[builtins] Move builtins into own files

R=yangguo@chromium.org
BUG=v8:5197

Review-Url: https://codereview.chromium.org/2165593002
Cr-Commit-Position: refs/heads/master@{#37885}

BUILD.gn

@@ -873,6 +873,23 @@ v8_source_set("v8_base") {
     "src/bootstrapper.cc",
     "src/bootstrapper.h",
     "src/builtins/builtins-array.cc",
+    "src/builtins/builtins-arraybuffer.cc",
+    "src/builtins/builtins-boolean.cc",
+    "src/builtins/builtins-dataview.cc",
+    "src/builtins/builtins-date.cc",
+    "src/builtins/builtins-function.cc",
+    "src/builtins/builtins-global.cc",
+    "src/builtins/builtins-internal.cc",
+    "src/builtins/builtins-json.cc",
+    "src/builtins/builtins-math.cc",
+    "src/builtins/builtins-number.cc",
+    "src/builtins/builtins-object.cc",
+    "src/builtins/builtins-proxy.cc",
+    "src/builtins/builtins-reflect.cc",
+    "src/builtins/builtins-sharedarraybuffer.cc",
+    "src/builtins/builtins-string.cc",
+    "src/builtins/builtins-symbol.cc",
+    "src/builtins/builtins-typedarray.cc",
     "src/builtins/builtins-utils.h",
     "src/builtins/builtins.cc",
     "src/builtins/builtins.h",

src/builtins/builtins-arraybuffer.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// ES6 section 21.1 ArrayBuffer Objects
+
+// ES6 section 24.1.2.1 ArrayBuffer ( length ) for the [[Call]] case.
+BUILTIN(ArrayBufferConstructor) {
+  HandleScope scope(isolate);
+  Handle<JSFunction> target = args.target<JSFunction>();
+  DCHECK(*target == target->native_context()->array_buffer_fun() ||
+         *target == target->native_context()->shared_array_buffer_fun());
+  THROW_NEW_ERROR_RETURN_FAILURE(
+      isolate, NewTypeError(MessageTemplate::kConstructorNotFunction,
+                            handle(target->shared()->name(), isolate)));
+}
+
+// ES6 section 24.1.2.1 ArrayBuffer ( length ) for the [[Construct]] case.
+BUILTIN(ArrayBufferConstructor_ConstructStub) {
+  HandleScope scope(isolate);
+  Handle<JSFunction> target = args.target<JSFunction>();
+  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+  Handle<Object> length = args.atOrUndefined(isolate, 1);
+  DCHECK(*target == target->native_context()->array_buffer_fun() ||
+         *target == target->native_context()->shared_array_buffer_fun());
+  Handle<Object> number_length;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_length,
+                                     Object::ToInteger(isolate, length));
+  if (number_length->Number() < 0.0) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kInvalidArrayBufferLength));
+  }
+  Handle<JSObject> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                     JSObject::New(target, new_target));
+  size_t byte_length;
+  if (!TryNumberToSize(isolate, *number_length, &byte_length)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kInvalidArrayBufferLength));
+  }
+  SharedFlag shared_flag =
+      (*target == target->native_context()->array_buffer_fun())
+          ? SharedFlag::kNotShared
+          : SharedFlag::kShared;
+  if (!JSArrayBuffer::SetupAllocatingData(Handle<JSArrayBuffer>::cast(result),
+                                          isolate, byte_length, true,
+                                          shared_flag)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kArrayBufferAllocationFailed));
+  }
+  return *result;
+}
+
+// ES6 section 24.1.4.1 get ArrayBuffer.prototype.byteLength
+BUILTIN(ArrayBufferPrototypeGetByteLength) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSArrayBuffer, array_buffer,
+                 "get ArrayBuffer.prototype.byteLength");
+
+  if (array_buffer->is_shared()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kIncompatibleMethodReceiver,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "get ArrayBuffer.prototype.byteLength"),
+                              args.receiver()));
+  }
+  // TODO(franzih): According to the ES6 spec, we should throw a TypeError
+  // here if the JSArrayBuffer is detached.
