<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[177030] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/177030">177030</a></dd>
<dt>Author</dt> <dd>msaboff@apple.com</dd>
<dt>Date</dt> <dd>2014-12-09 11:52:40 -0800 (Tue, 09 Dec 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>DFG Tries using an inner object's getter/setter when one hasn't been defined
https://bugs.webkit.org/show_bug.cgi?id=139229

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

Added a new NullGetterFunction singleton class to use for getters and setters that
haven't been set to a user defined value.  The NullGetterFunction callReturnUndefined()
and createReturnUndefined() methods return undefined.  Changed all null checks of the
getter and setter pointers to the newly added isGetterNull() and isSetterNull()
helper methods.  

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
Added NullGetterFunction.cpp &amp; .h to build files.

* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::executeEffects):
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncLookupGetter):
(JSC::objectProtoFuncLookupSetter):
* runtime/PropertyDescriptor.cpp:
(JSC::PropertyDescriptor::setDescriptor):
(JSC::PropertyDescriptor::setAccessorDescriptor):
Changed checking getter and setter to null to use new isGetterNull() and isSetterNull()
helpers.

* inspector/JSInjectedScriptHostPrototype.cpp:
(Inspector::JSInjectedScriptHostPrototype::finishCreation):
* inspector/JSJavaScriptCallFramePrototype.cpp:
* jit/JITOperations.cpp:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* runtime/JSObject.cpp:
(JSC::JSObject::putIndexedDescriptor):
(JSC::putDescriptor):
(JSC::JSObject::defineOwnNonIndexProperty):
* runtime/MapPrototype.cpp:
(JSC::MapPrototype::finishCreation):
* runtime/SetPrototype.cpp:
(JSC::SetPrototype::finishCreation):
Updated calls to GetterSetter::create(), setGetter(), setSetter(), withGetter()
and withSetter() to provide a global object.

* runtime/GetterSetter.cpp:
(JSC::GetterSetter::withGetter):
(JSC::GetterSetter::withSetter):
(JSC::callGetter):
(JSC::callSetter):
* runtime/GetterSetter.h:
(JSC::GetterSetter::GetterSetter):
(JSC::GetterSetter::create):
(JSC::GetterSetter::isGetterNull):
(JSC::GetterSetter::isSetterNull):
(JSC::GetterSetter::setGetter):
(JSC::GetterSetter::setSetter):
Changed to use NullGetterFunction for unspecified getters / setters.

* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::createThrowTypeError):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::nullGetterFunction):
(JSC::JSGlobalObject::evalFunction):
Added m_nullGetterFunction singleton.  Updated calls to GetterSetter::create(),
setGetter() and setSetter() to provide a global object.

* runtime/NullGetterFunction.cpp: Added.
(JSC::callReturnUndefined):
(JSC::constructReturnUndefined):
(JSC::NullGetterFunction::getCallData):
(JSC::NullGetterFunction::getConstructData):
* runtime/NullGetterFunction.h: Added.
(JSC::NullGetterFunction::create):
(JSC::NullGetterFunction::createStructure):
(JSC::NullGetterFunction::NullGetterFunction):
New singleton class that returns undefined when called.

LayoutTests:

New regression test.

* js/regress-139229-expected.txt: Added.
* js/regress-139229.html: Added.
* js/script-tests/regress-139229.js: Added.
(InnerObjectNoGetter):
(InnerObjectNoGetter.prototype.set enabled):
(InnerObjectNoSetter):
(InnerObjectNoSetter.prototype.get enabled):
(OuterObject):
(OuterObject.prototype.get enabled):
(OuterObject.prototype.set enabled):</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreCMakeListstxt">trunk/Source/JavaScriptCore/CMakeLists.txt</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters">trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters</a></li>
<li><a href="#trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj">trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorJSInjectedScriptHostPrototypecpp">trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFramePrototypecpp">trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGetterSettercpp">trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGetterSetterh">trunk/Source/JavaScriptCore/runtime/GetterSetter.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjecth">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapPrototypecpp">trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectPrototypecpp">trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimePropertyDescriptorcpp">trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetPrototypecpp">trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsjsregress139229expectedtxt">trunk/LayoutTests/js/regress-139229-expected.txt</a></li>
<li><a href="#trunkLayoutTestsjsregress139229html">trunk/LayoutTests/js/regress-139229.html</a></li>
<li><a href="#trunkLayoutTestsjsscripttestsregress139229js">trunk/LayoutTests/js/script-tests/regress-139229.js</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNullGetterFunctioncpp">trunk/Source/JavaScriptCore/runtime/NullGetterFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNullGetterFunctionh">trunk/Source/JavaScriptCore/runtime/NullGetterFunction.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/LayoutTests/ChangeLog        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -1,3 +1,23 @@
</span><ins>+2014-12-09  Michael Saboff  &lt;msaboff@apple.com&gt;
+
+        DFG Tries using an inner object's getter/setter when one hasn't been defined
+        https://bugs.webkit.org/show_bug.cgi?id=139229
+
+        Reviewed by Filip Pizlo.
+
+        New regression test.
+
+        * js/regress-139229-expected.txt: Added.
+        * js/regress-139229.html: Added.
+        * js/script-tests/regress-139229.js: Added.
