Title: [201448] trunk/Source/_javascript_Core
Revision
201448
Author
barraclo...@apple.com
Date
2016-05-27 00:09:35 -0700 (Fri, 27 May 2016)

Log Message

Static table property lookup should not require getOwnPropertySlot override.
https://bugs.webkit.org/show_bug.cgi?id=158059

Reviewed by Darin Adler.

Currently JSObject does not handle property lookup of entries in the static
table. Each subclass with static properties mut override getOwnPropertySlot,
and explicitly call the lookup functions. This has the following drawbacks:

- Performance: for any class with static properties, property acces becomes
  virtual (via method table).
- Poor encapsulation: implementation detail of static property access is
  spread throughout & cross projects, rather than being contained in JSObject.
- Code size: this results in a great many additional functions.
- Inconsistency: static table presence has to be be taken into account in many
  other operations, e.g. presence of read-only properties for put.
- Memory: in order to avoid the virtual lookup, DOM prototypes eagerly reify
  all properties. This is likely suboptimal.

Instead, JSObject::getPropertySlot / JSObject::getOwnPropertySlot should be
able to handle static properties.

This is actually a fairly small & simple change.

The common pattern is for subclasses of JObject to override getOwnPropertySlot
to first defer to JSObject for property storage lookup, and only if this fails
consult the static table. They just want the static tables to be consulted after
regular property storgae lookup. So just add a fast flag in TypeInfo for JSObject
to check, and where it is set, do so. Then it's just a question of switching
classes over to start setting this flag, and drop the override.

The new mechanism does change static table lookup order from oldest-ancestor
first to most-derived first. The new ordering makes more sense (means derived
class static tables can now override entries from parents), and shoudn't affect
any existing code (since overriding didn't previously work, there likely aren't
shadowing properties in more derived types).

This patch changes all classes in _javascript_Core over to using the new mechanism,
except JSGlobalObject. I'll move classes in WebCore over as a separate patch
(this is also why I've not moved JSGlobalObject in this patch - doing so would
move JSDOMWindow, and I'd rather handle that separately).

* runtime/JSTypeInfo.h:
(JSC::TypeInfo::hasStaticPropertyTable):
    - Add HasStaticPropertyTable flag.
* runtime/Lookup.cpp:
(JSC::setUpStaticFunctionSlot):
    - Change setUpStaticFunctionSlot to take a VM&.
* runtime/Lookup.h:
(JSC::getStaticPropertySlotFromTable):
    - Added helper function to perform static lookup alone.
(JSC::getStaticPropertySlot):
(JSC::getStaticFunctionSlot):
    - setUpStaticFunctionSlot changed to take a VM&.
* runtime/JSObject.cpp:
(JSC::JSObject::getOwnStaticPropertySlot):
    - Added, walks ClassInfo chain looking for static properties.
* runtime/JSObject.h:
(JSC::JSObject::getOwnNonIndexPropertySlot):
    - getOwnNonIndexPropertySlot is used internally by getPropertySlot
      & getOwnPropertySlot. If property is not present in storage array
      then check the static table.
* runtime/ArrayConstructor.cpp:
(JSC::ArrayConstructor::finishCreation):
(JSC::constructArrayWithSizeQuirk):
(JSC::ArrayConstructor::getOwnPropertySlot): Deleted.
* runtime/ArrayConstructor.h:
(JSC::ArrayConstructor::create):
* runtime/ArrayIteratorPrototype.cpp:
(JSC::ArrayIteratorPrototype::finishCreation):
(JSC::ArrayIteratorPrototype::getOwnPropertySlot): Deleted.
* runtime/ArrayIteratorPrototype.h:
(JSC::ArrayIteratorPrototype::create):
(JSC::ArrayIteratorPrototype::ArrayIteratorPrototype):
* runtime/BooleanPrototype.cpp:
(JSC::BooleanPrototype::finishCreation):
(JSC::booleanProtoFuncToString):
(JSC::BooleanPrototype::getOwnPropertySlot): Deleted.
* runtime/BooleanPrototype.h:
(JSC::BooleanPrototype::create):
* runtime/DateConstructor.cpp:
(JSC::DateConstructor::finishCreation):
(JSC::millisecondsFromComponents):
(JSC::DateConstructor::getOwnPropertySlot): Deleted.
* runtime/DateConstructor.h:
(JSC::DateConstructor::create):
* runtime/DatePrototype.cpp:
(JSC::DatePrototype::finishCreation):
(JSC::dateProtoFuncToString):
(JSC::DatePrototype::getOwnPropertySlot): Deleted.
* runtime/DatePrototype.h:
(JSC::DatePrototype::create):
* runtime/ErrorPrototype.cpp:
(JSC::ErrorPrototype::finishCreation):
(JSC::ErrorPrototype::getOwnPropertySlot): Deleted.
* runtime/ErrorPrototype.h:
(JSC::ErrorPrototype::create):
* runtime/GeneratorPrototype.cpp:
(JSC::GeneratorPrototype::finishCreation):
(JSC::GeneratorPrototype::getOwnPropertySlot): Deleted.
* runtime/GeneratorPrototype.h:
(JSC::GeneratorPrototype::create):
(JSC::GeneratorPrototype::createStructure):
(JSC::GeneratorPrototype::GeneratorPrototype):
* runtime/InspectorInstrumentationObject.cpp:
(JSC::InspectorInstrumentationObject::finishCreation):
(JSC::InspectorInstrumentationObject::isEnabled):
(JSC::InspectorInstrumentationObject::getOwnPropertySlot): Deleted.
* runtime/InspectorInstrumentationObject.h:
(JSC::InspectorInstrumentationObject::create):
