure(vm, this, m_functionPrototype.get())));
    392311    m_nullSetterFunction.set(vm, this, NullSetterFunction::create(vm, NullSetterFunction::createStructure(vm, this, m_functionPrototype.get())));
    … …  
    398317    m_functionPrototype->structure()->setPrototypeWithoutTransition(vm, m_objectPrototype.get());
    399318
    400     m_speciesGetterSetter.set(vm, this, GetterSetter::create(vm, this));
    401     m_speciesGetterSetter->setGetter(vm, this, JSFunction::createBuiltinFunction(vm, globalObjectSpeciesGetterCodeGenerator(vm), this, "get [Symbol.species]"));
    402 
    403     m_typedArrayProto.initLater(
    404         [] (const Initializer<JSTypedArrayViewPrototype>& init) {
    405             init.set(JSTypedArrayViewPrototype::create(init.vm, init.owner, JSTypedArrayViewPrototype::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get())));
    406            
    407             // Make sure that the constructor gets initialized, too.
    408             init.owner->m_typedArraySuperConstructor.get(init.owner);
    409         });
    410     m_typedArraySuperConstructor.initLater(
    411         [] (const Initializer<JSTypedArrayViewConstructor>& init) {
    412             JSTypedArrayViewPrototype* prototype = init.owner->m_typedArrayProto.get(init.owner);
    413             JSTypedArrayViewConstructor* constructor = JSTypedArrayViewConstructor::create(init.vm, init.owner, JSTypedArrayViewConstructor::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()), prototype, init.owner->m_speciesGetterSetter.get());
    414             prototype->putDirectWithoutTransition(init.vm, init.vm.propertyNames->constructor, constructor, DontEnum);
    415             init.set(constructor);
    416         });
    417    
    418 #define INIT_TYPED_ARRAY_LATER(type) \
    419     m_typedArray ## type.initLater( \
    420         [] (LazyClassStructure::Initializer& init) { \
    421             init.setPrototype(JS ## type ## ArrayPrototype::create(init.vm, init.global, JS ## type ## ArrayPrototype::createStructure(init.vm, init.global, init.global->m_typedArrayProto.get(init.global)))); \
    422             init.setStructure(JS ## type ## Array::createStructure(init.vm, init.global, init.prototype)); \
    423             init.setConstructor(JS ## type ## ArrayConstructor::create(init.vm, init.global, JS ## type ## ArrayConstructor::createStructure(init.vm, init.global, init.global->m_typedArraySuperConstructor.get(init.global)), init.prototype, ASCIILiteral(#type "Array"), typedArrayConstructorAllocate ## type ## ArrayCodeGenerator(init.vm))); \
    424             init.global->putDirectWithoutTransition(init.vm, init.vm.propertyNames->type ## ArrayPrivateName, init.constructor, DontEnum); \
    425         });
    426     FOR_EACH_TYPED_ARRAY_TYPE_EXCLUDING_DATA_VIEW(INIT_TYPED_ARRAY_LATER)
    427 #undef INIT_TYPED_ARRAY_LATER
    428    
    429     m_typedArrayDataView.initLater(
    430         [] (LazyClassStructure::Initializer& init) {
    431             init.setPrototype(JSDataViewPrototype::create(init.vm, JSDataViewPrototype::createStructure(init.vm, init.global, init.global->m_objectPrototype.get())));
    432             init.setStructure(JSDataView::createStructure(init.vm, init.global, init.prototype));
    433             init.setConstructor(JSDataViewConstructor::create(init.vm, init.global, JSDataViewConstructor::createStructure(init.vm, init.global, init.global->m_functionPrototype.get()), init.prototype, ASCIILiteral("DataView"), nullptr));
    434         });
     319    JSTypedArrayViewPrototype* typedArrayProto = JSTypedArrayViewPrototype::create(vm, this, JSTypedArrayViewPrototype::createStructure(vm, this, m_objectPrototype.get()));
     320
     321    m_typedArrays[toIndex(TypeInt8)].prototype.set(vm, this, JSInt8ArrayPrototype::create(vm, this, JSInt8ArrayPrototype::createStructure(vm, this, typedArrayProto)));
     322    m_typedArrays[toIndex(TypeInt16)].prototype.set(vm, this, JSInt16ArrayPrototype::create(vm, this, JSInt16ArrayPrototype::createStructure(vm, this, typedArrayProto)));
     323    m_typedArrays[toIndex(TypeInt32)].prototype.set(vm, this, JSInt32ArrayPrototype::create(vm, this, JSInt32ArrayPrototype::createStructure(vm, this, typedArrayProto)));
     324    m_typedArrays[toIndex(TypeUint8)].prototype.set(vm, this, JSUint8ArrayPrototype::create(vm, this, JSUint8ArrayPrototype::createStructure(vm, this, typedArrayProto)));
     325    m_typedArrays[toIndex(TypeUint8Clamped)].prototype.set(vm, this, JSUint8ClampedArrayPrototype::create(vm, this, JSUint8ClampedArrayPrototype::createStructure(vm, this, typedArrayProto)));
     326    m_typedArrays[toIndex(TypeUint16)].prototype.set(vm, this, JSUint16ArrayPrototype::create(vm, this, JSUint16ArrayPrototype::createStructure(vm, this, typedArrayProto)));
     327    m_typedArrays[toIndex(TypeUint32)].prototype.set(vm, this, JSUint32ArrayPrototype::create(vm, this, JSUint32ArrayPrototype::createStructure(vm, this, typedArrayProto)));
     328    m_typedArrays[toIndex(TypeFloat32)].prototype.set(vm, this, JSFloat32ArrayPrototype::create(vm, this, JSFloat32ArrayPrototype::createStructure(vm, this, typedArrayProto)));
     329    m_typedArrays[toIndex(TypeFloat64)].prototype.set(vm, this, JSFloat64ArrayPrototype::create(vm, this, JSFloat64ArrayPrototype::createStructure(vm, this, typedArrayProto)));
     330    m_typedArrays[toIndex(TypeDataView)].prototype.set(vm, this, JSDataViewPrototype::create(vm, JSDataViewPrototype::createStructure(vm, this, m_objectPrototype.get())));
     331   
     332    m_typedArrays[toIndex(TypeInt8)].structure.set(vm, this, JSInt8Array::createStructure(vm, this, m_typedArrays[toIndex(TypeInt8)].prototype.get()));
     333    m_typedArrays[toIndex(TypeInt16)].structure.set(vm, this, JSInt16Array::createStructure(vm, this, m_typedArrays[toIndex(TypeInt16)].prototype.get()));
     334    m_typedArrays[toIndex(TypeInt32)].structure.set(vm, this, JSInt32Array::createStructure(vm, this, m_typedArrays[toIndex(TypeInt32)].prototype.get()));
     335    m_typedArrays[toIndex(TypeUint8)].structure.set(vm, this, JSUint8Array::createStructure(vm, this, m_typedArrays[toIndex(TypeUint8)].prototype.get()));
     336    m_typedArrays[toIndex(TypeUint8Clamped)].structure.set(vm, this, JSUint8ClampedArray::createStructure(vm, this, m_typedArrays[toIndex(TypeUint8Clamped)].prototype.get()));
     337    m_typedArrays[toIndex(TypeUint16)].structure.set(vm, this, JSUint16Array::createStructure(vm, this, m_typedArrays[toIndex(TypeUint16)].prototype.get()));
     338    m_typedArrays[toIndex(TypeUint32)].structure.set(vm, this, JSUint32Array::createStructure(vm, this, m_typedArrays[toIndex(TypeUint32)].prototype.get()));
     339    m_typedArrays[toIndex(TypeFloat32)].structure.set(vm, this, JSFloat32Array::createStructure(vm, this, m_typedArrays[toIndex(TypeFloat32)].prototype.get()));
     340    m_typedArrays[toIndex(TypeFloat64)].structure.set(vm, this, JSFloat64Array::createStructure(vm, this, m_typedArrays[toIndex(TypeFloat64)].prototype.get()));
     341    m_typedArrays[toIndex(TypeDataView)].structure.set(vm, this, JSDataView::createStructure(vm, this, m_typedArrays[toIndex(TypeDataView)].prototype.get()));
    435342   
    436343    m_lexicalEnvironmentStructure.set(vm, this, JSLexicalEnvironment::createStructure(vm, this));
    437     m_moduleEnvironmentStructure.initLater(
    438         [] (const Initializer<Structure>& init) {
    439             init.set(JSModuleEnvironment::createStructure(init.vm, init.owner));
    440         });
     344    m_moduleEnvironmentStructure.set(vm, this, JSModuleEnvironment::createStructure(vm, this));
    441345    m_strictEvalActivationStructure.set(vm, this, StrictEvalActivation::createStructure(vm, this, jsNull()));
    442     m_debuggerScopeStructure.initLater(
    443         [] (const Initializer<Structure>& init) {
    444             init.set(DebuggerScope::createStructure(init.vm, init.owner));
    445         });
    446     m_withScopeStructure.initLater(
    447         [] (const Initializer<Structure>& init) {
    448             init.set(JSWithScope::createStructure(init.vm, init.owner, jsNull()));
    449         });
    450    
    451     m_nullPrototypeObjectStructure.initLater(
    452         [] (const Initializer<Structure>& init) {
    453             init.set(JSFinalObject::createStructure(init.vm, init.owner, jsNull(), JSFinalObject::defaultInlineCapacity()));
    454         });
    455    
    456     m_callbackFunctionStructure.initLater(
    457         [] (const Initializer<Structure>& init) {
    458             init.set(JSCallbackFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
    459         });
     346    m_debuggerScopeStructure.set(m_vm, this, DebuggerScope::createStructure(m_vm, this));