+        (InnerObjectNoGetter):
+        (InnerObjectNoGetter.prototype.set enabled):
+        (InnerObjectNoSetter):
+        (InnerObjectNoSetter.prototype.get enabled):
+        (OuterObject):
+        (OuterObject.prototype.get enabled):
+        (OuterObject.prototype.set enabled):
+
</ins><span class="cx"> 2014-12-09  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Re-enable function.arguments
</span></span></pre></div>
<a id="trunkLayoutTestsjsregress139229expectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress-139229-expected.txt (0 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress-139229-expected.txt                                (rev 0)
+++ trunk/LayoutTests/js/regress-139229-expected.txt        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -0,0 +1,9 @@
</span><ins>+Regression test for https://webkit.org/b/139229. This test should not crash.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsjsregress139229html"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/regress-139229.html (0 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/regress-139229.html                                (rev 0)
+++ trunk/LayoutTests/js/regress-139229.html        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body&gt;
+&lt;script src=&quot;script-tests/regress-139229.js&quot;&gt;&lt;/script&gt;
+&lt;script src=&quot;../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsjsscripttestsregress139229js"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/js/script-tests/regress-139229.js (0 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/js/script-tests/regress-139229.js                                (rev 0)
+++ trunk/LayoutTests/js/script-tests/regress-139229.js        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -0,0 +1,66 @@
</span><ins>+description(
+&quot;Regression test for https://webkit.org/b/139229. This test should not crash.&quot;
+);
+
+function InnerObjectNoGetter()
+{
+    this._enabled = false;
+}
+
+InnerObjectNoGetter.prototype = {
+    set enabled(x)
+    {
+        this._enabled = x;
+    }
+}
+
+function InnerObjectNoSetter()
+{
+    this._enabled = false;
+}
+
+InnerObjectNoSetter.prototype = {
+    get enabled()
+    {
+        return this._enabled;
+    }
+}
+
+function OuterObject(inner)
+{
+    this._innerObject = inner;
+}
+
+OuterObject.prototype = {
+    get enabled()
+    {
+        return this._innerObject.enabled;
+    },
+
+    set enabled(x)
+    {
+        this._innerObject.enabled = x;
+    }
+}
+
+var count = 0;
+
+var innerNoGetter = new InnerObjectNoGetter;
+var outerNoInnerGetter = new OuterObject(innerNoGetter);
+
+for (var i = 0; i &lt; 1000; ++i) {
+    if (outerNoInnerGetter.enabled)
+        ++count;
+}
+
+var innerNoSetter = new InnerObjectNoSetter;
+var outerNoInnerSetter = new OuterObject(innerNoSetter);
+
+for (var i = 0; i &lt; 1000; ++i) {
+    outerNoInnerSetter.enabled = true;
+    if (outerNoInnerSetter.enabled)
+        ++count;
+}
+
+if (count)
+    throw &quot;Error: bad result: count should be 0 but was: &quot; + count;
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreCMakeListstxt"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/CMakeLists.txt (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/CMakeLists.txt        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/CMakeLists.txt        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -513,6 +513,7 @@
</span><span class="cx">     runtime/NamePrototype.cpp
</span><span class="cx">     runtime/NativeErrorConstructor.cpp
</span><span class="cx">     runtime/NativeErrorPrototype.cpp
</span><ins>+    runtime/NullGetterFunction.cpp
</ins><span class="cx">     runtime/NumberConstructor.cpp
</span><span class="cx">     runtime/NumberObject.cpp
</span><span class="cx">     runtime/NumberPrototype.cpp
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/ChangeLog        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -1,3 +1,85 @@
</span><ins>+2014-12-09  Michael Saboff  &lt;msaboff@apple.com&gt;
+
+        DFG Tries using an inner object's getter/setter when one hasn't been defined
+        https://bugs.webkit.org/show_bug.cgi?id=139229
+
+        Reviewed by Filip Pizlo.
+
+        Added a new NullGetterFunction singleton class to use for getters and setters that
+        haven't been set to a user defined value.  The NullGetterFunction callReturnUndefined()
+        and createReturnUndefined() methods return undefined.  Changed all null checks of the
+        getter and setter pointers to the newly added isGetterNull() and isSetterNull()
+        helper methods.  
+
+        * CMakeLists.txt:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
+        * JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added NullGetterFunction.cpp &amp; .h to build files.
+
+        * dfg/DFGAbstractInterpreterInlines.h:
+        (JSC::DFG::AbstractInterpreter&lt;AbstractStateType&gt;::executeEffects):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        * runtime/PropertyDescriptor.cpp:
+        (JSC::PropertyDescriptor::setDescriptor):
+        (JSC::PropertyDescriptor::setAccessorDescriptor):
+        Changed checking getter and setter to null to use new isGetterNull() and isSetterNull()
+        helpers.
+
+        * inspector/JSInjectedScriptHostPrototype.cpp:
+        (Inspector::JSInjectedScriptHostPrototype::finishCreation):
+        * inspector/JSJavaScriptCallFramePrototype.cpp:
+        * jit/JITOperations.cpp:
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::putIndexedDescriptor):
+        (JSC::putDescriptor):
+        (JSC::JSObject::defineOwnNonIndexProperty):
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        Updated calls to GetterSetter::create(), setGetter(), setSetter(), withGetter()
+        and withSetter() to provide a global object.
+
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::withGetter):
+        (JSC::GetterSetter::withSetter):
+        (JSC::callGetter):
+        (JSC::callSetter):
+        * runtime/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        (JSC::GetterSetter::create):
+        (JSC::GetterSetter::isGetterNull):
+        (JSC::GetterSetter::isSetterNull):
+        (JSC::GetterSetter::setGetter):
+        (JSC::GetterSetter::setSetter):
+        Changed to use NullGetterFunction for unspecified getters / setters.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::createThrowTypeError):
+        (JSC::JSGlobalObject::visitChildren):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::nullGetterFunction):
+        (JSC::JSGlobalObject::evalFunction):
+        Added m_nullGetterFunction singleton.  Updated calls to GetterSetter::create(),
+        setGetter() and setSetter() to provide a global object.
+
+        * runtime/NullGetterFunction.cpp: Added.
+        (JSC::callReturnUndefined):
+        (JSC::constructReturnUndefined):
+        (JSC::NullGetterFunction::getCallData):
+        (JSC::NullGetterFunction::getConstructData):
+        * runtime/NullGetterFunction.h: Added.
+        (JSC::NullGetterFunction::create):
+        (JSC::NullGetterFunction::createStructure):
+        (JSC::NullGetterFunction::NullGetterFunction):
+        New singleton class that returns undefined when called.
