CSE2410 Fall 2014 Bounce

// Copyright 2012 the V8 project authors. All rights reserved.

// Redistribution and use in source and binary forms, with or without

// modification, are permitted provided that the following conditions are

// met:

//

//     * Redistributions of source code must retain the above copyright

//       notice, this list of conditions and the following disclaimer.

//     * Redistributions in binary form must reproduce the above

//       copyright notice, this list of conditions and the following

//       disclaimer in the documentation and/or other materials provided

//       with the distribution.

//     * Neither the name of Google Inc. nor the names of its

//       contributors may be used to endorse or promote products derived

//       from this software without specific prior written permission.

//

// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT

// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT

// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

#include "v8.h"

#include "accessors.h"

#include "api.h"

#include "bootstrapper.h"

#include "compiler.h"

#include "debug.h"

#include "execution.h"

#include "global-handles.h"

#include "isolate-inl.h"

#include "macro-assembler.h"

#include "natives.h"

#include "objects-visiting.h"

#include "platform.h"

#include "snapshot.h"

#include "extensions/externalize-string-extension.h"

#include "extensions/gc-extension.h"

#include "extensions/statistics-extension.h"

#include "code-stubs.h"

namespace v8 {

namespace internal {

NativesExternalStringResource::NativesExternalStringResource(

    Bootstrapper* bootstrapper,

    const char* source,

    size_t length)

    : data_(source), length_(length) {

  if (bootstrapper->delete_these_non_arrays_on_tear_down_ == NULL) {

    bootstrapper->delete_these_non_arrays_on_tear_down_ = new List<char*>(2);

  }

  // The resources are small objects and we only make a fixed number of

  // them, but let's clean them up on exit for neatness.

  bootstrapper->delete_these_non_arrays_on_tear_down_->

      Add(reinterpret_cast<char*>(this));

}

Bootstrapper::Bootstrapper(Isolate* isolate)

    : isolate_(isolate),

      nesting_(0),

      extensions_cache_(Script::TYPE_EXTENSION),

      delete_these_non_arrays_on_tear_down_(NULL),

      delete_these_arrays_on_tear_down_(NULL) {

}

Handle<String> Bootstrapper::NativesSourceLookup(int index) {

  ASSERT(0 <= index && index < Natives::GetBuiltinsCount());

  Heap* heap = isolate_->heap();

  if (heap->natives_source_cache()->get(index)->IsUndefined()) {

    // We can use external strings for the natives.

    Vector<const char> source = Natives::GetRawScriptSource(index);

    NativesExternalStringResource* resource =

        new NativesExternalStringResource(this,

                                          source.start(),

                                          source.length());

    Handle<String> source_code =

        isolate_->factory()->NewExternalStringFromAscii(resource);

    heap->natives_source_cache()->set(index, *source_code);

  }

  Handle<Object> cached_source(heap->natives_source_cache()->get(index),

                               isolate_);

  return Handle<String>::cast(cached_source);

}

void Bootstrapper::Initialize(bool create_heap_objects) {

  extensions_cache_.Initialize(isolate_, create_heap_objects);

}

void Bootstrapper::InitializeOncePerProcess() {

  GCExtension::Register();

  ExternalizeStringExtension::Register();

  StatisticsExtension::Register();

}

char* Bootstrapper::AllocateAutoDeletedArray(int bytes) {

  char* memory = new char[bytes];

  if (memory != NULL) {

    if (delete_these_arrays_on_tear_down_ == NULL) {

      delete_these_arrays_on_tear_down_ = new List<char*>(2);

    }

    delete_these_arrays_on_tear_down_->Add(memory);

  }

  return memory;

}

void Bootstrapper::TearDown() {

  if (delete_these_non_arrays_on_tear_down_ != NULL) {

    int len = delete_these_non_arrays_on_tear_down_->length();

    ASSERT(len < 20);  // Don't use this mechanism for unbounded allocations.

    for (int i = 0; i < len; i++) {

      delete delete_these_non_arrays_on_tear_down_->at(i);

      delete_these_non_arrays_on_tear_down_->at(i) = NULL;

    }

    delete delete_these_non_arrays_on_tear_down_;

    delete_these_non_arrays_on_tear_down_ = NULL;

  }

  if (delete_these_arrays_on_tear_down_ != NULL) {

    int len = delete_these_arrays_on_tear_down_->length();

    ASSERT(len < 1000);  // Don't use this mechanism for unbounded allocations.

    for (int i = 0; i < len; i++) {

      delete[] delete_these_arrays_on_tear_down_->at(i);

      delete_these_arrays_on_tear_down_->at(i) = NULL;

    }

    delete delete_these_arrays_on_tear_down_;

    delete_these_arrays_on_tear_down_ = NULL;

  }

  extensions_cache_.Initialize(isolate_, false);  // Yes, symmetrical

}

class Genesis BASE_EMBEDDED {

 public:

  Genesis(Isolate* isolate,

          Handle<Object> global_object,

          v8::Handle<v8::ObjectTemplate> global_template,

          v8::ExtensionConfiguration* extensions);

  ~Genesis() { }

  Isolate* isolate() const { return isolate_; }

  Factory* factory() const { return isolate_->factory(); }

  Heap* heap() const { return isolate_->heap(); }

  Handle<Context> result() { return result_; }

 private:

  Handle<Context> native_context() { return native_context_; }

  // Creates some basic objects. Used for creating a context from scratch.

  void CreateRoots();

  // Creates the empty function.  Used for creating a context from scratch.

  Handle<JSFunction> CreateEmptyFunction(Isolate* isolate);

  // Creates the ThrowTypeError function. ECMA 5th Ed. 13.2.3

  Handle<JSFunction> GetThrowTypeErrorFunction();

  void CreateStrictModeFunctionMaps(Handle<JSFunction> empty);

  // Make the "arguments" and "caller" properties throw a TypeError on access.

  void PoisonArgumentsAndCaller(Handle<Map> map);

  // Creates the global objects using the global and the template passed in

  // through the API.  We call this regardless of whether we are building a

  // context from scratch or using a deserialized one from the partial snapshot

  // but in the latter case we don't use the objects it produces directly, as

  // we have to used the deserialized ones that are linked together with the

  // rest of the context snapshot.

  Handle<JSGlobalProxy> CreateNewGlobals(

      v8::Handle<v8::ObjectTemplate> global_template,

      Handle<Object> global_object,

      Handle<GlobalObject>* global_proxy_out);

  // Hooks the given global proxy into the context.  If the context was created

  // by deserialization then this will unhook the global proxy that was

  // deserialized, leaving the GC to pick it up.

  void HookUpGlobalProxy(Handle<GlobalObject> inner_global,

                         Handle<JSGlobalProxy> global_proxy);

  // Similarly, we want to use the inner global that has been created by the

  // templates passed through the API.  The inner global from the snapshot is

  // detached from the other objects in the snapshot.

  void HookUpInnerGlobal(Handle<GlobalObject> inner_global);

  // New context initialization.  Used for creating a context from scratch.

  void InitializeGlobal(Handle<GlobalObject> inner_global,

                        Handle<JSFunction> empty_function);

  void InitializeExperimentalGlobal();

  // Installs the contents of the native .js files on the global objects.

