[factory] Simplify JSFunction creation

There's three common situations in which we need to create JSFunction
objects.  1) from the compiler, 2) from tests, and 3) everything else
(mostly during bootstrapping).

This is an attempt to simplify case 3), which previously relied on
several Factory::NewFunction overloads where it was not clear how the
semantics of each overload differed.

This CL removes all but one overload, and packs arguments into a new
NewFunctionArgs helper class.

It also removes the hacks around
SFI::set_lazy_deserialization_builtin_id by explicitly passing
builtin_id into Factory::NewSharedFunctionInfo.

Drive-by-fix: Properly set is_constructor hint in
SimpleCreateSharedFunctionInfo.

Bug: v8:6624
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ica94d95e72e443055db5e7ff9e8cdf4115201ef1
Reviewed-on: https://chromium-review.googlesource.com/757094
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49224}

src/api.cc

@@ -10060,34 +10060,33 @@ Local<Function> debug::GetBuiltin(Isolate* v8_isolate, Builtin builtin) {
   i::Isolate* isolate = reinterpret_cast<i::Isolate*>(v8_isolate);
   ENTER_V8_NO_SCRIPT_NO_EXCEPTION(isolate);
   i::HandleScope handle_scope(isolate);
-  i::Builtins::Name name;
+  i::Builtins::Name builtin_id;
   switch (builtin) {
     case kObjectKeys:
-      name = i::Builtins::kObjectKeys;
+      builtin_id = i::Builtins::kObjectKeys;
       break;
     case kObjectGetPrototypeOf:
-      name = i::Builtins::kObjectGetPrototypeOf;
+      builtin_id = i::Builtins::kObjectGetPrototypeOf;
       break;
     case kObjectGetOwnPropertyDescriptor:
-      name = i::Builtins::kObjectGetOwnPropertyDescriptor;
+      builtin_id = i::Builtins::kObjectGetOwnPropertyDescriptor;
       break;
     case kObjectGetOwnPropertyNames:
-      name = i::Builtins::kObjectGetOwnPropertyNames;
+      builtin_id = i::Builtins::kObjectGetOwnPropertyNames;
       break;
     case kObjectGetOwnPropertySymbols:
-      name = i::Builtins::kObjectGetOwnPropertySymbols;
+      builtin_id = i::Builtins::kObjectGetOwnPropertySymbols;
       break;
     default:
       UNREACHABLE();
   }
-  i::Handle<i::Code> call_code(isolate->builtins()->builtin(name));
-  i::Handle<i::JSFunction> fun =
-      isolate->factory()->NewFunctionWithoutPrototype(
-          isolate->factory()->empty_string(), call_code,
-          i::LanguageMode::kSloppy);
-  if (i::Builtins::IsLazy(name)) {
-    fun->shared()->set_lazy_deserialization_builtin_id(name);
-  }
+
+  i::Handle<i::String> name = isolate->factory()->empty_string();
+  i::Handle<i::Code> code(isolate->builtins()->builtin(builtin_id));
+  i::NewFunctionArgs args = i::NewFunctionArgs::ForBuiltinWithoutPrototype(
+      name, code, builtin_id, i::LanguageMode::kSloppy);
+  i::Handle<i::JSFunction> fun = isolate->factory()->NewFunction(args);
+
   fun->shared()->DontAdaptArguments();
   return Utils::ToLocal(handle_scope.CloseAndEscape(fun));
 }

src/builtins/builtins-console.cc

@@ -108,17 +108,19 @@ BUILTIN(ConsoleTimeStamp) {
 
 namespace {
 void InstallContextFunction(Handle<JSObject> target, const char* name,
-                            Builtins::Name call, int context_id,
+                            Builtins::Name builtin_id, int context_id,
                             Handle<Object> context_name) {
   Factory* const factory = target->GetIsolate()->factory();
 
-  Handle<Code> call_code(target->GetIsolate()->builtins()->builtin(call));
+  Handle<Code> code(target->GetIsolate()->builtins()->builtin(builtin_id));
 