     347    m_withScopeStructure.set(vm, this, JSWithScope::createStructure(vm, this, jsNull()));
     348   
     349    m_nullPrototypeObjectStructure.set(vm, this, JSFinalObject::createStructure(vm, this, jsNull(), JSFinalObject::defaultInlineCapacity()));
     350   
     351    m_callbackFunctionStructure.set(vm, this, JSCallbackFunction::createStructure(vm, this, m_functionPrototype.get()));
    460352    m_directArgumentsStructure.set(vm, this, DirectArguments::createStructure(vm, this, m_objectPrototype.get()));
    461353    m_scopedArgumentsStructure.set(vm, this, ScopedArguments::createStructure(vm, this, m_objectPrototype.get()));
    462354    m_clonedArgumentsStructure.set(vm, this, ClonedArguments::createStructure(vm, this, m_objectPrototype.get()));
    463     m_callbackConstructorStructure.initLater(
    464         [] (const Initializer<Structure>& init) {
    465             init.set(JSCallbackConstructor::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
    466         });
    467     m_callbackObjectStructure.initLater(
    468         [] (const Initializer<Structure>& init) {
    469             init.set(JSCallbackObject<JSDestructibleObject>::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
    470         });
     355    m_callbackConstructorStructure.set(vm, this, JSCallbackConstructor::createStructure(vm, this, m_objectPrototype.get()));
     356    m_callbackObjectStructure.set(vm, this, JSCallbackObject<JSDestructibleObject>::createStructure(vm, this, m_objectPrototype.get()));
    471357
    472358#if JSC_OBJC_API_ENABLED
    473     m_objcCallbackFunctionStructure.initLater(
    474         [] (const Initializer<Structure>& init) {
    475             init.set(ObjCCallbackFunction::createStructure(init.vm, init.owner, init.owner->m_functionPrototype.get()));
    476         });
    477     m_objcWrapperObjectStructure.initLater(
    478         [] (const Initializer<Structure>& init) {
    479             init.set(JSCallbackObject<JSAPIWrapperObject>::createStructure(init.vm, init.owner, init.owner->m_objectPrototype.get()));
    480         });
     359    m_objcCallbackFunctionStructure.set(vm, this, ObjCCallbackFunction::createStructure(vm, this, m_functionPrototype.get()));
     360    m_objcWrapperObjectStructure.set(vm, this, JSCallbackObject<JSAPIWrapperObject>::createStructure(vm, this, m_objectPrototype.get()));
    481361#endif
    482362   
    … …  
    522402#undef CREATE_PROTOTYPE_FOR_SIMPLE_TYPE
    523403
    524 #define CREATE_PROTOTYPE_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    525     m_ ## properName ## Structure.initLater(\
    526         [] (LazyClassStructure::Initializer& init) { \
    527             init.setPrototype(capitalName##Prototype::create(init.vm, init.global, capitalName##Prototype::createStructure(init.vm, init.global, init.global->m_objectPrototype.get()))); \
    528             init.setStructure(instanceType::createStructure(init.vm, init.global, init.prototype)); \
    529             init.setConstructor(capitalName ## Constructor::create(init.vm, capitalName ## Constructor::createStructure(init.vm, init.global, init.global->m_functionPrototype.get()), jsCast<capitalName ## Prototype*>(init.prototype), init.global->m_speciesGetterSetter.get())); \
    530         });
    531    
    532     FOR_EACH_LAZY_BUILTIN_TYPE(CREATE_PROTOTYPE_FOR_LAZY_TYPE)
    533    
    534 #undef CREATE_PROTOTYPE_FOR_LAZY_TYPE
    535    
    536404    m_iteratorPrototype.set(vm, this, IteratorPrototype::create(vm, this, IteratorPrototype::createStructure(vm, this, m_objectPrototype.get())));
    537405
    538406#define CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    539     m_ ## lowerName ## Structure.initLater( \
    540         [] (const Initializer<Structure>& init) { \
    541             JSObject* prototype = capitalName ## Prototype::create(init.vm, init.owner, capitalName ## Prototype::createStructure(init.vm, init.owner, init.owner->m_iteratorPrototype.get())); \
    542             init.set(instanceType::createStructure(init.vm, init.owner, prototype)); \
    543         });
     407m_ ## lowerName ## Prototype.set(vm, this, capitalName##Prototype::create(vm, this, capitalName##Prototype::createStructure(vm, this, m_iteratorPrototype.get()))); \
     408m_ ## properName ## Structure.set(vm, this, instanceType::createStructure(vm, this, m_ ## lowerName ## Prototype.get()));
     409   
    544410    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE)
    545 #undef CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE
    546 
    547411    m_propertyNameIteratorStructure.set(vm, this, JSPropertyNameIterator::createStructure(vm, this, m_iteratorPrototype.get()));
    548412    m_generatorPrototype.set(vm, this, GeneratorPrototype::create(vm, this, GeneratorPrototype::createStructure(vm, this, m_iteratorPrototype.get())));
    549413   
     414#undef CREATE_PROTOTYPE_FOR_DERIVED_ITERATOR_TYPE
     415
    550416    // Constructors
     417
     418    GetterSetter* speciesGetterSetter = GetterSetter::create(vm, this);
     419    speciesGetterSetter->setGetter(vm, this, JSFunction::createBuiltinFunction(vm, globalObjectSpeciesGetterCodeGenerator(vm), this, "get [Symbol.species]"));
    551420
    552421    ObjectConstructor* objectConstructor = ObjectConstructor::create(vm, this, ObjectConstructor::createStructure(vm, this, m_functionPrototype.get()), m_objectPrototype.get());
    … …  
    557426
    558427    JSCell* functionConstructor = FunctionConstructor::create(vm, FunctionConstructor::createStructure(vm, this, m_functionPrototype.get()), m_functionPrototype.get());
    559     JSObject* arrayConstructor = ArrayConstructor::create(vm, this, ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_arrayPrototype.get(), m_speciesGetterSetter.get());
    560    
    561     m_regExpConstructor.set(vm, this, RegExpConstructor::create(vm, RegExpConstructor::createStructure(vm, this, m_functionPrototype.get()), m_regExpPrototype.get(), m_speciesGetterSetter.get()));
     428    JSObject* arrayConstructor = ArrayConstructor::create(vm, this, ArrayConstructor::createStructure(vm, this, m_functionPrototype.get()), m_arrayPrototype.get(), speciesGetterSetter);
     429   
     430    m_regExpConstructor.set(vm, this, RegExpConstructor::create(vm, RegExpConstructor::createStructure(vm, this, m_functionPrototype.get()), m_regExpPrototype.get(), speciesGetterSetter));
    562431   
    563432#define CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    564 capitalName ## Constructor* lowerName ## Constructor = capitalName ## Constructor::create(vm, capitalName ## Constructor::createStructure(vm, this, m_functionPrototype.get()), m_ ## lowerName ## Prototype.get(), m_speciesGetterSetter.get()); \
     433capitalName ## Constructor* lowerName ## Constructor = capitalName ## Constructor::create(vm, capitalName ## Constructor::createStructure(vm, this, m_functionPrototype.get()), m_ ## lowerName ## Prototype.get(), speciesGetterSetter); \
    565434m_ ## lowerName ## Prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, lowerName ## Constructor, DontEnum); \
    566435
    … …  
    568437   
    569438#undef CREATE_CONSTRUCTOR_FOR_SIMPLE_TYPE
    570 
     439   
    571440    m_errorConstructor.set(vm, this, errorConstructor);
    572441    m_promiseConstructor.set(vm, this, promiseConstructor);
    573442    m_internalPromiseConstructor.set(vm, this, internalPromiseConstructor);
    574443   
    575     m_nativeErrorPrototypeStructure.set(vm, this, NativeErrorPrototype::createStructure(vm, this, m_errorPrototype.get()));
    576     m_nativeErrorStructure.set(vm, this, NativeErrorConstructor::createStructure(vm, this, m_functionPrototype.get()));
    577     m_evalErrorConstructor.initLater(
    578         [] (const Initializer<NativeErrorConstructor>& init) {
    579             init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("EvalError")));
    580         });
    581     m_rangeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, m_nativeErrorStructure.get(), m_nativeErrorPrototypeStructure.get(), ASCIILiteral("RangeError")));
    582     m_referenceErrorConstructor.initLater(
    583         [] (const Initializer<NativeErrorConstructor>& init) {
    584             init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("ReferenceError")));
    585         });
    586     m_syntaxErrorConstructor.initLater(
    587         [] (const Initializer<NativeErrorConstructor>& init) {
    588             init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("SyntaxError")));
    589         });
    590     m_typeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, m_nativeErrorStructure.get(), m_nativeErrorPrototypeStructure.get(), ASCIILiteral("TypeError")));
