Title: [267364] trunk/Source
Revision
267364
Author
[email protected]
Date
2020-09-21 13:41:07 -0700 (Mon, 21 Sep 2020)

Log Message

Functions should consistently enumerate length before name
https://bugs.webkit.org/show_bug.cgi?id=216789

Reviewed by Yusuke Suzuki.

Source/_javascript_Core:

In https://github.com/tc39/ecma262/pull/2116, which has been
approved to be merged into the main JS spec, it's expected that
all functions should have their length property enumerated before
the name property. To ensure this invariant, this patch moves the
length set into InternalFunction::finishCreation.

There are no new tests since tests will be added to test262 when
the spec PR is merged. Adding tests to stress just means we will
have the same test twice, which seems like a waste.

* API/JSCallbackFunction.cpp:
(JSC::JSCallbackFunction::finishCreation):
* API/ObjCCallbackFunction.mm:
(JSC::ObjCCallbackFunction::create):
* API/glib/JSCCallbackFunction.cpp:
(JSC::JSCCallbackFunction::create):
* runtime/AggregateErrorConstructor.cpp:
(JSC::AggregateErrorConstructor::finishCreation):
* runtime/ArrayConstructor.cpp:
(JSC::ArrayConstructor::finishCreation):
* runtime/AsyncFunctionConstructor.cpp:
(JSC::AsyncFunctionConstructor::finishCreation):
* runtime/AsyncGeneratorFunctionConstructor.cpp:
(JSC::AsyncGeneratorFunctionConstructor::finishCreation):
* runtime/BigIntConstructor.cpp:
(JSC::BigIntConstructor::finishCreation):
* runtime/BooleanConstructor.cpp:
(JSC::BooleanConstructor::finishCreation):
* runtime/DateConstructor.cpp:
(JSC::DateConstructor::finishCreation):
* runtime/ErrorConstructor.cpp:
(JSC::ErrorConstructor::finishCreation):
* runtime/FinalizationRegistryConstructor.cpp:
(JSC::FinalizationRegistryConstructor::finishCreation):
* runtime/FunctionConstructor.cpp:
(JSC::FunctionConstructor::finishCreation):
* runtime/FunctionPrototype.cpp:
(JSC::FunctionPrototype::finishCreation):
* runtime/GeneratorFunctionConstructor.cpp:
(JSC::GeneratorFunctionConstructor::finishCreation):
* runtime/InternalFunction.cpp:
(JSC::InternalFunction::finishCreation):
(JSC::InternalFunction::createFunctionThatMasqueradesAsUndefined):
* runtime/InternalFunction.h:
* runtime/IntlCollatorConstructor.cpp:
(JSC::IntlCollatorConstructor::finishCreation):
* runtime/IntlDateTimeFormatConstructor.cpp:
(JSC::IntlDateTimeFormatConstructor::finishCreation):
* runtime/IntlDisplayNamesConstructor.cpp:
(JSC::IntlDisplayNamesConstructor::finishCreation):
* runtime/IntlLocaleConstructor.cpp:
(JSC::IntlLocaleConstructor::finishCreation):
* runtime/IntlNumberFormatConstructor.cpp:
(JSC::IntlNumberFormatConstructor::finishCreation):
* runtime/IntlPluralRulesConstructor.cpp:
(JSC::IntlPluralRulesConstructor::finishCreation):
* runtime/IntlRelativeTimeFormatConstructor.cpp:
(JSC::IntlRelativeTimeFormatConstructor::finishCreation):
* runtime/IntlSegmenterConstructor.cpp:
(JSC::IntlSegmenterConstructor::finishCreation):
* runtime/JSArrayBufferConstructor.cpp:
(JSC::JSGenericArrayBufferConstructor<sharingMode>::finishCreation):
* runtime/JSGenericTypedArrayViewConstructorInlines.h:
(JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
* runtime/JSTypedArrayViewConstructor.cpp:
(JSC::JSTypedArrayViewConstructor::finishCreation):
* runtime/MapConstructor.cpp:
(JSC::MapConstructor::finishCreation):
* runtime/NativeErrorConstructor.cpp:
(JSC::NativeErrorConstructorBase::finishCreation):
* runtime/NullGetterFunction.h:
* runtime/NullSetterFunction.h:
* runtime/NumberConstructor.cpp:
(JSC::NumberConstructor::finishCreation):
* runtime/ObjectConstructor.cpp:
(JSC::ObjectConstructor::finishCreation):
* runtime/ProxyConstructor.cpp:
(JSC::ProxyConstructor::finishCreation):
* runtime/ProxyRevoke.cpp:
(JSC::ProxyRevoke::finishCreation):
* runtime/RegExpConstructor.cpp:
(JSC::RegExpConstructor::finishCreation):
* runtime/SetConstructor.cpp:
(JSC::SetConstructor::finishCreation):
* runtime/StringConstructor.cpp:
(JSC::StringConstructor::finishCreation):
* runtime/SymbolConstructor.cpp:
(JSC::SymbolConstructor::finishCreation):
* runtime/WeakMapConstructor.cpp:
(JSC::WeakMapConstructor::finishCreation):
* runtime/WeakObjectRefConstructor.cpp:
(JSC::WeakObjectRefConstructor::finishCreation):
* runtime/WeakSetConstructor.cpp:
(JSC::WeakSetConstructor::finishCreation):
* wasm/js/WebAssemblyCompileErrorConstructor.cpp:
(JSC::WebAssemblyCompileErrorConstructor::finishCreation):
* wasm/js/WebAssemblyGlobalConstructor.cpp:
(JSC::WebAssemblyGlobalConstructor::finishCreation):
* wasm/js/WebAssemblyInstanceConstructor.cpp:
(JSC::WebAssemblyInstanceConstructor::finishCreation):
* wasm/js/WebAssemblyLinkErrorConstructor.cpp:
(JSC::WebAssemblyLinkErrorConstructor::finishCreation):
* wasm/js/WebAssemblyMemoryConstructor.cpp:
(JSC::WebAssemblyMemoryConstructor::finishCreation):
* wasm/js/WebAssemblyModuleConstructor.cpp:
(JSC::WebAssemblyModuleConstructor::finishCreation):
* wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
(JSC::WebAssemblyRuntimeErrorConstructor::finishCreation):
* wasm/js/WebAssemblyTableConstructor.cpp:
(JSC::WebAssemblyTableConstructor::finishCreation):

