<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[201448] trunk/Source/JavaScriptCore</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/201448">201448</a></dd>
<dt>Author</dt> <dd>barraclough@apple.com</dd>
<dt>Date</dt> <dd>2016-05-27 00:09:35 -0700 (Fri, 27 May 2016)</dd>
</dl>

<h3>Log Message</h3>
<pre>Static table property lookup should not require getOwnPropertySlot override.
https://bugs.webkit.org/show_bug.cgi?id=158059

Reviewed by Darin Adler.

Currently JSObject does not handle property lookup of entries in the static
table. Each subclass with static properties mut override getOwnPropertySlot,
and explicitly call the lookup functions. This has the following drawbacks:

- Performance: for any class with static properties, property acces becomes
  virtual (via method table).
- Poor encapsulation: implementation detail of static property access is
  spread throughout &amp; cross projects, rather than being contained in JSObject.
- Code size: this results in a great many additional functions.
- Inconsistency: static table presence has to be be taken into account in many
  other operations, e.g. presence of read-only properties for put.
- Memory: in order to avoid the virtual lookup, DOM prototypes eagerly reify
  all properties. This is likely suboptimal.

Instead, JSObject::getPropertySlot / JSObject::getOwnPropertySlot should be
able to handle static properties.

This is actually a fairly small &amp; simple change.

The common pattern is for subclasses of JObject to override getOwnPropertySlot
to first defer to JSObject for property storage lookup, and only if this fails
consult the static table. They just want the static tables to be consulted after
regular property storgae lookup. So just add a fast flag in TypeInfo for JSObject
to check, and where it is set, do so. Then it's just a question of switching
classes over to start setting this flag, and drop the override.

The new mechanism does change static table lookup order from oldest-ancestor
first to most-derived first. The new ordering makes more sense (means derived
class static tables can now override entries from parents), and shoudn't affect
any existing code (since overriding didn't previously work, there likely aren't
shadowing properties in more derived types).

This patch changes all classes in JavaScriptCore over to using the new mechanism,
except JSGlobalObject. I'll move classes in WebCore over as a separate patch
(this is also why I've not moved JSGlobalObject in this patch - doing so would
move JSDOMWindow, and I'd rather handle that separately).

* runtime/JSTypeInfo.h:
(JSC::TypeInfo::hasStaticPropertyTable):
    - Add HasStaticPropertyTable flag.
* runtime/Lookup.cpp:
(JSC::setUpStaticFunctionSlot):
    - Change setUpStaticFunctionSlot to take a VM&amp;.
* runtime/Lookup.h:
(JSC::getStaticPropertySlotFromTable):
    - Added helper function to perform static lookup alone.
(JSC::getStaticPropertySlot):
(JSC::getStaticFunctionSlot):
    - setUpStaticFunctionSlot changed to take a VM&amp;.
* runtime/JSObject.cpp:
(JSC::JSObject::getOwnStaticPropertySlot):
    - Added, walks ClassInfo chain looking for static properties.
* runtime/JSObject.h:
(JSC::JSObject::getOwnNonIndexPropertySlot):
    - getOwnNonIndexPropertySlot is used internally by getPropertySlot
      &amp; getOwnPropertySlot. If property is not present in storage array
      then check the static table.
* runtime/ArrayConstructor.cpp:
(JSC::ArrayConstructor::finishCreation):
(JSC::constructArrayWithSizeQuirk):
(JSC::ArrayConstructor::getOwnPropertySlot): Deleted.
* runtime/ArrayConstructor.h:
(JSC::ArrayConstructor::create):
* runtime/ArrayIteratorPrototype.cpp:
(JSC::ArrayIteratorPrototype::finishCreation):
(JSC::ArrayIteratorPrototype::getOwnPropertySlot): Deleted.
* runtime/ArrayIteratorPrototype.h:
(JSC::ArrayIteratorPrototype::create):
(JSC::ArrayIteratorPrototype::ArrayIteratorPrototype):
* runtime/BooleanPrototype.cpp:
(JSC::BooleanPrototype::finishCreation):
(JSC::booleanProtoFuncToString):
(JSC::BooleanPrototype::getOwnPropertySlot): Deleted.
* runtime/BooleanPrototype.h:
(JSC::BooleanPrototype::create):
* runtime/DateConstructor.cpp:
(JSC::DateConstructor::finishCreation):
(JSC::millisecondsFromComponents):
(JSC::DateConstructor::getOwnPropertySlot): Deleted.
* runtime/DateConstructor.h:
(JSC::DateConstructor::create):
* runtime/DatePrototype.cpp:
(JSC::DatePrototype::finishCreation):
(JSC::dateProtoFuncToString):
(JSC::DatePrototype::getOwnPropertySlot): Deleted.
* runtime/DatePrototype.h:
(JSC::DatePrototype::create):
* runtime/ErrorPrototype.cpp:
(JSC::ErrorPrototype::finishCreation):
(JSC::ErrorPrototype::getOwnPropertySlot): Deleted.
* runtime/ErrorPrototype.h:
(JSC::ErrorPrototype::create):
* runtime/GeneratorPrototype.cpp:
(JSC::GeneratorPrototype::finishCreation):
(JSC::GeneratorPrototype::getOwnPropertySlot): Deleted.
* runtime/GeneratorPrototype.h:
(JSC::GeneratorPrototype::create):
(JSC::GeneratorPrototype::createStructure):
(JSC::GeneratorPrototype::GeneratorPrototype):
* runtime/InspectorInstrumentationObject.cpp:
(JSC::InspectorInstrumentationObject::finishCreation):
(JSC::InspectorInstrumentationObject::isEnabled):
(JSC::InspectorInstrumentationObject::getOwnPropertySlot): Deleted.
* runtime/InspectorInstrumentationObject.h:
(JSC::InspectorInstrumentationObject::create):
(JSC::InspectorInstrumentationObject::createStructure):
* runtime/IntlCollatorConstructor.cpp:
(JSC::IntlCollatorConstructor::getCallData):
(JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
(JSC::IntlCollatorConstructor::getOwnPropertySlot): Deleted.
* runtime/IntlCollatorConstructor.h:
* runtime/IntlCollatorPrototype.cpp:
(JSC::IntlCollatorPrototype::finishCreation):
(JSC::IntlCollatorFuncCompare):
(JSC::IntlCollatorPrototype::getOwnPropertySlot): Deleted.
* runtime/IntlCollatorPrototype.h:
* runtime/IntlDateTimeFormatConstructor.cpp:
(JSC::IntlDateTimeFormatConstructor::getCallData):
(JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
(JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot): Deleted.
* runtime/IntlDateTimeFormatConstructor.h:
* runtime/IntlDateTimeFormatPrototype.cpp:
(JSC::IntlDateTimeFormatPrototype::finishCreation):
(JSC::IntlDateTimeFormatFuncFormatDateTime):
(JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot): Deleted.
* runtime/IntlDateTimeFormatPrototype.h:
* runtime/IntlNumberFormatConstructor.cpp:
(JSC::IntlNumberFormatConstructor::getCallData):
(JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
(JSC::IntlNumberFormatConstructor::getOwnPropertySlot): Deleted.
* runtime/IntlNumberFormatConstructor.h:
* runtime/IntlNumberFormatPrototype.cpp:
(JSC::IntlNumberFormatPrototype::finishCreation):
(JSC::IntlNumberFormatFuncFormatNumber):
(JSC::IntlNumberFormatPrototype::getOwnPropertySlot): Deleted.
* runtime/IntlNumberFormatPrototype.h:
* runtime/JSDataViewPrototype.cpp:
(JSC::JSDataViewPrototype::createStructure):
(JSC::getData):
(JSC::JSDataViewPrototype::getOwnPropertySlot): Deleted.
* runtime/JSDataViewPrototype.h:
* runtime/JSInternalPromiseConstructor.cpp:
(JSC::JSInternalPromiseConstructor::getCallData):
(JSC::JSInternalPromiseConstructor::getOwnPropertySlot): Deleted.
* runtime/JSInternalPromiseConstructor.h:
* runtime/JSONObject.cpp:
(JSC::Walker::Walker):
(JSC::JSONObject::getOwnPropertySlot): Deleted.
* runtime/JSONObject.h:
(JSC::JSONObject::create):
* runtime/JSPromiseConstructor.cpp:
(JSC::JSPromiseConstructor::getCallData):
(JSC::JSPromiseConstructor::getOwnPropertySlot): Deleted.
* runtime/JSPromiseConstructor.h:
* runtime/JSPromisePrototype.cpp:
(JSC::JSPromisePrototype::addOwnInternalSlots):
(JSC::JSPromisePrototype::getOwnPropertySlot): Deleted.
* runtime/JSPromisePrototype.h:
* runtime/MapPrototype.cpp:
(JSC::MapPrototype::finishCreation):
(JSC::getMap):
(JSC::MapPrototype::getOwnPropertySlot): Deleted.
* runtime/MapPrototype.h:
(JSC::MapPrototype::create):
(JSC::MapPrototype::MapPrototype):
* runtime/ModuleLoaderObject.cpp:
(JSC::ModuleLoaderObject::finishCreation):
(JSC::printableModuleKey):
(JSC::ModuleLoaderObject::getOwnPropertySlot): Deleted.
* runtime/ModuleLoaderObject.h:
* runtime/NumberPrototype.cpp:
(JSC::NumberPrototype::finishCreation):
(JSC::toThisNumber):
(JSC::NumberPrototype::getOwnPropertySlot): Deleted.
* runtime/NumberPrototype.h:
(JSC::NumberPrototype::create):
* runtime/ObjectConstructor.cpp:
(JSC::ObjectConstructor::addDefineProperty):
(JSC::constructObject):
(JSC::ObjectConstructor::getOwnPropertySlot): Deleted.
