webkitgtk-2.4.11webkitgtk-2.4.11

1 files changed, 108 insertions, 254 deletions

diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 37638fd78..b0cad3dc5 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- *  Copyright (C) 2007, 2008, 2009, 2014, 2015 Apple Inc. All rights reserved.
+ *  Copyright (C) 2007, 2008, 2009, 2014 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -23,39 +23,33 @@
 #define JSGlobalObject_h
 
 #include "ArrayAllocationProfile.h"
-#include "InternalFunction.h"
+#include "ConstantMode.h"
 #include "JSArray.h"
 #include "JSArrayBufferPrototype.h"
 #include "JSClassRef.h"
-#include "JSGlobalLexicalEnvironment.h"
-#include "JSProxy.h"
 #include "JSSegmentedVariableObject.h"
 #include "JSWeakObjectMapRefInternal.h"
 #include "NumberPrototype.h"
-#include "RuntimeFlags.h"
 #include "SpecialPointer.h"
 #include "StringPrototype.h"
-#include "SymbolPrototype.h"
-#include "TemplateRegistry.h"
+#include "StructureChain.h"
+#include "StructureRareDataInlines.h"
 #include "VM.h"
 #include "Watchpoint.h"
 #include <JavaScriptCore/JSBase.h>
 #include <array>
 #include <wtf/HashSet.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/RandomNumber.h>
 
 struct OpaqueJSClass;
 struct OpaqueJSClassContextData;
 
-namespace Inspector {
-class JSGlobalObjectInspectorController;
-}
-
 namespace JSC {
 
 class ArrayPrototype;
 class BooleanPrototype;
-class ConsoleClient;
 class Debugger;
 class ErrorConstructor;
 class ErrorPrototype;
@@ -64,74 +58,47 @@ class EvalExecutable;
 class FunctionCodeBlock;
 class FunctionExecutable;
 class FunctionPrototype;
-class GeneratorPrototype;
-class GeneratorFunctionPrototype;
 class GetterSetter;
 class GlobalCodeBlock;
-class InputCursor;
 class JSGlobalObjectDebuggable;
-class JSInternalPromise;
-class JSPromise;
 class JSPromiseConstructor;
 class JSPromisePrototype;
 class JSStack;
 class LLIntOffsetsExtractor;
 class Microtask;
-class ModuleLoaderObject;
-class ModuleProgramExecutable;
 class NativeErrorConstructor;
-class NullGetterFunction;
-class NullSetterFunction;
-class ObjectConstructor;
 class ProgramCodeBlock;
 class ProgramExecutable;
 class RegExpConstructor;
 class RegExpPrototype;
 class SourceCode;
-class UnlinkedModuleProgramCodeBlock;
-class VariableEnvironment;
-enum class ThisTDZMode;
 struct ActivationStackNode;
 struct HashTable;
 
 #define DEFINE_STANDARD_BUILTIN(macro, upperName, lowerName) macro(upperName, lowerName, lowerName, JS ## upperName, upperName)
-
-#define FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR(macro) \
+    
+#define FOR_EACH_SIMPLE_BUILTIN_TYPE(macro) \
     macro(Set, set, set, JSSet, Set) \
     macro(Map, map, map, JSMap, Map) \
     macro(Date, date, date, DateInstance, Date) \
     macro(String, string, stringObject, StringObject, String) \
-    macro(Symbol, symbol, symbolObject, SymbolObject, Symbol) \
     macro(Boolean, boolean, booleanObject, BooleanObject, Boolean) \
     macro(Number, number, numberObject, NumberObject, Number) \
     macro(Error, error, error, ErrorInstance, Error) \
-    macro(JSPromise, promise, promise, JSPromise, Promise) \
     macro(JSArrayBuffer, arrayBuffer, arrayBuffer, JSArrayBuffer, ArrayBuffer) \
     DEFINE_STANDARD_BUILTIN(macro, WeakMap, weakMap) \
-    DEFINE_STANDARD_BUILTIN(macro, WeakSet, weakSet) \
-
-#define FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(macro) \
     DEFINE_STANDARD_BUILTIN(macro, ArrayIterator, arrayIterator) \
+    DEFINE_STANDARD_BUILTIN(macro, ArgumentsIterator, argumentsIterator) \
     DEFINE_STANDARD_BUILTIN(macro, MapIterator, mapIterator) \
     DEFINE_STANDARD_BUILTIN(macro, SetIterator, setIterator) \
-    DEFINE_STANDARD_BUILTIN(macro, StringIterator, stringIterator) \
-
-#define FOR_EACH_BUILTIN_ITERATOR_TYPE(macro) \
-    DEFINE_STANDARD_BUILTIN(macro, Iterator, iterator) \
-    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(macro) \
 
-#define FOR_EACH_SIMPLE_BUILTIN_TYPE(macro) \
-    FOR_EACH_SIMPLE_BUILTIN_TYPE_WITH_CONSTRUCTOR(macro) \
-    macro(JSInternalPromise, internalPromise, internalPromise, JSInternalPromise, InternalPromise) \
 
 #define DECLARE_SIMPLE_BUILTIN_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
     class JS ## capitalName; \
     class capitalName ## Prototype; \
     class capitalName ## Constructor;
 