   Handle<String> name_string =
       Name::ToFunctionName(factory->InternalizeUtf8String(name))
           .ToHandleChecked();
-  Handle<JSFunction> fun = factory->NewFunctionWithoutPrototype(
-      name_string, call_code, LanguageMode::kSloppy);
+  NewFunctionArgs args = NewFunctionArgs::ForBuiltinWithoutPrototype(
+      name_string, code, builtin_id, i::LanguageMode::kSloppy);
+  Handle<JSFunction> fun = factory->NewFunction(args);
+
   fun->shared()->set_native(true);
   fun->shared()->DontAdaptArguments();
   fun->shared()->set_length(1);
@@ -139,9 +141,13 @@ BUILTIN(ConsoleContext) {
 
   Factory* const factory = isolate->factory();
   Handle<String> name = factory->InternalizeUtf8String("Context");
-  Handle<JSFunction> cons = factory->NewFunction(name);
-  Handle<JSObject> empty = factory->NewJSObject(isolate->object_function());
-  JSFunction::SetPrototype(cons, empty);
+  NewFunctionArgs arguments = NewFunctionArgs::ForFunctionWithoutCode(
+      name, isolate->sloppy_function_map(), LanguageMode::kSloppy);
+  Handle<JSFunction> cons = factory->NewFunction(arguments);
+
+  Handle<JSObject> prototype = factory->NewJSObject(isolate->object_function());
+  JSFunction::SetPrototype(cons, prototype);
+
   Handle<JSObject> context = factory->NewJSObject(cons, TENURED);
   DCHECK(context->IsJSObject());
   int id = isolate->last_console_context_id() + 1;

src/builtins/builtins.h

@@ -48,6 +48,8 @@ class Builtins {
         builtin_count
   };
 
+  static const int32_t kNoBuiltinId = -1;
+
   static bool IsBuiltinId(int maybe_id) {
     return 0 <= maybe_id && maybe_id < builtin_count;
   }

src/factory.h

@@ -29,6 +29,7 @@ class BoilerplateDescription;
 class ConstantElementsPair;
 class CoverageInfo;
 class DebugInfo;
+class NewFunctionArgs;
 class JSModuleNamespace;
 struct SourceRange;
 class PreParsedScopeData;
@@ -621,18 +622,14 @@ class V8_EXPORT_PRIVATE Factory final {
 
   Handle<JSGlobalProxy> NewUninitializedJSGlobalProxy(int size);
 
-  Handle<JSFunction> NewFunction(Handle<Map> map,
-                                 Handle<SharedFunctionInfo> info,
-                                 Handle<Object> context_or_undefined,
-                                 PretenureFlag pretenure = TENURED);
-  Handle<JSFunction> NewFunction(
-      Handle<String> name, Handle<Code> code, Handle<Object> prototype,
-      LanguageMode language_mode = LanguageMode::kSloppy,
-      MutableMode prototype_mutability = MUTABLE);
-  Handle<JSFunction> NewFunction(Handle<String> name);
-  Handle<JSFunction> NewFunctionWithoutPrototype(
-      Handle<String> name, Handle<Code> code,
-      LanguageMode language_mode = LanguageMode::kSloppy);
+  // Creates a new JSFunction according to the given args. This is the function
+  // you'll probably want to use when creating a JSFunction from the runtime.
+  Handle<JSFunction> NewFunction(const NewFunctionArgs& args);
+
+  // For testing only. Creates a sloppy function without code.
+  Handle<JSFunction> NewFunctionForTest(Handle<String> name);
+
+  // Function creation from SharedFunctionInfo.
 
   Handle<JSFunction> NewFunctionFromSharedFunctionInfo(
       Handle<Map> initial_map, Handle<SharedFunctionInfo> function_info,
@@ -651,16 +648,12 @@ class V8_EXPORT_PRIVATE Factory final {
       Handle<SharedFunctionInfo> function_info, Handle<Context> context,
       PretenureFlag pretenure = TENURED);
 