* runtime/ObjectConstructor.h:
(JSC::ObjectConstructor::create):
(JSC::ObjectConstructor::createStructure):
* runtime/ReflectObject.cpp:
(JSC::ReflectObject::finishCreation):
(JSC::ReflectObject::getOwnPropertySlot): Deleted.
* runtime/ReflectObject.h:
(JSC::ReflectObject::create):
(JSC::ReflectObject::createStructure):
* runtime/RegExpConstructor.cpp:
(JSC::RegExpConstructor::getRightContext):
(JSC::regExpConstructorDollar):
(JSC::RegExpConstructor::getOwnPropertySlot): Deleted.
* runtime/RegExpConstructor.h:
(JSC::RegExpConstructor::create):
(JSC::RegExpConstructor::createStructure):
* runtime/SetPrototype.cpp:
(JSC::SetPrototype::finishCreation):
(JSC::getSet):
(JSC::SetPrototype::getOwnPropertySlot): Deleted.
* runtime/SetPrototype.h:
(JSC::SetPrototype::create):
(JSC::SetPrototype::SetPrototype):
* runtime/StringConstructor.cpp:
(JSC::StringConstructor::finishCreation):
(JSC::stringFromCharCodeSlowCase):
(JSC::StringConstructor::getOwnPropertySlot): Deleted.
* runtime/StringConstructor.h:
(JSC::StringConstructor::create):
* runtime/StringIteratorPrototype.cpp:
(JSC::StringIteratorPrototype::finishCreation):
(JSC::StringIteratorPrototype::getOwnPropertySlot): Deleted.
* runtime/StringIteratorPrototype.h:
(JSC::StringIteratorPrototype::create):
(JSC::StringIteratorPrototype::StringIteratorPrototype):
* runtime/StringPrototype.cpp:
(JSC::StringPrototype::create):
(JSC::substituteBackreferencesSlow):
(JSC::StringPrototype::getOwnPropertySlot): Deleted.
* runtime/StringPrototype.h:
* runtime/SymbolConstructor.cpp:
(JSC::SymbolConstructor::finishCreation):
(JSC::callSymbol):
(JSC::SymbolConstructor::getOwnPropertySlot): Deleted.
* runtime/SymbolConstructor.h:
(JSC::SymbolConstructor::create):
* runtime/SymbolPrototype.cpp:
(JSC::SymbolPrototype::finishCreation):
(JSC::SymbolPrototype::getOwnPropertySlot): Deleted.
* runtime/SymbolPrototype.h:
(JSC::SymbolPrototype::create):
    - remove getOwnPropertySlot, replace OverridesGetOwnPropertySlot flag with HasStaticPropertyTable.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkSourceJavaScriptCoreChangeLog">trunk/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayConstructorcpp">trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayConstructorh">trunk/Source/JavaScriptCore/runtime/ArrayConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayIteratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeArrayIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeBooleanPrototypecpp">trunk/Source/JavaScriptCore/runtime/BooleanPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeBooleanPrototypeh">trunk/Source/JavaScriptCore/runtime/BooleanPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDateConstructorcpp">trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDateConstructorh">trunk/Source/JavaScriptCore/runtime/DateConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDatePrototypecpp">trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeDatePrototypeh">trunk/Source/JavaScriptCore/runtime/DatePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeErrorPrototypecpp">trunk/Source/JavaScriptCore/runtime/ErrorPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeErrorPrototypeh">trunk/Source/JavaScriptCore/runtime/ErrorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGeneratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeGeneratorPrototypeh">trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeInspectorInstrumentationObjectcpp">trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeInspectorInstrumentationObjecth">trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorConstructorcpp">trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorConstructorh">trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatConstructorcpp">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatConstructorh">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatConstructorcpp">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatConstructorh">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypeh">trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewPrototypecpp">trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSDataViewPrototypeh">trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSInternalPromiseConstructorcpp">trunk/Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSInternalPromiseConstructorh">trunk/Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSONObjectcpp">trunk/Source/JavaScriptCore/runtime/JSONObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSONObjecth">trunk/Source/JavaScriptCore/runtime/JSONObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjectcpp">trunk/Source/JavaScriptCore/runtime/JSObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSObjecth">trunk/Source/JavaScriptCore/runtime/JSObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseConstructorcpp">trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromiseConstructorh">trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromisePrototypecpp">trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSPromisePrototypeh">trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeJSTypeInfoh">trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeLookupcpp">trunk/Source/JavaScriptCore/runtime/Lookup.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeLookuph">trunk/Source/JavaScriptCore/runtime/Lookup.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapPrototypecpp">trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeMapPrototypeh">trunk/Source/JavaScriptCore/runtime/MapPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeModuleLoaderObjectcpp">trunk/Source/JavaScriptCore/runtime/ModuleLoaderObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeModuleLoaderObjecth">trunk/Source/JavaScriptCore/runtime/ModuleLoaderObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNumberPrototypecpp">trunk/Source/JavaScriptCore/runtime/NumberPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeNumberPrototypeh">trunk/Source/JavaScriptCore/runtime/NumberPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorcpp">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeObjectConstructorh">trunk/Source/JavaScriptCore/runtime/ObjectConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeReflectObjectcpp">trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeReflectObjecth">trunk/Source/JavaScriptCore/runtime/ReflectObject.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpConstructorcpp">trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeRegExpConstructorh">trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetPrototypecpp">trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSetPrototypeh">trunk/Source/JavaScriptCore/runtime/SetPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringConstructorcpp">trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringConstructorh">trunk/Source/JavaScriptCore/runtime/StringConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringIteratorPrototypecpp">trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringIteratorPrototypeh">trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringPrototypecpp">trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeStringPrototypeh">trunk/Source/JavaScriptCore/runtime/StringPrototype.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolConstructorcpp">trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolConstructorh">trunk/Source/JavaScriptCore/runtime/SymbolConstructor.h</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolPrototypecpp">trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp</a></li>
<li><a href="#trunkSourceJavaScriptCoreruntimeSymbolPrototypeh">trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/ChangeLog (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/ChangeLog        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/ChangeLog        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -1,3 +1,243 @@
</span><ins>+2016-05-26  Gavin &amp; Ellie Barraclough  &lt;barraclough@apple.com&gt;
+
+        Static table property lookup should not require getOwnPropertySlot override.
+        https://bugs.webkit.org/show_bug.cgi?id=158059
+
+        Reviewed by Darin Adler.
+
+        Currently JSObject does not handle property lookup of entries in the static
+        table. Each subclass with static properties mut override getOwnPropertySlot,
+        and explicitly call the lookup functions. This has the following drawbacks:
+
+        - Performance: for any class with static properties, property acces becomes
+          virtual (via method table).
+        - Poor encapsulation: implementation detail of static property access is
+          spread throughout &amp; cross projects, rather than being contained in JSObject.
+        - Code size: this results in a great many additional functions.
+        - Inconsistency: static table presence has to be be taken into account in many
+          other operations, e.g. presence of read-only properties for put.
+        - Memory: in order to avoid the virtual lookup, DOM prototypes eagerly reify
+          all properties. This is likely suboptimal.
+
+        Instead, JSObject::getPropertySlot / JSObject::getOwnPropertySlot should be
+        able to handle static properties.
+
+        This is actually a fairly small &amp; simple change.
+
+        The common pattern is for subclasses of JObject to override getOwnPropertySlot
+        to first defer to JSObject for property storage lookup, and only if this fails
+        consult the static table. They just want the static tables to be consulted after
+        regular property storgae lookup. So just add a fast flag in TypeInfo for JSObject
+        to check, and where it is set, do so. Then it's just a question of switching
+        classes over to start setting this flag, and drop the override.
+
+        The new mechanism does change static table lookup order from oldest-ancestor
+        first to most-derived first. The new ordering makes more sense (means derived
+        class static tables can now override entries from parents), and shoudn't affect
+        any existing code (since overriding didn't previously work, there likely aren't
+        shadowing properties in more derived types).
+
+        This patch changes all classes in JavaScriptCore over to using the new mechanism,
+        except JSGlobalObject. I'll move classes in WebCore over as a separate patch
+        (this is also why I've not moved JSGlobalObject in this patch - doing so would
+        move JSDOMWindow, and I'd rather handle that separately).
+
+        * runtime/JSTypeInfo.h:
+        (JSC::TypeInfo::hasStaticPropertyTable):
+            - Add HasStaticPropertyTable flag.
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+            - Change setUpStaticFunctionSlot to take a VM&amp;.
+        * runtime/Lookup.h:
+        (JSC::getStaticPropertySlotFromTable):
+            - Added helper function to perform static lookup alone.
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticFunctionSlot):
+            - setUpStaticFunctionSlot changed to take a VM&amp;.
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::getOwnStaticPropertySlot):
+            - Added, walks ClassInfo chain looking for static properties.
+        * runtime/JSObject.h:
+        (JSC::JSObject::getOwnNonIndexPropertySlot):
+            - getOwnNonIndexPropertySlot is used internally by getPropertySlot
+              &amp; getOwnPropertySlot. If property is not present in storage array
+              then check the static table.
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::finishCreation):
+        (JSC::constructArrayWithSizeQuirk):
+        (JSC::ArrayConstructor::getOwnPropertySlot): Deleted.