-class IteratorPrototype;
 FOR_EACH_SIMPLE_BUILTIN_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
-FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DECLARE_SIMPLE_BUILTIN_TYPE)
 
 #undef DECLARE_SIMPLE_BUILTIN_TYPE
 
@@ -141,8 +108,8 @@ struct GlobalObjectMethodTable {
     typedef bool (*AllowsAccessFromFunctionPtr)(const JSGlobalObject*, ExecState*);
     AllowsAccessFromFunctionPtr allowsAccessFrom;
 
-    typedef bool (*SupportsLegacyProfilingFunctionPtr)(const JSGlobalObject*);
-    SupportsLegacyProfilingFunctionPtr supportsLegacyProfiling;
+    typedef bool (*SupportsProfilingFunctionPtr)(const JSGlobalObject*); 
+    SupportsProfilingFunctionPtr supportsProfiling;
 
     typedef bool (*SupportsRichSourceInfoFunctionPtr)(const JSGlobalObject*);
     SupportsRichSourceInfoFunctionPtr supportsRichSourceInfo;
@@ -150,29 +117,14 @@ struct GlobalObjectMethodTable {
     typedef bool (*ShouldInterruptScriptFunctionPtr)(const JSGlobalObject*);
     ShouldInterruptScriptFunctionPtr shouldInterruptScript;
 
-    typedef RuntimeFlags (*JavaScriptRuntimeFlagsFunctionPtr)(const JSGlobalObject*);
-    JavaScriptRuntimeFlagsFunctionPtr javaScriptRuntimeFlags;
+    typedef bool (*JavaScriptExperimentsEnabledFunctionPtr)(const JSGlobalObject*);
+    JavaScriptExperimentsEnabledFunctionPtr javaScriptExperimentsEnabled;
 
     typedef void (*QueueTaskToEventLoopFunctionPtr)(const JSGlobalObject*, PassRefPtr<Microtask>);
     QueueTaskToEventLoopFunctionPtr queueTaskToEventLoop;
 
     typedef bool (*ShouldInterruptScriptBeforeTimeoutPtr)(const JSGlobalObject*);
     ShouldInterruptScriptBeforeTimeoutPtr shouldInterruptScriptBeforeTimeout;
-
-    typedef JSInternalPromise* (*ModuleLoaderResolvePtr)(JSGlobalObject*, ExecState*, JSValue, JSValue);
-    ModuleLoaderResolvePtr moduleLoaderResolve;
-
-    typedef JSInternalPromise* (*ModuleLoaderFetchPtr)(JSGlobalObject*, ExecState*, JSValue);
-    ModuleLoaderFetchPtr moduleLoaderFetch;
-
-    typedef JSInternalPromise* (*ModuleLoaderTranslatePtr)(JSGlobalObject*, ExecState*, JSValue, JSValue);
-    ModuleLoaderTranslatePtr moduleLoaderTranslate;
-
-    typedef JSInternalPromise* (*ModuleLoaderInstantiatePtr)(JSGlobalObject*, ExecState*, JSValue, JSValue);
-    ModuleLoaderInstantiatePtr moduleLoaderInstantiate;
-
-    typedef JSValue (*ModuleLoaderEvaluatePtr)(JSGlobalObject*, ExecState*, JSValue, JSValue);
-    ModuleLoaderEvaluatePtr moduleLoaderEvaluate;
 };
 
 class JSGlobalObject : public JSSegmentedVariableObject {
@@ -181,8 +133,6 @@ private:
     typedef HashMap<OpaqueJSClass*, std::unique_ptr<OpaqueJSClassContextData>> OpaqueJSClassDataMap;
 
     struct JSGlobalObjectRareData {
-        WTF_MAKE_FAST_ALLOCATED;
-    public:
         JSGlobalObjectRareData()
             : profileGroup(0)
         {
@@ -199,8 +149,6 @@ protected:
 
     WriteBarrier<JSObject> m_globalThis;
 
-    WriteBarrier<JSGlobalLexicalEnvironment> m_globalLexicalEnvironment;
-    WriteBarrier<JSObject> m_globalCallee;
     WriteBarrier<RegExpConstructor> m_regExpConstructor;
     WriteBarrier<ErrorConstructor> m_errorConstructor;
     WriteBarrier<NativeErrorConstructor> m_evalErrorConstructor;
@@ -209,87 +157,58 @@ protected:
     WriteBarrier<NativeErrorConstructor> m_syntaxErrorConstructor;
     WriteBarrier<NativeErrorConstructor> m_typeErrorConstructor;
     WriteBarrier<NativeErrorConstructor> m_URIErrorConstructor;
-    WriteBarrier<ObjectConstructor> m_objectConstructor;
     WriteBarrier<JSPromiseConstructor> m_promiseConstructor;
-    WriteBarrier<JSInternalPromiseConstructor> m_internalPromiseConstructor;
-
-    WriteBarrier<NullGetterFunction> m_nullGetterFunction;
-    WriteBarrier<NullSetterFunction> m_nullSetterFunction;
-
-    WriteBarrier<JSFunction> m_parseIntFunction;
 