  // Used for creating a context from scratch.

  void InstallNativeFunctions();

  void InstallExperimentalNativeFunctions();

  Handle<JSFunction> InstallInternalArray(Handle<JSBuiltinsObject> builtins,

                                          const char* name,

                                          ElementsKind elements_kind);

  bool InstallNatives();

  Handle<JSFunction> InstallTypedArray(const char* name,

      ElementsKind elementsKind);

  bool InstallExperimentalNatives();

  void InstallBuiltinFunctionIds();

  void InstallJSFunctionResultCaches();

  void InitializeNormalizedMapCaches();

  enum ExtensionTraversalState {

    UNVISITED, VISITED, INSTALLED

  };

  class ExtensionStates {

   public:

    ExtensionStates();

    ExtensionTraversalState get_state(RegisteredExtension* extension);

    void set_state(RegisteredExtension* extension,

                   ExtensionTraversalState state);

   private:

    HashMap map_;

    DISALLOW_COPY_AND_ASSIGN(ExtensionStates);

  };

  // Used both for deserialized and from-scratch contexts to add the extensions

  // provided.

  static bool InstallExtensions(Handle<Context> native_context,

                                v8::ExtensionConfiguration* extensions);

  static bool InstallExtension(Isolate* isolate,

                               const char* name,

                               ExtensionStates* extension_states);

  static bool InstallExtension(Isolate* isolate,

                               v8::RegisteredExtension* current,

                               ExtensionStates* extension_states);

  static void InstallSpecialObjects(Handle<Context> native_context);

  bool InstallJSBuiltins(Handle<JSBuiltinsObject> builtins);

  bool ConfigureApiObject(Handle<JSObject> object,

                          Handle<ObjectTemplateInfo> object_template);

  bool ConfigureGlobalObjects(v8::Handle<v8::ObjectTemplate> global_template);

  // Migrates all properties from the 'from' object to the 'to'

  // object and overrides the prototype in 'to' with the one from

  // 'from'.

  void TransferObject(Handle<JSObject> from, Handle<JSObject> to);

  void TransferNamedProperties(Handle<JSObject> from, Handle<JSObject> to);

  void TransferIndexedProperties(Handle<JSObject> from, Handle<JSObject> to);

  enum PrototypePropertyMode {

    DONT_ADD_PROTOTYPE,

    ADD_READONLY_PROTOTYPE,

    ADD_WRITEABLE_PROTOTYPE

  };

  Handle<Map> CreateFunctionMap(PrototypePropertyMode prototype_mode);

  void SetFunctionInstanceDescriptor(Handle<Map> map,

                                     PrototypePropertyMode prototypeMode);

  void MakeFunctionInstancePrototypeWritable();

  Handle<Map> CreateStrictModeFunctionMap(

      PrototypePropertyMode prototype_mode,

      Handle<JSFunction> empty_function);

  void SetStrictFunctionInstanceDescriptor(Handle<Map> map,

                                           PrototypePropertyMode propertyMode);

  static bool CompileBuiltin(Isolate* isolate, int index);

  static bool CompileExperimentalBuiltin(Isolate* isolate, int index);

  static bool CompileNative(Isolate* isolate,

                            Vector<const char> name,

                            Handle<String> source);

  static bool CompileScriptCached(Isolate* isolate,

                                  Vector<const char> name,

                                  Handle<String> source,

                                  SourceCodeCache* cache,

                                  v8::Extension* extension,

                                  Handle<Context> top_context,

                                  bool use_runtime_context);

  Isolate* isolate_;

  Handle<Context> result_;

  Handle<Context> native_context_;

  // Function maps. Function maps are created initially with a read only

  // prototype for the processing of JS builtins. Later the function maps are

  // replaced in order to make prototype writable. These are the final, writable

  // prototype, maps.

  Handle<Map> function_map_writable_prototype_;

  Handle<Map> strict_mode_function_map_writable_prototype_;

  Handle<JSFunction> throw_type_error_function;

  BootstrapperActive active_;

  friend class Bootstrapper;

};

void Bootstrapper::Iterate(ObjectVisitor* v) {

  extensions_cache_.Iterate(v);

  v->Synchronize(VisitorSynchronization::kExtensions);

}

Handle<Context> Bootstrapper::CreateEnvironment(

    Handle<Object> global_object,

    v8::Handle<v8::ObjectTemplate> global_template,

    v8::ExtensionConfiguration* extensions) {

  HandleScope scope(isolate_);

  Genesis genesis(isolate_, global_object, global_template, extensions);

  Handle<Context> env = genesis.result();

  if (env.is_null() || !InstallExtensions(env, extensions)) {

    return Handle<Context>();

  }

  return scope.CloseAndEscape(env);

}

static void SetObjectPrototype(Handle<JSObject> object, Handle<Object> proto) {

  // object.__proto__ = proto;

  Factory* factory = object->GetIsolate()->factory();

  Handle<Map> old_to_map = Handle<Map>(object->map());

  Handle<Map> new_to_map = factory->CopyMap(old_to_map);

  new_to_map->set_prototype(*proto);

  object->set_map(*new_to_map);

}

void Bootstrapper::DetachGlobal(Handle<Context> env) {

  Factory* factory = env->GetIsolate()->factory();

  Handle<JSGlobalProxy> global_proxy(JSGlobalProxy::cast(env->global_proxy()));

  global_proxy->set_native_context(*factory->null_value());

  SetObjectPrototype(global_proxy, factory->null_value());

  env->set_global_proxy(env->global_object());

  env->global_object()->set_global_receiver(env->global_object());

}

void Bootstrapper::ReattachGlobal(Handle<Context> env,

                                  Handle<JSGlobalProxy> global_proxy) {

  env->global_object()->set_global_receiver(*global_proxy);

  env->set_global_proxy(*global_proxy);

  SetObjectPrototype(global_proxy, Handle<JSObject>(env->global_object()));

  global_proxy->set_native_context(*env);

}

static Handle<JSFunction> InstallFunction(Handle<JSObject> target,

                                          const char* name,

                                          InstanceType type,

                                          int instance_size,

                                          Handle<JSObject> prototype,

                                          Builtins::Name call,

                                          bool install_initial_map,

                                          bool set_instance_class_name) {

  Isolate* isolate = target->GetIsolate();

  Factory* factory = isolate->factory();

  Handle<String> internalized_name = factory->InternalizeUtf8String(name);

  Handle<Code> call_code = Handle<Code>(isolate->builtins()->builtin(call));

  Handle<JSFunction> function = prototype.is_null() ?

    factory->NewFunctionWithoutPrototype(internalized_name, call_code) :

    factory->NewFunctionWithPrototype(internalized_name,

                                      type,

                                      instance_size,

                                      prototype,

                                      call_code,

                                      install_initial_map);

  PropertyAttributes attributes;

  if (target->IsJSBuiltinsObject()) {

    attributes =

        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);

  } else {

    attributes = DONT_ENUM;

  }

  CHECK_NOT_EMPTY_HANDLE(isolate,

                         JSObject::SetLocalPropertyIgnoreAttributes(

                             target, internalized_name, function, attributes));

  if (set_instance_class_name) {

    function->shared()->set_instance_class_name(*internalized_name);

  }

  function->shared()->set_native(true);

  return function;

}

void Genesis::SetFunctionInstanceDescriptor(

    Handle<Map> map, PrototypePropertyMode prototypeMode) {

  int size = (prototypeMode == DONT_ADD_PROTOTYPE) ? 4 : 5;

  Handle<DescriptorArray> descriptors(factory()->NewDescriptorArray(0, size));

  DescriptorArray::WhitenessWitness witness(*descriptors);

  Handle<Foreign> length(factory()->NewForeign(&Accessors::FunctionLength));

  Handle<Foreign> name(factory()->NewForeign(&Accessors::FunctionName));

  Handle<Foreign> args(factory()->NewForeign(&Accessors::FunctionArguments));

  Handle<Foreign> caller(factory()->NewForeign(&Accessors::FunctionCaller));

  Handle<Foreign> prototype;

  if (prototypeMode != DONT_ADD_PROTOTYPE) {

    prototype = factory()->NewForeign(&Accessors::FunctionPrototype);

  }

  PropertyAttributes attribs = static_cast<PropertyAttributes>(

      DONT_ENUM | DONT_DELETE | READ_ONLY);

  map->set_instance_descriptors(*descriptors);

  {  // Add length.