Source/WebCore:

RuntimeMethod inherits from InternalFunction which now sets length by default.
RuntimeMethod intercepts length in getOwnPropertySlot so the value we pick
doesn't actually matter. Technically, this uses a little extra memory but
that's not too big of a deal because RuntimeMethod's are rare (and I believe
deprecated).

* bridge/runtime_method.cpp:
(JSC::RuntimeMethod::finishCreation):

Source/WebKit:

JSNPMethod inherits from InternalFunction which now sets length by default.
I chose 0 because it looks like this function doesn't directly look at any
arguments and I doubt anyone is looking at the length anyway.

* WebProcess/Plugins/Netscape/JSNPMethod.cpp:
(WebKit::JSNPMethod::finishCreation):

Modified Paths

Diff

Modified: trunk/Source/_javascript_Core/API/JSCallbackFunction.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/API/JSCallbackFunction.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/API/JSCallbackFunction.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -43,7 +43,7 @@
 
 void JSCallbackFunction::finishCreation(VM& vm, const String& name)
 {
-    Base::finishCreation(vm, name);
+    Base::finishCreation(vm, 0, name);
     ASSERT(inherits(vm, info()));
 }
 

Modified: trunk/Source/_javascript_Core/API/ObjCCallbackFunction.mm (267363 => 267364)


--- trunk/Source/_javascript_Core/API/ObjCCallbackFunction.mm	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/API/ObjCCallbackFunction.mm	2020-09-21 20:41:07 UTC (rev 267364)
@@ -547,7 +547,7 @@
 {
     Structure* structure = globalObject->objcCallbackFunctionStructure();
     ObjCCallbackFunction* function = new (NotNull, allocateCell<ObjCCallbackFunction>(vm.heap)) ObjCCallbackFunction(vm, structure, objCCallbackFunctionCallAsFunction, objCCallbackFunctionCallAsConstructor, WTFMove(impl));
-    function->finishCreation(vm, name);
+    function->finishCreation(vm, 0, name);
     return function;
 }
 

Modified: trunk/Source/_javascript_Core/API/glib/JSCCallbackFunction.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/API/glib/JSCCallbackFunction.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/API/glib/JSCCallbackFunction.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -56,7 +56,7 @@
 {
     Structure* structure = globalObject->glibCallbackFunctionStructure();
     JSCCallbackFunction* function = new (NotNull, allocateCell<JSCCallbackFunction>(vm.heap)) JSCCallbackFunction(vm, structure, type, jscClass, WTFMove(closure), returnType, WTFMove(parameters));
-    function->finishCreation(vm, name);
+    function->finishCreation(vm, 0, name);
     return function;
 }
 

Modified: trunk/Source/_javascript_Core/ChangeLog (267363 => 267364)


