<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[167199] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/167199">167199</a></dd>
<dt>Author</dt> <dd>oliver@apple.com</dd>
<dt>Date</dt> <dd>2014-04-13 11:01:54 -0700 (Sun, 13 Apr 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Rewrite Function.bind as a builtin
https://bugs.webkit.org/show_bug.cgi?id=131083

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

This change removes the existing function.bind implementation
entirely so JSBoundFunction is no more.

Instead we just return a regular JS closure with a few
private properties hanging off it that allow us to perform
the necessary bound function fakery.  While most of this is
simple, a couple of key changes:

- The parser and lexer now directly track whether they're
  parsing code for call or construct and convert the private
  name @IsConstructor into TRUETOK or FALSETOK as appropriate.
  This automatically gives us the ability to vary behaviour
  from within the builtin. It also leaves a lot of headroom
  for trivial future improvements.
- The instanceof operator now uses the prototypeForHasInstance
  private name, and we have a helper function to ensure that
  all objects that need to can update their magical 'prototype'
  property pair correctly.

* API/JSScriptRef.cpp:
(parseScript):
* JavaScriptCore.xcodeproj/project.pbxproj:
* builtins/BuiltinExecutables.cpp:
(JSC::BuiltinExecutables::createBuiltinExecutable):
* builtins/Function.prototype.js:
(bind.bindingFunction):
(bind.else.bindingFunction):
(bind):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::generateFunctionCodeBlock):
* bytecompiler/NodesCodegen.cpp:
(JSC::InstanceOfNode::emitBytecode):
* interpreter/Interpreter.cpp:
* parser/Lexer.cpp:
(JSC::Lexer&lt;T&gt;::Lexer):
(JSC::Lexer&lt;LChar&gt;::parseIdentifier):
(JSC::Lexer&lt;UChar&gt;::parseIdentifier):
* parser/Lexer.h:
* parser/Parser.cpp:
(JSC::Parser&lt;LexerType&gt;::Parser):
(JSC::Parser&lt;LexerType&gt;::parseInner):
* parser/Parser.h:
(JSC::parse):
* parser/ParserModes.h:
* runtime/CodeCache.cpp:
(JSC::CodeCache::getGlobalCodeBlock):
(JSC::CodeCache::getFunctionExecutableFromGlobalCode):
* runtime/CommonIdentifiers.h:
* runtime/Completion.cpp:
(JSC::checkSyntax):
* runtime/Executable.cpp:
(JSC::ProgramExecutable::checkSyntax):
* runtime/FunctionPrototype.cpp:
(JSC::FunctionPrototype::addFunctionProperties):
(JSC::functionProtoFuncBind): Deleted.
* runtime/JSBoundFunction.cpp: Removed.
* runtime/JSBoundFunction.h: Removed.
* runtime/JSFunction.cpp:
(JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
(JSC::RetrieveCallerFunctionFunctor::operator()):
(JSC::retrieveCallerFunction):
(JSC::JSFunction::getOwnPropertySlot):
(JSC::JSFunction::defineOwnProperty):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::globalFuncSetTypeErrorAccessor):
* runtime/JSGlobalObjectFunctions.h:
* runtime/JSObject.h:
(JSC::JSObject::inlineGetOwnPropertySlot):

Source/WebCore:

Switch WebCore to use the helper functions when defining the
prototype properties on DOM constructors, and update bindings
tests accordingly.

* bindings/js/JSImageConstructor.cpp:
(WebCore::JSImageConstructor::finishCreation):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateConstructorHelperMethods):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::JSTestActiveDOMObjectConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::JSTestCustomNamedGetterConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::JSTestEventConstructorConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::JSTestEventTargetConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::JSTestExceptionConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::JSTestGenerateIsReachableConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterfaceConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::JSTestMediaQueryListListenerConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::JSTestNamedConstructorConstructor::finishCreation):
(WebCore::JSTestNamedConstructorNamedConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::JSTestNodeConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::JSTestObjConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::JSTestOverloadedConstructorsConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::JSTestTypedefsConstructor::finishCreation):
* bindings/scripts/test/JS/JSattribute.cpp:
(WebCore::JSattributeConstructor::finishCreation):
* bindings/scripts/test/JS/JSreadonly.cpp:
(WebCore::JSreadonlyConstructor::finishCreation):

LayoutTests:

Testing.

* js/dom/function-bind-expected.txt:
* js/regress/function-bind-expected.txt: Added.
* js/regress/function-bind.html: Added.
* js/regress/script-tests/function-bind.js: Added.
(foo):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsjsdomfunctionbindexpectedtxt">trunk/LayoutTests/js/dom/function-bind-expected.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreAPIJSObjectRefcpp">trunk/Source/JavaScriptCore/API/JSObjectRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreAPIJSScriptRefcpp">trunk/Source/JavaScriptCore/API/JSScriptRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsBuiltinExecutablescpp">trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebuiltinsFunctionprototypejs">trunk/Source/JavaScriptCore/builtins/Function.prototype.js</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecodeUnlinkedCodeBlockcpp">trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorebytecompilerNodesCodegencpp">trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinterpreterInterpretercpp">trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserLexercpp">trunk/Source/JavaScriptCore/parser/Lexer.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserLexerh">trunk/Source/JavaScriptCore/parser/Lexer.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserNodesh">trunk/Source/JavaScriptCore/parser/Nodes.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserParsercpp">trunk/Source/JavaScriptCore/parser/Parser.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserParserh">trunk/Source/JavaScriptCore/parser/Parser.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreparserParserModesh">trunk/Source/JavaScriptCore/parser/ParserModes.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArgumentsIteratorConstructorcpp">trunk/Source/JavaScriptCore/runtime/ArgumentsIteratorConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayConstructorcpp">trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeBooleanConstructorcpp">trunk/Source/JavaScriptCore/runtime/BooleanConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCodeCachecpp">trunk/Source/JavaScriptCore/runtime/CodeCache.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCommonIdentifiersh">trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeCompletioncpp">trunk/Source/JavaScriptCore/runtime/Completion.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDateConstructorcpp">trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeErrorConstructorcpp">trunk/Source/JavaScriptCore/runtime/ErrorConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeExecutablecpp">trunk/Source/JavaScriptCore/runtime/Executable.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeFunctionConstructorcpp">trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeFunctionPrototypecpp">trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSArrayBufferConstructorcpp">trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh">trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionsh">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseConstructorcpp">trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapConstructorcpp">trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapIteratorConstructorcpp">trunk/Source/JavaScriptCore/runtime/MapIteratorConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNameConstructorcpp">trunk/Source/JavaScriptCore/runtime/NameConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNativeErrorConstructorcpp">trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNumberConstructorcpp">trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorcpp">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpConstructorcpp">trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetConstructorcpp">trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetIteratorConstructorcpp">trunk/Source/JavaScriptCore/runtime/SetIteratorConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringConstructorcpp">trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeWeakMapConstructorcpp">trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSImageConstructorcpp">trunk/Source/WebCore/bindings/js/JSImageConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSattributecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSreadonlycpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregressfunctionbindexpectedtxt">trunk/LayoutTests/js/regress/function-bind-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregressfunctionbindhtml">trunk/LayoutTests/js/regress/function-bind.html</a></li>
<li><a href="#trunkLayoutTestsjsregressscripttestsfunctionbindjs">trunk/LayoutTests/js/regress/script-tests/function-bind.js</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundFunctionh">trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/LayoutTests/ChangeLog        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -1,3 +1,18 @@
</span><ins>+2014-04-08  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        Rewrite Function.bind as a builtin
+        https://bugs.webkit.org/show_bug.cgi?id=131083
+
+        Reviewed by Geoffrey Garen.
+
+        Testing.
+
+        * js/dom/function-bind-expected.txt:
+        * js/regress/function-bind-expected.txt: Added.
+        * js/regress/function-bind.html: Added.
+        * js/regress/script-tests/function-bind.js: Added.
+        (foo):
+
</ins><span class="cx"> 2014-04-13  Youenn Fablet  &lt;youenn.fablet@crf.canon.fr&gt;
</span><span class="cx"> 
</span><span class="cx">         [GStreamer] No CORS support for media elements
</span></span></pre></div>
<a id="trunkLayoutTestsjsdomfunctionbindexpectedtxt"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/js/dom/function-bind-expected.txt (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/dom/function-bind-expected.txt        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/LayoutTests/js/dom/function-bind-expected.txt        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -3,7 +3,7 @@
</span><span class="cx"> On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-PASS new (decodeURI.bind())() threw exception TypeError: function is not a constructor (evaluating 'new (decodeURI.bind())()').
</del><ins>+PASS new (decodeURI.bind())() threw exception TypeError: function is not a constructor.
</ins><span class="cx"> PASS (new (String.bind())('foo')).toString() is 'foo'
</span><span class="cx"> PASS result is &quot;[object Window] -&gt; x:1, y:2&quot;
</span><span class="cx"> PASS result is &quot;'a' -&gt; x:'b', y:1&quot;
</span><span class="lines">@@ -23,9 +23,9 @@
</span><span class="cx"> PASS &quot;prototype&quot; in F is true
</span><span class="cx"> PASS &quot;prototype&quot; in G is false
</span><span class="cx"> PASS &quot;prototype&quot; in H is false
</span><del>-PASS Function.bind.call(undefined) threw exception TypeError: Type error.
</del><ins>+PASS Function.bind.call(undefined) threw exception TypeError: Cannot bind non-function object..
</ins><span class="cx"> PASS abcAt(1) is &quot;b&quot;
</span><del>-PASS new abcAt(1) threw exception TypeError: function is not a constructor (evaluating 'new abcAt(1)').
</del><ins>+PASS new abcAt(1) threw exception TypeError: function is not a constructor.