    591     m_URIErrorConstructor.initLater(
    592         [] (const Initializer<NativeErrorConstructor>& init) {
    593             init.set(NativeErrorConstructor::create(init.vm, init.owner, init.owner->m_nativeErrorStructure.get(), init.owner->m_nativeErrorPrototypeStructure.get(), ASCIILiteral("URIError")));
    594         });
     444    Structure* nativeErrorPrototypeStructure = NativeErrorPrototype::createStructure(vm, this, m_errorPrototype.get());
     445    Structure* nativeErrorStructure = NativeErrorConstructor::createStructure(vm, this, m_functionPrototype.get());
     446    m_evalErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("EvalError")));
     447    m_rangeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("RangeError")));
     448    m_referenceErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("ReferenceError")));
     449    m_syntaxErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("SyntaxError")));
     450    m_typeErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("TypeError")));
     451    m_URIErrorConstructor.set(vm, this, NativeErrorConstructor::create(vm, this, nativeErrorStructure, nativeErrorPrototypeStructure, ASCIILiteral("URIError")));
    595452
    596453    m_generatorFunctionPrototype.set(vm, this, GeneratorFunctionPrototype::create(vm, GeneratorFunctionPrototype::createStructure(vm, this, m_functionPrototype.get())));
    … …  
    611468    putDirectWithoutTransition(vm, vm.propertyNames->Array, arrayConstructor, DontEnum);
    612469    putDirectWithoutTransition(vm, vm.propertyNames->RegExp, m_regExpConstructor.get(), DontEnum);
     470    putDirectWithoutTransition(vm, vm.propertyNames->EvalError, m_evalErrorConstructor.get(), DontEnum);
    613471    putDirectWithoutTransition(vm, vm.propertyNames->RangeError, m_rangeErrorConstructor.get(), DontEnum);
     472    putDirectWithoutTransition(vm, vm.propertyNames->ReferenceError, m_referenceErrorConstructor.get(), DontEnum);
     473    putDirectWithoutTransition(vm, vm.propertyNames->SyntaxError, m_syntaxErrorConstructor.get(), DontEnum);
    614474    putDirectWithoutTransition(vm, vm.propertyNames->TypeError, m_typeErrorConstructor.get(), DontEnum);
    615 
    616     putDirectWithoutTransition(vm, vm.propertyNames->ObjectPrivateName, objectConstructor, DontEnum | DontDelete | ReadOnly);
    617     putDirectWithoutTransition(vm, vm.propertyNames->ArrayPrivateName, arrayConstructor, DontEnum | DontDelete | ReadOnly);
    618 
     475    putDirectWithoutTransition(vm, vm.propertyNames->URIError, m_URIErrorConstructor.get(), DontEnum);
     476
     477    putDirectWithoutTransition(vm, vm.propertyNames->Proxy, ProxyConstructor::create(vm, ProxyConstructor::createStructure(vm, this, m_functionPrototype.get())), DontEnum);
     478   
     479   
    619480#define PUT_CONSTRUCTOR_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    620481putDirectWithoutTransition(vm, vm.propertyNames-> jsName, lowerName ## Constructor, DontEnum); \
    … …  
    632493    putDirectWithoutTransition(vm, vm.propertyNames->Intl, intl, DontEnum);
    633494#endif // ENABLE(INTL)
     495    putDirectWithoutTransition(vm, vm.propertyNames->JSON, JSONObject::create(vm, JSONObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum);
     496    putDirectWithoutTransition(vm, vm.propertyNames->Math, MathObject::create(vm, this, MathObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum);
    634497    ReflectObject* reflectObject = ReflectObject::create(vm, this, ReflectObject::createStructure(vm, this, m_objectPrototype.get()));
    635498    putDirectWithoutTransition(vm, vm.propertyNames->Reflect, reflectObject, DontEnum);
    636499
    637500    putDirectWithoutTransition(vm, vm.propertyNames->console, ConsoleObject::create(vm, this, ConsoleObject::createStructure(vm, this, m_objectPrototype.get())), DontEnum);
     501
     502    JSTypedArrayViewConstructor* typedArraySuperConstructor = JSTypedArrayViewConstructor::create(vm, this, JSTypedArrayViewConstructor::createStructure(vm, this, m_functionPrototype.get()), typedArrayProto, speciesGetterSetter);
     503    typedArrayProto->putDirectWithoutTransition(vm, vm.propertyNames->constructor, typedArraySuperConstructor, DontEnum);
     504
     505    m_typedArrays[toIndex(TypeInt8)].constructor.set(vm , this, JSInt8ArrayConstructor::create(vm, this, JSInt8ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt8)].prototype.get(), ASCIILiteral("Int8Array"), typedArrayConstructorAllocateInt8ArrayCodeGenerator(vm)));
     506    m_typedArrays[toIndex(TypeInt16)].constructor.set(vm, this, JSInt16ArrayConstructor::create(vm, this, JSInt16ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt16)].prototype.get(), ASCIILiteral("Int16Array"), typedArrayConstructorAllocateInt16ArrayCodeGenerator(vm)));
     507    m_typedArrays[toIndex(TypeInt32)].constructor.set(vm, this, JSInt32ArrayConstructor::create(vm, this, JSInt32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeInt32)].prototype.get(), ASCIILiteral("Int32Array"), typedArrayConstructorAllocateInt32ArrayCodeGenerator(vm)));
     508    m_typedArrays[toIndex(TypeUint8)].constructor.set(vm, this, JSUint8ArrayConstructor::create(vm, this, JSUint8ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint8)].prototype.get(), ASCIILiteral("Uint8Array"), typedArrayConstructorAllocateUint8ArrayCodeGenerator(vm)));
     509    m_typedArrays[toIndex(TypeUint8Clamped)].constructor.set(vm, this, JSUint8ClampedArrayConstructor::create(vm, this, JSUint8ClampedArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint8Clamped)].prototype.get(), ASCIILiteral("Uint8ClampedArray"), typedArrayConstructorAllocateUint8ClampedArrayCodeGenerator(vm)));
     510    m_typedArrays[toIndex(TypeUint16)].constructor.set(vm, this, JSUint16ArrayConstructor::create(vm, this, JSUint16ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint16)].prototype.get(), ASCIILiteral("Uint16Array"), typedArrayConstructorAllocateUint16ArrayCodeGenerator(vm)));
     511    m_typedArrays[toIndex(TypeUint32)].constructor.set(vm, this, JSUint32ArrayConstructor::create(vm, this, JSUint32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeUint32)].prototype.get(), ASCIILiteral("Uint32Array"), typedArrayConstructorAllocateUint32ArrayCodeGenerator(vm)));
     512    m_typedArrays[toIndex(TypeFloat32)].constructor.set(vm, this, JSFloat32ArrayConstructor::create(vm, this, JSFloat32ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeFloat32)].prototype.get(), ASCIILiteral("Float32Array"), typedArrayConstructorAllocateFloat32ArrayCodeGenerator(vm)));
     513    m_typedArrays[toIndex(TypeFloat64)].constructor.set(vm, this, JSFloat64ArrayConstructor::create(vm, this, JSFloat64ArrayConstructor::createStructure(vm, this, typedArraySuperConstructor), m_typedArrays[toIndex(TypeFloat64)].prototype.get(), ASCIILiteral("Float64Array"), typedArrayConstructorAllocateFloat64ArrayCodeGenerator(vm)));
     514    m_typedArrays[toIndex(TypeDataView)].constructor.set(vm, this, JSDataViewConstructor::create(vm, this, JSDataViewConstructor::createStructure(vm, this, m_functionPrototype.get()), m_typedArrays[toIndex(TypeDataView)].prototype.get(), ASCIILiteral("DataView"), nullptr));
     515   
     516    for (unsigned typedArrayIndex = NUMBER_OF_TYPED_ARRAY_TYPES; typedArrayIndex--;) {
     517        m_typedArrays[typedArrayIndex].prototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, m_typedArrays[typedArrayIndex].constructor.get(), DontEnum);
     518        putDirectWithoutTransition(vm, Identifier::fromString(exec, m_typedArrays[typedArrayIndex].constructor.get()->name(exec)), m_typedArrays[typedArrayIndex].constructor.get(), DontEnum);
     519    }
     520
     521    putDirectWithoutTransition(vm, vm.propertyNames->Int8ArrayPrivateName, m_typedArrays[toIndex(TypeInt8)].constructor.get(), DontEnum);
     522    putDirectWithoutTransition(vm, vm.propertyNames->Int16ArrayPrivateName, m_typedArrays[toIndex(TypeInt16)].constructor.get(), DontEnum);
     523    putDirectWithoutTransition(vm, vm.propertyNames->Int32ArrayPrivateName, m_typedArrays[toIndex(TypeInt32)].constructor.get(), DontEnum);
     524    putDirectWithoutTransition(vm, vm.propertyNames->Uint8ArrayPrivateName, m_typedArrays[toIndex(TypeUint8)].constructor.get(), DontEnum);
     525    putDirectWithoutTransition(vm, vm.propertyNames->Uint8ClampedArrayPrivateName, m_typedArrays[toIndex(TypeUint8Clamped)].constructor.get(), DontEnum);
     526    putDirectWithoutTransition(vm, vm.propertyNames->Uint16ArrayPrivateName, m_typedArrays[toIndex(TypeUint16)].constructor.get(), DontEnum);
     527    putDirectWithoutTransition(vm, vm.propertyNames->Uint32ArrayPrivateName, m_typedArrays[toIndex(TypeUint32)].constructor.get(), DontEnum);
