<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[197648] trunk/Source</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/197648">197648</a></dd>
<dt>Author</dt> <dd>sbarati@apple.com</dd>
<dt>Date</dt> <dd>2016-03-06 17:00:33 -0800 (Sun, 06 Mar 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>[[GetPrototypeOf]] should be a fully virtual method in the method table
https://bugs.webkit.org/show_bug.cgi?id=155002

Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch makes us more consistent with how the ES6 specification models the
[[GetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable 
is a prerequisite for implementing Proxy.[[GetPrototypeOf]]. This patch
still allows directly accessing the prototype for situations where this
is the desired behavior. This is equivalent to getting the internal
[[Prototype]] field as described in the specification. 

* API/JSObjectRef.cpp:
(JSObjectGetPrototype):
(JSObjectSetPrototype):
* dfg/DFGOperations.cpp:
* dfg/DFGOperations.h:
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
(JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):
* ftl/FTLLowerDFGToB3.cpp:
(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
(JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* jsc.cpp:
(functionCreateProxy):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* runtime/ArrayPrototype.cpp:
(JSC::speciesConstructArray):
* runtime/ClassInfo.h:
* runtime/FunctionPrototype.cpp:
(JSC::functionProtoFuncBind):
* runtime/IntlCollatorPrototype.cpp:
(JSC::IntlCollatorPrototypeGetterCompare):
* runtime/IntlDateTimeFormatPrototype.cpp:
(JSC::IntlDateTimeFormatPrototypeGetterFormat):
* runtime/IntlNumberFormatPrototype.cpp:
(JSC::IntlNumberFormatPrototypeGetterFormat):
* runtime/JSBoundFunction.cpp:
(JSC::hasInstanceBoundFunction):
(JSC::getBoundFunctionStructure):
(JSC::JSBoundFunction::create):
* runtime/JSBoundFunction.h:
* runtime/JSCJSValue.cpp:
(JSC::JSValue::putToPrimitive):
* runtime/JSCell.cpp:
(JSC::JSCell::setPrototype):
(JSC::JSCell::getPrototype):
* runtime/JSCell.h:
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::hasLegacyProfiler):
(JSC::lastInPrototypeChain):
(JSC::JSGlobalObject::objectPrototypeIsSane):
(JSC::JSGlobalObject::arrayPrototypeChainIsSane):
(JSC::JSGlobalObject::stringPrototypeChainIsSane):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::finishCreation):
* runtime/JSGlobalObjectFunctions.cpp:
(JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
(JSC::GlobalFuncProtoGetterFunctor::operator()):
(JSC::globalFuncProtoGetter):
* runtime/JSLexicalEnvironment.cpp:
(JSC::JSLexicalEnvironment::getOwnPropertySlot):
* runtime/JSObject.cpp:
(JSC::JSObject::calculatedClassName):
(JSC::JSObject::putInlineSlow):
(JSC::JSObject::setPrototypeWithCycleCheck):
(JSC::JSObject::setPrototype):
(JSC::JSObject::getPrototype):
(JSC::JSObject::defaultHasInstance):
(JSC::objectPrivateFuncInstanceOf):
(JSC::JSObject::getPropertyNames):
(JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
(JSC::JSObject::attemptToInterceptPutByIndexOnHole):
(JSC::JSObject::getGenericPropertyNames):
* runtime/JSObject.h:
(JSC::JSObject::finishCreation):
(JSC::JSObject::JSObject):
(JSC::JSObject::getPrototypeDirect):
(JSC::JSObject::getPrototype):
(JSC::JSObject::getOwnNonIndexPropertySlot):
(JSC::JSObject::getPropertySlot):
(JSC::JSObject::getNonIndexPropertySlot):
(JSC::JSObject::prototype): Deleted.
* runtime/JSObjectInlines.h:
(JSC::JSObject::canPerformFastPutInline):
* runtime/JSProxy.cpp:
(JSC::JSProxy::setTarget):
* runtime/JSTypedArrayViewConstructor.cpp:
(JSC::constructTypedArrayView):
* runtime/ObjectConstructor.cpp:
(JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
(JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
(JSC::objectConstructorGetPrototypeOf):
* runtime/ObjectPrototype.cpp:
(JSC::objectProtoFuncIsPrototypeOf):
* runtime/ProxyObject.cpp:
(JSC::performProxyGet):
(JSC::ProxyObject::performSetPrototype):
* runtime/StructureInlines.h:
(JSC::Structure::isValid):
* tests/stress/proxy-has-property.js:
(assert.let.h1.has):
(assert.let.h2.has):
(assert):

Source/WebCore:

Change ::getPrototype(.) to ::prototype(.) in various places to prevent
a naming conflict with JSC.

No new tests because no new functionality was added.

* bindings/js/JSDOMWindowShell.cpp:
(WebCore::JSDOMWindowShell::setWindow):
* bindings/js/JSImageConstructor.cpp:
(WebCore::JSImageConstructor::initializeProperties):
(WebCore::JSImageConstructor::prototypeForStructure):
* bindings/js/WorkerScriptController.cpp:
(WebCore::WorkerScriptController::initScript):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateHeader):
(GenerateImplementation):
(GenerateConstructorHelperMethods):
* bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
(WebCore::JSTestActiveDOMObjectConstructor::initializeProperties):
(WebCore::JSTestActiveDOMObject::createPrototype):
(WebCore::JSTestActiveDOMObject::prototype):
(WebCore::JSTestActiveDOMObject::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestActiveDOMObject.h:
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
(WebCore::JSTestClassWithJSBuiltinConstructorConstructor::initializeProperties):
(WebCore::JSTestClassWithJSBuiltinConstructor::createPrototype):
(WebCore::JSTestClassWithJSBuiltinConstructor::prototype):
(WebCore::JSTestClassWithJSBuiltinConstructor::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
(WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::initializeProperties):
(WebCore::JSTestCustomConstructorWithNoInterfaceObject::createPrototype):
(WebCore::JSTestCustomConstructorWithNoInterfaceObject::prototype):
(WebCore::JSTestCustomConstructorWithNoInterfaceObject::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
* bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
(WebCore::JSTestCustomNamedGetterConstructor::initializeProperties):
(WebCore::JSTestCustomNamedGetter::createPrototype):
(WebCore::JSTestCustomNamedGetter::prototype):
(WebCore::JSTestCustomNamedGetter::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
* bindings/scripts/test/JS/JSTestEventConstructor.cpp:
(WebCore::JSTestEventConstructorConstructor::initializeProperties):
(WebCore::JSTestEventConstructor::createPrototype):
(WebCore::JSTestEventConstructor::prototype):
(WebCore::JSTestEventConstructor::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestEventConstructor.h:
* bindings/scripts/test/JS/JSTestEventTarget.cpp:
(WebCore::JSTestEventTargetConstructor::initializeProperties):
(WebCore::JSTestEventTarget::createPrototype):
(WebCore::JSTestEventTarget::prototype):
(WebCore::JSTestEventTarget::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestEventTarget.h:
* bindings/scripts/test/JS/JSTestException.cpp:
(WebCore::JSTestExceptionConstructor::initializeProperties):
(WebCore::JSTestException::createPrototype):
(WebCore::JSTestException::prototype):
(WebCore::JSTestException::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestException.h:
* bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
(WebCore::JSTestGenerateIsReachableConstructor::initializeProperties):
(WebCore::JSTestGenerateIsReachable::createPrototype):
(WebCore::JSTestGenerateIsReachable::prototype):
(WebCore::JSTestGenerateIsReachable::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterfaceConstructor::initializeProperties):
(WebCore::JSTestInterface::createPrototype):
(WebCore::JSTestInterface::prototype):
(WebCore::JSTestInterface::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestInterface.h:
* bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
(WebCore::JSTestJSBuiltinConstructorConstructor::initializeProperties):
(WebCore::JSTestJSBuiltinConstructor::createPrototype):
(WebCore::JSTestJSBuiltinConstructor::prototype):
(WebCore::JSTestJSBuiltinConstructor::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
* bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
(WebCore::JSTestMediaQueryListListenerConstructor::initializeProperties):
(WebCore::JSTestMediaQueryListListener::createPrototype):
(WebCore::JSTestMediaQueryListListener::prototype):
(WebCore::JSTestMediaQueryListListener::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::JSTestNamedConstructorConstructor::initializeProperties):
(WebCore::JSTestNamedConstructorNamedConstructor::initializeProperties):
(WebCore::JSTestNamedConstructor::createPrototype):
(WebCore::JSTestNamedConstructor::prototype):
(WebCore::JSTestNamedConstructor::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestNamedConstructor.h:
* bindings/scripts/test/JS/JSTestNode.cpp:
(WebCore::JSTestNodeConstructor::initializeProperties):
(WebCore::JSTestNode::createPrototype):
(WebCore::JSTestNode::prototype):
(WebCore::JSTestNode::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestNode.h:
* bindings/scripts/test/JS/JSTestNondeterministic.cpp:
(WebCore::JSTestNondeterministicConstructor::initializeProperties):
(WebCore::JSTestNondeterministic::createPrototype):
(WebCore::JSTestNondeterministic::prototype):
(WebCore::JSTestNondeterministic::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestNondeterministic.h:
* bindings/scripts/test/JS/JSTestObj.cpp:
(WebCore::JSTestObjConstructor::initializeProperties):
(WebCore::JSTestObj::createPrototype):
(WebCore::JSTestObj::prototype):
(WebCore::JSTestObj::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestObj.h:
* bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
(WebCore::JSTestOverloadedConstructorsConstructor::initializeProperties):
(WebCore::JSTestOverloadedConstructors::createPrototype):
(WebCore::JSTestOverloadedConstructors::prototype):
(WebCore::JSTestOverloadedConstructors::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
* bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
(WebCore::JSTestOverrideBuiltinsConstructor::initializeProperties):
(WebCore::JSTestOverrideBuiltins::createPrototype):
(WebCore::JSTestOverrideBuiltins::prototype):
(WebCore::JSTestOverrideBuiltins::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
(WebCore::JSTestSerializedScriptValueInterfaceConstructor::initializeProperties):
(WebCore::JSTestSerializedScriptValueInterface::createPrototype):
(WebCore::JSTestSerializedScriptValueInterface::prototype):
(WebCore::JSTestSerializedScriptValueInterface::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
* bindings/scripts/test/JS/JSTestTypedefs.cpp:
(WebCore::JSTestTypedefsConstructor::initializeProperties):
(WebCore::JSTestTypedefs::createPrototype):
(WebCore::JSTestTypedefs::prototype):
(WebCore::JSTestTypedefs::getPrototype): Deleted.
* bindings/scripts/test/JS/JSTestTypedefs.h:
* bindings/scripts/test/JS/JSattribute.cpp:
(WebCore::JSattributeConstructor::initializeProperties):
(WebCore::JSattribute::createPrototype):
(WebCore::JSattribute::prototype):
(WebCore::JSattribute::getPrototype): Deleted.
* bindings/scripts/test/JS/JSattribute.h:
* bindings/scripts/test/JS/JSreadonly.cpp:
(WebCore::JSreadonlyConstructor::initializeProperties):
(WebCore::JSreadonly::createPrototype):
(WebCore::JSreadonly::prototype):
(WebCore::JSreadonly::getPrototype): Deleted.
* bindings/scripts/test/JS/JSreadonly.h:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreAPIJSObjectRefcpp">trunk/Source/JavaScriptCore/API/JSObjectRef.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationscpp">trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGOperationsh">trunk/Source/JavaScriptCore/dfg/DFGOperations.h</a></li>
<li><a href="#trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp">trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodescpp">trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOpcodes32_64cpp">trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejitJITOperationscpp">trunk/Source/JavaScriptCore/jit/JITOperations.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorejsccpp">trunk/Source/JavaScriptCore/jsc.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLLIntSlowPathscpp">trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreterasm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCorellintLowLevelInterpreter64asm">trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayPrototypecpp">trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeClassInfoh">trunk/Source/JavaScriptCore/runtime/ClassInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeFunctionPrototypecpp">trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp">trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSBoundFunctionh">trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCJSValuecpp">trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellcpp">trunk/Source/JavaScriptCore/runtime/JSCell.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSCellh">trunk/Source/JavaScriptCore/runtime/JSCell.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjecth">trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp">trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmentcpp">trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectInlinesh">trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSProxycpp">trunk/Source/JavaScriptCore/runtime/JSProxy.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypedArrayViewConstructorcpp">trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorcpp">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectPrototypecpp">trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeProxyObjectcpp">trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStructureInlinesh">trunk/Source/JavaScriptCore/runtime/StructureInlines.h</a></li>
<li><a href="#trunkSourceJavaScriptCoretestsstressproxyhaspropertyjs">trunk/Source/JavaScriptCore/tests/stress/proxy-has-property.js</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowBasecpp">trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSDOMWindowShellcpp">trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSImageConstructorcpp">trunk/Source/WebCore/bindings/js/JSImageConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSPluginElementFunctionsh">trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.h</a></li>
<li><a href="#trunkSourceWebCorebindingsjsJSStorageCustomcpp">trunk/Source/WebCore/bindings/js/JSStorageCustom.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsjsWorkerScriptControllercpp">trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm">trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjecth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjectcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjecth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGetterh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestEventTargeth">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestExceptionh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachableh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenerh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNodeh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNondeterministiccpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestNondeterministich">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestObjh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinsh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfaceh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSTestTypedefsh">trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSattributecpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSattributeh">trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.h</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSreadonlycpp">trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp</a></li>
<li><a href="#trunkSourceWebCorebindingsscriptstestJSJSreadonlyh">trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreAPIJSObjectRefcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/API/JSObjectRef.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/API/JSObjectRef.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/API/JSObjectRef.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -267,8 +267,8 @@
</span><span class="cx">     ExecState* exec = toJS(ctx);
</span><span class="cx">     JSLockHolder locker(exec);
</span><span class="cx"> 
</span><del>-    JSObject* jsObject = toJS(object);
-    return toRef(exec, jsObject-&gt;prototype());
</del><ins>+    JSObject* jsObject = toJS(object); 
+    return toRef(exec, jsObject-&gt;getPrototypeDirect());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -1,3 +1,123 @@
</span><ins>+2016-03-06  Saam Barati  &lt;sbarati@apple.com&gt;
+
+        [[GetPrototypeOf]] should be a fully virtual method in the method table
+        https://bugs.webkit.org/show_bug.cgi?id=155002
+
+        Reviewed by Filip Pizlo.