+  return array_buffer->byte_length();
+}
+
+// ES6 section 24.1.3.1 ArrayBuffer.isView ( arg )
+BUILTIN(ArrayBufferIsView) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(2, args.length());
+  Object* arg = args[1];
+  return isolate->heap()->ToBoolean(arg->IsJSArrayBufferView());
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-boolean.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// ES6 section 19.3 Boolean Objects
+
+// ES6 section 19.3.1.1 Boolean ( value ) for the [[Call]] case.
+BUILTIN(BooleanConstructor) {
+  HandleScope scope(isolate);
+  Handle<Object> value = args.atOrUndefined(isolate, 1);
+  return isolate->heap()->ToBoolean(value->BooleanValue());
+}
+
+// ES6 section 19.3.1.1 Boolean ( value ) for the [[Construct]] case.
+BUILTIN(BooleanConstructor_ConstructStub) {
+  HandleScope scope(isolate);
+  Handle<Object> value = args.atOrUndefined(isolate, 1);
+  Handle<JSFunction> target = args.target<JSFunction>();
+  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+  DCHECK(*target == target->native_context()->boolean_function());
+  Handle<JSObject> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                     JSObject::New(target, new_target));
+  Handle<JSValue>::cast(result)->set_value(
+      isolate->heap()->ToBoolean(value->BooleanValue()));
+  return *result;
+}
+
+// ES6 section 19.3.3.2 Boolean.prototype.toString ( )
+void Builtins::Generate_BooleanPrototypeToString(CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Node* value = assembler->ToThisValue(
+      context, receiver, PrimitiveType::kBoolean, "Boolean.prototype.toString");
+  Node* result = assembler->LoadObjectField(value, Oddball::kToStringOffset);
+  assembler->Return(result);
+}
+
+// ES6 section 19.3.3.3 Boolean.prototype.valueOf ( )
+void Builtins::Generate_BooleanPrototypeValueOf(CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Node* result = assembler->ToThisValue(
+      context, receiver, PrimitiveType::kBoolean, "Boolean.prototype.valueOf");
+  assembler->Return(result);
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-dataview.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// ES6 section 24.2 DataView Objects
+
+// ES6 section 24.2.2 The DataView Constructor for the [[Call]] case.
+BUILTIN(DataViewConstructor) {
+  HandleScope scope(isolate);
+  THROW_NEW_ERROR_RETURN_FAILURE(
+      isolate,
+      NewTypeError(MessageTemplate::kConstructorNotFunction,
+                   isolate->factory()->NewStringFromAsciiChecked("DataView")));
+}
+
+// ES6 section 24.2.2 The DataView Constructor for the [[Construct]] case.
+BUILTIN(DataViewConstructor_ConstructStub) {
+  HandleScope scope(isolate);
+  Handle<JSFunction> target = args.target<JSFunction>();
+  Handle<JSReceiver> new_target = Handle<JSReceiver>::cast(args.new_target());
+  Handle<Object> buffer = args.atOrUndefined(isolate, 1);
+  Handle<Object> byte_offset = args.atOrUndefined(isolate, 2);
+  Handle<Object> byte_length = args.atOrUndefined(isolate, 3);
+
+  // 2. If Type(buffer) is not Object, throw a TypeError exception.
+  // 3. If buffer does not have an [[ArrayBufferData]] internal slot, throw a
+  //    TypeError exception.
+  if (!buffer->IsJSArrayBuffer()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kDataViewNotArrayBuffer));
+  }
+  Handle<JSArrayBuffer> array_buffer = Handle<JSArrayBuffer>::cast(buffer);
+
+  // 4. Let numberOffset be ? ToNumber(byteOffset).
+  Handle<Object> number_offset;
+  if (byte_offset->IsUndefined(isolate)) {
+    // We intentionally violate the specification at this point to allow
+    // for new DataView(buffer) invocations to be equivalent to the full
+    // new DataView(buffer, 0) invocation.
