Fix Function subclassing.

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/api-natives.h"
 #include "src/code-stubs.h"
 #include "src/extensions/externalize-string-extension.h"
@@ skipping 1040 matching lines @@
       factory->NewScriptContextTable();
   native_context()->set_script_context_table(*script_context_table);
   InstallGlobalThisBinding();
 
   Handle<String> object_name = factory->Object_string();
   JSObject::AddProperty(
       global_object, object_name, isolate->object_function(), DONT_ENUM);
 
   Handle<JSObject> global(native_context()->global_object());
 
-  // Install global Function object
-  Handle<JSFunction> function_function =
-      InstallFunction(global, "Function", JS_FUNCTION_TYPE, JSFunction::kSize,
-                      empty_function, Builtins::kIllegal);
-  function_function->initial_map()->set_is_callable();
-  function_function->initial_map()->set_is_constructor(true);
-  function_function->shared()->set_construct_stub(
-      *isolate->builtins()->JSBuiltinsConstructStub());
+  {  // --- F u n c t i o n ---
+    Handle<JSFunction> function_function =
+        InstallFunction(global, "Function", JS_FUNCTION_TYPE, JSFunction::kSize,
+                        empty_function, Builtins::kIllegal);
+    function_function->set_prototype_or_initial_map(
+        *sloppy_function_map_writable_prototype_);
+    function_function->shared()->set_construct_stub(
+        *isolate->builtins()->JSBuiltinsConstructStub());
+
+    sloppy_function_map_writable_prototype_->set_constructor_or_backpointer(

[Toon Verwaest, 2015/12/09 21:40:03]

SetConstructor?

[Igor Sheludko, 2015/12/10 10:50:41]

Done.

+        *function_function);
+    strict_function_map_writable_prototype_->set_constructor_or_backpointer(
+        *function_function);
+    native_context()->strong_function_map()->set_constructor_or_backpointer(
+        *function_function);
+  }
 
   {  // --- A r r a y ---
     Handle<JSFunction> array_function =
         InstallFunction(global, "Array", JS_ARRAY_TYPE, JSArray::kSize,
                         isolate->initial_object_prototype(),
                         Builtins::kArrayCode);
     array_function->shared()->DontAdaptArguments();
     array_function->shared()->set_function_data(Smi::FromInt(kArrayCode));
 
     // This seems a bit hackish, but we need to make sure Array.length
@@ skipping 686 matching lines @@
 
     JSObject::AddProperty(
         container, factory->InternalizeUtf8String("GeneratorFunctionPrototype"),
         generator_function_prototype, NONE);
 
     static const bool kUseStrictFunctionMap = true;
     Handle<JSFunction> generator_function_function =
         InstallFunction(container, "GeneratorFunction", JS_FUNCTION_TYPE,
                         JSFunction::kSize, generator_function_prototype,
                         Builtins::kIllegal, kUseStrictFunctionMap);
-    generator_function_function->initial_map()->set_is_callable();
-    generator_function_function->initial_map()->set_is_constructor(true);
+    generator_function_function->set_prototype_or_initial_map(
+        native_context->sloppy_generator_function_map());
     generator_function_function->shared()->set_construct_stub(
         *isolate->builtins()->JSBuiltinsConstructStub());
+
+    native_context->sloppy_generator_function_map()
+        ->set_constructor_or_backpointer(*generator_function_function);
+    native_context->strict_generator_function_map()
+        ->set_constructor_or_backpointer(*generator_function_function);
+    native_context->strong_generator_function_map()
+        ->set_constructor_or_backpointer(*generator_function_function);
   }
 
   {  // -- S e t I t e r a t o r
     Handle<JSObject> set_iterator_prototype =
         isolate->factory()->NewJSObject(isolate->object_function(), TENURED);
     SetObjectPrototype(set_iterator_prototype, iterator_prototype);
     Handle<JSFunction> set_iterator_function = InstallFunction(
         container, "SetIterator", JS_SET_ITERATOR_TYPE, JSSetIterator::kSize,
         set_iterator_prototype, Builtins::kIllegal);
     native_context->set_set_iterator_map(set_iterator_function->initial_map());
@@ skipping 1362 matching lines @@
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 }  // namespace internal
 }  // namespace v8