    CallbacksDescriptor d(*factory()->length_string(), *length, attribs);

    map->AppendDescriptor(&d, witness);

  }

  {  // Add name.

    CallbacksDescriptor d(*factory()->name_string(), *name, attribs);

    map->AppendDescriptor(&d, witness);

  }

  {  // Add arguments.

    CallbacksDescriptor d(*factory()->arguments_string(), *args, attribs);

    map->AppendDescriptor(&d, witness);

  }

  {  // Add caller.

    CallbacksDescriptor d(*factory()->caller_string(), *caller, attribs);

    map->AppendDescriptor(&d, witness);

  }

  if (prototypeMode != DONT_ADD_PROTOTYPE) {

    // Add prototype.

    if (prototypeMode == ADD_WRITEABLE_PROTOTYPE) {

      attribs = static_cast<PropertyAttributes>(attribs & ~READ_ONLY);

    }

    CallbacksDescriptor d(*factory()->prototype_string(), *prototype, attribs);

    map->AppendDescriptor(&d, witness);

  }

}

Handle<Map> Genesis::CreateFunctionMap(PrototypePropertyMode prototype_mode) {

  Handle<Map> map = factory()->NewMap(JS_FUNCTION_TYPE, JSFunction::kSize);

  SetFunctionInstanceDescriptor(map, prototype_mode);

  map->set_function_with_prototype(prototype_mode != DONT_ADD_PROTOTYPE);

  return map;

}

Handle<JSFunction> Genesis::CreateEmptyFunction(Isolate* isolate) {

  // Allocate the map for function instances. Maps are allocated first and their

  // prototypes patched later, once empty function is created.

  // Functions with this map will not have a 'prototype' property, and

  // can not be used as constructors.

  Handle<Map> function_without_prototype_map =

      CreateFunctionMap(DONT_ADD_PROTOTYPE);

  native_context()->set_function_without_prototype_map(

      *function_without_prototype_map);

  // Allocate the function map. This map is temporary, used only for processing

  // of builtins.

  // Later the map is replaced with writable prototype map, allocated below.

  Handle<Map> function_map = CreateFunctionMap(ADD_READONLY_PROTOTYPE);

  native_context()->set_function_map(*function_map);

  // The final map for functions. Writeable prototype.

  // This map is installed in MakeFunctionInstancePrototypeWritable.

  function_map_writable_prototype_ = CreateFunctionMap(ADD_WRITEABLE_PROTOTYPE);

  Factory* factory = isolate->factory();

  Handle<String> object_name = factory->Object_string();

  {  // --- O b j e c t ---

    Handle<JSFunction> object_fun =

        factory->NewFunction(object_name, factory->null_value());

    Handle<Map> object_function_map =

        factory->NewMap(JS_OBJECT_TYPE, JSObject::kHeaderSize);

    object_fun->set_initial_map(*object_function_map);

    object_function_map->set_constructor(*object_fun);

    native_context()->set_object_function(*object_fun);

    // Allocate a new prototype for the object function.

    Handle<JSObject> prototype = factory->NewJSObject(

        isolate->object_function(),

        TENURED);

    native_context()->set_initial_object_prototype(*prototype);

    // For bootstrapping set the array prototype to be the same as the object

    // prototype, otherwise the missing initial_array_prototype will cause

    // assertions during startup.

    native_context()->set_initial_array_prototype(*prototype);

    Accessors::FunctionSetPrototype(object_fun, prototype);

  }

  // Allocate the empty function as the prototype for function ECMAScript

  // 262 15.3.4.

  Handle<String> empty_string =

      factory->InternalizeOneByteString(STATIC_ASCII_VECTOR("Empty"));

  Handle<JSFunction> empty_function =

      factory->NewFunctionWithoutPrototype(empty_string, CLASSIC_MODE);

  // --- E m p t y ---

  Handle<Code> code =

      Handle<Code>(isolate->builtins()->builtin(

          Builtins::kEmptyFunction));

  empty_function->set_code(*code);

  empty_function->shared()->set_code(*code);

  Handle<String> source =

      factory->NewStringFromOneByte(STATIC_ASCII_VECTOR("() {}"));

  Handle<Script> script = factory->NewScript(source);

  script->set_type(Smi::FromInt(Script::TYPE_NATIVE));

  empty_function->shared()->set_script(*script);

  empty_function->shared()->set_start_position(0);

  empty_function->shared()->set_end_position(source->length());

  empty_function->shared()->DontAdaptArguments();

  // Set prototypes for the function maps.

  native_context()->function_map()->set_prototype(*empty_function);

  native_context()->function_without_prototype_map()->

      set_prototype(*empty_function);

  function_map_writable_prototype_->set_prototype(*empty_function);

  // Allocate the function map first and then patch the prototype later

  Handle<Map> empty_function_map = CreateFunctionMap(DONT_ADD_PROTOTYPE);

  empty_function_map->set_prototype(

      native_context()->object_function()->prototype());

  empty_function->set_map(*empty_function_map);

  return empty_function;

}

void Genesis::SetStrictFunctionInstanceDescriptor(

    Handle<Map> map, PrototypePropertyMode prototypeMode) {

  int size = (prototypeMode == DONT_ADD_PROTOTYPE) ? 4 : 5;

  Handle<DescriptorArray> descriptors(factory()->NewDescriptorArray(0, size));

  DescriptorArray::WhitenessWitness witness(*descriptors);

  Handle<Foreign> length(factory()->NewForeign(&Accessors::FunctionLength));

  Handle<Foreign> name(factory()->NewForeign(&Accessors::FunctionName));

  Handle<AccessorPair> arguments(factory()->NewAccessorPair());

  Handle<AccessorPair> caller(factory()->NewAccessorPair());

  Handle<Foreign> prototype;

  if (prototypeMode != DONT_ADD_PROTOTYPE) {

    prototype = factory()->NewForeign(&Accessors::FunctionPrototype);

  }

  PropertyAttributes rw_attribs =

      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);

  PropertyAttributes ro_attribs =

      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);

  map->set_instance_descriptors(*descriptors);

  {  // Add length.

    CallbacksDescriptor d(*factory()->length_string(), *length, ro_attribs);

    map->AppendDescriptor(&d, witness);

  }

  {  // Add name.

    CallbacksDescriptor d(*factory()->name_string(), *name, rw_attribs);

    map->AppendDescriptor(&d, witness);

  }

  {  // Add arguments.

    CallbacksDescriptor d(*factory()->arguments_string(), *arguments,

                          rw_attribs);

    map->AppendDescriptor(&d, witness);

  }

  {  // Add caller.

    CallbacksDescriptor d(*factory()->caller_string(), *caller, rw_attribs);

    map->AppendDescriptor(&d, witness);

  }

  if (prototypeMode != DONT_ADD_PROTOTYPE) {

    // Add prototype.

