src/runtime/runtime-object.cc

   1 // Copyright 2014 the V8 project authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "src/runtime/runtime-utils.h"
   6
   7 #include "src/arguments.h"
   8 #include "src/bootstrapper.h"
   9 #include "src/debug/debug.h"
  10 #include "src/messages.h"
  11 #include "src/runtime/runtime.h"
  12
  13 namespace v8 {
  14 namespace internal {
  15
  16
  17 MaybeHandle<Object> Runtime::GetObjectProperty(Isolate* isolate,
  18                                                Handle<Object> object,
  19                                                Handle<Object> key,
  20                                                LanguageMode language_mode) {
  21   if (object->IsUndefined() || object->IsNull()) {
  22     THROW_NEW_ERROR(
  23         isolate,
  24         NewTypeError(MessageTemplate::kNonObjectPropertyLoad, key, object),
  25         Object);
  26   }
  27
  28   // Check if the given key is an array index.
  29   uint32_t index = 0;
  30   if (key->ToArrayIndex(&index)) {
  31     return Object::GetElement(isolate, object, index, language_mode);
  32   }
  33
  34   // Convert the key to a name - possibly by calling back into JavaScript.
  35   Handle<Name> name;
  36   ASSIGN_RETURN_ON_EXCEPTION(isolate, name, Object::ToName(isolate, key),
  37                              Object);
  38
  39   // Check if the name is trivially convertible to an index and get
  40   // the element if so.
  41   // TODO(verwaest): Make sure GetProperty(LookupIterator*) can handle this, and
  42   // remove the special casing here.
  43   if (name->AsArrayIndex(&index)) {
  44     return Object::GetElement(isolate, object, index);
  45   } else {
  46     return Object::GetProperty(object, name, language_mode);
  47   }
  48 }
  49
  50
  51 MaybeHandle<Object> Runtime::KeyedGetObjectProperty(
  52     Isolate* isolate, Handle<Object> receiver_obj, Handle<Object> key_obj,
  53     LanguageMode language_mode) {
  54   // Fast cases for getting named properties of the receiver JSObject
  55   // itself.
  56   //
  57   // The global proxy objects has to be excluded since LookupOwn on
  58   // the global proxy object can return a valid result even though the
  59   // global proxy object never has properties.  This is the case
  60   // because the global proxy object forwards everything to its hidden
  61   // prototype including own lookups.
  62   //
  63   // Additionally, we need to make sure that we do not cache results
  64   // for objects that require access checks.
  65   if (receiver_obj->IsJSObject()) {
  66     if (!receiver_obj->IsJSGlobalProxy() &&
  67         !receiver_obj->IsAccessCheckNeeded() && key_obj->IsName()) {
  68       DisallowHeapAllocation no_allocation;
  69       Handle<JSObject> receiver = Handle<JSObject>::cast(receiver_obj);
  70       Handle<Name> key = Handle<Name>::cast(key_obj);
  71       if (receiver->IsGlobalObject()) {
  72         // Attempt dictionary lookup.
  73         GlobalDictionary* dictionary = receiver->global_dictionary();
  74         int entry = dictionary->FindEntry(key);
  75         if (entry != GlobalDictionary::kNotFound) {
  76           DCHECK(dictionary->ValueAt(entry)->IsPropertyCell());
  77           PropertyCell* cell = PropertyCell::cast(dictionary->ValueAt(entry));
  78           if (cell->property_details().type() == DATA) {
  79             Object* value = cell->value();
  80             if (!value->IsTheHole()) return Handle<Object>(value, isolate);
  81             // If value is the hole (meaning, absent) do the general lookup.
  82           }
  83         }
  84       } else if (!receiver->HasFastProperties()) {
  85         // Attempt dictionary lookup.
  86         NameDictionary* dictionary = receiver->property_dictionary();
  87         int entry = dictionary->FindEntry(key);
  88         if ((entry != NameDictionary::kNotFound) &&
  89             (dictionary->DetailsAt(entry).type() == DATA)) {
  90           Object* value = dictionary->ValueAt(entry);
  91           return Handle<Object>(value, isolate);
  92         }
  93       }
  94     } else if (key_obj->IsSmi()) {
  95       // JSObject without a name key. If the key is a Smi, check for a
  96       // definite out-of-bounds access to elements, which is a strong indicator
  97       // that subsequent accesses will also call the runtime. Proactively
  98       // transition elements to FAST_*_ELEMENTS to avoid excessive boxing of
  99       // doubles for those future calls in the case that the elements would
 100       // become FAST_DOUBLE_ELEMENTS.
 101       Handle<JSObject> js_object = Handle<JSObject>::cast(receiver_obj);
 102       ElementsKind elements_kind = js_object->GetElementsKind();
 103       if (IsFastDoubleElementsKind(elements_kind)) {
 104         if (Smi::cast(*key_obj)->value() >= js_object->elements()->length()) {
 105           elements_kind = IsFastHoleyElementsKind(elements_kind)
 106                               ? FAST_HOLEY_ELEMENTS
 107                               : FAST_ELEMENTS;
 108           JSObject::TransitionElementsKind(js_object, elements_kind);
 109         }
 110       } else {
 111         DCHECK(IsFastSmiOrObjectElementsKind(elements_kind) ||
 112                !IsFastElementsKind(elements_kind));
 113       }
 114     }
 115   } else if (receiver_obj->IsString() && key_obj->IsSmi()) {
 116     // Fast case for string indexing using [] with a smi index.
 117     Handle<String> str = Handle<String>::cast(receiver_obj);
 118     int index = Handle<Smi>::cast(key_obj)->value();
 119     if (index >= 0 && index < str->length()) {
 120       Factory* factory = isolate->factory();
 121       return factory->LookupSingleCharacterStringFromCode(
 122           String::Flatten(str)->Get(index));
 123     }
 124   }
 125
 126   // Fall back to GetObjectProperty.
 127   return GetObjectProperty(isolate, receiver_obj, key_obj, language_mode);
 128 }
 129
 130
 131 MaybeHandle<Object> Runtime::DeleteObjectProperty(Isolate* isolate,
 132                                                   Handle<JSReceiver> receiver,
 133                                                   Handle<Object> key,
 134                                                   LanguageMode language_mode) {
 135   // Check if the given key is an array index.
 136   uint32_t index = 0;
 137   if (key->ToArrayIndex(&index)) {
 138     return JSReceiver::DeleteElement(receiver, index, language_mode);
 139   }
 140
 141   Handle<Name> name;
 142   ASSIGN_RETURN_ON_EXCEPTION(isolate, name, Object::ToName(isolate, key),
 143                              Object);
 144
 145   return JSReceiver::DeletePropertyOrElement(receiver, name, language_mode);
 146 }
 147
 148
 149 MaybeHandle<Object> Runtime::SetObjectProperty(Isolate* isolate,
 150                                                Handle<Object> object,
 151                                                Handle<Object> key,
 152                                                Handle<Object> value,
 153                                                LanguageMode language_mode) {
 154   if (object->IsUndefined() || object->IsNull()) {
 155     THROW_NEW_ERROR(
 156         isolate,
 157         NewTypeError(MessageTemplate::kNonObjectPropertyStore, key, object),
 158         Object);
 159   }
 160
 161   // Check if the given key is an array index.
 162   uint32_t index = 0;
 163   if (key->ToArrayIndex(&index)) {
 164     return Object::SetElement(isolate, object, index, value, language_mode);
 165   }
 166
 167   Handle<Name> name;
 168   ASSIGN_RETURN_ON_EXCEPTION(isolate, name, Object::ToName(isolate, key),
 169                              Object);
 170
 171   LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, name);
 172   return Object::SetProperty(&it, value, language_mode,
 173                              Object::MAY_BE_STORE_FROM_KEYED);
 174 }
 175
 176
 177 MaybeHandle<Object> Runtime::GetPrototype(Isolate* isolate,
 178                                           Handle<Object> obj) {
 179   // We don't expect access checks to be needed on JSProxy objects.