+
+        This patch makes us more consistent with how the ES6 specification models the
+        [[GetPrototypeOf]] trap. Moving this method into ClassInfo::methodTable 
+        is a prerequisite for implementing Proxy.[[GetPrototypeOf]]. This patch
+        still allows directly accessing the prototype for situations where this
+        is the desired behavior. This is equivalent to getting the internal
+        [[Prototype]] field as described in the specification. 
+
+        * API/JSObjectRef.cpp:
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        * dfg/DFGOperations.cpp:
+        * dfg/DFGOperations.h:
+        * dfg/DFGSpeculativeJIT.cpp:
+        (JSC::DFG::SpeculativeJIT::compileInstanceOfForObject):
+        (JSC::DFG::SpeculativeJIT::compileCheckTypeInfoFlags):
+        * ftl/FTLLowerDFGToB3.cpp:
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOf):
+        (JSC::FTL::DFG::LowerDFGToB3::compileInstanceOfCustom):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        * jit/JITOperations.cpp:
+        * jit/JITOperations.h:
+        * jsc.cpp:
+        (functionCreateProxy):
+        * llint/LLIntSlowPaths.cpp:
+        (JSC::LLInt::LLINT_SLOW_PATH_DECL):
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::speciesConstructArray):
+        * runtime/ClassInfo.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncBind):
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototypeGetterCompare):
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototypeGetterFormat):
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototypeGetterFormat):
+        * runtime/JSBoundFunction.cpp:
+        (JSC::hasInstanceBoundFunction):
+        (JSC::getBoundFunctionStructure):
+        (JSC::JSBoundFunction::create):
+        * runtime/JSBoundFunction.h:
+        * runtime/JSCJSValue.cpp:
+        (JSC::JSValue::putToPrimitive):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::setPrototype):
+        (JSC::JSCell::getPrototype):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        (JSC::JSGlobalObject::hasLegacyProfiler):
+        (JSC::lastInPrototypeChain):
+        (JSC::JSGlobalObject::objectPrototypeIsSane):
+        (JSC::JSGlobalObject::arrayPrototypeChainIsSane):
+        (JSC::JSGlobalObject::stringPrototypeChainIsSane):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::finishCreation):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::GlobalFuncProtoGetterFunctor::GlobalFuncProtoGetterFunctor):
+        (JSC::GlobalFuncProtoGetterFunctor::operator()):
+        (JSC::globalFuncProtoGetter):
+        * runtime/JSLexicalEnvironment.cpp:
+        (JSC::JSLexicalEnvironment::getOwnPropertySlot):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::calculatedClassName):
+        (JSC::JSObject::putInlineSlow):
+        (JSC::JSObject::setPrototypeWithCycleCheck):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::getPrototype):
+        (JSC::JSObject::defaultHasInstance):
+        (JSC::objectPrivateFuncInstanceOf):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHoleForPrototype):
+        (JSC::JSObject::attemptToInterceptPutByIndexOnHole):
+        (JSC::JSObject::getGenericPropertyNames):
+        * runtime/JSObject.h:
+        (JSC::JSObject::finishCreation):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::getPrototypeDirect):
+        (JSC::JSObject::getPrototype):
+        (JSC::JSObject::getOwnNonIndexPropertySlot):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::getNonIndexPropertySlot):
+        (JSC::JSObject::prototype): Deleted.
+        * runtime/JSObjectInlines.h:
+        (JSC::JSObject::canPerformFastPutInline):
+        * runtime/JSProxy.cpp:
+        (JSC::JSProxy::setTarget):
+        * runtime/JSTypedArrayViewConstructor.cpp:
+        (JSC::constructTypedArrayView):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::ObjectConstructorGetPrototypeOfFunctor):
+        (JSC::ObjectConstructorGetPrototypeOfFunctor::operator()):
+        (JSC::objectConstructorGetPrototypeOf):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncIsPrototypeOf):
+        * runtime/ProxyObject.cpp:
+        (JSC::performProxyGet):
+        (JSC::ProxyObject::performSetPrototype):
+        * runtime/StructureInlines.h:
+        (JSC::Structure::isValid):
+        * tests/stress/proxy-has-property.js:
+        (assert.let.h1.has):
+        (assert.let.h2.has):
+        (assert):
+
</ins><span class="cx"> 2016-03-06  Commit Queue  &lt;commit-queue@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out r197645.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -1392,6 +1392,15 @@
</span><span class="cx">     return tryConvertToInt52(value);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+size_t JIT_OPERATION operationDefaultHasInstance(ExecState* exec, JSCell* value, JSCell* proto) // Returns jsBoolean(True|False) on 64-bit.
+{
+    VM* vm = &amp;exec-&gt;vm();
+    NativeCallFrameTracer tracer(vm, exec);
+    if (JSObject::defaultHasInstance(exec, value, proto))
+        return 1;
+    return 0;
+}
+
</ins><span class="cx"> void JIT_OPERATION operationProcessTypeProfilerLogDFG(ExecState* exec) 
</span><span class="cx"> {
</span><span class="cx">     exec-&gt;vm().typeProfilerLog()-&gt;processLogEntries(ASCIILiteral(&quot;Log Full, called from inside DFG.&quot;));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGOperationsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGOperations.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGOperations.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/dfg/DFGOperations.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -155,6 +155,8 @@
</span><span class="cx"> int64_t JIT_OPERATION operationConvertBoxedDoubleToInt52(EncodedJSValue);
</span><span class="cx"> int64_t JIT_OPERATION operationConvertDoubleToInt52(double);
</span><span class="cx"> 
</span><ins>+size_t JIT_OPERATION operationDefaultHasInstance(ExecState*, JSCell* value, JSCell* proto);
+
</ins><span class="cx"> void JIT_OPERATION operationProcessTypeProfilerLogDFG(ExecState*) WTF_INTERNAL;
</span><span class="cx"> 
</span><span class="cx"> void JIT_OPERATION debugOperationPrintSpeculationFailure(ExecState*, void*, void*) WTF_INTERNAL;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoredfgDFGSpeculativeJITcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -2740,6 +2740,8 @@
</span><span class="cx">     
</span><span class="cx">     // Walk up the prototype chain of the value (in scratchReg), comparing to prototypeReg.
</span><span class="cx">     MacroAssembler::Label loop(&amp;m_jit);
</span><ins>+    MacroAssembler::Jump performDefaultHasInstance = m_jit.branch8(MacroAssembler::Equal,
+        MacroAssembler::Address(scratchReg, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType));
</ins><span class="cx">     m_jit.emitLoadStructure(scratchReg, scratchReg, scratch2Reg);
</span><span class="cx">     m_jit.loadPtr(MacroAssembler::Address(scratchReg, Structure::prototypeOffset() + CellPayloadOffset), scratchReg);
</span><span class="cx">     MacroAssembler::Jump isInstance = m_jit.branchPtr(MacroAssembler::Equal, scratchReg, prototypeReg);
</span><span class="lines">@@ -2755,7 +2757,18 @@
</span><span class="cx"> #else
</span><span class="cx">     m_jit.move(MacroAssembler::TrustedImm32(0), scratchReg);
</span><span class="cx"> #endif
</span><del>-    MacroAssembler::Jump putResult = m_jit.jump();
</del><ins>+    MacroAssembler::JumpList doneJumps; 
+    doneJumps.append(m_jit.jump());
+
+    performDefaultHasInstance.link(&amp;m_jit);
+    silentSpillAllRegisters(scratchReg);
+    callOperation(operationDefaultHasInstance, scratchReg, valueReg, prototypeReg); 
+    silentFillAllRegisters(scratchReg);
+    m_jit.exceptionCheck();
+#if USE(JSVALUE64)
+    m_jit.or32(TrustedImm32(ValueFalse), scratchReg);
+#endif
+    doneJumps.append(m_jit.jump());
</ins><span class="cx">     
</span><span class="cx">     isInstance.link(&amp;m_jit);
</span><span class="cx"> #if USE(JSVALUE64)
</span><span class="lines">@@ -2764,7 +2777,7 @@
</span><span class="cx">     m_jit.move(MacroAssembler::TrustedImm32(1), scratchReg);
</span><span class="cx"> #endif
</span><span class="cx">     
</span><del>-    putResult.link(&amp;m_jit);
</del><ins>+    doneJumps.link(&amp;m_jit);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> void SpeculativeJIT::compileCheckTypeInfoFlags(Node* node)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -5947,6 +5947,8 @@
</span><span class="cx">         LBasicBlock loop = FTL_NEW_BLOCK(m_out, (&quot;InstanceOf loop&quot;));
</span><span class="cx">         LBasicBlock notYetInstance = FTL_NEW_BLOCK(m_out, (&quot;InstanceOf not yet instance&quot;));
</span><span class="cx">         LBasicBlock continuation = FTL_NEW_BLOCK(m_out, (&quot;InstanceOf continuation&quot;));
</span><ins>+        LBasicBlock loadPrototypeDirect = FTL_NEW_BLOCK(m_out, (&quot;Instanceof defaultPrototypeFunction&quot;));
+        LBasicBlock defaultHasInstanceSlow = FTL_NEW_BLOCK(m_out, (&quot;Instanceof defaultPrototypeFunction&quot;));
</ins><span class="cx">         
</span><span class="cx">         LValue condition;
</span><span class="cx">         if (m_node-&gt;child1().useKind() == UntypedUse)
</span><span class="lines">@@ -5964,8 +5966,14 @@
</span><span class="cx">         ValueFromBlock originalValue = m_out.anchor(cell);
</span><span class="cx">         m_out.jump(loop);
</span><span class="cx">         
</span><del>-        m_out.appendTo(loop, notYetInstance);
</del><ins>+        m_out.appendTo(loop, loadPrototypeDirect);
</ins><span class="cx">         LValue value = m_out.phi(m_out.int64, originalValue);
</span><ins>+        LValue type = m_out.load8ZeroExt32(value, m_heaps.JSCell_typeInfoType);
+        m_out.branch(
+            m_out.notEqual(type, m_out.constInt32(ProxyObjectType)),
+            usually(loadPrototypeDirect), rarely(defaultHasInstanceSlow));
+
+        m_out.appendTo(loadPrototypeDirect, notYetInstance);
</ins><span class="cx">         LValue structure = loadStructure(value);
</span><span class="cx">         LValue currentPrototype = m_out.load64(structure, m_heaps.Structure_prototype);
</span><span class="cx">         ValueFromBlock isInstanceResult = m_out.anchor(m_out.booleanTrue);
</span><span class="lines">@@ -5973,14 +5981,22 @@
</span><span class="cx">             m_out.equal(currentPrototype, prototype),
</span><span class="cx">             unsure(continuation), unsure(notYetInstance));
</span><span class="cx">         
</span><del>-        m_out.appendTo(notYetInstance, continuation);
</del><ins>+        m_out.appendTo(notYetInstance, defaultHasInstanceSlow);
</ins><span class="cx">         ValueFromBlock notInstanceResult = m_out.anchor(m_out.booleanFalse);
</span><span class="cx">         m_out.addIncomingToPhi(value, m_out.anchor(currentPrototype));
</span><span class="cx">         m_out.branch(isCell(currentPrototype), unsure(loop), unsure(continuation));
</span><ins>+
+        m_out.appendTo(defaultHasInstanceSlow, continuation);
+        // We can use the value that we're looping with because we
+        // can just continue off from wherever we bailed from the
+        // loop.
+        ValueFromBlock defaultHasInstanceResult = m_out.anchor(
+            vmCall(m_out.boolean, m_out.operation(operationDefaultHasInstance), m_callFrame, value, prototype));
+        m_out.jump(continuation);
</ins><span class="cx">         
</span><span class="cx">         m_out.appendTo(continuation, lastNext);
</span><span class="cx">         setBoolean(
</span><del>-            m_out.phi(m_out.boolean, notCellResult, isInstanceResult, notInstanceResult));
</del><ins>+            m_out.phi(m_out.boolean, notCellResult, isInstanceResult, notInstanceResult, defaultHasInstanceResult));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void compileInstanceOfCustom()
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodescpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -153,6 +153,8 @@
</span><span class="cx">     move(TrustedImm64(JSValue::encode(jsBoolean(true))), regT0);
</span><span class="cx">     Label loop(this);
</span><span class="cx"> 
</span><ins>+    addSlowCase(branch8(Equal, Address(regT2, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType)));
+
</ins><span class="cx">     // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
</span><span class="cx">     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
</span><span class="cx">     emitLoadStructure(regT2, regT2, regT3);
</span><span class="lines">@@ -857,6 +859,7 @@
</span><span class="cx">     linkSlowCaseIfNotJSCell(iter, value);
</span><span class="cx">     linkSlowCaseIfNotJSCell(iter, proto);
</span><span class="cx">     linkSlowCase(iter);
</span><ins>+    linkSlowCase(iter);
</ins><span class="cx">     emitGetVirtualRegister(value, regT0);
</span><span class="cx">     emitGetVirtualRegister(proto, regT1);
</span><span class="cx">     callOperation(operationInstanceOf, dst, regT0, regT1);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOpcodes32_64cpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -233,6 +233,8 @@
</span><span class="cx">     move(TrustedImm32(1), regT0);
</span><span class="cx">     Label loop(this);
</span><span class="cx"> 
</span><ins>+    addSlowCase(branch8(Equal, Address(regT2, JSCell::typeInfoTypeOffset()), TrustedImm32(ProxyObjectType)));
+
</ins><span class="cx">     // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!