+        * runtime/ArrayConstructor.h:
+        (JSC::ArrayConstructor::create):
+        * runtime/ArrayIteratorPrototype.cpp:
+        (JSC::ArrayIteratorPrototype::finishCreation):
+        (JSC::ArrayIteratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/ArrayIteratorPrototype.h:
+        (JSC::ArrayIteratorPrototype::create):
+        (JSC::ArrayIteratorPrototype::ArrayIteratorPrototype):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::finishCreation):
+        (JSC::booleanProtoFuncToString):
+        (JSC::BooleanPrototype::getOwnPropertySlot): Deleted.
+        * runtime/BooleanPrototype.h:
+        (JSC::BooleanPrototype::create):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::finishCreation):
+        (JSC::millisecondsFromComponents):
+        (JSC::DateConstructor::getOwnPropertySlot): Deleted.
+        * runtime/DateConstructor.h:
+        (JSC::DateConstructor::create):
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::finishCreation):
+        (JSC::dateProtoFuncToString):
+        (JSC::DatePrototype::getOwnPropertySlot): Deleted.
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::create):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::finishCreation):
+        (JSC::ErrorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/ErrorPrototype.h:
+        (JSC::ErrorPrototype::create):
+        * runtime/GeneratorPrototype.cpp:
+        (JSC::GeneratorPrototype::finishCreation):
+        (JSC::GeneratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/GeneratorPrototype.h:
+        (JSC::GeneratorPrototype::create):
+        (JSC::GeneratorPrototype::createStructure):
+        (JSC::GeneratorPrototype::GeneratorPrototype):
+        * runtime/InspectorInstrumentationObject.cpp:
+        (JSC::InspectorInstrumentationObject::finishCreation):
+        (JSC::InspectorInstrumentationObject::isEnabled):
+        (JSC::InspectorInstrumentationObject::getOwnPropertySlot): Deleted.
+        * runtime/InspectorInstrumentationObject.h:
+        (JSC::InspectorInstrumentationObject::create):
+        (JSC::InspectorInstrumentationObject::createStructure):
+        * runtime/IntlCollatorConstructor.cpp:
+        (JSC::IntlCollatorConstructor::getCallData):
+        (JSC::IntlCollatorConstructorFuncSupportedLocalesOf):
+        (JSC::IntlCollatorConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlCollatorConstructor.h:
+        * runtime/IntlCollatorPrototype.cpp:
+        (JSC::IntlCollatorPrototype::finishCreation):
+        (JSC::IntlCollatorFuncCompare):
+        (JSC::IntlCollatorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlCollatorPrototype.h:
+        * runtime/IntlDateTimeFormatConstructor.cpp:
+        (JSC::IntlDateTimeFormatConstructor::getCallData):
+        (JSC::IntlDateTimeFormatConstructorFuncSupportedLocalesOf):
+        (JSC::IntlDateTimeFormatConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlDateTimeFormatConstructor.h:
+        * runtime/IntlDateTimeFormatPrototype.cpp:
+        (JSC::IntlDateTimeFormatPrototype::finishCreation):
+        (JSC::IntlDateTimeFormatFuncFormatDateTime):
+        (JSC::IntlDateTimeFormatPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlDateTimeFormatPrototype.h:
+        * runtime/IntlNumberFormatConstructor.cpp:
+        (JSC::IntlNumberFormatConstructor::getCallData):
+        (JSC::IntlNumberFormatConstructorFuncSupportedLocalesOf):
+        (JSC::IntlNumberFormatConstructor::getOwnPropertySlot): Deleted.
+        * runtime/IntlNumberFormatConstructor.h:
+        * runtime/IntlNumberFormatPrototype.cpp:
+        (JSC::IntlNumberFormatPrototype::finishCreation):
+        (JSC::IntlNumberFormatFuncFormatNumber):
+        (JSC::IntlNumberFormatPrototype::getOwnPropertySlot): Deleted.
+        * runtime/IntlNumberFormatPrototype.h:
+        * runtime/JSDataViewPrototype.cpp:
+        (JSC::JSDataViewPrototype::createStructure):
+        (JSC::getData):
+        (JSC::JSDataViewPrototype::getOwnPropertySlot): Deleted.
+        * runtime/JSDataViewPrototype.h:
+        * runtime/JSInternalPromiseConstructor.cpp:
+        (JSC::JSInternalPromiseConstructor::getCallData):
+        (JSC::JSInternalPromiseConstructor::getOwnPropertySlot): Deleted.
+        * runtime/JSInternalPromiseConstructor.h:
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::Walker):
+        (JSC::JSONObject::getOwnPropertySlot): Deleted.
+        * runtime/JSONObject.h:
+        (JSC::JSONObject::create):
+        * runtime/JSPromiseConstructor.cpp:
+        (JSC::JSPromiseConstructor::getCallData):
+        (JSC::JSPromiseConstructor::getOwnPropertySlot): Deleted.
+        * runtime/JSPromiseConstructor.h:
+        * runtime/JSPromisePrototype.cpp:
+        (JSC::JSPromisePrototype::addOwnInternalSlots):
+        (JSC::JSPromisePrototype::getOwnPropertySlot): Deleted.
+        * runtime/JSPromisePrototype.h:
+        * runtime/MapPrototype.cpp:
+        (JSC::MapPrototype::finishCreation):
+        (JSC::getMap):
+        (JSC::MapPrototype::getOwnPropertySlot): Deleted.
+        * runtime/MapPrototype.h:
+        (JSC::MapPrototype::create):
+        (JSC::MapPrototype::MapPrototype):
+        * runtime/ModuleLoaderObject.cpp:
+        (JSC::ModuleLoaderObject::finishCreation):
+        (JSC::printableModuleKey):
+        (JSC::ModuleLoaderObject::getOwnPropertySlot): Deleted.
+        * runtime/ModuleLoaderObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::finishCreation):
+        (JSC::toThisNumber):
+        (JSC::NumberPrototype::getOwnPropertySlot): Deleted.
+        * runtime/NumberPrototype.h:
+        (JSC::NumberPrototype::create):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::addDefineProperty):
+        (JSC::constructObject):
+        (JSC::ObjectConstructor::getOwnPropertySlot): Deleted.
+        * runtime/ObjectConstructor.h:
+        (JSC::ObjectConstructor::create):
+        (JSC::ObjectConstructor::createStructure):
+        * runtime/ReflectObject.cpp:
+        (JSC::ReflectObject::finishCreation):
+        (JSC::ReflectObject::getOwnPropertySlot): Deleted.
+        * runtime/ReflectObject.h:
+        (JSC::ReflectObject::create):
+        (JSC::ReflectObject::createStructure):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar):
+        (JSC::RegExpConstructor::getOwnPropertySlot): Deleted.
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::create):
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/SetPrototype.cpp:
+        (JSC::SetPrototype::finishCreation):
+        (JSC::getSet):
+        (JSC::SetPrototype::getOwnPropertySlot): Deleted.
+        * runtime/SetPrototype.h:
+        (JSC::SetPrototype::create):
+        (JSC::SetPrototype::SetPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::finishCreation):
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::StringConstructor::getOwnPropertySlot): Deleted.
+        * runtime/StringConstructor.h:
+        (JSC::StringConstructor::create):
+        * runtime/StringIteratorPrototype.cpp:
+        (JSC::StringIteratorPrototype::finishCreation):
+        (JSC::StringIteratorPrototype::getOwnPropertySlot): Deleted.
+        * runtime/StringIteratorPrototype.h:
+        (JSC::StringIteratorPrototype::create):
+        (JSC::StringIteratorPrototype::StringIteratorPrototype):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::create):
+        (JSC::substituteBackreferencesSlow):
+        (JSC::StringPrototype::getOwnPropertySlot): Deleted.
+        * runtime/StringPrototype.h:
+        * runtime/SymbolConstructor.cpp:
+        (JSC::SymbolConstructor::finishCreation):
+        (JSC::callSymbol):
+        (JSC::SymbolConstructor::getOwnPropertySlot): Deleted.
+        * runtime/SymbolConstructor.h:
+        (JSC::SymbolConstructor::create):
+        * runtime/SymbolPrototype.cpp:
+        (JSC::SymbolPrototype::finishCreation):
+        (JSC::SymbolPrototype::getOwnPropertySlot): Deleted.
+        * runtime/SymbolPrototype.h:
+        (JSC::SymbolPrototype::create):
+            - remove getOwnPropertySlot, replace OverridesGetOwnPropertySlot flag with HasStaticPropertyTable.
+
</ins><span class="cx"> 2016-05-26  Commit Queue  &lt;commit-queue@webkit.org&gt;
</span><span class="cx"> 
</span><span class="cx">         Unreviewed, rolling out r201436.