</ins><span class="cx"> PASS boundFunctionPrototypeAccessed is false
</span><span class="cx"> PASS Function.bind.length is 1
</span><span class="cx"> PASS successfullyParsed is true
</span></span></pre></div>
<a id="trunkLayoutTestsjsregressfunctionbindexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/function-bind-expected.txt (0 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/function-bind-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress/function-bind-expected.txt        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+JSRegress/function-bind
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS no exception thrown
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressfunctionbindhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/function-bind.html (0 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/function-bind.html                                (rev 0)
+++ trunk/LayoutTests/js/regress/function-bind.html        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -0,0 +1,12 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;../../resources/regress-pre.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;script-tests/function-bind.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/regress-post.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregressscripttestsfunctionbindjs"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress/script-tests/function-bind.js (0 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress/script-tests/function-bind.js                                (rev 0)
+++ trunk/LayoutTests/js/regress/script-tests/function-bind.js        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -0,0 +1,28 @@
</span><ins>+function foo(a,b) {
+    return a ^ b + arguments.length;
+}
+
+var g0 = foo.bind({});
+var g1 = foo.bind({}, 1);
+var g2 = foo.bind({}, 1, 2);
+var g3 = foo.bind({}, 1, 2, 3);
+var start = new Date;
+
+var result = 0;
+for (var i = 0; i &lt; 100000; ++i) {
+    result *= 3;
+    result += g0(i, result);
+    result += g1();
+    result += g1(i);
+    result += g1(i, result);
+    result += g2();
+    result += g2(i);
+    result += g2(i, result);
+    result += g3();
+    result += g3(i);
+    result += g3(i, result);
+    result |= 0;
+}
+print((new Date - start))
+if (result != 1596499010)
+    throw &quot;Bad result: &quot; + result;
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreAPIJSObjectRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSObjectRef.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSObjectRef.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/API/JSObjectRef.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -127,6 +127,7 @@
</span><span class="cx"> 
</span><span class="cx">     JSCallbackConstructor* constructor = JSCallbackConstructor::create(exec, exec-&gt;lexicalGlobalObject(), exec-&gt;lexicalGlobalObject()-&gt;callbackConstructorStructure(), jsClass, callAsConstructor);
</span><span class="cx">     constructor-&gt;putDirect(exec-&gt;vm(), exec-&gt;propertyNames().prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
</span><ins>+    constructor-&gt;putDirect(exec-&gt;vm(), exec-&gt;propertyNames().prototypeForHasInstancePrivateName, jsPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     return toRef(constructor);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreAPIJSScriptRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSScriptRef.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSScriptRef.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/API/JSScriptRef.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -68,7 +68,7 @@
</span><span class="cx"> 
</span><span class="cx"> static bool parseScript(VM* vm, const SourceCode&amp; source, ParserError&amp; error)
</span><span class="cx"> {
</span><del>-    return JSC::parse&lt;JSC::ProgramNode&gt;(vm, source, 0, Identifier(), JSParseNormal, JSParseProgramCode, error);
</del><ins>+    return JSC::parse&lt;JSC::ProgramNode&gt;(vm, source, 0, Identifier(), JSParseNormal, JSParseProgramCode, JSNotFunctionKind, error);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> extern &quot;C&quot; {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -394,7 +394,6 @@
</span><span class="cx">     runtime/JSArrayBufferPrototype.cpp
</span><span class="cx">     runtime/JSArrayBufferView.cpp
</span><span class="cx">     runtime/JSArrayIterator.cpp
</span><del>-    runtime/JSBoundFunction.cpp
</del><span class="cx">     runtime/JSCJSValue.cpp
</span><span class="cx">     runtime/JSCell.cpp
</span><span class="cx">     runtime/JSConsole.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -1,3 +1,81 @@
</span><ins>+2014-04-08  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        Rewrite Function.bind as a builtin
+        https://bugs.webkit.org/show_bug.cgi?id=131083
+
+        Reviewed by Geoffrey Garen.
+
+        This change removes the existing function.bind implementation
+        entirely so JSBoundFunction is no more.
+
+        Instead we just return a regular JS closure with a few
+        private properties hanging off it that allow us to perform
+        the necessary bound function fakery.  While most of this is
+        simple, a couple of key changes:
+
+        - The parser and lexer now directly track whether they're
+          parsing code for call or construct and convert the private
+          name @IsConstructor into TRUETOK or FALSETOK as appropriate.
+          This automatically gives us the ability to vary behaviour
+          from within the builtin. It also leaves a lot of headroom
+          for trivial future improvements.
+        - The instanceof operator now uses the prototypeForHasInstance
+          private name, and we have a helper function to ensure that
+          all objects that need to can update their magical 'prototype'
+          property pair correctly.
+
+        * API/JSScriptRef.cpp:
+        (parseScript):
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * builtins/BuiltinExecutables.cpp:
+        (JSC::BuiltinExecutables::createBuiltinExecutable):
+        * builtins/Function.prototype.js:
+        (bind.bindingFunction):
+        (bind.else.bindingFunction):
+        (bind):
+        * bytecode/UnlinkedCodeBlock.cpp:
+        (JSC::generateFunctionCodeBlock):
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        * parser/Lexer.cpp:
+        (JSC::Lexer&lt;T&gt;::Lexer):
+        (JSC::Lexer&lt;LChar&gt;::parseIdentifier):
+        (JSC::Lexer&lt;UChar&gt;::parseIdentifier):
+        * parser/Lexer.h:
+        * parser/Parser.cpp:
+        (JSC::Parser&lt;LexerType&gt;::Parser):
+        (JSC::Parser&lt;LexerType&gt;::parseInner):
+        * parser/Parser.h:
+        (JSC::parse):
+        * parser/ParserModes.h:
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCache::getGlobalCodeBlock):
+        (JSC::CodeCache::getFunctionExecutableFromGlobalCode):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Completion.cpp:
+        (JSC::checkSyntax):
+        * runtime/Executable.cpp:
+        (JSC::ProgramExecutable::checkSyntax):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncBind): Deleted.
+        * runtime/JSBoundFunction.cpp: Removed.
+        * runtime/JSBoundFunction.h: Removed.
+        * runtime/JSFunction.cpp:
+        (JSC::RetrieveCallerFunctionFunctor::RetrieveCallerFunctionFunctor):
+        (JSC::RetrieveCallerFunctionFunctor::operator()):
+        (JSC::retrieveCallerFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::defineOwnProperty):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncSetTypeErrorAccessor):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+
</ins><span class="cx"> 2014-04-12  Filip Pizlo  &lt;fpizlo@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Math.fround() should be an intrinsic
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -640,7 +640,6 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSArrayBufferConstructor.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSArrayBufferPrototype.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSArrayBufferView.cpp&quot; /&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\runtime\JSBoundFunction.cpp&quot; /&gt;
</del><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSCJSValue.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSCell.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSConsole.cpp&quot; /&gt;
</span><span class="lines">@@ -1301,7 +1300,6 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSArrayBufferView.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSArrayBufferViewInlines.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSArrayIterator.h&quot; /&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\runtime\JSBoundFunction.h&quot; /&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSCInlines.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSCJSValue.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSCJSValueInlines.h&quot; /&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -606,9 +606,6 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSArray.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><del>-    &lt;ClCompile Include=&quot;..\runtime\JSBoundFunction.cpp&quot;&gt;
-      &lt;Filter&gt;runtime&lt;/Filter&gt;
-    &lt;/ClCompile&gt;
</del><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\JSCell.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><span class="lines">@@ -2255,9 +2252,6 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSArray.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span><del>-    &lt;ClInclude Include=&quot;..\runtime\JSBoundFunction.h&quot;&gt;
-      &lt;Filter&gt;runtime&lt;/Filter&gt;
-    &lt;/ClInclude&gt;
</del><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\JSCell.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -1215,8 +1215,6 @@
</span><span class="cx">                 86F3EEBD168CDE930077B92A /* ObjCCallbackFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 86F3EEB9168CCF750077B92A /* ObjCCallbackFunction.h */; };
</span><span class="cx">                 86F3EEBE168CDE930077B92A /* ObjCCallbackFunction.mm in Sources */ = {isa = PBXBuildFile; fileRef = 86F3EEBA168CCF750077B92A /* ObjCCallbackFunction.mm */; };
</span><span class="cx">                 86F3EEBF168CDE930077B92A /* ObjcRuntimeExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 86F3EEB616855A5B0077B92A /* ObjcRuntimeExtras.h */; };
</span><del>-                86FA9E91142BBB2E001773B7 /* JSBoundFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */; };
-                86FA9E92142BBB2E001773B7 /* JSBoundFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */; };
</del><span class="cx">                 90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */; };
</span><span class="cx">                 90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */ = {isa = PBXBuildFile; fileRef = 90213E3C123A40C200D422F3 /* MemoryStatistics.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 93052C340FB792190048FDC3 /* ParserArena.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93052C320FB792190048FDC3 /* ParserArena.cpp */; };
</span><span class="lines">@@ -2789,8 +2787,6 @@
</span><span class="cx">                 86F75EFB151C062F007C9BA3 /* RegExpCachedResult.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpCachedResult.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 86F75EFC151C062F007C9BA3 /* RegExpCachedResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpCachedResult.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 86F75EFD151C062F007C9BA3 /* RegExpMatchesArray.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpMatchesArray.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBoundFunction.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
-                86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBoundFunction.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><span class="cx">                 90213E3B123A40C200D422F3 /* MemoryStatistics.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MemoryStatistics.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 90213E3C123A40C200D422F3 /* MemoryStatistics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MemoryStatistics.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 93052C320FB792190048FDC3 /* ParserArena.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ParserArena.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4322,8 +4318,6 @@
</span><span class="cx">                                 0F2B66BC17B6B5AB00A7AE3F /* JSArrayBufferViewInlines.h */,
</span><span class="cx">                                 A7BDAEC417F4EA1400F6140C /* JSArrayIterator.cpp */,
</span><span class="cx">                                 A7BDAEC517F4EA1400F6140C /* JSArrayIterator.h */,
</span><del>-                                86FA9E8F142BBB2D001773B7 /* JSBoundFunction.cpp */,
-                                86FA9E90142BBB2E001773B7 /* JSBoundFunction.h */,
</del><span class="cx">                                 BC7F8FBA0E19D1EF008632C0 /* JSCell.cpp */,
</span><span class="cx">                                 BC1167D80E19BCC9008066DD /* JSCell.h */,
</span><span class="cx">                                 0F97496F1687ADE200A4FF6A /* JSCellInlines.h */,
</span><span class="lines">@@ -5939,7 +5933,6 @@
</span><span class="cx">                                 A7BDAECB17F4EA1400F6140C /* JSArrayIterator.h in Headers */,
</span><span class="cx">                                 BC18C4180E16F5CD00B34460 /* JSBase.h in Headers */,
</span><span class="cx">                                 140D17D70E8AD4A9000CD17D /* JSBasePrivate.h in Headers */,
</span><del>-                                86FA9E92142BBB2E001773B7 /* JSBoundFunction.h in Headers */,
</del><span class="cx">                                 BC18C4190E16F5CD00B34460 /* JSCallbackConstructor.h in Headers */,
</span><span class="cx">                                 BC18C41A0E16F5CD00B34460 /* JSCallbackFunction.h in Headers */,
</span><span class="cx">                                 BC18C41B0E16F5CD00B34460 /* JSCallbackObject.h in Headers */,
</span><span class="lines">@@ -7133,7 +7126,6 @@
</span><span class="cx">                                 0F2B66E817B6B5AB00A7AE3F /* JSArrayBufferView.cpp in Sources */,
</span><span class="cx">                                 A7BDAECA17F4EA1400F6140C /* JSArrayIterator.cpp in Sources */,
</span><span class="cx">                                 1421359B0A677F4F00A8195E /* JSBase.cpp in Sources */,
</span><del>-                                86FA9E91142BBB2E001773B7 /* JSBoundFunction.cpp in Sources */,
</del><span class="cx">                                 1440F8AF0A508D200005F061 /* JSCallbackConstructor.cpp in Sources */,
</span><span class="cx">                                 1440F8920A508B100005F061 /* JSCallbackFunction.cpp in Sources */,
</span><span class="cx">                                 14ABDF600A437FEF00ECCA01 /* JSCallbackObject.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsBuiltinExecutablescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/builtins/BuiltinExecutables.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx"> {
</span><span class="cx">     JSTextPosition positionBeforeLastNewline;
</span><span class="cx">     ParserError error;
</span><del>-    RefPtr&lt;ProgramNode&gt; program = parse&lt;ProgramNode&gt;(&amp;m_vm, source, 0, Identifier(), JSParseBuiltin, JSParseProgramCode, error, &amp;positionBeforeLastNewline);
</del><ins>+    RefPtr&lt;ProgramNode&gt; program = parse&lt;ProgramNode&gt;(&amp;m_vm, source, 0, Identifier(), JSParseBuiltin, JSParseProgramCode, JSNotFunctionKind, error, &amp;positionBeforeLastNewline);
</ins><span class="cx"> 
</span><span class="cx">     if (!program) {
</span><span class="cx">         dataLog(&quot;Fatal error compiling builtin function '&quot;, name.string(), &quot;': &quot;, error.m_message);