    PropertyAttributes attribs =

        prototypeMode == ADD_WRITEABLE_PROTOTYPE ? rw_attribs : ro_attribs;

    CallbacksDescriptor d(*factory()->prototype_string(), *prototype, attribs);

    map->AppendDescriptor(&d, witness);

  }

}

// ECMAScript 5th Edition, 13.2.3

Handle<JSFunction> Genesis::GetThrowTypeErrorFunction() {

  if (throw_type_error_function.is_null()) {

    Handle<String> name = factory()->InternalizeOneByteString(

        STATIC_ASCII_VECTOR("ThrowTypeError"));

    throw_type_error_function =

      factory()->NewFunctionWithoutPrototype(name, CLASSIC_MODE);

    Handle<Code> code(isolate()->builtins()->builtin(

        Builtins::kStrictModePoisonPill));

    throw_type_error_function->set_map(

        native_context()->function_map());

    throw_type_error_function->set_code(*code);

    throw_type_error_function->shared()->set_code(*code);

    throw_type_error_function->shared()->DontAdaptArguments();

    JSObject::PreventExtensions(throw_type_error_function);

  }

  return throw_type_error_function;

}

Handle<Map> Genesis::CreateStrictModeFunctionMap(

    PrototypePropertyMode prototype_mode,

    Handle<JSFunction> empty_function) {

  Handle<Map> map = factory()->NewMap(JS_FUNCTION_TYPE, JSFunction::kSize);

  SetStrictFunctionInstanceDescriptor(map, prototype_mode);

  map->set_function_with_prototype(prototype_mode != DONT_ADD_PROTOTYPE);

  map->set_prototype(*empty_function);

  return map;

}

void Genesis::CreateStrictModeFunctionMaps(Handle<JSFunction> empty) {

  // Allocate map for the prototype-less strict mode instances.

  Handle<Map> strict_mode_function_without_prototype_map =

      CreateStrictModeFunctionMap(DONT_ADD_PROTOTYPE, empty);

  native_context()->set_strict_mode_function_without_prototype_map(

      *strict_mode_function_without_prototype_map);

  // Allocate map for the strict mode functions. This map is temporary, used

  // only for processing of builtins.

  // Later the map is replaced with writable prototype map, allocated below.

  Handle<Map> strict_mode_function_map =

      CreateStrictModeFunctionMap(ADD_READONLY_PROTOTYPE, empty);

  native_context()->set_strict_mode_function_map(

      *strict_mode_function_map);

  // The final map for the strict mode functions. Writeable prototype.

  // This map is installed in MakeFunctionInstancePrototypeWritable.

  strict_mode_function_map_writable_prototype_ =

      CreateStrictModeFunctionMap(ADD_WRITEABLE_PROTOTYPE, empty);

  // Complete the callbacks.

  PoisonArgumentsAndCaller(strict_mode_function_without_prototype_map);

  PoisonArgumentsAndCaller(strict_mode_function_map);

  PoisonArgumentsAndCaller(strict_mode_function_map_writable_prototype_);

}

static void SetAccessors(Handle<Map> map,

                         Handle<String> name,

                         Handle<JSFunction> func) {

  DescriptorArray* descs = map->instance_descriptors();

  int number = descs->SearchWithCache(*name, *map);

  AccessorPair* accessors = AccessorPair::cast(descs->GetValue(number));

  accessors->set_getter(*func);

  accessors->set_setter(*func);

}

void Genesis::PoisonArgumentsAndCaller(Handle<Map> map) {

  SetAccessors(map, factory()->arguments_string(), GetThrowTypeErrorFunction());

  SetAccessors(map, factory()->caller_string(), GetThrowTypeErrorFunction());

}

static void AddToWeakNativeContextList(Context* context) {

  ASSERT(context->IsNativeContext());

  Heap* heap = context->GetIsolate()->heap();

#ifdef DEBUG

  { // NOLINT

    ASSERT(context->get(Context::NEXT_CONTEXT_LINK)->IsUndefined());

    // Check that context is not in the list yet.

    for (Object* current = heap->native_contexts_list();

         !current->IsUndefined();

         current = Context::cast(current)->get(Context::NEXT_CONTEXT_LINK)) {

      ASSERT(current != context);

    }

  }

#endif

  context->set(Context::NEXT_CONTEXT_LINK, heap->native_contexts_list());

  heap->set_native_contexts_list(context);

}

void Genesis::CreateRoots() {

  // Allocate the native context FixedArray first and then patch the

  // closure and extension object later (we need the empty function

  // and the global object, but in order to create those, we need the

  // native context).

  native_context_ = factory()->NewNativeContext();

  AddToWeakNativeContextList(*native_context());

  isolate()->set_context(*native_context());

  // Allocate the message listeners object.

  {

    v8::NeanderArray listeners;

    native_context()->set_message_listeners(*listeners.value());

  }

}

Handle<JSGlobalProxy> Genesis::CreateNewGlobals(

    v8::Handle<v8::ObjectTemplate> global_template,

    Handle<Object> global_object,

    Handle<GlobalObject>* inner_global_out) {

  // The argument global_template aka data is an ObjectTemplateInfo.

  // It has a constructor pointer that points at global_constructor which is a

  // FunctionTemplateInfo.

  // The global_constructor is used to create or reinitialize the global_proxy.

  // The global_constructor also has a prototype_template pointer that points at

  // js_global_template which is an ObjectTemplateInfo.

  // That in turn has a constructor pointer that points at

  // js_global_constructor which is a FunctionTemplateInfo.

  // js_global_constructor is used to make js_global_function

  // js_global_function is used to make the new inner_global.

  //

  // --- G l o b a l ---

  // Step 1: Create a fresh inner JSGlobalObject.

  Handle<JSFunction> js_global_function;

  Handle<ObjectTemplateInfo> js_global_template;

  if (!global_template.IsEmpty()) {

    // Get prototype template of the global_template.

    Handle<ObjectTemplateInfo> data =

        v8::Utils::OpenHandle(*global_template);

    Handle<FunctionTemplateInfo> global_constructor =

        Handle<FunctionTemplateInfo>(

            FunctionTemplateInfo::cast(data->constructor()));

    Handle<Object> proto_template(global_constructor->prototype_template(),

                                  isolate());

    if (!proto_template->IsUndefined()) {

      js_global_template =

          Handle<ObjectTemplateInfo>::cast(proto_template);

    }

  }

  if (js_global_template.is_null()) {

    Handle<String> name = Handle<String>(heap()->empty_string());

    Handle<Code> code = Handle<Code>(isolate()->builtins()->builtin(

        Builtins::kIllegal));

    js_global_function =

        factory()->NewFunction(name, JS_GLOBAL_OBJECT_TYPE,

                               JSGlobalObject::kSize, code, true);

    // Change the constructor property of the prototype of the

    // hidden global function to refer to the Object function.

    Handle<JSObject> prototype =

        Handle<JSObject>(

            JSObject::cast(js_global_function->instance_prototype()));

    CHECK_NOT_EMPTY_HANDLE(isolate(),

                           JSObject::SetLocalPropertyIgnoreAttributes(

                               prototype, factory()->constructor_string(),

                               isolate()->object_function(), NONE));

  } else {

    Handle<FunctionTemplateInfo> js_global_constructor(

        FunctionTemplateInfo::cast(js_global_template->constructor()));

    js_global_function =

        factory()->CreateApiFunction(js_global_constructor,

                                     factory()->InnerGlobalObject);

  }

  js_global_function->initial_map()->set_is_hidden_prototype();

  js_global_function->initial_map()->set_dictionary_map(true);

  Handle<GlobalObject> inner_global =

      factory()->NewGlobalObject(js_global_function);

  if (inner_global_out != NULL) {

    *inner_global_out = inner_global;

  }

  // Step 2: create or re-initialize the global proxy object.