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ArrayConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -71,11 +71,6 @@
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;isArray, arrayConstructorIsArray, DontEnum, 1);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ArrayConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;InternalFunction&gt;(exec, arrayConstructorTable, jsCast&lt;ArrayConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions ---------------------------
</span><span class="cx"> 
</span><span class="cx"> JSObject* constructArrayWithSizeQuirk(ExecState* exec, ArrayAllocationProfile* profile, JSGlobalObject* globalObject, JSValue length, JSValue newTarget)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ArrayConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> class ArrayConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | InternalFunction::StructureFlags;
</del><ins>+    static const unsigned StructureFlags = HasStaticPropertyTable | InternalFunction::StructureFlags;
</ins><span class="cx"> 
</span><span class="cx">     static ArrayConstructor* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure, ArrayPrototype* arrayPrototype, GetterSetter* speciesSymbol)
</span><span class="cx">     {
</span><span class="lines">@@ -55,7 +55,6 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     ArrayConstructor(VM&amp;, Structure*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> 
</span><span class="cx">     static ConstructType getConstructData(JSCell*, ConstructData&amp;);
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayIteratorPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -55,11 +55,6 @@
</span><span class="cx">     vm.prototypeMap.addPrototype(this);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ArrayIteratorPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, arrayIteratorPrototypeTable, jsCast&lt;ArrayIteratorPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Array Functions ----------------------------
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeArrayIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ArrayIteratorPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> class ArrayIteratorPrototype : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
</del><ins>+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
</ins><span class="cx"> 
</span><span class="cx">     static ArrayIteratorPrototype* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -56,7 +56,6 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeBooleanPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/BooleanPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/BooleanPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/BooleanPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -63,11 +63,6 @@
</span><span class="cx">     ASSERT(inherits(info()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool BooleanPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;BooleanObject&gt;(exec, booleanPrototypeTable, jsCast&lt;BooleanPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions ---------------------------
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeBooleanPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/BooleanPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/BooleanPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/BooleanPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -28,7 +28,7 @@
</span><span class="cx"> class BooleanPrototype : public BooleanObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef BooleanObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static BooleanPrototype* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -49,7 +49,6 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     BooleanPrototype(VM&amp;, Structure*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDateConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/DateConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -107,11 +107,6 @@
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(7), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool DateConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;InternalFunction&gt;(exec, dateConstructorTable, jsCast&lt;DateConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> static double millisecondsFromComponents(ExecState* exec, const ArgList&amp; args, WTF::TimeType timeType)
</span><span class="cx"> {
</span><span class="cx">     double doubleArguments[] = {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDateConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DateConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DateConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/DateConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -31,7 +31,7 @@
</span><span class="cx"> class DateConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static DateConstructor* create(VM&amp; vm, Structure* structure, DatePrototype* datePrototype, GetterSetter*)
</span><span class="cx">     {
</span><span class="lines">@@ -54,8 +54,6 @@
</span><span class="cx">     DateConstructor(VM&amp;, Structure*);
</span><span class="cx">     static ConstructType getConstructData(JSCell*, ConstructData&amp;);
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span><del>-
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> JSObject* constructDate(ExecState*, JSGlobalObject*, JSValue newTarget, const ArgList&amp;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDatePrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/DatePrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -504,11 +504,6 @@
</span><span class="cx">     // The constructor will be added later, after DateConstructor has been built.
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool DatePrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;JSObject&gt;(exec, dateTable, jsCast&lt;DatePrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // Functions
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeDatePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/DatePrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/DatePrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/DatePrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static DatePrototype* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -41,7 +41,6 @@
</span><span class="cx">         prototype-&gt;finishCreation(vm, globalObject);
</span><span class="cx">         return prototype;
</span><span class="cx">     }
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeErrorPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ErrorPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ErrorPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ErrorPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -62,11 +62,6 @@
</span><span class="cx">     putDirect(vm, vm.propertyNames-&gt;message, jsEmptyString(&amp;vm), DontEnum);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ErrorPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;ErrorInstance&gt;(exec, errorPrototypeTable, jsCast&lt;ErrorPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions ---------------------------
</span><span class="cx"> 
</span><span class="cx"> // ECMA-262 5.1, 15.11.4.4
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeErrorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ErrorPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ErrorPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ErrorPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -30,7 +30,7 @@
</span><span class="cx"> class ErrorPrototype : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static ErrorPrototype* create(VM&amp; vm, JSGlobalObject*, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -49,9 +49,6 @@
</span><span class="cx"> protected:
</span><span class="cx">     ErrorPrototype(VM&amp;, Structure*);
</span><span class="cx">     void finishCreation(VM&amp;);
</span><del>-
-private:
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGeneratorPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -54,9 +54,4 @@
</span><span class="cx">     vm.prototypeMap.addPrototype(this);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool GeneratorPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, generatorPrototypeTable, jsCast&lt;GeneratorPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeGeneratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/GeneratorPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> class GeneratorPrototype : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static GeneratorPrototype* create(VM&amp; vm, JSGlobalObject*, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -49,8 +49,6 @@
</span><span class="cx">         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-
</del><span class="cx"> private:
</span><span class="cx">     GeneratorPrototype(VM&amp; vm, Structure* structure)
</span><span class="cx">         : Base(vm, structure)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeInspectorInstrumentationObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -64,11 +64,6 @@
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;isEnabled, jsBoolean(false));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool InspectorInstrumentationObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, inspectorInstrumentationObjectTable, jsCast&lt;InspectorInstrumentationObject*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> bool InspectorInstrumentationObject::isEnabled(VM&amp; vm) const
</span><span class="cx"> {
</span><span class="cx">     return getDirect(vm, vm.propertyNames-&gt;isEnabled).asBoolean();
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeInspectorInstrumentationObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/InspectorInstrumentationObject.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static InspectorInstrumentationObject* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -52,8 +52,6 @@
</span><span class="cx">         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-
</del><span class="cx">     void enable(VM&amp;);
</span><span class="cx">     void disable(VM&amp;);
</span><span class="cx">     bool isEnabled(VM&amp;) const;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -135,11 +135,6 @@
</span><span class="cx">     return CallType::Host;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool IntlCollatorConstructor::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;InternalFunction&gt;(state, collatorConstructorTable, jsCast&lt;IntlCollatorConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlCollatorConstructorFuncSupportedLocalesOf(ExecState* state)
</span><span class="cx"> {
</span><span class="cx">     // 10.2.2 Intl.Collator.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx"> class IntlCollatorConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static IntlCollatorConstructor* create(VM&amp;, Structure*, IntlCollatorPrototype*, Structure*);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="lines">@@ -54,7 +54,6 @@
</span><span class="cx">     IntlCollatorConstructor(VM&amp;, Structure*);
</span><span class="cx">     static ConstructType getConstructData(JSCell*, ConstructData&amp;);
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx">     
</span><span class="cx">     WriteBarrier&lt;Structure&gt; m_collatorStructure;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -79,11 +79,6 @@
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool IntlCollatorPrototype::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;JSObject&gt;(state, collatorPrototypeTable, jsCast&lt;IntlCollatorPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> static EncodedJSValue JSC_HOST_CALL IntlCollatorFuncCompare(ExecState* state)
</span><span class="cx"> {
</span><span class="cx">     // 10.3.4 Collator Compare Functions (ECMA-402 2.0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlCollatorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlCollatorPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> class IntlCollatorPrototype : public IntlCollator {
</span><span class="cx"> public:
</span><span class="cx">     typedef IntlCollator Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static IntlCollatorPrototype* create(VM&amp;, JSGlobalObject*, Structure*);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="lines">@@ -48,7 +48,6 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     IntlCollatorPrototype(VM&amp;, Structure*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -135,11 +135,6 @@
</span><span class="cx">     return CallType::Host;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool IntlDateTimeFormatConstructor::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;InternalFunction&gt;(state, dateTimeFormatConstructorTable, jsCast&lt;IntlDateTimeFormatConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatConstructorFuncSupportedLocalesOf(ExecState* state)
</span><span class="cx"> {
</span><span class="cx">     // 12.2.2 Intl.DateTimeFormat.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx"> class IntlDateTimeFormatConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static IntlDateTimeFormatConstructor* create(VM&amp;, Structure*, IntlDateTimeFormatPrototype*, Structure*);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="lines">@@ -54,7 +54,6 @@
</span><span class="cx">     IntlDateTimeFormatConstructor(VM&amp;, Structure*);
</span><span class="cx">     static ConstructType getConstructData(JSCell*, ConstructData&amp;);