(JSC::InspectorInstrumentationObject::createStructure):
* runtime/IntlCollatorConstructor.cpp:
(JSC::IntlCollatorConstructor::getCallData):
(JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
(JSC::IntlCollatorConstructor::getOwnPropertySlot): Deleted.
* runtime/IntlCollatorConstructor.h:
* runtime/IntlCollatorPrototype.cpp:
(JSC::IntlCollatorPrototype::finishCreation):
(JSC::IntlCollatorFuncCompare):
(JSC::IntlCollatorPrototype::getOwnPropertySlot): Deleted.
* runtime/IntlCollatorPrototype.h:
* runtime/IntlDateTimeFormatConstructor.cpp:
(JSC::IntlDateTimeFormatConstructor::getCallData):
(JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
(JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot): Deleted.
* runtime/IntlDateTimeFormatConstructor.h:
* runtime/IntlDateTimeFormatPrototype.cpp:
(JSC::IntlDateTimeFormatPrototype::finishCreation):
(JSC::IntlDateTimeFormatFuncFormatDateTime):
(JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot): Deleted.
* runtime/IntlDateTimeFormatPrototype.h:
* runtime/IntlNumberFormatConstructor.cpp:
(JSC::IntlNumberFormatConstructor::getCallData):
(JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
(JSC::IntlNumberFormatConstructor::getOwnPropertySlot): Deleted.
* runtime/IntlNumberFormatConstructor.h:
* runtime/IntlNumberFormatPrototype.cpp:
(JSC::IntlNumberFormatPrototype::finishCreation):
(JSC::IntlNumberFormatFuncFormatNumber):
(JSC::IntlNumberFormatPrototype::getOwnPropertySlot): Deleted.
* runtime/IntlNumberFormatPrototype.h:
* runtime/JSDataViewPrototype.cpp:
(JSC::JSDataViewPrototype::createStructure):
(JSC::getData):
(JSC::JSDataViewPrototype::getOwnPropertySlot): Deleted.
* runtime/JSDataViewPrototype.h:
* runtime/JSInternalPromiseConstructor.cpp:
(JSC::JSInternalPromiseConstructor::getCallData):
(JSC::JSInternalPromiseConstructor::getOwnPropertySlot): Deleted.
* runtime/JSInternalPromiseConstructor.h:
* runtime/JSONObject.cpp:
(JSC::Walker::Walker):
(JSC::JSONObject::getOwnPropertySlot): Deleted.
* runtime/JSONObject.h:
(JSC::JSONObject::create):
* runtime/JSPromiseConstructor.cpp:
(JSC::JSPromiseConstructor::getCallData):
(JSC::JSPromiseConstructor::getOwnPropertySlot): Deleted.
* runtime/JSPromiseConstructor.h:
* runtime/JSPromisePrototype.cpp:
(JSC::JSPromisePrototype::addOwnInternalSlots):
(JSC::JSPromisePrototype::getOwnPropertySlot): Deleted.
* runtime/JSPromisePrototype.h:
* runtime/MapPrototype.cpp:
(JSC::MapPrototype::finishCreation):
(JSC::getMap):
(JSC::MapPrototype::getOwnPropertySlot): Deleted.
* runtime/MapPrototype.h:
(JSC::MapPrototype::create):
(JSC::MapPrototype::MapPrototype):
* runtime/ModuleLoaderObject.cpp:
(JSC::ModuleLoaderObject::finishCreation):
(JSC::printableModuleKey):
(JSC::ModuleLoaderObject::getOwnPropertySlot): Deleted.
* runtime/ModuleLoaderObject.h:
* runtime/NumberPrototype.cpp:
(JSC::NumberPrototype::finishCreation):
(JSC::toThisNumber):
(JSC::NumberPrototype::getOwnPropertySlot): Deleted.
* runtime/NumberPrototype.h:
(JSC::NumberPrototype::create):
* runtime/ObjectConstructor.cpp:
(JSC::ObjectConstructor::addDefineProperty):
(JSC::constructObject):
(JSC::ObjectConstructor::getOwnPropertySlot): Deleted.
* runtime/ObjectConstructor.h:
(JSC::ObjectConstructor::create):
(JSC::ObjectConstructor::createStructure):
* runtime/ReflectObject.cpp:
(JSC::ReflectObject::finishCreation):
(JSC::ReflectObject::getOwnPropertySlot): Deleted.
* runtime/ReflectObject.h:
(JSC::ReflectObject::create):
(JSC::ReflectObject::createStructure):
* runtime/RegExpConstructor.cpp:
(JSC::RegExpConstructor::getRightContext):
(JSC::regExpConstructorDollar):
(JSC::RegExpConstructor::getOwnPropertySlot): Deleted.
* runtime/RegExpConstructor.h:
(JSC::RegExpConstructor::create):
(JSC::RegExpConstructor::createStructure):
* runtime/SetPrototype.cpp:
(JSC::SetPrototype::finishCreation):
(JSC::getSet):
(JSC::SetPrototype::getOwnPropertySlot): Deleted.
* runtime/SetPrototype.h:
(JSC::SetPrototype::create):
(JSC::SetPrototype::SetPrototype):
* runtime/StringConstructor.cpp:
(JSC::StringConstructor::finishCreation):
(JSC::stringFromCharCodeSlowCase):
(JSC::StringConstructor::getOwnPropertySlot): Deleted.
* runtime/StringConstructor.h:
(JSC::StringConstructor::create):
* runtime/StringIteratorPrototype.cpp:
(JSC::StringIteratorPrototype::finishCreation):
(JSC::StringIteratorPrototype::getOwnPropertySlot): Deleted.
* runtime/StringIteratorPrototype.h:
(JSC::StringIteratorPrototype::create):
(JSC::StringIteratorPrototype::StringIteratorPrototype):
* runtime/StringPrototype.cpp:
(JSC::StringPrototype::create):
(JSC::substituteBackreferencesSlow):
(JSC::StringPrototype::getOwnPropertySlot): Deleted.
* runtime/StringPrototype.h:
* runtime/SymbolConstructor.cpp:
(JSC::SymbolConstructor::finishCreation):
(JSC::callSymbol):
(JSC::SymbolConstructor::getOwnPropertySlot): Deleted.
* runtime/SymbolConstructor.h:
(JSC::SymbolConstructor::create):
* runtime/SymbolPrototype.cpp:
(JSC::SymbolPrototype::finishCreation):
(JSC::SymbolPrototype::getOwnPropertySlot): Deleted.
* runtime/SymbolPrototype.h:
(JSC::SymbolPrototype::create):
    - remove getOwnPropertySlot, replace OverridesGetOwnPropertySlot flag with HasStaticPropertyTable.