  Handle<JSFunction> global_proxy_function;

  if (global_template.IsEmpty()) {

    Handle<String> name = Handle<String>(heap()->empty_string());

    Handle<Code> code = Handle<Code>(isolate()->builtins()->builtin(

        Builtins::kIllegal));

    global_proxy_function =

        factory()->NewFunction(name, JS_GLOBAL_PROXY_TYPE,

                               JSGlobalProxy::kSize, code, true);

  } else {

    Handle<ObjectTemplateInfo> data =

        v8::Utils::OpenHandle(*global_template);

    Handle<FunctionTemplateInfo> global_constructor(

            FunctionTemplateInfo::cast(data->constructor()));

    global_proxy_function =

        factory()->CreateApiFunction(global_constructor,

                                     factory()->OuterGlobalObject);

  }

  Handle<String> global_name = factory()->InternalizeOneByteString(

      STATIC_ASCII_VECTOR("global"));

  global_proxy_function->shared()->set_instance_class_name(*global_name);

  global_proxy_function->initial_map()->set_is_access_check_needed(true);

  // Set global_proxy.__proto__ to js_global after ConfigureGlobalObjects

  // Return the global proxy.

  if (global_object.location() != NULL) {

    ASSERT(global_object->IsJSGlobalProxy());

    return ReinitializeJSGlobalProxy(

        global_proxy_function,

        Handle<JSGlobalProxy>::cast(global_object));

  } else {

    return Handle<JSGlobalProxy>::cast(

        factory()->NewJSObject(global_proxy_function, TENURED));

  }

}

void Genesis::HookUpGlobalProxy(Handle<GlobalObject> inner_global,

                                Handle<JSGlobalProxy> global_proxy) {

  // Set the native context for the global object.

  inner_global->set_native_context(*native_context());

  inner_global->set_global_context(*native_context());

  inner_global->set_global_receiver(*global_proxy);

  global_proxy->set_native_context(*native_context());

  native_context()->set_global_proxy(*global_proxy);

}

void Genesis::HookUpInnerGlobal(Handle<GlobalObject> inner_global) {

  Handle<GlobalObject> inner_global_from_snapshot(

      GlobalObject::cast(native_context()->extension()));

  Handle<JSBuiltinsObject> builtins_global(native_context()->builtins());

  native_context()->set_extension(*inner_global);

  native_context()->set_global_object(*inner_global);

  native_context()->set_security_token(*inner_global);

  static const PropertyAttributes attributes =

      static_cast<PropertyAttributes>(READ_ONLY | DONT_DELETE);

  ForceSetProperty(builtins_global,

                   factory()->InternalizeOneByteString(

                       STATIC_ASCII_VECTOR("global")),

                   inner_global,

                   attributes);

  // Set up the reference from the global object to the builtins object.

  JSGlobalObject::cast(*inner_global)->set_builtins(*builtins_global);

  TransferNamedProperties(inner_global_from_snapshot, inner_global);

  TransferIndexedProperties(inner_global_from_snapshot, inner_global);

}

// This is only called if we are not using snapshots.  The equivalent

// work in the snapshot case is done in HookUpInnerGlobal.

void Genesis::InitializeGlobal(Handle<GlobalObject> inner_global,

                               Handle<JSFunction> empty_function) {

  // --- N a t i v e   C o n t e x t ---

  // Use the empty function as closure (no scope info).

  native_context()->set_closure(*empty_function);

  native_context()->set_previous(NULL);

  // Set extension and global object.

  native_context()->set_extension(*inner_global);

  native_context()->set_global_object(*inner_global);

  // Security setup: Set the security token of the global object to

  // its the inner global. This makes the security check between two

  // different contexts fail by default even in case of global

  // object reinitialization.

  native_context()->set_security_token(*inner_global);

  Isolate* isolate = inner_global->GetIsolate();

  Factory* factory = isolate->factory();

  Heap* heap = isolate->heap();

  Handle<String> object_name = factory->Object_string();

  CHECK_NOT_EMPTY_HANDLE(isolate,

                         JSObject::SetLocalPropertyIgnoreAttributes(

                             inner_global, object_name,

                             isolate->object_function(), DONT_ENUM));

  Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());

  // Install global Function object

  InstallFunction(global, "Function", JS_FUNCTION_TYPE, JSFunction::kSize,

                  empty_function, Builtins::kIllegal, true, true);

  {  // --- A r r a y ---

    Handle<JSFunction> array_function =

        InstallFunction(global, "Array", JS_ARRAY_TYPE, JSArray::kSize,

                        isolate->initial_object_prototype(),

                        Builtins::kArrayCode, true, true);

    array_function->shared()->DontAdaptArguments();

    array_function->shared()->set_function_data(Smi::FromInt(kArrayCode));

    // This seems a bit hackish, but we need to make sure Array.length

    // is 1.

    array_function->shared()->set_length(1);

    Handle<Map> initial_map(array_function->initial_map());

    // This assert protects an optimization in

    // HGraphBuilder::JSArrayBuilder::EmitMapCode()

    ASSERT(initial_map->elements_kind() == GetInitialFastElementsKind());

    Handle<DescriptorArray> array_descriptors(

        factory->NewDescriptorArray(0, 1));

    DescriptorArray::WhitenessWitness witness(*array_descriptors);

    Handle<Foreign> array_length(factory->NewForeign(&Accessors::ArrayLength));

    PropertyAttributes attribs = static_cast<PropertyAttributes>(

        DONT_ENUM | DONT_DELETE);

    initial_map->set_instance_descriptors(*array_descriptors);

    {  // Add length.

      CallbacksDescriptor d(*factory->length_string(), *array_length, attribs);

      array_function->initial_map()->AppendDescriptor(&d, witness);

    }

    // array_function is used internally. JS code creating array object should

    // search for the 'Array' property on the global object and use that one

    // as the constructor. 'Array' property on a global object can be

    // overwritten by JS code.

    native_context()->set_array_function(*array_function);

    // Cache the array maps, needed by ArrayConstructorStub

    CacheInitialJSArrayMaps(native_context(), initial_map);

    ArrayConstructorStub array_constructor_stub(isolate);

    Handle<Code> code = array_constructor_stub.GetCode(isolate);

    array_function->shared()->set_construct_stub(*code);

  }

  {  // --- N u m b e r ---

    Handle<JSFunction> number_fun =

        InstallFunction(global, "Number", JS_VALUE_TYPE, JSValue::kSize,

                        isolate->initial_object_prototype(),

                        Builtins::kIllegal, true, true);

    native_context()->set_number_function(*number_fun);

  }

  {  // --- B o o l e a n ---

    Handle<JSFunction> boolean_fun =

        InstallFunction(global, "Boolean", JS_VALUE_TYPE, JSValue::kSize,

                        isolate->initial_object_prototype(),

                        Builtins::kIllegal, true, true);

    native_context()->set_boolean_function(*boolean_fun);

  }

  {  // --- S t r i n g ---

    Handle<JSFunction> string_fun =

        InstallFunction(global, "String", JS_VALUE_TYPE, JSValue::kSize,

                        isolate->initial_object_prototype(),

                        Builtins::kIllegal, true, true);

    string_fun->shared()->set_construct_stub(

        isolate->builtins()->builtin(Builtins::kStringConstructCode));

    native_context()->set_string_function(*string_fun);

    Handle<Map> string_map =

        Handle<Map>(native_context()->string_function()->initial_map());

    Handle<DescriptorArray> string_descriptors(

        factory->NewDescriptorArray(0, 1));

    DescriptorArray::WhitenessWitness witness(*string_descriptors);

    Handle<Foreign> string_length(

        factory->NewForeign(&Accessors::StringLength));

    PropertyAttributes attribs = static_cast<PropertyAttributes>(

        DONT_ENUM | DONT_DELETE | READ_ONLY);

    string_map->set_instance_descriptors(*string_descriptors);

    {  // Add length.