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx">     
</span><span class="cx">     WriteBarrier&lt;Structure&gt; m_dateTimeFormatStructure;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -80,11 +80,6 @@
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool IntlDateTimeFormatPrototype::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;JSObject&gt;(state, dateTimeFormatPrototypeTable, jsCast&lt;IntlDateTimeFormatPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> static EncodedJSValue JSC_HOST_CALL IntlDateTimeFormatFuncFormatDateTime(ExecState* state)
</span><span class="cx"> {
</span><span class="cx">     // 12.3.4 DateTime Format Functions (ECMA-402 2.0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlDateTimeFormatPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlDateTimeFormatPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> class IntlDateTimeFormatPrototype : public IntlDateTimeFormat {
</span><span class="cx"> public:
</span><span class="cx">     typedef IntlDateTimeFormat Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static IntlDateTimeFormatPrototype* create(VM&amp;, JSGlobalObject*, Structure*);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="lines">@@ -48,7 +48,6 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     IntlDateTimeFormatPrototype(VM&amp;, Structure*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -135,11 +135,6 @@
</span><span class="cx">     return CallType::Host;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool IntlNumberFormatConstructor::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;InternalFunction&gt;(state, numberFormatConstructorTable, jsCast&lt;IntlNumberFormatConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> EncodedJSValue JSC_HOST_CALL IntlNumberFormatConstructorFuncSupportedLocalesOf(ExecState* state)
</span><span class="cx"> {
</span><span class="cx">     // 11.2.2 Intl.NumberFormat.supportedLocalesOf(locales [, options]) (ECMA-402 2.0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx"> class IntlNumberFormatConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static IntlNumberFormatConstructor* create(VM&amp;, Structure*, IntlNumberFormatPrototype*, Structure*);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="lines">@@ -54,7 +54,6 @@
</span><span class="cx">     IntlNumberFormatConstructor(VM&amp;, Structure*);
</span><span class="cx">     static ConstructType getConstructData(JSCell*, ConstructData&amp;);
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx">     static void visitChildren(JSCell*, SlotVisitor&amp;);
</span><span class="cx">     
</span><span class="cx">     WriteBarrier&lt;Structure&gt; m_numberFormatStructure;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -78,11 +78,6 @@
</span><span class="cx">     Base::finishCreation(vm);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool IntlNumberFormatPrototype::getOwnPropertySlot(JSObject* object, ExecState* state, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;JSObject&gt;(state, numberFormatPrototypeTable, jsCast&lt;IntlNumberFormatPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> static EncodedJSValue JSC_HOST_CALL IntlNumberFormatFuncFormatNumber(ExecState* state)
</span><span class="cx"> {
</span><span class="cx">     // 11.3.4 Format Number Functions (ECMA-402 2.0)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeIntlNumberFormatPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/IntlNumberFormatPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> class IntlNumberFormatPrototype : public IntlNumberFormat {
</span><span class="cx"> public:
</span><span class="cx">     typedef IntlNumberFormat Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static IntlNumberFormatPrototype* create(VM&amp;, JSGlobalObject*, Structure*);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="lines">@@ -48,7 +48,6 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     IntlNumberFormatPrototype(VM&amp;, Structure*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSDataViewPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -119,14 +119,6 @@
</span><span class="cx">         vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool JSDataViewPrototype::getOwnPropertySlot(
-    JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;JSObject&gt;(
-        exec, dataViewTable, jsCast&lt;JSDataViewPrototype*&gt;(object),
-        propertyName, slot);
-}
-
</del><span class="cx"> template&lt;typename Adaptor&gt;
</span><span class="cx"> EncodedJSValue getData(ExecState* exec)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSDataViewPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSDataViewPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> class JSDataViewPrototype : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx"> protected:
</span><span class="cx">     JSDataViewPrototype(VM&amp;, Structure*);
</span><span class="lines">@@ -46,9 +46,6 @@
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx">     
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue prototype);
</span><del>-
-protected:
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSInternalPromiseConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -85,9 +85,4 @@
</span><span class="cx">     return CallType::Host;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool JSInternalPromiseConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, internalPromiseConstructorTable, jsCast&lt;JSInternalPromiseConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSInternalPromiseConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSInternalPromiseConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> class JSInternalPromiseConstructor : public JSPromiseConstructor {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSPromiseConstructor Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static JSInternalPromiseConstructor* create(VM&amp;, Structure*, JSInternalPromisePrototype*, GetterSetter*);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="lines">@@ -47,7 +47,6 @@
</span><span class="cx">     JSInternalPromiseConstructor(VM&amp;, Structure*);
</span><span class="cx">     static ConstructType getConstructData(JSCell*, ConstructData&amp;);
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSONObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSONObject.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSONObject.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSONObject.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -552,11 +552,6 @@
</span><span class="cx"> 
</span><span class="cx"> // ECMA 15.8
</span><span class="cx"> 
</span><del>-bool JSONObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;JSObject&gt;(exec, jsonTable, jsCast&lt;JSONObject*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> class Walker {
</span><span class="cx"> public:
</span><span class="cx">     Walker(ExecState* exec, Handle&lt;JSObject&gt; function, CallType callType, CallData callData)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSONObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSONObject.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSONObject.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSONObject.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -33,7 +33,7 @@
</span><span class="cx"> class JSONObject : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static JSONObject* create(VM&amp; vm, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -54,7 +54,6 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     JSONObject(VM&amp;, Structure*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> JS_EXPORT_PRIVATE JSValue JSONParse(ExecState*, const String&amp;);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -1674,6 +1674,17 @@
</span><span class="cx">     return !result.isString();
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+bool JSObject::getOwnStaticPropertySlot(VM&amp; vm, PropertyName propertyName, PropertySlot&amp; slot)
+{
+    for (auto* info = classInfo(); info; info = info-&gt;parentClass) {
+        if (auto* table = info-&gt;staticPropHashTable) {
+            if (getStaticPropertySlotFromTable(vm, *table, this, propertyName, slot))
+                return true;
+        }
+    }
+    return false;
+}
+
</ins><span class="cx"> const HashTableValue* JSObject::findPropertyHashEntry(PropertyName propertyName) const
</span><span class="cx"> {
</span><span class="cx">     for (const ClassInfo* info = classInfo(); info; info = info-&gt;parentClass) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSObject.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSObject.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -87,7 +87,7 @@
</span><span class="cx">     friend class JSCell;
</span><span class="cx">     friend class JSFinalObject;
</span><span class="cx">     friend class MarkedBlock;
</span><del>-    JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(ExecState*, const HashTableValue*, JSObject*, PropertyName, PropertySlot&amp;);
</del><ins>+    JS_EXPORT_PRIVATE friend bool setUpStaticFunctionSlot(VM&amp;, const HashTableValue*, JSObject*, PropertyName, PropertySlot&amp;);
</ins><span class="cx"> 
</span><span class="cx">     enum PutMode {
</span><span class="cx">         PutModePut,
</span><span class="lines">@@ -922,6 +922,7 @@
</span><span class="cx">     JS_EXPORT_PRIVATE void fillGetterPropertySlot(PropertySlot&amp;, JSValue, unsigned, PropertyOffset);
</span><span class="cx">     void fillCustomGetterPropertySlot(PropertySlot&amp;, JSValue, unsigned, Structure&amp;);
</span><span class="cx"> 
</span><ins>+    JS_EXPORT_PRIVATE bool getOwnStaticPropertySlot(VM&amp;, PropertyName, PropertySlot&amp;);
</ins><span class="cx">     JS_EXPORT_PRIVATE const HashTableValue* findPropertyHashEntry(PropertyName) const;
</span><span class="cx">         
</span><span class="cx">     bool putIndexedDescriptor(ExecState*, SparseArrayEntry*, const PropertyDescriptor&amp;, PropertyDescriptor&amp; old);
</span><span class="lines">@@ -1192,8 +1193,11 @@
</span><span class="cx"> {
</span><span class="cx">     unsigned attributes;
</span><span class="cx">     PropertyOffset offset = structure.get(vm, propertyName, attributes);
</span><del>-    if (!isValidOffset(offset))
-        return false;
</del><ins>+    if (!isValidOffset(offset)) {
+        if (!TypeInfo::hasStaticPropertyTable(inlineTypeFlags()))
+            return false;
+        return getOwnStaticPropertySlot(vm, propertyName, slot);
+    }
</ins><span class="cx"> 
</span><span class="cx">     // getPropertySlot relies on this method never returning index properties!
</span><span class="cx">     ASSERT(!parseIndex(propertyName));
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -133,9 +133,4 @@
</span><span class="cx">     return CallType::Host;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool JSPromiseConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, promiseConstructorTable, jsCast&lt;JSPromiseConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromiseConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSPromiseConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -37,15 +37,13 @@
</span><span class="cx"> class JSPromiseConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static JSPromiseConstructor* create(VM&amp;, Structure*, JSPromisePrototype*, GetterSetter* speciesSymbol);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-
</del><span class="cx"> protected:
</span><span class="cx">     JSPromiseConstructor(VM&amp;, Structure*);
</span><span class="cx">     void finishCreation(VM&amp;, JSPromisePrototype*, GetterSetter*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromisePrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -85,9 +85,4 @@
</span><span class="cx">     JSC_BUILTIN_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;builtinNames().thenPrivateName(), promisePrototypeThenCodeGenerator, DontEnum | DontDelete | ReadOnly);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool JSPromisePrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, promisePrototypeTable, jsCast&lt;JSPromisePrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSPromisePrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSPromisePrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -33,15 +33,13 @@
</span><span class="cx"> class JSPromisePrototype : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static JSPromisePrototype* create(VM&amp;, JSGlobalObject*, Structure*);
</span><span class="cx">     static Structure* createStructure(VM&amp;, JSGlobalObject*, JSValue);
</span><span class="cx"> 
</span><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-
</del><span class="cx"> protected:
</span><span class="cx">     void finishCreation(VM&amp;, Structure*);
</span><span class="cx">     JSPromisePrototype(VM&amp;, Structure*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeJSTypeInfoh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/JSTypeInfo.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -43,7 +43,7 @@
</span><span class="cx"> static const unsigned InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero = 1 &lt;&lt; 4;
</span><span class="cx"> static const unsigned StructureIsImmortal = 1 &lt;&lt; 5;
</span><span class="cx"> static const unsigned OverridesToThis = 1 &lt;&lt; 6; // If this is false then this returns something other than 'this'. Non-object cells that are visible to JS have this set as do some exotic objects.
</span><del>-// There is one free bit at the end of the InlineTypeFlags.