 180   DCHECK(!obj->IsAccessCheckNeeded() || obj->IsJSObject());
 181   PrototypeIterator iter(isolate, obj, PrototypeIterator::START_AT_RECEIVER);
 182   do {
 183     if (PrototypeIterator::GetCurrent(iter)->IsAccessCheckNeeded() &&
 184         !isolate->MayAccess(
 185             Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)))) {
 186       return isolate->factory()->null_value();
 187     }
 188     iter.AdvanceIgnoringProxies();
 189     if (PrototypeIterator::GetCurrent(iter)->IsJSProxy()) {
 190       return PrototypeIterator::GetCurrent(iter);
 191     }
 192   } while (!iter.IsAtEnd(PrototypeIterator::END_AT_NON_HIDDEN));
 193   return PrototypeIterator::GetCurrent(iter);
 194 }
 195
 196
 197 RUNTIME_FUNCTION(Runtime_GetPrototype) {
 198   HandleScope scope(isolate);
 199   DCHECK(args.length() == 1);
 200   CONVERT_ARG_HANDLE_CHECKED(Object, obj, 0);
 201   Handle<Object> result;
 202   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
 203                                      Runtime::GetPrototype(isolate, obj));
 204   return *result;
 205 }
 206
 207
 208 RUNTIME_FUNCTION(Runtime_InternalSetPrototype) {
 209   HandleScope scope(isolate);
 210   DCHECK(args.length() == 2);
 211   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
 212   CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
 213   DCHECK(!obj->IsAccessCheckNeeded());
 214   DCHECK(!obj->map()->is_observed());
 215   Handle<Object> result;
 216   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 217       isolate, result, JSObject::SetPrototype(obj, prototype, false));
 218   return *result;
 219 }
 220
 221
 222 RUNTIME_FUNCTION(Runtime_SetPrototype) {
 223   HandleScope scope(isolate);
 224   DCHECK(args.length() == 2);
 225   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
 226   CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
 227   if (obj->IsAccessCheckNeeded() && !isolate->MayAccess(obj)) {
 228     isolate->ReportFailedAccessCheck(obj);
 229     RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
 230     return isolate->heap()->undefined_value();
 231   }
 232   if (obj->map()->is_observed()) {
 233     Handle<Object> old_value =
 234         Object::GetPrototypeSkipHiddenPrototypes(isolate, obj);
 235     Handle<Object> result;
 236     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 237         isolate, result, JSObject::SetPrototype(obj, prototype, true));
 238
 239     Handle<Object> new_value =
 240         Object::GetPrototypeSkipHiddenPrototypes(isolate, obj);
 241     if (!new_value->SameValue(*old_value)) {
 242       RETURN_FAILURE_ON_EXCEPTION(
 243           isolate, JSObject::EnqueueChangeRecord(
 244                        obj, "setPrototype", isolate->factory()->proto_string(),
 245                        old_value));
 246     }
 247     return *result;
 248   }
 249   Handle<Object> result;
 250   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 251       isolate, result, JSObject::SetPrototype(obj, prototype, true));
 252   return *result;
 253 }
 254
 255
 256 // Enumerator used as indices into the array returned from GetOwnProperty
 257 enum PropertyDescriptorIndices {
 258   IS_ACCESSOR_INDEX,
 259   VALUE_INDEX,
 260   GETTER_INDEX,
 261   SETTER_INDEX,
 262   WRITABLE_INDEX,
 263   ENUMERABLE_INDEX,
 264   CONFIGURABLE_INDEX,
 265   DESCRIPTOR_SIZE
 266 };
 267
 268
 269 MUST_USE_RESULT static MaybeHandle<Object> GetOwnProperty(Isolate* isolate,
 270                                                           Handle<JSObject> obj,
 271                                                           Handle<Name> name) {
 272   Heap* heap = isolate->heap();
 273   Factory* factory = isolate->factory();
 274
 275   PropertyAttributes attrs;
 276   // Get attributes.
 277   LookupIterator it = LookupIterator::PropertyOrElement(isolate, obj, name,
 278                                                         LookupIterator::HIDDEN);
 279   Maybe<PropertyAttributes> maybe = JSObject::GetPropertyAttributes(&it);
 280
 281   if (!maybe.IsJust()) return MaybeHandle<Object>();
 282   attrs = maybe.FromJust();
 283   if (attrs == ABSENT) return factory->undefined_value();
 284
 285   DCHECK(!isolate->has_pending_exception());
 286   Handle<FixedArray> elms = factory->NewFixedArray(DESCRIPTOR_SIZE);
 287   elms->set(ENUMERABLE_INDEX, heap->ToBoolean((attrs & DONT_ENUM) == 0));
 288   elms->set(CONFIGURABLE_INDEX, heap->ToBoolean((attrs & DONT_DELETE) == 0));
 289
 290   bool is_accessor_pair = it.state() == LookupIterator::ACCESSOR &&
 291                           it.GetAccessors()->IsAccessorPair();
 292   elms->set(IS_ACCESSOR_INDEX, heap->ToBoolean(is_accessor_pair));
 293
 294   if (is_accessor_pair) {
 295     Handle<AccessorPair> accessors =
 296         Handle<AccessorPair>::cast(it.GetAccessors());
 297     Handle<Object> getter(accessors->GetComponent(ACCESSOR_GETTER), isolate);
 298     Handle<Object> setter(accessors->GetComponent(ACCESSOR_SETTER), isolate);
 299     elms->set(GETTER_INDEX, *getter);
 300     elms->set(SETTER_INDEX, *setter);
 301   } else {
 302     Handle<Object> value;
 303     ASSIGN_RETURN_ON_EXCEPTION(isolate, value, Object::GetProperty(&it),
 304                                Object);
 305     elms->set(WRITABLE_INDEX, heap->ToBoolean((attrs & READ_ONLY) == 0));
 306     elms->set(VALUE_INDEX, *value);
 307   }
 308
 309   return factory->NewJSArrayWithElements(elms);
 310 }
 311
 312
 313 // Returns an array with the property description:
 314 //  if args[1] is not a property on args[0]
 315 //          returns undefined
 316 //  if args[1] is a data property on args[0]
 317 //         [false, value, Writeable, Enumerable, Configurable]
 318 //  if args[1] is an accessor on args[0]
 319 //         [true, GetFunction, SetFunction, Enumerable, Configurable]
 320 RUNTIME_FUNCTION(Runtime_GetOwnProperty) {
 321   HandleScope scope(isolate);
 322   DCHECK(args.length() == 2);
 323   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
 324   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
 325   Handle<Object> result;
 326   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
 327                                      GetOwnProperty(isolate, obj, name));
 328   return *result;
 329 }
 330
 331
 332 RUNTIME_FUNCTION(Runtime_PreventExtensions) {
 333   HandleScope scope(isolate);
 334   DCHECK(args.length() == 1);
 335   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
 336   Handle<Object> result;
 337   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
 338                                      JSObject::PreventExtensions(obj));
 339   return *result;
 340 }
 341
 342
 343 RUNTIME_FUNCTION(Runtime_IsExtensible) {
 344   SealHandleScope shs(isolate);
 345   DCHECK(args.length() == 1);
 346   CONVERT_ARG_CHECKED(JSObject, obj, 0);
 347   return isolate->heap()->ToBoolean(obj->IsExtensible());
 348 }
 349
 350
 351 RUNTIME_FUNCTION(Runtime_OptimizeObjectForAddingMultipleProperties) {
 352   HandleScope scope(isolate);
 353   DCHECK(args.length() == 2);
 354   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
 355   CONVERT_SMI_ARG_CHECKED(properties, 1);
 356   // Conservative upper limit to prevent fuzz tests from going OOM.
 357   RUNTIME_ASSERT(properties <= 100000);
 358   if (object->HasFastProperties() && !object->IsJSGlobalProxy()) {
 359     JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, properties,
 360                                   "OptimizeForAdding");
 361   }
 362   return *object;
 363 }
 364
 365
 366 RUNTIME_FUNCTION(Runtime_ObjectFreeze) {
 367   HandleScope scope(isolate);
 368   DCHECK(args.length() == 1);
 369   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
 370
 371   // %ObjectFreeze is a fast path and these cases are handled elsewhere.