--- trunk/Source/_javascript_Core/ChangeLog	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/ChangeLog	2020-09-21 20:41:07 UTC (rev 267364)
@@ -1,3 +1,121 @@
+2020-09-21  Keith Miller  <[email protected]>
+
+        Functions should consistently enumerate length before name
+        https://bugs.webkit.org/show_bug.cgi?id=216789
+
+        Reviewed by Yusuke Suzuki.
+
+        In https://github.com/tc39/ecma262/pull/2116, which has been
+        approved to be merged into the main JS spec, it's expected that
+        all functions should have their length property enumerated before
+        the name property. To ensure this invariant, this patch moves the
+        length set into InternalFunction::finishCreation.
+
+        There are no new tests since tests will be added to test262 when
+        the spec PR is merged. Adding tests to stress just means we will
+        have the same test twice, which seems like a waste.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::finishCreation):
+        * API/ObjCCallbackFunction.mm:
+        (JSC::ObjCCallbackFunction::create):
+        * API/glib/JSCCallbackFunction.cpp:
+        (JSC::JSCCallbackFunction::create):
+        * runtime/AggregateErrorConstructor.cpp:
+        (JSC::AggregateErrorConstructor::finishCreation):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        * runtime/AsyncFunctionConstructor.cpp:
+        (JSC::AsyncFunctionConstructor::finishCreation):
+        * runtime/AsyncGeneratorFunctionConstructor.cpp:
+        (JSC::AsyncGeneratorFunctionConstructor::finishCreation):
+        * runtime/BigIntConstructor.cpp:
+        (JSC::BigIntConstructor::finishCreation):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::finishCreation):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::finishCreation):
+        * runtime/FinalizationRegistryConstructor.cpp:
+        (JSC::FinalizationRegistryConstructor::finishCreation):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::finishCreation):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::finishCreation):
+        * runtime/GeneratorFunctionConstructor.cpp:
+        (JSC::GeneratorFunctionConstructor::finishCreation):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::finishCreation):
+        (JSC::InternalFunction::createFunctionThatMasqueradesAsUndefined):
+        * runtime/InternalFunction.h:
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::IntlCollatorConstructor::finishCreation):
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::IntlDateTimeFormatConstructor::finishCreation):
+        * runtime/IntlDisplayNamesConstructor.cpp:
+        (JSC::IntlDisplayNamesConstructor::finishCreation):
+        * runtime/IntlLocaleConstructor.cpp:
+        (JSC::IntlLocaleConstructor::finishCreation):
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::IntlNumberFormatConstructor::finishCreation):
+        * runtime/IntlPluralRulesConstructor.cpp:
+        (JSC::IntlPluralRulesConstructor::finishCreation):
+        * runtime/IntlRelativeTimeFormatConstructor.cpp:
+        (JSC::IntlRelativeTimeFormatConstructor::finishCreation):
+        * runtime/IntlSegmenterConstructor.cpp:
+        (JSC::IntlSegmenterConstructor::finishCreation):
+        * runtime/JSArrayBufferConstructor.cpp:
+        (JSC::JSGenericArrayBufferConstructor<sharingMode>::finishCreation):
+        * runtime/JSGenericTypedArrayViewConstructorInlines.h:
+        (JSC::JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::JSTypedArrayViewConstructor::finishCreation):
+        * runtime/MapConstructor.cpp:
+        (JSC::MapConstructor::finishCreation):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructorBase::finishCreation):
+        * runtime/NullGetterFunction.h:
+        * runtime/NullSetterFunction.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::finishCreation):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::finishCreation):
+        * runtime/ProxyConstructor.cpp:
+        (JSC::ProxyConstructor::finishCreation):
+        * runtime/ProxyRevoke.cpp:
+        (JSC::ProxyRevoke::finishCreation):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::finishCreation):
+        * runtime/SetConstructor.cpp:
+        (JSC::SetConstructor::finishCreation):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::finishCreation):
+        * runtime/SymbolConstructor.cpp:
+        (JSC::SymbolConstructor::finishCreation):
+        * runtime/WeakMapConstructor.cpp:
+        (JSC::WeakMapConstructor::finishCreation):
+        * runtime/WeakObjectRefConstructor.cpp:
+        (JSC::WeakObjectRefConstructor::finishCreation):
+        * runtime/WeakSetConstructor.cpp:
+        (JSC::WeakSetConstructor::finishCreation):
+        * wasm/js/WebAssemblyCompileErrorConstructor.cpp:
+        (JSC::WebAssemblyCompileErrorConstructor::finishCreation):
+        * wasm/js/WebAssemblyGlobalConstructor.cpp:
+        (JSC::WebAssemblyGlobalConstructor::finishCreation):
+        * wasm/js/WebAssemblyInstanceConstructor.cpp:
+        (JSC::WebAssemblyInstanceConstructor::finishCreation):
+        * wasm/js/WebAssemblyLinkErrorConstructor.cpp:
+        (JSC::WebAssemblyLinkErrorConstructor::finishCreation):
+        * wasm/js/WebAssemblyMemoryConstructor.cpp:
+        (JSC::WebAssemblyMemoryConstructor::finishCreation):
+        * wasm/js/WebAssemblyModuleConstructor.cpp:
+        (JSC::WebAssemblyModuleConstructor::finishCreation):
+        * wasm/js/WebAssemblyRuntimeErrorConstructor.cpp:
+        (JSC::WebAssemblyRuntimeErrorConstructor::finishCreation):
+        * wasm/js/WebAssemblyTableConstructor.cpp:
+        (JSC::WebAssemblyTableConstructor::finishCreation):
+
 2020-09-21  Yusuke Suzuki  <[email protected]>
 
         [JSC] Proxy should be trapped if base value is primitive

Modified: trunk/Source/_javascript_Core/runtime/AggregateErrorConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/AggregateErrorConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/AggregateErrorConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -49,10 +49,9 @@
 
 void AggregateErrorConstructor::finishCreation(VM& vm, AggregateErrorPrototype* prototype)
 {
-    Base::finishCreation(vm, errorTypeName(ErrorType::AggregateError), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 2, errorTypeName(ErrorType::AggregateError), PropertyAdditionMode::WithoutStructureTransition);
     ASSERT(inherits(vm, info()));
 
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(2), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 

Modified: trunk/Source/_javascript_Core/runtime/ArrayConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/ArrayConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/ArrayConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -53,9 +53,8 @@
 
 void ArrayConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, ArrayPrototype* arrayPrototype, GetterSetter* speciesSymbol)
 {
-    Base::finishCreation(vm, vm.propertyNames->Array.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, vm.propertyNames->Array.string(), PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, arrayPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->isArray, arrayConstructorIsArrayCodeGenerator, static_cast<unsigned>(PropertyAttribute::DontEnum));
 }

Modified: trunk/Source/_javascript_Core/runtime/AsyncFunctionConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/AsyncFunctionConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/AsyncFunctionConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -55,9 +55,8 @@
 
 void AsyncFunctionConstructor::finishCreation(VM& vm, AsyncFunctionPrototype* prototype)
 {
-    Base::finishCreation(vm, "AsyncFunction"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "AsyncFunction"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/AsyncGeneratorFunctionConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/AsyncGeneratorFunctionConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/AsyncGeneratorFunctionConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -55,11 +55,8 @@
 
 void AsyncGeneratorFunctionConstructor::finishCreation(VM& vm, AsyncGeneratorFunctionPrototype* prototype)
 {
-    Base::finishCreation(vm, "AsyncGeneratorFunction"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "AsyncGeneratorFunction"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-
-    // Number of arguments for constructor
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/BigIntConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/BigIntConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/BigIntConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -63,11 +63,10 @@
 
 void BigIntConstructor::finishCreation(VM& vm, BigIntPrototype* bigIntPrototype)
 {
-    Base::finishCreation(vm, "BigInt"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "BigInt"_s, PropertyAdditionMode::WithoutStructureTransition);
     ASSERT(inherits(vm, info()));
 
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, bigIntPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------