      CallbacksDescriptor d(*factory->length_string(), *string_length, attribs);

      string_map->AppendDescriptor(&d, witness);

    }

  }

  {  // --- D a t e ---

    // Builtin functions for Date.prototype.

    Handle<JSFunction> date_fun =

        InstallFunction(global, "Date", JS_DATE_TYPE, JSDate::kSize,

                        isolate->initial_object_prototype(),

                        Builtins::kIllegal, true, true);

    native_context()->set_date_function(*date_fun);

  }

  {  // -- R e g E x p

    // Builtin functions for RegExp.prototype.

    Handle<JSFunction> regexp_fun =

        InstallFunction(global, "RegExp", JS_REGEXP_TYPE, JSRegExp::kSize,

                        isolate->initial_object_prototype(),

                        Builtins::kIllegal, true, true);

    native_context()->set_regexp_function(*regexp_fun);

    ASSERT(regexp_fun->has_initial_map());

    Handle<Map> initial_map(regexp_fun->initial_map());

    ASSERT_EQ(0, initial_map->inobject_properties());

    PropertyAttributes final =

        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);

    Handle<DescriptorArray> descriptors = factory->NewDescriptorArray(0, 5);

    DescriptorArray::WhitenessWitness witness(*descriptors);

    initial_map->set_instance_descriptors(*descriptors);

    {

      // ECMA-262, section 15.10.7.1.

      FieldDescriptor field(heap->source_string(),

                            JSRegExp::kSourceFieldIndex,

                            final,

                            Representation::Tagged());

      initial_map->AppendDescriptor(&field, witness);

    }

    {

      // ECMA-262, section 15.10.7.2.

      FieldDescriptor field(heap->global_string(),

                            JSRegExp::kGlobalFieldIndex,

                            final,

                            Representation::Tagged());

      initial_map->AppendDescriptor(&field, witness);

    }

    {

      // ECMA-262, section 15.10.7.3.

      FieldDescriptor field(heap->ignore_case_string(),

                            JSRegExp::kIgnoreCaseFieldIndex,

                            final,

                            Representation::Tagged());

      initial_map->AppendDescriptor(&field, witness);

    }

    {

      // ECMA-262, section 15.10.7.4.

      FieldDescriptor field(heap->multiline_string(),

                            JSRegExp::kMultilineFieldIndex,

                            final,

                            Representation::Tagged());

      initial_map->AppendDescriptor(&field, witness);

    }

    {

      // ECMA-262, section 15.10.7.5.

      PropertyAttributes writable =

          static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE);

      FieldDescriptor field(heap->last_index_string(),

                            JSRegExp::kLastIndexFieldIndex,

                            writable,

                            Representation::Tagged());

      initial_map->AppendDescriptor(&field, witness);

    }

    initial_map->set_inobject_properties(5);

    initial_map->set_pre_allocated_property_fields(5);

    initial_map->set_unused_property_fields(0);

    initial_map->set_instance_size(

        initial_map->instance_size() + 5 * kPointerSize);

    initial_map->set_visitor_id(StaticVisitorBase::GetVisitorId(*initial_map));

    // RegExp prototype object is itself a RegExp.

    Handle<Map> proto_map = factory->CopyMap(initial_map);

    proto_map->set_prototype(native_context()->initial_object_prototype());

    Handle<JSObject> proto = factory->NewJSObjectFromMap(proto_map);

    proto->InObjectPropertyAtPut(JSRegExp::kSourceFieldIndex,

                                 heap->query_colon_string());

    proto->InObjectPropertyAtPut(JSRegExp::kGlobalFieldIndex,

                                 heap->false_value());

    proto->InObjectPropertyAtPut(JSRegExp::kIgnoreCaseFieldIndex,

                                 heap->false_value());

    proto->InObjectPropertyAtPut(JSRegExp::kMultilineFieldIndex,

                                 heap->false_value());

    proto->InObjectPropertyAtPut(JSRegExp::kLastIndexFieldIndex,

                                 Smi::FromInt(0),

                                 SKIP_WRITE_BARRIER);  // It's a Smi.

    initial_map->set_prototype(*proto);

    factory->SetRegExpIrregexpData(Handle<JSRegExp>::cast(proto),

                                   JSRegExp::IRREGEXP, factory->empty_string(),

                                   JSRegExp::Flags(0), 0);

  }

  {  // -- J S O N

    Handle<String> name = factory->InternalizeUtf8String("JSON");

    Handle<JSFunction> cons = factory->NewFunction(name,

                                                   factory->the_hole_value());

    JSFunction::SetInstancePrototype(cons,

        Handle<Object>(native_context()->initial_object_prototype(), isolate));

    cons->SetInstanceClassName(*name);

    Handle<JSObject> json_object = factory->NewJSObject(cons, TENURED);

    ASSERT(json_object->IsJSObject());

    CHECK_NOT_EMPTY_HANDLE(isolate,

                           JSObject::SetLocalPropertyIgnoreAttributes(

                                 global, name, json_object, DONT_ENUM));

    native_context()->set_json_object(*json_object);

  }

  { // -- A r r a y B u f f e r

    Handle<JSFunction> array_buffer_fun =

        InstallFunction(

            global, "ArrayBuffer", JS_ARRAY_BUFFER_TYPE,

            JSArrayBuffer::kSizeWithInternalFields,

            isolate->initial_object_prototype(),

            Builtins::kIllegal, true, true);

    native_context()->set_array_buffer_fun(*array_buffer_fun);

  }

  { // -- T y p e d A r r a y s

    Handle<JSFunction> int8_fun = InstallTypedArray("Int8Array",

        EXTERNAL_BYTE_ELEMENTS);

    native_context()->set_int8_array_fun(*int8_fun);

    Handle<JSFunction> uint8_fun = InstallTypedArray("Uint8Array",

        EXTERNAL_UNSIGNED_BYTE_ELEMENTS);

    native_context()->set_uint8_array_fun(*uint8_fun);

    Handle<JSFunction> int16_fun = InstallTypedArray("Int16Array",

        EXTERNAL_SHORT_ELEMENTS);

    native_context()->set_int16_array_fun(*int16_fun);

    Handle<JSFunction> uint16_fun = InstallTypedArray("Uint16Array",

        EXTERNAL_UNSIGNED_SHORT_ELEMENTS);

    native_context()->set_uint16_array_fun(*uint16_fun);

    Handle<JSFunction> int32_fun = InstallTypedArray("Int32Array",

        EXTERNAL_INT_ELEMENTS);

    native_context()->set_int32_array_fun(*int32_fun);

    Handle<JSFunction> uint32_fun = InstallTypedArray("Uint32Array",

        EXTERNAL_UNSIGNED_INT_ELEMENTS);

    native_context()->set_uint32_array_fun(*uint32_fun);