     528    putDirectWithoutTransition(vm, vm.propertyNames->Float32ArrayPrivateName, m_typedArrays[toIndex(TypeFloat32)].constructor.get(), DontEnum);
     529    putDirectWithoutTransition(vm, vm.propertyNames->Float64ArrayPrivateName, m_typedArrays[toIndex(TypeFloat64)].constructor.get(), DontEnum);
    638530
    639531    m_moduleLoader.set(vm, this, ModuleLoaderObject::create(vm, this, ModuleLoaderObject::createStructure(vm, this, m_objectPrototype.get())));
    … …  
    989881}
    990882
     883void JSGlobalObject::createThrowTypeError(VM& vm)
     884{
     885    JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeError);
     886    GetterSetter* getterSetter = GetterSetter::create(vm, this);
     887    getterSetter->setGetter(vm, this, thrower);
     888    getterSetter->setSetter(vm, this, thrower);
     889    m_throwTypeErrorGetterSetter.set(vm, this, getterSetter);
     890}
     891
     892void JSGlobalObject::createThrowTypeErrorArgumentsAndCaller(VM& vm)
     893{
     894    JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeErrorArgumentsAndCaller);
     895    GetterSetter* getterSetter = GetterSetter::create(vm, this);
     896    getterSetter->setGetter(vm, this, thrower);
     897    getterSetter->setSetter(vm, this, thrower);
     898    m_throwTypeErrorArgumentsAndCallerGetterSetter.set(vm, this, getterSetter);
     899}
     900
    991901// Set prototype, and also insert the object prototype at the end of the chain.
    992902void JSGlobalObject::resetPrototype(VM& vm, JSValue prototype)
    … …  
    1015925    visitor.append(&thisObject->m_regExpConstructor);
    1016926    visitor.append(&thisObject->m_errorConstructor);
    1017     visitor.append(&thisObject->m_nativeErrorPrototypeStructure);
    1018     visitor.append(&thisObject->m_nativeErrorStructure);
    1019     thisObject->m_evalErrorConstructor.visit(visitor);
     927    visitor.append(&thisObject->m_evalErrorConstructor);
    1020928    visitor.append(&thisObject->m_rangeErrorConstructor);
    1021     thisObject->m_referenceErrorConstructor.visit(visitor);
    1022     thisObject->m_syntaxErrorConstructor.visit(visitor);
     929    visitor.append(&thisObject->m_referenceErrorConstructor);
     930    visitor.append(&thisObject->m_syntaxErrorConstructor);
    1023931    visitor.append(&thisObject->m_typeErrorConstructor);
    1024     thisObject->m_URIErrorConstructor.visit(visitor);
     932    visitor.append(&thisObject->m_URIErrorConstructor);
    1025933    visitor.append(&thisObject->m_objectConstructor);
    1026934    visitor.append(&thisObject->m_promiseConstructor);
     935    visitor.append(&thisObject->m_internalPromiseConstructor);
    1027936
    1028937    visitor.append(&thisObject->m_nullGetterFunction);
    … …  
    1034943    visitor.append(&thisObject->m_applyFunction);
    1035944    visitor.append(&thisObject->m_definePropertyFunction);
    1036     thisObject->m_arrayProtoValuesFunction.visit(visitor);
    1037     thisObject->m_initializePromiseFunction.visit(visitor);
     945    visitor.append(&thisObject->m_arrayProtoValuesFunction);
     946    visitor.append(&thisObject->m_initializePromiseFunction);
    1038947    visitor.append(&thisObject->m_newPromiseCapabilityFunction);
    1039948    visitor.append(&thisObject->m_functionProtoHasInstanceSymbolFunction);
    1040     thisObject->m_throwTypeErrorGetterSetter.visit(visitor);
    1041     thisObject->m_throwTypeErrorArgumentsAndCallerGetterSetter.visit(visitor);
     949    visitor.append(&thisObject->m_throwTypeErrorGetterSetter);
     950    visitor.append(&thisObject->m_throwTypeErrorArgumentsAndCallerGetterSetter);
    1042951    visitor.append(&thisObject->m_moduleLoader);
    1043952
    … …  
    1050959    visitor.append(&thisObject->m_generatorPrototype);
    1051960
    1052     thisObject->m_debuggerScopeStructure.visit(visitor);
    1053     thisObject->m_withScopeStructure.visit(visitor);
     961    visitor.append(&thisObject->m_debuggerScopeStructure);
     962    visitor.append(&thisObject->m_withScopeStructure);
    1054963    visitor.append(&thisObject->m_strictEvalActivationStructure);
    1055964    visitor.append(&thisObject->m_lexicalEnvironmentStructure);
    1056     thisObject->m_moduleEnvironmentStructure.visit(visitor);
     965    visitor.append(&thisObject->m_moduleEnvironmentStructure);
    1057966    visitor.append(&thisObject->m_directArgumentsStructure);
    1058967    visitor.append(&thisObject->m_scopedArgumentsStructure);
    … …  
    1062971    for (unsigned i = 0; i < NumberOfIndexingShapes; ++i)
    1063972        visitor.append(&thisObject->m_arrayStructureForIndexingShapeDuringAllocation[i]);
    1064     thisObject->m_callbackConstructorStructure.visit(visitor);
    1065     thisObject->m_callbackFunctionStructure.visit(visitor);
    1066     thisObject->m_callbackObjectStructure.visit(visitor);
     973    visitor.append(&thisObject->m_booleanObjectStructure);
     974    visitor.append(&thisObject->m_callbackConstructorStructure);
     975    visitor.append(&thisObject->m_callbackFunctionStructure);
     976    visitor.append(&thisObject->m_callbackObjectStructure);
    1067977    visitor.append(&thisObject->m_propertyNameIteratorStructure);
    1068978#if JSC_OBJC_API_ENABLED
    1069     thisObject->m_objcCallbackFunctionStructure.visit(visitor);
    1070     thisObject->m_objcWrapperObjectStructure.visit(visitor);
     979    visitor.append(&thisObject->m_objcCallbackFunctionStructure);
     980    visitor.append(&thisObject->m_objcWrapperObjectStructure);
    1071981#endif
    1072     thisObject->m_nullPrototypeObjectStructure.visit(visitor);
     982    visitor.append(&thisObject->m_nullPrototypeObjectStructure);
    1073983    visitor.append(&thisObject->m_errorStructure);
    1074984    visitor.append(&thisObject->m_calleeStructure);
    1075985    visitor.append(&thisObject->m_functionStructure);
    1076     thisObject->m_boundSlotBaseFunctionStructure.visit(visitor);
    1077     thisObject->m_boundFunctionStructure.visit(visitor);
     986    visitor.append(&thisObject->m_boundSlotBaseFunctionStructure);
     987    visitor.append(&thisObject->m_boundFunctionStructure);
    1078988    visitor.append(&thisObject->m_getterSetterStructure);
    1079     thisObject->m_nativeStdFunctionStructure.visit(visitor);
    1080     thisObject->m_namedFunctionStructure.visit(visitor);
     989    visitor.append(&thisObject->m_nativeStdFunctionStructure);
     990    visitor.append(&thisObject->m_namedFunctionStructure);
    1081991    visitor.append(&thisObject->m_symbolObjectStructure);
    1082992    visitor.append(&thisObject->m_regExpStructure);
    … …  
    1088998    visitor.append(&thisObject->m_moduleNamespaceObjectStructure);
    1089999    visitor.append(&thisObject->m_dollarVMStructure);
     1000    visitor.append(&thisObject->m_internalFunctionStructure);
    10901001    visitor.append(&thisObject->m_proxyObjectStructure);
    10911002    visitor.append(&thisObject->m_callableProxyObjectStructure);
    … …  
    11001011
    11011012    FOR_EACH_SIMPLE_BUILTIN_TYPE(VISIT_SIMPLE_TYPE)
     1013    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_SIMPLE_TYPE)
    11021014
    11031015#undef VISIT_SIMPLE_TYPE
    11041016
    1105 #define VISIT_LAZY_TYPE(CapitalName, lowerName, properName, instanceType, jsName) \
    1106     thisObject->m_ ## properName ## Structure.visit(visitor);
    1107    
    1108     FOR_EACH_LAZY_BUILTIN_TYPE(VISIT_LAZY_TYPE)
    1109     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(VISIT_LAZY_TYPE)
    1110 
    1111 #undef VISIT_LAZY_TYPE
    1112 
    1113     for (unsigned i = NUMBER_OF_TYPED_ARRAY_TYPES; i--;)
    1114         thisObject->lazyTypedArrayStructure(indexToTypedArrayType(i)).visit(visitor);
    1115    
    1116     visitor.append(&thisObject->m_speciesGetterSetter);
    1117     thisObject->m_typedArrayProto.visit(visitor);
    1118     thisObject->m_typedArraySuperConstructor.visit(visitor);
     1017    for (unsigned i = NUMBER_OF_TYPED_ARRAY_TYPES; i--;) {
     1018        visitor.append(&thisObject->m_typedArrays[i].prototype);
     1019        visitor.append(&thisObject->m_typedArrays[i].constructor);
     1020        visitor.append(&thisObject->m_typedArrays[i].structure);
     1021    }
    11191022}
    11201023
    … …  
    11581061{
    11591062    JSGlobalObject* thisObject = jsCast<JSGlobalObject*>(object);
    1160     if (getStaticPropertySlot<JSGlobalObject, Base>(exec, globalObjectTable, thisObject, propertyName, slot))
     1063    if (getStaticFunctionSlot<Base>(exec, globalObjectTable, thisObject, propertyName, slot))
    11611064        return true;
    11621065    return symbolTableGet(thisObject, propertyName, slot);