-  Handle<JSFunction> NewFunction(
-      Handle<String> name, Handle<Code> code, Handle<Object> prototype,
-      InstanceType type, int instance_size, int inobject_properties,
-      LanguageMode language_mode = LanguageMode::kSloppy,
-      MutableMode prototype_mutability = MUTABLE);
-  Handle<JSFunction> NewFunction(Handle<String> name, Handle<Code> code,
-                                 InstanceType type, int instance_size,
-                                 int inobject_properties);
-  Handle<JSFunction> NewFunction(Handle<Map> map, Handle<String> name,
-                                 MaybeHandle<Code> maybe_code);
+  // The choke-point for JSFunction creation. Handles allocation and
+  // initialization. All other utility methods call into this.
+  Handle<JSFunction> NewFunction(Handle<Map> map,
+                                 Handle<SharedFunctionInfo> info,
+                                 Handle<Object> context_or_undefined,
+                                 PretenureFlag pretenure = TENURED);
 
   // Create a serialized scope info.
   Handle<ScopeInfo> NewScopeInfo(int length);
@@ -768,7 +761,8 @@ class V8_EXPORT_PRIVATE Factory final {
       Handle<ScopeInfo> scope_info);
   Handle<SharedFunctionInfo> NewSharedFunctionInfo(
       MaybeHandle<String> name, MaybeHandle<Code> code, bool is_constructor,
-      FunctionKind kind = kNormalFunction);
+      FunctionKind kind = kNormalFunction,
+      int maybe_builtin_index = Builtins::kNoBuiltinId);
 
   Handle<SharedFunctionInfo> NewSharedFunctionInfoForLiteral(
       FunctionLiteral* literal, Handle<Script> script);
@@ -875,6 +869,59 @@ class V8_EXPORT_PRIVATE Factory final {
                              PretenureFlag pretenure = NOT_TENURED);
 };
 
+// Utility class to simplify argument handling around JSFunction creation.
+class NewFunctionArgs final {
+ public:
+  static NewFunctionArgs ForWasm(Handle<String> name, Handle<Code> code,
+                                 Handle<Map> map);
+  static NewFunctionArgs ForBuiltin(Handle<String> name, Handle<Code> code,
+                                    Handle<Map> map, int builtin_id);
+  static NewFunctionArgs ForFunctionWithoutCode(Handle<String> name,
+                                                Handle<Map> map,
+                                                LanguageMode language_mode);
+  static NewFunctionArgs ForBuiltinWithPrototype(
+      Handle<String> name, Handle<Code> code, Handle<Object> prototype,
+      InstanceType type, int instance_size, int inobject_properties,
+      int builtin_id, MutableMode prototype_mutability);
+  static NewFunctionArgs ForBuiltinWithoutPrototype(Handle<String> name,
+                                                    Handle<Code> code,
+                                                    int builtin_id,
+                                                    LanguageMode language_mode);
+
+  Handle<Map> GetMap(Isolate* isolate) const;
+
+ private:
+  NewFunctionArgs() {}  // Use the static factory constructors.
+
+  void SetShouldCreateAndSetInitialMap();
+  void SetShouldSetPrototype();
+  void SetShouldSetLanguageMode();
+
+  // Sentinel value.
+  static const int kUninitialized = -1;
+
+  Handle<String> name_;
+  MaybeHandle<Map> maybe_map_;
+  MaybeHandle<Code> maybe_code_;
+
+  bool should_create_and_set_initial_map_ = false;
+  InstanceType type_;
+  int instance_size_ = kUninitialized;
+  int inobject_properties_ = kUninitialized;
+
+  bool should_set_prototype_ = false;
+  MaybeHandle<Object> maybe_prototype_;
+
+  bool should_set_language_mode_ = false;
+  LanguageMode language_mode_;
+
+  int maybe_builtin_id_ = kUninitialized;
+
+  MutableMode prototype_mutability_;
+
+  friend class Factory;
+};
+
 }  // namespace internal
 }  // namespace v8
 

src/objects/shared-function-info-inl.h

@@ -320,14 +320,6 @@ int SharedFunctionInfo::lazy_deserialization_builtin_id() const {
   return id;
 }
 
-void SharedFunctionInfo::set_lazy_deserialization_builtin_id(int builtin_id) {
-  DCHECK(function_data()->IsUndefined(GetIsolate()) ||
-         HasLazyDeserializationBuiltinId());
-  DCHECK(Builtins::IsBuiltinId(builtin_id));
-  DCHECK(Builtins::IsLazy(builtin_id));
-  set_function_data(Smi::FromInt(builtin_id));
-}
-
 bool SharedFunctionInfo::HasBuiltinFunctionId() {
   return function_identifier()->IsSmi();
 }

src/objects/shared-function-info.h

@@ -165,7 +165,6 @@ class SharedFunctionInfo : public HeapObject {
   // mainly used during optimization).
   inline bool HasLazyDeserializationBuiltinId() const;
   inline int lazy_deserialization_builtin_id() const;
-  inline void set_lazy_deserialization_builtin_id(int builtin_id);
 