     WriteBarrier<JSFunction> m_evalFunction;
     WriteBarrier<JSFunction> m_callFunction;
     WriteBarrier<JSFunction> m_applyFunction;
-    WriteBarrier<JSFunction> m_definePropertyFunction;
-    WriteBarrier<JSFunction> m_arrayProtoValuesFunction;
-    WriteBarrier<JSFunction> m_initializePromiseFunction;
-    WriteBarrier<JSFunction> m_newPromiseCapabilityFunction;
-    WriteBarrier<JSFunction> m_functionProtoHasInstanceSymbolFunction;
     WriteBarrier<GetterSetter> m_throwTypeErrorGetterSetter;
 
-    WriteBarrier<ModuleLoaderObject> m_moduleLoader;
-
     WriteBarrier<ObjectPrototype> m_objectPrototype;
     WriteBarrier<FunctionPrototype> m_functionPrototype;
     WriteBarrier<ArrayPrototype> m_arrayPrototype;
     WriteBarrier<RegExpPrototype> m_regExpPrototype;
-    WriteBarrier<IteratorPrototype> m_iteratorPrototype;
-    WriteBarrier<GeneratorFunctionPrototype> m_generatorFunctionPrototype;
-    WriteBarrier<GeneratorPrototype> m_generatorPrototype;
+    WriteBarrier<JSPromisePrototype> m_promisePrototype;
 
-    WriteBarrier<Structure> m_debuggerScopeStructure;
     WriteBarrier<Structure> m_withScopeStructure;
     WriteBarrier<Structure> m_strictEvalActivationStructure;
-    WriteBarrier<Structure> m_lexicalEnvironmentStructure;
-    WriteBarrier<Structure> m_moduleEnvironmentStructure;
-    WriteBarrier<Structure> m_directArgumentsStructure;
-    WriteBarrier<Structure> m_scopedArgumentsStructure;
-    WriteBarrier<Structure> m_outOfBandArgumentsStructure;
+    WriteBarrier<Structure> m_activationStructure;
+    WriteBarrier<Structure> m_nameScopeStructure;
+    WriteBarrier<Structure> m_argumentsStructure;
         
     // Lists the actual structures used for having these particular indexing shapes.
     WriteBarrier<Structure> m_originalArrayStructureForIndexingShape[NumberOfIndexingShapes];
     // Lists the structures we should use during allocation for these particular indexing shapes.
-    // These structures will differ from the originals list above when we are having a bad time.
     WriteBarrier<Structure> m_arrayStructureForIndexingShapeDuringAllocation[NumberOfIndexingShapes];
 
     WriteBarrier<Structure> m_callbackConstructorStructure;
     WriteBarrier<Structure> m_callbackFunctionStructure;
     WriteBarrier<Structure> m_callbackObjectStructure;
-    WriteBarrier<Structure> m_propertyNameIteratorStructure;
 #if JSC_OBJC_API_ENABLED
     WriteBarrier<Structure> m_objcCallbackFunctionStructure;
     WriteBarrier<Structure> m_objcWrapperObjectStructure;
 #endif
     WriteBarrier<Structure> m_nullPrototypeObjectStructure;
-    WriteBarrier<Structure> m_calleeStructure;
     WriteBarrier<Structure> m_functionStructure;
     WriteBarrier<Structure> m_boundFunctionStructure;
-    WriteBarrier<Structure> m_boundSlotBaseFunctionStructure;
-    WriteBarrier<Structure> m_nativeStdFunctionStructure;
     WriteBarrier<Structure> m_namedFunctionStructure;
     PropertyOffset m_functionNameOffset;
     WriteBarrier<Structure> m_privateNameStructure;
+    WriteBarrier<Structure> m_regExpMatchesArrayStructure;
     WriteBarrier<Structure> m_regExpStructure;
-    WriteBarrier<Structure> m_generatorFunctionStructure;
-    WriteBarrier<Structure> m_consoleStructure;
-    WriteBarrier<Structure> m_dollarVMStructure;
     WriteBarrier<Structure> m_internalFunctionStructure;
-    WriteBarrier<Structure> m_iteratorResultObjectStructure;
-    WriteBarrier<Structure> m_regExpMatchesArrayStructure;
-    WriteBarrier<Structure> m_moduleRecordStructure;
-    WriteBarrier<Structure> m_moduleNamespaceObjectStructure;
-    WriteBarrier<Structure> m_proxyObjectStructure;
-#if ENABLE(WEBASSEMBLY)
-    WriteBarrier<Structure> m_wasmModuleStructure;
-#endif
+    
+    WriteBarrier<Structure> m_iteratorResultStructure;
+
+#if ENABLE(PROMISES)
+    WriteBarrier<Structure> m_promiseStructure;
+#endif // ENABLE(PROMISES)
 
 #define DEFINE_STORAGE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
     WriteBarrier<capitalName ## Prototype> m_ ## lowerName ## Prototype; \
     WriteBarrier<Structure> m_ ## properName ## Structure;
 
     FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
-    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_STORAGE_FOR_SIMPLE_TYPE)
 
 #undef DEFINE_STORAGE_FOR_SIMPLE_TYPE
 
@@ -299,45 +218,28 @@ protected:
     };
     
     std::array<TypedArrayData, NUMBER_OF_TYPED_ARRAY_TYPES> m_typedArrays;
-
-    JSCell* m_specialPointers[Special::TableSize]; // Special pointers used by the LLInt and JIT.
-    JSCell* m_linkTimeConstants[LinkTimeConstantCount];
+        
+    void* m_specialPointers[Special::TableSize]; // Special pointers used by the LLInt and JIT.
 