 372   RUNTIME_ASSERT(!object->HasSloppyArgumentsElements() &&
 373                  !object->map()->is_observed() && !object->IsJSProxy());
 374
 375   Handle<Object> result;
 376   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, JSObject::Freeze(object));
 377   return *result;
 378 }
 379
 380
 381 RUNTIME_FUNCTION(Runtime_ObjectSeal) {
 382   HandleScope scope(isolate);
 383   DCHECK(args.length() == 1);
 384   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
 385
 386   // %ObjectSeal is a fast path and these cases are handled elsewhere.
 387   RUNTIME_ASSERT(!object->HasSloppyArgumentsElements() &&
 388                  !object->map()->is_observed() && !object->IsJSProxy());
 389
 390   Handle<Object> result;
 391   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, JSObject::Seal(object));
 392   return *result;
 393 }
 394
 395
 396 RUNTIME_FUNCTION(Runtime_LoadGlobalViaContext) {
 397   HandleScope scope(isolate);
 398   DCHECK_EQ(1, args.length());
 399   CONVERT_SMI_ARG_CHECKED(slot, 0);
 400
 401   // Go up context chain to the script context.
 402   Handle<Context> script_context(isolate->context()->script_context(), isolate);
 403   DCHECK(script_context->IsScriptContext());
 404   DCHECK(script_context->get(slot)->IsPropertyCell());
 405
 406   // Lookup the named property on the global object.
 407   Handle<ScopeInfo> scope_info(script_context->scope_info(), isolate);
 408   Handle<Name> name(scope_info->ContextSlotName(slot), isolate);
 409   Handle<GlobalObject> global_object(script_context->global_object(), isolate);
 410   LookupIterator it(global_object, name, LookupIterator::HIDDEN);
 411
 412   // Switch to fast mode only if there is a data property and it's not on
 413   // a hidden prototype.
 414   if (it.state() == LookupIterator::DATA &&
 415       it.GetHolder<Object>().is_identical_to(global_object)) {
 416     // Now update the cell in the script context.
 417     Handle<PropertyCell> cell = it.GetPropertyCell();
 418     script_context->set(slot, *cell);
 419   } else {
 420     // This is not a fast case, so keep this access in a slow mode.
 421     // Store empty_property_cell here to release the outdated property cell.
 422     script_context->set(slot, isolate->heap()->empty_property_cell());
 423   }
 424
 425   Handle<Object> result;
 426   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result, Object::GetProperty(&it));
 427   return *result;
 428 }
 429
 430
 431 namespace {
 432
 433 Object* StoreGlobalViaContext(Isolate* isolate, int slot, Handle<Object> value,
 434                               LanguageMode language_mode) {
 435   // Go up context chain to the script context.
 436   Handle<Context> script_context(isolate->context()->script_context(), isolate);
 437   DCHECK(script_context->IsScriptContext());
 438   DCHECK(script_context->get(slot)->IsPropertyCell());
 439
 440   // Lookup the named property on the global object.
 441   Handle<ScopeInfo> scope_info(script_context->scope_info(), isolate);
 442   Handle<Name> name(scope_info->ContextSlotName(slot), isolate);
 443   Handle<GlobalObject> global_object(script_context->global_object(), isolate);
 444   LookupIterator it(global_object, name, LookupIterator::HIDDEN);
 445
 446   // Switch to fast mode only if there is a data property and it's not on
 447   // a hidden prototype.
 448   if (it.state() == LookupIterator::DATA &&
 449       it.GetHolder<Object>().is_identical_to(global_object)) {
 450     // Now update cell in the script context.
 451     Handle<PropertyCell> cell = it.GetPropertyCell();
 452     script_context->set(slot, *cell);
 453   } else {
 454     // This is not a fast case, so keep this access in a slow mode.
 455     // Store empty_property_cell here to release the outdated property cell.
 456     script_context->set(slot, isolate->heap()->empty_property_cell());
 457   }
 458
 459   Handle<Object> result;
 460   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 461       isolate, result,
 462       Object::SetProperty(&it, value, language_mode,
 463                           Object::CERTAINLY_NOT_STORE_FROM_KEYED));
 464   return *result;
 465 }
 466
 467 }  // namespace
 468
 469
 470 RUNTIME_FUNCTION(Runtime_StoreGlobalViaContext_Sloppy) {
 471   HandleScope scope(isolate);
 472   DCHECK_EQ(2, args.length());
 473   CONVERT_SMI_ARG_CHECKED(slot, 0);
 474   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
 475
 476   return StoreGlobalViaContext(isolate, slot, value, SLOPPY);
 477 }
 478
 479
 480 RUNTIME_FUNCTION(Runtime_StoreGlobalViaContext_Strict) {
 481   HandleScope scope(isolate);
 482   DCHECK_EQ(2, args.length());
 483   CONVERT_SMI_ARG_CHECKED(slot, 0);
 484   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
 485
 486   return StoreGlobalViaContext(isolate, slot, value, STRICT);
 487 }
 488
 489
 490 RUNTIME_FUNCTION(Runtime_GetProperty) {
 491   HandleScope scope(isolate);
 492   DCHECK(args.length() == 2);
 493
 494   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
 495   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
 496
 497   Handle<Object> result;
 498   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 499       isolate, result,
 500       Runtime::GetObjectProperty(isolate, object, key, SLOPPY));
 501   return *result;
 502 }
 503
 504
 505 RUNTIME_FUNCTION(Runtime_GetPropertyStrong) {
 506   HandleScope scope(isolate);
 507   DCHECK(args.length() == 2);
 508
 509   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
 510   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
 511
 512   Handle<Object> result;
 513   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 514       isolate, result,
 515       Runtime::GetObjectProperty(isolate, object, key, STRONG));
 516   return *result;
 517 }
 518
 519
 520 // KeyedGetProperty is called from KeyedLoadIC::GenerateGeneric.
 521 RUNTIME_FUNCTION(Runtime_KeyedGetProperty) {
 522   HandleScope scope(isolate);
 523   DCHECK(args.length() == 2);
 524
 525   CONVERT_ARG_HANDLE_CHECKED(Object, receiver_obj, 0);
 526   CONVERT_ARG_HANDLE_CHECKED(Object, key_obj, 1);
 527
 528   Handle<Object> result;
 529   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 530       isolate, result,
 531       Runtime::KeyedGetObjectProperty(isolate, receiver_obj, key_obj, SLOPPY));
 532   return *result;
 533 }
 534
 535
 536 RUNTIME_FUNCTION(Runtime_KeyedGetPropertyStrong) {
 537   HandleScope scope(isolate);
 538   DCHECK(args.length() == 2);
 539
 540   CONVERT_ARG_HANDLE_CHECKED(Object, receiver_obj, 0);
 541   CONVERT_ARG_HANDLE_CHECKED(Object, key_obj, 1);
 542
 543   Handle<Object> result;
 544   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 545       isolate, result,
 546       Runtime::KeyedGetObjectProperty(isolate, receiver_obj, key_obj, STRONG));
 547   return *result;
 548 }
 549
 550
 551 RUNTIME_FUNCTION(Runtime_AddNamedProperty) {
 552   HandleScope scope(isolate);
 553   RUNTIME_ASSERT(args.length() == 4);
 554
 555   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
 556   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
 557   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
 558   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
 559
 560 #ifdef DEBUG
 561   uint32_t index = 0;
 562   DCHECK(!name->ToArrayIndex(&index));
 563   LookupIterator it(object, name, LookupIterator::OWN_SKIP_INTERCEPTOR);
 564   Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
 565   if (!maybe.IsJust()) return isolate->heap()->exception();
 566   RUNTIME_ASSERT(!it.IsFound());
 567 #endif
 568
 569   Handle<Object> result;
 570   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 571       isolate, result,
 572       JSObject::SetOwnPropertyIgnoreAttributes(object, name, value, attrs));
 573   return *result;
 574 }
 575
 576
 577 // Adds an element to an array.
 578 // This is used to create an indexed data property into an array.