Modified: trunk/Source/_javascript_Core/runtime/BooleanConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/BooleanConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/BooleanConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -61,9 +61,8 @@
 
 void BooleanConstructor::finishCreation(VM& vm, BooleanPrototype* booleanPrototype)
 {
-    Base::finishCreation(vm, vm.propertyNames->Boolean.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, vm.propertyNames->Boolean.string(), PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, booleanPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 JSObject* constructBooleanFromImmediateBoolean(JSGlobalObject* globalObject, JSValue immediateBooleanValue)

Modified: trunk/Source/_javascript_Core/runtime/DateConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/DateConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/DateConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -62,9 +62,8 @@
 
 void DateConstructor::finishCreation(VM& vm, DatePrototype* datePrototype)
 {
-    Base::finishCreation(vm, vm.propertyNames->Date.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 7, vm.propertyNames->Date.string(), PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, datePrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(7), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 static double millisecondsFromComponents(JSGlobalObject* globalObject, const ArgList& args, WTF::TimeType timeType)

Modified: trunk/Source/_javascript_Core/runtime/ErrorConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/ErrorConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/ErrorConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -40,10 +40,9 @@
 
 void ErrorConstructor::finishCreation(VM& vm, ErrorPrototype* errorPrototype)
 {
-    Base::finishCreation(vm, vm.propertyNames->Error.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, vm.propertyNames->Error.string(), PropertyAdditionMode::WithoutStructureTransition);
     // ECMA 15.11.3.1 Error.prototype
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, errorPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectWithoutTransition(vm, vm.propertyNames->stackTraceLimit, jsNumber(globalObject()->stackTraceLimit().valueOr(Options::defaultErrorStackTraceLimit())), static_cast<unsigned>(PropertyAttribute::None));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/FinalizationRegistryConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/FinalizationRegistryConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/FinalizationRegistryConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -41,9 +41,8 @@
 
 void FinalizationRegistryConstructor::finishCreation(VM& vm, FinalizationRegistryPrototype* prototype)
 {
-    Base::finishCreation(vm, "FinalizationRegistry"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "FinalizationRegistry"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 }
 
 static EncodedJSValue JSC_HOST_CALL callFinalizationRegistry(JSGlobalObject*, CallFrame*);

Modified: trunk/Source/_javascript_Core/runtime/FunctionConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/FunctionConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/FunctionConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -57,9 +57,8 @@
 
 void FunctionConstructor::finishCreation(VM& vm, FunctionPrototype* functionPrototype)
 {
-    Base::finishCreation(vm, vm.propertyNames->Function.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, vm.propertyNames->Function.string(), PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, functionPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 // ECMA 15.3.2 The Function Constructor

Modified: trunk/Source/_javascript_Core/runtime/FunctionPrototype.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/FunctionPrototype.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/FunctionPrototype.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -47,9 +47,8 @@
 
 void FunctionPrototype::finishCreation(VM& vm, const String& name)
 {
-    Base::finishCreation(vm, name, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, name, PropertyAdditionMode::WithoutStructureTransition);
     ASSERT(inherits(vm, info()));
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 void FunctionPrototype::addFunctionProperties(VM& vm, JSGlobalObject* globalObject, JSFunction** callFunction, JSFunction** applyFunction, JSFunction** hasInstanceSymbolFunction)

Modified: trunk/Source/_javascript_Core/runtime/GeneratorFunctionConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/GeneratorFunctionConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/GeneratorFunctionConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -55,9 +55,8 @@
 
 void GeneratorFunctionConstructor::finishCreation(VM& vm, GeneratorFunctionPrototype* generatorFunctionPrototype)
 {
-    Base::finishCreation(vm, "GeneratorFunction"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "GeneratorFunction"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, generatorFunctionPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 } // namespace JSC

Modified: trunk/Source/_javascript_Core/runtime/InternalFunction.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/InternalFunction.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/InternalFunction.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -43,7 +43,7 @@
     ASSERT(m_functionForConstruct);
 }
 
-void InternalFunction::finishCreation(VM& vm, const String& name, NameAdditionMode nameAdditionMode)
+void InternalFunction::finishCreation(VM& vm, unsigned length, const String& name, PropertyAdditionMode nameAdditionMode)
 {
     Base::finishCreation(vm);
     ASSERT(jsDynamicCast<InternalFunction*>(vm, this));
@@ -51,12 +51,17 @@
     ASSERT(methodTable(vm)->getCallData == InternalFunction::info()->methodTable.getCallData);
     ASSERT(methodTable(vm)->getConstructData == InternalFunction::info()->methodTable.getConstructData);
     ASSERT(type() == InternalFunctionType || type() == NullSetterFunctionType);
+
     JSString* nameString = jsString(vm, name);
     m_originalName.set(vm, this, nameString);
-    if (nameAdditionMode == NameAdditionMode::WithStructureTransition)
+    // The enumeration order is length followed by name. So, we make sure to add the properties in that order.
+    if (nameAdditionMode == PropertyAdditionMode::WithStructureTransition) {
+        putDirect(vm, vm.propertyNames->length, jsNumber(length), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
         putDirect(vm, vm.propertyNames->name, nameString, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
-    else
+    } else {
+        putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(length), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
         putDirectWithoutTransition(vm, vm.propertyNames->name, nameString, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
+    }
 }
 
 void InternalFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
@@ -159,8 +164,7 @@
     Structure* structure = Structure::create(vm, globalObject, globalObject->objectPrototype(), TypeInfo(InternalFunctionType, InternalFunction::StructureFlags | MasqueradesAsUndefined), InternalFunction::info());
     globalObject->masqueradesAsUndefinedWatchpoint()->fireAll(globalObject->vm(), "Allocated masquerading object");
     InternalFunction* function = new (NotNull, allocateCell<InternalFunction>(vm.heap)) InternalFunction(vm, structure, nativeFunction);
-    function->finishCreation(vm, name, NameAdditionMode::WithoutStructureTransition);
-    function->putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(length), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
+    function->finishCreation(vm, length, name, PropertyAdditionMode::WithoutStructureTransition);
     return function;
 }
 