</span><span class="lines">@@ -71,7 +71,7 @@
</span><span class="cx">     RELEASE_ASSERT(body);
</span><span class="cx">     for (const auto&amp; closedVariable : program-&gt;closedVariables()) {
</span><span class="cx">         if (closedVariable == m_vm.propertyNames-&gt;arguments.impl())
</span><del>-        continue;
</del><ins>+            continue;
</ins><span class="cx">         
</span><span class="cx">         if (closedVariable == m_vm.propertyNames-&gt;undefinedKeyword.impl())
</span><span class="cx">             continue;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebuiltinsFunctionprototypejs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/builtins/Function.prototype.js (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/builtins/Function.prototype.js        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/builtins/Function.prototype.js        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -32,3 +32,166 @@
</span><span class="cx">     &quot;use strict&quot;;
</span><span class="cx">     return this.@apply(thisValue, argumentValues);
</span><span class="cx"> }
</span><ins>+
+function bind(thisValue /*, optional arguments */)
+{
+    &quot;use strict&quot;;
+    var boundFunction = this;
+    if (typeof boundFunction !== &quot;function&quot;)
+        throw new @TypeError(&quot;Cannot bind non-function object.&quot;);
+    var bindingFunction;
+    var oversizedCall = undefined;
+    if (arguments.length &lt;= 1) {
+        bindingFunction = function () {
+            if (@IsConstructor)
+                return new boundFunction(...arguments);
+            return boundFunction.@apply(thisValue, arguments);
+        }
+    } else {
+        var length = arguments.length;
+        switch (length - 1 /* skip thisValue */) {
+        case 1: {
+            var boundParameter = arguments[1];
+            bindingFunction = function () {
+                var argumentLength = arguments.length;
+                if (!argumentLength) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter);
+                    return boundFunction.@call(thisValue, boundParameter);
+                }
+                if (argumentLength == 1) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter, arguments[0]);
+                    return boundFunction.@call(thisValue, boundParameter, arguments[0]);
+                }
+                if (argumentLength == 2) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter, arguments[0], arguments[1]);
+                    return boundFunction.@call(thisValue, boundParameter, arguments[0], arguments[1]);
+                }
+                if (argumentLength == 3) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter, arguments[0], arguments[1], arguments[2]);
+                    return boundFunction.@call(thisValue, boundParameter, arguments[0], arguments[1], arguments[2]);
+                }
+                var completeArguments = [boundParameter, ...arguments];
+                if (!oversizedCall) {
+                    oversizedCall = function (isConstruct, boundFunction, thisValue, completeArguments) {
+                        if (isConstruct)
+                            return new boundFunction(...completeArguments);
+                        return boundFunction.@apply(thisValue, completeArguments);
+                    }
+                }
+                return oversizedCall(@IsConstructor, boundFunction, thisValue, completeArguments);
+            }
+            break;
+        }
+        case 2: {
+            var boundParameter1 = arguments[1];
+            var boundParameter2 = arguments[2];
+            bindingFunction = function () {
+                if (!arguments.length) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter1, boundParameter2);
+                    return boundFunction.@call(thisValue, boundParameter1, boundParameter2);
+                }
+                if (arguments.length == 1) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter1, boundParameter2, arguments[0]);
+                    return boundFunction.@call(thisValue, boundParameter1, boundParameter2, arguments[0]);
+                }
+                if (arguments.length == 2) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter1, boundParameter2, arguments[0], arguments[1]);
+                    return boundFunction.@call(thisValue, boundParameter1, boundParameter2, arguments[0], arguments[1]);
+                }
+                if (arguments.length == 3) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter1, boundParameter2, arguments[0], arguments[1], arguments[2]);
+                    return boundFunction.@call(thisValue, boundParameter1, boundParameter2, arguments[0], arguments[1], arguments[2]);
+                }
+                var completeArguments = [boundParameter1, boundParameter2, ...arguments];
+                if (!oversizedCall) {
+                    oversizedCall = function (isConstruct, boundFunction, thisValue, completeArguments) {
+                        if (isConstruct)
+                            return new boundFunction(...completeArguments);
+                        return boundFunction.@apply(thisValue, completeArguments);
+                    }
+                }
+                return oversizedCall(@IsConstructor, boundFunction, thisValue, completeArguments);
+            }
+            break;
+        }
+        case 3: {
+            var boundParameter1 = arguments[1];
+            var boundParameter2 = arguments[2];
+            var boundParameter3 = arguments[3];
+            bindingFunction = function () {
+                if (!arguments.length) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter1, boundParameter2, boundParameter3);
+                    return boundFunction.@call(thisValue, boundParameter1, boundParameter2, boundParameter3);
+                }
+                if (arguments.length == 1) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter1, boundParameter2, boundParameter3, arguments[0]);
+                    return boundFunction.@call(thisValue, boundParameter1, boundParameter2, boundParameter3, arguments[0]);
+                }
+                if (arguments.length == 2) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter1, boundParameter2, boundParameter3, arguments[0], arguments[1]);
+                    return boundFunction.@call(thisValue, boundParameter1, boundParameter2, boundParameter3, arguments[0], arguments[1]);
+                }
+                if (arguments.length == 3) {
+                    if (@IsConstructor)
+                        return new boundFunction(boundParameter1, boundParameter2, boundParameter3, arguments[0], arguments[1], arguments[2]);
+                    return boundFunction.@call(thisValue, boundParameter1, boundParameter2, boundParameter3, arguments[0], arguments[1], arguments[2]);
+                }
+                var completeArguments = [boundParameter1, boundParameter2, boundParameter3, ...arguments];
+                if (!oversizedCall) {
+                    oversizedCall = function (isConstruct, boundFunction, thisValue, completeArguments) {
+                        if (isConstruct)
+                            return new boundFunction(...completeArguments);
+                        return boundFunction.@apply(thisValue, completeArguments);
+                    }
+                }
+                return oversizedCall(@IsConstructor, boundFunction, thisValue, completeArguments);
+            }
+            break;
+        }
+        default:
+            var boundParameters = [];
+            for (var i = 1; i &lt; length; i++)
+                boundParameters[i - 1] = arguments[i];
+            
+            bindingFunction = function () {
+                if (!arguments.length) {
+                    if (@IsConstructor)
+                        return new boundFunction(...boundParameters);
+                    return boundFunction.@apply(thisValue, boundParameters);
+                }
+                
+                var completeArguments = [];
+                var localBoundParameters = boundParameters;
+                var boundLength = localBoundParameters.length;
+                for (var i = 0; i &lt; boundLength; i++)
+                    completeArguments[i] = localBoundParameters[i];
+                for (var i = 0; i &lt; arguments.length; i++)
+                    completeArguments[i + boundLength] = arguments[i];
+                if (@IsConstructor)
+                    return new boundFunction(...completeArguments);
+                else
+                    return boundFunction.@apply(thisValue, completeArguments);
+            }
+        }
+    }
+    bindingFunction.@boundFunctionName = this.name;
+    bindingFunction.@boundFunction = boundFunction.@boundFunction || boundFunction;
+    var boundLength = boundFunction.length - (arguments.length - 1);
+    if (boundLength &lt; 0)
+        boundLength = 0;
+    bindingFunction.@boundFunctionLength = boundLength;
+    @SetTypeErrorAccessor(bindingFunction, &quot;arguments&quot;);
+    @SetTypeErrorAccessor(bindingFunction, &quot;caller&quot;);
+    return bindingFunction;
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecodeUnlinkedCodeBlockcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/bytecode/UnlinkedCodeBlock.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -51,7 +51,7 @@
</span><span class="cx"> 
</span><span class="cx"> static UnlinkedFunctionCodeBlock* generateFunctionCodeBlock(VM&amp; vm, UnlinkedFunctionExecutable* executable, const SourceCode&amp; source, CodeSpecializationKind kind, DebuggerMode debuggerMode, ProfilerMode profilerMode, UnlinkedFunctionKind functionKind, ParserError&amp; error)
</span><span class="cx"> {
</span><del>-    RefPtr&lt;FunctionBodyNode&gt; body = parse&lt;FunctionBodyNode&gt;(&amp;vm, source, executable-&gt;parameters(), executable-&gt;name(), executable-&gt;toStrictness(), JSParseFunctionCode, error);
</del><ins>+    RefPtr&lt;FunctionBodyNode&gt; body = parse&lt;FunctionBodyNode&gt;(&amp;vm, source, executable-&gt;parameters(), executable-&gt;name(), executable-&gt;toStrictness(), JSParseFunctionCode, kind == CodeForConstruct ? JSFunctionIsConstructorKind : JSFunctionIsFunctionKind, error);
</ins><span class="cx"> 
</span><span class="cx">     if (!body) {
</span><span class="cx">         ASSERT(error.m_type != ParserError::ErrorNone);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorebytecompilerNodesCodegencpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/bytecompiler/NodesCodegen.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -1285,7 +1285,7 @@
</span><span class="cx">     generator.emitCheckHasInstance(dstReg.get(), src1.get(), src2.get(), target.get());
</span><span class="cx"> 
</span><span class="cx">     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</span><del>-    generator.emitGetById(prototype.get(), src2.get(), generator.vm()-&gt;propertyNames-&gt;prototype);
</del><ins>+    generator.emitGetById(prototype.get(), src2.get(), generator.vm()-&gt;propertyNames-&gt;prototypeForHasInstancePrivateName);
</ins><span class="cx"> 
</span><span class="cx">     generator.emitExpressionInfo(divot(), divotStart(), divotEnd());
</span><span class="cx">     RegisterID* result = generator.emitInstanceOf(dstReg.get(), src1.get(), prototype.get());
</span><span class="lines">@@ -1696,7 +1696,14 @@
</span><span class="cx"> void IfElseNode::emitBytecode(BytecodeGenerator&amp; generator, RegisterID* dst)
</span><span class="cx"> {
</span><span class="cx">     generator.emitDebugHook(WillExecuteStatement, firstLine(), startOffset(), lineStartOffset());
</span><del>-    
</del><ins>+    bool constantBranch = false;
+    if (m_condition-&gt;getBooleanConstant(constantBranch)) {
+        if (constantBranch)
+            generator.emitNode(dst, m_ifBlock);
+        else if (m_elseBlock)
+            generator.emitNode(dst, m_elseBlock);
+        return;
+    }
</ins><span class="cx">     RefPtr&lt;Label&gt; beforeThen = generator.newLabel();
</span><span class="cx">     RefPtr&lt;Label&gt; beforeElse = generator.newLabel();
</span><span class="cx">     RefPtr&lt;Label&gt; afterElse = generator.newLabel();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinterpreterInterpretercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/interpreter/Interpreter.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -44,7 +44,6 @@
</span><span class="cx"> #include &quot;GetterSetter.h&quot;
</span><span class="cx"> #include &quot;JSActivation.h&quot;
</span><span class="cx"> #include &quot;JSArray.h&quot;
</span><del>-#include &quot;JSBoundFunction.h&quot;
</del><span class="cx"> #include &quot;JSNameScope.h&quot;
</span><span class="cx"> #include &quot;JSNotAnObject.h&quot;
</span><span class="cx"> #include &quot;JSPropertyNameIterator.h&quot;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserLexercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/Lexer.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/Lexer.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/parser/Lexer.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -489,10 +489,11 @@
</span><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> template &lt;typename T&gt;
</span><del>-Lexer&lt;T&gt;::Lexer(VM* vm, JSParserStrictness strictness)
</del><ins>+Lexer&lt;T&gt;::Lexer(VM* vm, JSParserStrictness strictness, JSFunctionKind functionKind)
</ins><span class="cx">     : m_isReparsing(false)
</span><span class="cx">     , m_vm(vm)
</span><span class="cx">     , m_parsingBuiltinFunction(strictness == JSParseBuiltin)
</span><ins>+    , m_functionKind(functionKind)
</ins><span class="cx"> {
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -819,8 +820,13 @@
</span><span class="cx">                 ident = m_vm-&gt;propertyNames-&gt;getPrivateName(*ident);
</span><span class="cx">             else if (*ident == m_vm-&gt;propertyNames-&gt;undefinedKeyword)
</span><span class="cx">                 tokenData-&gt;ident = &amp;m_vm-&gt;propertyNames-&gt;undefinedPrivateName;
</span><ins>+            
</ins><span class="cx">             if (!ident)
</span><span class="cx">                 return INVALID_PRIVATE_NAME_ERRORTOK;
</span><ins>+            
+            if (*ident == m_vm-&gt;propertyNames-&gt;IsConstructorPrivateName)
+                return m_functionKind == JSFunctionIsConstructorKind ? TRUETOKEN : FALSETOKEN;
+            
</ins><span class="cx">         }
</span><span class="cx">         tokenData-&gt;ident = ident;
</span><span class="cx">     } else
</span><span class="lines">@@ -896,6 +902,11 @@
</span><span class="cx">                 ident = m_vm-&gt;propertyNames-&gt;getPrivateName(*ident);
</span><span class="cx">             else if (*ident == m_vm-&gt;propertyNames-&gt;undefinedKeyword)
</span><span class="cx">                 tokenData-&gt;ident = &amp;m_vm-&gt;propertyNames-&gt;undefinedPrivateName;
</span><ins>+            if (m_functionKind == JSFunctionIsConstructorKind) {
+                if (*ident == m_vm-&gt;propertyNames-&gt;IsConstructorPrivateName)
+                    return TRUETOKEN;
+                return FALSETOKEN;
+            }
</ins><span class="cx">             if (!ident)
</span><span class="cx">                 return INVALID_PRIVATE_NAME_ERRORTOK;
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserLexerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/Lexer.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/Lexer.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/parser/Lexer.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -71,7 +71,7 @@
</span><span class="cx">     WTF_MAKE_FAST_ALLOCATED;
</span><span class="cx"> 
</span><span class="cx"> public:
</span><del>-    Lexer(VM*, JSParserStrictness);
</del><ins>+    Lexer(VM*, JSParserStrictness, JSFunctionKind);
</ins><span class="cx">     ~Lexer();
</span><span class="cx"> 
</span><span class="cx">     // Character manipulation functions.