   // [function identifier]: This field holds an additional identifier for the
   // function.

src/wasm/wasm-debug.cc

@@ -782,8 +782,9 @@ Handle<JSFunction> WasmDebugInfo::GetCWasmEntry(
         isolate->factory()->NewSharedFunctionInfo(name, new_entry_code, false);
     shared->set_internal_formal_parameter_count(
         compiler::CWasmEntryParameters::kNumParameters);
-    Handle<JSFunction> new_entry = isolate->factory()->NewFunction(
-        isolate->sloppy_function_map(), name, new_entry_code);
+    NewFunctionArgs args = NewFunctionArgs::ForWasm(
+        name, new_entry_code, isolate->sloppy_function_map());
+    Handle<JSFunction> new_entry = isolate->factory()->NewFunction(args);
     new_entry->set_context(
         *debug_info->wasm_instance()->compiled_module()->native_context());
     new_entry->set_shared(*shared);

src/wasm/wasm-js.cc

@@ -871,8 +871,9 @@ void WasmJs::Install(Isolate* isolate, bool exposed_on_global_object) {
 
   // Setup WebAssembly
   Handle<String> name = v8_str(isolate, "WebAssembly");
-  Handle<JSFunction> cons = factory->NewFunction(isolate->strict_function_map(),
-                                                 name, MaybeHandle<Code>());
+  NewFunctionArgs args = NewFunctionArgs::ForFunctionWithoutCode(
+      name, isolate->strict_function_map(), LanguageMode::kStrict);
+  Handle<JSFunction> cons = factory->NewFunction(args);
   JSFunction::SetPrototype(cons, isolate->initial_object_prototype());
   cons->shared()->set_instance_class_name(*name);
   Handle<JSObject> webassembly = factory->NewJSObject(cons, TENURED);

src/wasm/wasm-objects.cc

@@ -658,8 +658,9 @@ Handle<WasmExportedFunction> WasmExportedFunction::New(
       isolate->factory()->NewSharedFunctionInfo(name, export_wrapper, false);
   shared->set_length(arity);
   shared->set_internal_formal_parameter_count(arity);
-  Handle<JSFunction> js_function = isolate->factory()->NewFunction(
-      isolate->sloppy_function_map(), name, export_wrapper);
+  NewFunctionArgs args = NewFunctionArgs::ForWasm(
+      name, export_wrapper, isolate->sloppy_function_map());
+  Handle<JSFunction> js_function = isolate->factory()->NewFunction(args);
 
   js_function->set_shared(*shared);
   Handle<Symbol> instance_symbol(isolate->factory()->wasm_instance_symbol());

test/cctest/heap/test-alloc.cc

@@ -139,8 +139,8 @@ TEST(StressJS) {
   v8::HandleScope scope(CcTest::isolate());
   v8::Local<v8::Context> env = v8::Context::New(CcTest::isolate());
   env->Enter();
-  Handle<JSFunction> function = factory->NewFunction(
-      factory->function_string());
+  Handle<JSFunction> function =
+      factory->NewFunctionForTest(factory->function_string());
   // Force the creation of an initial map and set the code to
   // something empty.
   factory->NewJSObject(function);

test/cctest/heap/test-heap.cc

@@ -361,7 +361,7 @@ TEST(GarbageCollection) {
   {
     HandleScope inner_scope(isolate);
     // Allocate a function and keep it in global object's property.
-    Handle<JSFunction> function = factory->NewFunction(name);
+    Handle<JSFunction> function = factory->NewFunctionForTest(name);
     JSReceiver::SetProperty(global, name, function, LanguageMode::kSloppy)
         .Check();
     // Allocate an object.  Unrooted after leaving the scope.
@@ -927,7 +927,7 @@ TEST(FunctionAllocation) {
 
   v8::HandleScope sc(CcTest::isolate());
   Handle<String> name = factory->InternalizeUtf8String("theFunction");
-  Handle<JSFunction> function = factory->NewFunction(name);
+  Handle<JSFunction> function = factory->NewFunctionForTest(name);
 