+    number_offset = handle(Smi::FromInt(0), isolate);
+  } else {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_offset,
+                                       Object::ToNumber(byte_offset));
+  }
+
+  // 5. Let offset be ToInteger(numberOffset).
+  Handle<Object> offset;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, offset,
+                                     Object::ToInteger(isolate, number_offset));
+
+  // 6. If numberOffset ≠ offset or offset < 0, throw a RangeError exception.
+  if (number_offset->Number() != offset->Number() || offset->Number() < 0.0) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kInvalidDataViewOffset));
+  }
+
+  // 7. If IsDetachedBuffer(buffer) is true, throw a TypeError exception.
+  // We currently violate the specification at this point.
+
+  // 8. Let bufferByteLength be the value of buffer's [[ArrayBufferByteLength]]
+  // internal slot.
+  double const buffer_byte_length = array_buffer->byte_length()->Number();
+
+  // 9. If offset > bufferByteLength, throw a RangeError exception
+  if (offset->Number() > buffer_byte_length) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kInvalidDataViewOffset));
+  }
+
+  Handle<Object> view_byte_length;
+  if (byte_length->IsUndefined(isolate)) {
+    // 10. If byteLength is undefined, then
+    //       a. Let viewByteLength be bufferByteLength - offset.
+    view_byte_length =
+        isolate->factory()->NewNumber(buffer_byte_length - offset->Number());
+  } else {
+    // 11. Else,
+    //       a. Let viewByteLength be ? ToLength(byteLength).
+    //       b. If offset+viewByteLength > bufferByteLength, throw a RangeError
+    //          exception
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, view_byte_length,
+                                       Object::ToLength(isolate, byte_length));
+    if (offset->Number() + view_byte_length->Number() > buffer_byte_length) {
+      THROW_NEW_ERROR_RETURN_FAILURE(
+          isolate, NewRangeError(MessageTemplate::kInvalidDataViewLength));
+    }
+  }
+
+  // 12. Let O be ? OrdinaryCreateFromConstructor(NewTarget,
+  //     "%DataViewPrototype%", «[[DataView]], [[ViewedArrayBuffer]],
+  //     [[ByteLength]], [[ByteOffset]]»).
+  // 13. Set O's [[DataView]] internal slot to true.
+  Handle<JSObject> result;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, result,
+                                     JSObject::New(target, new_target));
+  for (int i = 0; i < ArrayBufferView::kInternalFieldCount; ++i) {
+    Handle<JSDataView>::cast(result)->SetInternalField(i, Smi::FromInt(0));
+  }
+
+  // 14. Set O's [[ViewedArrayBuffer]] internal slot to buffer.
+  Handle<JSDataView>::cast(result)->set_buffer(*array_buffer);
+
+  // 15. Set O's [[ByteLength]] internal slot to viewByteLength.
+  Handle<JSDataView>::cast(result)->set_byte_length(*view_byte_length);
+
+  // 16. Set O's [[ByteOffset]] internal slot to offset.
+  Handle<JSDataView>::cast(result)->set_byte_offset(*offset);
+
+  // 17. Return O.
+  return *result;
+}
+
+// ES6 section 24.2.4.1 get DataView.prototype.buffer
+BUILTIN(DataViewPrototypeGetBuffer) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.buffer");
+  return data_view->buffer();
+}
+
+// ES6 section 24.2.4.2 get DataView.prototype.byteLength
+BUILTIN(DataViewPrototypeGetByteLength) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.byteLength");
+  // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
+  // here if the JSArrayBuffer of the {data_view} was neutered.
+  return data_view->byte_length();
+}
+
+// ES6 section 24.2.4.3 get DataView.prototype.byteOffset
+BUILTIN(DataViewPrototypeGetByteOffset) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSDataView, data_view, "get DataView.prototype.byteOffset");
+  // TODO(bmeurer): According to the ES6 spec, we should throw a TypeError
+  // here if the JSArrayBuffer of the {data_view} was neutered.