+
</ins><span class="cx"> 2014-12-09  Geoffrey Garen  &lt;ggaren@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Re-enable function.arguments
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -778,6 +778,7 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\NamePrototype.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\NativeErrorConstructor.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\NativeErrorPrototype.cpp&quot; /&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\runtime\NullGetterFunction.cpp&quot; /&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\NumberConstructor.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\NumberObject.cpp&quot; /&gt;
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\NumberPrototype.cpp&quot; /&gt;
</span><span class="lines">@@ -1571,6 +1572,7 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\NamePrototype.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\NativeErrorConstructor.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\NativeErrorPrototype.h&quot; /&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\runtime\NullGetterFunction.h&quot; /&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\NumberConstructor.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\NumberObject.h&quot; /&gt;
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\NumberPrototype.h&quot; /&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorevcxprojJavaScriptCorevcxprojfilters"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -756,6 +756,9 @@
</span><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\NativeErrorPrototype.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><ins>+    &lt;ClCompile Include=&quot;..\runtime\NullGetterFunction.cpp&quot;&gt;
+      &lt;Filter&gt;runtime&lt;/Filter&gt;
+    &lt;/ClCompile&gt;
</ins><span class="cx">     &lt;ClCompile Include=&quot;..\runtime\NumberConstructor.cpp&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClCompile&gt;
</span><span class="lines">@@ -2768,6 +2771,9 @@
</span><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\NativeErrorPrototype.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span><ins>+    &lt;ClInclude Include=&quot;..\runtime\NullGetterFunction.h&quot;&gt;
+      &lt;Filter&gt;runtime&lt;/Filter&gt;
+    &lt;/ClInclude&gt;
</ins><span class="cx">     &lt;ClInclude Include=&quot;..\runtime\NumberConstructor.h&quot;&gt;
</span><span class="cx">       &lt;Filter&gt;runtime&lt;/Filter&gt;
</span><span class="cx">     &lt;/ClInclude&gt;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreJavaScriptCorexcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -917,6 +917,7 @@
</span><span class="cx">                 6511230714046B0A002B101D /* testRegExp.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 651122E5140469BA002B101D /* testRegExp.cpp */; };
</span><span class="cx">                 6514F21918B3E1670098FF8B /* Bytecodes.h in Headers */ = {isa = PBXBuildFile; fileRef = 6514F21718B3E1670098FF8B /* Bytecodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><span class="cx">                 65303D641447B9E100D3F904 /* ParserTokens.h in Headers */ = {isa = PBXBuildFile; fileRef = 65303D631447B9E100D3F904 /* ParserTokens.h */; settings = {ATTRIBUTES = (Private, ); }; };
</span><ins>+                6546F5211A32B313006F07D5 /* NullGetterFunction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */; };
</ins><span class="cx">                 6553A33117A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */; };
</span><span class="cx">                 6553A33217A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h in Headers */ = {isa = PBXBuildFile; fileRef = 6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */; };
</span><span class="cx">                 655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 655EB29A10CE2581001A990E /* NodesCodegen.cpp */; };
</span><span class="lines">@@ -2562,6 +2563,8 @@
</span><span class="cx">                 65303D631447B9E100D3F904 /* ParserTokens.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserTokens.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 65400C0F0A69BAF200509887 /* PropertyNameArray.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = PropertyNameArray.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 65400C100A69BAF200509887 /* PropertyNameArray.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PropertyNameArray.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><ins>+                6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; lineEnding = 0; path = NullGetterFunction.cpp; sourceTree = &quot;&lt;group&gt;&quot;; xcLanguageSpecificationIdentifier = xcode.lang.cpp; };
+                6546F5201A32A59C006F07D5 /* NullGetterFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NullGetterFunction.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</ins><span class="cx">                 6553A32F17A1F1EE008CF6F3 /* CommonSlowPathsExceptions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CommonSlowPathsExceptions.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 6553A33017A1F1EE008CF6F3 /* CommonSlowPathsExceptions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CommonSlowPathsExceptions.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 655EB29A10CE2581001A990E /* NodesCodegen.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NodesCodegen.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -3154,7 +3157,7 @@
</span><span class="cx">                 BC2680C90E16D4E900A06E92 /* ObjectPrototype.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjectPrototype.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 BC2680E60E16D52300A06E92 /* NumberConstructor.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NumberConstructor.lut.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 BC3046060E1F497F003232CF /* Error.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Error.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><del>-                BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GetterSetter.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</del><ins>+                BC337BDE0E1AF0B80076918A /* GetterSetter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; lineEnding = 0; path = GetterSetter.h; sourceTree = &quot;&lt;group&gt;&quot;; xcLanguageSpecificationIdentifier = xcode.lang.objcpp; };
</ins><span class="cx">                 BC337BEA0E1B00CB0076918A /* Error.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Error.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 BC6AAAE40E1F426500AD87D8 /* ClassInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ClassInfo.h; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="cx">                 BC756FC60E2031B200DE7D12 /* JSGlobalObjectFunctions.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSGlobalObjectFunctions.cpp; sourceTree = &quot;&lt;group&gt;&quot;; };
</span><span class="lines">@@ -4439,6 +4442,8 @@
</span><span class="cx">                                 BC02E9090E1839DB000F9297 /* NativeErrorConstructor.h */,
</span><span class="cx">                                 BC02E90A0E1839DB000F9297 /* NativeErrorPrototype.cpp */,
</span><span class="cx">                                 BC02E90B0E1839DB000F9297 /* NativeErrorPrototype.h */,
</span><ins>+                                6546F51F1A32A59C006F07D5 /* NullGetterFunction.cpp */,
+                                6546F5201A32A59C006F07D5 /* NullGetterFunction.h */,