 579 RUNTIME_FUNCTION(Runtime_AddElement) {
 580   HandleScope scope(isolate);
 581   RUNTIME_ASSERT(args.length() == 3);
 582
 583   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
 584   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
 585   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
 586
 587   uint32_t index = 0;
 588   CHECK(key->ToArrayIndex(&index));
 589
 590 #ifdef DEBUG
 591   LookupIterator it(isolate, object, index,
 592                     LookupIterator::OWN_SKIP_INTERCEPTOR);
 593   Maybe<PropertyAttributes> maybe = JSReceiver::GetPropertyAttributes(&it);
 594   if (!maybe.IsJust()) return isolate->heap()->exception();
 595   RUNTIME_ASSERT(!it.IsFound());
 596
 597   if (object->IsJSArray()) {
 598     Handle<JSArray> array = Handle<JSArray>::cast(object);
 599     RUNTIME_ASSERT(!JSArray::WouldChangeReadOnlyLength(array, index));
 600   }
 601 #endif
 602
 603   Handle<Object> result;
 604   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 605       isolate, result,
 606       JSObject::SetOwnElementIgnoreAttributes(object, index, value, NONE));
 607   return *result;
 608 }
 609
 610
 611 RUNTIME_FUNCTION(Runtime_AppendElement) {
 612   HandleScope scope(isolate);
 613   RUNTIME_ASSERT(args.length() == 2);
 614
 615   CONVERT_ARG_HANDLE_CHECKED(JSArray, array, 0);
 616   CONVERT_ARG_HANDLE_CHECKED(Object, value, 1);
 617
 618   uint32_t index;
 619   CHECK(array->length()->ToArrayIndex(&index));
 620
 621   Handle<Object> result;
 622   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 623       isolate, result, JSObject::AddDataElement(array, index, value, NONE));
 624   JSObject::ValidateElements(array);
 625   return *array;
 626 }
 627
 628
 629 RUNTIME_FUNCTION(Runtime_SetProperty) {
 630   HandleScope scope(isolate);
 631   RUNTIME_ASSERT(args.length() == 4);
 632
 633   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
 634   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
 635   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
 636   CONVERT_LANGUAGE_MODE_ARG_CHECKED(language_mode_arg, 3);
 637   LanguageMode language_mode = language_mode_arg;
 638
 639   Handle<Object> result;
 640   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 641       isolate, result,
 642       Runtime::SetObjectProperty(isolate, object, key, value, language_mode));
 643   return *result;
 644 }
 645
 646
 647 namespace {
 648
 649 // ES6 section 12.5.4.
 650 Object* DeleteProperty(Isolate* isolate, Handle<Object> object,
 651                        Handle<Object> key, LanguageMode language_mode) {
 652   Handle<JSReceiver> receiver;
 653   if (!JSReceiver::ToObject(isolate, object).ToHandle(&receiver)) {
 654     THROW_NEW_ERROR_RETURN_FAILURE(
 655         isolate, NewTypeError(MessageTemplate::kUndefinedOrNullToObject));
 656   }
 657   Handle<Object> result;
 658   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 659       isolate, result,
 660       Runtime::DeleteObjectProperty(isolate, receiver, key, language_mode));
 661   return *result;
 662 }
 663
 664 }  // namespace
 665
 666
 667 RUNTIME_FUNCTION(Runtime_DeleteProperty_Sloppy) {
 668   HandleScope scope(isolate);
 669   DCHECK_EQ(2, args.length());
 670   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
 671   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
 672   return DeleteProperty(isolate, object, key, SLOPPY);
 673 }
 674
 675
 676 RUNTIME_FUNCTION(Runtime_DeleteProperty_Strict) {
 677   HandleScope scope(isolate);
 678   DCHECK_EQ(2, args.length());
 679   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
 680   CONVERT_ARG_HANDLE_CHECKED(Object, key, 1);
 681   return DeleteProperty(isolate, object, key, STRICT);
 682 }
 683
 684
 685 static Object* HasOwnPropertyImplementation(Isolate* isolate,
 686                                             Handle<JSObject> object,
 687                                             Handle<Name> key) {
 688   Maybe<bool> maybe = JSReceiver::HasOwnProperty(object, key);
 689   if (!maybe.IsJust()) return isolate->heap()->exception();
 690   if (maybe.FromJust()) return isolate->heap()->true_value();
 691   // Handle hidden prototypes.  If there's a hidden prototype above this thing
 692   // then we have to check it for properties, because they are supposed to
 693   // look like they are on this object.
 694   PrototypeIterator iter(isolate, object);
 695   if (!iter.IsAtEnd() &&
 696       Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter))
 697           ->map()
 698           ->is_hidden_prototype()) {
 699     // TODO(verwaest): The recursion is not necessary for keys that are array
 700     // indices. Removing this.
 701     return HasOwnPropertyImplementation(
 702         isolate, Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter)),
 703         key);
 704   }
 705   RETURN_FAILURE_IF_SCHEDULED_EXCEPTION(isolate);
 706   return isolate->heap()->false_value();
 707 }
 708
 709
 710 RUNTIME_FUNCTION(Runtime_HasOwnProperty) {
 711   HandleScope scope(isolate);
 712   DCHECK(args.length() == 2);
 713   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0)
 714   CONVERT_ARG_HANDLE_CHECKED(Name, key, 1);
 715
 716   uint32_t index;
 717   const bool key_is_array_index = key->AsArrayIndex(&index);
 718
 719   // Only JS objects can have properties.
 720   if (object->IsJSObject()) {
 721     Handle<JSObject> js_obj = Handle<JSObject>::cast(object);
 722     // Fast case: either the key is a real named property or it is not
 723     // an array index and there are no interceptors or hidden
 724     // prototypes.
 725     Maybe<bool> maybe = Nothing<bool>();
 726     if (key_is_array_index) {
 727       maybe = JSObject::HasOwnElement(js_obj, index);
 728     } else {
 729       maybe = JSObject::HasRealNamedProperty(js_obj, key);
 730     }
 731     if (!maybe.IsJust()) return isolate->heap()->exception();
 732     DCHECK(!isolate->has_pending_exception());
 733     if (maybe.FromJust()) {
 734       return isolate->heap()->true_value();
 735     }
 736     Map* map = js_obj->map();
 737     if (!key_is_array_index && !map->has_named_interceptor() &&
 738         !HeapObject::cast(map->prototype())->map()->is_hidden_prototype()) {
 739       return isolate->heap()->false_value();
 740     }
 741     // Slow case.
 742     return HasOwnPropertyImplementation(isolate, Handle<JSObject>(js_obj),
 743                                         Handle<Name>(key));
 744   } else if (object->IsString() && key_is_array_index) {
 745     // Well, there is one exception:  Handle [] on strings.
 746     Handle<String> string = Handle<String>::cast(object);
 747     if (index < static_cast<uint32_t>(string->length())) {
 748       return isolate->heap()->true_value();
 749     }
 750   }
 751   return isolate->heap()->false_value();
 752 }
 753
 754
 755 RUNTIME_FUNCTION(Runtime_HasProperty) {
 756   HandleScope scope(isolate);
 757   DCHECK(args.length() == 2);
 758   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
 759   CONVERT_ARG_HANDLE_CHECKED(Name, key, 1);
 760
 761   Maybe<bool> maybe = JSReceiver::HasProperty(receiver, key);
 762   if (!maybe.IsJust()) return isolate->heap()->exception();
 763   return isolate->heap()->ToBoolean(maybe.FromJust());
 764 }
 765
 766
 767 RUNTIME_FUNCTION(Runtime_HasElement) {
 768   HandleScope scope(isolate);
 769   DCHECK(args.length() == 2);
 770   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
 771   CONVERT_SMI_ARG_CHECKED(index, 1);
 772
 773   Maybe<bool> maybe = JSReceiver::HasElement(receiver, index);
 774   if (!maybe.IsJust()) return isolate->heap()->exception();
 775   return isolate->heap()->ToBoolean(maybe.FromJust());
 776 }
 777
 778
 779 RUNTIME_FUNCTION(Runtime_IsPropertyEnumerable) {
 780   HandleScope scope(isolate);
 781   DCHECK(args.length() == 2);
 782
 783   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
 784   CONVERT_ARG_HANDLE_CHECKED(Name, key, 1);
 785
 786   Maybe<PropertyAttributes> maybe =
 787       JSReceiver::GetOwnPropertyAttributes(object, key);
 788   if (!maybe.IsJust()) return isolate->heap()->exception();
 789   if (maybe.FromJust() == ABSENT) maybe = Just(DONT_ENUM);
 790   return isolate->heap()->ToBoolean((maybe.FromJust() & DONT_ENUM) == 0);
 791 }
 792
 793
 794 // Returns either a FixedArray or, if the given object has an enum cache that
 795 // contains all enumerable properties of the object and its prototypes have
 796 // none, the map of the object. This is used to speed up the check for
 797 // deletions during a for-in.