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/ChangeLog (201447 => 201448)


--- trunk/Source/_javascript_Core/ChangeLog	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/ChangeLog	2016-05-27 07:09:35 UTC (rev 201448)
@@ -1,3 +1,243 @@
+2016-05-26  Gavin & Ellie Barraclough  <barraclo...@apple.com>
+
+        Static table property lookup should not require getOwnPropertySlot override.
+        https://bugs.webkit.org/show_bug.cgi?id=158059
+
+        Reviewed by Darin Adler.
+
+        Currently JSObject does not handle property lookup of entries in the static
+        table. Each subclass with static properties mut override getOwnPropertySlot,
+        and explicitly call the lookup functions. This has the following drawbacks:
+
+        - Performance: for any class with static properties, property acces becomes
+          virtual (via method table).
+        - Poor encapsulation: implementation detail of static property access is
+          spread throughout & cross projects, rather than being contained in JSObject.
+        - Code size: this results in a great many additional functions.
+        - Inconsistency: static table presence has to be be taken into account in many
+          other operations, e.g. presence of read-only properties for put.
+        - Memory: in order to avoid the virtual lookup, DOM prototypes eagerly reify
+          all properties. This is likely suboptimal.
+
+        Instead, JSObject::getPropertySlot / JSObject::getOwnPropertySlot should be
+        able to handle static properties.
+
+        This is actually a fairly small & simple change.
+
+        The common pattern is for subclasses of JObject to override getOwnPropertySlot
+        to first defer to JSObject for property storage lookup, and only if this fails
+        consult the static table. They just want the static tables to be consulted after
+        regular property storgae lookup. So just add a fast flag in TypeInfo for JSObject
+        to check, and where it is set, do so. Then it's just a question of switching
+        classes over to start setting this flag, and drop the override.
+
+        The new mechanism does change static table lookup order from oldest-ancestor
+        first to most-derived first. The new ordering makes more sense (means derived
+        class static tables can now override entries from parents), and shoudn't affect
+        any existing code (since overriding didn't previously work, there likely aren't
+        shadowing properties in more derived types).
+
+        This patch changes all classes in _javascript_Core over to using the new mechanism,
+        except JSGlobalObject. I'll move classes in WebCore over as a separate patch
+        (this is also why I've not moved JSGlobalObject in this patch - doing so would
+        move JSDOMWindow, and I'd rather handle that separately).
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::hasStaticPropertyTable):
+            - Add HasStaticPropertyTable flag.
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+            - Change setUpStaticFunctionSlot to take a VM&.
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlotFromTable):
+            - Added helper function to perform static lookup alone.
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+            - setUpStaticFunctionSlot changed to take a VM&.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnStaticPropertySlot):
+            - Added, walks ClassInfo chain looking for static properties.
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnNonIndexPropertySlot):
+            - getOwnNonIndexPropertySlot is used internally by getPropertySlot
+              & getOwnPropertySlot. If property is not present in storage array
+              then check the static table.
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::constructArrayWithSizeQuirk):
+        (JSC::ArrayConstructor::getOwnPropertySlot): Deleted.
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::create):
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::ArrayIteratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/ArrayIteratorPrototype.h:
+        (JSC::ArrayIteratorPrototype::create):
+        (JSC::ArrayIteratorPrototype::ArrayIteratorPrototype):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::finishCreation):
+        (JSC::booleanProtoFuncToString):
+        (JSC::BooleanPrototype::getOwnPropertySlot): Deleted.
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::create):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        (JSC::millisecondsFromComponents):
+        (JSC::DateConstructor::getOwnPropertySlot): Deleted.
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::create):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+        (JSC::dateProtoFuncToString):
+        (JSC::DatePrototype::getOwnPropertySlot): Deleted.
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::finishCreation):
+        (JSC::ErrorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+        * runtime/GeneratorPrototype.cpp:
+        (JSC::GeneratorPrototype::finishCreation):
+        (JSC::GeneratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/GeneratorPrototype.h:
+        (JSC::GeneratorPrototype::create):
+        (JSC::GeneratorPrototype::createStructure):
+        (JSC::GeneratorPrototype::GeneratorPrototype):
+        * runtime/InspectorInstrumentationObject.cpp:
+        (JSC::InspectorInstrumentationObject::finishCreation):
+        (JSC::InspectorInstrumentationObject::isEnabled):
+        (JSC::InspectorInstrumentationObject::getOwnPropertySlot): Deleted.
+        * runtime/InspectorInstrumentationObject.h:
+        (JSC::InspectorInstrumentationObject::create):
+        (JSC::InspectorInstrumentationObject::createStructure):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::IntlCollatorConstructor::getCallData):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        (JSC::IntlCollatorConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlCollatorConstructor.h:
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototype::finishCreation):
+        (JSC::IntlCollatorFuncCompare):
+        (JSC::IntlCollatorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlCollatorPrototype.h:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::IntlDateTimeFormatConstructor::getCallData):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        (JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlDateTimeFormatConstructor.h:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototype::finishCreation):
+        (JSC::IntlDateTimeFormatFuncFormatDateTime):
+        (JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlDateTimeFormatPrototype.h:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::IntlNumberFormatConstructor::getCallData):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        (JSC::IntlNumberFormatConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlNumberFormatConstructor.h:
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototype::finishCreation):
+        (JSC::IntlNumberFormatFuncFormatNumber):
+        (JSC::IntlNumberFormatPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlNumberFormatPrototype.h:
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::createStructure):
+        (JSC::getData):
+        (JSC::JSDataViewPrototype::getOwnPropertySlot): Deleted.
+        * runtime/JSDataViewPrototype.h:
+        * runtime/JSInternalPromiseConstructor.cpp:
+        (JSC::JSInternalPromiseConstructor::getCallData):
+        (JSC::JSInternalPromiseConstructor::getOwnPropertySlot): Deleted.
+        * runtime/JSInternalPromiseConstructor.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::Walker):
+        (JSC::JSONObject::getOwnPropertySlot): Deleted.
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getCallData):
+        (JSC::JSPromiseConstructor::getOwnPropertySlot): Deleted.
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::addOwnInternalSlots):
+        (JSC::JSPromisePrototype::getOwnPropertySlot): Deleted.
+        * runtime/JSPromisePrototype.h:
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        (JSC::getMap):
+        (JSC::MapPrototype::getOwnPropertySlot): Deleted.
+        * runtime/MapPrototype.h:
+        (JSC::MapPrototype::create):
+        (JSC::MapPrototype::MapPrototype):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::ModuleLoaderObject::finishCreation):
+        (JSC::printableModuleKey):
+        (JSC::ModuleLoaderObject::getOwnPropertySlot): Deleted.
+        * runtime/ModuleLoaderObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::finishCreation):
+        (JSC::toThisNumber):
+        (JSC::NumberPrototype::getOwnPropertySlot): Deleted.
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::create):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::addDefineProperty):
+        (JSC::constructObject):
+        (JSC::ObjectConstructor::getOwnPropertySlot): Deleted.
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::create):
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ReflectObject.cpp:
+        (JSC::ReflectObject::finishCreation):
+        (JSC::ReflectObject::getOwnPropertySlot): Deleted.
+        * runtime/ReflectObject.h:
+        (JSC::ReflectObject::create):
+        (JSC::ReflectObject::createStructure):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar):
+        (JSC::RegExpConstructor::getOwnPropertySlot): Deleted.
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::create):
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        (JSC::getSet):
+        (JSC::SetPrototype::getOwnPropertySlot): Deleted.
+        * runtime/SetPrototype.h:
+        (JSC::SetPrototype::create):
+        (JSC::SetPrototype::SetPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::finishCreation):
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::StringConstructor::getOwnPropertySlot): Deleted.
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::create):
+        * runtime/StringIteratorPrototype.cpp:
+        (JSC::StringIteratorPrototype::finishCreation):
+        (JSC::StringIteratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/StringIteratorPrototype.h:
+        (JSC::StringIteratorPrototype::create):
+        (JSC::StringIteratorPrototype::StringIteratorPrototype):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::create):
+        (JSC::substituteBackreferencesSlow):
+        (JSC::StringPrototype::getOwnPropertySlot): Deleted.
+        * runtime/StringPrototype.h:
+        * runtime/SymbolConstructor.cpp:
+        (JSC::SymbolConstructor::finishCreation):
+        (JSC::callSymbol):
+        (JSC::SymbolConstructor::getOwnPropertySlot): Deleted.
+        * runtime/SymbolConstructor.h:
+        (JSC::SymbolConstructor::create):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::SymbolPrototype::finishCreation):
+        (JSC::SymbolPrototype::getOwnPropertySlot): Deleted.
+        * runtime/SymbolPrototype.h:
+        (JSC::SymbolPrototype::create):
+            - remove getOwnPropertySlot, replace OverridesGetOwnPropertySlot flag with HasStaticPropertyTable.
+
 2016-05-26  Commit Queue  <commit-qu...@webkit.org>
 
         Unreviewed, rolling out r201436.

Modified: trunk/Source/_javascript_Core/runtime/ArrayConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ArrayConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ArrayConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -71,11 +71,6 @@
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->isArray, arrayConstructorIsArray, DontEnum, 1);
 }
 
-bool ArrayConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<InternalFunction>(exec, arrayConstructorTable, jsCast<ArrayConstructor*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions ---------------------------
 
 JSObject* constructArrayWithSizeQuirk(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, JSValue length, JSValue newTarget)

Modified: trunk/Source/_javascript_Core/runtime/ArrayConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ArrayConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ArrayConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -34,7 +34,7 @@
 class ArrayConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | InternalFunction::StructureFlags;
+    static const unsigned StructureFlags = HasStaticPropertyTable | InternalFunction::StructureFlags;
 
     static ArrayConstructor* create(VM& vm, JSGlobalObject* globalObject, Structure* structure, ArrayPrototype* arrayPrototype, GetterSetter* speciesSymbol)
     {
@@ -55,7 +55,6 @@
 
 private:
     ArrayConstructor(VM&, Structure*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 
     static ConstructType getConstructData(JSCell*, ConstructData&);
     static CallType getCallData(JSCell*, CallData&);

Modified: trunk/Source/_javascript_Core/runtime/ArrayIteratorPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ArrayIteratorPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ArrayIteratorPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -55,11 +55,6 @@
     vm.prototypeMap.addPrototype(this);
 }
 
-bool ArrayIteratorPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<Base>(exec, arrayIteratorPrototypeTable, jsCast<ArrayIteratorPrototype*>(object), propertyName, slot);
-}
-
 // ------------------------------ Array Functions ----------------------------
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/ArrayIteratorPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ArrayIteratorPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ArrayIteratorPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -33,7 +33,7 @@
 class ArrayIteratorPrototype : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
 
     static ArrayIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -56,7 +56,6 @@
     }
 
     void finishCreation(VM&, JSGlobalObject*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 }

Modified: trunk/Source/_javascript_Core/runtime/BooleanPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/BooleanPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/BooleanPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -63,11 +63,6 @@
     ASSERT(inherits(info()));
 }
 
-bool BooleanPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<BooleanObject>(exec, booleanPrototypeTable, jsCast<BooleanPrototype*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions ---------------------------
 
 EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec)

Modified: trunk/Source/_javascript_Core/runtime/BooleanPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/BooleanPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/BooleanPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -28,7 +28,7 @@
 class BooleanPrototype : public BooleanObject {
 public:
     typedef BooleanObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static BooleanPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -49,7 +49,6 @@
 
 private:
     BooleanPrototype(VM&, Structure*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/DateConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/DateConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/DateConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -107,11 +107,6 @@
     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
 }
 
-bool DateConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<InternalFunction>(exec, dateConstructorTable, jsCast<DateConstructor*>(object), propertyName, slot);
-}
-
 static double millisecondsFromComponents(ExecState* exec, const ArgList& args, WTF::TimeType timeType)
 {
     double doubleArguments[] = {