</ins><span class="cx">                                 BC2680C20E16D4E900A06E92 /* NumberConstructor.cpp */,
</span><span class="cx">                                 BC2680C30E16D4E900A06E92 /* NumberConstructor.h */,
</span><span class="cx">                                 F692A8700255597D01FF60F7 /* NumberObject.cpp */,
</span><span class="lines">@@ -7173,6 +7178,7 @@
</span><span class="cx">                                 14469DE1107EC7E700650446 /* NativeErrorPrototype.cpp in Sources */,
</span><span class="cx">                                 148F21B7107EC5470042EC2C /* Nodes.cpp in Sources */,
</span><span class="cx">                                 655EB29B10CE2581001A990E /* NodesCodegen.cpp in Sources */,
</span><ins>+                                6546F5211A32B313006F07D5 /* NullGetterFunction.cpp in Sources */,
</ins><span class="cx">                                 14469DE2107EC7E700650446 /* NumberConstructor.cpp in Sources */,
</span><span class="cx">                                 14469DE3107EC7E700650446 /* NumberObject.cpp in Sources */,
</span><span class="cx">                                 14469DE4107EC7E700650446 /* NumberPrototype.cpp in Sources */,
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -1384,8 +1384,9 @@
</span><span class="cx">     case GetGetter: {
</span><span class="cx">         JSValue base = forNode(node-&gt;child1()).m_value;
</span><span class="cx">         if (base) {
</span><del>-            if (JSObject* getter = jsCast&lt;GetterSetter*&gt;(base)-&gt;getterConcurrently()) {
-                setConstant(node, *m_graph.freeze(getter));
</del><ins>+            GetterSetter* getterSetter = jsCast&lt;GetterSetter*&gt;(base);
+            if (!getterSetter-&gt;isGetterNull()) {
+                setConstant(node, *m_graph.freeze(getterSetter-&gt;getterConcurrently()));
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="lines">@@ -1397,8 +1398,9 @@
</span><span class="cx">     case GetSetter: {
</span><span class="cx">         JSValue base = forNode(node-&gt;child1()).m_value;
</span><span class="cx">         if (base) {
</span><del>-            if (JSObject* setter = jsCast&lt;GetterSetter*&gt;(base)-&gt;setterConcurrently()) {
-                setConstant(node, *m_graph.freeze(setter));
</del><ins>+            GetterSetter* getterSetter = jsCast&lt;GetterSetter*&gt;(base);
+            if (!getterSetter-&gt;isSetterNull()) {
+                setConstant(node, *m_graph.freeze(getterSetter-&gt;setterConcurrently()));
</ins><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorJSInjectedScriptHostPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/inspector/JSInjectedScriptHostPrototype.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -63,9 +63,9 @@
</span><span class="cx">     JSC_NATIVE_FUNCTION(&quot;isHTMLAllCollection&quot;, jsInjectedScriptHostPrototypeFunctionIsHTMLAllCollection, DontEnum, 1);
</span><span class="cx"> 
</span><span class="cx">     Identifier evaluateIdentifier(&amp;vm, &quot;evaluate&quot;);
</span><del>-    GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
</ins><span class="cx">     JSFunction* function = JSFunction::create(vm, globalObject, 0, evaluateIdentifier.string(), jsInjectedScriptHostPrototypeAttributeEvaluate);
</span><del>-    accessor-&gt;setGetter(vm, function);
</del><ins>+    accessor-&gt;setGetter(vm, globalObject, function);
</ins><span class="cx">     putDirectNonIndexAccessor(vm, evaluateIdentifier, accessor, DontEnum | Accessor);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreinspectorJSJavaScriptCallFramePrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/inspector/JSJavaScriptCallFramePrototype.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -66,9 +66,9 @@
</span><span class="cx"> #define JSC_NATIVE_NON_INDEX_ACCESSOR(jsName, cppName, attributes) \
</span><span class="cx">     { \
</span><span class="cx">         Identifier identifier(&amp;vm, jsName); \
</span><del>-        GetterSetter* accessor = GetterSetter::create(vm); \
</del><ins>+        GetterSetter* accessor = GetterSetter::create(vm, globalObject); \
</ins><span class="cx">         JSFunction* function = JSFunction::create(vm, globalObject, 0, identifier.string(), cppName); \
</span><del>-        accessor-&gt;setGetter(vm, function); \
</del><ins>+        accessor-&gt;setGetter(vm, globalObject, function); \
</ins><span class="cx">         putDirectNonIndexAccessor(vm, identifier, accessor, (attributes)); \
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -1268,7 +1268,7 @@
</span><span class="cx">     ASSERT(JSValue::decode(encodedObjectValue).isObject());
</span><span class="cx">     JSObject* baseObj = asObject(JSValue::decode(encodedObjectValue));
</span><span class="cx"> 
</span><del>-    GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+    GetterSetter* accessor = GetterSetter::create(vm, exec-&gt;lexicalGlobalObject());
</ins><span class="cx"> 
</span><span class="cx">     JSValue getter = JSValue::decode(encodedGetterValue);
</span><span class="cx">     JSValue setter = JSValue::decode(encodedSetterValue);
</span><span class="lines">@@ -1277,9 +1277,9 @@
</span><span class="cx">     ASSERT(getter.isObject() || setter.isObject());
</span><span class="cx"> 
</span><span class="cx">     if (!getter.isUndefined())
</span><del>-        accessor-&gt;setGetter(vm, asObject(getter));
</del><ins>+        accessor-&gt;setGetter(vm, exec-&gt;lexicalGlobalObject(), asObject(getter));
</ins><span class="cx">     if (!setter.isUndefined())
</span><del>-        accessor-&gt;setSetter(vm, asObject(setter));
</del><ins>+        accessor-&gt;setSetter(vm, exec-&gt;lexicalGlobalObject(), asObject(setter));
</ins><span class="cx">     baseObj-&gt;putDirectAccessor(exec, *identifier, accessor, Accessor);
</span><span class="cx"> }
</span><span class="cx"> #else
</span><span class="lines">@@ -1291,16 +1291,16 @@
</span><span class="cx">     ASSERT(object &amp;&amp; object-&gt;isObject());
</span><span class="cx">     JSObject* baseObj = object-&gt;getObject();
</span><span class="cx"> 
</span><del>-    GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+    GetterSetter* accessor = GetterSetter::create(vm, exec-&gt;lexicalGlobalObject());
</ins><span class="cx"> 
</span><span class="cx">     ASSERT(!getter || getter-&gt;isObject());
</span><span class="cx">     ASSERT(!setter || setter-&gt;isObject());
</span><span class="cx">     ASSERT(getter || setter);
</span><span class="cx"> 
</span><span class="cx">     if (getter)
</span><del>-        accessor-&gt;setGetter(vm, getter-&gt;getObject());
</del><ins>+        accessor-&gt;setGetter(vm, exec-&gt;lexicalGlobalObject(), getter-&gt;getObject());
</ins><span class="cx">     if (setter)
</span><del>-        accessor-&gt;setSetter(vm, setter-&gt;getObject());
</del><ins>+        accessor-&gt;setSetter(vm, exec-&gt;lexicalGlobalObject(), setter-&gt;getObject());
</ins><span class="cx">     baseObj-&gt;putDirectAccessor(exec, *identifier, accessor, Accessor);
</span><span class="cx"> }
</span><span class="cx"> #endif
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -872,7 +872,7 @@
</span><span class="cx">     ASSERT(LLINT_OP(1).jsValue().isObject());
</span><span class="cx">     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
</span><span class="cx">     
</span><del>-    GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+    GetterSetter* accessor = GetterSetter::create(vm, exec-&gt;lexicalGlobalObject());
</ins><span class="cx">     LLINT_CHECK_EXCEPTION();