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h

    r200383 r200416  
    3232#include "JSSegmentedVariableObject.h"
    3333#include "JSWeakObjectMapRefInternal.h"
    34 #include "LazyProperty.h"
    35 #include "LazyClassStructure.h"
    3634#include "NumberPrototype.h"
    3735#include "RuntimeFlags.h"
    … …  
    7876class JSPromisePrototype;
    7977class JSStack;
    80 class JSTypedArrayViewConstructor;
    81 class JSTypedArrayViewPrototype;
    8278class LLIntOffsetsExtractor;
    8379class Microtask;
    … …  
    10298
    10399#define FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR(macro) \
     100    macro(Set, set, set, JSSet, Set) \
     101    macro(Map, map, map, JSMap, Map) \
     102    macro(Date, date, date, DateInstance, Date) \
    104103    macro(String, string, stringObject, StringObject, String) \
    105104    macro(Symbol, symbol, symbolObject, SymbolObject, Symbol) \
     105    macro(Boolean, boolean, booleanObject, BooleanObject, Boolean) \
    106106    macro(Number, number, numberObject, NumberObject, Number) \
    107107    macro(Error, error, error, ErrorInstance, Error) \
    108     macro(Map, map, map, JSMap, Map) \
    109108    macro(JSPromise, promise, promise, JSPromise, Promise) \
    110109    macro(JSArrayBuffer, arrayBuffer, arrayBuffer, JSArrayBuffer, ArrayBuffer) \
     110    DEFINE_STANDARD_BUILTIN(macro, WeakMap, weakMap) \
     111    DEFINE_STANDARD_BUILTIN(macro, WeakSet, weakSet) \
    111112
    112113#define FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(macro) \
    … …  
    124125    macro(JSInternalPromise, internalPromise, internalPromise, JSInternalPromise, InternalPromise) \
    125126
    126 #define FOR_EACH_LAZY_BUILTIN_TYPE(macro) \
    127     macro(Set, set, set, JSSet, Set) \
    128     macro(Date, date, date, DateInstance, Date) \
    129     macro(Boolean, boolean, booleanObject, BooleanObject, Boolean) \
    130     DEFINE_STANDARD_BUILTIN(macro, WeakMap, weakMap) \
    131     DEFINE_STANDARD_BUILTIN(macro, WeakSet, weakSet) \
    132 
    133127#define DECLARE_SIMPLE_BUILTIN_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    134128    class JS ## capitalName; \
    … …  
    138132class IteratorPrototype;
    139133FOR_EACH_SIMPLE_BUILTIN_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
    140 FOR_EACH_LAZY_BUILTIN_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
    141134FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
    142135
    143136#undef DECLARE_SIMPLE_BUILTIN_TYPE
    144 
    145 class JSInternalPromise;
    146 class InternalPromisePrototype;
    147 class InternalPromiseConstructor;
    148137
    149138typedef Vector<ExecState*, 16> ExecStateStack;
    … …  
    209198    };
    210199
    211 // Our hashtable code-generator tries to access these properties, so we make them public.
    212 // However, we'd like it better if they could be protected.
    213 public:
    214     template<typename T> using Initializer = typename LazyProperty<JSGlobalObject, T>::Initializer;
    215    
     200protected:
    216201    Register m_globalCallFrame[JSStack::CallFrameHeaderSize];
    217202
    … …  
    222207    WriteBarrier<RegExpConstructor> m_regExpConstructor;
    223208    WriteBarrier<ErrorConstructor> m_errorConstructor;
    224     WriteBarrier<Structure> m_nativeErrorPrototypeStructure;
    225     WriteBarrier<Structure> m_nativeErrorStructure;
    226     LazyProperty<JSGlobalObject, NativeErrorConstructor> m_evalErrorConstructor;
     209    WriteBarrier<NativeErrorConstructor> m_evalErrorConstructor;
    227210    WriteBarrier<NativeErrorConstructor> m_rangeErrorConstructor;
    228     LazyProperty<JSGlobalObject, NativeErrorConstructor> m_referenceErrorConstructor;
    229     LazyProperty<JSGlobalObject, NativeErrorConstructor> m_syntaxErrorConstructor;
     211    WriteBarrier<NativeErrorConstructor> m_referenceErrorConstructor;
     212    WriteBarrier<NativeErrorConstructor> m_syntaxErrorConstructor;
    230213    WriteBarrier<NativeErrorConstructor> m_typeErrorConstructor;
    231     LazyProperty<JSGlobalObject, NativeErrorConstructor> m_URIErrorConstructor;
     214    WriteBarrier<NativeErrorConstructor> m_URIErrorConstructor;
    232215    WriteBarrier<ObjectConstructor> m_objectConstructor;
    233216    WriteBarrier<JSPromiseConstructor> m_promiseConstructor;
    … …  
    243226    WriteBarrier<JSFunction> m_applyFunction;
    244227    WriteBarrier<JSFunction> m_definePropertyFunction;
    245     LazyProperty<JSGlobalObject, JSFunction> m_arrayProtoValuesFunction;
    246     LazyProperty<JSGlobalObject, JSFunction> m_initializePromiseFunction;
     228    WriteBarrier<JSFunction> m_arrayProtoValuesFunction;
     229    WriteBarrier<JSFunction> m_initializePromiseFunction;
    247230    WriteBarrier<JSFunction> m_newPromiseCapabilityFunction;
    248231    WriteBarrier<JSFunction> m_functionProtoHasInstanceSymbolFunction;
    249     LazyProperty<JSGlobalObject, GetterSetter> m_throwTypeErrorGetterSetter;
    250232    WriteBarrier<JSObject> m_regExpProtoExec;
    251233    WriteBarrier<JSObject> m_regExpProtoSymbolReplace;
    252234    WriteBarrier<JSObject> m_regExpProtoGlobalGetter;
    253235    WriteBarrier<JSObject> m_regExpProtoUnicodeGetter;
    254     LazyProperty<JSGlobalObject, GetterSetter> m_throwTypeErrorArgumentsAndCallerGetterSetter;
     236    WriteBarrier<GetterSetter> m_throwTypeErrorGetterSetter;
     237    WriteBarrier<GetterSetter> m_throwTypeErrorArgumentsAndCallerGetterSetter;
    255238
    256239    WriteBarrier<ModuleLoaderObject> m_moduleLoader;
    … …  
    264247    WriteBarrier<GeneratorPrototype> m_generatorPrototype;
    265248
    266     LazyProperty<JSGlobalObject, Structure> m_debuggerScopeStructure;
    267     LazyProperty<JSGlobalObject, Structure> m_withScopeStructure;
     249    WriteBarrier<Structure> m_debuggerScopeStructure;
     250    WriteBarrier<Structure> m_withScopeStructure;
    268251    WriteBarrier<Structure> m_strictEvalActivationStructure;
    269252    WriteBarrier<Structure> m_lexicalEnvironmentStructure;
    270     LazyProperty<JSGlobalObject, Structure> m_moduleEnvironmentStructure;
     253    WriteBarrier<Structure> m_moduleEnvironmentStructure;
    271254    WriteBarrier<Structure> m_directArgumentsStructure;
    272255    WriteBarrier<Structure> m_scopedArgumentsStructure;
    … …  
    279262    WriteBarrier<Structure> m_arrayStructureForIndexingShapeDuringAllocation[NumberOfIndexingShapes];
    280263
    281     LazyProperty<JSGlobalObject, Structure> m_callbackConstructorStructure;
    282     LazyProperty<JSGlobalObject, Structure> m_callbackFunctionStructure;
    283     LazyProperty<JSGlobalObject, Structure> m_callbackObjectStructure;
     264    WriteBarrier<Structure> m_callbackConstructorStructure;
     265    WriteBarrier<Structure> m_callbackFunctionStructure;
     266    WriteBarrier<Structure> m_callbackObjectStructure;
    284267    WriteBarrier<Structure> m_propertyNameIteratorStructure;
    285268#if JSC_OBJC_API_ENABLED
    286     LazyProperty<JSGlobalObject, Structure> m_objcCallbackFunctionStructure;
    287     LazyProperty<JSGlobalObject, Structure> m_objcWrapperObjectStructure;
     269    WriteBarrier<Structure> m_objcCallbackFunctionStructure;
     270    WriteBarrier<Structure> m_objcWrapperObjectStructure;
    288271#endif
    289     LazyProperty<JSGlobalObject, Structure> m_nullPrototypeObjectStructure;
     272    WriteBarrier<Structure> m_nullPrototypeObjectStructure;
    290273    WriteBarrier<Structure> m_calleeStructure;
    291274    WriteBarrier<Structure> m_functionStructure;
    292     LazyProperty<JSGlobalObject, Structure> m_boundFunctionStructure;
    293     LazyProperty<JSGlobalObject, Structure> m_boundSlotBaseFunctionStructure;
     275    WriteBarrier<Structure> m_boundFunctionStructure;
     276    WriteBarrier<Structure> m_boundSlotBaseFunctionStructure;
    294277    WriteBarrier<Structure> m_getterSetterStructure;
    295     LazyProperty<JSGlobalObject, Structure> m_nativeStdFunctionStructure;
    296     LazyProperty<JSGlobalObject, Structure> m_namedFunctionStructure;
     278    WriteBarrier<Structure> m_nativeStdFunctionStructure;
     279    WriteBarrier<Structure> m_namedFunctionStructure;
    297280    PropertyOffset m_functionNameOffset;
    298281    WriteBarrier<Structure> m_privateNameStructure;
    … …  
    300283    WriteBarrier<Structure> m_generatorFunctionStructure;
    301284    WriteBarrier<Structure> m_dollarVMStructure;
     285    WriteBarrier<Structure> m_internalFunctionStructure;
    302286    WriteBarrier<Structure> m_iteratorResultObjectStructure;
    303287    WriteBarrier<Structure> m_regExpMatchesArrayStructure;
    … …  
    317301
    318302    FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
     303    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
    319304
    320305#undef DEFINE_STORAGE_FOR_SIMPLE_TYPE
    321306
    322 #define DEFINE_STORAGE_FOR_ITERATOR_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    323     LazyProperty<JSGlobalObject, Structure> m_ ## properName ## Structure;
    324     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_ITERATOR_TYPE)
    325 #undef DEFINE_STORAGE_FOR_ITERATOR_TYPE
     307    struct TypedArrayData {
     308        WriteBarrier<JSObject> prototype;
     309        WriteBarrier<InternalFunction> constructor;
     310        WriteBarrier<Structure> structure;
     311    };
    326312   
    327 #define DEFINE_STORAGE_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    328     LazyClassStructure m_ ## properName ## Structure;
    329     FOR_EACH_LAZY_BUILTIN_TYPE(DEFINE_STORAGE_FOR_LAZY_TYPE)
    330 #undef DEFINE_STORAGE_FOR_LAZY_TYPE
    331 
    332     WriteBarrier<GetterSetter> m_speciesGetterSetter;
    333    
    334     LazyProperty<JSGlobalObject, JSTypedArrayViewPrototype> m_typedArrayProto;
    335     LazyProperty<JSGlobalObject, JSTypedArrayViewConstructor> m_typedArraySuperConstructor;
    336    
    337 #define DECLARE_TYPED_ARRAY_TYPE_STRUCTURE(name) LazyClassStructure m_typedArray ## name;
    338     FOR_EACH_TYPED_ARRAY_TYPE(DECLARE_TYPED_ARRAY_TYPE_STRUCTURE)
    339 #undef DECLARE_TYPED_ARRAY_TYPE_STRUCTURE
     313    std::array<TypedArrayData, NUMBER_OF_TYPED_ARRAY_TYPES> m_typedArrays;
    340314
    341315    JSCell* m_specialPointers[Special::TableSize]; // Special pointers used by the LLInt and JIT.
    … …  
    464438    JSPromiseConstructor* promiseConstructor() const { return m_promiseConstructor.get(); }
    465439    JSInternalPromiseConstructor* internalPromiseConstructor() const { return m_internalPromiseConstructor.get(); }
    466     NativeErrorConstructor* evalErrorConstructor() const { return m_evalErrorConstructor.get(this); }
     440    NativeErrorConstructor* evalErrorConstructor() const { return m_evalErrorConstructor.get(); }
    467441    NativeErrorConstructor* rangeErrorConstructor() const { return m_rangeErrorConstructor.get(); }
    468     NativeErrorConstructor* referenceErrorConstructor() const { return m_referenceErrorConstructor.get(this); }
    469     NativeErrorConstructor* syntaxErrorConstructor() const { return m_syntaxErrorConstructor.get(this); }
     442    NativeErrorConstructor* referenceErrorConstructor() const { return m_referenceErrorConstructor.get(); }
     443    NativeErrorConstructor* syntaxErrorConstructor() const { return m_syntaxErrorConstructor.get(); }
    470444    NativeErrorConstructor* typeErrorConstructor() const { return m_typeErrorConstructor.get(); }