     String m_name;
 
     Debugger* m_debugger;
 
-    VM& m_vm;
-
-#if ENABLE(WEB_REPLAY)
-    RefPtr<InputCursor> m_inputCursor;
-#endif
-
 #if ENABLE(REMOTE_INSPECTOR)
-    std::unique_ptr<Inspector::JSGlobalObjectInspectorController> m_inspectorController;
     std::unique_ptr<JSGlobalObjectDebuggable> m_inspectorDebuggable;
 #endif
 
-#if ENABLE(INTL)
-    HashSet<String> m_intlCollatorAvailableLocales;
-    HashSet<String> m_intlDateTimeFormatAvailableLocales;
-    HashSet<String> m_intlNumberFormatAvailableLocales;
-#endif // ENABLE(INTL)
-
     RefPtr<WatchpointSet> m_masqueradesAsUndefinedWatchpoint;
     RefPtr<WatchpointSet> m_havingABadTimeWatchpoint;
     RefPtr<WatchpointSet> m_varInjectionWatchpoint;
 
-    std::unique_ptr<JSGlobalObjectRareData> m_rareData;
+    OwnPtr<JSGlobalObjectRareData> m_rareData;
 
     WeakRandom m_weakRandom;
 
-    TemplateRegistry m_templateRegistry;
-
     bool m_evalEnabled;
     String m_evalDisabledErrorMessage;
-    RuntimeFlags m_runtimeFlags;
-    ConsoleClient* m_consoleClient;
+    bool m_experimentsEnabled;
 
     static JS_EXPORTDATA const GlobalObjectMethodTable s_globalObjectMethodTable;
     const GlobalObjectMethodTable* m_globalObjectMethodTable;
@@ -346,12 +248,11 @@ protected:
     {
         if (m_rareData)
             return;
-        m_rareData = std::make_unique<JSGlobalObjectRareData>();
+        m_rareData = adoptPtr(new JSGlobalObjectRareData);
     }
         
 public:
     typedef JSSegmentedVariableObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot | OverridesGetPropertyNames;
 
     static JSGlobalObject* create(VM& vm, Structure* structure)
     {
@@ -364,8 +265,7 @@ public:
     DECLARE_EXPORT_INFO;
 
     bool hasDebugger() const { return m_debugger; }
-    bool hasLegacyProfiler() const;
-    const RuntimeFlags& runtimeFlags() const { return m_runtimeFlags; }
+    bool hasProfiler() const { return globalObjectMethodTable()->supportsProfiling(this); }
 
 protected:
     JS_EXPORT_PRIVATE explicit JSGlobalObject(VM&, Structure*, const GlobalObjectMethodTable* = 0);
@@ -374,21 +274,23 @@ protected:
     {
         Base::finishCreation(vm);
         structure()->setGlobalObject(vm, this);
-        m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
-        init(vm);
-        setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype(), PureForwardingProxyType), this));
+        m_experimentsEnabled = m_globalObjectMethodTable->javaScriptExperimentsEnabled(this);
+        init(this);
     }
 
     void finishCreation(VM& vm, JSObject* thisValue)
     {
         Base::finishCreation(vm);
         structure()->setGlobalObject(vm, this);
-        m_runtimeFlags = m_globalObjectMethodTable->javaScriptRuntimeFlags(this);
-        init(vm);
-        setGlobalThis(vm, thisValue);
+        m_experimentsEnabled = m_globalObjectMethodTable->javaScriptExperimentsEnabled(this);
+        init(thisValue);
     }
 
-    void addGlobalVar(const Identifier&);
+    struct NewGlobalVar {
+        int registerNumber;
+        VariableWatchpointSet* set;
+    };
+    NewGlobalVar addGlobalVar(const Identifier&, ConstantMode);
 
 public:
     JS_EXPORT_PRIVATE ~JSGlobalObject();
@@ -399,21 +301,28 @@ public:
     JS_EXPORT_PRIVATE static void visitChildren(JSCell*, SlotVisitor&);
 
     JS_EXPORT_PRIVATE static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
+    bool hasOwnPropertyForWrite(ExecState*, PropertyName);
     JS_EXPORT_PRIVATE static void put(JSCell*, ExecState*, PropertyName, JSValue, PutPropertySlot&);
 
     JS_EXPORT_PRIVATE static void defineGetter(JSObject*, ExecState*, PropertyName, JSObject* getterFunc, unsigned attributes);
     JS_EXPORT_PRIVATE static void defineSetter(JSObject*, ExecState*, PropertyName, JSObject* setterFunc, unsigned attributes);
     JS_EXPORT_PRIVATE static bool defineOwnProperty(JSObject*, ExecState*, PropertyName, const PropertyDescriptor&, bool shouldThrow);
 