</span><span class="lines">@@ -238,6 +238,7 @@
</span><span class="cx"> 
</span><span class="cx">     VM* m_vm;
</span><span class="cx">     bool m_parsingBuiltinFunction;
</span><ins>+    JSFunctionKind m_functionKind;
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> template &lt;&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserNodesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/Nodes.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/Nodes.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/parser/Nodes.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -164,6 +164,7 @@
</span><span class="cx">         virtual bool isSubtract() const { return false; }
</span><span class="cx">         virtual bool isBoolean() const { return false; }
</span><span class="cx">         virtual bool isSpreadExpression() const { return false; }
</span><ins>+        virtual bool getBooleanConstant(bool&amp;) const { return false; }
</ins><span class="cx"> 
</span><span class="cx">         virtual void emitBytecodeInConditionContext(BytecodeGenerator&amp;, Label*, Label*, FallThroughMode);
</span><span class="cx"> 
</span><span class="lines">@@ -213,6 +214,13 @@
</span><span class="cx">         NullNode(const JSTokenLocation&amp;);
</span><span class="cx"> 
</span><span class="cx">     private:
</span><ins>+        
+        bool getBooleanConstant(bool&amp; value) const override
+        {
+            value = false;
+            return true;
+        }
+        
</ins><span class="cx">         virtual bool isNull() const override { return true; }
</span><span class="cx">         virtual JSValue jsValue(BytecodeGenerator&amp;) const override { return jsNull(); }
</span><span class="cx">     };
</span><span class="lines">@@ -221,8 +229,14 @@
</span><span class="cx">     public:
</span><span class="cx">         BooleanNode(const JSTokenLocation&amp;, bool value);
</span><span class="cx">         bool value() { return m_value; }
</span><ins>+        
+    private:
+        bool getBooleanConstant(bool&amp; value) const override
+        {
+            value = m_value;
+            return true;
+        }
</ins><span class="cx"> 
</span><del>-    private:
</del><span class="cx">         virtual bool isBoolean() const override { return true; }
</span><span class="cx">         virtual JSValue jsValue(BytecodeGenerator&amp;) const override { return jsBoolean(m_value); }
</span><span class="cx"> 
</span><span class="lines">@@ -236,6 +250,11 @@
</span><span class="cx">         void setValue(double value) { m_value = value; }
</span><span class="cx"> 
</span><span class="cx">     private:
</span><ins>+        bool getBooleanConstant(bool&amp; value) const override
+        {
+            value = (bool)m_value;
+            return true;
+        }
</ins><span class="cx">         virtual bool isNumber() const override { return true; }
</span><span class="cx">         virtual JSValue jsValue(BytecodeGenerator&amp;) const override { return jsNumber(m_value); }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserParsercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/Parser.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/Parser.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/parser/Parser.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -192,7 +192,7 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template &lt;typename LexerType&gt;
</span><del>-Parser&lt;LexerType&gt;::Parser(VM* vm, const SourceCode&amp; source, FunctionParameters* parameters, const Identifier&amp; name, JSParserStrictness strictness, JSParserMode parserMode)
</del><ins>+Parser&lt;LexerType&gt;::Parser(VM* vm, const SourceCode&amp; source, FunctionParameters* parameters, const Identifier&amp; name, JSParserStrictness strictness, JSParserMode parserMode, JSFunctionKind functionKind)
</ins><span class="cx">     : m_vm(vm)
</span><span class="cx">     , m_source(&amp;source)
</span><span class="cx">     , m_hasStackOverflow(false)
</span><span class="lines">@@ -207,7 +207,7 @@
</span><span class="cx">     , m_sourceElements(0)
</span><span class="cx">     , m_parsingBuiltin(strictness == JSParseBuiltin)
</span><span class="cx"> {
</span><del>-    m_lexer = adoptPtr(new LexerType(vm, strictness));
</del><ins>+    m_lexer = adoptPtr(new LexerType(vm, strictness, functionKind));
</ins><span class="cx">     m_arena = m_vm-&gt;parserArena.get();
</span><span class="cx">     m_lexer-&gt;setCode(source, m_arena);
</span><span class="cx">     m_token.m_location.line = source.firstLine();
</span><span class="lines">@@ -283,7 +283,6 @@
</span><span class="cx">     
</span><span class="cx">     Vector&lt;RefPtr&lt;StringImpl&gt;&gt; closedVariables;
</span><span class="cx">     if (m_parsingBuiltin) {
</span><del>-        RELEASE_ASSERT(!capturedVariables.size());
</del><span class="cx">         IdentifierSet usedVariables;
</span><span class="cx">         scope-&gt;getUsedVariables(usedVariables);
</span><span class="cx">         for (const auto&amp; variable : usedVariables) {
</span><span class="lines">@@ -294,6 +293,16 @@
</span><span class="cx">                 continue;
</span><span class="cx">             closedVariables.append(variable);
</span><span class="cx">         }
</span><ins>+        if (!capturedVariables.isEmpty()) {
+            for (const auto&amp; capturedVariable : capturedVariables) {
+                if (scope-&gt;hasDeclaredVariable(Identifier(m_vm, capturedVariable.get())))
+                    continue;
+                
+                if (scope-&gt;hasDeclaredParameter(Identifier(m_vm, capturedVariable.get())))
+                    continue;
+                RELEASE_ASSERT_NOT_REACHED();
+            }
+        }
</ins><span class="cx">     }
</span><span class="cx">     didFinishParsing(sourceElements, context.varDeclarations(), context.funcDeclarations(), features,
</span><span class="cx">         context.numConstants(), capturedVariables, std::move(closedVariables));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserParserh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/Parser.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/Parser.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/parser/Parser.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -411,7 +411,7 @@
</span><span class="cx">     WTF_MAKE_FAST_ALLOCATED;
</span><span class="cx"> 
</span><span class="cx"> public:
</span><del>-    Parser(VM*, const SourceCode&amp;, FunctionParameters*, const Identifier&amp;, JSParserStrictness, JSParserMode);
</del><ins>+    Parser(VM*, const SourceCode&amp;, FunctionParameters*, const Identifier&amp;, JSParserStrictness, JSParserMode, JSFunctionKind);
</ins><span class="cx">     ~Parser();
</span><span class="cx"> 
</span><span class="cx">     template &lt;class ParsedNode&gt;
</span><span class="lines">@@ -954,13 +954,13 @@
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template &lt;class ParsedNode&gt;
</span><del>-PassRefPtr&lt;ParsedNode&gt; parse(VM* vm, const SourceCode&amp; source, FunctionParameters* parameters, const Identifier&amp; name, JSParserStrictness strictness, JSParserMode parserMode, ParserError&amp; error, JSTextPosition* positionBeforeLastNewline = 0)
</del><ins>+PassRefPtr&lt;ParsedNode&gt; parse(VM* vm, const SourceCode&amp; source, FunctionParameters* parameters, const Identifier&amp; name, JSParserStrictness strictness, JSParserMode parserMode, JSFunctionKind functionKind, ParserError&amp; error, JSTextPosition* positionBeforeLastNewline = 0)
</ins><span class="cx"> {
</span><span class="cx">     SamplingRegion samplingRegion(&quot;Parsing&quot;);
</span><span class="cx"> 
</span><span class="cx">     ASSERT(!source.provider()-&gt;source().isNull());
</span><span class="cx">     if (source.provider()-&gt;source().is8Bit()) {
</span><del>-        Parser&lt;Lexer&lt;LChar&gt;&gt; parser(vm, source, parameters, name, strictness, parserMode);
</del><ins>+        Parser&lt;Lexer&lt;LChar&gt;&gt; parser(vm, source, parameters, name, strictness, parserMode, functionKind);
</ins><span class="cx">         RefPtr&lt;ParsedNode&gt; result = parser.parse&lt;ParsedNode&gt;(error);
</span><span class="cx">         if (positionBeforeLastNewline)
</span><span class="cx">             *positionBeforeLastNewline = parser.positionBeforeLastNewline();
</span><span class="lines">@@ -972,7 +972,7 @@
</span><span class="cx">         }
</span><span class="cx">         return result.release();
</span><span class="cx">     }
</span><del>-    Parser&lt;Lexer&lt;UChar&gt;&gt; parser(vm, source, parameters, name, strictness, parserMode);
</del><ins>+    Parser&lt;Lexer&lt;UChar&gt;&gt; parser(vm, source, parameters, name, strictness, parserMode, functionKind);
</ins><span class="cx">     RefPtr&lt;ParsedNode&gt; result = parser.parse&lt;ParsedNode&gt;(error);
</span><span class="cx">     if (positionBeforeLastNewline)
</span><span class="cx">         *positionBeforeLastNewline = parser.positionBeforeLastNewline();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreparserParserModesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/parser/ParserModes.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/parser/ParserModes.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/parser/ParserModes.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -33,7 +33,8 @@
</span><span class="cx"> 
</span><span class="cx"> enum JSParserStrictness { JSParseNormal, JSParseBuiltin, JSParseStrict };
</span><span class="cx"> enum JSParserMode { JSParseProgramCode, JSParseFunctionCode };
</span><del>-
</del><ins>+enum JSFunctionKind { JSNotFunctionKind, JSFunctionIsFunctionKind, JSFunctionIsConstructorKind };
+    
</ins><span class="cx"> enum ProfilerMode { ProfilerOff, ProfilerOn };
</span><span class="cx"> enum DebuggerMode { DebuggerOff, DebuggerOn };
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArgumentsIteratorConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArgumentsIteratorConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArgumentsIteratorConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/ArgumentsIteratorConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx"> void ArgumentsIteratorConstructor::finishCreation(VM&amp; vm, ArgumentsIteratorPrototype* prototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, prototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -62,7 +62,7 @@
</span><span class="cx"> void ArrayConstructor::finishCreation(VM&amp; vm, ArrayPrototype* arrayPrototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, arrayPrototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, arrayPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, arrayPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeBooleanConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/BooleanConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/BooleanConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/BooleanConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx"> void BooleanConstructor::finishCreation(VM&amp; vm, BooleanPrototype* booleanPrototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, booleanPrototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, booleanPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, booleanPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx"> 
</span><span class="cx">     // no. of arguments for constructor