Modified: trunk/Source/_javascript_Core/runtime/InternalFunction.h (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/InternalFunction.h	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/InternalFunction.h	2020-09-21 20:41:07 UTC (rev 267364)
@@ -86,8 +86,8 @@
 protected:
     JS_EXPORT_PRIVATE InternalFunction(VM&, Structure*, NativeFunction functionForCall, NativeFunction functionForConstruct = nullptr);
 
-    enum class NameAdditionMode { WithStructureTransition, WithoutStructureTransition };
-    JS_EXPORT_PRIVATE void finishCreation(VM&, const String& name, NameAdditionMode = NameAdditionMode::WithStructureTransition);
+    enum class PropertyAdditionMode { WithStructureTransition, WithoutStructureTransition };
+    JS_EXPORT_PRIVATE void finishCreation(VM&, unsigned length, const String& name, PropertyAdditionMode = PropertyAdditionMode::WithStructureTransition);
 
     JS_EXPORT_PRIVATE static CallData getConstructData(JSCell*);
     JS_EXPORT_PRIVATE static CallData getCallData(JSCell*);

Modified: trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/IntlCollatorConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -75,9 +75,8 @@
 
 void IntlCollatorConstructor::finishCreation(VM& vm, IntlCollatorPrototype* collatorPrototype)
 {
-    Base::finishCreation(vm, "Collator"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "Collator"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, collatorPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     collatorPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/IntlDateTimeFormatConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -74,9 +74,8 @@
 
 void IntlDateTimeFormatConstructor::finishCreation(VM& vm, IntlDateTimeFormatPrototype* dateTimeFormatPrototype)
 {
-    Base::finishCreation(vm, "DateTimeFormat"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "DateTimeFormat"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, dateTimeFormatPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructIntlDateTimeFormat(JSGlobalObject* globalObject, CallFrame* callFrame)

Modified: trunk/Source/_javascript_Core/runtime/IntlDisplayNamesConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/IntlDisplayNamesConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/IntlDisplayNamesConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -72,9 +72,8 @@
 
 void IntlDisplayNamesConstructor::finishCreation(VM& vm, IntlDisplayNamesPrototype* displayNamesPrototype)
 {
-    Base::finishCreation(vm, "DisplayNames"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 2, "DisplayNames"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, displayNamesPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(2), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     displayNamesPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/IntlLocaleConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/IntlLocaleConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/IntlLocaleConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -58,9 +58,8 @@
 
 void IntlLocaleConstructor::finishCreation(VM& vm, IntlLocalePrototype* localePrototype)
 {
-    Base::finishCreation(vm, "Locale"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "Locale"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, localePrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     localePrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/IntlNumberFormatConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -74,9 +74,8 @@
 
 void IntlNumberFormatConstructor::finishCreation(VM& vm, IntlNumberFormatPrototype* numberFormatPrototype)
 {
-    Base::finishCreation(vm, "NumberFormat"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "NumberFormat"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, numberFormatPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 static EncodedJSValue JSC_HOST_CALL constructIntlNumberFormat(JSGlobalObject* globalObject, CallFrame* callFrame)

Modified: trunk/Source/_javascript_Core/runtime/IntlPluralRulesConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/IntlPluralRulesConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/IntlPluralRulesConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -74,9 +74,8 @@
 
 void IntlPluralRulesConstructor::finishCreation(VM& vm, IntlPluralRulesPrototype* pluralRulesPrototype)
 {
-    Base::finishCreation(vm, "PluralRules"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "PluralRules"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, pluralRulesPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     pluralRulesPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/IntlRelativeTimeFormatConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/IntlRelativeTimeFormatConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/IntlRelativeTimeFormatConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -73,9 +73,8 @@
 
 void IntlRelativeTimeFormatConstructor::finishCreation(VM& vm, IntlRelativeTimeFormatPrototype* relativeTimeFormatPrototype)
 {
-    Base::finishCreation(vm, "RelativeTimeFormat"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "RelativeTimeFormat"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, relativeTimeFormatPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     relativeTimeFormatPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/IntlSegmenterConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/IntlSegmenterConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/IntlSegmenterConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -72,9 +72,8 @@
 
 void IntlSegmenterConstructor::finishCreation(VM& vm, IntlSegmenterPrototype* segmenterPrototype)
 {
-    Base::finishCreation(vm, "Segmenter"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "Segmenter"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, segmenterPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
     segmenterPrototype->putDirectWithoutTransition(vm, vm.propertyNames->constructor, this, static_cast<unsigned>(PropertyAttribute::DontEnum));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/JSArrayBufferConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/JSArrayBufferConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/JSArrayBufferConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -57,9 +57,8 @@
 template<ArrayBufferSharingMode sharingMode>
 void JSGenericArrayBufferConstructor<sharingMode>::finishCreation(VM& vm, JSArrayBufferPrototype* prototype, GetterSetter* speciesSymbol)
 {
-    Base::finishCreation(vm, arrayBufferSharingModeName(sharingMode), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, arrayBufferSharingModeName(sharingMode), PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 
     if (sharingMode == ArrayBufferSharingMode::Default) {