+    // We use this in the code generator as we perform symbol table
+    // lookups prior to initializing the properties
+    bool symbolTableHasProperty(PropertyName);
+
     void addVar(ExecState* exec, const Identifier& propertyName)
     {
         if (!hasProperty(exec, propertyName))
-            addGlobalVar(propertyName);
+            addGlobalVar(propertyName, IsVariable);
     }
-    void addFunction(ExecState*, const Identifier&);
-
-    JSScope* globalScope() { return m_globalLexicalEnvironment.get(); }
-    JSGlobalLexicalEnvironment* globalLexicalEnvironment() { return m_globalLexicalEnvironment.get(); }
+    void addConst(ExecState* exec, const Identifier& propertyName)
+    {
+        if (!hasProperty(exec, propertyName))
+            addGlobalVar(propertyName, IsConstant);
+    }
+    void addFunction(ExecState*, const Identifier&, JSValue);
 
     // The following accessors return pristine values, even if a script 
     // replaces the global object's associated property.
@@ -421,29 +330,17 @@ public:
     RegExpConstructor* regExpConstructor() const { return m_regExpConstructor.get(); }
 
     ErrorConstructor* errorConstructor() const { return m_errorConstructor.get(); }
-    ObjectConstructor* objectConstructor() const { return m_objectConstructor.get(); }
-    JSPromiseConstructor* promiseConstructor() const { return m_promiseConstructor.get(); }
-    JSInternalPromiseConstructor* internalPromiseConstructor() const { return m_internalPromiseConstructor.get(); }
     NativeErrorConstructor* evalErrorConstructor() const { return m_evalErrorConstructor.get(); }
     NativeErrorConstructor* rangeErrorConstructor() const { return m_rangeErrorConstructor.get(); }
     NativeErrorConstructor* referenceErrorConstructor() const { return m_referenceErrorConstructor.get(); }
     NativeErrorConstructor* syntaxErrorConstructor() const { return m_syntaxErrorConstructor.get(); }
     NativeErrorConstructor* typeErrorConstructor() const { return m_typeErrorConstructor.get(); }
     NativeErrorConstructor* URIErrorConstructor() const { return m_URIErrorConstructor.get(); }
-
-    NullGetterFunction* nullGetterFunction() const { return m_nullGetterFunction.get(); }
-    NullSetterFunction* nullSetterFunction() const { return m_nullSetterFunction.get(); }
-
-    JSFunction* parseIntFunction() const { return m_parseIntFunction.get(); }
+    JSPromiseConstructor* promiseConstructor() const { return m_promiseConstructor.get(); }
 
     JSFunction* evalFunction() const { return m_evalFunction.get(); }
     JSFunction* callFunction() const { return m_callFunction.get(); }
     JSFunction* applyFunction() const { return m_applyFunction.get(); }
-    JSFunction* definePropertyFunction() const { return m_definePropertyFunction.get(); }
-    JSFunction* arrayProtoValuesFunction() const { return m_arrayProtoValuesFunction.get(); }
-    JSFunction* initializePromiseFunction() const { return m_initializePromiseFunction.get(); }
-    JSFunction* newPromiseCapabilityFunction() const { return m_newPromiseCapabilityFunction.get(); }
-    JSFunction* functionProtoHasInstanceSymbolFunction() const { return m_functionProtoHasInstanceSymbolFunction.get(); }
     GetterSetter* throwTypeErrorGetterSetter(VM& vm)
     {
         if (!m_throwTypeErrorGetterSetter)
@@ -451,30 +348,22 @@ public:
         return m_throwTypeErrorGetterSetter.get();
     }
 
-    ModuleLoaderObject* moduleLoader() const { return m_moduleLoader.get(); }
-
     ObjectPrototype* objectPrototype() const { return m_objectPrototype.get(); }
     FunctionPrototype* functionPrototype() const { return m_functionPrototype.get(); }
     ArrayPrototype* arrayPrototype() const { return m_arrayPrototype.get(); }
     BooleanPrototype* booleanPrototype() const { return m_booleanPrototype.get(); }
     StringPrototype* stringPrototype() const { return m_stringPrototype.get(); }
-    SymbolPrototype* symbolPrototype() const { return m_symbolPrototype.get(); }
     NumberPrototype* numberPrototype() const { return m_numberPrototype.get(); }
     DatePrototype* datePrototype() const { return m_datePrototype.get(); }
     RegExpPrototype* regExpPrototype() const { return m_regExpPrototype.get(); }
     ErrorPrototype* errorPrototype() const { return m_errorPrototype.get(); }
-    IteratorPrototype* iteratorPrototype() const { return m_iteratorPrototype.get(); }
-    GeneratorFunctionPrototype* generatorFunctionPrototype() const { return m_generatorFunctionPrototype.get(); }
-    GeneratorPrototype* generatorPrototype() const { return m_generatorPrototype.get(); }
+    JSPromisePrototype* promisePrototype() const { return m_promisePrototype.get(); }
 