    471     NativeErrorConstructor* URIErrorConstructor() const { return m_URIErrorConstructor.get(this); }
     445    NativeErrorConstructor* URIErrorConstructor() const { return m_URIErrorConstructor.get(); }
    472446
    473447    NullGetterFunction* nullGetterFunction() const { return m_nullGetterFunction.get(); }
    … …  
    480454    JSFunction* applyFunction() const { return m_applyFunction.get(); }
    481455    JSFunction* definePropertyFunction() const { return m_definePropertyFunction.get(); }
    482     JSFunction* arrayProtoValuesFunction() const { return m_arrayProtoValuesFunction.get(this); }
    483     JSFunction* initializePromiseFunction() const { return m_initializePromiseFunction.get(this); }
     456    JSFunction* arrayProtoValuesFunction() const { return m_arrayProtoValuesFunction.get(); }
     457    JSFunction* initializePromiseFunction() const { return m_initializePromiseFunction.get(); }
    484458    JSFunction* newPromiseCapabilityFunction() const { return m_newPromiseCapabilityFunction.get(); }
    485459    JSFunction* functionProtoHasInstanceSymbolFunction() const { return m_functionProtoHasInstanceSymbolFunction.get(); }
    … …  
    488462    JSObject* regExpProtoGlobalGetter() const { return m_regExpProtoGlobalGetter.get(); }
    489463    JSObject* regExpProtoUnicodeGetter() const { return m_regExpProtoUnicodeGetter.get(); }
    490     GetterSetter* throwTypeErrorGetterSetter()
    491     {
    492         return m_throwTypeErrorGetterSetter.get(this);
    493     }
    494 
    495     GetterSetter* throwTypeErrorArgumentsAndCallerGetterSetter()
    496     {
    497         return m_throwTypeErrorArgumentsAndCallerGetterSetter.get(this);
     464    GetterSetter* throwTypeErrorGetterSetter(VM& vm)
     465    {
     466        if (!m_throwTypeErrorGetterSetter)
     467            createThrowTypeError(vm);
     468        return m_throwTypeErrorGetterSetter.get();
     469    }
     470
     471    GetterSetter* throwTypeErrorArgumentsAndCallerGetterSetter(VM& vm)
     472    {
     473        if (!m_throwTypeErrorArgumentsAndCallerGetterSetter)
     474            createThrowTypeErrorArgumentsAndCaller(vm);
     475        return m_throwTypeErrorArgumentsAndCallerGetterSetter.get();
    498476    }
    499477   
    … …  
    503481    FunctionPrototype* functionPrototype() const { return m_functionPrototype.get(); }
    504482    ArrayPrototype* arrayPrototype() const { return m_arrayPrototype.get(); }
    505     JSObject* booleanPrototype() const { return m_booleanObjectStructure.prototype(this); }
     483    BooleanPrototype* booleanPrototype() const { return m_booleanPrototype.get(); }
    506484    StringPrototype* stringPrototype() const { return m_stringPrototype.get(); }
    507485    SymbolPrototype* symbolPrototype() const { return m_symbolPrototype.get(); }
    508     JSObject* numberPrototype() const { return m_numberPrototype.get(); }
    509     JSObject* datePrototype() const { return m_dateStructure.prototype(this); }
     486    NumberPrototype* numberPrototype() const { return m_numberPrototype.get(); }
     487    DatePrototype* datePrototype() const { return m_datePrototype.get(); }
    510488    RegExpPrototype* regExpPrototype() const { return m_regExpPrototype.get(); }
    511489    ErrorPrototype* errorPrototype() const { return m_errorPrototype.get(); }
    … …  
    514492    GeneratorPrototype* generatorPrototype() const { return m_generatorPrototype.get(); }
    515493
    516     Structure* debuggerScopeStructure() const { return m_debuggerScopeStructure.get(this); }
    517     Structure* withScopeStructure() const { return m_withScopeStructure.get(this); }
     494    Structure* debuggerScopeStructure() const { return m_debuggerScopeStructure.get(); }
     495    Structure* withScopeStructure() const { return m_withScopeStructure.get(); }
    518496    Structure* strictEvalActivationStructure() const { return m_strictEvalActivationStructure.get(); }
    519497    Structure* activationStructure() const { return m_lexicalEnvironmentStructure.get(); }
    520     Structure* moduleEnvironmentStructure() const { return m_moduleEnvironmentStructure.get(this); }
     498    Structure* moduleEnvironmentStructure() const { return m_moduleEnvironmentStructure.get(); }
    521499    Structure* directArgumentsStructure() const { return m_directArgumentsStructure.get(); }
    522500    Structure* scopedArgumentsStructure() const { return m_scopedArgumentsStructure.get(); }
    … …  
    546524    }
    547525       
    548     Structure* booleanObjectStructure() const { return m_booleanObjectStructure.get(this); }
    549     Structure* callbackConstructorStructure() const { return m_callbackConstructorStructure.get(this); }
    550     Structure* callbackFunctionStructure() const { return m_callbackFunctionStructure.get(this); }
    551     Structure* callbackObjectStructure() const { return m_callbackObjectStructure.get(this); }
     526    Structure* booleanObjectStructure() const { return m_booleanObjectStructure.get(); }
     527    Structure* callbackConstructorStructure() const { return m_callbackConstructorStructure.get(); }
     528    Structure* callbackFunctionStructure() const { return m_callbackFunctionStructure.get(); }
     529    Structure* callbackObjectStructure() const { return m_callbackObjectStructure.get(); }
    552530    Structure* propertyNameIteratorStructure() const { return m_propertyNameIteratorStructure.get(); }
    553531#if JSC_OBJC_API_ENABLED
    554     Structure* objcCallbackFunctionStructure() const { return m_objcCallbackFunctionStructure.get(this); }
    555     Structure* objcWrapperObjectStructure() const { return m_objcWrapperObjectStructure.get(this); }
     532    Structure* objcCallbackFunctionStructure() const { return m_objcCallbackFunctionStructure.get(); }
     533    Structure* objcWrapperObjectStructure() const { return m_objcWrapperObjectStructure.get(); }
    556534#endif
    557     Structure* dateStructure() const { return m_dateStructure.get(this); }
    558     Structure* nullPrototypeObjectStructure() const { return m_nullPrototypeObjectStructure.get(this); }
     535    Structure* dateStructure() const { return m_dateStructure.get(); }
     536    Structure* nullPrototypeObjectStructure() const { return m_nullPrototypeObjectStructure.get(); }
    559537    Structure* errorStructure() const { return m_errorStructure.get(); }
    560538    Structure* calleeStructure() const { return m_calleeStructure.get(); }
    561539    Structure* functionStructure() const { return m_functionStructure.get(); }
    562     Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(this); }
    563     Structure* boundSlotBaseFunctionStructure() const { return m_boundSlotBaseFunctionStructure.get(this); }
     540    Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(); }
     541    Structure* boundSlotBaseFunctionStructure() const { return m_boundSlotBaseFunctionStructure.get(); }
    564542    Structure* getterSetterStructure() const { return m_getterSetterStructure.get(); }
    565     Structure* nativeStdFunctionStructure() const { return m_nativeStdFunctionStructure.get(this); }
    566     Structure* namedFunctionStructure() const { return m_namedFunctionStructure.get(this); }
     543    Structure* nativeStdFunctionStructure() const { return m_nativeStdFunctionStructure.get(); }
     544    Structure* namedFunctionStructure() const { return m_namedFunctionStructure.get(); }
    567545    PropertyOffset functionNameOffset() const { return m_functionNameOffset; }
    568546    Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }
    569547    Structure* privateNameStructure() const { return m_privateNameStructure.get(); }
     548    Structure* internalFunctionStructure() const { return m_internalFunctionStructure.get(); }
    570549    Structure* mapStructure() const { return m_mapStructure.get(); }
    571550    Structure* regExpStructure() const { return m_regExpStructure.get(); }
    572551    Structure* generatorFunctionStructure() const { return m_generatorFunctionStructure.get(); }
    573     Structure* setStructure() const { return m_setStructure.get(this); }
     552    Structure* setStructure() const { return m_setStructure.get(); }
    574553    Structure* stringObjectStructure() const { return m_stringObjectStructure.get(); }
    575554    Structure* symbolObjectStructure() const { return m_symbolObjectStructure.get(); }
    … …  
    616595
    617596    FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_ACCESSORS_FOR_SIMPLE_TYPE)
     597    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_ACCESSORS_FOR_SIMPLE_TYPE)
    618598
    619599#undef DEFINE_ACCESSORS_FOR_SIMPLE_TYPE
    620600
    621 #define DEFINE_ACCESSORS_FOR_ITERATOR_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    622     Structure* properName ## Structure() { return m_ ## properName ## Structure.get(this); }
    623 
    624     FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_ACCESSORS_FOR_ITERATOR_TYPE)
    625 
    626 #undef DEFINE_ACCESSORS_FOR_ITERATOR_TYPE
    627 
    628 #define DEFINE_ACCESSORS_FOR_LAZY_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
    629     Structure* properName ## Structure() { return m_ ## properName ## Structure.get(this); }
    630 
    631     FOR_EACH_LAZY_BUILTIN_TYPE(DEFINE_ACCESSORS_FOR_LAZY_TYPE)
    632 
    633 #undef DEFINE_ACCESSORS_FOR_LAZY_TYPE
    634 
    635     LazyClassStructure& lazyTypedArrayStructure(TypedArrayType type)
    636     {
    637         switch (type) {
    638         case NotTypedArray:
    639             RELEASE_ASSERT_NOT_REACHED();
    640             return m_typedArrayInt8;
    641 #define TYPED_ARRAY_TYPE_CASE(name) case Type ## name: return m_typedArray ## name;
    642             FOR_EACH_TYPED_ARRAY_TYPE(TYPED_ARRAY_TYPE_CASE)
    643 #undef TYPED_ARRAY_TYPE_CASE
    644         }
    645         RELEASE_ASSERT_NOT_REACHED();
    646         return m_typedArrayInt8;
    647     }
    648     const LazyClassStructure& lazyTypedArrayStructure(TypedArrayType type) const
    649     {
    650         return const_cast<const LazyClassStructure&>(const_cast<JSGlobalObject*>(this)->lazyTypedArrayStructure(type));
    651     }
    652    
    653601    Structure* typedArrayStructure(TypedArrayType type) const
    654602    {
    655         return lazyTypedArrayStructure(type).get(this);
    656     }
    657     Structure* typedArrayStructureConcurrently(TypedArrayType type) const
    658     {
    659         return lazyTypedArrayStructure(type).getConcurrently();
     603        return m_typedArrays[toIndex(type)].structure.get();
    660604    }
    661605    bool isOriginalTypedArrayStructure(Structure* structure)
    … …  
    664608        if (type == NotTypedArray)
    665609            return false;
    666         return typedArrayStructureConcurrently(type) == structure;
     610        return typedArrayStructure(type) == structure;
    667611    }
    668612
    669613    JSObject* typedArrayConstructor(TypedArrayType type) const
    670614    {
    671         return lazyTypedArrayStructure(type).constructor(this);
     615        return m_typedArrays[toIndex(type)].constructor.get();
    672616    }
    673617
    … …  
    796740    JS_EXPORT_PRIVATE void init(VM&);
    797741
     742    void createThrowTypeError(VM&);
     743    void createThrowTypeErrorArgumentsAndCaller(VM&);
     744
    798745    JS_EXPORT_PRIVATE static void clearRareData(JSCell*);
    799746};