Modified: trunk/Source/_javascript_Core/runtime/DateConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/DateConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/DateConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -31,7 +31,7 @@
 class DateConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static DateConstructor* create(VM& vm, Structure* structure, DatePrototype* datePrototype, GetterSetter*)
     {
@@ -54,8 +54,6 @@
     DateConstructor(VM&, Structure*);
     static ConstructType getConstructData(JSCell*, ConstructData&);
     static CallType getCallData(JSCell*, CallData&);
-
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 JSObject* constructDate(ExecState*, JSGlobalObject*, JSValue newTarget, const ArgList&);

Modified: trunk/Source/_javascript_Core/runtime/DatePrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/DatePrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/DatePrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -504,11 +504,6 @@
     // The constructor will be added later, after DateConstructor has been built.
 }
 
-bool DatePrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, dateTable, jsCast<DatePrototype*>(object), propertyName, slot);
-}
-
 // Functions
 
 EncodedJSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec)

Modified: trunk/Source/_javascript_Core/runtime/DatePrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/DatePrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/DatePrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -33,7 +33,7 @@
 
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static DatePrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -41,7 +41,6 @@
         prototype->finishCreation(vm, globalObject);
         return prototype;
     }
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 
     DECLARE_INFO;
 

Modified: trunk/Source/_javascript_Core/runtime/ErrorPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ErrorPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ErrorPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -62,11 +62,6 @@
     putDirect(vm, vm.propertyNames->message, jsEmptyString(&vm), DontEnum);
 }
 
-bool ErrorPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<ErrorInstance>(exec, errorPrototypeTable, jsCast<ErrorPrototype*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions ---------------------------
 
 // ECMA-262 5.1, 15.11.4.4

Modified: trunk/Source/_javascript_Core/runtime/ErrorPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ErrorPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ErrorPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -30,7 +30,7 @@
 class ErrorPrototype : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static ErrorPrototype* create(VM& vm, JSGlobalObject*, Structure* structure)
     {
@@ -49,9 +49,6 @@
 protected:
     ErrorPrototype(VM&, Structure*);
     void finishCreation(VM&);
-
-private:
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/GeneratorPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/GeneratorPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/GeneratorPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -54,9 +54,4 @@
     vm.prototypeMap.addPrototype(this);
 }
 
-bool GeneratorPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<Base>(exec, generatorPrototypeTable, jsCast<GeneratorPrototype*>(object), propertyName, slot);
-}
-
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/GeneratorPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/GeneratorPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/GeneratorPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -33,7 +33,7 @@
 class GeneratorPrototype : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static GeneratorPrototype* create(VM& vm, JSGlobalObject*, Structure* structure)
     {
@@ -49,8 +49,6 @@
         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
     }
 
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-
 private:
     GeneratorPrototype(VM& vm, Structure* structure)
         : Base(vm, structure)

Modified: trunk/Source/_javascript_Core/runtime/InspectorInstrumentationObject.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/InspectorInstrumentationObject.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/InspectorInstrumentationObject.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -64,11 +64,6 @@
     putDirectWithoutTransition(vm, vm.propertyNames->isEnabled, jsBoolean(false));
 }
 
-bool InspectorInstrumentationObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<Base>(exec, inspectorInstrumentationObjectTable, jsCast<InspectorInstrumentationObject*>(object), propertyName, slot);
-}
-
 bool InspectorInstrumentationObject::isEnabled(VM& vm) const
 {
     return getDirect(vm, vm.propertyNames->isEnabled).asBoolean();

Modified: trunk/Source/_javascript_Core/runtime/InspectorInstrumentationObject.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/InspectorInstrumentationObject.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/InspectorInstrumentationObject.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -36,7 +36,7 @@
 
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static InspectorInstrumentationObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -52,8 +52,6 @@
         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
     }
 
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-
     void enable(VM&);
     void disable(VM&);
     bool isEnabled(VM&) const;

Modified: trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -135,11 +135,6 @@
     return CallType::Host;
 }
 
-bool IntlCollatorConstructor::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<InternalFunction>(state, collatorConstructorTable, jsCast<IntlCollatorConstructor*>(object), propertyName, slot);
-}
-
 EncodedJSValue JSC_HOST_CALL IntlCollatorConstructorFuncSupportedLocalesOf(ExecState* state)
 {
     // 10.2.2 Intl.Collator.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)

Modified: trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -38,7 +38,7 @@
 class IntlCollatorConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static IntlCollatorConstructor* create(VM&, Structure*, IntlCollatorPrototype*, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -54,7 +54,6 @@
     IntlCollatorConstructor(VM&, Structure*);
     static ConstructType getConstructData(JSCell*, ConstructData&);
     static CallType getCallData(JSCell*, CallData&);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
     static void visitChildren(JSCell*, SlotVisitor&);
     
     WriteBarrier<Structure> m_collatorStructure;

Modified: trunk/Source/_javascript_Core/runtime/IntlCollatorPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlCollatorPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlCollatorPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -79,11 +79,6 @@
     Base::finishCreation(vm);
 }
 
-bool IntlCollatorPrototype::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(state, collatorPrototypeTable, jsCast<IntlCollatorPrototype*>(object), propertyName, slot);
-}
-
 static EncodedJSValue JSC_HOST_CALL IntlCollatorFuncCompare(ExecState* state)
 {
     // 10.3.4 Collator Compare Functions (ECMA-402 2.0)

Modified: trunk/Source/_javascript_Core/runtime/IntlCollatorPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlCollatorPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlCollatorPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -36,7 +36,7 @@
 class IntlCollatorPrototype : public IntlCollator {
 public:
     typedef IntlCollator Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static IntlCollatorPrototype* create(VM&, JSGlobalObject*, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -48,7 +48,6 @@
 
 private:
     IntlCollatorPrototype(VM&, Structure*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -135,11 +135,6 @@
     return CallType::Host;
 }
 
-bool IntlDateTimeFormatConstructor::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<InternalFunction>(state, dateTimeFormatConstructorTable, jsCast<IntlDateTimeFormatConstructor*>(object), propertyName, slot);
-}
-
 EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatConstructorFuncSupportedLocalesOf(ExecState* state)
 {
     // 12.2.2 Intl.DateTimeFormat.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)

Modified: trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -38,7 +38,7 @@
 class IntlDateTimeFormatConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static IntlDateTimeFormatConstructor* create(VM&, Structure*, IntlDateTimeFormatPrototype*, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -54,7 +54,6 @@
     IntlDateTimeFormatConstructor(VM&, Structure*);
     static ConstructType getConstructData(JSCell*, ConstructData&);
     static CallType getCallData(JSCell*, CallData&);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
     static void visitChildren(JSCell*, SlotVisitor&);
     
     WriteBarrier<Structure> m_dateTimeFormatStructure;

Modified: trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -80,11 +80,6 @@
     Base::finishCreation(vm);
 }
 
-bool IntlDateTimeFormatPrototype::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(state, dateTimeFormatPrototypeTable, jsCast<IntlDateTimeFormatPrototype*>(object), propertyName, slot);
-}
-
 static EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatFuncFormatDateTime(ExecState* state)
 {
     // 12.3.4 DateTime Format Functions (ECMA-402 2.0)

Modified: trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -36,7 +36,7 @@
 class IntlDateTimeFormatPrototype : public IntlDateTimeFormat {
 public:
     typedef IntlDateTimeFormat Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static IntlDateTimeFormatPrototype* create(VM&, JSGlobalObject*, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -48,7 +48,6 @@
 
 private:
     IntlDateTimeFormatPrototype(VM&, Structure*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -135,11 +135,6 @@
     return CallType::Host;
 }
 
-bool IntlNumberFormatConstructor::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<InternalFunction>(state, numberFormatConstructorTable, jsCast<IntlNumberFormatConstructor*>(object), propertyName, slot);
-}
-
 EncodedJSValue JSC_HOST_CALL IntlNumberFormatConstructorFuncSupportedLocalesOf(ExecState* state)
 {
     // 11.2.2 Intl.NumberFormat.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)