-    Structure* debuggerScopeStructure() const { return m_debuggerScopeStructure.get(); }
     Structure* withScopeStructure() const { return m_withScopeStructure.get(); }
     Structure* strictEvalActivationStructure() const { return m_strictEvalActivationStructure.get(); }
-    Structure* activationStructure() const { return m_lexicalEnvironmentStructure.get(); }
-    Structure* moduleEnvironmentStructure() const { return m_moduleEnvironmentStructure.get(); }
-    Structure* directArgumentsStructure() const { return m_directArgumentsStructure.get(); }
-    Structure* scopedArgumentsStructure() const { return m_scopedArgumentsStructure.get(); }
-    Structure* outOfBandArgumentsStructure() const { return m_outOfBandArgumentsStructure.get(); }
+    Structure* activationStructure() const { return m_activationStructure.get(); }
+    Structure* nameScopeStructure() const { return m_nameScopeStructure.get(); }
+    Structure* argumentsStructure() const { return m_argumentsStructure.get(); }
     Structure* originalArrayStructureForIndexingType(IndexingType indexingType) const
     {
         ASSERT(indexingType & IsArray);
@@ -485,13 +374,9 @@ public:
         ASSERT(indexingType & IsArray);
         return m_arrayStructureForIndexingShapeDuringAllocation[(indexingType & IndexingShapeMask) >> IndexingShapeShift].get();
     }
-    Structure* arrayStructureForIndexingTypeDuringAllocation(ExecState* exec, IndexingType indexingType, JSValue newTarget) const
+    Structure* arrayStructureForProfileDuringAllocation(ArrayAllocationProfile* profile) const
     {
-        return InternalFunction::createSubclassStructure(exec, newTarget, arrayStructureForIndexingTypeDuringAllocation(indexingType));
-    }
-    Structure* arrayStructureForProfileDuringAllocation(ExecState* exec, ArrayAllocationProfile* profile, JSValue newTarget) const
-    {
-        return arrayStructureForIndexingTypeDuringAllocation(exec, ArrayAllocationProfile::selectIndexingTypeFor(profile), newTarget);
+        return arrayStructureForIndexingTypeDuringAllocation(ArrayAllocationProfile::selectIndexingTypeFor(profile));
     }
         
     bool isOriginalArrayStructure(Structure* structure)
@@ -503,7 +388,6 @@ public:
     Structure* callbackConstructorStructure() const { return m_callbackConstructorStructure.get(); }
     Structure* callbackFunctionStructure() const { return m_callbackFunctionStructure.get(); }
     Structure* callbackObjectStructure() const { return m_callbackObjectStructure.get(); }
-    Structure* propertyNameIteratorStructure() const { return m_propertyNameIteratorStructure.get(); }
 #if JSC_OBJC_API_ENABLED
     Structure* objcCallbackFunctionStructure() const { return m_objcCallbackFunctionStructure.get(); }
     Structure* objcWrapperObjectStructure() const { return m_objcWrapperObjectStructure.get(); }
@@ -511,53 +395,28 @@ public:
     Structure* dateStructure() const { return m_dateStructure.get(); }
     Structure* nullPrototypeObjectStructure() const { return m_nullPrototypeObjectStructure.get(); }
     Structure* errorStructure() const { return m_errorStructure.get(); }
-    Structure* calleeStructure() const { return m_calleeStructure.get(); }
     Structure* functionStructure() const { return m_functionStructure.get(); }
     Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(); }
-    Structure* boundSlotBaseFunctionStructure() const { return m_boundSlotBaseFunctionStructure.get(); }
-    Structure* nativeStdFunctionStructure() const { return m_nativeStdFunctionStructure.get(); }
     Structure* namedFunctionStructure() const { return m_namedFunctionStructure.get(); }
     PropertyOffset functionNameOffset() const { return m_functionNameOffset; }
     Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }
     Structure* privateNameStructure() const { return m_privateNameStructure.get(); }
     Structure* internalFunctionStructure() const { return m_internalFunctionStructure.get(); }
     Structure* mapStructure() const { return m_mapStructure.get(); }
+    Structure* regExpMatchesArrayStructure() const { return m_regExpMatchesArrayStructure.get(); }
     Structure* regExpStructure() const { return m_regExpStructure.get(); }
-    Structure* generatorFunctionStructure() const { return m_generatorFunctionStructure.get(); }
     Structure* setStructure() const { return m_setStructure.get(); }
     Structure* stringObjectStructure() const { return m_stringObjectStructure.get(); }
-    Structure* symbolObjectStructure() const { return m_symbolObjectStructure.get(); }
-    Structure* iteratorResultObjectStructure() const { return m_iteratorResultObjectStructure.get(); }
-    Structure* regExpMatchesArrayStructure() const { return m_regExpMatchesArrayStructure.get(); }
-    Structure* moduleRecordStructure() const { return m_moduleRecordStructure.get(); }
-    Structure* moduleNamespaceObjectStructure() const { return m_moduleNamespaceObjectStructure.get(); }
-    Structure* proxyObjectStructure() const { return m_proxyObjectStructure.get(); }
-#if ENABLE(WEBASSEMBLY)
-    Structure* wasmModuleStructure() const { return m_wasmModuleStructure.get(); }
-#endif
+    Structure* iteratorResultStructure() const { return m_iteratorResultStructure.get(); }
+    static ptrdiff_t iteratorResultStructureOffset() { return OBJECT_OFFSETOF(JSGlobalObject, m_iteratorResultStructure); }
+
+#if ENABLE(PROMISES)
+    Structure* promiseStructure() const { return m_promiseStructure.get(); }
+#endif // ENABLE(PROMISES)
 