</span><span class="cx">     
</span><span class="cx">     JSValue getter = LLINT_OP(3).jsValue();
</span><span class="lines">@@ -882,9 +882,9 @@
</span><span class="cx">     ASSERT(getter.isObject() || setter.isObject());
</span><span class="cx">     
</span><span class="cx">     if (!getter.isUndefined())
</span><del>-        accessor-&gt;setGetter(vm, asObject(getter));
</del><ins>+        accessor-&gt;setGetter(vm, exec-&gt;lexicalGlobalObject(), asObject(getter));
</ins><span class="cx">     if (!setter.isUndefined())
</span><del>-        accessor-&gt;setSetter(vm, asObject(setter));
</del><ins>+        accessor-&gt;setSetter(vm, exec-&gt;lexicalGlobalObject(), asObject(setter));
</ins><span class="cx">     baseObj-&gt;putDirectAccessor(
</span><span class="cx">         exec,
</span><span class="cx">         exec-&gt;codeBlock()-&gt;identifier(pc[2].u.operand),
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGetterSettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -44,29 +44,29 @@
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_setter);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-GetterSetter* GetterSetter::withGetter(VM&amp; vm, JSObject* newGetter)
</del><ins>+GetterSetter* GetterSetter::withGetter(VM&amp; vm, JSGlobalObject* globalObject, JSObject* newGetter)
</ins><span class="cx"> {
</span><del>-    if (!getter()) {
-        setGetter(vm, newGetter);
</del><ins>+    if (isGetterNull()) {
+        setGetter(vm, globalObject, newGetter);
</ins><span class="cx">         return this;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    GetterSetter* result = GetterSetter::create(vm);
-    result-&gt;setGetter(vm, newGetter);
-    result-&gt;setSetter(vm, setter());
</del><ins>+    GetterSetter* result = GetterSetter::create(vm, globalObject);
+    result-&gt;setGetter(vm, globalObject, newGetter);
+    result-&gt;setSetter(vm, globalObject, setter());
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-GetterSetter* GetterSetter::withSetter(VM&amp; vm, JSObject* newSetter)
</del><ins>+GetterSetter* GetterSetter::withSetter(VM&amp; vm, JSGlobalObject* globalObject, JSObject* newSetter)
</ins><span class="cx"> {
</span><del>-    if (!setter()) {
-        setSetter(vm, newSetter);
</del><ins>+    if (isSetterNull()) {
+        setSetter(vm, globalObject, newSetter);
</ins><span class="cx">         return this;
</span><span class="cx">     }
</span><span class="cx">     
</span><del>-    GetterSetter* result = GetterSetter::create(vm);
-    result-&gt;setGetter(vm, getter());
-    result-&gt;setSetter(vm, newSetter);
</del><ins>+    GetterSetter* result = GetterSetter::create(vm, globalObject);
+    result-&gt;setGetter(vm, globalObject, getter());
+    result-&gt;setSetter(vm, globalObject, newSetter);
</ins><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -78,8 +78,6 @@
</span><span class="cx">         return exec-&gt;exception();
</span><span class="cx"> 
</span><span class="cx">     JSObject* getter = jsCast&lt;GetterSetter*&gt;(getterSetter)-&gt;getter();
</span><del>-    if (!getter)
-        return jsUndefined();
</del><span class="cx"> 
</span><span class="cx">     CallData callData;
</span><span class="cx">     CallType callType = getter-&gt;methodTable(exec-&gt;vm())-&gt;getCallData(getter, callData);
</span><span class="lines">@@ -88,13 +86,16 @@
</span><span class="cx"> 
</span><span class="cx"> void callSetter(ExecState* exec, JSValue base, JSValue getterSetter, JSValue value, ECMAMode ecmaMode)
</span><span class="cx"> {
</span><del>-    JSObject* setter = jsCast&lt;GetterSetter*&gt;(getterSetter)-&gt;setter();
-    if (!setter) {
</del><ins>+    GetterSetter* getterSetterObj = jsCast&lt;GetterSetter*&gt;(getterSetter);
+
+    if (getterSetterObj-&gt;isSetterNull()) {
</ins><span class="cx">         if (ecmaMode == StrictMode)
</span><span class="cx">             throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</span><span class="cx">         return;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    JSObject* setter = getterSetterObj-&gt;setter();
+
</ins><span class="cx">     MarkedArgumentBuffer args;
</span><span class="cx">     args.append(value);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGetterSetterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GetterSetter.h (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GetterSetter.h        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/GetterSetter.h        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -26,6 +26,8 @@
</span><span class="cx"> #include &quot;JSCell.h&quot;
</span><span class="cx"> 
</span><span class="cx"> #include &quot;CallFrame.h&quot;
</span><ins>+#include &quot;JSGlobalObject.h&quot;
+#include &quot;NullGetterFunction.h&quot;
</ins><span class="cx"> #include &quot;Structure.h&quot;
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -41,18 +43,20 @@
</span><span class="cx"> class GetterSetter : public JSCell {
</span><span class="cx">     friend class JIT;
</span><span class="cx"> 
</span><del>-private:        
-    GetterSetter(VM&amp; vm)
</del><ins>+private:
+    GetterSetter(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx">         : JSCell(vm, vm.getterSetterStructure.get())
</span><span class="cx">     {
</span><ins>+        m_getter.set(vm, this, globalObject-&gt;nullGetterFunction());
+        m_setter.set(vm, this, globalObject-&gt;nullGetterFunction());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     typedef JSCell Base;
</span><span class="cx"> 
</span><del>-    static GetterSetter* create(VM&amp; vm)
</del><ins>+    static GetterSetter* create(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx">     {
</span><del>-        GetterSetter* getterSetter = new (NotNull, allocateCell&lt;GetterSetter&gt;(vm.heap)) GetterSetter(vm);
</del><ins>+        GetterSetter* getterSetter = new (NotNull, allocateCell&lt;GetterSetter&gt;(vm.heap)) GetterSetter(vm, globalObject);
</ins><span class="cx">         getterSetter-&gt;finishCreation(vm);
</span><span class="cx">         return getterSetter;
</span><span class="cx">     }
</span><span class="lines">@@ -68,13 +72,19 @@
</span><span class="cx">         return result;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    bool isGetterNull() const { return !!jsDynamicCast&lt;NullGetterFunction*&gt;(m_getter.get()); }
+    bool isSetterNull() const { return !!jsDynamicCast&lt;NullGetterFunction*&gt;(m_setter.get()); }
+
</ins><span class="cx">     // Set the getter. It's only valid to call this if you've never set the getter on this
</span><span class="cx">     // object.
</span><del>-    void setGetter(VM&amp; vm, JSObject* getter)
</del><ins>+    void setGetter(VM&amp; vm, JSGlobalObject* globalObject, JSObject* getter)
</ins><span class="cx">     {
</span><del>-        RELEASE_ASSERT(!m_getter);
</del><ins>+        if (!getter)
+            getter = jsCast&lt;JSObject*&gt;(globalObject-&gt;nullGetterFunction());
+
+        RELEASE_ASSERT(isGetterNull());
</ins><span class="cx">         WTF::storeStoreFence();
</span><del>-        m_getter.setMayBeNull(vm, this, getter);
</del><ins>+        m_getter.set(vm, this, getter);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSObject* setter() const { return m_setter.get(); }
</span><span class="lines">@@ -88,15 +98,18 @@
</span><span class="cx"> 
</span><span class="cx">     // Set the setter. It's only valid to call this if you've never set the setter on this
</span><span class="cx">     // object.