  • trunk/Source/JavaScriptCore/runtime/JSNativeStdFunction.cpp

    r200383 r200416  
    11/*
    2  * Copyright (C) 2015-2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2015 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    6969    NativeExecutable* executable = lookUpOrCreateNativeExecutable(vm, runStdFunction, intrinsic, nativeConstructor, name);
    7070    NativeStdFunctionCell* functionCell = NativeStdFunctionCell::create(vm, WTFMove(nativeStdFunction));
    71     Structure* structure = globalObject->nativeStdFunctionStructure();
    72     JSNativeStdFunction* function = new (NotNull, allocateCell<JSNativeStdFunction>(vm.heap)) JSNativeStdFunction(vm, globalObject, structure);
     71    JSNativeStdFunction* function = new (NotNull, allocateCell<JSNativeStdFunction>(vm.heap)) JSNativeStdFunction(vm, globalObject, globalObject->nativeStdFunctionStructure());
    7372    function->finishCreation(vm, executable, length, name, functionCell);
    7473    return function;

  • trunk/Source/JavaScriptCore/runtime/JSWithScope.cpp

    r200383 r200416  
    11/*
    2  * Copyright (C) 2012, 2016 Apple Inc. All Rights Reserved.
     2 * Copyright (C) 2012 Apple Inc. All Rights Reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3333const ClassInfo JSWithScope::s_info = { "WithScope", &Base::s_info, 0, CREATE_METHOD_TABLE(JSWithScope) };
    3434
    35 JSWithScope* JSWithScope::create(
    36     VM& vm, JSGlobalObject* globalObject, JSObject* object, JSScope* next)
    37 {
    38     Structure* structure = globalObject->withScopeStructure();
    39     JSWithScope* withScope = new (NotNull, allocateCell<JSWithScope>(vm.heap)) JSWithScope(vm, structure, object, next);
    40     withScope->finishCreation(vm);
    41     return withScope;
    42 }
    43 
    4435void JSWithScope::visitChildren(JSCell* cell, SlotVisitor& visitor)
    4536{
    … …  
    5041}
    5142
    52 Structure* JSWithScope::createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
    53 {
    54     return Structure::create(vm, globalObject, proto, TypeInfo(WithScopeType, StructureFlags), info());
    55 }
    56 
    57 JSWithScope::JSWithScope(VM& vm, Structure* structure, JSObject* object, JSScope* next)
    58     : Base(vm, structure, next)
    59     , m_object(vm, this, object)
    60 {
    61 }
    62 
    6343} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSWithScope.h

    r200383 r200416  
    11/*
    2  * Copyright (C) 2012, 2016 Apple Inc. All Rights Reserved.
     2 * Copyright (C) 2012 Apple Inc. All Rights Reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3535    typedef JSScope Base;
    3636
    37     JS_EXPORT_PRIVATE static JSWithScope* create(VM&, JSGlobalObject*, JSObject*, JSScope* next);
     37    static JSWithScope* create(ExecState* exec, JSObject* object, JSScope* next)
     38    {
     39        JSWithScope* withScope = new (NotNull, allocateCell<JSWithScope>(*exec->heap())) JSWithScope(exec, object, next);
     40        withScope->finishCreation(exec->vm());
     41        return withScope;
     42    }
    3843
    3944    JSObject* object() { return m_object.get(); }
    … …  
    4146    static void visitChildren(JSCell*, SlotVisitor&);
    4247
    43     static Structure* createStructure(VM&, JSGlobalObject*, JSValue proto);
     48    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue proto)
     49    {
     50        return Structure::create(vm, globalObject, proto, TypeInfo(WithScopeType, StructureFlags), info());
     51    }
    4452
    4553    DECLARE_EXPORT_INFO;
    4654
    4755private:
    48     JSWithScope(VM&, Structure*, JSObject*, JSScope* next);
     56    JSWithScope(ExecState* exec, JSObject* object, JSScope* next)
     57        : Base(
     58            exec->vm(),
     59            exec->lexicalGlobalObject()->withScopeStructure(),
     60            next
     61        )
     62        , m_object(exec->vm(), this, object)
     63    {
     64    }
    4965
    5066    WriteBarrier<JSObject> m_object;

  • trunk/Source/JavaScriptCore/runtime/Lookup.cpp

    r200383 r200416  
    11/*
    2  *  Copyright (C) 2008, 2012, 2015-2016 Apple Inc. All rights reserved.
     2 *  Copyright (C) 2008, 2012, 2015 Apple Inc. All rights reserved.
    33 *
    44 *  This library is free software; you can redistribute it and/or
    … …  
    4646{
    4747    ASSERT(thisObj->globalObject());
    48     ASSERT(entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty);
     48    ASSERT(entry->attributes() & BuiltinOrFunctionOrAccessor);
    4949    VM& vm = exec->vm();
    5050    unsigned attributes;
    … …  
    6464                vm, thisObj->globalObject(), propertyName, entry->functionLength(),
    6565                entry->function(), entry->intrinsic(), attributesForStructure(entry->attributes()));
    66         } else if (isAccessor)
     66        } else {
     67            ASSERT(isAccessor);
    6768            reifyStaticAccessor(vm, *entry, *thisObj, propertyName);
    68         else if (entry->attributes() & CellProperty) {
    69             LazyCellProperty* property = bitwise_cast<LazyCellProperty*>(
    70                 bitwise_cast<char*>(thisObj) + entry->lazyCellPropertyOffset());
    71             JSCell* result = property->get(thisObj);
    72             thisObj->putDirect(vm, propertyName, result, attributesForStructure(entry->attributes()));
    73         } else if (entry->attributes() & ClassStructure) {
    74             LazyClassStructure* structure = bitwise_cast<LazyClassStructure*>(
    75                 bitwise_cast<char*>(thisObj) + entry->lazyClassStructureOffset());
    76             structure->get(jsCast<JSGlobalObject*>(thisObj));
    77         } else if (entry->attributes() & PropertyCallback) {
    78             JSValue result = entry->lazyPropertyCallback()(vm, thisObj);
    79             thisObj->putDirect(vm, propertyName, result, attributesForStructure(entry->attributes()));
    80         } else
    81             RELEASE_ASSERT_NOT_REACHED();
     69        }
    8270
    8371        offset = thisObj->getDirectOffset(vm, propertyName, attributes);
    84         RELEASE_ASSERT(isValidOffset(offset));
     72        ASSERT(isValidOffset(offset));
    8573    }
    8674

  • trunk/Source/JavaScriptCore/runtime/Lookup.h

    r200406 r200416  
    11/*
    22 *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
    3  *  Copyright (C) 2003, 2006, 2007, 2008, 2009, 2016 Apple Inc. All rights reserved.
     3 *  Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
    44 *
    55 *  This library is free software; you can redistribute it and/or
    … …  
    2929#include "Intrinsic.h"
    3030#include "JSGlobalObject.h"
    31 #include "LazyProperty.h"
    3231#include "PropertySlot.h"
    3332#include "PutPropertySlot.h"
    … …  
    4746typedef PutPropertySlot::PutValueFunc PutFunction;
    4847typedef FunctionExecutable* (*BuiltinGenerator)(VM&);
    49 typedef JSValue (*LazyPropertyCallback)(VM&, JSObject*);
    5048
    5149// Hash table generated by the create_hash_table script.
    … …  
    7775    unsigned char functionLength() const { ASSERT(m_attributes & Function); return static_cast<unsigned char>(m_values.value2); }
    7876
    79     GetFunction propertyGetter() const { ASSERT(!(m_attributes & BuiltinOrFunctionOrAccessorOrLazyPropertyOrConstant)); return reinterpret_cast<GetFunction>(m_values.value1); }
    80     PutFunction propertyPutter() const { ASSERT(!(m_attributes & BuiltinOrFunctionOrAccessorOrLazyPropertyOrConstant)); return reinterpret_cast<PutFunction>(m_values.value2); }
     77    GetFunction propertyGetter() const { ASSERT(!(m_attributes & BuiltinOrFunctionOrAccessorOrConstant)); return reinterpret_cast<GetFunction>(m_values.value1); }
     78    PutFunction propertyPutter() const { ASSERT(!(m_attributes & BuiltinOrFunctionOrAccessorOrConstant)); return reinterpret_cast<PutFunction>(m_values.value2); }
    8179
    8280    NativeFunction accessorGetter() const { ASSERT(m_attributes & Accessor); return reinterpret_cast<NativeFunction>(m_values.value1); }
    … …  
    8886
    8987    intptr_t lexerValue() const { ASSERT(!m_attributes); return m_values.value1; }
    90    
    91     ptrdiff_t lazyCellPropertyOffset() const { ASSERT(m_attributes & CellProperty); return m_values.value1; }
    92     ptrdiff_t lazyClassStructureOffset() const { ASSERT(m_attributes & ClassStructure); return m_values.value1; }
    93     LazyPropertyCallback lazyPropertyCallback() const { ASSERT(m_attributes & PropertyCallback); return reinterpret_cast<LazyPropertyCallback>(m_values.value1); }
    9488};
    9589
    … …  
    228222        return false;
    229223
    230     if (entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty)
     224    if (entry->attributes() & BuiltinOrFunctionOrAccessor)
    231225        return setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
    232226
    … …  
    278272        return false;
    279273
    280     ASSERT(!(entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty));
     274    ASSERT(!(entry->attributes() & BuiltinOrFunctionOrAccessor));
    281275
    282276    if (entry->attributes() & ConstantInteger) {
    … …  
    294288inline bool putEntry(ExecState* exec, const HashTableValue* entry, JSObject* base, JSObject* thisValue, PropertyName propertyName, JSValue value, PutPropertySlot& slot)
    295289{
    296     if (entry->attributes() & BuiltinOrFunctionOrLazyProperty) {
     290    if (entry->attributes() & BuiltinOrFunction) {
    297291        if (!(entry->attributes() & ReadOnly)) {
    298             // If this is a function or lazy property put then we just do the put because
    299             // logically the object already had the property, so this is just a replace.
     292            // If this is a function put it as an override property.
    300293            if (JSObject* thisObject = jsDynamicCast<JSObject*>(thisValue))
    301294                thisObject->putDirect(exec->vm(), propertyName, value);
    … …  
    368361        return;
    369362    }
    370    
    371     if (value.attributes() & CellProperty) {
    372         LazyCellProperty* property = bitwise_cast<LazyCellProperty*>(
    373             bitwise_cast<char*>(&thisObj) + value.lazyCellPropertyOffset());
    374         JSCell* result = property->get(&thisObj);
    375         thisObj.putDirect(vm, propertyName, result, attributesForStructure(value.attributes()));
    376         return;
    377     }
    378    
    379     if (value.attributes() & ClassStructure) {
    380         LazyClassStructure* structure = bitwise_cast<LazyClassStructure*>(
    381             bitwise_cast<char*>(&thisObj) + value.lazyClassStructureOffset());
    382         structure->get(jsCast<JSGlobalObject*>(&thisObj));
    383         return;
    384     }
    385    
    386     if (value.attributes() & PropertyCallback) {
    387         JSValue result = value.lazyPropertyCallback()(vm, &thisObj);
    388         thisObj.putDirect(vm, propertyName, result, attributesForStructure(value.attributes()));
    389         return;
    390     }
    391363
    392364    CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter());

