Revert "Only create arguments-maps in the bootstrapper, remove now obsolete ValueType flag."

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/code-stubs.h"
 #include "src/extensions/externalize-string-extension.h"
 #include "src/extensions/free-buffer-extension.h"
@@ skipping 751 matching lines @@
     if (!proto_template->IsUndefined()) {
       js_global_object_template =
           Handle<ObjectTemplateInfo>::cast(proto_template);
     }
   }
 
   if (js_global_object_template.is_null()) {
     Handle<String> name = Handle<String>(heap()->empty_string());
     Handle<Code> code = Handle<Code>(isolate()->builtins()->builtin(
         Builtins::kIllegal));
+    js_global_object_function = factory()->NewFunction(
+        name, code, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize);
+    // Change the constructor property of the prototype of the
+    // hidden global function to refer to the Object function.
     Handle<JSObject> prototype =
-        factory()->NewFunctionPrototype(isolate()->object_function());
-    js_global_object_function = factory()->NewFunction(
-        name, code, prototype, JS_GLOBAL_OBJECT_TYPE, JSGlobalObject::kSize);
-#ifdef DEBUG
-    LookupIterator it(prototype, factory()->constructor_string(),
-                      LookupIterator::CHECK_OWN_REAL);
-    Handle<Object> value = JSReceiver::GetProperty(&it).ToHandleChecked();
-    ASSERT(it.IsFound());
-    ASSERT_EQ(*isolate()->object_function(), *value);
-#endif
+        Handle<JSObject>(
+            JSObject::cast(js_global_object_function->instance_prototype()));
+    JSObject::SetOwnPropertyIgnoreAttributes(
+        prototype, factory()->constructor_string(),
+        isolate()->object_function(), NONE).Check();
   } else {
     Handle<FunctionTemplateInfo> js_global_object_constructor(
         FunctionTemplateInfo::cast(js_global_object_template->constructor()));
     js_global_object_function =
         factory()->CreateApiFunction(js_global_object_constructor,
                                      factory()->the_hole_value(),
                                      factory()->GlobalObjectType);
   }
 
   js_global_object_function->initial_map()->set_is_hidden_prototype();
@@ skipping 334 matching lines @@
     native_context()->set_data_view_fun(*data_view_fun);
   }
 
   // -- W e a k M a p
   InstallFunction(global, "WeakMap", JS_WEAK_MAP_TYPE, JSWeakMap::kSize,
                   isolate->initial_object_prototype(), Builtins::kIllegal);
   // -- W e a k S e t
   InstallFunction(global, "WeakSet", JS_WEAK_SET_TYPE, JSWeakSet::kSize,
                   isolate->initial_object_prototype(), Builtins::kIllegal);
 
-  {  // --- sloppy arguments map
+  {  // --- arguments_boilerplate_
     // Make sure we can recognize argument objects at runtime.
     // This is done by introducing an anonymous function with
     // class_name equals 'Arguments'.
     Handle<String> arguments_string = factory->InternalizeOneByteString(
         STATIC_ASCII_VECTOR("Arguments"));
     Handle<Code> code(isolate->builtins()->builtin(Builtins::kIllegal));
+
     Handle<JSFunction> function = factory->NewFunctionWithoutPrototype(
         arguments_string, code);
+    ASSERT(!function->has_initial_map());
     function->shared()->set_instance_class_name(*arguments_string);
+    function->shared()->set_expected_nof_properties(2);
+    function->set_prototype_or_initial_map(
+        native_context()->object_function()->prototype());
+    Handle<JSObject> result = factory->NewJSObject(function);
 
-    Handle<Map> map =
-        factory->NewMap(JS_OBJECT_TYPE, Heap::kSloppyArgumentsObjectSize);
-    // Create the descriptor array for the arguments object.
-    Map::EnsureDescriptorSlack(map, 2);
+    native_context()->set_sloppy_arguments_boilerplate(*result);
+    // Note: length must be added as the first property and
+    //       callee must be added as the second property.
+    JSObject::AddProperty(
+        result, factory->length_string(),
+        factory->undefined_value(), DONT_ENUM,
+        Object::FORCE_TAGGED, FORCE_FIELD);
+    JSObject::AddProperty(
+        result, factory->callee_string(),
+        factory->undefined_value(), DONT_ENUM,
+        Object::FORCE_TAGGED, FORCE_FIELD);
 