Modified: trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -38,7 +38,7 @@
 class IntlNumberFormatConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static IntlNumberFormatConstructor* create(VM&, Structure*, IntlNumberFormatPrototype*, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -54,7 +54,6 @@
     IntlNumberFormatConstructor(VM&, Structure*);
     static ConstructType getConstructData(JSCell*, ConstructData&);
     static CallType getCallData(JSCell*, CallData&);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
     static void visitChildren(JSCell*, SlotVisitor&);
     
     WriteBarrier<Structure> m_numberFormatStructure;

Modified: trunk/Source/_javascript_Core/runtime/IntlNumberFormatPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlNumberFormatPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlNumberFormatPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -78,11 +78,6 @@
     Base::finishCreation(vm);
 }
 
-bool IntlNumberFormatPrototype::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(state, numberFormatPrototypeTable, jsCast<IntlNumberFormatPrototype*>(object), propertyName, slot);
-}
-
 static EncodedJSValue JSC_HOST_CALL IntlNumberFormatFuncFormatNumber(ExecState* state)
 {
     // 11.3.4 Format Number Functions (ECMA-402 2.0)

Modified: trunk/Source/_javascript_Core/runtime/IntlNumberFormatPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/IntlNumberFormatPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/IntlNumberFormatPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -36,7 +36,7 @@
 class IntlNumberFormatPrototype : public IntlNumberFormat {
 public:
     typedef IntlNumberFormat Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static IntlNumberFormatPrototype* create(VM&, JSGlobalObject*, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -48,7 +48,6 @@
 
 private:
     IntlNumberFormatPrototype(VM&, Structure*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/JSDataViewPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSDataViewPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSDataViewPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -119,14 +119,6 @@
         vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
 }
 
-bool JSDataViewPrototype::getOwnPropertySlot(
-    JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(
-        exec, dataViewTable, jsCast<JSDataViewPrototype*>(object),
-        propertyName, slot);
-}
-
 template<typename Adaptor>
 EncodedJSValue getData(ExecState* exec)
 {

Modified: trunk/Source/_javascript_Core/runtime/JSDataViewPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSDataViewPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSDataViewPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -33,7 +33,7 @@
 class JSDataViewPrototype : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
 protected:
     JSDataViewPrototype(VM&, Structure*);
@@ -46,9 +46,6 @@
     DECLARE_INFO;
     
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue prototype);
-
-protected:
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/JSInternalPromiseConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSInternalPromiseConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSInternalPromiseConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -85,9 +85,4 @@
     return CallType::Host;
 }
 
-bool JSInternalPromiseConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<Base>(exec, internalPromiseConstructorTable, jsCast<JSInternalPromiseConstructor*>(object), propertyName, slot);
-}
-
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/JSInternalPromiseConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSInternalPromiseConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSInternalPromiseConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -36,7 +36,7 @@
 class JSInternalPromiseConstructor : public JSPromiseConstructor {
 public:
     typedef JSPromiseConstructor Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static JSInternalPromiseConstructor* create(VM&, Structure*, JSInternalPromisePrototype*, GetterSetter*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
@@ -47,7 +47,6 @@
     JSInternalPromiseConstructor(VM&, Structure*);
     static ConstructType getConstructData(JSCell*, ConstructData&);
     static CallType getCallData(JSCell*, CallData&);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/JSONObject.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSONObject.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSONObject.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -552,11 +552,6 @@
 
 // ECMA 15.8
 
-bool JSONObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, jsonTable, jsCast<JSONObject*>(object), propertyName, slot);
-}
-
 class Walker {
 public:
     Walker(ExecState* exec, Handle<JSObject> function, CallType callType, CallData callData)

Modified: trunk/Source/_javascript_Core/runtime/JSONObject.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSONObject.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSONObject.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -33,7 +33,7 @@
 class JSONObject : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static JSONObject* create(VM& vm, Structure* structure)
     {
@@ -54,7 +54,6 @@
 
 private:
     JSONObject(VM&, Structure*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 JS_EXPORT_PRIVATE JSValue JSONParse(ExecState*, const String&);

Modified: trunk/Source/_javascript_Core/runtime/JSObject.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSObject.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSObject.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -1674,6 +1674,17 @@
     return !result.isString();
 }
 
+bool JSObject::getOwnStaticPropertySlot(VM& vm, PropertyName propertyName, PropertySlot& slot)
+{
+    for (auto* info = classInfo(); info; info = info->parentClass) {
+        if (auto* table = info->staticPropHashTable) {
+            if (getStaticPropertySlotFromTable(vm, *table, this, propertyName, slot))
+                return true;
+        }
+    }
+    return false;
+}
+
 const HashTableValue* JSObject::findPropertyHashEntry(PropertyName propertyName) const
 {
     for (const ClassInfo* info = classInfo(); info; info = info->parentClass) {

Modified: trunk/Source/_javascript_Core/runtime/JSObject.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSObject.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSObject.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -87,7 +87,7 @@
     friend class JSCell;
     friend class JSFinalObject;
     friend class MarkedBlock;
-    JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(ExecState*, const HashTableValue*, JSObject*, PropertyName, PropertySlot&);
+    JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(VM&, const HashTableValue*, JSObject*, PropertyName, PropertySlot&);
 
     enum PutMode {
         PutModePut,
@@ -922,6 +922,7 @@
     JS_EXPORT_PRIVATE void fillGetterPropertySlot(PropertySlot&, JSValue, unsigned, PropertyOffset);
     void fillCustomGetterPropertySlot(PropertySlot&, JSValue, unsigned, Structure&);
 
+    JS_EXPORT_PRIVATE bool getOwnStaticPropertySlot(VM&, PropertyName, PropertySlot&);
     JS_EXPORT_PRIVATE const HashTableValue* findPropertyHashEntry(PropertyName) const;
         
     bool putIndexedDescriptor(ExecState*, SparseArrayEntry*, const PropertyDescriptor&, PropertyDescriptor& old);
@@ -1192,8 +1193,11 @@
 {
     unsigned attributes;
     PropertyOffset offset = structure.get(vm, propertyName, attributes);
-    if (!isValidOffset(offset))
-        return false;
+    if (!isValidOffset(offset)) {
+        if (!TypeInfo::hasStaticPropertyTable(inlineTypeFlags()))
+            return false;
+        return getOwnStaticPropertySlot(vm, propertyName, slot);
+    }
 
     // getPropertySlot relies on this method never returning index properties!
     ASSERT(!parseIndex(propertyName));

Modified: trunk/Source/_javascript_Core/runtime/JSPromiseConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSPromiseConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSPromiseConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -133,9 +133,4 @@
     return CallType::Host;
 }
 
-bool JSPromiseConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<Base>(exec, promiseConstructorTable, jsCast<JSPromiseConstructor*>(object), propertyName, slot);
-}
-
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/JSPromiseConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSPromiseConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSPromiseConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -37,15 +37,13 @@
 class JSPromiseConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static JSPromiseConstructor* create(VM&, Structure*, JSPromisePrototype*, GetterSetter* speciesSymbol);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
 
     DECLARE_INFO;
 
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-
 protected:
     JSPromiseConstructor(VM&, Structure*);
     void finishCreation(VM&, JSPromisePrototype*, GetterSetter*);

Modified: trunk/Source/_javascript_Core/runtime/JSPromisePrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSPromisePrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSPromisePrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -85,9 +85,4 @@
     JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().thenPrivateName(), promisePrototypeThenCodeGenerator, DontEnum | DontDelete | ReadOnly);
 }
 
-bool JSPromisePrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<Base>(exec, promisePrototypeTable, jsCast<JSPromisePrototype*>(object), propertyName, slot);
-}
-
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/JSPromisePrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSPromisePrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSPromisePrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -33,15 +33,13 @@
 class JSPromisePrototype : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static JSPromisePrototype* create(VM&, JSGlobalObject*, Structure*);
     static Structure* createStructure(VM&, JSGlobalObject*, JSValue);
 
     DECLARE_INFO;
 
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-
 protected:
     void finishCreation(VM&, Structure*);
     JSPromisePrototype(VM&, Structure*);