  • trunk/Source/JavaScriptCore/runtime/PropertySlot.h

    r200406 r200416  
    11/*
    2  *  Copyright (C) 2005, 2007, 2008, 2015-2016 Apple Inc. All rights reserved.
     2 *  Copyright (C) 2005, 2007, 2008, 2015 Apple Inc. All rights reserved.
    33 *
    44 *  This library is free software; you can redistribute it and/or
    … …  
    4747    Builtin           = 1 << 9,  // property is a builtin function - only used by static hashtables
    4848    ConstantInteger   = 1 << 10, // property is a constant integer - only used by static hashtables
    49     CellProperty      = 1 << 11, // property is a lazy property - only used by static hashtables
    50     ClassStructure    = 1 << 12, // property is a lazy class structure - only used by static hashtables
    51     PropertyCallback  = 1 << 13, // property that is a lazy property callback - only used by static hashtables
    5249    BuiltinOrFunction = Builtin | Function, // helper only used by static hashtables
    53     BuiltinOrFunctionOrLazyProperty = Builtin | Function | CellProperty | ClassStructure | PropertyCallback, // helper only used by static hashtables
    54     BuiltinOrFunctionOrAccessorOrLazyProperty = Builtin | Function | Accessor | CellProperty | ClassStructure | PropertyCallback, // helper only used by static hashtables
    55     BuiltinOrFunctionOrAccessorOrLazyPropertyOrConstant = Builtin | Function | Accessor | CellProperty | ClassStructure | PropertyCallback | ConstantInteger // helper only used by static hashtables
     50    BuiltinOrFunctionOrAccessor = Builtin | Function | Accessor, // helper only used by static hashtables
     51    BuiltinOrFunctionOrAccessorOrConstant = Builtin | Function | Accessor | ConstantInteger, // helper only used by static hashtables
    5652};
    5753

  • trunk/Source/JavaScriptCore/runtime/TypedArrayType.h

    r200383 r200416  
    11/*
    2  * Copyright (C) 2013, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2013 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    3434struct ClassInfo;
    3535
    36 #define FOR_EACH_TYPED_ARRAY_TYPE(macro) \
    37     macro(Int8) \
    38     macro(Uint8) \
    39     macro(Uint8Clamped) \
    40     macro(Int16) \
    41     macro(Uint16) \
    42     macro(Int32) \
    43     macro(Uint32) \
    44     macro(Float32) \
    45     macro(Float64) \
    46     macro(DataView)
    47 
    48 #define FOR_EACH_TYPED_ARRAY_TYPE_EXCLUDING_DATA_VIEW(macro) \
    49     macro(Int8) \
    50     macro(Uint8) \
    51     macro(Uint8Clamped) \
    52     macro(Int16) \
    53     macro(Uint16) \
    54     macro(Int32) \
    55     macro(Uint32) \
    56     macro(Float32) \
    57     macro(Float64)
    58 
    5936enum TypedArrayType {
    6037    NotTypedArray,
    61 #define DECLARE_TYPED_ARRAY_TYPE(name) Type ## name,
    62     FOR_EACH_TYPED_ARRAY_TYPE(DECLARE_TYPED_ARRAY_TYPE)
    63 #undef DECLARE_TYPED_ARRAY_TYPE
     38    TypeInt8,
     39    TypeUint8,
     40    TypeUint8Clamped,
     41    TypeInt16,
     42    TypeUint16,
     43    TypeInt32,
     44    TypeUint32,
     45    TypeFloat32,
     46    TypeFloat64,
     47    TypeDataView
    6448};
    6549

  • trunk/Source/WTF/ChangeLog

    r200383 r200416  
     12016-05-04  Chris Dumez  <cdumez@apple.com>
     2
     3        Unreviewed, rolling out r200383 and r200406.
     4
     5        Seems to have caused crashes on iOS / ARMv7s
     6
     7        Reverted changesets:
     8
     9        "Speed up JSGlobalObject initialization by making some
     10        properties lazy"
     11        https://bugs.webkit.org/show_bug.cgi?id=157045
     12        http://trac.webkit.org/changeset/200383
     13
     14        "REGRESSION(r200383): Setting lazily initialized properties
     15        across frame boundaries crashes"
     16        https://bugs.webkit.org/show_bug.cgi?id=157333
     17        http://trac.webkit.org/changeset/200406
     18
    1192016-05-03  Filip Pizlo  <fpizlo@apple.com>
    220

  • trunk/Source/WTF/wtf/StdLibExtras.h

    r200383 r200416  
    11/*
    2  * Copyright (C) 2008, 2016 Apple Inc. All Rights Reserved.
     2 * Copyright (C) 2008 Apple Inc. All Rights Reserved.
    33 * Copyright (C) 2013 Patrick Gansterer <paroga@paroga.com>
    44 *
    … …  
    3030#include <chrono>
    3131#include <memory>
    32 #include <string.h>
    3332#include <wtf/Assertions.h>
    3433#include <wtf/CheckedArithmetic.h>
    … …  
    286285WTF_EXPORT_PRIVATE bool isCompilationThread();
    287286
    288 template<typename Func>
    289 bool isStatelessLambda()
    290 {
    291     return std::is_empty<Func>::value;
    292 }
    293 
    294 template<typename ResultType, typename Func, typename... ArgumentTypes>
    295 ResultType callStatelessLambda(ArgumentTypes&&... arguments)
    296 {
    297     uint64_t data[(sizeof(Func) + sizeof(uint64_t) - 1) / sizeof(uint64_t)];
    298     memset(data, 0, sizeof(data));
    299     return (*bitwise_cast<Func*>(data))(std::forward<ArgumentTypes>(arguments)...);
    300 }
    301 
    302287} // namespace WTF
    303288
    … …  
    419404using WTF::bitwise_cast;
    420405using WTF::safeCast;
    421 using WTF::isStatelessLambda;
    422 using WTF::callStatelessLambda;
    423406
    424407#if COMPILER_SUPPORTS(CXX_USER_LITERALS)

  • trunk/Source/WebCore/ChangeLog

    r200415 r200416  
     12016-05-04  Chris Dumez  <cdumez@apple.com>
     2
     3        Unreviewed, rolling out r200383 and r200406.
     4
     5        Seems to have caused crashes on iOS / ARMv7s
     6
     7        Reverted changesets:
     8
     9        "Speed up JSGlobalObject initialization by making some
     10        properties lazy"
     11        https://bugs.webkit.org/show_bug.cgi?id=157045
     12        http://trac.webkit.org/changeset/200383
     13
     14        "REGRESSION(r200383): Setting lazily initialized properties
     15        across frame boundaries crashes"
     16        https://bugs.webkit.org/show_bug.cgi?id=157333
     17        http://trac.webkit.org/changeset/200406
     18
    1192016-05-04  Joanmarie Diggs  <jdiggs@igalia.com>
    220

  • trunk/Source/WebCore/bindings/js/JSHTMLElementCustom.cpp

    r200383 r200416  
    11/*
    2  * Copyright (C) 2007, 2016 Apple Inc. All rights reserved.
     2 * Copyright (C) 2007 Apple Inc. All rights reserved.
    33 *
    44 * Redistribution and use in source and binary forms, with or without
    … …  
    102102
    103103    // The document is put on first, fall back to searching it only after the element and form.
    104     // FIXME: This probably may use the wrong global object. If this is called from a native
    105     // function, then it would be correct but not optimal since the native function would *know*
    106     // the global object. But, it may be that globalObject() is more correct.
    107     // https://bugs.webkit.org/show_bug.cgi?id=134932
    108     VM& vm = exec->vm();
    109     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
    110    
    111     scope = JSWithScope::create(vm, lexicalGlobalObject, asObject(toJS(exec, globalObject(), &element.document())), scope);
     104    scope = JSWithScope::create(exec, asObject(toJS(exec, globalObject(), &element.document())), scope);
    112105
    113106    // The form is next, searched before the document, but after the element itself.
    114107    if (HTMLFormElement* form = element.form())
    115         scope = JSWithScope::create(vm, lexicalGlobalObject, asObject(toJS(exec, globalObject(), form)), scope);
     108        scope = JSWithScope::create(exec, asObject(toJS(exec, globalObject(), form)), scope);
    116109
    117110    // The element is on top, searched first.
    118     return JSWithScope::create(vm, lexicalGlobalObject, asObject(toJS(exec, globalObject(), &element)), scope);
     111    return JSWithScope::create(exec, asObject(toJS(exec, globalObject(), &element)), scope);
    119112}
    120113
Note: See TracChangeset for help on using the changeset viewer.