</del><ins>+static const unsigned HasStaticPropertyTable = 1 &lt;&lt; 7;
</ins><span class="cx"> 
</span><span class="cx"> static const unsigned ImplementsHasInstance = 1 &lt;&lt; 8;
</span><span class="cx"> static const unsigned OverridesGetPropertyNames = 1 &lt;&lt; 9;
</span><span class="lines">@@ -83,6 +83,7 @@
</span><span class="cx">     bool typeOfShouldCallGetCallData() const { return isSetOnFlags1(TypeOfShouldCallGetCallData); }
</span><span class="cx">     bool overridesGetOwnPropertySlot() const { return overridesGetOwnPropertySlot(inlineTypeFlags()); }
</span><span class="cx">     static bool overridesGetOwnPropertySlot(InlineTypeFlags flags) { return flags &amp; OverridesGetOwnPropertySlot; }
</span><ins>+    static bool hasStaticPropertyTable(InlineTypeFlags flags) { return flags &amp; HasStaticPropertyTable; }
</ins><span class="cx">     bool interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero() const { return isSetOnFlags1(InterceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero); }
</span><span class="cx">     bool structureIsImmortal() const { return isSetOnFlags1(StructureIsImmortal); }
</span><span class="cx">     bool overridesToThis() const { return isSetOnFlags1(OverridesToThis); }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeLookupcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Lookup.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Lookup.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/Lookup.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -27,9 +27,9 @@
</span><span class="cx"> 
</span><span class="cx"> namespace JSC {
</span><span class="cx"> 
</span><del>-void reifyStaticAccessor(VM&amp; vm, const HashTableValue&amp; value, JSObject&amp; thisObj, PropertyName propertyName)
</del><ins>+void reifyStaticAccessor(VM&amp; vm, const HashTableValue&amp; value, JSObject&amp; thisObject, PropertyName propertyName)
</ins><span class="cx"> {
</span><del>-    JSGlobalObject* globalObject = thisObj.globalObject();
</del><ins>+    JSGlobalObject* globalObject = thisObject.globalObject();
</ins><span class="cx">     GetterSetter* accessor = GetterSetter::create(vm, globalObject);
</span><span class="cx">     if (value.accessorGetter()) {
</span><span class="cx">         String getterName = WTF::tryMakeString(ASCIILiteral(&quot;get &quot;), String(*propertyName.publicName()));
</span><span class="lines">@@ -39,50 +39,49 @@
</span><span class="cx">             ? JSFunction::createBuiltinFunction(vm, value.builtinAccessorGetterGenerator()(vm), globalObject, getterName)
</span><span class="cx">             : JSFunction::create(vm, globalObject, 0, getterName, value.accessorGetter()));
</span><span class="cx">     }
</span><del>-    thisObj.putDirectNonIndexAccessor(vm, propertyName, accessor, attributesForStructure(value.attributes()));
</del><ins>+    thisObject.putDirectNonIndexAccessor(vm, propertyName, accessor, attributesForStructure(value.attributes()));
</ins><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool setUpStaticFunctionSlot(ExecState* exec, const HashTableValue* entry, JSObject* thisObj, PropertyName propertyName, PropertySlot&amp; slot)
</del><ins>+bool setUpStaticFunctionSlot(VM&amp; vm, const HashTableValue* entry, JSObject* thisObject, PropertyName propertyName, PropertySlot&amp; slot)
</ins><span class="cx"> {
</span><del>-    ASSERT(thisObj-&gt;globalObject());
</del><ins>+    ASSERT(thisObject-&gt;globalObject());
</ins><span class="cx">     ASSERT(entry-&gt;attributes() &amp; BuiltinOrFunctionOrAccessorOrLazyProperty);
</span><del>-    VM&amp; vm = exec-&gt;vm();
</del><span class="cx">     unsigned attributes;
</span><span class="cx">     bool isAccessor = entry-&gt;attributes() &amp; Accessor;
</span><del>-    PropertyOffset offset = thisObj-&gt;getDirectOffset(vm, propertyName, attributes);
</del><ins>+    PropertyOffset offset = thisObject-&gt;getDirectOffset(vm, propertyName, attributes);
</ins><span class="cx"> 
</span><span class="cx">     if (!isValidOffset(offset)) {
</span><span class="cx">         // If a property is ever deleted from an object with a static table, then we reify
</span><span class="cx">         // all static functions at that time - after this we shouldn't be re-adding anything.
</span><del>-        if (thisObj-&gt;staticFunctionsReified())
</del><ins>+        if (thisObject-&gt;staticFunctionsReified())
</ins><span class="cx">             return false;
</span><span class="cx"> 
</span><span class="cx">         if (entry-&gt;attributes() &amp; Builtin)
</span><del>-            thisObj-&gt;putDirectBuiltinFunction(vm, thisObj-&gt;globalObject(), propertyName, entry-&gt;builtinGenerator()(vm), attributesForStructure(entry-&gt;attributes()));
</del><ins>+            thisObject-&gt;putDirectBuiltinFunction(vm, thisObject-&gt;globalObject(), propertyName, entry-&gt;builtinGenerator()(vm), attributesForStructure(entry-&gt;attributes()));
</ins><span class="cx">         else if (entry-&gt;attributes() &amp; Function) {
</span><del>-            thisObj-&gt;putDirectNativeFunction(
-                vm, thisObj-&gt;globalObject(), propertyName, entry-&gt;functionLength(),
</del><ins>+            thisObject-&gt;putDirectNativeFunction(
+                vm, thisObject-&gt;globalObject(), propertyName, entry-&gt;functionLength(),
</ins><span class="cx">                 entry-&gt;function(), entry-&gt;intrinsic(), attributesForStructure(entry-&gt;attributes()));
</span><span class="cx">         } else if (isAccessor)
</span><del>-            reifyStaticAccessor(vm, *entry, *thisObj, propertyName);
</del><ins>+            reifyStaticAccessor(vm, *entry, *thisObject, propertyName);
</ins><span class="cx">         else if (entry-&gt;attributes() &amp; CellProperty) {
</span><span class="cx">             LazyCellProperty* property = bitwise_cast&lt;LazyCellProperty*&gt;(
</span><del>-                bitwise_cast&lt;char*&gt;(thisObj) + entry-&gt;lazyCellPropertyOffset());
-            JSCell* result = property-&gt;get(thisObj);
-            thisObj-&gt;putDirect(vm, propertyName, result, attributesForStructure(entry-&gt;attributes()));
</del><ins>+                bitwise_cast&lt;char*&gt;(thisObject) + entry-&gt;lazyCellPropertyOffset());
+            JSCell* result = property-&gt;get(thisObject);
+            thisObject-&gt;putDirect(vm, propertyName, result, attributesForStructure(entry-&gt;attributes()));
</ins><span class="cx">         } else if (entry-&gt;attributes() &amp; ClassStructure) {
</span><span class="cx">             LazyClassStructure* structure = bitwise_cast&lt;LazyClassStructure*&gt;(
</span><del>-                bitwise_cast&lt;char*&gt;(thisObj) + entry-&gt;lazyClassStructureOffset());
-            structure-&gt;get(jsCast&lt;JSGlobalObject*&gt;(thisObj));
</del><ins>+                bitwise_cast&lt;char*&gt;(thisObject) + entry-&gt;lazyClassStructureOffset());
+            structure-&gt;get(jsCast&lt;JSGlobalObject*&gt;(thisObject));
</ins><span class="cx">         } else if (entry-&gt;attributes() &amp; PropertyCallback) {
</span><del>-            JSValue result = entry-&gt;lazyPropertyCallback()(vm, thisObj);
-            thisObj-&gt;putDirect(vm, propertyName, result, attributesForStructure(entry-&gt;attributes()));
</del><ins>+            JSValue result = entry-&gt;lazyPropertyCallback()(vm, thisObject);
+            thisObject-&gt;putDirect(vm, propertyName, result, attributesForStructure(entry-&gt;attributes()));
</ins><span class="cx">         } else {
</span><span class="cx">             dataLog(&quot;Static hashtable entry for &quot;, propertyName, &quot; has weird attributes: &quot;, entry-&gt;attributes(), &quot;\n&quot;);
</span><span class="cx">             RELEASE_ASSERT_NOT_REACHED();
</span><span class="cx">         }
</span><span class="cx"> 
</span><del>-        offset = thisObj-&gt;getDirectOffset(vm, propertyName, attributes);
</del><ins>+        offset = thisObject-&gt;getDirectOffset(vm, propertyName, attributes);
</ins><span class="cx">         if (!isValidOffset(offset)) {
</span><span class="cx">             dataLog(&quot;Static hashtable initialiation for &quot;, propertyName, &quot; did not produce a property.\n&quot;);
</span><span class="cx">             RELEASE_ASSERT_NOT_REACHED();
</span><span class="lines">@@ -90,9 +89,9 @@
</span><span class="cx">     }
</span><span class="cx"> 
</span><span class="cx">     if (isAccessor)
</span><del>-        slot.setCacheableGetterSlot(thisObj, attributes, jsCast&lt;GetterSetter*&gt;(thisObj-&gt;getDirect(offset)), offset);
</del><ins>+        slot.setCacheableGetterSlot(thisObject, attributes, jsCast&lt;GetterSetter*&gt;(thisObject-&gt;getDirect(offset)), offset);
</ins><span class="cx">     else
</span><del>-        slot.setValue(thisObj, attributes, thisObj-&gt;getDirect(offset), offset);
</del><ins>+        slot.setValue(thisObject, attributes, thisObject-&gt;getDirect(offset), offset);
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeLookuph"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/Lookup.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/Lookup.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/Lookup.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -191,7 +191,7 @@
</span><span class="cx">     }
</span><span class="cx"> };
</span><span class="cx"> 
</span><del>-JS_EXPORT_PRIVATE bool setUpStaticFunctionSlot(ExecState*, const HashTableValue*, JSObject* thisObject, PropertyName, PropertySlot&amp;);
</del><ins>+JS_EXPORT_PRIVATE bool setUpStaticFunctionSlot(VM&amp;, const HashTableValue*, JSObject* thisObject, PropertyName, PropertySlot&amp;);
</ins><span class="cx"> JS_EXPORT_PRIVATE void reifyStaticAccessor(VM&amp;, const HashTableValue&amp;, JSObject&amp; thisObject, PropertyName);
</span><span class="cx"> 
</span><span class="cx"> inline BuiltinGenerator HashTableValue::builtinAccessorGetterGenerator() const
</span><span class="lines">@@ -208,6 +208,27 @@
</span><span class="cx">     return reinterpret_cast&lt;BuiltinGenerator&gt;(m_values.value2);
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+inline bool getStaticPropertySlotFromTable(VM&amp; vm, const HashTable&amp; table, JSObject* thisObject, PropertyName propertyName, PropertySlot&amp; slot)
+{
+    if (thisObject-&gt;staticFunctionsReified())
+        return false;
+
+    auto* entry = table.entry(propertyName);
+    if (!entry)
+        return false;
+
+    if (entry-&gt;attributes() &amp; BuiltinOrFunctionOrAccessorOrLazyProperty)
+        return setUpStaticFunctionSlot(vm, entry, thisObject, propertyName, slot);
+
+    if (entry-&gt;attributes() &amp; ConstantInteger) {
+        slot.setValue(thisObject, attributesForStructure(entry-&gt;attributes()), jsNumber(entry-&gt;constantInteger()));
+        return true;
+    }
+
+    slot.setCacheableCustom(thisObject, attributesForStructure(entry-&gt;attributes()), entry-&gt;propertyGetter());
+    return true;
+}
+
</ins><span class="cx"> /**
</span><span class="cx">  * This method does it all (looking in the hashtable, checking for function
</span><span class="cx">  * overrides, creating the function or retrieving from cache, calling
</span><span class="lines">@@ -215,12 +236,12 @@
</span><span class="cx">  * unknown property).