Modified: trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewConstructorInlines.h (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewConstructorInlines.h	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/JSGenericTypedArrayViewConstructorInlines.h	2020-09-21 20:41:07 UTC (rev 267364)
@@ -52,9 +52,8 @@
 template<typename ViewClass>
 void JSGenericTypedArrayViewConstructor<ViewClass>::finishCreation(VM& vm, JSGlobalObject* globalObject, JSObject* prototype, const String& name, FunctionExecutable* privateAllocator)
 {
-    Base::finishCreation(vm, name, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, ViewClass::TypedArrayStorageType == TypeDataView ? 1 : 3, name, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(ViewClass::TypedArrayStorageType == TypeDataView ? 1 : 3), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectWithoutTransition(vm, vm.propertyNames->BYTES_PER_ELEMENT, jsNumber(ViewClass::elementSize), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly | PropertyAttribute::DontDelete);
 
     if (privateAllocator)

Modified: trunk/Source/_javascript_Core/runtime/JSTypedArrayViewConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/JSTypedArrayViewConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/JSTypedArrayViewConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -43,9 +43,8 @@
 
 void JSTypedArrayViewConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, JSTypedArrayViewPrototype* prototype, GetterSetter* speciesSymbol)
 {
-    Base::finishCreation(vm, "TypedArray"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "TypedArray"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 
     JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->of, typedArrayConstructorOfCodeGenerator, static_cast<unsigned>(PropertyAttribute::DontEnum));

Modified: trunk/Source/_javascript_Core/runtime/MapConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/MapConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/MapConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -37,9 +37,8 @@
 
 void MapConstructor::finishCreation(VM& vm, MapPrototype* mapPrototype, GetterSetter* speciesSymbol)
 {
-    Base::finishCreation(vm, "Map"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "Map"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, mapPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 

Modified: trunk/Source/_javascript_Core/runtime/NativeErrorConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/NativeErrorConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/NativeErrorConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -39,10 +39,9 @@
 
 void NativeErrorConstructorBase::finishCreation(VM& vm, NativeErrorPrototype* prototype, ErrorType errorType)
 {
-    Base::finishCreation(vm, errorTypeName(errorType), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, errorTypeName(errorType), PropertyAdditionMode::WithoutStructureTransition);
     ASSERT(inherits(vm, info()));
     
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 

Modified: trunk/Source/_javascript_Core/runtime/NullGetterFunction.h (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/NullGetterFunction.h	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/NullGetterFunction.h	2020-09-21 20:41:07 UTC (rev 267364)
@@ -37,7 +37,7 @@
     {
         // Since NullGetterFunction is per JSGlobalObject, we use put-without-transition in InternalFunction::finishCreation.
         NullGetterFunction* function = new (NotNull, allocateCell< NullGetterFunction>(vm.heap))  NullGetterFunction(vm, structure);
-        function->finishCreation(vm, String(), NameAdditionMode::WithoutStructureTransition);
+        function->finishCreation(vm, 0, String(), PropertyAdditionMode::WithoutStructureTransition);
         return function;
     }
 

Modified: trunk/Source/_javascript_Core/runtime/NullSetterFunction.h (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/NullSetterFunction.h	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/NullSetterFunction.h	2020-09-21 20:41:07 UTC (rev 267364)
@@ -35,8 +35,8 @@
 
     static NullSetterFunction* create(VM& vm, Structure* structure, ECMAMode ecmaMode)
     {
-        NullSetterFunction* function = new (NotNull, allocateCell< NullSetterFunction>(vm.heap))  NullSetterFunction(vm, structure, ecmaMode);
-        function->finishCreation(vm, String());
+        NullSetterFunction* function = new (NotNull, allocateCell<NullSetterFunction>(vm.heap))  NullSetterFunction(vm, structure, ecmaMode);
+        function->finishCreation(vm, 0, String());
         return function;
     }
 

Modified: trunk/Source/_javascript_Core/runtime/NumberConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/NumberConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/NumberConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -59,13 +59,12 @@
 
 void NumberConstructor::finishCreation(VM& vm, NumberPrototype* numberPrototype)
 {
-    Base::finishCreation(vm, vm.propertyNames->Number.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, vm.propertyNames->Number.string(), PropertyAdditionMode::WithoutStructureTransition);
     ASSERT(inherits(vm, info()));
 
     JSGlobalObject* globalObject = numberPrototype->globalObject(vm);
 
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, numberPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 
     putDirectWithoutTransition(vm, Identifier::fromString(vm, "EPSILON"), jsDoubleNumber(std::numeric_limits<double>::epsilon()), PropertyAttribute::DontDelete | PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectWithoutTransition(vm, Identifier::fromString(vm, "MAX_VALUE"), jsDoubleNumber(1.7976931348623157E+308), PropertyAttribute::DontDelete | PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);

Modified: trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/ObjectConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -93,10 +93,9 @@
 
 void ObjectConstructor::finishCreation(VM& vm, JSGlobalObject* globalObject, ObjectPrototype* objectPrototype)
 {
-    Base::finishCreation(vm, vm.propertyNames->Object.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, vm.propertyNames->Object.string(), PropertyAdditionMode::WithoutStructureTransition);
 
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, objectPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().createPrivateName(), objectConstructorCreate, static_cast<unsigned>(PropertyAttribute::DontEnum), 2);
     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames->builtinNames().definePropertyPrivateName(), objectConstructorDefineProperty, static_cast<unsigned>(PropertyAttribute::DontEnum), 3);

Modified: trunk/Source/_javascript_Core/runtime/ProxyConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/ProxyConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/ProxyConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -75,8 +75,7 @@
 
 void ProxyConstructor::finishCreation(VM& vm, const char* name, JSGlobalObject* globalObject)
 {
-    Base::finishCreation(vm, name, NameAdditionMode::WithStructureTransition);
-    putDirect(vm, vm.propertyNames->length, jsNumber(2), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
+    Base::finishCreation(vm, 2, name, PropertyAdditionMode::WithStructureTransition);
     putDirect(vm, makeIdentifier(vm, "revocable"), JSFunction::create(vm, globalObject, 2, "revocable"_s, makeRevocableProxy));
 }
 