</span><del>-    void setSetter(VM&amp; vm, JSObject* setter)
</del><ins>+    void setSetter(VM&amp; vm, JSGlobalObject* globalObject, JSObject* setter)
</ins><span class="cx">     {
</span><del>-        RELEASE_ASSERT(!m_setter);
</del><ins>+        if (!setter)
+            setter = jsCast&lt;JSObject*&gt;(globalObject-&gt;nullGetterFunction());
+
+        RELEASE_ASSERT(isSetterNull());
</ins><span class="cx">         WTF::storeStoreFence();
</span><del>-        m_setter.setMayBeNull(vm, this, setter);
</del><ins>+        m_setter.set(vm, this, setter);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><del>-    GetterSetter* withGetter(VM&amp;, JSObject* getter);
-    GetterSetter* withSetter(VM&amp;, JSObject* setter);
</del><ins>+    GetterSetter* withGetter(VM&amp;, JSGlobalObject*, JSObject* getter);
+    GetterSetter* withSetter(VM&amp;, JSGlobalObject*, JSObject* setter);
</ins><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span><span class="cx">     {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -99,6 +99,7 @@
</span><span class="cx"> #include &quot;NamePrototype.h&quot;
</span><span class="cx"> #include &quot;NativeErrorConstructor.h&quot;
</span><span class="cx"> #include &quot;NativeErrorPrototype.h&quot;
</span><ins>+#include &quot;NullGetterFunction.h&quot;
</ins><span class="cx"> #include &quot;NumberConstructor.h&quot;
</span><span class="cx"> #include &quot;NumberPrototype.h&quot;
</span><span class="cx"> #include &quot;ObjCCallbackFunction.h&quot;
</span><span class="lines">@@ -232,10 +233,11 @@
</span><span class="cx">     m_functionPrototype-&gt;addFunctionProperties(exec, this, &amp;callFunction, &amp;applyFunction);
</span><span class="cx">     m_callFunction.set(vm, this, callFunction);
</span><span class="cx">     m_applyFunction.set(vm, this, applyFunction);
</span><ins>+    m_nullGetterFunction.set(vm, this, NullGetterFunction::create(vm, NullGetterFunction::createStructure(vm, this, m_functionPrototype.get())));
</ins><span class="cx">     m_objectPrototype.set(vm, this, ObjectPrototype::create(vm, this, ObjectPrototype::createStructure(vm, this, jsNull())));
</span><del>-    GetterSetter* protoAccessor = GetterSetter::create(vm);
-    protoAccessor-&gt;setGetter(vm, JSFunction::create(vm, this, 0, String(), globalFuncProtoGetter));
-    protoAccessor-&gt;setSetter(vm, JSFunction::create(vm, this, 0, String(), globalFuncProtoSetter));
</del><ins>+    GetterSetter* protoAccessor = GetterSetter::create(vm, this);
+    protoAccessor-&gt;setGetter(vm, this, JSFunction::create(vm, this, 0, String(), globalFuncProtoGetter));
+    protoAccessor-&gt;setSetter(vm, this, JSFunction::create(vm, this, 0, String(), globalFuncProtoSetter));
</ins><span class="cx">     m_objectPrototype-&gt;putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;underscoreProto, protoAccessor, Accessor | DontEnum);
</span><span class="cx">     m_functionPrototype-&gt;structure()-&gt;setPrototypeWithoutTransition(vm, m_objectPrototype.get());
</span><span class="cx">     
</span><span class="lines">@@ -609,9 +611,9 @@
</span><span class="cx"> void JSGlobalObject::createThrowTypeError(VM&amp; vm)
</span><span class="cx"> {
</span><span class="cx">     JSFunction* thrower = JSFunction::create(vm, this, 0, String(), globalFuncThrowTypeError);
</span><del>-    GetterSetter* getterSetter = GetterSetter::create(vm);
-    getterSetter-&gt;setGetter(vm, thrower);
-    getterSetter-&gt;setSetter(vm, thrower);
</del><ins>+    GetterSetter* getterSetter = GetterSetter::create(vm, this);
+    getterSetter-&gt;setGetter(vm, this, thrower);
+    getterSetter-&gt;setSetter(vm, this, thrower);
</ins><span class="cx">     m_throwTypeErrorGetterSetter.set(vm, this, getterSetter);
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -651,6 +653,8 @@
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_promiseConstructor);
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+    visitor.append(&amp;thisObject-&gt;m_nullGetterFunction);
+
</ins><span class="cx">     visitor.append(&amp;thisObject-&gt;m_evalFunction);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_callFunction);
</span><span class="cx">     visitor.append(&amp;thisObject-&gt;m_applyFunction);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -80,6 +80,7 @@
</span><span class="cx"> class RegExpConstructor;
</span><span class="cx"> class RegExpPrototype;
</span><span class="cx"> class SourceCode;
</span><ins>+class NullGetterFunction;
</ins><span class="cx"> struct ActivationStackNode;
</span><span class="cx"> struct HashTable;
</span><span class="cx"> 
</span><span class="lines">@@ -174,6 +175,8 @@
</span><span class="cx"> #endif
</span><span class="cx">     WriteBarrier&lt;ObjectConstructor&gt; m_objectConstructor;
</span><span class="cx"> 
</span><ins>+    WriteBarrier&lt;NullGetterFunction&gt; m_nullGetterFunction;
+
</ins><span class="cx">     WriteBarrier&lt;JSFunction&gt; m_evalFunction;
</span><span class="cx">     WriteBarrier&lt;JSFunction&gt; m_callFunction;
</span><span class="cx">     WriteBarrier&lt;JSFunction&gt; m_applyFunction;
</span><span class="lines">@@ -371,6 +374,8 @@
</span><span class="cx">     JSPromiseConstructor* promiseConstructor() const { return m_promiseConstructor.get(); }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><ins>+    NullGetterFunction* nullGetterFunction() const { return m_nullGetterFunction.get(); }
+
</ins><span class="cx">     JSFunction* evalFunction() const { return m_evalFunction.get(); }
</span><span class="cx">     JSFunction* callFunction() const { return m_callFunction.get(); }
</span><span class="cx">     JSFunction* applyFunction() const { return m_applyFunction.get(); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -1689,11 +1689,11 @@
</span><span class="cx">         else if (oldDescriptor.isAccessorDescriptor())
</span><span class="cx">             setter = oldDescriptor.setterObject();
</span><span class="cx"> 
</span><del>-        GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+        GetterSetter* accessor = GetterSetter::create(vm, exec-&gt;lexicalGlobalObject());
</ins><span class="cx">         if (getter)
</span><del>-            accessor-&gt;setGetter(vm, getter);