Modified: trunk/Source/_javascript_Core/runtime/JSTypeInfo.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/JSTypeInfo.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/JSTypeInfo.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -43,7 +43,7 @@
 static const unsigned InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero = 1 << 4;
 static const unsigned StructureIsImmortal = 1 << 5;
 static const unsigned OverridesToThis = 1 << 6; // If this is false then this returns something other than 'this'. Non-object cells that are visible to JS have this set as do some exotic objects.
-// There is one free bit at the end of the InlineTypeFlags.
+static const unsigned HasStaticPropertyTable = 1 << 7;
 
 static const unsigned ImplementsHasInstance = 1 << 8;
 static const unsigned OverridesGetPropertyNames = 1 << 9;
@@ -83,6 +83,7 @@
     bool typeOfShouldCallGetCallData() const { return isSetOnFlags1(TypeOfShouldCallGetCallData); }
     bool overridesGetOwnPropertySlot() const { return overridesGetOwnPropertySlot(inlineTypeFlags()); }
     static bool overridesGetOwnPropertySlot(InlineTypeFlags flags) { return flags & OverridesGetOwnPropertySlot; }
+    static bool hasStaticPropertyTable(InlineTypeFlags flags) { return flags & HasStaticPropertyTable; }
     bool interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero() const { return isSetOnFlags1(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero); }
     bool structureIsImmortal() const { return isSetOnFlags1(StructureIsImmortal); }
     bool overridesToThis() const { return isSetOnFlags1(OverridesToThis); }

Modified: trunk/Source/_javascript_Core/runtime/Lookup.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/Lookup.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/Lookup.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -27,9 +27,9 @@
 
 namespace JSC {
 
-void reifyStaticAccessor(VM& vm, const HashTableValue& value, JSObject& thisObj, PropertyName propertyName)
+void reifyStaticAccessor(VM& vm, const HashTableValue& value, JSObject& thisObject, PropertyName propertyName)
 {
-    JSGlobalObject* globalObject = thisObj.globalObject();
+    JSGlobalObject* globalObject = thisObject.globalObject();
     GetterSetter* accessor = GetterSetter::create(vm, globalObject);
     if (value.accessorGetter()) {
         String getterName = WTF::tryMakeString(ASCIILiteral("get "), String(*propertyName.publicName()));
@@ -39,50 +39,49 @@
             ? JSFunction::createBuiltinFunction(vm, value.builtinAccessorGetterGenerator()(vm), globalObject, getterName)
             : JSFunction::create(vm, globalObject, 0, getterName, value.accessorGetter()));
     }
-    thisObj.putDirectNonIndexAccessor(vm, propertyName, accessor, attributesForStructure(value.attributes()));
+    thisObject.putDirectNonIndexAccessor(vm, propertyName, accessor, attributesForStructure(value.attributes()));
 }
 
-bool setUpStaticFunctionSlot(ExecState* exec, const HashTableValue* entry, JSObject* thisObj, PropertyName propertyName, PropertySlot& slot)
+bool setUpStaticFunctionSlot(VM& vm, const HashTableValue* entry, JSObject* thisObject, PropertyName propertyName, PropertySlot& slot)
 {
-    ASSERT(thisObj->globalObject());
+    ASSERT(thisObject->globalObject());
     ASSERT(entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty);
-    VM& vm = exec->vm();
     unsigned attributes;
     bool isAccessor = entry->attributes() & Accessor;
-    PropertyOffset offset = thisObj->getDirectOffset(vm, propertyName, attributes);
+    PropertyOffset offset = thisObject->getDirectOffset(vm, propertyName, attributes);
 
     if (!isValidOffset(offset)) {
         // If a property is ever deleted from an object with a static table, then we reify
         // all static functions at that time - after this we shouldn't be re-adding anything.
-        if (thisObj->staticFunctionsReified())
+        if (thisObject->staticFunctionsReified())
             return false;
 
         if (entry->attributes() & Builtin)
-            thisObj->putDirectBuiltinFunction(vm, thisObj->globalObject(), propertyName, entry->builtinGenerator()(vm), attributesForStructure(entry->attributes()));
+            thisObject->putDirectBuiltinFunction(vm, thisObject->globalObject(), propertyName, entry->builtinGenerator()(vm), attributesForStructure(entry->attributes()));
         else if (entry->attributes() & Function) {
-            thisObj->putDirectNativeFunction(
-                vm, thisObj->globalObject(), propertyName, entry->functionLength(),
+            thisObject->putDirectNativeFunction(
+                vm, thisObject->globalObject(), propertyName, entry->functionLength(),
                 entry->function(), entry->intrinsic(), attributesForStructure(entry->attributes()));
         } else if (isAccessor)
-            reifyStaticAccessor(vm, *entry, *thisObj, propertyName);
+            reifyStaticAccessor(vm, *entry, *thisObject, propertyName);
         else if (entry->attributes() & CellProperty) {
             LazyCellProperty* property = bitwise_cast<LazyCellProperty*>(
-                bitwise_cast<char*>(thisObj) + entry->lazyCellPropertyOffset());
-            JSCell* result = property->get(thisObj);
-            thisObj->putDirect(vm, propertyName, result, attributesForStructure(entry->attributes()));
+                bitwise_cast<char*>(thisObject) + entry->lazyCellPropertyOffset());
+            JSCell* result = property->get(thisObject);
+            thisObject->putDirect(vm, propertyName, result, attributesForStructure(entry->attributes()));
         } else if (entry->attributes() & ClassStructure) {
             LazyClassStructure* structure = bitwise_cast<LazyClassStructure*>(
-                bitwise_cast<char*>(thisObj) + entry->lazyClassStructureOffset());
-            structure->get(jsCast<JSGlobalObject*>(thisObj));
+                bitwise_cast<char*>(thisObject) + entry->lazyClassStructureOffset());
+            structure->get(jsCast<JSGlobalObject*>(thisObject));
         } else if (entry->attributes() & PropertyCallback) {
-            JSValue result = entry->lazyPropertyCallback()(vm, thisObj);
-            thisObj->putDirect(vm, propertyName, result, attributesForStructure(entry->attributes()));
+            JSValue result = entry->lazyPropertyCallback()(vm, thisObject);
+            thisObject->putDirect(vm, propertyName, result, attributesForStructure(entry->attributes()));
         } else {
             dataLog("Static hashtable entry for ", propertyName, " has weird attributes: ", entry->attributes(), "\n");
             RELEASE_ASSERT_NOT_REACHED();
         }
 
-        offset = thisObj->getDirectOffset(vm, propertyName, attributes);
+        offset = thisObject->getDirectOffset(vm, propertyName, attributes);
         if (!isValidOffset(offset)) {
             dataLog("Static hashtable initialiation for ", propertyName, " did not produce a property.\n");
             RELEASE_ASSERT_NOT_REACHED();
@@ -90,9 +89,9 @@
     }
 
     if (isAccessor)
-        slot.setCacheableGetterSlot(thisObj, attributes, jsCast<GetterSetter*>(thisObj->getDirect(offset)), offset);
+        slot.setCacheableGetterSlot(thisObject, attributes, jsCast<GetterSetter*>(thisObject->getDirect(offset)), offset);
     else
-        slot.setValue(thisObj, attributes, thisObj->getDirect(offset), offset);
+        slot.setValue(thisObject, attributes, thisObject->getDirect(offset), offset);
     return true;
 }
 

Modified: trunk/Source/_javascript_Core/runtime/Lookup.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/Lookup.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/Lookup.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -191,7 +191,7 @@
     }
 };
 
-JS_EXPORT_PRIVATE bool setUpStaticFunctionSlot(ExecState*, const HashTableValue*, JSObject* thisObject, PropertyName, PropertySlot&);
+JS_EXPORT_PRIVATE bool setUpStaticFunctionSlot(VM&, const HashTableValue*, JSObject* thisObject, PropertyName, PropertySlot&);
 JS_EXPORT_PRIVATE void reifyStaticAccessor(VM&, const HashTableValue&, JSObject& thisObject, PropertyName);
 
 inline BuiltinGenerator HashTableValue::builtinAccessorGetterGenerator() const
@@ -208,6 +208,27 @@
     return reinterpret_cast<BuiltinGenerator>(m_values.value2);
 }
 