 798 RUNTIME_FUNCTION(Runtime_GetPropertyNamesFast) {
 799   SealHandleScope shs(isolate);
 800   DCHECK(args.length() == 1);
 801
 802   CONVERT_ARG_CHECKED(JSReceiver, raw_object, 0);
 803
 804   if (raw_object->IsSimpleEnum()) return raw_object->map();
 805
 806   HandleScope scope(isolate);
 807   Handle<JSReceiver> object(raw_object);
 808   Handle<FixedArray> content;
 809   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 810       isolate, content,
 811       JSReceiver::GetKeys(object, JSReceiver::INCLUDE_PROTOS));
 812
 813   // Test again, since cache may have been built by preceding call.
 814   if (object->IsSimpleEnum()) return object->map();
 815
 816   return *content;
 817 }
 818
 819
 820 // Return the names of the own named properties.
 821 // args[0]: object
 822 // args[1]: PropertyAttributes as int
 823 RUNTIME_FUNCTION(Runtime_GetOwnPropertyNames) {
 824   HandleScope scope(isolate);
 825   DCHECK(args.length() == 2);
 826   if (!args[0]->IsJSObject()) {
 827     return isolate->heap()->undefined_value();
 828   }
 829   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
 830   CONVERT_SMI_ARG_CHECKED(filter_value, 1);
 831   PropertyAttributes filter = static_cast<PropertyAttributes>(filter_value);
 832
 833   // Find the number of own properties for each of the objects.
 834   int total_property_count = 0;
 835   for (PrototypeIterator iter(isolate, object,
 836                               PrototypeIterator::START_AT_RECEIVER);
 837        !iter.IsAtEnd(PrototypeIterator::END_AT_NON_HIDDEN); iter.Advance()) {
 838     Handle<JSObject> jsproto =
 839         Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
 840     total_property_count += jsproto->NumberOfOwnProperties(filter);
 841   }
 842
 843   // Allocate an array with storage for all the property names.
 844   Handle<FixedArray> names =
 845       isolate->factory()->NewFixedArray(total_property_count);
 846
 847   // Get the property names.
 848   int next_copy_index = 0;
 849   int hidden_strings = 0;
 850   Handle<Object> hidden_string = isolate->factory()->hidden_string();
 851   for (PrototypeIterator iter(isolate, object,
 852                               PrototypeIterator::START_AT_RECEIVER);
 853        !iter.IsAtEnd(PrototypeIterator::END_AT_NON_HIDDEN); iter.Advance()) {
 854     Handle<JSObject> jsproto =
 855         Handle<JSObject>::cast(PrototypeIterator::GetCurrent(iter));
 856     int own = jsproto->GetOwnPropertyNames(*names, next_copy_index, filter);
 857     // Names from hidden prototypes may already have been added
 858     // for inherited function template instances. Count the duplicates
 859     // and stub them out; the final copy pass at the end ignores holes.
 860     for (int j = next_copy_index; j < next_copy_index + own; j++) {
 861       Object* name_from_hidden_proto = names->get(j);
 862       if (isolate->IsInternallyUsedPropertyName(name_from_hidden_proto)) {
 863         hidden_strings++;
 864       } else {
 865         for (int k = 0; k < next_copy_index; k++) {
 866           Object* name = names->get(k);
 867           if (name_from_hidden_proto == name) {
 868             names->set(j, *hidden_string);
 869             hidden_strings++;
 870             break;
 871           }
 872         }
 873       }
 874     }
 875     next_copy_index += own;
 876   }
 877
 878   CHECK_EQ(total_property_count, next_copy_index);
 879
 880   if (object->IsAccessCheckNeeded() && !isolate->MayAccess(object)) {
 881     for (int i = 0; i < total_property_count; i++) {
 882       Handle<Name> name(Name::cast(names->get(i)));
 883       if (name.is_identical_to(hidden_string)) continue;
 884       LookupIterator it(object, name, LookupIterator::HIDDEN_SKIP_INTERCEPTOR);
 885       if (!JSObject::AllCanRead(&it)) {
 886         names->set(i, *hidden_string);
 887         hidden_strings++;
 888       }
 889     }
 890   }
 891
 892   // Filter out name of hidden properties object and
 893   // hidden prototype duplicates.
 894   if (hidden_strings > 0) {
 895     if (hidden_strings == total_property_count) {
 896       names = isolate->factory()->empty_fixed_array();
 897     } else {
 898       int i;
 899       for (i = 0; i < total_property_count; i++) {
 900         Object* name = names->get(i);
 901         if (name == *hidden_string) break;
 902       }
 903       int dest_pos = i;
 904       for (; i < total_property_count; i++) {
 905         Object* name = names->get(i);
 906         if (name == *hidden_string) continue;
 907         names->set(dest_pos++, name);
 908       }
 909
 910       isolate->heap()->RightTrimFixedArray<Heap::CONCURRENT_TO_SWEEPER>(
 911           *names, hidden_strings);
 912     }
 913   }
 914
 915   return *isolate->factory()->NewJSArrayWithElements(names);
 916 }
 917
 918
 919 // Return the names of the own indexed properties.
 920 // args[0]: object
 921 RUNTIME_FUNCTION(Runtime_GetOwnElementNames) {
 922   HandleScope scope(isolate);
 923   DCHECK(args.length() == 1);
 924   if (!args[0]->IsJSObject()) {
 925     return isolate->heap()->undefined_value();
 926   }
 927   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
 928
 929   int n = obj->NumberOfOwnElements(NONE);
 930   Handle<FixedArray> names = isolate->factory()->NewFixedArray(n);
 931   obj->GetOwnElementKeys(*names, NONE);
 932   return *isolate->factory()->NewJSArrayWithElements(names);
 933 }
 934
 935
 936 // Return information on whether an object has a named or indexed interceptor.
 937 // args[0]: object
 938 RUNTIME_FUNCTION(Runtime_GetInterceptorInfo) {
 939   HandleScope scope(isolate);
 940   DCHECK(args.length() == 1);
 941   if (!args[0]->IsJSObject()) {
 942     return Smi::FromInt(0);
 943   }
 944   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
 945
 946   int result = 0;
 947   if (obj->HasNamedInterceptor()) result |= 2;
 948   if (obj->HasIndexedInterceptor()) result |= 1;
 949
 950   return Smi::FromInt(result);
 951 }
 952
 953
 954 // Return property names from named interceptor.
 955 // args[0]: object
 956 RUNTIME_FUNCTION(Runtime_GetNamedInterceptorPropertyNames) {
 957   HandleScope scope(isolate);
 958   DCHECK(args.length() == 1);
 959   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
 960
 961   if (obj->HasNamedInterceptor()) {
 962     Handle<JSObject> result;
 963     if (JSObject::GetKeysForNamedInterceptor(obj, obj).ToHandle(&result)) {
 964       return *result;
 965     }
 966   }
 967   return isolate->heap()->undefined_value();
 968 }
 969
 970
 971 // Return element names from indexed interceptor.