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCodeCachecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CodeCache.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CodeCache.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/CodeCache.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -92,7 +92,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     typedef typename CacheTypes&lt;UnlinkedCodeBlockType&gt;::RootNode RootNode;
</span><del>-    RefPtr&lt;RootNode&gt; rootNode = parse&lt;RootNode&gt;(&amp;vm, source, 0, Identifier(), strictness, JSParseProgramCode, error);
</del><ins>+    RefPtr&lt;RootNode&gt; rootNode = parse&lt;RootNode&gt;(&amp;vm, source, 0, Identifier(), strictness, JSParseProgramCode, JSNotFunctionKind, error);
</ins><span class="cx">     if (!rootNode) {
</span><span class="cx">         m_sourceCode.remove(addResult.iterator);
</span><span class="cx">         return 0;
</span><span class="lines">@@ -142,7 +142,7 @@
</span><span class="cx">         return jsCast&lt;UnlinkedFunctionExecutable*&gt;(addResult.iterator-&gt;value.cell.get());
</span><span class="cx"> 
</span><span class="cx">     JSTextPosition positionBeforeLastNewline;
</span><del>-    RefPtr&lt;ProgramNode&gt; program = parse&lt;ProgramNode&gt;(&amp;vm, source, 0, Identifier(), JSParseNormal, JSParseProgramCode, error, &amp;positionBeforeLastNewline);
</del><ins>+    RefPtr&lt;ProgramNode&gt; program = parse&lt;ProgramNode&gt;(&amp;vm, source, 0, Identifier(), JSParseNormal, JSParseProgramCode, JSNotFunctionKind, error, &amp;positionBeforeLastNewline);
</ins><span class="cx">     if (!program) {
</span><span class="cx">         RELEASE_ASSERT(error.m_type != ParserError::ErrorNone);
</span><span class="cx">         m_sourceCode.remove(addResult.iterator);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCommonIdentifiersh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/CommonIdentifiers.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -219,7 +219,14 @@
</span><span class="cx">     macro(Object) \
</span><span class="cx">     macro(TypeError) \
</span><span class="cx">     macro(undefined) \
</span><del>-    macro(BuiltinLog)
</del><ins>+    macro(BuiltinLog) \
+    macro(IsConstructor) \
+    macro(boundFunctionName) \
+    macro(boundFunctionParameters) \
+    macro(boundFunction) \
+    macro(boundFunctionLength) \
+    macro(prototypeForHasInstance) \
+    macro(SetTypeErrorAccessor)
</ins><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeCompletioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Completion.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Completion.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/Completion.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx"> {
</span><span class="cx">     JSLockHolder lock(vm);
</span><span class="cx">     RELEASE_ASSERT(vm.atomicStringTable() == wtfThreadData().atomicStringTable());
</span><del>-    RefPtr&lt;ProgramNode&gt; programNode = parse&lt;ProgramNode&gt;(&amp;vm, source, 0, Identifier(), JSParseNormal, JSParseProgramCode, error);
</del><ins>+    RefPtr&lt;ProgramNode&gt; programNode = parse&lt;ProgramNode&gt;(&amp;vm, source, 0, Identifier(), JSParseNormal, JSParseProgramCode, JSNotFunctionKind, error);
</ins><span class="cx">     return programNode;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDateConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -108,7 +108,7 @@
</span><span class="cx"> void DateConstructor::finishCreation(VM&amp; vm, DatePrototype* datePrototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, datePrototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, datePrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, datePrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeErrorConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ErrorConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ErrorConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/ErrorConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, errorPrototype-&gt;classInfo()-&gt;className);
</span><span class="cx">     // ECMA 15.11.3.1 Error.prototype
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, errorPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, errorPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), DontDelete | ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeExecutablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Executable.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Executable.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/Executable.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -447,7 +447,7 @@
</span><span class="cx">     ParserError error;
</span><span class="cx">     VM* vm = &amp;exec-&gt;vm();
</span><span class="cx">     JSGlobalObject* lexicalGlobalObject = exec-&gt;lexicalGlobalObject();
</span><del>-    RefPtr&lt;ProgramNode&gt; programNode = parse&lt;ProgramNode&gt;(vm, m_source, 0, Identifier(), JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, error);
</del><ins>+    RefPtr&lt;ProgramNode&gt; programNode = parse&lt;ProgramNode&gt;(vm, m_source, 0, Identifier(), JSParseNormal, ProgramNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, JSNotFunctionKind, error);
</ins><span class="cx">     if (programNode)
</span><span class="cx">         return 0;
</span><span class="cx">     ASSERT(error.m_type != ParserError::ErrorNone);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeFunctionConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/FunctionConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> void FunctionConstructor::finishCreation(VM&amp; vm, FunctionPrototype* functionPrototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, functionPrototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, functionPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, functionPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx"> 
</span><span class="cx">     // Number of arguments for constructor
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeFunctionPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -25,7 +25,6 @@
</span><span class="cx"> #include &quot;BuiltinExecutables.h&quot;
</span><span class="cx"> #include &quot;BuiltinNames.h&quot;
</span><span class="cx"> #include &quot;JSArray.h&quot;
</span><del>-#include &quot;JSBoundFunction.h&quot;
</del><span class="cx"> #include &quot;JSFunction.h&quot;
</span><span class="cx"> #include &quot;JSString.h&quot;
</span><span class="cx"> #include &quot;JSStringBuilder.h&quot;
</span><span class="lines">@@ -40,7 +39,6 @@
</span><span class="cx"> const ClassInfo FunctionPrototype::s_info = { &quot;Function&quot;, &amp;Base::s_info, 0, 0, CREATE_METHOD_TABLE(FunctionPrototype) };
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL functionProtoFuncToString(ExecState*);
</span><del>-static EncodedJSValue JSC_HOST_CALL functionProtoFuncBind(ExecState*);
</del><span class="cx"> 
</span><span class="cx"> FunctionPrototype::FunctionPrototype(VM&amp; vm, Structure* structure)
</span><span class="cx">     : InternalFunction(vm, structure)
</span><span class="lines">@@ -62,9 +60,8 @@
</span><span class="cx"> 
</span><span class="cx">     *applyFunction = putDirectBuiltinFunctionWithoutTransition(vm, globalObject, vm.propertyNames-&gt;builtinNames().applyPublicName(), functionPrototypeApplyCodeGenerator(vm), DontEnum);
</span><span class="cx">     *callFunction = putDirectBuiltinFunctionWithoutTransition(vm, globalObject, vm.propertyNames-&gt;builtinNames().callPublicName(), functionPrototypeCallCodeGenerator(vm), DontEnum);
</span><del>-
-    JSFunction* bindFunction = JSFunction::create(vm, globalObject, 1, vm.propertyNames-&gt;bind.string(), functionProtoFuncBind);
-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;bind, bindFunction, DontEnum);
</del><ins>+    
+    putDirectBuiltinFunctionWithoutTransition(vm, globalObject, vm.propertyNames-&gt;builtinNames().bindPublicName(), functionPrototypeBindCodeGenerator(vm), DontEnum);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callFunctionPrototype(ExecState*)
</span><span class="lines">@@ -121,47 +118,4 @@
</span><span class="cx">     return throwVMTypeError(exec);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-// 15.3.4.5 Function.prototype.bind (thisArg [, arg1 [, arg2, ...]])
-EncodedJSValue JSC_HOST_CALL functionProtoFuncBind(ExecState* exec)
-{
-    JSGlobalObject* globalObject = exec-&gt;callee()-&gt;globalObject();
-
-    // Let Target be the this value.
-    JSValue target = exec-&gt;thisValue();
-
-    // If IsCallable(Target) is false, throw a TypeError exception.
-    CallData callData;
-    CallType callType = getCallData(target, callData);
-    if (callType == CallTypeNone)
-        return throwVMTypeError(exec);
-    // Primitive values are not callable.
-    ASSERT(target.isObject());
-    JSObject* targetObject = asObject(target);
-    VM&amp; vm = exec-&gt;vm();
-
-    // Let A be a new (possibly empty) internal list of all of the argument values provided after thisArg (arg1, arg2 etc), in order.
-    size_t numBoundArgs = exec-&gt;argumentCount() &gt; 1 ? exec-&gt;argumentCount() - 1 : 0;
-    JSArray* boundArgs = JSArray::tryCreateUninitialized(vm, globalObject-&gt;arrayStructureForIndexingTypeDuringAllocation(ArrayWithUndecided), numBoundArgs);
-    if (!boundArgs)
-        return JSValue::encode(throwOutOfMemoryError(exec));
-
-    for (size_t i = 0; i &lt; numBoundArgs; ++i)
-        boundArgs-&gt;initializeIndex(vm, i, exec-&gt;argument(i + 1));
-
-    // If the [[Class]] internal property of Target is &quot;Function&quot;, then ...
-    // Else set the length own property of F to 0.
-    unsigned length = 0;
-    if (targetObject-&gt;inherits(JSFunction::info())) {
-        ASSERT(target.get(exec, exec-&gt;propertyNames().length).isNumber());
-        // a. Let L be the length property of Target minus the length of A.
-        // b. Set the length own property of F to either 0 or L, whichever is larger.
-        unsigned targetLength = (unsigned)target.get(exec, exec-&gt;propertyNames().length).asNumber();
-        if (targetLength &gt; numBoundArgs)
-            length = targetLength - numBoundArgs;
-    }
-
-    JSString* name = target.get(exec, exec-&gt;propertyNames().name).toString(exec);
-    return JSValue::encode(JSBoundFunction::create(vm, globalObject, targetObject, exec-&gt;argument(0), boundArgs, length, name-&gt;value(exec)));
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSArrayBufferConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSArrayBufferConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx"> void JSArrayBufferConstructor::finishCreation(VM&amp; vm, JSArrayBufferPrototype* prototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, &quot;ArrayBuffer&quot;);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, prototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), DontEnum | DontDelete | ReadOnly);
</span><span class="cx"> 
</span><span class="cx">     JSGlobalObject* globalObject = this-&gt;globalObject();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -1,129 +0,0 @@
</span><del>-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include &quot;config.h&quot;
-#include &quot;JSBoundFunction.h&quot;
-
-#include &quot;GetterSetter.h&quot;
-#include &quot;JSGlobalObject.h&quot;
-#include &quot;JSCInlines.h&quot;
-
-namespace JSC {
-
-const ClassInfo JSBoundFunction::s_info = { &quot;Function&quot;, &amp;Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSBoundFunction) };
-
-EncodedJSValue JSC_HOST_CALL boundFunctionCall(ExecState* exec)
-{
-    JSBoundFunction* boundFunction = jsCast&lt;JSBoundFunction*&gt;(exec-&gt;callee());
-
-    ASSERT(isJSArray(boundFunction-&gt;boundArgs())); // Currently this is true!