     JS_EXPORT_PRIVATE void setRemoteDebuggingEnabled(bool);
     JS_EXPORT_PRIVATE bool remoteDebuggingEnabled() const;
 
-#if ENABLE(WEB_REPLAY)
-    JS_EXPORT_PRIVATE void setInputCursor(PassRefPtr<InputCursor>);
-    InputCursor& inputCursor() const { return *m_inputCursor; }
-#endif
-
-#if ENABLE(REMOTE_INSPECTOR)
-    Inspector::JSGlobalObjectInspectorController& inspectorController() const { return *m_inspectorController.get(); }
-    JSGlobalObjectDebuggable& inspectorDebuggable() { return *m_inspectorDebuggable.get(); }
-#endif
-
-#if ENABLE(INTL)
-    const HashSet<String>& intlCollatorAvailableLocales();
-    const HashSet<String>& intlDateTimeFormatAvailableLocales();
-    const HashSet<String>& intlNumberFormatAvailableLocales();
-#endif // ENABLE(INTL)
-
-    void setConsoleClient(ConsoleClient* consoleClient) { m_consoleClient = consoleClient; }
-    ConsoleClient* consoleClient() const { return m_consoleClient; }
-
     void setName(const String&);
     const String& name() const { return m_name; }
 
@@ -567,7 +426,6 @@ public:
     Structure* properName ## Structure() { return m_ ## properName ## Structure.get(); }
 
     FOR_EACH_SIMPLE_BUILTIN_TYPE(DEFINE_ACCESSORS_FOR_SIMPLE_TYPE)
-    FOR_EACH_BUILTIN_DERIVED_ITERATOR_TYPE(DEFINE_ACCESSORS_FOR_SIMPLE_TYPE)
 
 #undef DEFINE_ACCESSORS_FOR_SIMPLE_TYPE
 
@@ -583,17 +441,11 @@ public:
         return typedArrayStructure(type) == structure;
     }
 
-    JSCell* actualPointerFor(Special::Pointer pointer)
+    void* actualPointerFor(Special::Pointer pointer)
     {
         ASSERT(pointer < Special::TableSize);
         return m_specialPointers[pointer];
     }
-    JSCell* jsCellForLinkTimeConstant(LinkTimeConstant type)
-    {
-        unsigned index = static_cast<unsigned>(type);
-        ASSERT(index < LinkTimeConstantCount);
-        return m_linkTimeConstants[index];
-    }
 
     WatchpointSet* masqueradesAsUndefinedWatchpoint() { return m_masqueradesAsUndefinedWatchpoint.get(); }
     WatchpointSet* havingABadTimeWatchpoint() { return m_havingABadTimeWatchpoint.get(); }
@@ -624,14 +476,14 @@ public:
     const GlobalObjectMethodTable* globalObjectMethodTable() const { return m_globalObjectMethodTable; }
 
     static bool allowsAccessFrom(const JSGlobalObject*, ExecState*) { return true; }
-    static bool supportsLegacyProfiling(const JSGlobalObject*) { return false; }
+    static bool supportsProfiling(const JSGlobalObject*) { return false; }
     static bool supportsRichSourceInfo(const JSGlobalObject*) { return true; }
 
     JS_EXPORT_PRIVATE ExecState* globalExec();
 
     static bool shouldInterruptScript(const JSGlobalObject*) { return true; }
     static bool shouldInterruptScriptBeforeTimeout(const JSGlobalObject*) { return false; }
-    static RuntimeFlags javaScriptRuntimeFlags(const JSGlobalObject*) { return RuntimeFlags(); }
+    static bool javaScriptExperimentsEnabled(const JSGlobalObject*) { return false; }
 
     void queueMicrotask(PassRefPtr<Microtask>);
 
@@ -645,14 +497,13 @@ public:
 
     void resetPrototype(VM&, JSValue prototype);
 
-    VM& vm() const { return m_vm; }
+    VM& vm() const { return *Heap::heap(this)->vm(); }
     JSObject* globalThis() const;
+    JS_EXPORT_PRIVATE void setGlobalThis(VM&, JSObject* globalThis);
 
     static Structure* createStructure(VM& vm, JSValue prototype)
     {
-        Structure* result = Structure::create(vm, 0, prototype, TypeInfo(GlobalObjectType, StructureFlags), info());
-        result->setTransitionWatchpointIsLikelyToBeFired(true);
-        return result;
+        return Structure::create(vm, 0, prototype, TypeInfo(GlobalObjectType, StructureFlags), info());
     }
 
     void registerWeakMap(OpaqueJSWeakObjectMap* map)
@@ -673,17 +524,16 @@ public:
         return m_rareData->opaqueJSClassData;
     }
 
-    TemplateRegistry& templateRegistry() { return m_templateRegistry; }
-
-    static ptrdiff_t weakRandomOffset() { return OBJECT_OFFSETOF(JSGlobalObject, m_weakRandom); }
     double weakRandomNumber() { return m_weakRandom.get(); }
     unsigned weakRandomInteger() { return m_weakRandom.getUint32(); }
 