+inline bool getStaticPropertySlotFromTable(VM& vm, const HashTable& table, JSObject* thisObject, PropertyName propertyName, PropertySlot& slot)
+{
+    if (thisObject->staticFunctionsReified())
+        return false;
+
+    auto* entry = table.entry(propertyName);
+    if (!entry)
+        return false;
+
+    if (entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty)
+        return setUpStaticFunctionSlot(vm, entry, thisObject, propertyName, slot);
+
+    if (entry->attributes() & ConstantInteger) {
+        slot.setValue(thisObject, attributesForStructure(entry->attributes()), jsNumber(entry->constantInteger()));
+        return true;
+    }
+
+    slot.setCacheableCustom(thisObject, attributesForStructure(entry->attributes()), entry->propertyGetter());
+    return true;
+}
+
 /**
  * This method does it all (looking in the hashtable, checking for function
  * overrides, creating the function or retrieving from cache, calling
@@ -215,12 +236,12 @@
  * unknown property).
  */
 template <class ThisImp, class ParentImp>
-inline bool getStaticPropertySlot(ExecState* exec, const HashTable& table, ThisImp* thisObj, PropertyName propertyName, PropertySlot& slot)
+inline bool getStaticPropertySlot(ExecState* exec, const HashTable& table, ThisImp* thisObject, PropertyName propertyName, PropertySlot& slot)
 {
-    if (ParentImp::getOwnPropertySlot(thisObj, exec, propertyName, slot))
+    if (ParentImp::getOwnPropertySlot(thisObject, exec, propertyName, slot))
         return true;
 
-    if (thisObj->staticFunctionsReified())
+    if (thisObject->staticFunctionsReified())
         return false;
 
     auto* entry = table.entry(propertyName);
@@ -228,14 +249,14 @@
         return false;
 
     if (entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty)
-        return setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
+        return setUpStaticFunctionSlot(exec->vm(), entry, thisObject, propertyName, slot);
 
     if (entry->attributes() & ConstantInteger) {
-        slot.setValue(thisObj, attributesForStructure(entry->attributes()), jsNumber(entry->constantInteger()));
+        slot.setValue(thisObject, attributesForStructure(entry->attributes()), jsNumber(entry->constantInteger()));
         return true;
     }
 
-    slot.setCacheableCustom(thisObj, attributesForStructure(entry->attributes()), entry->propertyGetter());
+    slot.setCacheableCustom(thisObject, attributesForStructure(entry->attributes()), entry->propertyGetter());
     return true;
 }
 
@@ -245,19 +266,19 @@
  * a dummy getValueProperty.
  */
 template <class ParentImp>
-inline bool getStaticFunctionSlot(ExecState* exec, const HashTable& table, JSObject* thisObj, PropertyName propertyName, PropertySlot& slot)
+inline bool getStaticFunctionSlot(ExecState* exec, const HashTable& table, JSObject* thisObject, PropertyName propertyName, PropertySlot& slot)
 {
-    if (ParentImp::getOwnPropertySlot(thisObj, exec, propertyName, slot))
+    if (ParentImp::getOwnPropertySlot(thisObject, exec, propertyName, slot))
         return true;
 
-    if (thisObj->staticFunctionsReified())
+    if (thisObject->staticFunctionsReified())
         return false;
 
     auto* entry = table.entry(propertyName);
     if (!entry)
         return false;
 
-    return setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
+    return setUpStaticFunctionSlot(exec->vm(), entry, thisObject, propertyName, slot);
 }
 
 /**
@@ -265,12 +286,12 @@
  * Using this instead of getStaticPropertySlot removes the need for a FuncImp class.
  */
 template <class ThisImp, class ParentImp>
-inline bool getStaticValueSlot(ExecState* exec, const HashTable& table, ThisImp* thisObj, PropertyName propertyName, PropertySlot& slot)
+inline bool getStaticValueSlot(ExecState* exec, const HashTable& table, ThisImp* thisObject, PropertyName propertyName, PropertySlot& slot)
 {
-    if (ParentImp::getOwnPropertySlot(thisObj, exec, propertyName, slot))
+    if (ParentImp::getOwnPropertySlot(thisObject, exec, propertyName, slot))
         return true;
 
-    if (thisObj->staticFunctionsReified())
+    if (thisObject->staticFunctionsReified())
         return false;
 
     auto* entry = table.entry(propertyName);
@@ -280,11 +301,11 @@
     ASSERT(!(entry->attributes() & BuiltinOrFunctionOrAccessorOrLazyProperty));
 
     if (entry->attributes() & ConstantInteger) {
-        slot.setValue(thisObj, attributesForStructure(entry->attributes()), jsNumber(entry->constantInteger()));
+        slot.setValue(thisObject, attributesForStructure(entry->attributes()), jsNumber(entry->constantInteger()));
         return true;
     }
 
-    slot.setCacheableCustom(thisObj, attributesForStructure(entry->attributes()), entry->propertyGetter());
+    slot.setCacheableCustom(thisObject, attributesForStructure(entry->attributes()), entry->propertyGetter());
     return true;
 }
 

Modified: trunk/Source/_javascript_Core/runtime/MapPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/MapPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/MapPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -89,11 +89,6 @@
     JSC_NATIVE_GETTER(vm.propertyNames->size, mapProtoFuncSize, DontEnum | Accessor);
 }
 
-bool MapPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<Base>(exec, mapPrototypeTable, jsCast<MapPrototype*>(object), propertyName, slot);
-}
-
 ALWAYS_INLINE static JSMap* getMap(CallFrame* callFrame, JSValue thisValue)
 {
     if (!thisValue.isObject()) {

Modified: trunk/Source/_javascript_Core/runtime/MapPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/MapPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/MapPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -34,7 +34,7 @@
 public:
     typedef JSNonFinalObject Base;
 
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
 
     static MapPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -56,7 +56,6 @@
     {
     }
     void finishCreation(VM&, JSGlobalObject*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState*);

Modified: trunk/Source/_javascript_Core/runtime/ModuleLoaderObject.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ModuleLoaderObject.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ModuleLoaderObject.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -119,11 +119,6 @@
     putDirectWithoutTransition(vm, Identifier::fromString(&vm, "registry"), JSMap::create(vm, globalObject->mapStructure()));
 }
 
-bool ModuleLoaderObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<Base>(exec, moduleLoaderObjectTable, jsCast<ModuleLoaderObject*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions --------------------------------
 
 static String printableModuleKey(ExecState* exec, JSValue key)

Modified: trunk/Source/_javascript_Core/runtime/ModuleLoaderObject.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ModuleLoaderObject.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ModuleLoaderObject.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -37,7 +37,7 @@
     ModuleLoaderObject(VM&, Structure*);
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     enum Status {
         Fetch = 1,
@@ -77,8 +77,6 @@
     // Additional platform dependent hooked APIs.
     JSValue evaluate(ExecState*, JSValue key, JSValue moduleRecord);
 
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-
 protected:
     void finishCreation(VM&, JSGlobalObject*);
 };

Modified: trunk/Source/_javascript_Core/runtime/NumberPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/NumberPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/NumberPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -89,11 +89,6 @@
     ASSERT(inherits(info()));
 }
 
-bool NumberPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<NumberObject>(exec, numberPrototypeTable, jsCast<NumberPrototype*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions ---------------------------
 
 static ALWAYS_INLINE bool toThisNumber(JSValue thisValue, double& x)

Modified: trunk/Source/_javascript_Core/runtime/NumberPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/NumberPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/NumberPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -28,7 +28,7 @@
 class NumberPrototype : public NumberObject {
 public:
     typedef NumberObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static NumberPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -49,7 +49,6 @@
 
 private:
     NumberPrototype(VM&, Structure*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 EncodedJSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState*);

Modified: trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -113,11 +113,6 @@
     return definePropertyFunction;
 }
 
-bool ObjectConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, objectConstructorTable, jsCast<ObjectConstructor*>(object), propertyName, slot);
-}
-
 // ES 19.1.1.1 Object([value])
 static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, JSValue newTarget)
 {