-    JSArray* boundArgs = asArray(boundFunction-&gt;boundArgs());
-
-    MarkedArgumentBuffer args;
-    for (unsigned i = 0; i &lt; boundArgs-&gt;length(); ++i)
-        args.append(boundArgs-&gt;getIndexQuickly(i));
-    for (unsigned i = 0; i &lt; exec-&gt;argumentCount(); ++i)
-        args.append(exec-&gt;uncheckedArgument(i));
-
-    JSObject* targetFunction = boundFunction-&gt;targetFunction();
-    CallData callData;
-    CallType callType = getCallData(targetFunction, callData);
-    ASSERT(callType != CallTypeNone);
-    return JSValue::encode(call(exec, targetFunction, callType, callData, boundFunction-&gt;boundThis(), args));
-}
-
-EncodedJSValue JSC_HOST_CALL boundFunctionConstruct(ExecState* exec)
-{
-    JSBoundFunction* boundFunction = jsCast&lt;JSBoundFunction*&gt;(exec-&gt;callee());
-
-    ASSERT(isJSArray(boundFunction-&gt;boundArgs())); // Currently this is true!
-    JSArray* boundArgs = asArray(boundFunction-&gt;boundArgs());
-
-    MarkedArgumentBuffer args;
-    for (unsigned i = 0; i &lt; boundArgs-&gt;length(); ++i)
-        args.append(boundArgs-&gt;getIndexQuickly(i));
-    for (unsigned i = 0; i &lt; exec-&gt;argumentCount(); ++i)
-        args.append(exec-&gt;uncheckedArgument(i));
-
-    JSObject* targetFunction = boundFunction-&gt;targetFunction();
-    ConstructData constructData;
-    ConstructType constructType = getConstructData(targetFunction, constructData);
-    ASSERT(constructType != ConstructTypeNone);
-    return JSValue::encode(construct(exec, targetFunction, constructType, constructData, args));
-}
-
-JSBoundFunction* JSBoundFunction::create(VM&amp; vm, JSGlobalObject* globalObject, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int length, const String&amp; name)
-{
-    ConstructData constructData;
-    ConstructType constructType = JSC::getConstructData(targetFunction, constructData);
-    bool canConstruct = constructType != ConstructTypeNone;
-    NativeExecutable* executable = vm.getHostFunction(boundFunctionCall, canConstruct ? boundFunctionConstruct : callHostFunctionAsConstructor);
-    JSBoundFunction* function = new (NotNull, allocateCell&lt;JSBoundFunction&gt;(vm.heap)) JSBoundFunction(vm, globalObject, globalObject-&gt;boundFunctionStructure(), targetFunction, boundThis, boundArgs);
-
-    function-&gt;finishCreation(vm, executable, length, name);
-    return function;
-}
-
-void JSBoundFunction::destroy(JSCell* cell)
-{
-    static_cast&lt;JSBoundFunction*&gt;(cell)-&gt;JSBoundFunction::~JSBoundFunction();
-}
-
-bool JSBoundFunction::customHasInstance(JSObject* object, ExecState* exec, JSValue value)
-{
-    return jsCast&lt;JSBoundFunction*&gt;(object)-&gt;m_targetFunction-&gt;hasInstance(exec, value);
-}
-
-JSBoundFunction::JSBoundFunction(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs)
-    : Base(vm, globalObject, structure)
-    , m_targetFunction(vm, this, targetFunction)
-    , m_boundThis(vm, this, boundThis)
-    , m_boundArgs(vm, this, boundArgs)
-{
-}
-
-void JSBoundFunction::finishCreation(VM&amp; vm, NativeExecutable* executable, int length, const String&amp; name)
-{
-    Base::finishCreation(vm, executable, length, name);
-    ASSERT(inherits(info()));
-
-    putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;arguments, globalObject()-&gt;throwTypeErrorGetterSetter(vm), DontDelete | DontEnum | Accessor);
-    putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;caller, globalObject()-&gt;throwTypeErrorGetterSetter(vm), DontDelete | DontEnum | Accessor);
-}
-
-void JSBoundFunction::visitChildren(JSCell* cell, SlotVisitor&amp; visitor)
-{
-    JSBoundFunction* thisObject = jsCast&lt;JSBoundFunction*&gt;(cell);
-    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
-    COMPILE_ASSERT(StructureFlags &amp; OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
-    ASSERT(thisObject-&gt;structure()-&gt;typeInfo().overridesVisitChildren());
-    Base::visitChildren(thisObject, visitor);
-
-    visitor.append(&amp;thisObject-&gt;m_targetFunction);
-    visitor.append(&amp;thisObject-&gt;m_boundThis);
-    visitor.append(&amp;thisObject-&gt;m_boundArgs);
-}
-
-} // namespace JSC
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundFunctionh"></a>
<div class="delfile"><h4>Deleted: trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -1,75 +0,0 @@
</span><del>-/*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSBoundFunction_h
-#define JSBoundFunction_h
-
-#include &quot;JSFunction.h&quot;
-
-namespace JSC {
-
-EncodedJSValue JSC_HOST_CALL boundFunctionCall(ExecState*);
-EncodedJSValue JSC_HOST_CALL boundFunctionConstruct(ExecState*);
-
-class JSBoundFunction : public JSFunction {
-public:
-    typedef JSFunction Base;
-
-    static JSBoundFunction* create(VM&amp;, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int, const String&amp;);
-    
-    static void destroy(JSCell*);
-
-    static bool customHasInstance(JSObject*, ExecState*, JSValue);
-
-    JSObject* targetFunction() { return m_targetFunction.get(); }
-    JSValue boundThis() { return m_boundThis.get(); }
-    JSValue boundArgs() { return m_boundArgs.get(); }
-
-    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype) 
-    {
-        ASSERT(globalObject);
-        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info()); 
-    }
-
-    DECLARE_INFO;
-
-protected:
-    const static unsigned StructureFlags = OverridesHasInstance | OverridesVisitChildren | Base::StructureFlags;
-
-    static void visitChildren(JSCell*, SlotVisitor&amp;);
-
-private:
-    JSBoundFunction(VM&amp;, JSGlobalObject*, Structure*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs);
-    
-    void finishCreation(VM&amp;, NativeExecutable*, int, const String&amp;);
-
-    WriteBarrier&lt;JSObject&gt; m_targetFunction;
-    WriteBarrier&lt;Unknown&gt; m_boundThis;
-    WriteBarrier&lt;Unknown&gt; m_boundArgs;
-};
-
-} // namespace JSC
-
-#endif // JSFunction_h
</del></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSFunction.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSFunction.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSFunction.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -33,7 +33,6 @@
</span><span class="cx"> #include &quot;FunctionPrototype.h&quot;
</span><span class="cx"> #include &quot;GetterSetter.h&quot;
</span><span class="cx"> #include &quot;JSArray.h&quot;
</span><del>-#include &quot;JSBoundFunction.h&quot;
</del><span class="cx"> #include &quot;JSFunctionInlines.h&quot;
</span><span class="cx"> #include &quot;JSGlobalObject.h&quot;
</span><span class="cx"> #include &quot;JSNameScope.h&quot; 
</span><span class="lines">@@ -251,8 +250,9 @@
</span><span class="cx"> 
</span><span class="cx"> class RetrieveCallerFunctionFunctor {
</span><span class="cx"> public:
</span><del>-    RetrieveCallerFunctionFunctor(JSFunction* functionObj)
-        : m_targetCallee(jsDynamicCast&lt;JSObject*&gt;(functionObj))
</del><ins>+    RetrieveCallerFunctionFunctor(ExecState* exec, JSFunction* functionObj)
+        : m_exec(exec)
+        , m_targetCallee(jsDynamicCast&lt;JSObject*&gt;(functionObj))
</ins><span class="cx">         , m_hasFoundFrame(false)
</span><span class="cx">         , m_hasSkippedToCallerFrame(false)
</span><span class="cx">         , m_result(jsNull())
</span><span class="lines">@@ -265,7 +265,7 @@
</span><span class="cx">     {
</span><span class="cx">         JSObject* callee = visitor-&gt;callee();
</span><span class="cx"> 
</span><del>-        if (callee &amp;&amp; callee-&gt;inherits(JSBoundFunction::info()))
</del><ins>+        if (callee &amp;&amp; callee-&gt;hasOwnProperty(m_exec, m_exec-&gt;propertyNames().boundFunctionNamePrivateName))
</ins><span class="cx">             return StackVisitor::Continue;
</span><span class="cx"> 
</span><span class="cx">         if (!m_hasFoundFrame &amp;&amp; (callee != m_targetCallee))
</span><span class="lines">@@ -283,6 +283,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><ins>+    ExecState* m_exec;
</ins><span class="cx">     JSObject* m_targetCallee;
</span><span class="cx">     bool m_hasFoundFrame;
</span><span class="cx">     bool m_hasSkippedToCallerFrame;
</span><span class="lines">@@ -291,7 +292,7 @@
</span><span class="cx"> 
</span><span class="cx"> static JSValue retrieveCallerFunction(ExecState* exec, JSFunction* functionObj)
</span><span class="cx"> {
</span><del>-    RetrieveCallerFunctionFunctor functor(functionObj);
</del><ins>+    RetrieveCallerFunctionFunctor functor(exec, functionObj);
</ins><span class="cx">     exec-&gt;iterate(functor);
</span><span class="cx">     return functor.result();
</span><span class="cx"> }
</span><span class="lines">@@ -328,17 +329,59 @@
</span><span class="cx"> bool JSFunction::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><span class="cx">     JSFunction* thisObject = jsCast&lt;JSFunction*&gt;(object);
</span><del>-    if (thisObject-&gt;isHostOrBuiltinFunction())
</del><ins>+    if (thisObject-&gt;isHostFunction())
</ins><span class="cx">         return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
</span><del>-
-    if (propertyName == exec-&gt;propertyNames().prototype) {
</del><ins>+    if (thisObject-&gt;isBuiltinFunction()) {
+        if (propertyName == exec-&gt;propertyNames().caller) {
+            if (thisObject-&gt;jsExecutable()-&gt;isStrictMode()) {
+                bool result = Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+                if (!result) {
+                    thisObject-&gt;putDirectAccessor(exec, propertyName, thisObject-&gt;globalObject()-&gt;throwTypeErrorGetterSetter(exec-&gt;vm()), DontDelete | DontEnum | Accessor);
+                    result = Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+                    ASSERT(result);
+                }
+                return result;
+            }
+            slot.setCacheableCustom(thisObject, ReadOnly | DontEnum | DontDelete, callerGetter);
+            return true;
+        }
+        if (propertyName == exec-&gt;propertyNames().prototypeForHasInstancePrivateName) {
+            PropertySlot boundFunctionSlot(thisObject);
+            if (Base::getOwnPropertySlot(thisObject, exec, exec-&gt;propertyNames().boundFunctionPrivateName, boundFunctionSlot)) {
+                JSValue boundFunction = boundFunctionSlot.getValue(exec, exec-&gt;propertyNames().boundFunctionPrivateName);
+                PropertySlot boundPrototypeSlot(asObject(boundFunction));
+                if (asObject(boundFunction)-&gt;getPropertySlot(exec, propertyName, boundPrototypeSlot)) {
+                    slot.setValue(boundPrototypeSlot.slotBase(), boundPrototypeSlot.attributes(), boundPrototypeSlot.getValue(exec, propertyName));
+                    return true;
+                }
+            }
+        }
+        if (propertyName == exec-&gt;propertyNames().name) {
+            PropertySlot nameSlot(thisObject);
+            if (Base::getOwnPropertySlot(thisObject, exec, exec-&gt;vm().propertyNames-&gt;boundFunctionNamePrivateName, nameSlot)) {
+                slot.setValue(thisObject, DontEnum | DontDelete | ReadOnly, nameSlot.getValue(exec, exec-&gt;vm().propertyNames-&gt;boundFunctionNamePrivateName));
+                return true;
+            }
+        }
+        if (propertyName == exec-&gt;propertyNames().length) {
+            PropertySlot lengthSlot(thisObject);
+            if (Base::getOwnPropertySlot(thisObject, exec, exec-&gt;vm().propertyNames-&gt;boundFunctionLengthPrivateName, lengthSlot)) {
+                slot.setValue(thisObject, DontEnum | DontDelete | ReadOnly, lengthSlot.getValue(exec, exec-&gt;vm().propertyNames-&gt;boundFunctionLengthPrivateName));
+                return true;
+            }
+        }
+            
+        return Base::getOwnPropertySlot(thisObject, exec, propertyName, slot);
+    }
+    
+    if (propertyName == exec-&gt;propertyNames().prototype || propertyName == exec-&gt;propertyNames().prototypeForHasInstancePrivateName) {
</ins><span class="cx">         VM&amp; vm = exec-&gt;vm();
</span><span class="cx">         unsigned attributes;
</span><span class="cx">         PropertyOffset offset = thisObject-&gt;getDirectOffset(vm, propertyName, attributes);
</span><span class="cx">         if (!isValidOffset(offset)) {
</span><span class="cx">             JSObject* prototype = constructEmptyObject(exec);
</span><span class="cx">             prototype-&gt;putDirect(vm, exec-&gt;propertyNames().constructor, thisObject, DontEnum);
</span><del>-            thisObject-&gt;putDirect(vm, exec-&gt;propertyNames().prototype, prototype, DontDelete | DontEnum);
</del><ins>+            thisObject-&gt;putDirectPrototypeProperty(vm, prototype, DontDelete | DontEnum);
</ins><span class="cx">             offset = thisObject-&gt;getDirectOffset(vm, exec-&gt;propertyNames().prototype, attributes);
</span><span class="cx">             ASSERT(isValidOffset(offset));
</span><span class="cx">         }
</span><span class="lines">@@ -390,16 +433,23 @@
</span><span class="cx"> void JSFunction::getOwnNonIndexPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray&amp; propertyNames, EnumerationMode mode)
</span><span class="cx"> {
</span><span class="cx">     JSFunction* thisObject = jsCast&lt;JSFunction*&gt;(object);
</span><del>-    if (!thisObject-&gt;isHostOrBuiltinFunction() &amp;&amp; (mode == IncludeDontEnumProperties)) {
-        VM&amp; vm = exec-&gt;vm();
-        // Make sure prototype has been reified.