   Handle<Smi> twenty_three(Smi::FromInt(23), isolate);
   Handle<Smi> twenty_four(Smi::FromInt(24), isolate);
@@ -1029,7 +1029,7 @@ TEST(JSObjectMaps) {
 
   v8::HandleScope sc(CcTest::isolate());
   Handle<String> name = factory->InternalizeUtf8String("theFunction");
-  Handle<JSFunction> function = factory->NewFunction(name);
+  Handle<JSFunction> function = factory->NewFunctionForTest(name);
 
   Handle<String> prop_name = factory->InternalizeUtf8String("theSlot");
   Handle<JSObject> obj = factory->NewJSObject(function);

test/cctest/heap/test-mark-compact.cc

@@ -129,7 +129,7 @@ HEAP_TEST(MarkCompactCollector) {
   { HandleScope scope(isolate);
     // allocate a garbage
     Handle<String> func_name = factory->InternalizeUtf8String("theFunction");
-    Handle<JSFunction> function = factory->NewFunction(func_name);
+    Handle<JSFunction> function = factory->NewFunctionForTest(func_name);
     JSReceiver::SetProperty(global, func_name, function, LanguageMode::kSloppy)
         .Check();
 

test/cctest/interpreter/test-interpreter.cc

@@ -2118,7 +2118,7 @@ TEST(InterpreterInstanceOf) {
   Zone* zone = handles.main_zone();
   Factory* factory = isolate->factory();
   Handle<i::String> name = factory->NewStringFromAsciiChecked("cons");
-  Handle<i::JSFunction> func = factory->NewFunction(name);
+  Handle<i::JSFunction> func = factory->NewFunctionForTest(name);
   Handle<i::JSObject> instance = factory->NewJSObject(func);
   Handle<i::Object> other = factory->NewNumber(3.3333);
   Handle<i::Object> cases[] = {Handle<i::Object>::cast(instance), other};

test/cctest/test-code-stub-assembler.cc

@@ -891,7 +891,8 @@ TEST(TryHasOwnProperty) {
 
   {
     // Dictionary mode object.
-    Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+    Handle<JSFunction> function =
+        factory->NewFunctionForTest(factory->empty_string());
     Handle<JSObject> object = factory->NewJSObject(function);
     AddProperties(object, names, arraysize(names));
     JSObject::NormalizeProperties(object, CLEAR_INOBJECT_PROPERTIES, 0, "test");
@@ -908,7 +909,8 @@ TEST(TryHasOwnProperty) {
 
   {
     // Global object.
-    Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+    Handle<JSFunction> function =
+        factory->NewFunctionForTest(factory->empty_string());
     JSFunction::EnsureHasInitialMap(function);
     function->initial_map()->set_instance_type(JS_GLOBAL_OBJECT_TYPE);
     function->initial_map()->set_is_prototype_map(true);
@@ -958,7 +960,8 @@ TEST(TryHasOwnProperty) {
   }
 
   {
-    Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+    Handle<JSFunction> function =
+        factory->NewFunctionForTest(factory->empty_string());
     Handle<JSProxy> object = factory->NewJSProxy(function, objects[0]);
     CHECK_EQ(JS_PROXY_TYPE, object->map()->instance_type());
     ft.CheckTrue(object, names[0], expect_bailout);
@@ -1031,11 +1034,11 @@ TEST(TryGetOwnProperty) {
       factory->NewPrivateSymbol(),
   };
   Handle<Object> values[] = {
-      factory->NewFunction(factory->empty_string()),
+      factory->NewFunctionForTest(factory->empty_string()),
       factory->NewSymbol(),
       factory->InternalizeUtf8String("a"),
       CreateAccessorPair(&ft, "() => 188;", "() => 199;"),
-      factory->NewFunction(factory->InternalizeUtf8String("bb")),
+      factory->NewFunctionForTest(factory->InternalizeUtf8String("bb")),
       factory->InternalizeUtf8String("ccc"),
       CreateAccessorPair(&ft, "() => 88;", nullptr),
       handle(Smi::FromInt(1), isolate),
@@ -1043,7 +1046,8 @@ TEST(TryGetOwnProperty) {
       CreateAccessorPair(&ft, nullptr, "() => 99;"),
       factory->NewHeapNumber(4.2),
       handle(Smi::FromInt(153), isolate),
-      factory->NewJSObject(factory->NewFunction(factory->empty_string())),
+      factory->NewJSObject(
+          factory->NewFunctionForTest(factory->empty_string())),
       factory->NewPrivateSymbol(),
   };
   STATIC_ASSERT(arraysize(values) < arraysize(names));
@@ -1093,7 +1097,8 @@ TEST(TryGetOwnProperty) {
 