-    {  // length
-      FieldDescriptor d(factory->length_string(), Heap::kArgumentsLengthIndex,
-                        DONT_ENUM, Representation::Tagged());
-      map->AppendDescriptor(&d);
-    }
-    {  // callee
-      FieldDescriptor d(factory->callee_string(), Heap::kArgumentsCalleeIndex,
-                        DONT_ENUM, Representation::Tagged());
-      map->AppendDescriptor(&d);
-    }
+#ifdef DEBUG
+    LookupResult lookup(isolate);
+    result->LookupOwn(factory->callee_string(), &lookup);
+    ASSERT(lookup.IsField());
+    ASSERT(lookup.GetFieldIndex().property_index() ==
+           Heap::kArgumentsCalleeIndex);
 
-    map->set_function_with_prototype(true);
-    map->set_prototype(native_context()->object_function()->prototype());
-    map->set_pre_allocated_property_fields(2);
-    map->set_inobject_properties(2);
-    native_context()->set_sloppy_arguments_map(*map);
+    result->LookupOwn(factory->length_string(), &lookup);
+    ASSERT(lookup.IsField());
+    ASSERT(lookup.GetFieldIndex().property_index() ==
+           Heap::kArgumentsLengthIndex);
 
-    ASSERT(!function->has_initial_map());
-    function->set_initial_map(*map);
-    map->set_constructor(*function);
+    ASSERT(result->map()->inobject_properties() > Heap::kArgumentsCalleeIndex);
+    ASSERT(result->map()->inobject_properties() > Heap::kArgumentsLengthIndex);
 
-    ASSERT(map->inobject_properties() > Heap::kArgumentsCalleeIndex);
-    ASSERT(map->inobject_properties() > Heap::kArgumentsLengthIndex);
-    ASSERT(!map->is_dictionary_map());
-    ASSERT(IsFastObjectElementsKind(map->elements_kind()));
+    // Check the state of the object.
+    ASSERT(result->HasFastProperties());
+    ASSERT(result->HasFastObjectElements());
+#endif
   }
 
-  {  // --- aliased arguments map
-    Handle<Map> map = Map::Copy(isolate->sloppy_arguments_map());
-    map->set_elements_kind(SLOPPY_ARGUMENTS_ELEMENTS);
-    ASSERT_EQ(2, map->pre_allocated_property_fields());
-    native_context()->set_aliased_arguments_map(*map);
+  {  // --- aliased_arguments_boilerplate_
+    // Set up a well-formed parameter map to make assertions happy.
+    Handle<FixedArray> elements = factory->NewFixedArray(2);
+    elements->set_map(heap->sloppy_arguments_elements_map());
+    Handle<FixedArray> array;
+    array = factory->NewFixedArray(0);
+    elements->set(0, *array);
+    array = factory->NewFixedArray(0);
+    elements->set(1, *array);
+
+    Handle<Map> old_map(
+        native_context()->sloppy_arguments_boilerplate()->map());
+    Handle<Map> new_map = Map::Copy(old_map);
+    new_map->set_pre_allocated_property_fields(2);
+    Handle<JSObject> result = factory->NewJSObjectFromMap(new_map);
+    // Set elements kind after allocating the object because
+    // NewJSObjectFromMap assumes a fast elements map.
+    new_map->set_elements_kind(SLOPPY_ARGUMENTS_ELEMENTS);
+    result->set_elements(*elements);
+    ASSERT(result->HasSloppyArgumentsElements());
+    native_context()->set_aliased_arguments_boilerplate(*result);
   }
 
-  {  // --- strict mode arguments map
+  {  // --- strict mode arguments boilerplate
     const PropertyAttributes attributes =
       static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY);
 