-        PropertySlot slot(thisObject);
-        thisObject-&gt;methodTable(vm)-&gt;getOwnPropertySlot(thisObject, exec, vm.propertyNames-&gt;prototype, slot);
</del><ins>+    if (mode == IncludeDontEnumProperties) {
+        bool shouldIncludeJSFunctionProperties = !thisObject-&gt;isHostOrBuiltinFunction();
+        if (!shouldIncludeJSFunctionProperties &amp;&amp; thisObject-&gt;isBuiltinFunction()) {
+            PropertySlot boundFunctionSlot(thisObject);
+            shouldIncludeJSFunctionProperties = Base::getOwnPropertySlot(thisObject, exec, exec-&gt;propertyNames().boundFunctionPrivateName, boundFunctionSlot);
+        }
+        if (shouldIncludeJSFunctionProperties) {
+            VM&amp; vm = exec-&gt;vm();
+            // Make sure prototype has been reified.
+            PropertySlot slot(thisObject);
+            thisObject-&gt;methodTable(vm)-&gt;getOwnPropertySlot(thisObject, exec, vm.propertyNames-&gt;prototype, slot);
</ins><span class="cx"> 
</span><del>-        propertyNames.add(vm.propertyNames-&gt;arguments);
-        propertyNames.add(vm.propertyNames-&gt;caller);
-        propertyNames.add(vm.propertyNames-&gt;length);
-        propertyNames.add(vm.propertyNames-&gt;name);
</del><ins>+            propertyNames.add(vm.propertyNames-&gt;arguments);
+            propertyNames.add(vm.propertyNames-&gt;caller);
+            propertyNames.add(vm.propertyNames-&gt;length);
+            propertyNames.add(vm.propertyNames-&gt;name);
+        }
</ins><span class="cx">     }
</span><span class="cx">     Base::getOwnNonIndexPropertyNames(thisObject, exec, propertyNames, mode);
</span><span class="cx"> }
</span><span class="lines">@@ -419,8 +469,10 @@
</span><span class="cx">         thisObject-&gt;m_allocationProfile.clear();
</span><span class="cx">         thisObject-&gt;m_allocationProfileWatchpoint.fireAll();
</span><span class="cx">         // Don't allow this to be cached, since a [[Put]] must clear m_allocationProfile.
</span><del>-        PutPropertySlot dontCache(thisObject);
-        Base::put(thisObject, exec, propertyName, value, dontCache);
</del><ins>+        PutPropertySlot dontCachePrototype(thisObject);
+        Base::put(thisObject, exec, propertyName, value, dontCachePrototype);
+        PutPropertySlot dontCachePrototypeForHasInstance(thisObject);
+        Base::put(thisObject, exec, exec-&gt;propertyNames().prototypeForHasInstancePrivateName, value, dontCachePrototypeForHasInstance);
</ins><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx">     if (thisObject-&gt;jsExecutable()-&gt;isStrictMode() &amp;&amp; (propertyName == exec-&gt;propertyNames().arguments || propertyName == exec-&gt;propertyNames().caller)) {
</span><span class="lines">@@ -465,7 +517,10 @@
</span><span class="cx">         thisObject-&gt;methodTable(exec-&gt;vm())-&gt;getOwnPropertySlot(thisObject, exec, propertyName, slot);
</span><span class="cx">         thisObject-&gt;m_allocationProfile.clear();
</span><span class="cx">         thisObject-&gt;m_allocationProfileWatchpoint.fireAll();
</span><del>-        return Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException);
</del><ins>+        if (!Base::defineOwnProperty(object, exec, propertyName, descriptor, throwException))
+            return false;
+        Base::defineOwnProperty(object, exec, exec-&gt;propertyNames().prototypeForHasInstancePrivateName, descriptor, throwException);
+        return true;
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     bool valueCheck;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGenericTypedArrayViewConstructorInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx"> void JSGenericTypedArrayViewConstructor&lt;ViewClass&gt;::finishCreation(VM&amp; vm, JSObject* prototype, const String&amp; name)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, name);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, prototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(3), DontEnum | DontDelete | ReadOnly);
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;BYTES_PER_ELEMENT, jsNumber(ViewClass::elementSize), DontEnum | ReadOnly | DontDelete);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -60,7 +60,6 @@
</span><span class="cx"> #include &quot;JSArrayBufferConstructor.h&quot;
</span><span class="cx"> #include &quot;JSArrayBufferPrototype.h&quot;
</span><span class="cx"> #include &quot;JSArrayIterator.h&quot;
</span><del>-#include &quot;JSBoundFunction.h&quot;
</del><span class="cx"> #include &quot;JSCInlines.h&quot;
</span><span class="cx"> #include &quot;JSCallbackConstructor.h&quot;
</span><span class="cx"> #include &quot;JSCallbackFunction.h&quot;
</span><span class="lines">@@ -278,7 +277,6 @@
</span><span class="cx"> 
</span><span class="cx">     m_functionPrototype.set(vm, this, FunctionPrototype::create(vm, FunctionPrototype::createStructure(vm, this, jsNull()))); // The real prototype will be set once ObjectPrototype is created.
</span><span class="cx">     m_functionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
</span><del>-    m_boundFunctionStructure.set(vm, this, JSBoundFunction::createStructure(vm, this, m_functionPrototype.get()));
</del><span class="cx">     m_namedFunctionStructure.set(vm, this, Structure::addPropertyTransition(vm, m_functionStructure.get(), vm.propertyNames-&gt;name, DontDelete | ReadOnly | DontEnum, 0, m_functionNameOffset));
</span><span class="cx">     m_internalFunctionStructure.set(vm, this, InternalFunction::createStructure(vm, this, m_functionPrototype.get()));
</span><span class="cx">     JSFunction* callFunction = 0;
</span><span class="lines">@@ -453,6 +451,7 @@
</span><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     JSFunction* builtinLog = JSFunction::create(vm, this, 1, vm.propertyNames-&gt;emptyIdentifier.string(), globalFuncBuiltinLog);
</span><ins>+    JSFunction* setTypeErrorAccessor = JSFunction::create(vm, this, 2, vm.propertyNames-&gt;emptyIdentifier.string(), globalFuncSetTypeErrorAccessor);
</ins><span class="cx">     GlobalPropertyInfo staticGlobals[] = {
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;NaN, jsNaN(), DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;Infinity, jsNumber(std::numeric_limits&lt;double&gt;::infinity()), DontEnum | DontDelete | ReadOnly),
</span><span class="lines">@@ -460,7 +459,8 @@
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;undefinedPrivateName, jsUndefined(), DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;ObjectPrivateName, objectConstructor, DontEnum | DontDelete | ReadOnly),
</span><span class="cx">         GlobalPropertyInfo(vm.propertyNames-&gt;TypeErrorPrivateName, m_typeErrorConstructor.get(), DontEnum | DontDelete | ReadOnly),
</span><del>-        GlobalPropertyInfo(vm.propertyNames-&gt;BuiltinLogPrivateName, builtinLog, DontEnum | DontDelete | ReadOnly)
</del><ins>+        GlobalPropertyInfo(vm.propertyNames-&gt;BuiltinLogPrivateName, builtinLog, DontEnum | DontDelete | ReadOnly),
+        GlobalPropertyInfo(vm.propertyNames-&gt;SetTypeErrorAccessorPrivateName, setTypeErrorAccessor, DontEnum | DontDelete | ReadOnly)
</ins><span class="cx">     };
</span><span class="cx">     addStaticGlobals(staticGlobals, WTF_ARRAY_LENGTH(staticGlobals));
</span><span class="cx">     
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -26,6 +26,7 @@
</span><span class="cx"> #include &quot;JSGlobalObjectFunctions.h&quot;
</span><span class="cx"> 
</span><span class="cx"> #include &quot;CallFrame.h&quot;
</span><ins>+#include &quot;GetterSetter.h&quot;
</ins><span class="cx"> #include &quot;Interpreter.h&quot;
</span><span class="cx"> #include &quot;JSFunction.h&quot;
</span><span class="cx"> #include &quot;JSGlobalObject.h&quot;
</span><span class="lines">@@ -812,4 +813,19 @@
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+    
+EncodedJSValue JSC_HOST_CALL globalFuncSetTypeErrorAccessor(ExecState* exec)
+{
+    JSObject* target = jsDynamicCast&lt;JSObject*&gt;(exec-&gt;argument(0));
+    JSValue propertyName = exec-&gt;argument(1);
+    
+    // Setting __proto__ of a primitive should have no effect.