</span><span class="cx">     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
</span><span class="cx">     loadPtr(Address(regT2, JSCell::structureIDOffset()), regT2);
</span><span class="lines">@@ -263,6 +265,7 @@
</span><span class="cx">     linkSlowCaseIfNotJSCell(iter, value);
</span><span class="cx">     linkSlowCaseIfNotJSCell(iter, proto);
</span><span class="cx">     linkSlowCase(iter);
</span><ins>+    linkSlowCase(iter);
</ins><span class="cx"> 
</span><span class="cx">     emitLoad(value, regT1, regT0);
</span><span class="cx">     emitLoad(proto, regT3, regT2);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejitJITOperationscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jit/JITOperations.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/jit/JITOperations.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -1779,8 +1779,6 @@
</span><span class="cx">     JSValue value = JSValue::decode(encodedValue);
</span><span class="cx">     JSValue proto = JSValue::decode(encodedProto);
</span><span class="cx">     
</span><del>-    ASSERT(!value.isObject() || !proto.isObject());
-
</del><span class="cx">     bool result = JSObject::defaultHasInstance(exec, value, proto);
</span><span class="cx">     return JSValue::encode(jsBoolean(result));
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorejsccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/jsc.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/jsc.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/jsc.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -1228,7 +1228,7 @@
</span><span class="cx">     if (!target.isObject())
</span><span class="cx">         return JSValue::encode(jsUndefined());
</span><span class="cx">     JSObject* jsTarget = asObject(target.asCell());
</span><del>-    Structure* structure = JSProxy::createStructure(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), jsTarget-&gt;prototype());
</del><ins>+    Structure* structure = JSProxy::createStructure(exec-&gt;vm(), exec-&gt;lexicalGlobalObject(), jsTarget-&gt;getPrototypeDirect());
</ins><span class="cx">     JSProxy* proxy = JSProxy::create(exec-&gt;vm(), structure, jsTarget);
</span><span class="cx">     return JSValue::encode(proxy);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLLIntSlowPathscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/llint/LLIntSlowPaths.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -526,7 +526,6 @@
</span><span class="cx">     LLINT_BEGIN();
</span><span class="cx">     JSValue value = LLINT_OP_C(2).jsValue();
</span><span class="cx">     JSValue proto = LLINT_OP_C(3).jsValue();
</span><del>-    ASSERT(!value.isObject() || !proto.isObject());
</del><span class="cx">     LLINT_RETURN(jsBoolean(JSObject::defaultHasInstance(exec, value, proto)));
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreterasm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter.asm        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -1706,7 +1706,12 @@
</span><span class="cx">     callSlowPath(_slow_path_copy_rest)
</span><span class="cx">     dispatch(4)
</span><span class="cx"> 
</span><ins>+_llint_op_instanceof:
+    traceExecution()
+    callSlowPath(_llint_slow_path_instanceof)
+    dispatch(4)
</ins><span class="cx"> 
</span><ins>+
</ins><span class="cx"> # Lastly, make sure that we can link even though we don't support all opcodes.
</span><span class="cx"> # These opcodes should never arise when using LLInt or either JIT. We assert
</span><span class="cx"> # as much.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter32_64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -1206,34 +1206,6 @@
</span><span class="cx">     storei 1, PayloadOffset[cfr, t3, 8]
</span><span class="cx">     dispatch(4)
</span><span class="cx"> 
</span><del>-_llint_op_instanceof:
-    traceExecution()
-    # Actually do the work.
-    loadi 12[PC], t0
-    loadi 4[PC], t3
-    loadConstantOrVariablePayload(t0, CellTag, t1, .opInstanceofSlow)
-    bbb JSCell::m_type[t1], ObjectType, .opInstanceofSlow
-    loadi 8[PC], t0
-    loadConstantOrVariablePayload(t0, CellTag, t2, .opInstanceofSlow)
-    
-    # Register state: t1 = prototype, t2 = value
-    move 1, t0
-.opInstanceofLoop:
-    loadp JSCell::m_structureID[t2], t2
-    loadi Structure::m_prototype + PayloadOffset[t2], t2
-    bpeq t2, t1, .opInstanceofDone
-    btinz t2, .opInstanceofLoop
-
-    move 0, t0
-.opInstanceofDone:
-    storei BooleanTag, TagOffset[cfr, t3, 8]
-    storei t0, PayloadOffset[cfr, t3, 8]
-    dispatch(4)
-
-.opInstanceofSlow:
-    callSlowPath(_llint_slow_path_instanceof)
-    dispatch(4)
-
</del><span class="cx"> _llint_op_instanceof_custom:
</span><span class="cx">     traceExecution()
</span><span class="cx">     callSlowPath(_llint_slow_path_instanceof_custom)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCorellintLowLevelInterpreter64asm"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -1093,34 +1093,6 @@
</span><span class="cx">     dispatch(4)
</span><span class="cx"> 
</span><span class="cx"> 
</span><del>-_llint_op_instanceof:
-    traceExecution()
-    # Actually do the work.
-    loadisFromInstruction(3, t0)
-    loadConstantOrVariableCell(t0, t1, .opInstanceofSlow)
-    bbb JSCell::m_type[t1], ObjectType, .opInstanceofSlow
-    loadisFromInstruction(2, t0)
-    loadConstantOrVariableCell(t0, t2, .opInstanceofSlow)
-    
-    # Register state: t1 = prototype, t2 = value
-    move 1, t0
-.opInstanceofLoop:
-    loadStructureAndClobberFirstArg(t2, t3)
-    loadq Structure::m_prototype[t3], t2
-    bqeq t2, t1, .opInstanceofDone
-    btqz t2, tagMask, .opInstanceofLoop
-
-    move 0, t0
-.opInstanceofDone:
-    orq ValueFalse, t0
-    loadisFromInstruction(1, t3)
-    storeq t0, [cfr, t3, 8]
-    dispatch(4)
-
-.opInstanceofSlow:
-    callSlowPath(_llint_slow_path_instanceof)
-    dispatch(4)
-
</del><span class="cx"> _llint_op_instanceof_custom:
</span><span class="cx">     traceExecution()
</span><span class="cx">     callSlowPath(_llint_slow_path_instanceof_custom)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/ArrayPrototype.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -184,7 +184,7 @@
</span><span class="cx">         // Fast path in the normal case where the user has not set an own constructor and the Array.prototype.constructor is normal.
</span><span class="cx">         // We need prototype check for subclasses of Array, which are Array objects but have a different prototype by default.
</span><span class="cx">         if (LIKELY(!thisObject-&gt;hasCustomProperties()
</span><del>-            &amp;&amp; thisObject-&gt;globalObject()-&gt;arrayPrototype() == thisObject-&gt;prototype()
</del><ins>+            &amp;&amp; thisObject-&gt;globalObject()-&gt;arrayPrototype() == thisObject-&gt;getPrototypeDirect()
</ins><span class="cx">             &amp;&amp; !thisObject-&gt;globalObject()-&gt;arrayPrototype()-&gt;didChangeConstructorOrSpeciesProperties()))
</span><span class="cx">             return std::make_pair(SpeciesConstructResult::FastPath, nullptr);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeClassInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ClassInfo.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ClassInfo.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/ClassInfo.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -112,6 +112,9 @@
</span><span class="cx">     typedef bool (*SetPrototypeFunctionPtr)(JSObject*, ExecState*, JSValue, bool shouldThrowIfCantSet);
</span><span class="cx">     SetPrototypeFunctionPtr setPrototype;
</span><span class="cx"> 
</span><ins>+    typedef JSValue (*GetPrototypeFunctionPtr)(JSObject*, ExecState*);
+    GetPrototypeFunctionPtr getPrototype;
+
</ins><span class="cx">     typedef void (*DumpToStreamFunctionPtr)(const JSCell*, PrintStream&amp;);
</span><span class="cx">     DumpToStreamFunctionPtr dumpToStream;
</span><span class="cx"> 
</span><span class="lines">@@ -166,6 +169,7 @@
</span><span class="cx">         &amp;ClassName::preventExtensions, \
</span><span class="cx">         &amp;ClassName::isExtensible, \
</span><span class="cx">         &amp;ClassName::setPrototype, \
</span><ins>+        &amp;ClassName::getPrototype, \
</ins><span class="cx">         &amp;ClassName::dumpToStream, \
</span><span class="cx">         &amp;ClassName::estimatedSize \
</span><span class="cx">     }, \
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeFunctionPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/FunctionPrototype.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -168,7 +168,7 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSString* name = target.get(exec, exec-&gt;propertyNames().name).toString(exec);
</span><del>-    return JSValue::encode(JSBoundFunction::create(vm, globalObject, targetObject, exec-&gt;argument(0), boundArgs, length, name-&gt;value(exec)));
</del><ins>+    return JSValue::encode(JSBoundFunction::create(vm, exec, globalObject, targetObject, exec-&gt;argument(0), boundArgs, length, name-&gt;value(exec)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -129,7 +129,9 @@
</span><span class="cx">             return JSValue::encode(throwOutOfMemoryError(state));
</span><span class="cx"> 
</span><span class="cx">         // c. Let bc be BoundFunctionCreate(F, Â«this value»).
</span><del>-        boundCompare = JSBoundFunction::create(vm, globalObject, targetObject, collator, boundArgs, 2, ASCIILiteral(&quot;compare&quot;));
</del><ins>+        boundCompare = JSBoundFunction::create(vm, state, globalObject, targetObject, collator, boundArgs, 2, ASCIILiteral(&quot;compare&quot;));
+        if (vm.exception())
+            return JSValue::encode(JSValue());
</ins><span class="cx">         // d. Set collator.[[boundCompare]] to bc.
</span><span class="cx">         collator-&gt;setBoundCompare(vm, boundCompare);
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -134,7 +134,9 @@
</span><span class="cx">             return JSValue::encode(throwOutOfMemoryError(state));
</span><span class="cx"> 
</span><span class="cx">         // c. Let bf be BoundFunctionCreate(F, Â«this value»).
</span><del>-        boundFormat = JSBoundFunction::create(vm, globalObject, targetObject, dtf, boundArgs, 1, ASCIILiteral(&quot;format&quot;));
</del><ins>+        boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, dtf, boundArgs, 1, ASCIILiteral(&quot;format&quot;));
+        if (vm.exception())
+            return JSValue::encode(JSValue());
</ins><span class="cx">         // d. Set dtf.[[boundFormat]] to bf.
</span><span class="cx">         dtf-&gt;setBoundFormat(vm, boundFormat);
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -122,7 +122,9 @@
</span><span class="cx">             return JSValue::encode(throwOutOfMemoryError(state));
</span><span class="cx"> 
</span><span class="cx">         // c. Let bf be BoundFunctionCreate(F, Â«this value»).
</span><del>-        boundFormat = JSBoundFunction::create(vm, globalObject, targetObject, nf, boundArgs, 1, ASCIILiteral(&quot;format&quot;));
</del><ins>+        boundFormat = JSBoundFunction::create(vm, state, globalObject, targetObject, nf, boundArgs, 1, ASCIILiteral(&quot;format&quot;));
+        if (vm.exception())
+            return JSValue::encode(JSValue());
</ins><span class="cx">         // d. Set nf.[[boundFormat]] to bf.