     UnlinkedProgramCodeBlock* createProgramCodeBlock(CallFrame*, ProgramExecutable*, JSObject** exception);
-    UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*, ThisTDZMode, bool isArrowFunctionContext, const VariableEnvironment*);
-    UnlinkedModuleProgramCodeBlock* createModuleProgramCodeBlock(CallFrame*, ModuleProgramExecutable*);
+    UnlinkedEvalCodeBlock* createEvalCodeBlock(CallFrame*, EvalExecutable*);
 
 protected:
+
+    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | OverridesVisitChildren | OverridesGetPropertyNames | Base::StructureFlags;
+
     struct GlobalPropertyInfo {
         GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
             : identifier(i)
@@ -702,10 +552,10 @@ protected:
 
 private:
     friend class LLIntOffsetsExtractor;
-
-    JS_EXPORT_PRIVATE void setGlobalThis(VM&, JSObject* globalThis);
-
-    JS_EXPORT_PRIVATE void init(VM&);
+        
+    // FIXME: Fold reset into init.
+    JS_EXPORT_PRIVATE void init(JSObject* thisValue);
+    void reset(JSValue prototype);
 
     void createThrowTypeError(VM&);
 
@@ -720,55 +570,59 @@ inline JSGlobalObject* asGlobalObject(JSValue value)
     return jsCast<JSGlobalObject*>(asObject(value));
 }
 
-inline JSArray* constructEmptyArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, unsigned initialLength = 0, JSValue newTarget = JSValue())
+inline bool JSGlobalObject::hasOwnPropertyForWrite(ExecState* exec, PropertyName propertyName)
 {
-    Structure* structure;
-    if (initialLength >= MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH)
-        structure = globalObject->arrayStructureForIndexingTypeDuringAllocation(exec, ArrayWithArrayStorage, newTarget);
-    else
-        structure = globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget);
-
-    return ArrayAllocationProfile::updateLastAllocationFor(profile, JSArray::create(exec->vm(), structure, initialLength));
+    PropertySlot slot(this);
+    if (Base::getOwnPropertySlot(this, exec, propertyName, slot))
+        return true;
+    bool slotIsWriteable;
+    return symbolTableGet(this, propertyName, slot, slotIsWriteable);
 }
 
-inline JSArray* constructEmptyArray(ExecState* exec, ArrayAllocationProfile* profile, unsigned initialLength = 0, JSValue newTarget = JSValue())
+inline bool JSGlobalObject::symbolTableHasProperty(PropertyName propertyName)
 {
-    return constructEmptyArray(exec, profile, exec->lexicalGlobalObject(), initialLength, newTarget);
+    SymbolTableEntry entry = symbolTable()->inlineGet(propertyName.publicName());
+    return !entry.isNull();
 }
- 
-inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const ArgList& values, JSValue newTarget = JSValue())
+
+inline JSArray* constructEmptyArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, unsigned initialLength = 0)
 {
-    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget), values));
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, JSArray::create(exec->vm(), initialLength >= MIN_SPARSE_ARRAY_INDEX ? globalObject->arrayStructureForIndexingTypeDuringAllocation(ArrayWithArrayStorage) : globalObject->arrayStructureForProfileDuringAllocation(profile), initialLength));
 }
 
-inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, const ArgList& values, JSValue newTarget = JSValue())
+inline JSArray* constructEmptyArray(ExecState* exec, ArrayAllocationProfile* profile, unsigned initialLength = 0)
+{
+    return constructEmptyArray(exec, profile, exec->lexicalGlobalObject(), initialLength);
+}
+ 
+inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const ArgList& values)
 {
-    return constructArray(exec, profile, exec->lexicalGlobalObject(), values, newTarget);
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, globalObject->arrayStructureForProfileDuringAllocation(profile), values));
 }
 
-inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
+inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, const ArgList& values)
 {
-    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget), values, length));
+    return constructArray(exec, profile, exec->lexicalGlobalObject(), values);
 }
 
-inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
+inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length)
 {
-    return constructArray(exec, profile, exec->lexicalGlobalObject(), values, length, newTarget);
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArray(exec, globalObject->arrayStructureForProfileDuringAllocation(profile), values, length));
 }
 
-inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
+inline JSArray* constructArray(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, unsigned length)
 {
-    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArrayNegativeIndexed(exec, globalObject->arrayStructureForProfileDuringAllocation(exec, profile, newTarget), values, length));
+    return constructArray(exec, profile, exec->lexicalGlobalObject(), values, length);
 }
 
-inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, unsigned length, JSValue newTarget = JSValue())
+inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, const JSValue* values, unsigned length)
 {
-    return constructArrayNegativeIndexed(exec, profile, exec->lexicalGlobalObject(), values, length, newTarget);
+    return ArrayAllocationProfile::updateLastAllocationFor(profile, constructArrayNegativeIndexed(exec, globalObject->arrayStructureForProfileDuringAllocation(profile), values, length));
 }
 
-inline JSObject* ExecState::globalThisValue() const
+inline JSArray* constructArrayNegativeIndexed(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, unsigned length)
 {
-    return lexicalGlobalObject()->globalThis();
+    return constructArrayNegativeIndexed(exec, profile, exec->lexicalGlobalObject(), values, length);
 }
 
 inline JSObject* JSScope::globalThis()