    Handle<JSFunction> float_fun = InstallTypedArray("Float32Array",

        EXTERNAL_FLOAT_ELEMENTS);

    native_context()->set_float_array_fun(*float_fun);

    Handle<JSFunction> double_fun = InstallTypedArray("Float64Array",

        EXTERNAL_DOUBLE_ELEMENTS);

    native_context()->set_double_array_fun(*double_fun);

    Handle<JSFunction> uint8c_fun = InstallTypedArray("Uint8ClampedArray",

        EXTERNAL_PIXEL_ELEMENTS);

    native_context()->set_uint8c_array_fun(*uint8c_fun);

    Handle<JSFunction> data_view_fun =

        InstallFunction(

            global, "DataView", JS_DATA_VIEW_TYPE,

            JSDataView::kSizeWithInternalFields,

            isolate->initial_object_prototype(),

            Builtins::kIllegal, true, true);

    native_context()->set_data_view_fun(*data_view_fun);

  }

  {  // --- arguments_boilerplate_

    // Make sure we can recognize argument objects at runtime.

    // This is done by introducing an anonymous function with

    // class_name equals 'Arguments'.

    Handle<String> arguments_string = factory->InternalizeOneByteString(

        STATIC_ASCII_VECTOR("Arguments"));

    Handle<Code> code = Handle<Code>(

        isolate->builtins()->builtin(Builtins::kIllegal));

    Handle<JSObject> prototype =

        Handle<JSObject>(

            JSObject::cast(native_context()->object_function()->prototype()));

    Handle<JSFunction> function =

        factory->NewFunctionWithPrototype(arguments_string,

                                          JS_OBJECT_TYPE,

                                          JSObject::kHeaderSize,

                                          prototype,

                                          code,

                                          false);

    ASSERT(!function->has_initial_map());

    function->shared()->set_instance_class_name(*arguments_string);

    function->shared()->set_expected_nof_properties(2);

    Handle<JSObject> result = factory->NewJSObject(function);

    native_context()->set_arguments_boilerplate(*result);

    // Note: length must be added as the first property and

    //       callee must be added as the second property.

    CHECK_NOT_EMPTY_HANDLE(isolate,

                           JSObject::SetLocalPropertyIgnoreAttributes(

                               result, factory->length_string(),

                               factory->undefined_value(), DONT_ENUM,

                               Object::FORCE_TAGGED, FORCE_FIELD));

    CHECK_NOT_EMPTY_HANDLE(isolate,

                           JSObject::SetLocalPropertyIgnoreAttributes(

                               result, factory->callee_string(),

                               factory->undefined_value(), DONT_ENUM,

                               Object::FORCE_TAGGED, FORCE_FIELD));

#ifdef DEBUG

    LookupResult lookup(isolate);

    result->LocalLookup(heap->callee_string(), &lookup);

    ASSERT(lookup.IsField());

    ASSERT(lookup.GetFieldIndex().field_index() == Heap::kArgumentsCalleeIndex);

    result->LocalLookup(heap->length_string(), &lookup);

    ASSERT(lookup.IsField());

    ASSERT(lookup.GetFieldIndex().field_index() == Heap::kArgumentsLengthIndex);

    ASSERT(result->map()->inobject_properties() > Heap::kArgumentsCalleeIndex);

    ASSERT(result->map()->inobject_properties() > Heap::kArgumentsLengthIndex);

    // Check the state of the object.

    ASSERT(result->HasFastProperties());

    ASSERT(result->HasFastObjectElements());

#endif

  }

  {  // --- aliased_arguments_boilerplate_

    // Set up a well-formed parameter map to make assertions happy.

    Handle<FixedArray> elements = factory->NewFixedArray(2);

    elements->set_map(heap->non_strict_arguments_elements_map());

    Handle<FixedArray> array;

    array = factory->NewFixedArray(0);

    elements->set(0, *array);

    array = factory->NewFixedArray(0);

    elements->set(1, *array);

    Handle<Map> old_map(native_context()->arguments_boilerplate()->map());

    Handle<Map> new_map = factory->CopyMap(old_map);

    new_map->set_pre_allocated_property_fields(2);

    Handle<JSObject> result = factory->NewJSObjectFromMap(new_map);

    // Set elements kind after allocating the object because

    // NewJSObjectFromMap assumes a fast elements map.

    new_map->set_elements_kind(NON_STRICT_ARGUMENTS_ELEMENTS);

    result->set_elements(*elements);

    ASSERT(result->HasNonStrictArgumentsElements());

    native_context()->set_aliased_arguments_boilerplate(*result);

  }

  {  // --- strict mode arguments boilerplate

    const PropertyAttributes attributes =

      static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);

    // Create the ThrowTypeError functions.

    Handle<AccessorPair> callee = factory->NewAccessorPair();

    Handle<AccessorPair> caller = factory->NewAccessorPair();

    Handle<JSFunction> throw_function =

        GetThrowTypeErrorFunction();

    // Install the ThrowTypeError functions.

    callee->set_getter(*throw_function);

    callee->set_setter(*throw_function);

    caller->set_getter(*throw_function);

    caller->set_setter(*throw_function);

    // Create the map. Allocate one in-object field for length.

    Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE,

                                      Heap::kArgumentsObjectSizeStrict);

    // Create the descriptor array for the arguments object.

    Handle<DescriptorArray> descriptors = factory->NewDescriptorArray(0, 3);

    DescriptorArray::WhitenessWitness witness(*descriptors);

    map->set_instance_descriptors(*descriptors);

    {  // length

      FieldDescriptor d(

          *factory->length_string(), 0, DONT_ENUM, Representation::Tagged());

      map->AppendDescriptor(&d, witness);

    }

    {  // callee

      CallbacksDescriptor d(*factory->callee_string(),

                            *callee,

                            attributes);

      map->AppendDescriptor(&d, witness);

    }

    {  // caller

      CallbacksDescriptor d(*factory->caller_string(),

                            *caller,

                            attributes);

      map->AppendDescriptor(&d, witness);

    }

    map->set_function_with_prototype(true);

    map->set_prototype(native_context()->object_function()->prototype());

    map->set_pre_allocated_property_fields(1);

    map->set_inobject_properties(1);

    // Copy constructor from the non-strict arguments boilerplate.

    map->set_constructor(

      native_context()->arguments_boilerplate()->map()->constructor());

    // Allocate the arguments boilerplate object.

    Handle<JSObject> result = factory->NewJSObjectFromMap(map);

    native_context()->set_strict_mode_arguments_boilerplate(*result);

    // Add length property only for strict mode boilerplate.

    CHECK_NOT_EMPTY_HANDLE(isolate,

                           JSObject::SetLocalPropertyIgnoreAttributes(

                               result, factory->length_string(),

                               factory->undefined_value(), DONT_ENUM));

#ifdef DEBUG

    LookupResult lookup(isolate);

    result->LocalLookup(heap->length_string(), &lookup);

    ASSERT(lookup.IsField());

    ASSERT(lookup.GetFieldIndex().field_index() == Heap::kArgumentsLengthIndex);

    ASSERT(result->map()->inobject_properties() > Heap::kArgumentsLengthIndex);

    // Check the state of the object.

    ASSERT(result->HasFastProperties());

    ASSERT(result->HasFastObjectElements());

#endif

  }

  {  // --- context extension

    // Create a function for the context extension objects.