</del><ins>+            accessor-&gt;setGetter(vm, exec-&gt;lexicalGlobalObject(), getter);
</ins><span class="cx">         if (setter)
</span><del>-            accessor-&gt;setSetter(vm, setter);
</del><ins>+            accessor-&gt;setSetter(vm, exec-&gt;lexicalGlobalObject(), setter);
</ins><span class="cx"> 
</span><span class="cx">         entryInMap-&gt;set(vm, this, accessor);
</span><span class="cx">         entryInMap-&gt;attributes = descriptor.attributesOverridingCurrent(oldDescriptor) &amp; ~ReadOnly;
</span><span class="lines">@@ -2463,11 +2463,11 @@
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     if (descriptor.isGenericDescriptor() || descriptor.isDataDescriptor()) {
</span><span class="cx">         if (descriptor.isGenericDescriptor() &amp;&amp; oldDescriptor.isAccessorDescriptor()) {
</span><del>-            GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+            GetterSetter* accessor = GetterSetter::create(vm, exec-&gt;lexicalGlobalObject());
</ins><span class="cx">             if (oldDescriptor.getterPresent())
</span><del>-                accessor-&gt;setGetter(vm, oldDescriptor.getterObject());
</del><ins>+                accessor-&gt;setGetter(vm, exec-&gt;lexicalGlobalObject(), oldDescriptor.getterObject());
</ins><span class="cx">             if (oldDescriptor.setterPresent())
</span><del>-                accessor-&gt;setSetter(vm, oldDescriptor.setterObject());
</del><ins>+                accessor-&gt;setSetter(vm, exec-&gt;lexicalGlobalObject(), oldDescriptor.setterObject());
</ins><span class="cx">             target-&gt;putDirectAccessor(exec, propertyName, accessor, attributes | Accessor);
</span><span class="cx">             return true;
</span><span class="cx">         }
</span><span class="lines">@@ -2482,16 +2482,16 @@
</span><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx">     attributes &amp;= ~ReadOnly;
</span><del>-    GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+    GetterSetter* accessor = GetterSetter::create(vm, exec-&gt;lexicalGlobalObject());
</ins><span class="cx"> 
</span><span class="cx">     if (descriptor.getterPresent())
</span><del>-        accessor-&gt;setGetter(vm, descriptor.getterObject());
</del><ins>+        accessor-&gt;setGetter(vm, exec-&gt;lexicalGlobalObject(), descriptor.getterObject());
</ins><span class="cx">     else if (oldDescriptor.getterPresent())
</span><del>-        accessor-&gt;setGetter(vm, oldDescriptor.getterObject());
</del><ins>+        accessor-&gt;setGetter(vm, exec-&gt;lexicalGlobalObject(), oldDescriptor.getterObject());
</ins><span class="cx">     if (descriptor.setterPresent())
</span><del>-        accessor-&gt;setSetter(vm, descriptor.setterObject());
</del><ins>+        accessor-&gt;setSetter(vm, exec-&gt;lexicalGlobalObject(), descriptor.setterObject());
</ins><span class="cx">     else if (oldDescriptor.setterPresent())
</span><del>-        accessor-&gt;setSetter(vm, oldDescriptor.setterObject());
</del><ins>+        accessor-&gt;setSetter(vm, exec-&gt;lexicalGlobalObject(), oldDescriptor.setterObject());
</ins><span class="cx"> 
</span><span class="cx">     target-&gt;putDirectAccessor(exec, propertyName, accessor, attributes | Accessor);
</span><span class="cx">     return true;
</span><span class="lines">@@ -2632,17 +2632,17 @@
</span><span class="cx">     GetterSetter* getterSetter;
</span><span class="cx">     bool getterSetterChanged = false;
</span><span class="cx">     if (accessor.isCustomGetterSetter())
</span><del>-        getterSetter = GetterSetter::create(exec-&gt;vm());
</del><ins>+        getterSetter = GetterSetter::create(exec-&gt;vm(), exec-&gt;lexicalGlobalObject());
</ins><span class="cx">     else {
</span><span class="cx">         ASSERT(accessor.isGetterSetter());
</span><span class="cx">         getterSetter = asGetterSetter(accessor);
</span><span class="cx">     }
</span><span class="cx">     if (descriptor.setterPresent()) {
</span><del>-        getterSetter = getterSetter-&gt;withSetter(exec-&gt;vm(), descriptor.setterObject());
</del><ins>+        getterSetter = getterSetter-&gt;withSetter(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), descriptor.setterObject());
</ins><span class="cx">         getterSetterChanged = true;
</span><span class="cx">     }
</span><span class="cx">     if (descriptor.getterPresent()) {
</span><del>-        getterSetter = getterSetter-&gt;withGetter(exec-&gt;vm(), descriptor.getterObject());
</del><ins>+        getterSetter = getterSetter-&gt;withGetter(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), descriptor.getterObject());
</ins><span class="cx">         getterSetterChanged = true;
</span><span class="cx">     }
</span><span class="cx">     if (current.attributesEqual(descriptor) &amp;&amp; !getterSetterChanged)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -70,9 +70,9 @@
</span><span class="cx">     JSC_NATIVE_FUNCTION(vm.propertyNames-&gt;entries, mapProtoFuncEntries, DontEnum, 0);
</span><span class="cx">     JSC_NATIVE_FUNCTION(vm.propertyNames-&gt;iteratorPrivateName, mapProtoFuncEntries, DontEnum, 0);
</span><span class="cx"> 
</span><del>-    GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
</ins><span class="cx">     JSFunction* function = JSFunction::create(vm, globalObject, 0, vm.propertyNames-&gt;size.string(), mapProtoFuncSize);
</span><del>-    accessor-&gt;setGetter(vm, function);
</del><ins>+    accessor-&gt;setGetter(vm, globalObject, function);
</ins><span class="cx">     putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;size, accessor, DontEnum | Accessor);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNullGetterFunctioncpp"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/NullGetterFunction.cpp (0 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NullGetterFunction.cpp                                (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/NullGetterFunction.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -0,0 +1,57 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include &quot;config.h&quot;
+#include &quot;NullGetterFunction.h&quot;
+
+#include &quot;JSCJSValueInlines.h&quot;
+
+namespace JSC {
+
+const ClassInfo NullGetterFunction::s_info = { &quot;Function&quot;, &amp;Base::s_info, 0, CREATE_METHOD_TABLE(NullGetterFunction) };