+  return data_view->byte_offset();
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-global.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+#include "src/uri.h"
+
+namespace v8 {
+namespace internal {
+
+// ES6 section 18.2.6.2 decodeURI (encodedURI)
+BUILTIN(GlobalDecodeURI) {
+  HandleScope scope(isolate);
+  Handle<String> encoded_uri;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, encoded_uri,
+      Object::ToString(isolate, args.atOrUndefined(isolate, 1)));
+
+  RETURN_RESULT_OR_FAILURE(isolate, Uri::DecodeUri(isolate, encoded_uri));
+}
+
+// ES6 section 18.2.6.3 decodeURIComponent (encodedURIComponent)
+BUILTIN(GlobalDecodeURIComponent) {
+  HandleScope scope(isolate);
+  Handle<String> encoded_uri_component;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, encoded_uri_component,
+      Object::ToString(isolate, args.atOrUndefined(isolate, 1)));
+
+  RETURN_RESULT_OR_FAILURE(
+      isolate, Uri::DecodeUriComponent(isolate, encoded_uri_component));
+}
+
+// ES6 section 18.2.6.4 encodeURI (uri)
+BUILTIN(GlobalEncodeURI) {
+  HandleScope scope(isolate);
+  Handle<String> uri;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, uri, Object::ToString(isolate, args.atOrUndefined(isolate, 1)));
+
+  RETURN_RESULT_OR_FAILURE(isolate, Uri::EncodeUri(isolate, uri));
+}
+
+// ES6 section 18.2.6.5 encodeURIComponenet (uriComponent)
+BUILTIN(GlobalEncodeURIComponent) {
+  HandleScope scope(isolate);
+  Handle<String> uri_component;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, uri_component,
+      Object::ToString(isolate, args.atOrUndefined(isolate, 1)));
+
+  RETURN_RESULT_OR_FAILURE(isolate,
+                           Uri::EncodeUriComponent(isolate, uri_component));
+}
+
+// ES6 section B.2.1.1 escape (string)
+BUILTIN(GlobalEscape) {
+  HandleScope scope(isolate);
+  Handle<String> string;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, string,
+      Object::ToString(isolate, args.atOrUndefined(isolate, 1)));
+
+  RETURN_RESULT_OR_FAILURE(isolate, Uri::Escape(isolate, string));
+}
+
+// ES6 section B.2.1.2 unescape (string)
+BUILTIN(GlobalUnescape) {
+  HandleScope scope(isolate);
+  Handle<String> string;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, string,
+      Object::ToString(isolate, args.atOrUndefined(isolate, 1)));
+
+  RETURN_RESULT_OR_FAILURE(isolate, Uri::Unescape(isolate, string));
+}
+
+// ES6 section 18.2.1 eval (x)
+BUILTIN(GlobalEval) {
+  HandleScope scope(isolate);
+  Handle<Object> x = args.atOrUndefined(isolate, 1);
+  Handle<JSFunction> target = args.target<JSFunction>();
+  Handle<JSObject> target_global_proxy(target->global_proxy(), isolate);
+  if (!x->IsString()) return *x;
+  Handle<JSFunction> function;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, function,
+      Builtins::CompileString(handle(target->native_context(), isolate),
+                              Handle<String>::cast(x), NO_PARSE_RESTRICTION));
+  RETURN_RESULT_OR_FAILURE(
+      isolate,
+      Execution::Call(isolate, function, target_global_proxy, 0, nullptr));
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-internal.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+namespace v8 {
+namespace internal {
+
+BUILTIN(Illegal) {
+  UNREACHABLE();
+  return isolate->heap()->undefined_value();  // Make compiler happy.