     // Create the ThrowTypeError functions.
     Handle<AccessorPair> callee = factory->NewAccessorPair();
     Handle<AccessorPair> caller = factory->NewAccessorPair();
 
     Handle<JSFunction> poison = GetStrictPoisonFunction();
 
     // Install the ThrowTypeError functions.
     callee->set_getter(*poison);
     callee->set_setter(*poison);
     caller->set_getter(*poison);
     caller->set_setter(*poison);
 
     // Create the map. Allocate one in-object field for length.
     Handle<Map> map = factory->NewMap(JS_OBJECT_TYPE,
                                       Heap::kStrictArgumentsObjectSize);
     // Create the descriptor array for the arguments object.
     Map::EnsureDescriptorSlack(map, 3);
 
     {  // length
-      FieldDescriptor d(factory->length_string(), Heap::kArgumentsLengthIndex,
-                        DONT_ENUM, Representation::Tagged());
+      FieldDescriptor d(
+          factory->length_string(), 0, DONT_ENUM, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // callee
-      CallbacksDescriptor d(factory->callee_string(), callee, attributes);
+      CallbacksDescriptor d(factory->callee_string(),
+                            callee,
+                            attributes);
       map->AppendDescriptor(&d);
     }
     {  // caller
-      CallbacksDescriptor d(factory->caller_string(), caller, attributes);
+      CallbacksDescriptor d(factory->caller_string(),
+                            caller,
+                            attributes);
       map->AppendDescriptor(&d);
     }
 
     map->set_function_with_prototype(true);
     map->set_prototype(native_context()->object_function()->prototype());
     map->set_pre_allocated_property_fields(1);
     map->set_inobject_properties(1);
 
     // Copy constructor from the sloppy arguments boilerplate.
     map->set_constructor(
-        native_context()->sloppy_arguments_map()->constructor());
+      native_context()->sloppy_arguments_boilerplate()->map()->constructor());
 
-    native_context()->set_strict_arguments_map(*map);
+    // Allocate the arguments boilerplate object.
+    Handle<JSObject> result = factory->NewJSObjectFromMap(map);
+    native_context()->set_strict_arguments_boilerplate(*result);
 
-    ASSERT(map->inobject_properties() > Heap::kArgumentsLengthIndex);
-    ASSERT(!map->is_dictionary_map());
-    ASSERT(IsFastObjectElementsKind(map->elements_kind()));
+#ifdef DEBUG
+    LookupResult lookup(isolate);
+    result->LookupOwn(factory->length_string(), &lookup);
+    ASSERT(lookup.IsField());
+    ASSERT(lookup.GetFieldIndex().property_index() ==
+           Heap::kArgumentsLengthIndex);
+
+    Handle<Object> length_value = Object::GetProperty(
+        result, factory->length_string()).ToHandleChecked();
+    ASSERT_EQ(heap->undefined_value(), *length_value);
+
+    ASSERT(result->map()->inobject_properties() > Heap::kArgumentsLengthIndex);
+
+    // Check the state of the object.
+    ASSERT(result->HasFastProperties());
+    ASSERT(result->HasFastObjectElements());
+#endif
   }
 
   {  // --- context extension
     // Create a function for the context extension objects.
     Handle<Code> code = Handle<Code>(
         isolate->builtins()->builtin(Builtins::kIllegal));
     Handle<JSFunction> context_extension_fun = factory->NewFunction(
         factory->empty_string(), code, JS_CONTEXT_EXTENSION_OBJECT_TYPE,
         JSObject::kHeaderSize);
 