    Handle<Code> code = Handle<Code>(

        isolate->builtins()->builtin(Builtins::kIllegal));

    Handle<JSFunction> context_extension_fun =

        factory->NewFunction(factory->empty_string(),

                             JS_CONTEXT_EXTENSION_OBJECT_TYPE,

                             JSObject::kHeaderSize,

                             code,

                             true);

    Handle<String> name = factory->InternalizeOneByteString(

        STATIC_ASCII_VECTOR("context_extension"));

    context_extension_fun->shared()->set_instance_class_name(*name);

    native_context()->set_context_extension_function(*context_extension_fun);

  }

  {

    // Set up the call-as-function delegate.

    Handle<Code> code =

        Handle<Code>(isolate->builtins()->builtin(

            Builtins::kHandleApiCallAsFunction));

    Handle<JSFunction> delegate =

        factory->NewFunction(factory->empty_string(), JS_OBJECT_TYPE,

                             JSObject::kHeaderSize, code, true);

    native_context()->set_call_as_function_delegate(*delegate);

    delegate->shared()->DontAdaptArguments();

  }

  {

    // Set up the call-as-constructor delegate.

    Handle<Code> code =

        Handle<Code>(isolate->builtins()->builtin(

            Builtins::kHandleApiCallAsConstructor));

    Handle<JSFunction> delegate =

        factory->NewFunction(factory->empty_string(), JS_OBJECT_TYPE,

                             JSObject::kHeaderSize, code, true);

    native_context()->set_call_as_constructor_delegate(*delegate);

    delegate->shared()->DontAdaptArguments();

  }

  // Initialize the out of memory slot.

  native_context()->set_out_of_memory(heap->false_value());

  // Initialize the embedder data slot.

  Handle<FixedArray> embedder_data = factory->NewFixedArray(2);

  native_context()->set_embedder_data(*embedder_data);

  // Allocate the random seed slot.

  Handle<ByteArray> random_seed = factory->NewByteArray(kRandomStateSize);

  native_context()->set_random_seed(*random_seed);

}

Handle<JSFunction> Genesis::InstallTypedArray(

    const char* name, ElementsKind elementsKind) {

  Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());

  Handle<JSFunction> result = InstallFunction(global, name, JS_TYPED_ARRAY_TYPE,

      JSTypedArray::kSize, isolate()->initial_object_prototype(),

      Builtins::kIllegal, false, true);

  Handle<Map> initial_map = isolate()->factory()->NewMap(

      JS_TYPED_ARRAY_TYPE, JSTypedArray::kSizeWithInternalFields, elementsKind);

  result->set_initial_map(*initial_map);

  initial_map->set_constructor(*result);

  return result;

}

void Genesis::InitializeExperimentalGlobal() {

  Handle<JSObject> global = Handle<JSObject>(native_context()->global_object());

  // TODO(mstarzinger): Move this into Genesis::InitializeGlobal once we no

  // longer need to live behind flags, so functions get added to the snapshot.

  if (FLAG_harmony_symbols) {

    // --- S y m b o l ---

    Handle<JSFunction> symbol_fun =

        InstallFunction(global, "Symbol", JS_VALUE_TYPE, JSValue::kSize,

                        isolate()->initial_object_prototype(),

                        Builtins::kIllegal, true, true);

    native_context()->set_symbol_function(*symbol_fun);

  }

  if (FLAG_harmony_collections) {

    {  // -- S e t

      InstallFunction(global, "Set", JS_SET_TYPE, JSSet::kSize,

                      isolate()->initial_object_prototype(),

                      Builtins::kIllegal, true, true);

    }

    {  // -- M a p

      InstallFunction(global, "Map", JS_MAP_TYPE, JSMap::kSize,

                      isolate()->initial_object_prototype(),

                      Builtins::kIllegal, true, true);

    }

    {  // -- W e a k M a p

      InstallFunction(global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize,

                      isolate()->initial_object_prototype(),

                      Builtins::kIllegal, true, true);

    }

    {  // -- W e a k S e t

      InstallFunction(global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize,

                      isolate()->initial_object_prototype(),

                      Builtins::kIllegal, true, true);

    }

  }

  if (FLAG_harmony_generators) {

    // Create generator meta-objects and install them on the builtins object.

    Handle<JSObject> builtins(native_context()->builtins());

    Handle<JSObject> generator_object_prototype =

        factory()->NewJSObject(isolate()->object_function(), TENURED);

    Handle<JSFunction> generator_function_prototype =

        InstallFunction(builtins, "GeneratorFunctionPrototype",

                        JS_FUNCTION_TYPE, JSFunction::kHeaderSize,

                        generator_object_prototype, Builtins::kIllegal,

                        false, false);

    InstallFunction(builtins, "GeneratorFunction",

                    JS_FUNCTION_TYPE, JSFunction::kSize,

                    generator_function_prototype, Builtins::kIllegal,

                    false, false);

    // Create maps for generator functions and their prototypes.  Store those

    // maps in the native context.

    Handle<Map> function_map(native_context()->function_map());

    Handle<Map> generator_function_map = factory()->CopyMap(function_map);

    generator_function_map->set_prototype(*generator_function_prototype);

    native_context()->set_generator_function_map(*generator_function_map);

    Handle<Map> strict_mode_function_map(

        native_context()->strict_mode_function_map());

    Handle<Map> strict_mode_generator_function_map = factory()->CopyMap(

        strict_mode_function_map);

    strict_mode_generator_function_map->set_prototype(

        *generator_function_prototype);

    native_context()->set_strict_mode_generator_function_map(

        *strict_mode_generator_function_map);

    Handle<Map> object_map(native_context()->object_function()->initial_map());

    Handle<Map> generator_object_prototype_map = factory()->CopyMap(

        object_map, 0);

    generator_object_prototype_map->set_prototype(

        *generator_object_prototype);

    native_context()->set_generator_object_prototype_map(

        *generator_object_prototype_map);

    // Create a map for generator result objects.

    ASSERT(object_map->inobject_properties() == 0);

    STATIC_ASSERT(JSGeneratorObject::kResultPropertyCount == 2);

    Handle<Map> generator_result_map = factory()->CopyMap(object_map,

        JSGeneratorObject::kResultPropertyCount);

    ASSERT(generator_result_map->inobject_properties() ==

        JSGeneratorObject::kResultPropertyCount);

    Handle<DescriptorArray> descriptors = factory()->NewDescriptorArray(0,

        JSGeneratorObject::kResultPropertyCount);

    DescriptorArray::WhitenessWitness witness(*descriptors);

    generator_result_map->set_instance_descriptors(*descriptors);

    Handle<String> value_string = factory()->InternalizeOneByteString(

        STATIC_ASCII_VECTOR("value"));

    FieldDescriptor value_descr(*value_string,

                                JSGeneratorObject::kResultValuePropertyIndex,

                                NONE,

                                Representation::Tagged());

    generator_result_map->AppendDescriptor(&value_descr, witness);

    Handle<String> done_string = factory()->InternalizeOneByteString(

        STATIC_ASCII_VECTOR("done"));

    FieldDescriptor done_descr(*done_string,

                               JSGeneratorObject::kResultDonePropertyIndex,

                               NONE,

                               Representation::Tagged());

    generator_result_map->AppendDescriptor(&done_descr, witness);

    generator_result_map->set_unused_property_fields(0);

    ASSERT_EQ(JSGeneratorObject::kResultSize,

              generator_result_map->instance_size());

    native_context()->set_generator_result_map(*generator_result_map);

  }

}