 972 // args[0]: object
 973 RUNTIME_FUNCTION(Runtime_GetIndexedInterceptorElementNames) {
 974   HandleScope scope(isolate);
 975   DCHECK(args.length() == 1);
 976   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
 977
 978   if (obj->HasIndexedInterceptor()) {
 979     Handle<JSObject> result;
 980     if (JSObject::GetKeysForIndexedInterceptor(obj, obj).ToHandle(&result)) {
 981       return *result;
 982     }
 983   }
 984   return isolate->heap()->undefined_value();
 985 }
 986
 987
 988 RUNTIME_FUNCTION(Runtime_OwnKeys) {
 989   HandleScope scope(isolate);
 990   DCHECK(args.length() == 1);
 991   CONVERT_ARG_CHECKED(JSObject, raw_object, 0);
 992   Handle<JSObject> object(raw_object);
 993
 994   Handle<FixedArray> contents;
 995   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
 996       isolate, contents, JSReceiver::GetKeys(object, JSReceiver::OWN_ONLY));
 997
 998   // Some fast paths through GetKeysInFixedArrayFor reuse a cached
 999   // property array and since the result is mutable we have to create
1000   // a fresh clone on each invocation.
1001   int length = contents->length();
1002   Handle<FixedArray> copy = isolate->factory()->NewFixedArray(length);
1003   for (int i = 0; i < length; i++) {
1004     Object* entry = contents->get(i);
1005     if (entry->IsString()) {
1006       copy->set(i, entry);
1007     } else {
1008       DCHECK(entry->IsNumber());
1009       HandleScope scope(isolate);
1010       Handle<Object> entry_handle(entry, isolate);
1011       Handle<Object> entry_str =
1012           isolate->factory()->NumberToString(entry_handle);
1013       copy->set(i, *entry_str);
1014     }
1015   }
1016   return *isolate->factory()->NewJSArrayWithElements(copy);
1017 }
1018
1019
1020 RUNTIME_FUNCTION(Runtime_ToFastProperties) {
1021   HandleScope scope(isolate);
1022   DCHECK(args.length() == 1);
1023   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
1024   if (object->IsJSObject() && !object->IsGlobalObject()) {
1025     JSObject::MigrateSlowToFast(Handle<JSObject>::cast(object), 0,
1026                                 "RuntimeToFastProperties");
1027   }
1028   return *object;
1029 }
1030
1031
1032 RUNTIME_FUNCTION(Runtime_NewStringWrapper) {
1033   HandleScope scope(isolate);
1034   DCHECK(args.length() == 1);
1035   CONVERT_ARG_HANDLE_CHECKED(String, value, 0);
1036   return *Object::ToObject(isolate, value).ToHandleChecked();
1037 }
1038
1039
1040 RUNTIME_FUNCTION(Runtime_AllocateHeapNumber) {
1041   HandleScope scope(isolate);
1042   DCHECK(args.length() == 0);
1043   return *isolate->factory()->NewHeapNumber(0);
1044 }
1045
1046
1047 static Object* Runtime_NewObjectHelper(Isolate* isolate,
1048                                        Handle<Object> constructor,
1049                                        Handle<Object> original_constructor,
1050                                        Handle<AllocationSite> site) {
1051   // If the constructor isn't a proper function we throw a type error.
1052   if (!constructor->IsJSFunction()) {
1053     THROW_NEW_ERROR_RETURN_FAILURE(
1054         isolate, NewTypeError(MessageTemplate::kNotConstructor, constructor));
1055   }
1056
1057   Handle<JSFunction> function = Handle<JSFunction>::cast(constructor);
1058
1059   CHECK(original_constructor->IsJSFunction());
1060   Handle<JSFunction> original_function =
1061       Handle<JSFunction>::cast(original_constructor);
1062
1063
1064   // If function should not have prototype, construction is not allowed. In this
1065   // case generated code bailouts here, since function has no initial_map.
1066   if (!function->should_have_prototype() && !function->shared()->bound()) {
1067     THROW_NEW_ERROR_RETURN_FAILURE(
1068         isolate, NewTypeError(MessageTemplate::kNotConstructor, constructor));
1069   }
1070
1071   Debug* debug = isolate->debug();
1072   // Handle stepping into constructors if step into is active.
1073   if (debug->StepInActive()) debug->HandleStepIn(function, true);
1074
1075   if (function->has_initial_map()) {
1076     if (function->initial_map()->instance_type() == JS_FUNCTION_TYPE) {
1077       // The 'Function' function ignores the receiver object when
1078       // called using 'new' and creates a new JSFunction object that
1079       // is returned.  The receiver object is only used for error
1080       // reporting if an error occurs when constructing the new
1081       // JSFunction. Factory::NewJSObject() should not be used to
1082       // allocate JSFunctions since it does not properly initialize
1083       // the shared part of the function. Since the receiver is
1084       // ignored anyway, we use the global object as the receiver
1085       // instead of a new JSFunction object. This way, errors are
1086       // reported the same way whether or not 'Function' is called
1087       // using 'new'.
1088       return isolate->global_proxy();
1089     }
1090   }
1091
1092   // The function should be compiled for the optimization hints to be
1093   // available.
1094   Compiler::Compile(function, CLEAR_EXCEPTION);
1095
1096   Handle<JSObject> result;
1097   if (site.is_null()) {
1098     result = isolate->factory()->NewJSObject(function);
1099   } else {
1100     result = isolate->factory()->NewJSObjectWithMemento(function, site);
1101   }
1102
1103   // Set up the prototoype using original function.
1104   // TODO(dslomov): instead of setting the __proto__,
1105   // use and cache the correct map.
1106   if (*original_function != *function) {
1107     if (original_function->has_instance_prototype()) {
1108       Handle<Object> prototype =
1109           handle(original_function->instance_prototype(), isolate);
1110       RETURN_FAILURE_ON_EXCEPTION(
1111           isolate, JSObject::SetPrototype(result, prototype, false));
1112     }
1113   }
1114
1115   isolate->counters()->constructed_objects()->Increment();
1116   isolate->counters()->constructed_objects_runtime()->Increment();
1117
1118   return *result;
1119 }
1120
1121
1122 RUNTIME_FUNCTION(Runtime_NewObject) {
1123   HandleScope scope(isolate);
1124   DCHECK(args.length() == 2);
1125   CONVERT_ARG_HANDLE_CHECKED(Object, constructor, 0);
1126   CONVERT_ARG_HANDLE_CHECKED(Object, original_constructor, 1);
1127   return Runtime_NewObjectHelper(isolate, constructor, original_constructor,
1128                                  Handle<AllocationSite>::null());
1129 }
1130
1131
1132 RUNTIME_FUNCTION(Runtime_NewObjectWithAllocationSite) {
1133   HandleScope scope(isolate);
1134   DCHECK(args.length() == 3);
1135   CONVERT_ARG_HANDLE_CHECKED(Object, original_constructor, 2);
1136   CONVERT_ARG_HANDLE_CHECKED(Object, constructor, 1);
1137   CONVERT_ARG_HANDLE_CHECKED(Object, feedback, 0);
1138   Handle<AllocationSite> site;
1139   if (feedback->IsAllocationSite()) {
1140     // The feedback can be an AllocationSite or undefined.