Modified: trunk/Source/_javascript_Core/runtime/ObjectConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ObjectConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ObjectConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -38,7 +38,7 @@
 class ObjectConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static ObjectConstructor* create(VM& vm, JSGlobalObject* globalObject, Structure* structure, ObjectPrototype* objectPrototype)
     {
@@ -47,8 +47,6 @@
         return constructor;
     }
 
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-
     DECLARE_INFO;
 
     static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)

Modified: trunk/Source/_javascript_Core/runtime/ReflectObject.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ReflectObject.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ReflectObject.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -89,11 +89,6 @@
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->getOwnPropertyDescriptorPrivateName, reflectObjectGetOwnPropertyDescriptor, DontEnum | DontDelete | ReadOnly, 2);
 }
 
-bool ReflectObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<Base>(exec, reflectObjectTable, jsCast<ReflectObject*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions --------------------------------
 
 // https://tc39.github.io/ecma262/#sec-reflect.construct

Modified: trunk/Source/_javascript_Core/runtime/ReflectObject.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/ReflectObject.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/ReflectObject.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -36,7 +36,7 @@
 
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static ReflectObject* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -52,8 +52,6 @@
         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
     }
 
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-
 protected:
     void finishCreation(VM&, JSGlobalObject*);
 };

Modified: trunk/Source/_javascript_Core/runtime/RegExpConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/RegExpConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/RegExpConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -145,11 +145,6 @@
 {
     return m_cachedResult.rightContext(exec, this);
 }
-    
-bool RegExpConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<RegExpConstructor, InternalFunction>(exec, regExpConstructorTable, jsCast<RegExpConstructor*>(object), propertyName, slot);
-}
 
 template<int N>
 EncodedJSValue regExpConstructorDollar(ExecState* exec, EncodedJSValue thisValue, PropertyName, JSObject*)

Modified: trunk/Source/_javascript_Core/runtime/RegExpConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/RegExpConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/RegExpConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -34,7 +34,7 @@
 class RegExpConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static RegExpConstructor* create(VM& vm, Structure* structure, RegExpPrototype* regExpPrototype, GetterSetter* species)
     {
@@ -48,8 +48,6 @@
         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
     }
 
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
-
     DECLARE_INFO;
 
     MatchResult performMatch(VM&, RegExp*, JSString*, const String&, int startOffset, int** ovector);

Modified: trunk/Source/_javascript_Core/runtime/SetPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/SetPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/SetPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -83,12 +83,6 @@
     JSC_NATIVE_GETTER(vm.propertyNames->size, setProtoFuncSize, DontEnum | Accessor);
 }
 
-bool SetPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<Base>(exec, setPrototypeTable, jsCast<SetPrototype*>(object), propertyName, slot);
-}
-
-
 ALWAYS_INLINE static JSSet* getSet(CallFrame* callFrame, JSValue thisValue)
 {
     if (!thisValue.isObject()) {

Modified: trunk/Source/_javascript_Core/runtime/SetPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/SetPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/SetPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -34,7 +34,7 @@
 public:
     typedef JSNonFinalObject Base;
 
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
 
     static SetPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -56,7 +56,6 @@
     {
     }
     void finishCreation(VM&, JSGlobalObject*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 EncodedJSValue JSC_HOST_CALL privateFuncIsSet(ExecState*);

Modified: trunk/Source/_javascript_Core/runtime/StringConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/StringConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/StringConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -64,11 +64,6 @@
     putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
 }
 
-bool StringConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<InternalFunction>(exec, stringConstructorTable, jsCast<StringConstructor*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions --------------------------------
 
 static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec)

Modified: trunk/Source/_javascript_Core/runtime/StringConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/StringConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/StringConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -31,7 +31,7 @@
 class StringConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static StringConstructor* create(VM& vm, Structure* structure, StringPrototype* stringPrototype, GetterSetter*)
     {
@@ -52,8 +52,6 @@
     void finishCreation(VM&, StringPrototype*);
     static ConstructType getConstructData(JSCell*, ConstructData&);
     static CallType getCallData(JSCell*, CallData&);
-
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 JSCell* JSC_HOST_CALL stringFromCharCode(ExecState*, int32_t);

Modified: trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -58,9 +58,4 @@
     vm.prototypeMap.addPrototype(this);
 }
 
-bool StringIteratorPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<Base>(exec, stringIteratorPrototypeTable, jsCast<StringIteratorPrototype*>(object), propertyName, slot);
-}
-
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/StringIteratorPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -34,7 +34,7 @@
 class StringIteratorPrototype : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static StringIteratorPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -56,7 +56,6 @@
     {
     }
     void finishCreation(VM&, JSGlobalObject*);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 }

Modified: trunk/Source/_javascript_Core/runtime/StringPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/StringPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/StringPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -189,11 +189,6 @@
     return prototype;
 }
 
-bool StringPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<Base>(exec, stringPrototypeTable, jsCast<StringPrototype*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions --------------------------
 
 static NEVER_INLINE String substituteBackreferencesSlow(StringView replacement, StringView source, const int* ovector, RegExp* reg, size_t i)

Modified: trunk/Source/_javascript_Core/runtime/StringPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/StringPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/StringPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -36,7 +36,7 @@
 
 public:
     typedef StringObject Base;
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
 
     static StringPrototype* create(VM&, JSGlobalObject*, Structure*);
 
@@ -49,9 +49,6 @@
 
 protected:
     void finishCreation(VM&, JSGlobalObject*, JSString*);
-
-private:
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceGeneric(

Modified: trunk/Source/_javascript_Core/runtime/SymbolConstructor.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/SymbolConstructor.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/SymbolConstructor.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -73,11 +73,6 @@
     JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_WELL_KNOWN_SYMBOLS)
 }
 
-bool SymbolConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<Base>(exec, symbolConstructorTable, jsCast<SymbolConstructor*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions ---------------------------
 
 static EncodedJSValue JSC_HOST_CALL callSymbol(ExecState* exec)

Modified: trunk/Source/_javascript_Core/runtime/SymbolConstructor.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/SymbolConstructor.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/SymbolConstructor.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -38,7 +38,7 @@
 class SymbolConstructor : public InternalFunction {
 public:
     typedef InternalFunction Base;
-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
 
     static SymbolConstructor* create(VM& vm, Structure* structure, SymbolPrototype* prototype, GetterSetter*)
     {
@@ -61,7 +61,6 @@
     SymbolConstructor(VM&, Structure*);
     static ConstructType getConstructData(JSCell*, ConstructData&);
     static CallType getCallData(JSCell*, CallData&);
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/SymbolPrototype.cpp (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/SymbolPrototype.cpp	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/SymbolPrototype.cpp	2016-05-27 07:09:35 UTC (rev 201448)
@@ -65,11 +65,6 @@
     JSC_NATIVE_FUNCTION(vm.propertyNames->toPrimitiveSymbol, symbolProtoFuncValueOf, DontEnum | ReadOnly, 1);
 }
 
-bool SymbolPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &slot)
-{
-    return getStaticFunctionSlot<Base>(exec, symbolPrototypeTable, jsCast<SymbolPrototype*>(object), propertyName, slot);
-}
-
 // ------------------------------ Functions ---------------------------
 
 static const char* SymbolToStringTypeError = "Symbol.prototype.toString requires that |this| be a symbol or a symbol object";

Modified: trunk/Source/_javascript_Core/runtime/SymbolPrototype.h (201447 => 201448)


--- trunk/Source/_javascript_Core/runtime/SymbolPrototype.h	2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/_javascript_Core/runtime/SymbolPrototype.h	2016-05-27 07:09:35 UTC (rev 201448)
@@ -36,7 +36,7 @@
 class SymbolPrototype : public JSNonFinalObject {
 public:
     typedef JSNonFinalObject Base;
-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
 
     static SymbolPrototype* create(VM& vm, JSGlobalObject* globalObject, Structure* structure)
     {
@@ -55,9 +55,6 @@
 protected:
     SymbolPrototype(VM&, Structure*);
     void finishCreation(VM&, JSGlobalObject*);
-
-private:
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&);
 };
 STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(SymbolPrototype);
 
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to