</span><span class="cx">  */
</span><span class="cx"> template &lt;class ThisImp, class ParentImp&gt;
</span><del>-inline bool getStaticPropertySlot(ExecState* exec, const HashTable&amp; table, ThisImp* thisObj, PropertyName propertyName, PropertySlot&amp; slot)
</del><ins>+inline bool getStaticPropertySlot(ExecState* exec, const HashTable&amp; table, ThisImp* thisObject, PropertyName propertyName, PropertySlot&amp; slot)
</ins><span class="cx"> {
</span><del>-    if (ParentImp::getOwnPropertySlot(thisObj, exec, propertyName, slot))
</del><ins>+    if (ParentImp::getOwnPropertySlot(thisObject, exec, propertyName, slot))
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    if (thisObj-&gt;staticFunctionsReified())
</del><ins>+    if (thisObject-&gt;staticFunctionsReified())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     auto* entry = table.entry(propertyName);
</span><span class="lines">@@ -228,14 +249,14 @@
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     if (entry-&gt;attributes() &amp; BuiltinOrFunctionOrAccessorOrLazyProperty)
</span><del>-        return setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
</del><ins>+        return setUpStaticFunctionSlot(exec-&gt;vm(), entry, thisObject, propertyName, slot);
</ins><span class="cx"> 
</span><span class="cx">     if (entry-&gt;attributes() &amp; ConstantInteger) {
</span><del>-        slot.setValue(thisObj, attributesForStructure(entry-&gt;attributes()), jsNumber(entry-&gt;constantInteger()));
</del><ins>+        slot.setValue(thisObject, attributesForStructure(entry-&gt;attributes()), jsNumber(entry-&gt;constantInteger()));
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    slot.setCacheableCustom(thisObj, attributesForStructure(entry-&gt;attributes()), entry-&gt;propertyGetter());
</del><ins>+    slot.setCacheableCustom(thisObject, attributesForStructure(entry-&gt;attributes()), entry-&gt;propertyGetter());
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span><span class="lines">@@ -245,19 +266,19 @@
</span><span class="cx">  * a dummy getValueProperty.
</span><span class="cx">  */
</span><span class="cx"> template &lt;class ParentImp&gt;
</span><del>-inline bool getStaticFunctionSlot(ExecState* exec, const HashTable&amp; table, JSObject* thisObj, PropertyName propertyName, PropertySlot&amp; slot)
</del><ins>+inline bool getStaticFunctionSlot(ExecState* exec, const HashTable&amp; table, JSObject* thisObject, PropertyName propertyName, PropertySlot&amp; slot)
</ins><span class="cx"> {
</span><del>-    if (ParentImp::getOwnPropertySlot(thisObj, exec, propertyName, slot))
</del><ins>+    if (ParentImp::getOwnPropertySlot(thisObject, exec, propertyName, slot))
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    if (thisObj-&gt;staticFunctionsReified())
</del><ins>+    if (thisObject-&gt;staticFunctionsReified())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     auto* entry = table.entry(propertyName);
</span><span class="cx">     if (!entry)
</span><span class="cx">         return false;
</span><span class="cx"> 
</span><del>-    return setUpStaticFunctionSlot(exec, entry, thisObj, propertyName, slot);
</del><ins>+    return setUpStaticFunctionSlot(exec-&gt;vm(), entry, thisObject, propertyName, slot);
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> /**
</span><span class="lines">@@ -265,12 +286,12 @@
</span><span class="cx">  * Using this instead of getStaticPropertySlot removes the need for a FuncImp class.
</span><span class="cx">  */
</span><span class="cx"> template &lt;class ThisImp, class ParentImp&gt;
</span><del>-inline bool getStaticValueSlot(ExecState* exec, const HashTable&amp; table, ThisImp* thisObj, PropertyName propertyName, PropertySlot&amp; slot)
</del><ins>+inline bool getStaticValueSlot(ExecState* exec, const HashTable&amp; table, ThisImp* thisObject, PropertyName propertyName, PropertySlot&amp; slot)
</ins><span class="cx"> {
</span><del>-    if (ParentImp::getOwnPropertySlot(thisObj, exec, propertyName, slot))
</del><ins>+    if (ParentImp::getOwnPropertySlot(thisObject, exec, propertyName, slot))
</ins><span class="cx">         return true;
</span><span class="cx"> 
</span><del>-    if (thisObj-&gt;staticFunctionsReified())
</del><ins>+    if (thisObject-&gt;staticFunctionsReified())
</ins><span class="cx">         return false;
</span><span class="cx"> 
</span><span class="cx">     auto* entry = table.entry(propertyName);
</span><span class="lines">@@ -280,11 +301,11 @@
</span><span class="cx">     ASSERT(!(entry-&gt;attributes() &amp; BuiltinOrFunctionOrAccessorOrLazyProperty));
</span><span class="cx"> 
</span><span class="cx">     if (entry-&gt;attributes() &amp; ConstantInteger) {
</span><del>-        slot.setValue(thisObj, attributesForStructure(entry-&gt;attributes()), jsNumber(entry-&gt;constantInteger()));
</del><ins>+        slot.setValue(thisObject, attributesForStructure(entry-&gt;attributes()), jsNumber(entry-&gt;constantInteger()));
</ins><span class="cx">         return true;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    slot.setCacheableCustom(thisObj, attributesForStructure(entry-&gt;attributes()), entry-&gt;propertyGetter());
</del><ins>+    slot.setCacheableCustom(thisObject, attributesForStructure(entry-&gt;attributes()), entry-&gt;propertyGetter());
</ins><span class="cx">     return true;
</span><span class="cx"> }
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/MapPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -89,11 +89,6 @@
</span><span class="cx">     JSC_NATIVE_GETTER(vm.propertyNames-&gt;size, mapProtoFuncSize, DontEnum | Accessor);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool MapPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, mapPrototypeTable, jsCast&lt;MapPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> ALWAYS_INLINE static JSMap* getMap(CallFrame* callFrame, JSValue thisValue)
</span><span class="cx"> {
</span><span class="cx">     if (!thisValue.isObject()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeMapPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/MapPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/MapPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/MapPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><span class="cx"> 
</span><del>-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
</del><ins>+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
</ins><span class="cx"> 
</span><span class="cx">     static MapPrototype* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -56,7 +56,6 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL privateFuncIsMap(ExecState*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeModuleLoaderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ModuleLoaderObject.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ModuleLoaderObject.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ModuleLoaderObject.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -119,11 +119,6 @@
</span><span class="cx">     putDirectWithoutTransition(vm, Identifier::fromString(&amp;vm, &quot;registry&quot;), JSMap::create(vm, globalObject-&gt;mapStructure()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ModuleLoaderObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, moduleLoaderObjectTable, jsCast&lt;ModuleLoaderObject*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions --------------------------------
</span><span class="cx"> 
</span><span class="cx"> static String printableModuleKey(ExecState* exec, JSValue key)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeModuleLoaderObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ModuleLoaderObject.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ModuleLoaderObject.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ModuleLoaderObject.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -37,7 +37,7 @@
</span><span class="cx">     ModuleLoaderObject(VM&amp;, Structure*);
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     enum Status {
</span><span class="cx">         Fetch = 1,
</span><span class="lines">@@ -77,8 +77,6 @@
</span><span class="cx">     // Additional platform dependent hooked APIs.