+    if (!target || !propertyName.isString())
+        return JSValue::encode(jsUndefined());
+    VM&amp; vm = exec-&gt;vm();
+    Identifier property(exec, asString(propertyName)-&gt;getString(exec));
+    target-&gt;putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;arguments, target-&gt;globalObject()-&gt;throwTypeErrorGetterSetter(vm), DontDelete | DontEnum | Accessor);
+    return JSValue::encode(jsUndefined());
+}
+    
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -53,6 +53,8 @@
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncProtoSetter(ExecState*);
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL globalFuncBuiltinLog(ExecState*);
</span><span class="cx">     
</span><ins>+EncodedJSValue JSC_HOST_CALL globalFuncSetTypeErrorAccessor(ExecState*);
+    
</ins><span class="cx"> static const double mantissaOverflowLowerBound = 9007199254740992.0;
</span><span class="cx"> double parseIntOverflow(const LChar*, unsigned length, int radix);
</span><span class="cx"> bool isStrWhiteSpace(UChar);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -2668,5 +2668,17 @@
</span><span class="cx"> {
</span><span class="cx">     return exec-&gt;vm().throwException(exec, createTypeError(exec, message));
</span><span class="cx"> }
</span><del>-
</del><ins>+    
+void JSObject::putDirectPrototypeProperty(VM&amp; vm, JSValue value, int attributes)
+{
+    putDirect(vm, vm.propertyNames-&gt;prototype, value, attributes);
+    putDirect(vm, vm.propertyNames-&gt;prototypeForHasInstancePrivateName, value, attributes);
+}
+    
+void JSObject::putDirectPrototypePropertyWithoutTransitions(VM&amp; vm, JSValue value, int attributes)
+{
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, value, attributes);
+    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototypeForHasInstancePrivateName, value, attributes);
+}
+    
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -932,6 +932,9 @@
</span><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    JS_EXPORT_PRIVATE void putDirectPrototypeProperty(VM&amp;, JSValue, int);
+    void putDirectPrototypePropertyWithoutTransitions(VM&amp;, JSValue, int);
+    
</ins><span class="cx"> private:
</span><span class="cx">     friend class LLIntOffsetsExtractor;
</span><span class="cx">         
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -86,7 +86,7 @@
</span><span class="cx"> void JSPromiseConstructor::finishCreation(VM&amp; vm, JSPromisePrototype* promisePrototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, &quot;Promise&quot;);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, promisePrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, promisePrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/MapConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx"> void MapConstructor::finishCreation(VM&amp; vm, MapPrototype* mapPrototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, mapPrototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, mapPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, mapPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapIteratorConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapIteratorConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapIteratorConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/MapIteratorConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx"> void MapIteratorConstructor::finishCreation(VM&amp; vm, MapIteratorPrototype* prototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, prototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNameConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NameConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NameConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/NameConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -44,7 +44,7 @@
</span><span class="cx"> void NameConstructor::finishCreation(VM&amp; vm, NamePrototype* prototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, prototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, prototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), DontDelete | ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNativeErrorConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -46,7 +46,7 @@
</span><span class="cx">     NativeErrorPrototype* prototype = NativeErrorPrototype::create(vm, globalObject, prototypeStructure, name, this);
</span><span class="cx">     
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, prototype, DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirectPrototypeProperty(vm, prototype, DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     m_errorStructure.set(vm, this, ErrorInstance::createStructure(vm, globalObject, prototype));
</span><span class="cx">     ASSERT(m_errorStructure);
</span><span class="cx">     ASSERT(m_errorStructure-&gt;isObject());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNumberConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/NumberConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -66,7 +66,7 @@
</span><span class="cx">     ASSERT(inherits(info()));
</span><span class="cx"> 
</span><span class="cx">     // Number.Prototype
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, numberPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, numberPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx"> 
</span><span class="cx">     // no. of arguments for constructor
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -88,7 +88,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, Identifier(&amp;vm, &quot;Object&quot;).string());
</span><span class="cx">     // ECMA 15.2.3.1
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, objectPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, objectPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     // no. of arguments for constructor
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -95,7 +95,7 @@
</span><span class="cx">     ASSERT(inherits(info()));
</span><span class="cx"> 
</span><span class="cx">     // ECMA 15.10.5.1 RegExp.prototype
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, regExpPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, regExpPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx"> 
</span><span class="cx">     // no. of arguments for constructor
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/SetConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx"> void SetConstructor::finishCreation(VM&amp; vm, SetPrototype* setPrototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, setPrototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, setPrototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, setPrototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetIteratorConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetIteratorConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetIteratorConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/SetIteratorConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx"> void SetIteratorConstructor::finishCreation(VM&amp; vm, SetIteratorPrototype* prototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, prototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -56,7 +56,7 @@
</span><span class="cx"> void StringConstructor::finishCreation(VM&amp; vm, StringPrototype* stringPrototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, stringPrototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, stringPrototype, ReadOnly | DontEnum | DontDelete);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, stringPrototype, ReadOnly | DontEnum | DontDelete);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeWeakMapConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx"> void WeakMapConstructor::finishCreation(VM&amp; vm, WeakMapPrototype* prototype)
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm, prototype-&gt;classInfo()-&gt;className);
</span><del>-    putDirectWithoutTransition(vm, vm.propertyNames-&gt;prototype, prototype, DontEnum | DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypePropertyWithoutTransitions(vm, prototype, DontEnum | DontDelete | ReadOnly);
</ins><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/ChangeLog        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -1,3 +1,52 @@
</span><ins>+2014-04-08  Oliver Hunt  &lt;oliver@apple.com&gt;
+
+        Rewrite Function.bind as a builtin
+        https://bugs.webkit.org/show_bug.cgi?id=131083
+
+        Reviewed by Geoffrey Garen.
+
+        Switch WebCore to use the helper functions when defining the
+        prototype properties on DOM constructors, and update bindings
+        tests accordingly.
+
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::finishCreation):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorHelperMethods):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::JSTestActiveDOMObjectConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore::JSTestCustomNamedGetterConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructorConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::JSTestEventTargetConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::JSTestExceptionConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
+        (WebCore::JSTestGenerateIsReachableConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::JSTestMediaQueryListListenerConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructorConstructor::finishCreation):
+        (WebCore::JSTestNamedConstructorNamedConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestNode.cpp:
+        (WebCore::JSTestNodeConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::JSTestOverloadedConstructorsConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::JSTestTypedefsConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSattribute.cpp:
+        (WebCore::JSattributeConstructor::finishCreation):
+        * bindings/scripts/test/JS/JSreadonly.cpp:
+        (WebCore::JSreadonlyConstructor::finishCreation):
+
</ins><span class="cx"> 2014-04-13  Simon Fraser  &lt;simon.fraser@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [iOS WK2] Hook up scrolling tree nodes when coming out of the page cache
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSImageConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSImageConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSImageConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/js/JSImageConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx">  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
</span><del>- *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
</del><ins>+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2010, 2014 Apple Inc. All rights reserved.
</ins><span class="cx">  *
</span><span class="cx">  *  This library is free software; you can redistribute it and/or
</span><span class="cx">  *  modify it under the terms of the GNU Lesser General Public
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(globalObject);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSHTMLImageElementPrototype::self(vm, globalObject), None);
</del><ins>+    putDirectPrototypeProperty(vm, JSHTMLImageElementPrototype::self(vm, globalObject), None);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL constructImage(ExecState* exec)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -4526,15 +4526,15 @@
</span><span class="cx">     if (IsDOMGlobalObject($interface)) {
</span><span class="cx">         push(@$outputArray, &quot;    Base::finishCreation(vm);\n&quot;);
</span><span class="cx">         push(@$outputArray, &quot;    ASSERT(inherits(info()));\n&quot;);
</span><del>-        push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;prototype, globalObject-&gt;prototype(), DontDelete | ReadOnly);\n&quot;);
</del><ins>+        push(@$outputArray, &quot;    putDirectPrototypeProperty(vm, globalObject-&gt;prototype(), DontDelete | ReadOnly);\n&quot;);
</ins><span class="cx">     } elsif ($generatingNamedConstructor) {
</span><span class="cx">         push(@$outputArray, &quot;    Base::finishCreation(globalObject);\n&quot;);
</span><span class="cx">         push(@$outputArray, &quot;    ASSERT(inherits(info()));\n&quot;);
</span><del>-        push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;prototype, ${className}Prototype::self(vm, globalObject), None);\n&quot;);
</del><ins>+        push(@$outputArray, &quot;    putDirectPrototypeProperty(vm, ${className}Prototype::self(vm, globalObject), None);\n&quot;);
</ins><span class="cx">     } else {
</span><span class="cx">         push(@$outputArray, &quot;    Base::finishCreation(vm);\n&quot;);
</span><span class="cx">         push(@$outputArray, &quot;    ASSERT(inherits(info()));\n&quot;);
</span><del>-        push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;prototype, ${protoClassName}::self(vm, globalObject), DontDelete | ReadOnly);\n&quot;);
</del><ins>+        push(@$outputArray, &quot;    putDirectPrototypeProperty(vm, ${protoClassName}::self(vm, globalObject), DontDelete | ReadOnly);\n&quot;);
</ins><span class="cx">     }
</span><span class="cx">     push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;length, jsNumber(${leastConstructorLength}), ReadOnly | DontDelete | DontEnum);\n&quot;) if defined $leastConstructorLength;
</span><span class="cx">     push(@$outputArray, &quot;}\n\n&quot;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -74,7 +74,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestActiveDOMObjectPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestActiveDOMObjectPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestCustomNamedGetterPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestCustomNamedGetterPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -95,7 +95,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestEventConstructorPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestEventConstructorPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -76,7 +76,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestEventTargetPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestEventTargetPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -69,7 +69,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestExceptionPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestExceptionPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestGenerateIsReachablePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestGenerateIsReachablePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -193,7 +193,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestInterfacePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestInterfacePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -56,7 +56,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestMediaQueryListListenerPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestMediaQueryListListenerPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNamedConstructorPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestNamedConstructorPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -98,7 +98,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(globalObject);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNamedConstructorPrototype::self(vm, globalObject), None);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestNamedConstructorPrototype::self(vm, globalObject), None);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -62,7 +62,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNodePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestNodePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -242,7 +242,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestObjPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestObjPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -121,7 +121,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestOverloadedConstructorsPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestOverloadedConstructorsPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -60,7 +60,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestSerializedScriptValueInterfacePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestSerializedScriptValueInterfacePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -97,7 +97,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestTypedefsPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSTestTypedefsPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(2), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSattributecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -55,7 +55,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSattributePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSattributePrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSreadonlycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp (167198 => 167199)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp        2014-04-13 16:41:29 UTC (rev 167198)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp        2014-04-13 18:01:54 UTC (rev 167199)
</span><span class="lines">@@ -52,7 +52,7 @@
</span><span class="cx"> {
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx">     ASSERT(inherits(info()));
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSreadonlyPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</del><ins>+    putDirectPrototypeProperty(vm, JSreadonlyPrototype::self(vm, globalObject), DontDelete | ReadOnly);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontDelete | DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>