</span><span class="cx">         nf-&gt;setBoundFormat(vm, boundFormat);
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundFunctioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundFunction.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -87,9 +87,11 @@
</span><span class="cx">     return JSValue::encode(jsBoolean(boundObject-&gt;targetFunction()-&gt;hasInstance(exec, value)));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline Structure* getBoundFunctionStructure(VM&amp; vm, JSGlobalObject* globalObject, JSObject* targetFunction)
</del><ins>+inline Structure* getBoundFunctionStructure(VM&amp; vm, ExecState* exec, JSGlobalObject* globalObject, JSObject* targetFunction)
</ins><span class="cx"> {
</span><del>-    JSValue prototype = targetFunction-&gt;structure(vm)-&gt;storedPrototype();
</del><ins>+    JSValue prototype = targetFunction-&gt;getPrototype(vm, exec);
+    if (UNLIKELY(vm.exception()))
+        return nullptr;
</ins><span class="cx">     JSFunction* targetJSFunction = jsDynamicCast&lt;JSFunction*&gt;(targetFunction);
</span><span class="cx"> 
</span><span class="cx">     // We only cache the structure of the bound function if the bindee is a JSFunction since there
</span><span class="lines">@@ -117,13 +119,15 @@
</span><span class="cx">     return result;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSBoundFunction* JSBoundFunction::create(VM&amp; vm, JSGlobalObject* globalObject, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int length, const String&amp; name)
</del><ins>+JSBoundFunction* JSBoundFunction::create(VM&amp; vm, ExecState* exec, JSGlobalObject* globalObject, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int length, const String&amp; name)
</ins><span class="cx"> {
</span><span class="cx">     ConstructData constructData;
</span><span class="cx">     ConstructType constructType = JSC::getConstructData(targetFunction, constructData);
</span><span class="cx">     bool canConstruct = constructType != ConstructType::None;
</span><span class="cx">     NativeExecutable* executable = vm.getHostFunction(boundFunctionCall, canConstruct ? boundFunctionConstruct : callHostFunctionAsConstructor, ASCIILiteral(&quot;Function.prototype.bind result&quot;));
</span><del>-    Structure* structure = getBoundFunctionStructure(vm, globalObject, targetFunction);
</del><ins>+    Structure* structure = getBoundFunctionStructure(vm, exec, globalObject, targetFunction);
+    if (UNLIKELY(vm.exception()))
+        return nullptr;
</ins><span class="cx">     JSBoundFunction* function = new (NotNull, allocateCell&lt;JSBoundFunction&gt;(vm.heap)) JSBoundFunction(vm, globalObject, structure, targetFunction, boundThis, boundArgs);
</span><span class="cx"> 
</span><span class="cx">     function-&gt;finishCreation(vm, executable, length, makeString(&quot;bound &quot;, name));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSBoundFunctionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSBoundFunction.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     typedef JSFunction Base;
</span><span class="cx">     const static unsigned StructureFlags = ~ImplementsDefaultHasInstance &amp; Base::StructureFlags;
</span><span class="cx"> 
</span><del>-    static JSBoundFunction* create(VM&amp;, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int, const String&amp;);
</del><ins>+    static JSBoundFunction* create(VM&amp;, ExecState*, JSGlobalObject*, JSObject* targetFunction, JSValue boundThis, JSValue boundArgs, int, const String&amp;);
</ins><span class="cx">     
</span><span class="cx">     static bool customHasInstance(JSObject*, ExecState*, JSValue);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCJSValuecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSCJSValue.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -143,7 +143,7 @@
</span><span class="cx">     JSValue prototype;
</span><span class="cx">     if (propertyName != exec-&gt;propertyNames().underscoreProto) {
</span><span class="cx">         for (; !obj-&gt;structure()-&gt;hasReadOnlyOrGetterSetterPropertiesExcludingProto(); obj = asObject(prototype)) {
</span><del>-            prototype = obj-&gt;prototype();
</del><ins>+            prototype = obj-&gt;getPrototypeDirect();
</ins><span class="cx">             if (prototype.isNull()) {
</span><span class="cx">                 if (slot.isStrictMode())
</span><span class="cx">                     throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
</span><span class="lines">@@ -178,7 +178,9 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        prototype = obj-&gt;prototype();
</del><ins>+        prototype = obj-&gt;getPrototype(vm, exec);
+        if (vm.exception())
+            return;
</ins><span class="cx">         if (prototype.isNull())
</span><span class="cx">             break;
</span><span class="cx">     }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -285,4 +285,9 @@
</span><span class="cx">     RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+JSValue JSCell::getPrototype(JSObject*, ExecState*)
+{
+    RELEASE_ASSERT_NOT_REACHED();
+}
+
</ins><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSCellh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSCell.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSCell.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSCell.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -209,6 +209,7 @@
</span><span class="cx">     static NO_RETURN_DUE_TO_CRASH bool preventExtensions(JSObject*, ExecState*);
</span><span class="cx">     static NO_RETURN_DUE_TO_CRASH bool isExtensible(JSObject*, ExecState*);
</span><span class="cx">     static NO_RETURN_DUE_TO_CRASH bool setPrototype(JSObject*, ExecState*, JSValue, bool);
</span><ins>+    static NO_RETURN_DUE_TO_CRASH JSValue getPrototype(JSObject*, ExecState*);
</ins><span class="cx"> 
</span><span class="cx">     static String className(const JSObject*);
</span><span class="cx">     JS_EXPORT_PRIVATE static bool customHasInstance(JSObject*, ExecState*, JSValue);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -613,7 +613,7 @@
</span><span class="cx">         putDirectWithoutTransition(vm, Identifier::fromString(exec, &quot;$vm&quot;), dollarVM, DontEnum);
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    resetPrototype(vm, prototype());
</del><ins>+    resetPrototype(vm, getPrototypeDirect());
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSGlobalObject::hasLegacyProfiler() const
</span><span class="lines">@@ -669,8 +669,8 @@
</span><span class="cx"> static inline JSObject* lastInPrototypeChain(JSObject* object)
</span><span class="cx"> {
</span><span class="cx">     JSObject* o = object;
</span><del>-    while (o-&gt;prototype().isObject())
-        o = asObject(o-&gt;prototype());
</del><ins>+    while (o-&gt;getPrototypeDirect().isObject())
+        o = asObject(o-&gt;getPrototypeDirect());
</ins><span class="cx">     return o;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -726,7 +726,7 @@
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        JSValue prototypeValue = current-&gt;prototype();
</del><ins>+        JSValue prototypeValue = current-&gt;getPrototypeDirect();
</ins><span class="cx">         if (prototypeValue.isNull())
</span><span class="cx">             break;
</span><span class="cx">         current = asObject(prototypeValue);
</span><span class="lines">@@ -785,20 +785,20 @@
</span><span class="cx"> bool JSGlobalObject::objectPrototypeIsSane()
</span><span class="cx"> {
</span><span class="cx">     return !hasIndexedProperties(m_objectPrototype-&gt;indexingType())
</span><del>-        &amp;&amp; m_objectPrototype-&gt;prototype().isNull();
</del><ins>+        &amp;&amp; m_objectPrototype-&gt;getPrototypeDirect().isNull();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSGlobalObject::arrayPrototypeChainIsSane()
</span><span class="cx"> {
</span><span class="cx">     return !hasIndexedProperties(m_arrayPrototype-&gt;indexingType())
</span><del>-        &amp;&amp; m_arrayPrototype-&gt;prototype() == m_objectPrototype.get()
</del><ins>+        &amp;&amp; m_arrayPrototype-&gt;getPrototypeDirect() == m_objectPrototype.get()
</ins><span class="cx">         &amp;&amp; objectPrototypeIsSane();
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool JSGlobalObject::stringPrototypeChainIsSane()
</span><span class="cx"> {
</span><span class="cx">     return !hasIndexedProperties(m_stringPrototype-&gt;indexingType())
</span><del>-        &amp;&amp; m_stringPrototype-&gt;prototype() == m_objectPrototype.get()
</del><ins>+        &amp;&amp; m_stringPrototype-&gt;getPrototypeDirect() == m_objectPrototype.get()
</ins><span class="cx">         &amp;&amp; objectPrototypeIsSane();
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObject.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -379,7 +379,7 @@
</span><span class="cx">         structure()-&gt;setGlobalObject(vm, this);
</span><span class="cx">         m_runtimeFlags = m_globalObjectMethodTable-&gt;javaScriptRuntimeFlags(this);
</span><span class="cx">         init(vm);
</span><del>-        setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, prototype(), PureForwardingProxyType), this));
</del><ins>+        setGlobalThis(vm, JSProxy::create(vm, JSProxy::createStructure(vm, this, getPrototypeDirect(), PureForwardingProxyType), this));
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void finishCreation(VM&amp; vm, JSObject* thisValue)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSGlobalObjectFunctionscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -784,8 +784,9 @@
</span><span class="cx"> 
</span><span class="cx"> class GlobalFuncProtoGetterFunctor {
</span><span class="cx"> public:
</span><del>-    GlobalFuncProtoGetterFunctor(JSObject* thisObject)
-        : m_hasSkippedFirstFrame(false)
</del><ins>+    GlobalFuncProtoGetterFunctor(ExecState* exec, JSObject* thisObject)
+        : m_exec(exec)
+        , m_hasSkippedFirstFrame(false)
</ins><span class="cx">         , m_thisObject(thisObject)
</span><span class="cx">         , m_result(JSValue::encode(jsUndefined()))
</span><span class="cx">     {
</span><span class="lines">@@ -801,12 +802,13 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         if (m_thisObject-&gt;allowsAccessFrom(visitor-&gt;callFrame()))
</span><del>-            m_result = JSValue::encode(m_thisObject-&gt;prototype());
</del><ins>+            m_result = JSValue::encode(m_thisObject-&gt;getPrototype(m_exec-&gt;vm(), m_exec));
</ins><span class="cx"> 
</span><span class="cx">         return StackVisitor::Done;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><ins>+    ExecState* m_exec;
</ins><span class="cx">     bool m_hasSkippedFirstFrame;
</span><span class="cx">     JSObject* m_thisObject;
</span><span class="cx">     EncodedJSValue m_result;
</span><span class="lines">@@ -822,7 +824,10 @@
</span><span class="cx">     if (!thisObject)
</span><span class="cx">         return JSValue::encode(exec-&gt;thisValue().synthesizePrototype(exec));
</span><span class="cx"> 
</span><del>-    GlobalFuncProtoGetterFunctor functor(thisObject);
</del><ins>+    GlobalFuncProtoGetterFunctor functor(exec, thisObject);
+    // This can throw but it's just unneeded extra work to check for it. The return
+    // value from this function is only used as the return value from a host call.
+    // Therefore, the return value is only used if there wasn't an exception.
</ins><span class="cx">     exec-&gt;iterate(functor);
</span><span class="cx">     return functor.result();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSLexicalEnvironmentcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSLexicalEnvironment.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -76,7 +76,7 @@
</span><span class="cx">     // We don't call through to JSObject because there's no way to give a 
</span><span class="cx">     // lexical environment object getter properties or a prototype.
</span><span class="cx">     ASSERT(!thisObject-&gt;hasGetterSetterProperties());
</span><del>-    ASSERT(thisObject-&gt;prototype().isNull());
</del><ins>+    ASSERT(thisObject-&gt;getPrototypeDirect().isNull());
</ins><span class="cx">     return false;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -272,7 +272,7 @@
</span><span class="cx"> {
</span><span class="cx">     String prototypeFunctionName;
</span><span class="cx">     ExecState* exec = object-&gt;globalObject()-&gt;globalExec();
</span><del>-    PropertySlot slot(object-&gt;structure()-&gt;storedPrototype(), PropertySlot::InternalMethodType::VMInquiry);
</del><ins>+    PropertySlot slot(object-&gt;getPrototypeDirect(), PropertySlot::InternalMethodType::VMInquiry);
</ins><span class="cx">     PropertyName constructor(exec-&gt;propertyNames().constructor);
</span><span class="cx">     if (object-&gt;getPropertySlot(exec, constructor, slot)) {
</span><span class="cx">         if (slot.isValue()) {
</span><span class="lines">@@ -430,11 +430,14 @@
</span><span class="cx">             }
</span><span class="cx">         }
</span><span class="cx">         if (obj-&gt;type() == ProxyObjectType &amp;&amp; propertyName != vm.propertyNames-&gt;underscoreProto) {
</span><ins>+            // FIXME: We shouldn't unconditionally perform [[Set]] here.
+            // We need to do more because this is observable behavior.
+            // https://bugs.webkit.org/show_bug.cgi?id=155012
</ins><span class="cx">             ProxyObject* proxy = jsCast&lt;ProxyObject*&gt;(obj);
</span><span class="cx">             proxy-&gt;ProxyObject::put(proxy, exec, propertyName, value, slot);
</span><span class="cx">             return;
</span><span class="cx">         }
</span><del>-        JSValue prototype = obj-&gt;prototype();
</del><ins>+        JSValue prototype = obj-&gt;getPrototypeDirect();
</ins><span class="cx">         if (prototype.isNull())
</span><span class="cx">             break;
</span><span class="cx">         obj = asObject(prototype);
</span><span class="lines">@@ -1201,7 +1204,7 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT(methodTable(vm)-&gt;toThis(this, exec, NotStrictMode) == this);
</span><span class="cx"> 
</span><del>-    if (this-&gt;prototype() == prototype)
</del><ins>+    if (this-&gt;getPrototypeDirect() == prototype)
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><span class="cx">     bool isExtensible = this-&gt;isExtensible(exec);
</span><span class="lines">@@ -1215,13 +1218,16 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     JSValue nextPrototype = prototype;
</span><ins>+    MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
</ins><span class="cx">     while (nextPrototype &amp;&amp; nextPrototype.isObject()) {
</span><span class="cx">         if (nextPrototype == this) {
</span><span class="cx">             if (shouldThrowIfCantSet)
</span><span class="cx">                 vm.throwException(exec, createError(exec, ASCIILiteral(&quot;cyclic __proto__ value&quot;)));
</span><span class="cx">             return false;
</span><span class="cx">         }
</span><del>-        nextPrototype = asObject(nextPrototype)-&gt;prototype();
</del><ins>+        if (UNLIKELY(asObject(nextPrototype)-&gt;methodTable(vm)-&gt;getPrototype != defaultGetPrototype))
+            break; // We're done. Set the prototype.
