1 files changed, 38 insertions, 3 deletions
diff --git a/Source/JavaScriptCore/runtime/InternalFunction.cpp b/Source/JavaScriptCore/runtime/InternalFunction.cpp
index 69120bea5..bb23d45ed 100644
--- a/Source/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/Source/JavaScriptCore/runtime/InternalFunction.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 1999-2002 Harri Porten (porten@kde.org)
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2004, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2007, 2008, 2016 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -26,13 +26,13 @@
 #include "FunctionPrototype.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
-#include "Operations.h"
+#include "JSCInlines.h"
 
 namespace JSC {
 
 STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(InternalFunction);
 
-const ClassInfo InternalFunction::s_info = { "Function", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(InternalFunction) };
+const ClassInfo InternalFunction::s_info = { "Function", &Base::s_info, 0, CREATE_METHOD_TABLE(InternalFunction) };
 
 InternalFunction::InternalFunction(VM& vm, Structure* structure)
     : JSDestructibleObject(vm, structure)
@@ -78,4 +78,39 @@ const String InternalFunction::calculatedDisplayName(ExecState* exec)
     return name(exec);
 }
 
+Structure* InternalFunction::createSubclassStructure(ExecState* exec, JSValue newTarget, Structure* baseClass)
+{
+
+    VM& vm = exec->vm();
+    // We allow newTarget == JSValue() because the API needs to be able to create classes without having a real JS frame.
+    // Since we don't allow subclassing in the API we just treat newTarget == JSValue() as newTarget == exec->callee()
+    ASSERT(!newTarget || newTarget.isFunction());
+
+    if (newTarget && newTarget != exec->callee()) {
+        // newTarget may be an InternalFunction if we were called from Reflect.construct.
+        JSFunction* targetFunction = jsDynamicCast<JSFunction*>(newTarget);
+
+        if (LIKELY(targetFunction)) {
+            Structure* structure = targetFunction->rareData(vm)->internalFunctionAllocationStructure();
+            if (LIKELY(structure && structure->classInfo() == baseClass->classInfo()))
+                return structure;
+
+            // Note, Reflect.construct might cause the profile to churn but we don't care.
+            JSObject* prototype = jsDynamicCast<JSObject*>(newTarget.get(exec, exec->propertyNames().prototype));
+            if (prototype)
+                return targetFunction->rareData(vm)->createInternalFunctionAllocationStructureFromBase(vm, prototype, baseClass);
+        } else {
+            JSObject* prototype = jsDynamicCast<JSObject*>(newTarget.get(exec, exec->propertyNames().prototype));
+            if (prototype) {
+                // This only happens if someone Reflect.constructs our builtin constructor with another builtin constructor as the new.target.
+                // Thus, we don't care about the cost of looking up the structure from our hash table every time.
+                return vm.prototypeMap.emptyStructureForPrototypeFromBaseStructure(prototype, baseClass);
+            }
+        }
+    }
+    
+    return baseClass;
+}
+
+
 } // namespace JSC