1141     site = Handle<AllocationSite>::cast(feedback);
1142   }
1143   return Runtime_NewObjectHelper(isolate, constructor, original_constructor,
1144                                  site);
1145 }
1146
1147
1148 RUNTIME_FUNCTION(Runtime_FinalizeInstanceSize) {
1149   HandleScope scope(isolate);
1150   DCHECK(args.length() == 1);
1151
1152   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
1153   function->CompleteInobjectSlackTracking();
1154
1155   return isolate->heap()->undefined_value();
1156 }
1157
1158
1159 RUNTIME_FUNCTION(Runtime_GlobalProxy) {
1160   SealHandleScope shs(isolate);
1161   DCHECK(args.length() == 1);
1162   CONVERT_ARG_CHECKED(JSFunction, function, 0);
1163   return function->context()->global_proxy();
1164 }
1165
1166
1167 RUNTIME_FUNCTION(Runtime_LookupAccessor) {
1168   HandleScope scope(isolate);
1169   DCHECK(args.length() == 3);
1170   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
1171   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
1172   CONVERT_SMI_ARG_CHECKED(flag, 2);
1173   AccessorComponent component = flag == 0 ? ACCESSOR_GETTER : ACCESSOR_SETTER;
1174   if (!receiver->IsJSObject()) return isolate->heap()->undefined_value();
1175   Handle<Object> result;
1176   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
1177       isolate, result,
1178       JSObject::GetAccessor(Handle<JSObject>::cast(receiver), name, component));
1179   return *result;
1180 }
1181
1182
1183 RUNTIME_FUNCTION(Runtime_LoadMutableDouble) {
1184   HandleScope scope(isolate);
1185   DCHECK(args.length() == 2);
1186   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
1187   CONVERT_ARG_HANDLE_CHECKED(Smi, index, 1);
1188   RUNTIME_ASSERT((index->value() & 1) == 1);
1189   FieldIndex field_index =
1190       FieldIndex::ForLoadByFieldIndex(object->map(), index->value());
1191   if (field_index.is_inobject()) {
1192     RUNTIME_ASSERT(field_index.property_index() <
1193                    object->map()->GetInObjectProperties());
1194   } else {
1195     RUNTIME_ASSERT(field_index.outobject_array_index() <
1196                    object->properties()->length());
1197   }
1198   return *JSObject::FastPropertyAt(object, Representation::Double(),
1199                                    field_index);
1200 }
1201
1202
1203 RUNTIME_FUNCTION(Runtime_TryMigrateInstance) {
1204   HandleScope scope(isolate);
1205   DCHECK(args.length() == 1);
1206   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
1207   if (!object->IsJSObject()) return Smi::FromInt(0);
1208   Handle<JSObject> js_object = Handle<JSObject>::cast(object);
1209   if (!js_object->map()->is_deprecated()) return Smi::FromInt(0);
1210   // This call must not cause lazy deopts, because it's called from deferred
1211   // code where we can't handle lazy deopts for lack of a suitable bailout
1212   // ID. So we just try migration and signal failure if necessary,
1213   // which will also trigger a deopt.
1214   if (!JSObject::TryMigrateInstance(js_object)) return Smi::FromInt(0);
1215   return *object;
1216 }
1217
1218
1219 RUNTIME_FUNCTION(Runtime_IsJSGlobalProxy) {
1220   SealHandleScope shs(isolate);
1221   DCHECK(args.length() == 1);
1222   CONVERT_ARG_CHECKED(Object, obj, 0);
1223   return isolate->heap()->ToBoolean(obj->IsJSGlobalProxy());
1224 }
1225
1226
1227 static bool IsValidAccessor(Handle<Object> obj) {
1228   return obj->IsUndefined() || obj->IsSpecFunction() || obj->IsNull();
1229 }
1230
1231
1232 // Implements part of 8.12.9 DefineOwnProperty.
1233 // There are 3 cases that lead here:
1234 // Step 4b - define a new accessor property.
1235 // Steps 9c & 12 - replace an existing data property with an accessor property.
1236 // Step 12 - update an existing accessor property with an accessor or generic
1237 //           descriptor.
1238 RUNTIME_FUNCTION(Runtime_DefineAccessorPropertyUnchecked) {
1239   HandleScope scope(isolate);
1240   DCHECK(args.length() == 5);
1241   CONVERT_ARG_HANDLE_CHECKED(JSObject, obj, 0);
1242   RUNTIME_ASSERT(!obj->IsNull());
1243   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
1244   CONVERT_ARG_HANDLE_CHECKED(Object, getter, 2);
1245   RUNTIME_ASSERT(IsValidAccessor(getter));
1246   CONVERT_ARG_HANDLE_CHECKED(Object, setter, 3);
1247   RUNTIME_ASSERT(IsValidAccessor(setter));
1248   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 4);
1249
1250   RETURN_FAILURE_ON_EXCEPTION(
1251       isolate, JSObject::DefineAccessor(obj, name, getter, setter, attrs));
1252   return isolate->heap()->undefined_value();
1253 }
1254
1255
1256 // Implements part of 8.12.9 DefineOwnProperty.
1257 // There are 3 cases that lead here:
1258 // Step 4a - define a new data property.
1259 // Steps 9b & 12 - replace an existing accessor property with a data property.
1260 // Step 12 - update an existing data property with a data or generic
1261 //           descriptor.
1262 RUNTIME_FUNCTION(Runtime_DefineDataPropertyUnchecked) {
1263   HandleScope scope(isolate);
1264   DCHECK(args.length() == 4);
1265   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
1266   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
1267   CONVERT_ARG_HANDLE_CHECKED(Object, value, 2);
1268   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
1269
1270   LookupIterator it = LookupIterator::PropertyOrElement(isolate, object, name,
1271                                                         LookupIterator::OWN);
1272   if (it.state() == LookupIterator::ACCESS_CHECK && !it.HasAccess()) {
1273     return isolate->heap()->undefined_value();
1274   }
1275
1276   Handle<Object> result;
1277   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
1278       isolate, result, JSObject::DefineOwnPropertyIgnoreAttributes(
1279                            &it, value, attrs, JSObject::DONT_FORCE_FIELD));
1280
1281   return *result;
1282 }
1283
1284
1285 // Return property without being observable by accessors or interceptors.
1286 RUNTIME_FUNCTION(Runtime_GetDataProperty) {
1287   HandleScope scope(isolate);
1288   DCHECK(args.length() == 2);
1289   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, object, 0);
1290   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
1291   return *JSReceiver::GetDataProperty(object, name);
1292 }
1293
1294
1295 RUNTIME_FUNCTION(Runtime_HasFastPackedElements) {
1296   SealHandleScope shs(isolate);
1297   DCHECK(args.length() == 1);
1298   CONVERT_ARG_CHECKED(HeapObject, obj, 0);
1299   return isolate->heap()->ToBoolean(
1300       IsFastPackedElementsKind(obj->map()->elements_kind()));
1301 }
1302
1303
1304 RUNTIME_FUNCTION(Runtime_ValueOf) {
1305   SealHandleScope shs(isolate);
1306   DCHECK(args.length() == 1);
1307   CONVERT_ARG_CHECKED(Object, obj, 0);
1308   if (!obj->IsJSValue()) return obj;
1309   return JSValue::cast(obj)->value();
1310 }
1311
1312
1313 RUNTIME_FUNCTION(Runtime_SetValueOf) {
1314   SealHandleScope shs(isolate);
1315   DCHECK(args.length() == 2);
1316   CONVERT_ARG_CHECKED(Object, obj, 0);
1317   CONVERT_ARG_CHECKED(Object, value, 1);
1318   if (!obj->IsJSValue()) return value;
1319   JSValue::cast(obj)->set_value(value);
1320   return value;
1321 }
1322
1323
1324 RUNTIME_FUNCTION(Runtime_JSValueGetValue) {
1325   SealHandleScope shs(isolate);
1326   DCHECK(args.length() == 1);
1327   CONVERT_ARG_CHECKED(JSValue, obj, 0);
1328   return JSValue::cast(obj)->value();
1329 }
1330
1331
1332 RUNTIME_FUNCTION(Runtime_HeapObjectGetMap) {
1333   SealHandleScope shs(isolate);
1334   DCHECK(args.length() == 1);
1335   CONVERT_ARG_CHECKED(HeapObject, obj, 0);
1336   return obj->map();
1337 }
1338
1339
1340 RUNTIME_FUNCTION(Runtime_MapGetInstanceType) {
1341   SealHandleScope shs(isolate);