+        nextPrototype = asObject(nextPrototype)-&gt;getPrototypeDirect();
</ins><span class="cx">     }
</span><span class="cx">     setPrototypeDirect(vm, prototype);
</span><span class="cx">     return true;
</span><span class="lines">@@ -1232,6 +1238,11 @@
</span><span class="cx">     return object-&gt;setPrototypeWithCycleCheck(exec-&gt;vm(), exec, prototype, shouldThrowIfCantSet);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+JSValue JSObject::getPrototype(JSObject* object, ExecState*)
+{
+    return object-&gt;getPrototypeDirect();
+}
+
</ins><span class="cx"> bool JSObject::setPrototype(VM&amp; vm, ExecState* exec, JSValue prototype, bool shouldThrowIfCantSet)
</span><span class="cx"> {
</span><span class="cx">     return methodTable(vm)-&gt;setPrototype(this, exec, prototype, shouldThrowIfCantSet);
</span><span class="lines">@@ -1572,12 +1583,19 @@
</span><span class="cx">         return false;
</span><span class="cx">     }
</span><span class="cx"> 
</span><ins>+    VM&amp; vm = exec-&gt;vm();
</ins><span class="cx">     JSObject* object = asObject(value);
</span><del>-    while ((object = object-&gt;prototype().getObject())) {
</del><ins>+    while (true) {
+        JSValue objectValue = object-&gt;getPrototype(vm, exec);
+        if (UNLIKELY(vm.exception()))
+            return false;
+        if (!objectValue.isObject())
+            return false;
+        object = asObject(objectValue);
</ins><span class="cx">         if (proto == object)
</span><span class="cx">             return true;
</span><span class="cx">     }
</span><del>-    return false;
</del><ins>+    ASSERT_NOT_REACHED();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL objectPrivateFuncInstanceOf(ExecState* exec)
</span><span class="lines">@@ -1590,24 +1608,29 @@
</span><span class="cx"> 
</span><span class="cx"> void JSObject::getPropertyNames(JSObject* object, ExecState* exec, PropertyNameArray&amp; propertyNames, EnumerationMode mode)
</span><span class="cx"> {
</span><del>-    object-&gt;methodTable(exec-&gt;vm())-&gt;getOwnPropertyNames(object, exec, propertyNames, mode);
-    if (UNLIKELY(exec-&gt;hadException()))
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    object-&gt;methodTable(vm)-&gt;getOwnPropertyNames(object, exec, propertyNames, mode);
+    if (UNLIKELY(vm.exception()))
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    if (object-&gt;prototype().isNull())
</del><ins>+    JSValue nextProto = object-&gt;getPrototype(vm, exec);
+    if (UNLIKELY(vm.exception()))
</ins><span class="cx">         return;
</span><ins>+    if (nextProto.isNull())
+        return;
</ins><span class="cx"> 
</span><del>-    VM&amp; vm = exec-&gt;vm();
-    JSObject* prototype = asObject(object-&gt;prototype());
</del><ins>+    JSObject* prototype = asObject(nextProto);
</ins><span class="cx">     while(1) {
</span><span class="cx">         if (prototype-&gt;structure(vm)-&gt;typeInfo().overridesGetPropertyNames()) {
</span><span class="cx">             prototype-&gt;methodTable(vm)-&gt;getPropertyNames(prototype, exec, propertyNames, mode);
</span><span class="cx">             break;
</span><span class="cx">         }
</span><span class="cx">         prototype-&gt;methodTable(vm)-&gt;getOwnPropertyNames(prototype, exec, propertyNames, mode);
</span><del>-        if (UNLIKELY(exec-&gt;hadException()))
</del><ins>+        if (UNLIKELY(vm.exception()))
</ins><span class="cx">             return;
</span><del>-        JSValue nextProto = prototype-&gt;prototype();
</del><ins>+        nextProto = prototype-&gt;getPrototype(vm, exec);
+        if (UNLIKELY(vm.exception()))
+            return;
</ins><span class="cx">         if (nextProto.isNull())
</span><span class="cx">             break;
</span><span class="cx">         prototype = asObject(nextProto);
</span><span class="lines">@@ -2027,7 +2050,7 @@
</span><span class="cx">             return true;
</span><span class="cx">         }
</span><span class="cx">         
</span><del>-        JSValue prototypeValue = current-&gt;prototype();
</del><ins>+        JSValue prototypeValue = current-&gt;getPrototypeDirect();
</ins><span class="cx">         if (prototypeValue.isNull())
</span><span class="cx">             return false;
</span><span class="cx">         
</span><span class="lines">@@ -2037,7 +2060,7 @@
</span><span class="cx"> 
</span><span class="cx"> bool JSObject::attemptToInterceptPutByIndexOnHole(ExecState* exec, unsigned i, JSValue value, bool shouldThrow)
</span><span class="cx"> {
</span><del>-    JSValue prototypeValue = prototype();
</del><ins>+    JSValue prototypeValue = getPrototypeDirect();
</ins><span class="cx">     if (prototypeValue.isNull())
</span><span class="cx">         return false;
</span><span class="cx">     
</span><span class="lines">@@ -3029,13 +3052,16 @@
</span><span class="cx"> {
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     object-&gt;methodTable(vm)-&gt;getOwnPropertyNames(object, exec, propertyNames, EnumerationMode(mode, JSObjectPropertiesMode::Exclude));
</span><del>-    if (UNLIKELY(exec-&gt;hadException()))
</del><ins>+    if (UNLIKELY(vm.exception()))
</ins><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    if (object-&gt;prototype().isNull())
</del><ins>+    JSValue nextProto = object-&gt;getPrototype(vm, exec);
+    if (UNLIKELY(vm.exception()))
</ins><span class="cx">         return;
</span><ins>+    if (nextProto.isNull())
+        return;
</ins><span class="cx"> 
</span><del>-    JSObject* prototype = asObject(object-&gt;prototype());
</del><ins>+    JSObject* prototype = asObject(nextProto);
</ins><span class="cx">     while (true) {
</span><span class="cx">         if (prototype-&gt;structure(vm)-&gt;typeInfo().overridesGetPropertyNames()) {
</span><span class="cx">             prototype-&gt;methodTable(vm)-&gt;getPropertyNames(prototype, exec, propertyNames, mode);
</span><span class="lines">@@ -3044,7 +3070,9 @@
</span><span class="cx">         prototype-&gt;methodTable(vm)-&gt;getOwnPropertyNames(prototype, exec, propertyNames, mode);
</span><span class="cx">         if (UNLIKELY(exec-&gt;hadException()))
</span><span class="cx">             return;
</span><del>-        JSValue nextProto = prototype-&gt;prototype();
</del><ins>+        nextProto = prototype-&gt;getPrototype(vm, exec);
+        if (UNLIKELY(vm.exception()))
+            return;
</ins><span class="cx">         if (nextProto.isNull())
</span><span class="cx">             break;
</span><span class="cx">         prototype = asObject(nextProto);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -103,7 +103,19 @@
</span><span class="cx">     JS_EXPORT_PRIVATE static String className(const JSObject*);
</span><span class="cx">     JS_EXPORT_PRIVATE static String calculatedClassName(JSObject*);
</span><span class="cx"> 
</span><del>-    JSValue prototype() const;
</del><ins>+    // This is the fully virtual [[GetPrototypeOf]] internal function defined
+    // in the ECMAScript 6 specification. Use this when doing a [[GetPrototypeOf]] 
+    // operation as dictated in the specification.
+    JSValue getPrototype(VM&amp;, ExecState*);
+    JS_EXPORT_PRIVATE static JSValue getPrototype(JSObject*, ExecState*);
+    // This gets the prototype directly off of the structure. This does not do
+    // dynamic dispatch on the getPrototype method table method. It is not valid 
+    // to use this when performing a [[GetPrototypeOf]] operation in the specification.
+    // It is valid to use though when you know that you want to directly get it
+    // without consulting the method table. This is akin to getting the [[Prototype]]
+    // internal field directly as described in the specification.
+    JSValue getPrototypeDirect() const;
+
</ins><span class="cx">     // This sets the prototype without checking for cycles and without
</span><span class="cx">     // doing dynamic dispatch on [[SetPrototypeOf]] operation in the specification.
</span><span class="cx">     // It is not valid to use this when performing a [[SetPrototypeOf]] operation in
</span><span class="lines">@@ -759,7 +771,7 @@
</span><span class="cx">     {
</span><span class="cx">         Base::finishCreation(vm);
</span><span class="cx">         ASSERT(inherits(info()));
</span><del>-        ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
</del><ins>+        ASSERT(getPrototypeDirect().isNull() || Heap::heap(this) == Heap::heap(getPrototypeDirect()));
</ins><span class="cx">         ASSERT(structure()-&gt;isObject());
</span><span class="cx">         ASSERT(classInfo());
</span><span class="cx">     }
</span><span class="lines">@@ -1124,11 +1136,20 @@
</span><span class="cx">     vm.heap.ascribeOwner(this, butterfly);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-inline JSValue JSObject::prototype() const
</del><ins>+inline JSValue JSObject::getPrototypeDirect() const
</ins><span class="cx"> {
</span><span class="cx">     return structure()-&gt;storedPrototype();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+inline JSValue JSObject::getPrototype(VM&amp; vm, ExecState* exec)
+{
+    auto getPrototypeMethod = methodTable(vm)-&gt;getPrototype;
+    MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
+    if (LIKELY(getPrototypeMethod == defaultGetPrototype))
+        return getPrototypeDirect();
+    return getPrototypeMethod(this, exec);
+}
+
</ins><span class="cx"> // It is safe to call this method with a PropertyName that is actually an index,
</span><span class="cx"> // but if so will always return false (doesn't search index storage).
</span><span class="cx"> ALWAYS_INLINE bool JSObject::getOwnNonIndexPropertySlot(VM&amp; vm, Structure&amp; structure, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="lines">@@ -1204,6 +1225,7 @@
</span><span class="cx">             // parsing the int again.
</span><span class="cx">             return object-&gt;getNonIndexPropertySlot(exec, propertyName, slot);
</span><span class="cx">         }
</span><ins>+        ASSERT(object-&gt;type() != ProxyObjectType);
</ins><span class="cx">         Structure&amp; structure = *structureIDTable.get(object-&gt;structureID());
</span><span class="cx">         if (object-&gt;getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
</span><span class="cx">             return true;
</span><span class="lines">@@ -1223,11 +1245,21 @@
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     auto&amp; structureIDTable = vm.heap.structureIDTable();
</span><span class="cx">     JSObject* object = this;
</span><ins>+    MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
</ins><span class="cx">     while (true) {
</span><span class="cx">         Structure&amp; structure = *structureIDTable.get(object-&gt;structureID());
</span><span class="cx">         if (structure.classInfo()-&gt;methodTable.getOwnPropertySlotByIndex(object, exec, propertyName, slot))
</span><span class="cx">             return true;
</span><del>-        JSValue prototype = structure.storedPrototype();
</del><ins>+        if (UNLIKELY(vm.exception()))
+            return false;
+        JSValue prototype;
+        if (LIKELY(structure.classInfo()-&gt;methodTable.getPrototype == defaultGetPrototype || slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry))
+            prototype = structure.storedPrototype();
+        else {
+            prototype = object-&gt;getPrototype(vm, exec);
+            if (vm.exception())
+                return false;
+        }
</ins><span class="cx">         if (!prototype.isObject())
</span><span class="cx">             return false;
</span><span class="cx">         object = asObject(prototype);
</span><span class="lines">@@ -1242,14 +1274,26 @@
</span><span class="cx">     VM&amp; vm = exec-&gt;vm();
</span><span class="cx">     auto&amp; structureIDTable = vm.heap.structureIDTable();
</span><span class="cx">     JSObject* object = this;
</span><ins>+    MethodTable::GetPrototypeFunctionPtr defaultGetPrototype = JSObject::getPrototype;
</ins><span class="cx">     while (true) {
</span><span class="cx">         Structure&amp; structure = *structureIDTable.get(object-&gt;structureID());
</span><span class="cx">         if (LIKELY(!TypeInfo::overridesGetOwnPropertySlot(object-&gt;inlineTypeFlags()))) {
</span><span class="cx">             if (object-&gt;getOwnNonIndexPropertySlot(vm, structure, propertyName, slot))
</span><span class="cx">                 return true;
</span><del>-        } else if (structure.classInfo()-&gt;methodTable.getOwnPropertySlot(object, exec, propertyName, slot))
-            return true;
-        JSValue prototype = structure.storedPrototype();
</del><ins>+        } else {
+            if (structure.classInfo()-&gt;methodTable.getOwnPropertySlot(object, exec, propertyName, slot))
+                return true;
+            if (UNLIKELY(vm.exception()))
+                return false;
+        }
+        JSValue prototype;
+        if (LIKELY(structure.classInfo()-&gt;methodTable.getPrototype == defaultGetPrototype || slot.internalMethodType() == PropertySlot::InternalMethodType::VMInquiry))
+            prototype = structure.storedPrototype();
+        else {
+            prototype = object-&gt;getPrototype(vm, exec);
+            if (vm.exception())
+                return false;
+        }
</ins><span class="cx">         if (!prototype.isObject())
</span><span class="cx">             return false;
</span><span class="cx">         object = asObject(prototype);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSObjectInlines.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">         if (obj-&gt;structure(vm)-&gt;hasReadOnlyOrGetterSetterPropertiesExcludingProto() || obj-&gt;type() == ProxyObjectType)
</span><span class="cx">             return false;
</span><span class="cx"> 
</span><del>-        prototype = obj-&gt;prototype();
</del><ins>+        prototype = obj-&gt;getPrototypeDirect();
</ins><span class="cx">         if (prototype.isNull())
</span><span class="cx">             return true;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSProxycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSProxy.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSProxy.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSProxy.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -47,7 +47,7 @@
</span><span class="cx"> {
</span><span class="cx">     ASSERT_ARG(globalObject, globalObject);
</span><span class="cx">     m_target.set(vm, this, globalObject);
</span><del>-    setPrototypeDirect(vm, globalObject-&gt;prototype());
</del><ins>+    setPrototypeDirect(vm, globalObject-&gt;getPrototypeDirect());
</ins><span class="cx"> 
</span><span class="cx">     PrototypeMap&amp; prototypeMap = vm.prototypeMap;
</span><span class="cx">     if (!prototypeMap.isPrototype(this))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypedArrayViewConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/JSTypedArrayViewConstructor.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx">     if (object-&gt;methodTable()-&gt;getConstructData(object, data) == ConstructType::None)
</span><span class="cx">         return JSValue::encode(throwTypeError(exec, &quot;new.target passed to TypedArray is not a valid constructor.&quot;));
</span><span class="cx"> 
</span><del>-    for (; !value.isNull(); value = jsCast&lt;JSObject*&gt;(value)-&gt;prototype()) {
</del><ins>+    for (; !value.isNull(); value = jsCast&lt;JSObject*&gt;(value)-&gt;getPrototypeDirect()) {
</ins><span class="cx">         if (jsDynamicCast&lt;JSTypedArrayViewConstructor*&gt;(value))
</span><span class="cx">             return JSValue::encode(throwTypeError(exec, &quot;Unable to find TypedArray constructor that inherits from TypedArray.&quot;));
</span><span class="cx">         if (jsDynamicCast&lt;JSGenericTypedArrayViewConstructor&lt;JSInt8Array&gt;*&gt;(value))
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -150,8 +150,9 @@
</span><span class="cx"> 
</span><span class="cx"> class ObjectConstructorGetPrototypeOfFunctor {
</span><span class="cx"> public:
</span><del>-    ObjectConstructorGetPrototypeOfFunctor(JSObject* object)
-        : m_hasSkippedFirstFrame(false)
</del><ins>+    ObjectConstructorGetPrototypeOfFunctor(ExecState* exec, JSObject* object)
+        : m_exec(exec)
+        , m_hasSkippedFirstFrame(false)
</ins><span class="cx">         , m_object(object)
</span><span class="cx">         , m_result(jsUndefined())
</span><span class="cx">     {
</span><span class="lines">@@ -167,11 +168,12 @@
</span><span class="cx">         }
</span><span class="cx"> 
</span><span class="cx">         if (m_object-&gt;allowsAccessFrom(visitor-&gt;callFrame()))
</span><del>-            m_result = m_object-&gt;prototype();
</del><ins>+            m_result = m_object-&gt;getPrototype(m_exec-&gt;vm(), m_exec);
</ins><span class="cx">         return StackVisitor::Done;
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx"> private:
</span><ins>+    ExecState* m_exec;
</ins><span class="cx">     bool m_hasSkippedFirstFrame;
</span><span class="cx">     JSObject* m_object;
</span><span class="cx">     JSValue m_result;
</span><span class="lines">@@ -179,7 +181,10 @@
</span><span class="cx"> 
</span><span class="cx"> JSValue objectConstructorGetPrototypeOf(ExecState* exec, JSObject* object)
</span><span class="cx"> {
</span><del>-    ObjectConstructorGetPrototypeOfFunctor functor(object);
</del><ins>+    ObjectConstructorGetPrototypeOfFunctor functor(exec, object);
+    // This can throw but it's just unneeded extra work to check for it. The return
+    // value from this function is only used as the return value from a host call.