+
+static EncodedJSValue JSC_HOST_CALL callReturnUndefined(ExecState*)
+{
+    return JSValue::encode(jsUndefined());
+}
+
+static EncodedJSValue JSC_HOST_CALL constructReturnUndefined(ExecState*)
+{
+    return JSValue::encode(jsUndefined());
+}
+
+CallType NullGetterFunction::getCallData(JSCell*, CallData&amp; callData)
+{
+    callData.native.function = callReturnUndefined;
+    return CallTypeHost;
+}
+
+ConstructType NullGetterFunction::getConstructData(JSCell*, ConstructData&amp; constructData)
+{
+    constructData.native.function = constructReturnUndefined;
+    return ConstructTypeHost;
+}
+
+}
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNullGetterFunctionh"></a>
<div class="addfile"><h4>Added: trunk/Source/JavaScriptCore/runtime/NullGetterFunction.h (0 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NullGetterFunction.h                                (rev 0)
+++ trunk/Source/JavaScriptCore/runtime/NullGetterFunction.h        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -0,0 +1,62 @@
</span><ins>+/*
+ * Copyright (C) 2014 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef NullGetterFunction_h
+#define  NullGetterFunction_h
+
+#include &quot;InternalFunction.h&quot;
+
+namespace JSC {
+
+class NullGetterFunction : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static NullGetterFunction* create(VM&amp; vm, Structure* structure)
+    {
+        NullGetterFunction* function = new (NotNull, allocateCell&lt; NullGetterFunction&gt;(vm.heap))  NullGetterFunction(vm, structure);
+        function-&gt;finishCreation(vm, String());
+        return function;
+    }
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    NullGetterFunction(VM&amp; vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+    static ConstructType getConstructData(JSCell*, ConstructData&amp;);
+    static CallType getCallData(JSCell*, CallData&amp;);
+};
+
+}
+
+#endif // NullGetterFunction_h
</ins></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -156,8 +156,8 @@
</span><span class="cx">     PropertySlot slot(thisObject);
</span><span class="cx">     if (thisObject-&gt;getPropertySlot(exec, exec-&gt;argument(0).toString(exec)-&gt;toIdentifier(exec), slot)
</span><span class="cx">         &amp;&amp; slot.isAccessor()) {
</span><del>-        JSObject* getter = slot.getterSetter()-&gt;getter();
-        return getter ? JSValue::encode(getter) : JSValue::encode(jsUndefined());
</del><ins>+        GetterSetter* getterSetter = slot.getterSetter();
+        return getterSetter-&gt;isGetterNull() ? JSValue::encode(jsUndefined()) : JSValue::encode(getterSetter-&gt;getter());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span><span class="lines">@@ -172,8 +172,8 @@
</span><span class="cx">     PropertySlot slot(thisObject);
</span><span class="cx">     if (thisObject-&gt;getPropertySlot(exec, exec-&gt;argument(0).toString(exec)-&gt;toIdentifier(exec), slot)
</span><span class="cx">         &amp;&amp; slot.isAccessor()) {
</span><del>-        JSObject* setter = slot.getterSetter()-&gt;setter();
-        return setter ? JSValue::encode(setter) : JSValue::encode(jsUndefined());
</del><ins>+        GetterSetter* getterSetter = slot.getterSetter();
+        return getterSetter-&gt;isSetterNull() ? JSValue::encode(jsUndefined()) : JSValue::encode(getterSetter-&gt;setter());
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     return JSValue::encode(jsUndefined());
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimePropertyDescriptorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/PropertyDescriptor.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -106,8 +106,8 @@
</span><span class="cx">         m_attributes &amp;= ~ReadOnly; // FIXME: we should be able to ASSERT this!
</span><span class="cx"> 
</span><span class="cx">         GetterSetter* accessor = asGetterSetter(value);
</span><del>-        m_getter = accessor-&gt;getter() ? accessor-&gt;getter() : jsUndefined();
-        m_setter = accessor-&gt;setter() ? accessor-&gt;setter() : jsUndefined();
</del><ins>+        m_getter = !accessor-&gt;isGetterNull() ? accessor-&gt;getter() : jsUndefined();
+        m_setter = !accessor-&gt;isSetterNull() ? accessor-&gt;setter() : jsUndefined();
</ins><span class="cx">         m_seenAttributes = EnumerablePresent | ConfigurablePresent;
</span><span class="cx">     } else {
</span><span class="cx">         m_value = value;
</span><span class="lines">@@ -131,8 +131,8 @@
</span><span class="cx">     attributes &amp;= ~ReadOnly; // FIXME: we should be able to ASSERT this!
</span><span class="cx"> 
</span><span class="cx">     m_attributes = attributes;
</span><del>-    m_getter = accessor-&gt;getter() ? accessor-&gt;getter() : jsUndefined();
-    m_setter = accessor-&gt;setter() ? accessor-&gt;setter() : jsUndefined();
</del><ins>+    m_getter = !accessor-&gt;isGetterNull() ? accessor-&gt;getter() : jsUndefined();
+    m_setter = !accessor-&gt;isSetterNull() ? accessor-&gt;setter() : jsUndefined();
</ins><span class="cx">     m_seenAttributes = EnumerablePresent | ConfigurablePresent;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp (177029 => 177030)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp        2014-12-09 19:39:29 UTC (rev 177029)
+++ trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp        2014-12-09 19:52:40 UTC (rev 177030)
</span><span class="lines">@@ -69,9 +69,9 @@
</span><span class="cx">     JSC_NATIVE_FUNCTION(vm.propertyNames-&gt;entries, setProtoFuncEntries, DontEnum, 0);
</span><span class="cx">     JSC_NATIVE_FUNCTION(vm.propertyNames-&gt;iteratorPrivateName, setProtoFuncKeys, DontEnum, 0);
</span><span class="cx"> 
</span><del>-    GetterSetter* accessor = GetterSetter::create(vm);
</del><ins>+    GetterSetter* accessor = GetterSetter::create(vm, globalObject);
</ins><span class="cx">     JSFunction* function = JSFunction::create(vm, globalObject, 0, vm.propertyNames-&gt;size.string(), setProtoFuncSize);
</span><del>-    accessor-&gt;setGetter(vm, function);
</del><ins>+    accessor-&gt;setGetter(vm, globalObject, function);
</ins><span class="cx">     putDirectNonIndexAccessor(vm, vm.propertyNames-&gt;size, accessor, DontEnum | Accessor);
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>