@@ skipping 896 matching lines @@
   BootstrapperActive active(this);
   SaveContext saved_context(isolate_);
   isolate_->set_context(*native_context);
   return Genesis::InstallExtensions(native_context, extensions) &&
       Genesis::InstallSpecialObjects(native_context);
 }
 
 
 bool Genesis::InstallSpecialObjects(Handle<Context> native_context) {
   Isolate* isolate = native_context->GetIsolate();
-  // Don't install extensions into the snapshot.
-  if (isolate->serializer_enabled()) return true;
-
   Factory* factory = isolate->factory();
   HandleScope scope(isolate);
   Handle<JSGlobalObject> global(JSGlobalObject::cast(
       native_context->global_object()));
-
-  Handle<JSObject> Error = Handle<JSObject>::cast(
-      Object::GetProperty(isolate, global, "Error").ToHandleChecked());
-  Handle<String> name =
-      factory->InternalizeOneByteString(STATIC_ASCII_VECTOR("stackTraceLimit"));
-  Handle<Smi> stack_trace_limit(Smi::FromInt(FLAG_stack_trace_limit), isolate);
-  JSObject::AddProperty(Error, name, stack_trace_limit, NONE);
-
   // Expose the natives in global if a name for it is specified.
   if (FLAG_expose_natives_as != NULL && strlen(FLAG_expose_natives_as) != 0) {
     Handle<String> natives =
         factory->InternalizeUtf8String(FLAG_expose_natives_as);
-    JSObject::AddProperty(global, natives, handle(global->builtins()),
-                          DONT_ENUM);
+    RETURN_ON_EXCEPTION_VALUE(
+        isolate,
+        JSObject::SetOwnPropertyIgnoreAttributes(
+            global, natives, Handle<JSObject>(global->builtins()), DONT_ENUM),
+        false);
+  }
+
+  Handle<Object> Error = Object::GetProperty(
+      isolate, global, "Error").ToHandleChecked();
+  if (Error->IsJSObject()) {
+    Handle<String> name = factory->InternalizeOneByteString(
+        STATIC_ASCII_VECTOR("stackTraceLimit"));
+    Handle<Smi> stack_trace_limit(
+        Smi::FromInt(FLAG_stack_trace_limit), isolate);
+    RETURN_ON_EXCEPTION_VALUE(
+        isolate,
+        JSObject::SetOwnPropertyIgnoreAttributes(
+            Handle<JSObject>::cast(Error), name, stack_trace_limit, NONE),
+        false);
   }
 
   // Expose the stack trace symbol to native JS.
-  JSObject::AddProperty(handle(global->builtins()),
-                        factory->InternalizeOneByteString(
-                            STATIC_ASCII_VECTOR("stack_trace_symbol")),
-                        factory->stack_trace_symbol(), NONE);
+  RETURN_ON_EXCEPTION_VALUE(
+      isolate,
+      JSObject::SetOwnPropertyIgnoreAttributes(
+          handle(native_context->builtins(), isolate),
+          factory->InternalizeOneByteString(
+              STATIC_ASCII_VECTOR("stack_trace_symbol")),
+          factory->stack_trace_symbol(),
+          NONE),
+      false);
 
   // Expose the debug global object in global if a name for it is specified.
   if (FLAG_expose_debug_as != NULL && strlen(FLAG_expose_debug_as) != 0) {
     // If loading fails we just bail out without installing the
     // debugger but without tanking the whole context.
     Debug* debug = isolate->debug();
     if (!debug->Load()) return true;
     Handle<Context> debug_context = debug->debug_context();
     // Set the security token for the debugger context to the same as
     // the shell native context to allow calling between these (otherwise
     // exposing debug global object doesn't make much sense).
     debug_context->set_security_token(native_context->security_token());
     Handle<String> debug_string =
         factory->InternalizeUtf8String(FLAG_expose_debug_as);
     Handle<Object> global_proxy(debug_context->global_proxy(), isolate);
-    JSObject::AddProperty(global, debug_string, global_proxy, DONT_ENUM);
+    RETURN_ON_EXCEPTION_VALUE(
+        isolate,
+        JSObject::SetOwnPropertyIgnoreAttributes(
+            global, debug_string, global_proxy, DONT_ENUM),
+        false);
   }
   return true;
 }
 
 
 static uint32_t Hash(RegisteredExtension* extension) {
   return v8::internal::ComputePointerHash(extension);
 }
 
 
@@ skipping 493 matching lines @@
   return from + sizeof(NestingCounterType);
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   ASSERT(!IsActive());
 }
 
 } }  // namespace v8::internal