Modified: trunk/Source/_javascript_Core/runtime/ProxyRevoke.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/ProxyRevoke.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/ProxyRevoke.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -51,10 +51,8 @@
 
 void ProxyRevoke::finishCreation(VM& vm, ProxyObject* proxy)
 {
-    Base::finishCreation(vm, emptyString());
+    Base::finishCreation(vm, 0, emptyString());
     m_proxy.set(vm, this, proxy);
-
-    putDirect(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 static EncodedJSValue JSC_HOST_CALL performProxyRevoke(JSGlobalObject* globalObject, CallFrame* callFrame)

Modified: trunk/Source/_javascript_Core/runtime/RegExpConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/RegExpConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/RegExpConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -86,11 +86,10 @@
 
 void RegExpConstructor::finishCreation(VM& vm, RegExpPrototype* regExpPrototype, GetterSetter* speciesSymbol)
 {
-    Base::finishCreation(vm, vm.propertyNames->RegExp.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 2, vm.propertyNames->RegExp.string(), PropertyAdditionMode::WithoutStructureTransition);
     ASSERT(inherits(vm, info()));
 
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, regExpPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(2), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 
     putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }

Modified: trunk/Source/_javascript_Core/runtime/SetConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/SetConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/SetConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -37,9 +37,8 @@
 
 void SetConstructor::finishCreation(VM& vm, SetPrototype* setPrototype, GetterSetter* speciesSymbol)
 {
-    Base::finishCreation(vm, vm.propertyNames->Set.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, vm.propertyNames->Set.string(), PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, setPrototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
     putDirectNonIndexAccessorWithoutTransition(vm, vm.propertyNames->speciesSymbol, speciesSymbol, PropertyAttribute::Accessor | PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 

Modified: trunk/Source/_javascript_Core/runtime/StringConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/StringConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/StringConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -59,9 +59,8 @@
 
 void StringConstructor::finishCreation(VM& vm, StringPrototype* stringPrototype)
 {
-    Base::finishCreation(vm, vm.propertyNames->String.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, vm.propertyNames->String.string(), PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, stringPrototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 // ------------------------------ Functions --------------------------------

Modified: trunk/Source/_javascript_Core/runtime/SymbolConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/SymbolConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/SymbolConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -66,9 +66,8 @@
 
 void SymbolConstructor::finishCreation(VM& vm, SymbolPrototype* prototype)
 {
-    Base::finishCreation(vm, vm.propertyNames->Symbol.string(), NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, vm.propertyNames->Symbol.string(), PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 
     JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_WELL_KNOWN_SYMBOLS)
 }

Modified: trunk/Source/_javascript_Core/runtime/WeakMapConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/WeakMapConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/WeakMapConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -37,9 +37,8 @@
 
 void WeakMapConstructor::finishCreation(VM& vm, WeakMapPrototype* prototype)
 {
-    Base::finishCreation(vm, "WeakMap"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "WeakMap"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 }
 
 static EncodedJSValue JSC_HOST_CALL callWeakMap(JSGlobalObject*, CallFrame*);

Modified: trunk/Source/_javascript_Core/runtime/WeakObjectRefConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/WeakObjectRefConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/WeakObjectRefConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -36,9 +36,8 @@
 
 void WeakObjectRefConstructor::finishCreation(VM& vm, WeakObjectRefPrototype* prototype)
 {
-    Base::finishCreation(vm, "WeakRef"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "WeakRef"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 }
 
 static EncodedJSValue JSC_HOST_CALL callWeakRef(JSGlobalObject*, CallFrame*);

Modified: trunk/Source/_javascript_Core/runtime/WeakSetConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/runtime/WeakSetConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/runtime/WeakSetConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -37,9 +37,8 @@
 
 void WeakSetConstructor::finishCreation(VM& vm, WeakSetPrototype* prototype)
 {
-    Base::finishCreation(vm, "WeakSet"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 0, "WeakSet"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(0), PropertyAttribute::DontEnum | PropertyAttribute::ReadOnly);
 }
 
 static EncodedJSValue JSC_HOST_CALL callWeakSet(JSGlobalObject*, CallFrame*);

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyCompileErrorConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyCompileErrorConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyCompileErrorConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -79,9 +79,8 @@
 
 void WebAssemblyCompileErrorConstructor::finishCreation(VM& vm, WebAssemblyCompileErrorPrototype* prototype)
 {
-    Base::finishCreation(vm, "CompileError"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "CompileError"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 WebAssemblyCompileErrorConstructor::WebAssemblyCompileErrorConstructor(VM& vm, Structure* structure)

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyGlobalConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyGlobalConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyGlobalConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -143,9 +143,8 @@
 
 void WebAssemblyGlobalConstructor::finishCreation(VM& vm, WebAssemblyGlobalPrototype* prototype)
 {
-    Base::finishCreation(vm, "Global"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "Global"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 WebAssemblyGlobalConstructor::WebAssemblyGlobalConstructor(VM& vm, Structure* structure)

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyInstanceConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyInstanceConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyInstanceConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -97,9 +97,8 @@
 
 void WebAssemblyInstanceConstructor::finishCreation(VM& vm, WebAssemblyInstancePrototype* prototype)
 {
-    Base::finishCreation(vm, "Instance"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "Instance"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 WebAssemblyInstanceConstructor::WebAssemblyInstanceConstructor(VM& vm, Structure* structure)

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyLinkErrorConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyLinkErrorConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyLinkErrorConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -79,9 +79,8 @@
 
 void WebAssemblyLinkErrorConstructor::finishCreation(VM& vm, WebAssemblyLinkErrorPrototype* prototype)
 {
-    Base::finishCreation(vm, "LinkError"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "LinkError"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 WebAssemblyLinkErrorConstructor::WebAssemblyLinkErrorConstructor(VM& vm, Structure* structure)