+}
+
+BUILTIN(EmptyFunction) { return isolate->heap()->undefined_value(); }
+
+// -----------------------------------------------------------------------------
+// Throwers for restricted function properties and strict arguments object
+// properties
+
+BUILTIN(RestrictedFunctionPropertiesThrower) {
+  HandleScope scope(isolate);
+  THROW_NEW_ERROR_RETURN_FAILURE(
+      isolate, NewTypeError(MessageTemplate::kRestrictedFunctionProperties));
+}
+
+BUILTIN(RestrictedStrictArgumentsPropertiesThrower) {
+  HandleScope scope(isolate);
+  THROW_NEW_ERROR_RETURN_FAILURE(
+      isolate, NewTypeError(MessageTemplate::kStrictPoisonPill));
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-json.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+#include "src/json-parser.h"
+#include "src/json-stringifier.h"
+
+namespace v8 {
+namespace internal {
+
+// ES6 section 24.3.1 JSON.parse.
+BUILTIN(JsonParse) {
+  HandleScope scope(isolate);
+  Handle<Object> source = args.atOrUndefined(isolate, 1);
+  Handle<Object> reviver = args.atOrUndefined(isolate, 2);
+  Handle<String> string;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, string,
+                                     Object::ToString(isolate, source));
+  string = String::Flatten(string);
+  RETURN_RESULT_OR_FAILURE(
+      isolate, string->IsSeqOneByteString()
+                   ? JsonParser<true>::Parse(isolate, string, reviver)
+                   : JsonParser<false>::Parse(isolate, string, reviver));
+}
+
+// ES6 section 24.3.2 JSON.stringify.
+BUILTIN(JsonStringify) {
+  HandleScope scope(isolate);
+  JsonStringifier stringifier(isolate);
+  Handle<Object> object = args.atOrUndefined(isolate, 1);
+  Handle<Object> replacer = args.atOrUndefined(isolate, 2);
+  Handle<Object> indent = args.atOrUndefined(isolate, 3);
+  RETURN_RESULT_OR_FAILURE(isolate,
+                           stringifier.Stringify(object, replacer, indent));
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-number.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// ES6 section 20.1 Number Objects
+
+// ES6 section 20.1.3.2 Number.prototype.toExponential ( fractionDigits )
+BUILTIN(NumberPrototypeToExponential) {
+  HandleScope scope(isolate);
+  Handle<Object> value = args.at<Object>(0);
+  Handle<Object> fraction_digits = args.atOrUndefined(isolate, 1);
+
+  // Unwrap the receiver {value}.
+  if (value->IsJSValue()) {
+    value = handle(Handle<JSValue>::cast(value)->value(), isolate);
+  }
+  if (!value->IsNumber()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kNotGeneric,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "Number.prototype.toExponential")));
+  }
+  double const value_number = value->Number();
+
+  // Convert the {fraction_digits} to an integer first.
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, fraction_digits, Object::ToInteger(isolate, fraction_digits));
+  double const fraction_digits_number = fraction_digits->Number();
+
+  if (std::isnan(value_number)) return isolate->heap()->nan_string();
+  if (std::isinf(value_number)) {
+    return (value_number < 0.0) ? isolate->heap()->minus_infinity_string()
+                                : isolate->heap()->infinity_string();
+  }
+  if (fraction_digits_number < 0.0 || fraction_digits_number > 20.0) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kNumberFormatRange,
+                               isolate->factory()->NewStringFromAsciiChecked(
+                                   "toExponential()")));
+  }
+  int const f = args.atOrUndefined(isolate, 1)->IsUndefined(isolate)
+                    ? -1
+                    : static_cast<int>(fraction_digits_number);
+  char* const str = DoubleToExponentialCString(value_number, f);
+  Handle<String> result = isolate->factory()->NewStringFromAsciiChecked(str);
+  DeleteArray(str);
+  return *result;
+}
+
+// ES6 section 20.1.3.3 Number.prototype.toFixed ( fractionDigits )
+BUILTIN(NumberPrototypeToFixed) {
+  HandleScope scope(isolate);
+  Handle<Object> value = args.at<Object>(0);
+  Handle<Object> fraction_digits = args.atOrUndefined(isolate, 1);
+
+  // Unwrap the receiver {value}.