</span><span class="cx">     JSValue evaluate(ExecState*, JSValue key, JSValue moduleRecord);
</span><span class="cx"> 
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-
</del><span class="cx"> protected:
</span><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*);
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNumberPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/NumberPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -89,11 +89,6 @@
</span><span class="cx">     ASSERT(inherits(info()));
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool NumberPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;NumberObject&gt;(exec, numberPrototypeTable, jsCast&lt;NumberPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions ---------------------------
</span><span class="cx"> 
</span><span class="cx"> static ALWAYS_INLINE bool toThisNumber(JSValue thisValue, double&amp; x)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeNumberPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/NumberPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/NumberPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/NumberPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -28,7 +28,7 @@
</span><span class="cx"> class NumberPrototype : public NumberObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef NumberObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static NumberPrototype* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -49,7 +49,6 @@
</span><span class="cx"> 
</span><span class="cx"> private:
</span><span class="cx">     NumberPrototype(VM&amp;, Structure*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -113,11 +113,6 @@
</span><span class="cx">     return definePropertyFunction;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ObjectConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;JSObject&gt;(exec, objectConstructorTable, jsCast&lt;ObjectConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ES 19.1.1.1 Object([value])
</span><span class="cx"> static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, JSValue newTarget)
</span><span class="cx"> {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeObjectConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ObjectConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ObjectConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ObjectConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx"> class ObjectConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static ObjectConstructor* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure, ObjectPrototype* objectPrototype)
</span><span class="cx">     {
</span><span class="lines">@@ -47,8 +47,6 @@
</span><span class="cx">         return constructor;
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-
</del><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><span class="cx">     static Structure* createStructure(VM&amp; vm, JSGlobalObject* globalObject, JSValue prototype)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeReflectObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ReflectObject.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -89,11 +89,6 @@
</span><span class="cx">     JSC_NATIVE_FUNCTION_WITHOUT_TRANSITION(vm.propertyNames-&gt;getOwnPropertyDescriptorPrivateName, reflectObjectGetOwnPropertyDescriptor, DontEnum | DontDelete | ReadOnly, 2);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool ReflectObject::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, reflectObjectTable, jsCast&lt;ReflectObject*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions --------------------------------
</span><span class="cx"> 
</span><span class="cx"> // https://tc39.github.io/ecma262/#sec-reflect.construct
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeReflectObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/ReflectObject.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/ReflectObject.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/ReflectObject.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static ReflectObject* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -52,8 +52,6 @@
</span><span class="cx">         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-
</del><span class="cx"> protected:
</span><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*);
</span><span class="cx"> };
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/RegExpConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -145,11 +145,6 @@
</span><span class="cx"> {
</span><span class="cx">     return m_cachedResult.rightContext(exec, this);
</span><span class="cx"> }
</span><del>-    
-bool RegExpConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticValueSlot&lt;RegExpConstructor, InternalFunction&gt;(exec, regExpConstructorTable, jsCast&lt;RegExpConstructor*&gt;(object), propertyName, slot);
-}
</del><span class="cx"> 
</span><span class="cx"> template&lt;int N&gt;
</span><span class="cx"> EncodedJSValue regExpConstructorDollar(ExecState* exec, EncodedJSValue thisValue, PropertyName, JSObject*)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeRegExpConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/RegExpConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> class RegExpConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static RegExpConstructor* create(VM&amp; vm, Structure* structure, RegExpPrototype* regExpPrototype, GetterSetter* species)
</span><span class="cx">     {
</span><span class="lines">@@ -48,8 +48,6 @@
</span><span class="cx">         return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
</span><span class="cx">     }
</span><span class="cx"> 
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
-
</del><span class="cx">     DECLARE_INFO;
</span><span class="cx"> 
</span><span class="cx">     MatchResult performMatch(VM&amp;, RegExp*, JSString*, const String&amp;, int startOffset, int** ovector);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/SetPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -83,12 +83,6 @@
</span><span class="cx">     JSC_NATIVE_GETTER(vm.propertyNames-&gt;size, setProtoFuncSize, DontEnum | Accessor);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool SetPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, setPrototypeTable, jsCast&lt;SetPrototype*&gt;(object), propertyName, slot);
-}
-
-
</del><span class="cx"> ALWAYS_INLINE static JSSet* getSet(CallFrame* callFrame, JSValue thisValue)
</span><span class="cx"> {
</span><span class="cx">     if (!thisValue.isObject()) {
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSetPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SetPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SetPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/SetPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><span class="cx"> 
</span><del>-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
</del><ins>+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
</ins><span class="cx"> 
</span><span class="cx">     static SetPrototype* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -56,7 +56,6 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JSC_HOST_CALL privateFuncIsSet(ExecState*);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/StringConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -64,11 +64,6 @@
</span><span class="cx">     putDirectWithoutTransition(vm, vm.propertyNames-&gt;length, jsNumber(1), ReadOnly | DontEnum | DontDelete);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool StringConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;InternalFunction&gt;(exec, stringConstructorTable, jsCast&lt;StringConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions --------------------------------
</span><span class="cx"> 
</span><span class="cx"> static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/StringConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -31,7 +31,7 @@
</span><span class="cx"> class StringConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static StringConstructor* create(VM&amp; vm, Structure* structure, StringPrototype* stringPrototype, GetterSetter*)
</span><span class="cx">     {
</span><span class="lines">@@ -52,8 +52,6 @@
</span><span class="cx">     void finishCreation(VM&amp;, StringPrototype*);
</span><span class="cx">     static ConstructType getConstructData(JSCell*, ConstructData&amp;);
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span><del>-
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> JSCell* JSC_HOST_CALL stringFromCharCode(ExecState*, int32_t);
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringIteratorPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -58,9 +58,4 @@
</span><span class="cx">     vm.prototypeMap.addPrototype(this);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool StringIteratorPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot&amp; slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, stringIteratorPrototypeTable, jsCast&lt;StringIteratorPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringIteratorPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/StringIteratorPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -34,7 +34,7 @@
</span><span class="cx"> class StringIteratorPrototype : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static StringIteratorPrototype* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -56,7 +56,6 @@
</span><span class="cx">     {
</span><span class="cx">     }
</span><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> }
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/StringPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -189,11 +189,6 @@
</span><span class="cx">     return prototype;
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool StringPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, stringPrototypeTable, jsCast&lt;StringPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions --------------------------
</span><span class="cx"> 
</span><span class="cx"> static NEVER_INLINE String substituteBackreferencesSlow(StringView replacement, StringView source, const int* ovector, RegExp* reg, size_t i)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeStringPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/StringPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/StringPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/StringPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> 
</span><span class="cx"> public:
</span><span class="cx">     typedef StringObject Base;
</span><del>-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
</del><ins>+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
</ins><span class="cx"> 
</span><span class="cx">     static StringPrototype* create(VM&amp;, JSGlobalObject*, Structure*);
</span><span class="cx"> 
</span><span class="lines">@@ -49,9 +49,6 @@
</span><span class="cx"> 
</span><span class="cx"> protected:
</span><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*, JSString*);
</span><del>-
-private:
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> EncodedJSValue JIT_OPERATION operationStringProtoFuncReplaceGeneric(
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolConstructorcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/SymbolConstructor.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -73,11 +73,6 @@
</span><span class="cx">     JSC_COMMON_PRIVATE_IDENTIFIERS_EACH_WELL_KNOWN_SYMBOL(INITIALIZE_WELL_KNOWN_SYMBOLS)
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool SymbolConstructor::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, symbolConstructorTable, jsCast&lt;SymbolConstructor*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions ---------------------------
</span><span class="cx"> 
</span><span class="cx"> static EncodedJSValue JSC_HOST_CALL callSymbol(ExecState* exec)
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolConstructorh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolConstructor.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolConstructor.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/SymbolConstructor.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -38,7 +38,7 @@
</span><span class="cx"> class SymbolConstructor : public InternalFunction {
</span><span class="cx"> public:
</span><span class="cx">     typedef InternalFunction Base;
</span><del>-    static const unsigned StructureFlags = OverridesGetOwnPropertySlot | Base::StructureFlags;
</del><ins>+    static const unsigned StructureFlags = HasStaticPropertyTable | Base::StructureFlags;
</ins><span class="cx"> 
</span><span class="cx">     static SymbolConstructor* create(VM&amp; vm, Structure* structure, SymbolPrototype* prototype, GetterSetter*)
</span><span class="cx">     {
</span><span class="lines">@@ -61,7 +61,6 @@
</span><span class="cx">     SymbolConstructor(VM&amp;, Structure*);
</span><span class="cx">     static ConstructType getConstructData(JSCell*, ConstructData&amp;);
</span><span class="cx">     static CallType getCallData(JSCell*, CallData&amp;);
</span><del>-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace JSC
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolPrototypecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/SymbolPrototype.cpp        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -65,11 +65,6 @@
</span><span class="cx">     JSC_NATIVE_FUNCTION(vm.propertyNames-&gt;toPrimitiveSymbol, symbolProtoFuncValueOf, DontEnum | ReadOnly, 1);
</span><span class="cx"> }
</span><span class="cx"> 
</span><del>-bool SymbolPrototype::getOwnPropertySlot(JSObject* object, ExecState* exec, PropertyName propertyName, PropertySlot &amp;slot)
-{
-    return getStaticFunctionSlot&lt;Base&gt;(exec, symbolPrototypeTable, jsCast&lt;SymbolPrototype*&gt;(object), propertyName, slot);
-}
-
</del><span class="cx"> // ------------------------------ Functions ---------------------------
</span><span class="cx"> 
</span><span class="cx"> static const char* SymbolToStringTypeError = &quot;Symbol.prototype.toString requires that |this| be a symbol or a symbol object&quot;;
</span></span></pre></div>
<a id="trunkSourceJavaScriptCoreruntimeSymbolPrototypeh"></a>
<div class="modfile"><h4>Modified: trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h (201447 => 201448)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h        2016-05-27 05:43:52 UTC (rev 201447)
+++ trunk/Source/JavaScriptCore/runtime/SymbolPrototype.h        2016-05-27 07:09:35 UTC (rev 201448)
</span><span class="lines">@@ -36,7 +36,7 @@
</span><span class="cx"> class SymbolPrototype : public JSNonFinalObject {
</span><span class="cx"> public:
</span><span class="cx">     typedef JSNonFinalObject Base;
</span><del>-    static const unsigned StructureFlags = Base::StructureFlags | OverridesGetOwnPropertySlot;
</del><ins>+    static const unsigned StructureFlags = Base::StructureFlags | HasStaticPropertyTable;
</ins><span class="cx"> 
</span><span class="cx">     static SymbolPrototype* create(VM&amp; vm, JSGlobalObject* globalObject, Structure* structure)
</span><span class="cx">     {
</span><span class="lines">@@ -55,9 +55,6 @@
</span><span class="cx"> protected:
</span><span class="cx">     SymbolPrototype(VM&amp;, Structure*);
</span><span class="cx">     void finishCreation(VM&amp;, JSGlobalObject*);
</span><del>-
-private:
-    static bool getOwnPropertySlot(JSObject*, ExecState*, PropertyName, PropertySlot&amp;);
</del><span class="cx"> };
</span><span class="cx"> STATIC_ASSERT_IS_TRIVIALLY_DESTRUCTIBLE(SymbolPrototype);
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>