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyMemoryConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyMemoryConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyMemoryConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -135,9 +135,8 @@
 
 void WebAssemblyMemoryConstructor::finishCreation(VM& vm, WebAssemblyMemoryPrototype* prototype)
 {
-    Base::finishCreation(vm, "Memory"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "Memory"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 WebAssemblyMemoryConstructor::WebAssemblyMemoryConstructor(VM& vm, Structure* structure)

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyModuleConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyModuleConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyModuleConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -200,9 +200,8 @@
 
 void WebAssemblyModuleConstructor::finishCreation(VM& vm, WebAssemblyModulePrototype* prototype)
 {
-    Base::finishCreation(vm, "Module"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "Module"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 WebAssemblyModuleConstructor::WebAssemblyModuleConstructor(VM& vm, Structure* structure)

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyRuntimeErrorConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -81,9 +81,8 @@
 
 void WebAssemblyRuntimeErrorConstructor::finishCreation(VM& vm, WebAssemblyRuntimeErrorPrototype* prototype)
 {
-    Base::finishCreation(vm, "RuntimeError"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "RuntimeError"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum | PropertyAttribute::DontDelete);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 WebAssemblyRuntimeErrorConstructor::WebAssemblyRuntimeErrorConstructor(VM& vm, Structure* structure)

Modified: trunk/Source/_javascript_Core/wasm/js/WebAssemblyTableConstructor.cpp (267363 => 267364)


--- trunk/Source/_javascript_Core/wasm/js/WebAssemblyTableConstructor.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/_javascript_Core/wasm/js/WebAssemblyTableConstructor.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -127,9 +127,8 @@
 
 void WebAssemblyTableConstructor::finishCreation(VM& vm, WebAssemblyTablePrototype* prototype)
 {
-    Base::finishCreation(vm, "Table"_s, NameAdditionMode::WithoutStructureTransition);
+    Base::finishCreation(vm, 1, "Table"_s, PropertyAdditionMode::WithoutStructureTransition);
     putDirectWithoutTransition(vm, vm.propertyNames->prototype, prototype, PropertyAttribute::DontEnum | PropertyAttribute::DontDelete | PropertyAttribute::ReadOnly);
-    putDirectWithoutTransition(vm, vm.propertyNames->length, jsNumber(1), PropertyAttribute::ReadOnly | PropertyAttribute::DontEnum);
 }
 
 WebAssemblyTableConstructor::WebAssemblyTableConstructor(VM& vm, Structure* structure)

Modified: trunk/Source/WebCore/ChangeLog (267363 => 267364)


--- trunk/Source/WebCore/ChangeLog	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/WebCore/ChangeLog	2020-09-21 20:41:07 UTC (rev 267364)
@@ -1,3 +1,19 @@
+2020-09-21  Keith Miller  <[email protected]>
+
+        Functions should consistently enumerate length before name
+        https://bugs.webkit.org/show_bug.cgi?id=216789
+
+        Reviewed by Yusuke Suzuki.
+
+        RuntimeMethod inherits from InternalFunction which now sets length by default.
+        RuntimeMethod intercepts length in getOwnPropertySlot so the value we pick
+        doesn't actually matter. Technically, this uses a little extra memory but
+        that's not too big of a deal because RuntimeMethod's are rare (and I believe
+        deprecated).
+
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::finishCreation):
+
 2020-09-20  Darin Adler  <[email protected]>
 
         Next step towards eliminating deprecated legacy positions

Modified: trunk/Source/WebCore/bridge/runtime_method.cpp (267363 => 267364)


--- trunk/Source/WebCore/bridge/runtime_method.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/WebCore/bridge/runtime_method.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -54,7 +54,7 @@
 
 void RuntimeMethod::finishCreation(VM& vm, const String& ident)
 {
-    Base::finishCreation(vm, ident);
+    Base::finishCreation(vm, 0, ident);
     ASSERT(inherits(vm, info()));
 }
 

Modified: trunk/Source/WebKit/ChangeLog (267363 => 267364)


--- trunk/Source/WebKit/ChangeLog	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/WebKit/ChangeLog	2020-09-21 20:41:07 UTC (rev 267364)
@@ -1,3 +1,17 @@
+2020-09-21  Keith Miller  <[email protected]>
+
+        Functions should consistently enumerate length before name
+        https://bugs.webkit.org/show_bug.cgi?id=216789
+
+        Reviewed by Yusuke Suzuki.
+
+        JSNPMethod inherits from InternalFunction which now sets length by default.
+        I chose 0 because it looks like this function doesn't directly look at any
+        arguments and I doubt anyone is looking at the length anyway.
+
+        * WebProcess/Plugins/Netscape/JSNPMethod.cpp:
+        (WebKit::JSNPMethod::finishCreation):
+
 2020-09-20  Darin Adler  <[email protected]>
 
         Next step towards eliminating deprecated legacy positions

Modified: trunk/Source/WebKit/WebProcess/Plugins/Netscape/JSNPMethod.cpp (267363 => 267364)


--- trunk/Source/WebKit/WebProcess/Plugins/Netscape/JSNPMethod.cpp	2020-09-21 20:28:24 UTC (rev 267363)
+++ trunk/Source/WebKit/WebProcess/Plugins/Netscape/JSNPMethod.cpp	2020-09-21 20:41:07 UTC (rev 267364)
@@ -56,7 +56,7 @@
 
 void JSNPMethod::finishCreation(VM& vm, const String& name)
 {
-    Base::finishCreation(vm, name);
+    Base::finishCreation(vm, 0, name);
     ASSERT(inherits(vm, info()));
 }
 
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to