1342   DCHECK(args.length() == 1);
1343   CONVERT_ARG_CHECKED(Map, map, 0);
1344   return Smi::FromInt(map->instance_type());
1345 }
1346
1347
1348 RUNTIME_FUNCTION(Runtime_ObjectEquals) {
1349   SealHandleScope shs(isolate);
1350   DCHECK(args.length() == 2);
1351   CONVERT_ARG_CHECKED(Object, obj1, 0);
1352   CONVERT_ARG_CHECKED(Object, obj2, 1);
1353   return isolate->heap()->ToBoolean(obj1 == obj2);
1354 }
1355
1356
1357 RUNTIME_FUNCTION(Runtime_IsSpecObject) {
1358   SealHandleScope shs(isolate);
1359   DCHECK(args.length() == 1);
1360   CONVERT_ARG_CHECKED(Object, obj, 0);
1361   return isolate->heap()->ToBoolean(obj->IsSpecObject());
1362 }
1363
1364
1365 RUNTIME_FUNCTION(Runtime_IsStrong) {
1366   SealHandleScope shs(isolate);
1367   DCHECK(args.length() == 1);
1368   CONVERT_ARG_CHECKED(Object, obj, 0);
1369   return isolate->heap()->ToBoolean(obj->IsJSReceiver() &&
1370                                     JSReceiver::cast(obj)->map()->is_strong());
1371 }
1372
1373
1374 RUNTIME_FUNCTION(Runtime_ClassOf) {
1375   SealHandleScope shs(isolate);
1376   DCHECK(args.length() == 1);
1377   CONVERT_ARG_CHECKED(Object, obj, 0);
1378   if (!obj->IsJSReceiver()) return isolate->heap()->null_value();
1379   return JSReceiver::cast(obj)->class_name();
1380 }
1381
1382
1383 RUNTIME_FUNCTION(Runtime_DefineGetterPropertyUnchecked) {
1384   HandleScope scope(isolate);
1385   DCHECK(args.length() == 4);
1386   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
1387   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
1388   CONVERT_ARG_HANDLE_CHECKED(JSFunction, getter, 2);
1389   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
1390
1391   RETURN_FAILURE_ON_EXCEPTION(
1392       isolate,
1393       JSObject::DefineAccessor(object, name, getter,
1394                                isolate->factory()->null_value(), attrs));
1395   return isolate->heap()->undefined_value();
1396 }
1397
1398
1399 RUNTIME_FUNCTION(Runtime_DefineSetterPropertyUnchecked) {
1400   HandleScope scope(isolate);
1401   DCHECK(args.length() == 4);
1402   CONVERT_ARG_HANDLE_CHECKED(JSObject, object, 0);
1403   CONVERT_ARG_HANDLE_CHECKED(Name, name, 1);
1404   CONVERT_ARG_HANDLE_CHECKED(JSFunction, setter, 2);
1405   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
1406
1407   RETURN_FAILURE_ON_EXCEPTION(
1408       isolate,
1409       JSObject::DefineAccessor(object, name, isolate->factory()->null_value(),
1410                                setter, attrs));
1411   return isolate->heap()->undefined_value();
1412 }
1413
1414
1415 RUNTIME_FUNCTION(Runtime_ToObject) {
1416   HandleScope scope(isolate);
1417   DCHECK_EQ(1, args.length());
1418   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
1419   Handle<JSReceiver> receiver;
1420   if (JSReceiver::ToObject(isolate, object).ToHandle(&receiver)) {
1421     return *receiver;
1422   }
1423   THROW_NEW_ERROR_RETURN_FAILURE(
1424       isolate, NewTypeError(MessageTemplate::kUndefinedOrNullToObject));
1425 }
1426
1427
1428 RUNTIME_FUNCTION(Runtime_ToPrimitive) {
1429   HandleScope scope(isolate);
1430   DCHECK_EQ(1, args.length());
1431   CONVERT_ARG_HANDLE_CHECKED(Object, input, 0);
1432   Handle<Object> result;
1433   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
1434                                      Object::ToPrimitive(input));
1435   return *result;
1436 }
1437
1438
1439 RUNTIME_FUNCTION(Runtime_ToPrimitive_Number) {
1440   HandleScope scope(isolate);
1441   DCHECK_EQ(1, args.length());
1442   CONVERT_ARG_HANDLE_CHECKED(Object, input, 0);
1443   Handle<Object> result;
1444   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
1445       isolate, result, Object::ToPrimitive(input, ToPrimitiveHint::kNumber));
1446   return *result;
1447 }
1448
1449
1450 RUNTIME_FUNCTION(Runtime_ToPrimitive_String) {
1451   HandleScope scope(isolate);
1452   DCHECK_EQ(1, args.length());
1453   CONVERT_ARG_HANDLE_CHECKED(Object, input, 0);
1454   Handle<Object> result;
1455   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
1456       isolate, result, Object::ToPrimitive(input, ToPrimitiveHint::kString));
1457   return *result;
1458 }
1459
1460
1461 RUNTIME_FUNCTION(Runtime_OrdinaryToPrimitive) {
1462   HandleScope scope(isolate);
1463   DCHECK_EQ(2, args.length());
1464   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, receiver, 0);
1465   CONVERT_ARG_HANDLE_CHECKED(String, hint, 1);
1466   Handle<Object> result;
1467   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
1468       isolate, result, JSReceiver::OrdinaryToPrimitive(receiver, hint));
1469   return *result;
1470 }
1471
1472
1473 RUNTIME_FUNCTION(Runtime_ToNumber) {
1474   HandleScope scope(isolate);
1475   DCHECK_EQ(1, args.length());
1476   CONVERT_ARG_HANDLE_CHECKED(Object, input, 0);
1477   Handle<Object> result;
1478   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
1479                                      Object::ToNumber(isolate, input));
1480   return *result;
1481 }
1482
1483
1484 RUNTIME_FUNCTION(Runtime_StrictEquals) {
1485   SealHandleScope scope(isolate);
1486   DCHECK_EQ(2, args.length());
1487   CONVERT_ARG_CHECKED(Object, x, 0);
1488   CONVERT_ARG_CHECKED(Object, y, 1);
1489   // TODO(bmeurer): Change this at some point to return true/false instead.
1490   return Smi::FromInt(x->StrictEquals(y) ? EQUAL : NOT_EQUAL);
1491 }
1492
1493
1494 RUNTIME_FUNCTION(Runtime_InstanceOf) {
1495   // ECMA-262, section 11.8.6, page 54.
1496   HandleScope shs(isolate);
1497   DCHECK_EQ(2, args.length());
1498   DCHECK(args.length() == 2);
1499   CONVERT_ARG_HANDLE_CHECKED(Object, object, 0);
1500   CONVERT_ARG_HANDLE_CHECKED(Object, callable, 1);
1501   // {callable} must have a [[Call]] internal method.
1502   if (!callable->IsCallable()) {
1503     THROW_NEW_ERROR_RETURN_FAILURE(
1504         isolate,
1505         NewTypeError(MessageTemplate::kInstanceofFunctionExpected, callable));
1506   }
1507   // If {object} is not a receiver, return false.
1508   if (!object->IsJSReceiver()) {
1509     return isolate->heap()->false_value();
1510   }
1511   // Check if {callable} is bound, if so, get [[BoundFunction]] from it and use
1512   // that instead of {callable}.
1513   if (callable->IsJSFunction()) {
1514     Handle<JSFunction> function = Handle<JSFunction>::cast(callable);
1515     if (function->shared()->bound()) {
1516       Handle<FixedArray> bindings(function->function_bindings(), isolate);
1517       callable =
1518           handle(bindings->get(JSFunction::kBoundFunctionIndex), isolate);
1519     }
1520   }
1521   DCHECK(callable->IsCallable());
1522   // Get the "prototype" of {callable}; raise an error if it's not a receiver.
1523   Handle<Object> prototype;
1524   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
1525       isolate, prototype,
1526       Object::GetProperty(callable, isolate->factory()->prototype_string()));
1527   if (!prototype->IsJSReceiver()) {
1528     THROW_NEW_ERROR_RETURN_FAILURE(
1529         isolate,
1530         NewTypeError(MessageTemplate::kInstanceofNonobjectProto, prototype));
1531   }
1532   // Return whether or not {prototype} is in the prototype chain of {object}.
1533   return isolate->heap()->ToBoolean(
1534       object->HasInPrototypeChain(isolate, *prototype));
1535 }
1536
1537
1538 RUNTIME_FUNCTION(Runtime_HasInPrototypeChain) {
1539   SealHandleScope scope(isolate);
1540   DCHECK_EQ(2, args.length());
1541   CONVERT_ARG_CHECKED(Object, object, 0);
1542   CONVERT_ARG_CHECKED(Object, prototype, 1);
1543   return isolate->heap()->ToBoolean(
1544       object->HasInPrototypeChain(isolate, prototype));
1545 }
1546
1547 }  // namespace internal
1548 }  // namespace v8