+    // Therefore, the return value is only used if there wasn't an exception.
</ins><span class="cx">     exec-&gt;iterate(functor);
</span><span class="cx">     return functor.result();
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/ObjectPrototype.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -101,14 +101,19 @@
</span><span class="cx">     if (!exec-&gt;argument(0).isObject())
</span><span class="cx">         return JSValue::encode(jsBoolean(false));
</span><span class="cx"> 
</span><del>-    JSValue v = asObject(exec-&gt;argument(0))-&gt;prototype();
</del><ins>+    VM&amp; vm = exec-&gt;vm();
+    JSValue v = asObject(exec-&gt;argument(0))-&gt;getPrototype(vm, exec);
+    if (UNLIKELY(vm.exception()))
+        return JSValue::encode(JSValue());
</ins><span class="cx"> 
</span><span class="cx">     while (true) {
</span><span class="cx">         if (!v.isObject())
</span><span class="cx">             return JSValue::encode(jsBoolean(false));
</span><span class="cx">         if (v == thisObj)
</span><span class="cx">             return JSValue::encode(jsBoolean(true));
</span><del>-        v = asObject(v)-&gt;prototype();
</del><ins>+        v = asObject(v)-&gt;getPrototype(vm, exec);
+        if (UNLIKELY(vm.exception()))
+            return JSValue::encode(JSValue());
</ins><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeProxyObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/ProxyObject.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -90,11 +90,10 @@
</span><span class="cx">     // FIXME: make it so that custom getters take both the |this| value and the slotBase (property holder).
</span><span class="cx">     // https://bugs.webkit.org/show_bug.cgi?id=154320
</span><span class="cx">     while (true) {
</span><del>-        if (LIKELY(proxyObjectAsObject-&gt;inherits(ProxyObject::info())))
</del><ins>+        if (LIKELY(proxyObjectAsObject-&gt;type() == ProxyObjectType))
</ins><span class="cx">             break;
</span><span class="cx"> 
</span><del>-        Structure&amp; structure = *vm.heap.structureIDTable().get(proxyObjectAsObject-&gt;structureID());
-        JSValue prototype = structure.storedPrototype();
</del><ins>+        JSValue prototype = proxyObjectAsObject-&gt;getPrototypeDirect();
</ins><span class="cx">         RELEASE_ASSERT(prototype.isObject());
</span><span class="cx">         proxyObjectAsObject = asObject(prototype);
</span><span class="cx">     }
</span><span class="lines">@@ -1006,7 +1005,9 @@
</span><span class="cx">     if (targetIsExtensible)
</span><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    JSValue targetPrototype = target-&gt;prototype();
</del><ins>+    JSValue targetPrototype = target-&gt;getPrototype(vm, exec);
+    if (vm.exception())
+        return false;
</ins><span class="cx">     if (!sameValue(exec, prototype, targetPrototype)) {
</span><span class="cx">         throwVMTypeError(exec, ASCIILiteral(&quot;Proxy 'setPrototypeOf' trap returned true when its target is non-extensible and the new prototype value is not the same as the current prototype value. It should have returned false.&quot;));
</span><span class="cx">         return false;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStructureInlinesh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StructureInlines.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StructureInlines.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/runtime/StructureInlines.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -210,7 +210,7 @@
</span><span class="cx">         if (asObject(prototype)-&gt;structure() != cachedStructure-&gt;get())
</span><span class="cx">             return false;
</span><span class="cx">         ++cachedStructure;
</span><del>-        prototype = asObject(prototype)-&gt;prototype();
</del><ins>+        prototype = asObject(prototype)-&gt;getPrototypeDirect();
</ins><span class="cx">     }
</span><span class="cx">     return prototype.isNull() &amp;&amp; !*cachedStructure;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoretestsstressproxyhaspropertyjs"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/tests/stress/proxy-has-property.js (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/tests/stress/proxy-has-property.js        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/JavaScriptCore/tests/stress/proxy-has-property.js        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -367,3 +367,79 @@
</span><span class="cx">         assert(threw);
</span><span class="cx">     }
</span><span class="cx"> }
</span><ins>+
+{
+    let e1 = null;
+    let e2 = null;
+    let t1 = {};
+    let called1 = false;
+    let h1 = {
+        has: function(theTarget, propName) {
+            called1 = true;
+            e1 = new Error;
+            throw e1;
+            return false;
+        }
+    };
+    let p1 = new Proxy(t1, h1);
+
+    let t2 = {};
+    t2.__proto__ = p1;
+    let h2 = {
+        has: function(theTarget, propName) {
+            e2 = new Error;
+            throw e2;
+            return false;
+        }
+    };
+    let p2 = new Proxy(t2, h2);
+    for (let i = 0; i &lt; 500; i++) {
+        let threw = false;
+        try {
+            10 in p2;
+        } catch(e) {
+            assert(e === e2);
+            threw = true;
+        }
+        assert(threw);
+        assert(!called1);
+    }
+}
+
+{
+    let e1 = null;
+    let e2 = null;
+    let t1 = {};
+    let called1 = false;
+    let h1 = {
+        has: function(theTarget, propName) {
+            called1 = true;
+            e1 = new Error;
+            throw e1;
+            return false;
+        }
+    };
+    let p1 = new Proxy(t1, h1);
+
+    let t2 = {};
+    t2.__proto__ = p1;
+    let h2 = {
+        has: function(theTarget, propName) {
+            e2 = new Error;
+            throw e2;
+            return false;
+        }
+    };
+    let p2 = new Proxy(t2, h2);
+    for (let i = 0; i &lt; 500; i++) {
+        let threw = false;
+        try {
+            &quot;foo&quot; in p2;
+        } catch(e) {
+            assert(e === e2);
+            threw = true;
+        }
+        assert(threw);
+        assert(!called1);
+    }
+}
</ins></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/ChangeLog        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -1,3 +1,154 @@
</span><ins>+2016-03-06  Saam Barati  &lt;sbarati@apple.com&gt;
+
+        [[GetPrototypeOf]] should be a fully virtual method in the method table
+        https://bugs.webkit.org/show_bug.cgi?id=155002
+
+        Reviewed by Filip Pizlo.
+
+        Change ::getPrototype(.) to ::prototype(.) in various places to prevent
+        a naming conflict with JSC.
+
+        No new tests because no new functionality was added.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::initializeProperties):
+        (WebCore::JSImageConstructor::prototypeForStructure):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        (GenerateConstructorHelperMethods):
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:
+        (WebCore::JSTestActiveDOMObjectConstructor::initializeProperties):
+        (WebCore::JSTestActiveDOMObject::createPrototype):
+        (WebCore::JSTestActiveDOMObject::prototype):
+        (WebCore::JSTestActiveDOMObject::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestActiveDOMObject.h:
+        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp:
+        (WebCore::JSTestClassWithJSBuiltinConstructorConstructor::initializeProperties):
+        (WebCore::JSTestClassWithJSBuiltinConstructor::createPrototype):
+        (WebCore::JSTestClassWithJSBuiltinConstructor::prototype):
+        (WebCore::JSTestClassWithJSBuiltinConstructor::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h:
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObjectConstructor::initializeProperties):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::createPrototype):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::prototype):
+        (WebCore::JSTestCustomConstructorWithNoInterfaceObject::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:
+        (WebCore::JSTestCustomNamedGetterConstructor::initializeProperties):
+        (WebCore::JSTestCustomNamedGetter::createPrototype):
+        (WebCore::JSTestCustomNamedGetter::prototype):
+        (WebCore::JSTestCustomNamedGetter::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
+        * bindings/scripts/test/JS/JSTestEventConstructor.cpp:
+        (WebCore::JSTestEventConstructorConstructor::initializeProperties):
+        (WebCore::JSTestEventConstructor::createPrototype):
+        (WebCore::JSTestEventConstructor::prototype):
+        (WebCore::JSTestEventConstructor::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestEventConstructor.h:
+        * bindings/scripts/test/JS/JSTestEventTarget.cpp:
+        (WebCore::JSTestEventTargetConstructor::initializeProperties):
+        (WebCore::JSTestEventTarget::createPrototype):
+        (WebCore::JSTestEventTarget::prototype):
+        (WebCore::JSTestEventTarget::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestEventTarget.h:
+        * bindings/scripts/test/JS/JSTestException.cpp:
+        (WebCore::JSTestExceptionConstructor::initializeProperties):
+        (WebCore::JSTestException::createPrototype):
+        (WebCore::JSTestException::prototype):
+        (WebCore::JSTestException::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestException.h:
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:
+        (WebCore::JSTestGenerateIsReachableConstructor::initializeProperties):
+        (WebCore::JSTestGenerateIsReachable::createPrototype):
+        (WebCore::JSTestGenerateIsReachable::prototype):
+        (WebCore::JSTestGenerateIsReachable::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
+        * bindings/scripts/test/JS/JSTestInterface.cpp:
+        (WebCore::JSTestInterfaceConstructor::initializeProperties):
+        (WebCore::JSTestInterface::createPrototype):
+        (WebCore::JSTestInterface::prototype):
+        (WebCore::JSTestInterface::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp:
+        (WebCore::JSTestJSBuiltinConstructorConstructor::initializeProperties):
+        (WebCore::JSTestJSBuiltinConstructor::createPrototype):
+        (WebCore::JSTestJSBuiltinConstructor::prototype):
+        (WebCore::JSTestJSBuiltinConstructor::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h:
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:
+        (WebCore::JSTestMediaQueryListListenerConstructor::initializeProperties):
+        (WebCore::JSTestMediaQueryListListener::createPrototype):
+        (WebCore::JSTestMediaQueryListListener::prototype):
+        (WebCore::JSTestMediaQueryListListener::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
+        * bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
+        (WebCore::JSTestNamedConstructorConstructor::initializeProperties):
+        (WebCore::JSTestNamedConstructorNamedConstructor::initializeProperties):
+        (WebCore::JSTestNamedConstructor::createPrototype):
+        (WebCore::JSTestNamedConstructor::prototype):
+        (WebCore::JSTestNamedConstructor::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestNamedConstructor.h:
+        * bindings/scripts/test/JS/JSTestNode.cpp:
+        (WebCore::JSTestNodeConstructor::initializeProperties):
+        (WebCore::JSTestNode::createPrototype):
+        (WebCore::JSTestNode::prototype):
+        (WebCore::JSTestNode::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestNode.h:
+        * bindings/scripts/test/JS/JSTestNondeterministic.cpp:
+        (WebCore::JSTestNondeterministicConstructor::initializeProperties):
+        (WebCore::JSTestNondeterministic::createPrototype):
+        (WebCore::JSTestNondeterministic::prototype):
+        (WebCore::JSTestNondeterministic::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestNondeterministic.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::JSTestObjConstructor::initializeProperties):
+        (WebCore::JSTestObj::createPrototype):
+        (WebCore::JSTestObj::prototype):
+        (WebCore::JSTestObj::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestObj.h:
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:
+        (WebCore::JSTestOverloadedConstructorsConstructor::initializeProperties):
+        (WebCore::JSTestOverloadedConstructors::createPrototype):
+        (WebCore::JSTestOverloadedConstructors::prototype):
+        (WebCore::JSTestOverloadedConstructors::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:
+        (WebCore::JSTestOverrideBuiltinsConstructor::initializeProperties):
+        (WebCore::JSTestOverrideBuiltins::createPrototype):
+        (WebCore::JSTestOverrideBuiltins::prototype):
+        (WebCore::JSTestOverrideBuiltins::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:
+        (WebCore::JSTestSerializedScriptValueInterfaceConstructor::initializeProperties):
+        (WebCore::JSTestSerializedScriptValueInterface::createPrototype):
+        (WebCore::JSTestSerializedScriptValueInterface::prototype):
+        (WebCore::JSTestSerializedScriptValueInterface::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
+        * bindings/scripts/test/JS/JSTestTypedefs.cpp:
+        (WebCore::JSTestTypedefsConstructor::initializeProperties):
+        (WebCore::JSTestTypedefs::createPrototype):
+        (WebCore::JSTestTypedefs::prototype):
+        (WebCore::JSTestTypedefs::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSTestTypedefs.h:
+        * bindings/scripts/test/JS/JSattribute.cpp:
+        (WebCore::JSattributeConstructor::initializeProperties):
+        (WebCore::JSattribute::createPrototype):
+        (WebCore::JSattribute::prototype):
+        (WebCore::JSattribute::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSattribute.h:
+        * bindings/scripts/test/JS/JSreadonly.cpp:
+        (WebCore::JSreadonlyConstructor::initializeProperties):
+        (WebCore::JSreadonly::createPrototype):
+        (WebCore::JSreadonly::prototype):
+        (WebCore::JSreadonly::getPrototype): Deleted.
+        * bindings/scripts/test/JS/JSreadonly.h:
+
</ins><span class="cx"> 2016-03-06  Youenn Fablet  &lt;youenn.fablet@crf.canon.fr&gt;
</span><span class="cx"> 
</span><span class="cx">         Enable DOM class create functions to take parameters in case of JSBuiltinConstructor
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowBasecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowBase.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -309,7 +309,7 @@
</span><span class="cx">             return jsCast&lt;JSDOMWindow*&gt;(object);
</span><span class="cx">         if (classInfo == JSDOMWindowShell::info())
</span><span class="cx">             return jsCast&lt;JSDOMWindowShell*&gt;(object)-&gt;window();
</span><del>-        value = object-&gt;prototype();
</del><ins>+        value = object-&gt;getPrototypeDirect();
</ins><span class="cx">     }
</span><span class="cx">     return 0;
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -169,7 +169,7 @@
</span><span class="cx">     // FIXME: This seems like a silly idea. It only serves to suppress named property access
</span><span class="cx">     // to frames that happen to have names corresponding to properties on the prototype.