   {
     // Dictionary mode object.
-    Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+    Handle<JSFunction> function =
+        factory->NewFunctionForTest(factory->empty_string());
     Handle<JSObject> object = factory->NewJSObject(function);
     AddProperties(object, names, arraysize(names), values, arraysize(values),
                   rand_gen.NextInt());
@@ -1163,7 +1168,8 @@ TEST(TryGetOwnProperty) {
   }
 
   {
-    Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+    Handle<JSFunction> function =
+        factory->NewFunctionForTest(factory->empty_string());
     Handle<JSProxy> object = factory->NewJSProxy(function, objects[0]);
     CHECK_EQ(JS_PROXY_TYPE, object->map()->instance_type());
     Handle<Object> value = ft.Call(object, names[0]).ToHandleChecked();
@@ -1395,7 +1401,8 @@ TEST(TryLookupElement) {
 
   {
     Handle<JSArray> handler = factory->NewJSArray(0);
-    Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+    Handle<JSFunction> function =
+        factory->NewFunctionForTest(factory->empty_string());
     Handle<JSProxy> object = factory->NewJSProxy(function, handler);
     CHECK_EQ(JS_PROXY_TYPE, object->map()->instance_type());
     ft.CheckTrue(object, smi0, expect_bailout);

test/cctest/test-elements-kind.cc

@@ -75,7 +75,8 @@ TEST(JSObjectAddingProperties) {
 
   Handle<FixedArray> empty_fixed_array(factory->empty_fixed_array());
   Handle<PropertyArray> empty_property_array(factory->empty_property_array());
-  Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+  Handle<JSFunction> function =
+      factory->NewFunctionForTest(factory->empty_string());
   Handle<Object> value(Smi::FromInt(42), isolate);
 
   Handle<JSObject> object = factory->NewJSObject(function);
@@ -104,7 +105,8 @@ TEST(JSObjectInObjectAddingProperties) {
 
   Handle<FixedArray> empty_fixed_array(factory->empty_fixed_array());
   Handle<PropertyArray> empty_property_array(factory->empty_property_array());
-  Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+  Handle<JSFunction> function =
+      factory->NewFunctionForTest(factory->empty_string());
   int nof_inobject_properties = 10;
   // force in object properties by changing the expected_nof_properties
   function->shared()->set_expected_nof_properties(nof_inobject_properties);
@@ -151,7 +153,8 @@ TEST(JSObjectAddingElements) {
   Handle<String> name;
   Handle<FixedArray> empty_fixed_array(factory->empty_fixed_array());
   Handle<PropertyArray> empty_property_array(factory->empty_property_array());
-  Handle<JSFunction> function = factory->NewFunction(factory->empty_string());
+  Handle<JSFunction> function =
+      factory->NewFunctionForTest(factory->empty_string());
   Handle<Object> value(Smi::FromInt(42), isolate);
 
   Handle<JSObject> object = factory->NewJSObject(function);

test/cctest/test-field-type-tracking.cc

@@ -66,11 +66,11 @@ static Handle<AccessorPair> CreateAccessorPair(bool with_getter,
   Handle<AccessorPair> pair = factory->NewAccessorPair();
   Handle<String> empty_string = factory->empty_string();
   if (with_getter) {
-    Handle<JSFunction> func = factory->NewFunction(empty_string);
+    Handle<JSFunction> func = factory->NewFunctionForTest(empty_string);
     pair->set_getter(*func);
   }
   if (with_setter) {
-    Handle<JSFunction> func = factory->NewFunction(empty_string);
+    Handle<JSFunction> func = factory->NewFunctionForTest(empty_string);
     pair->set_setter(*func);
   }
   return pair;
@@ -1484,7 +1484,7 @@ TEST(ReconfigureDataFieldAttribute_SameDataConstantAfterTargetMap) {
     TestConfig() {
       Isolate* isolate = CcTest::i_isolate();
       Factory* factory = isolate->factory();
-      js_func_ = factory->NewFunction(factory->empty_string());
+      js_func_ = factory->NewFunctionForTest(factory->empty_string());
     }
 