</span><span class="cx">     // This seems to only serve to leak some information cross-origin.
</span><del>-    JSValue proto = thisObject-&gt;prototype();
</del><ins>+    JSValue proto = thisObject-&gt;getPrototypeDirect();
</ins><span class="cx">     if (proto.isObject() &amp;&amp; asObject(proto)-&gt;getPropertySlot(exec, propertyName, slot)) {
</span><span class="cx">         thisObject-&gt;printErrorMessage(errorMessage);
</span><span class="cx">         slot.setUndefined();
</span><span class="lines">@@ -192,7 +192,7 @@
</span><span class="cx"> 
</span><span class="cx"> static bool jsDOMWindowGetOwnPropertySlotNamedItemGetter(JSDOMWindow* thisObject, Frame&amp; frame, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
</span><span class="cx"> {
</span><del>-    JSValue proto = thisObject-&gt;prototype();
</del><ins>+    JSValue proto = thisObject-&gt;getPrototypeDirect();
</ins><span class="cx">     if (proto.isObject() &amp;&amp; asObject(proto)-&gt;hasProperty(exec, propertyName))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSDOMWindowShellcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -85,7 +85,7 @@
</span><span class="cx">     Structure* structure = JSDOMWindow::createStructure(vm, 0, prototype.get());
</span><span class="cx">     JSDOMWindow* jsDOMWindow = JSDOMWindow::create(vm, structure, *domWindow, this);
</span><span class="cx">     prototype-&gt;structure()-&gt;setGlobalObject(vm, jsDOMWindow);
</span><del>-    prototype-&gt;structure()-&gt;setPrototypeWithoutTransition(vm, JSEventTarget::getPrototype(vm, jsDOMWindow));
</del><ins>+    prototype-&gt;structure()-&gt;setPrototypeWithoutTransition(vm, JSEventTarget::prototype(vm, jsDOMWindow));
</ins><span class="cx">     setWindow(vm, jsDOMWindow);
</span><span class="cx">     ASSERT(jsDOMWindow-&gt;globalObject() == jsDOMWindow);
</span><span class="cx">     ASSERT(prototype-&gt;globalObject() == jsDOMWindow);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSImageConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSImageConstructor.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSImageConstructor.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/js/JSImageConstructor.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSImageConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSHTMLImageElement::getPrototype(vm, &amp;globalObject), None);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSHTMLImageElement::prototype(vm, &amp;globalObject), None);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; JSValue JSImageConstructor::prototypeForStructure(VM&amp; vm, const JSDOMGlobalObject&amp; globalObject)
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSPluginElementFunctionsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/js/JSPluginElementFunctions.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -50,7 +50,7 @@
</span><span class="cx">             if (Type::hasStaticPropertyTable &amp;&amp; JSC::getStaticValueSlot&lt;Type, Base&gt;(exec, *Type::info()-&gt;staticPropHashTable, element, propertyName, slot))
</span><span class="cx">                 return true;
</span><span class="cx"> 
</span><del>-            JSC::JSValue proto = element-&gt;prototype();
</del><ins>+            JSC::JSValue proto = element-&gt;getPrototypeDirect();
</ins><span class="cx">             if (proto.isObject() &amp;&amp; JSC::jsCast&lt;JSC::JSObject*&gt;(asObject(proto))-&gt;hasProperty(exec, propertyName))
</span><span class="cx">                 return false;
</span><span class="cx">         }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsJSStorageCustomcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/JSStorageCustom.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/JSStorageCustom.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/js/JSStorageCustom.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -61,7 +61,7 @@
</span><span class="cx"> 
</span><span class="cx">     static_assert(!hasStaticPropertyTable, &quot;This function does not handle static instance properties&quot;);
</span><span class="cx"> 
</span><del>-    JSValue prototype = thisObject-&gt;prototype();
</del><ins>+    JSValue prototype = thisObject-&gt;getPrototypeDirect();
</ins><span class="cx">     if (prototype.isObject() &amp;&amp; asObject(prototype)-&gt;getPropertySlot(exec, propertyName, slot))
</span><span class="cx">         return Base::deleteProperty(thisObject, exec, propertyName);
</span><span class="cx"> 
</span><span class="lines">@@ -106,7 +106,7 @@
</span><span class="cx">     PropertySlot slot(this, PropertySlot::InternalMethodType::GetOwnProperty);
</span><span class="cx">     static_assert(!hasStaticPropertyTable, &quot;This function does not handle static instance properties&quot;);
</span><span class="cx"> 
</span><del>-    JSValue prototype = this-&gt;prototype();
</del><ins>+    JSValue prototype = this-&gt;getPrototypeDirect();
</ins><span class="cx">     if (prototype.isObject() &amp;&amp; asObject(prototype)-&gt;getPropertySlot(exec, propertyName, slot))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsjsWorkerScriptControllercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -95,11 +95,11 @@
</span><span class="cx">         ASSERT(structure-&gt;globalObject() == m_workerGlobalScopeWrapper);
</span><span class="cx">         ASSERT(m_workerGlobalScopeWrapper-&gt;structure()-&gt;globalObject() == m_workerGlobalScopeWrapper);
</span><span class="cx">         workerGlobalScopePrototype-&gt;structure()-&gt;setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
</span><del>-        workerGlobalScopePrototype-&gt;structure()-&gt;setPrototypeWithoutTransition(*m_vm, JSEventTarget::getPrototype(*m_vm, m_workerGlobalScopeWrapper.get()));
</del><ins>+        workerGlobalScopePrototype-&gt;structure()-&gt;setPrototypeWithoutTransition(*m_vm, JSEventTarget::prototype(*m_vm, m_workerGlobalScopeWrapper.get()));
</ins><span class="cx">         dedicatedContextPrototype-&gt;structure()-&gt;setGlobalObject(*m_vm, m_workerGlobalScopeWrapper.get());
</span><span class="cx">     }
</span><span class="cx">     ASSERT(m_workerGlobalScopeWrapper-&gt;globalObject() == m_workerGlobalScopeWrapper);
</span><del>-    ASSERT(asObject(m_workerGlobalScopeWrapper-&gt;prototype())-&gt;globalObject() == m_workerGlobalScopeWrapper);
</del><ins>+    ASSERT(asObject(m_workerGlobalScopeWrapper-&gt;getPrototypeDirect())-&gt;globalObject() == m_workerGlobalScopeWrapper);
</ins><span class="cx"> 
</span><span class="cx">     m_consoleClient = std::make_unique&lt;WorkerConsoleClient&gt;(*m_workerGlobalScope);
</span><span class="cx">     m_workerGlobalScopeWrapper-&gt;setConsoleClient(m_consoleClient.get());
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptsCodeGeneratorJSpm"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -408,7 +408,7 @@
</span><span class="cx">     # https://heycam.github.io/webidl/#dfn-named-property-visibility
</span><span class="cx">     # https://heycam.github.io/webidl/#dfn-named-properties-object
</span><span class="cx">     my $prototypeCheck = sub {
</span><del>-        push(@getOwnPropertySlotImpl, &quot;    ${namespaceMaybe}JSValue proto = thisObject-&gt;prototype();\n&quot;);
</del><ins>+        push(@getOwnPropertySlotImpl, &quot;    ${namespaceMaybe}JSValue proto = thisObject-&gt;getPrototypeDirect();\n&quot;);
</ins><span class="cx">         push(@getOwnPropertySlotImpl, &quot;    if (proto.isObject() &amp;&amp; jsCast&lt;${namespaceMaybe}JSObject*&gt;(proto)-&gt;hasProperty(state, propertyName))\n&quot;);
</span><span class="cx">         push(@getOwnPropertySlotImpl, &quot;        return false;\n\n&quot;);
</span><span class="cx">     };
</span><span class="lines">@@ -981,7 +981,7 @@
</span><span class="cx">     # Prototype
</span><span class="cx">     unless (IsDOMGlobalObject($interface)) {
</span><span class="cx">         push(@headerContent, &quot;    static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);\n&quot;);
</span><del>-        push(@headerContent, &quot;    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);\n&quot;);
</del><ins>+        push(@headerContent, &quot;    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);\n&quot;);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     # JSValue to implementation type
</span><span class="lines">@@ -2195,14 +2195,14 @@
</span><span class="cx">         push(@implContent, &quot;JSObject* ${className}::createPrototype(VM&amp; vm, JSGlobalObject* globalObject)\n&quot;);
</span><span class="cx">         push(@implContent, &quot;{\n&quot;);
</span><span class="cx">         if ($hasParent &amp;&amp; $parentClassName ne &quot;JSC::DOMNodeFilter&quot;) {
</span><del>-            push(@implContent, &quot;    return ${className}Prototype::create(vm, globalObject, ${className}Prototype::createStructure(vm, globalObject, ${parentClassName}::getPrototype(vm, globalObject)));\n&quot;);
</del><ins>+            push(@implContent, &quot;    return ${className}Prototype::create(vm, globalObject, ${className}Prototype::createStructure(vm, globalObject, ${parentClassName}::prototype(vm, globalObject)));\n&quot;);
</ins><span class="cx">         } else {
</span><span class="cx">             my $prototype = $interface-&gt;isException ? &quot;errorPrototype&quot; : &quot;objectPrototype&quot;;
</span><span class="cx">             push(@implContent, &quot;    return ${className}Prototype::create(vm, globalObject, ${className}Prototype::createStructure(vm, globalObject, globalObject-&gt;${prototype}()));\n&quot;);
</span><span class="cx">         }
</span><span class="cx">         push(@implContent, &quot;}\n\n&quot;);
</span><span class="cx"> 
</span><del>-        push(@implContent, &quot;JSObject* ${className}::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)\n&quot;);
</del><ins>+        push(@implContent, &quot;JSObject* ${className}::prototype(VM&amp; vm, JSGlobalObject* globalObject)\n&quot;);
</ins><span class="cx">         push(@implContent, &quot;{\n&quot;);
</span><span class="cx">         push(@implContent, &quot;    return getDOMPrototype&lt;${className}&gt;(vm, globalObject);\n&quot;);
</span><span class="cx">         push(@implContent, &quot;}\n\n&quot;);
</span><span class="lines">@@ -2333,7 +2333,7 @@
</span><span class="cx">                 } elsif (InterfaceRequiresAttributesOnInstanceForCompatibility($interface)) {
</span><span class="cx">                     # Fallback to trying to searching the prototype chain for compatibility reasons.
</span><span class="cx">                     push(@implContent, &quot;        JSObject* thisObject = JSValue::decode(thisValue).getObject();\n&quot;);
</span><del>-                    push(@implContent, &quot;        for (thisObject = thisObject ? thisObject-&gt;prototype().getObject() : nullptr; thisObject; thisObject = thisObject-&gt;prototype().getObject()) {\n&quot;);
</del><ins>+                    push(@implContent, &quot;        for (thisObject = thisObject ? thisObject-&gt;getPrototypeDirect().getObject() : nullptr; thisObject; thisObject = thisObject-&gt;getPrototypeDirect().getObject()) {\n&quot;);
</ins><span class="cx">                     push(@implContent, &quot;            if ((castedThis = &quot; . GetCastingHelperForThisObject($interface) . &quot;(thisObject)))\n&quot;);
</span><span class="cx">                     push(@implContent, &quot;                break;\n&quot;);
</span><span class="cx">                     push(@implContent, &quot;        }\n&quot;);
</span><span class="lines">@@ -2636,7 +2636,7 @@
</span><span class="cx">                 } elsif (InterfaceRequiresAttributesOnInstanceForCompatibility($interface)) {
</span><span class="cx">                     # Fallback to trying to searching the prototype chain for compatibility reasons.
</span><span class="cx">                     push(@implContent, &quot;        JSObject* thisObject = JSValue::decode(thisValue).getObject();\n&quot;);
</span><del>-                    push(@implContent, &quot;        for (thisObject = thisObject ? thisObject-&gt;prototype().getObject() : nullptr; thisObject; thisObject = thisObject-&gt;prototype().getObject()) {\n&quot;);
</del><ins>+                    push(@implContent, &quot;        for (thisObject = thisObject ? thisObject-&gt;getPrototypeDirect().getObject() : nullptr; thisObject; thisObject = thisObject-&gt;getPrototypeDirect().getObject()) {\n&quot;);
</ins><span class="cx">                     push(@implContent, &quot;            if ((castedThis = &quot; . GetCastingHelperForThisObject($interface) . &quot;(thisObject)))\n&quot;);
</span><span class="cx">                     push(@implContent, &quot;                break;\n&quot;);
</span><span class="cx">                     push(@implContent, &quot;        }\n&quot;);
</span><span class="lines">@@ -5027,11 +5027,11 @@
</span><span class="cx">     # of whether the interface was declared with the [NoInterfaceObject] extended attribute.
</span><span class="cx">     # https://heycam.github.io/webidl/#interface-prototype-object
</span><span class="cx">     if (IsDOMGlobalObject($interface)) {
</span><del>-        push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;prototype, globalObject.prototype(), DontDelete | ReadOnly | DontEnum);\n&quot;);
</del><ins>+        push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;prototype, globalObject.getPrototypeDirect(), DontDelete | ReadOnly | DontEnum);\n&quot;);
</ins><span class="cx">     } elsif ($interface-&gt;isCallback) {
</span><span class="cx">         push(@$outputArray, &quot;    UNUSED_PARAM(globalObject);\n&quot;);
</span><span class="cx">     } else {
</span><del>-        push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;prototype, ${className}::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);\n&quot;);
</del><ins>+        push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;prototype, ${className}::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);\n&quot;);
</ins><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     push(@$outputArray, &quot;    putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(\&quot;$visibleInterfaceName\&quot;))), ReadOnly | DontEnum);\n&quot;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -93,7 +93,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestActiveDOMObjectConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestActiveDOMObject::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestActiveDOMObject::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestActiveDOMObject&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -129,7 +129,7 @@
</span><span class="cx">     return JSTestActiveDOMObjectPrototype::create(vm, globalObject, JSTestActiveDOMObjectPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestActiveDOMObject::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestActiveDOMObject::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestActiveDOMObject&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestActiveDOMObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = true;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestActiveDOMObject* toWrapped(JSC::JSValue);
</span><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -71,7 +71,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestClassWithJSBuiltinConstructorConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestClassWithJSBuiltinConstructor::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestClassWithJSBuiltinConstructor::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestClassWithJSBuiltinConstructor&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -110,7 +110,7 @@
</span><span class="cx">     return JSTestClassWithJSBuiltinConstructorPrototype::create(vm, globalObject, JSTestClassWithJSBuiltinConstructorPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestClassWithJSBuiltinConstructor::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestClassWithJSBuiltinConstructor::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestClassWithJSBuiltinConstructor&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestClassWithJSBuiltinConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestClassWithJSBuiltinConstructor* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -75,7 +75,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestCustomConstructorWithNoInterfaceObjectConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestCustomConstructorWithNoInterfaceObject::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestCustomConstructorWithNoInterfaceObject::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestCustomConstructorWithNoInterfaceObject&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -109,7 +109,7 @@
</span><span class="cx">     return JSTestCustomConstructorWithNoInterfaceObjectPrototype::create(vm, globalObject, JSTestCustomConstructorWithNoInterfaceObjectPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestCustomConstructorWithNoInterfaceObject::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestCustomConstructorWithNoInterfaceObject::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestCustomConstructorWithNoInterfaceObject&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomConstructorWithNoInterfaceObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestCustomConstructorWithNoInterfaceObject* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGettercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestCustomNamedGetterConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestCustomNamedGetter::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestCustomNamedGetter::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestCustomNamedGetter&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -112,7 +112,7 @@
</span><span class="cx">     return JSTestCustomNamedGetterPrototype::create(vm, globalObject, JSTestCustomNamedGetterPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestCustomNamedGetter::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestCustomNamedGetter::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestCustomNamedGetter&gt;(vm, globalObject);
</span><span class="cx"> }
</span><span class="lines">@@ -129,7 +129,7 @@
</span><span class="cx">     ASSERT_GC_OBJECT_INHERITS(thisObject, info());
</span><span class="cx">     if (Base::getOwnPropertySlot(thisObject, state, propertyName, slot))
</span><span class="cx">         return true;
</span><del>-    JSValue proto = thisObject-&gt;prototype();
</del><ins>+    JSValue proto = thisObject-&gt;getPrototypeDirect();
</ins><span class="cx">     if (proto.isObject() &amp;&amp; jsCast&lt;JSObject*&gt;(proto)-&gt;hasProperty(state, propertyName))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestCustomNamedGetterh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestCustomNamedGetter* toWrapped(JSC::JSValue);
</span><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -116,7 +116,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestEventConstructorConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestEventConstructor::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestEventConstructor::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestEventConstructor&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -152,7 +152,7 @@
</span><span class="cx">     return JSTestEventConstructorPrototype::create(vm, globalObject, JSTestEventConstructorPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestEventConstructor::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestEventConstructor::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestEventConstructor&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventConstructor.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestEventConstructor* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargetcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -78,7 +78,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestEventTargetConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestEventTarget::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestEventTarget::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestEventTarget&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -110,10 +110,10 @@
</span><span class="cx"> 
</span><span class="cx"> JSObject* JSTestEventTarget::createPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</span><span class="cx"> {
</span><del>-    return JSTestEventTargetPrototype::create(vm, globalObject, JSTestEventTargetPrototype::createStructure(vm, globalObject, JSEventTarget::getPrototype(vm, globalObject)));
</del><ins>+    return JSTestEventTargetPrototype::create(vm, globalObject, JSTestEventTargetPrototype::createStructure(vm, globalObject, JSEventTarget::prototype(vm, globalObject)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestEventTarget::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestEventTarget::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestEventTarget&gt;(vm, globalObject);
</span><span class="cx"> }
</span><span class="lines">@@ -131,7 +131,7 @@
</span><span class="cx">     }
</span><span class="cx">     if (Base::getOwnPropertySlot(thisObject, state, propertyName, slot))
</span><span class="cx">         return true;
</span><del>-    JSValue proto = thisObject-&gt;prototype();
</del><ins>+    JSValue proto = thisObject-&gt;getPrototypeDirect();
</ins><span class="cx">     if (proto.isObject() &amp;&amp; jsCast&lt;JSObject*&gt;(proto)-&gt;hasProperty(state, propertyName))
</span><span class="cx">         return false;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestEventTargeth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestEventTarget.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestEventTarget* toWrapped(JSC::JSValue);
</span><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptioncpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -87,7 +87,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestExceptionConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestException::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestException::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestException&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -121,7 +121,7 @@
</span><span class="cx">     return JSTestExceptionPrototype::create(vm, globalObject, JSTestExceptionPrototype::createStructure(vm, globalObject, globalObject-&gt;errorPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestException::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestException::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestException&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestExceptionh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = true;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestException* toWrapped(JSC::JSValue);
</span><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachablecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestGenerateIsReachableConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestGenerateIsReachable::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestGenerateIsReachable::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestGenerateIsReachable&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -104,7 +104,7 @@
</span><span class="cx">     return JSTestGenerateIsReachablePrototype::create(vm, globalObject, JSTestGenerateIsReachablePrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestGenerateIsReachable::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestGenerateIsReachable::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestGenerateIsReachable&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestGenerateIsReachableh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestGenerateIsReachable* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -253,7 +253,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestInterfaceConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestInterface::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestInterface::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestInterface&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum);
</span><span class="cx">     reifyStaticProperties(vm, JSTestInterfaceConstructorTableValues, *this);
</span><span class="lines">@@ -399,7 +399,7 @@
</span><span class="cx">     return JSTestInterfacePrototype::create(vm, globalObject, JSTestInterfacePrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestInterface::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestInterface::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestInterface&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestInterfaceh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestInterface* toWrapped(JSC::JSValue);
</span><span class="cx">     static void put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&amp;);
</span><span class="cx">     static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestJSBuiltinConstructorConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestJSBuiltinConstructor::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestJSBuiltinConstructor::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestJSBuiltinConstructor&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -121,7 +121,7 @@
</span><span class="cx">     return JSTestJSBuiltinConstructorPrototype::create(vm, globalObject, JSTestJSBuiltinConstructorPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestJSBuiltinConstructor::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestJSBuiltinConstructor::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestJSBuiltinConstructor&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestJSBuiltinConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestJSBuiltinConstructor.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenercpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -77,7 +77,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestMediaQueryListListenerConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestMediaQueryListListener::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestMediaQueryListListener::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestMediaQueryListListener&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -112,7 +112,7 @@
</span><span class="cx">     return JSTestMediaQueryListListenerPrototype::create(vm, globalObject, JSTestMediaQueryListListenerPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestMediaQueryListListener::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestMediaQueryListListener::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestMediaQueryListListener&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestMediaQueryListListenerh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestMediaQueryListListener* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestNamedConstructorConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNamedConstructor::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNamedConstructor::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestNamedConstructor&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -111,7 +111,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestNamedConstructorNamedConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNamedConstructor::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNamedConstructor::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;Audio&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -145,7 +145,7 @@
</span><span class="cx">     return JSTestNamedConstructorPrototype::create(vm, globalObject, JSTestNamedConstructorPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestNamedConstructor::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestNamedConstructor::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestNamedConstructor&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNamedConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestNamedConstructor* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNodecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -81,7 +81,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestNodeConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNode::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNode::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestNode&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -113,10 +113,10 @@
</span><span class="cx"> 
</span><span class="cx"> JSObject* JSTestNode::createPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</span><span class="cx"> {
</span><del>-    return JSTestNodePrototype::create(vm, globalObject, JSTestNodePrototype::createStructure(vm, globalObject, JSNode::getPrototype(vm, globalObject)));
</del><ins>+    return JSTestNodePrototype::create(vm, globalObject, JSTestNodePrototype::createStructure(vm, globalObject, JSNode::prototype(vm, globalObject)));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestNode::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestNode::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestNode&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNodeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNode.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -39,7 +39,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNondeterministiccpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -93,7 +93,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestNondeterministicConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNondeterministic::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestNondeterministic::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestNondeterministic&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -133,7 +133,7 @@
</span><span class="cx">     return JSTestNondeterministicPrototype::create(vm, globalObject, JSTestNondeterministicPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestNondeterministic::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestNondeterministic::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestNondeterministic&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestNondeterministich"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNondeterministic.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestNondeterministic* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -505,7 +505,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestObjConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestObj::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestObj::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestObject&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(2), ReadOnly | DontEnum);
</span><span class="cx">     reifyStaticProperties(vm, JSTestObjConstructorTableValues, *this);
</span><span class="lines">@@ -762,7 +762,7 @@
</span><span class="cx">     return JSTestObjPrototype::create(vm, globalObject, JSTestObjPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestObj::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestObj::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestObj&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestObjh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = true;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestObj* toWrapped(JSC::JSValue);
</span><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -150,7 +150,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestOverloadedConstructorsConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestOverloadedConstructors::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestOverloadedConstructors::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestOverloadedConstructors&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -184,7 +184,7 @@
</span><span class="cx">     return JSTestOverloadedConstructorsPrototype::create(vm, globalObject, JSTestOverloadedConstructorsPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestOverloadedConstructors::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestOverloadedConstructors::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestOverloadedConstructors&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverloadedConstructorsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestOverloadedConstructors* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -79,7 +79,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestOverrideBuiltinsConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestOverrideBuiltins::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestOverrideBuiltins::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestOverrideBuiltins&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -114,7 +114,7 @@
</span><span class="cx">     return JSTestOverrideBuiltinsPrototype::create(vm, globalObject, JSTestOverrideBuiltinsPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestOverrideBuiltins::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestOverrideBuiltins::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestOverrideBuiltins&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestOverrideBuiltinsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestOverrideBuiltins* toWrapped(JSC::JSValue);
</span><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
</span><span class="cx">     static bool getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&amp;);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfacecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -84,7 +84,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestSerializedScriptValueInterfaceConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestSerializedScriptValueInterface::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestSerializedScriptValueInterface::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestSerializedScriptValueInterface&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -123,7 +123,7 @@
</span><span class="cx">     return JSTestSerializedScriptValueInterfacePrototype::create(vm, globalObject, JSTestSerializedScriptValueInterfacePrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestSerializedScriptValueInterface::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestSerializedScriptValueInterface::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestSerializedScriptValueInterface&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestSerializedScriptValueInterfaceh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -42,7 +42,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestSerializedScriptValueInterface* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestTypedefscpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -146,7 +146,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSTestTypedefsConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestTypedefs::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSTestTypedefs::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;TestTypedefs&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(2), ReadOnly | DontEnum);
</span><span class="cx">     reifyStaticProperties(vm, JSTestTypedefsConstructorTableValues, *this);
</span><span class="lines">@@ -197,7 +197,7 @@
</span><span class="cx">     return JSTestTypedefsPrototype::create(vm, globalObject, JSTestTypedefsPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSTestTypedefs::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSTestTypedefs::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSTestTypedefs&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSTestTypedefsh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = true;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static TestTypedefs* toWrapped(JSC::JSValue);
</span><span class="cx">     static bool getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&amp;);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSattributecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -73,7 +73,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSattributeConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSattribute::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSattribute::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;attribute&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -108,7 +108,7 @@
</span><span class="cx">     return JSattributePrototype::create(vm, globalObject, JSattributePrototype::createStructure(vm, globalObject, globalObject-&gt;errorPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSattribute::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSattribute::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSattribute&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSattributeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSattribute.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -41,7 +41,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static attribute* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSreadonlycpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.cpp        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -70,7 +70,7 @@
</span><span class="cx"> 
</span><span class="cx"> template&lt;&gt; void JSreadonlyConstructor::initializeProperties(VM&amp; vm, JSDOMGlobalObject&amp; globalObject)
</span><span class="cx"> {
</span><del>-    putDirect(vm, vm.propertyNames-&gt;prototype, JSreadonly::getPrototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</del><ins>+    putDirect(vm, vm.propertyNames-&gt;prototype, JSreadonly::prototype(vm, &amp;globalObject), DontDelete | ReadOnly | DontEnum);
</ins><span class="cx">     putDirect(vm, vm.propertyNames-&gt;name, jsNontrivialString(&amp;vm, String(ASCIILiteral(&quot;readonly&quot;))), ReadOnly | DontEnum);
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;length, jsNumber(0), ReadOnly | DontEnum);
</span><span class="cx"> }
</span><span class="lines">@@ -104,7 +104,7 @@
</span><span class="cx">     return JSreadonlyPrototype::create(vm, globalObject, JSreadonlyPrototype::createStructure(vm, globalObject, globalObject-&gt;objectPrototype()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-JSObject* JSreadonly::getPrototype(VM&amp; vm, JSGlobalObject* globalObject)
</del><ins>+JSObject* JSreadonly::prototype(VM&amp; vm, JSGlobalObject* globalObject)
</ins><span class="cx"> {
</span><span class="cx">     return getDOMPrototype&lt;JSreadonly&gt;(vm, globalObject);
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceWebCorebindingsscriptstestJSJSreadonlyh"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.h (197647 => 197648)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.h        2016-03-06 23:40:42 UTC (rev 197647)
+++ trunk/Source/WebCore/bindings/scripts/test/JS/JSreadonly.h        2016-03-07 01:00:33 UTC (rev 197648)
</span><span class="lines">@@ -40,7 +40,7 @@
</span><span class="cx">     static const bool hasStaticPropertyTable = false;
</span><span class="cx"> 
</span><span class="cx">     static JSC::JSObject* createPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</span><del>-    static JSC::JSObject* getPrototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</del><ins>+    static JSC::JSObject* prototype(JSC::VM&amp;, JSC::JSGlobalObject*);
</ins><span class="cx">     static readonly* toWrapped(JSC::JSValue);
</span><span class="cx">     static void destroy(JSC::JSCell*);
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>