     Handle<Map> AddPropertyAtBranch(int branch_id, Expectations& expectations,
@@ -1570,7 +1570,7 @@ TEST(ReconfigureDataFieldAttribute_DataConstantToAccConstantAfterTargetMap) {
     TestConfig() {
       Isolate* isolate = CcTest::i_isolate();
       Factory* factory = isolate->factory();
-      js_func_ = factory->NewFunction(factory->empty_string());
+      js_func_ = factory->NewFunctionForTest(factory->empty_string());
       pair_ = CreateAccessorPair(true, true);
     }
 
@@ -2641,7 +2641,8 @@ TEST(TransitionDataConstantToSameDataConstant) {
   Isolate* isolate = CcTest::i_isolate();
   Factory* factory = isolate->factory();
 
-  Handle<JSFunction> js_func = factory->NewFunction(factory->empty_string());
+  Handle<JSFunction> js_func =
+      factory->NewFunctionForTest(factory->empty_string());
   TransitionToDataConstantOperator transition_op(js_func);
 
   SameMapChecker checker;
@@ -2688,7 +2689,8 @@ TEST(TransitionDataConstantToDataField) {
   Factory* factory = isolate->factory();
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
-  Handle<JSFunction> js_func1 = factory->NewFunction(factory->empty_string());
+  Handle<JSFunction> js_func1 =
+      factory->NewFunctionForTest(factory->empty_string());
   TransitionToDataConstantOperator transition_op1(js_func1);
 
   Handle<Object> value2 = isolate->factory()->NewHeapNumber(0);

test/cctest/test-weakmaps.cc

@@ -168,8 +168,8 @@ TEST(Regress2060a) {
   Factory* factory = isolate->factory();
   Heap* heap = isolate->heap();
   HandleScope scope(isolate);
-  Handle<JSFunction> function = factory->NewFunction(
-      factory->function_string());
+  Handle<JSFunction> function =
+      factory->NewFunctionForTest(factory->function_string());
   Handle<JSObject> key = factory->NewJSObject(function);
   Handle<JSWeakMap> weakmap = AllocateJSWeakMap(isolate);
 
@@ -209,8 +209,8 @@ TEST(Regress2060b) {
   Factory* factory = isolate->factory();
   Heap* heap = isolate->heap();
   HandleScope scope(isolate);
-  Handle<JSFunction> function = factory->NewFunction(
-      factory->function_string());
+  Handle<JSFunction> function =
+      factory->NewFunctionForTest(factory->function_string());
 
   // Start second old-space page so that keys land on evacuation candidate.
   Page* first_page = heap->old_space()->anchor()->next_page();

test/cctest/test-weaksets.cc

@@ -167,8 +167,8 @@ TEST(WeakSet_Regress2060a) {
   Factory* factory = isolate->factory();
   Heap* heap = isolate->heap();
   HandleScope scope(isolate);
-  Handle<JSFunction> function = factory->NewFunction(
-      factory->function_string());
+  Handle<JSFunction> function =
+      factory->NewFunctionForTest(factory->function_string());
   Handle<JSObject> key = factory->NewJSObject(function);
   Handle<JSWeakSet> weakset = AllocateJSWeakSet(isolate);
 
@@ -208,8 +208,8 @@ TEST(WeakSet_Regress2060b) {
   Factory* factory = isolate->factory();
   Heap* heap = isolate->heap();
   HandleScope scope(isolate);
-  Handle<JSFunction> function = factory->NewFunction(
-      factory->function_string());
+  Handle<JSFunction> function =
+      factory->NewFunctionForTest(factory->function_string());
 
   // Start second old-space page so that keys land on evacuation candidate.
   Page* first_page = heap->old_space()->anchor()->next_page();