+  if (value->IsJSValue()) {
+    value = handle(Handle<JSValue>::cast(value)->value(), isolate);
+  }
+  if (!value->IsNumber()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kNotGeneric,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "Number.prototype.toFixed")));
+  }
+  double const value_number = value->Number();
+
+  // Convert the {fraction_digits} to an integer first.
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, fraction_digits, Object::ToInteger(isolate, fraction_digits));
+  double const fraction_digits_number = fraction_digits->Number();
+
+  // Check if the {fraction_digits} are in the supported range.
+  if (fraction_digits_number < 0.0 || fraction_digits_number > 20.0) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kNumberFormatRange,
+                               isolate->factory()->NewStringFromAsciiChecked(
+                                   "toFixed() digits")));
+  }
+
+  if (std::isnan(value_number)) return isolate->heap()->nan_string();
+  if (std::isinf(value_number)) {
+    return (value_number < 0.0) ? isolate->heap()->minus_infinity_string()
+                                : isolate->heap()->infinity_string();
+  }
+  char* const str = DoubleToFixedCString(
+      value_number, static_cast<int>(fraction_digits_number));
+  Handle<String> result = isolate->factory()->NewStringFromAsciiChecked(str);
+  DeleteArray(str);
+  return *result;
+}
+
+// ES6 section 20.1.3.4 Number.prototype.toLocaleString ( [ r1 [ , r2 ] ] )
+BUILTIN(NumberPrototypeToLocaleString) {
+  HandleScope scope(isolate);
+  Handle<Object> value = args.at<Object>(0);
+
+  // Unwrap the receiver {value}.
+  if (value->IsJSValue()) {
+    value = handle(Handle<JSValue>::cast(value)->value(), isolate);
+  }
+  if (!value->IsNumber()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kNotGeneric,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "Number.prototype.toLocaleString")));
+  }
+
+  // Turn the {value} into a String.
+  return *isolate->factory()->NumberToString(value);
+}
+
+// ES6 section 20.1.3.5 Number.prototype.toPrecision ( precision )
+BUILTIN(NumberPrototypeToPrecision) {
+  HandleScope scope(isolate);
+  Handle<Object> value = args.at<Object>(0);
+  Handle<Object> precision = args.atOrUndefined(isolate, 1);
+
+  // Unwrap the receiver {value}.
+  if (value->IsJSValue()) {
+    value = handle(Handle<JSValue>::cast(value)->value(), isolate);
+  }
+  if (!value->IsNumber()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kNotGeneric,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "Number.prototype.toPrecision")));
+  }
+  double const value_number = value->Number();
+
+  // If no {precision} was specified, just return ToString of {value}.
+  if (precision->IsUndefined(isolate)) {
+    return *isolate->factory()->NumberToString(value);
+  }
+
+  // Convert the {precision} to an integer first.
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, precision,
+                                     Object::ToInteger(isolate, precision));
+  double const precision_number = precision->Number();
+
+  if (std::isnan(value_number)) return isolate->heap()->nan_string();
+  if (std::isinf(value_number)) {
+    return (value_number < 0.0) ? isolate->heap()->minus_infinity_string()
+                                : isolate->heap()->infinity_string();
+  }
+  if (precision_number < 1.0 || precision_number > 21.0) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kToPrecisionFormatRange));
+  }
+  char* const str = DoubleToPrecisionCString(
+      value_number, static_cast<int>(precision_number));
+  Handle<String> result = isolate->factory()->NewStringFromAsciiChecked(str);
+  DeleteArray(str);
+  return *result;
+}
+
+// ES6 section 20.1.3.6 Number.prototype.toString ( [ radix ] )
+BUILTIN(NumberPrototypeToString) {
+  HandleScope scope(isolate);
+  Handle<Object> value = args.at<Object>(0);
+  Handle<Object> radix = args.atOrUndefined(isolate, 1);
+
+  // Unwrap the receiver {value}.
+  if (value->IsJSValue()) {
+    value = handle(Handle<JSValue>::cast(value)->value(), isolate);
+  }
+  if (!value->IsNumber()) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kNotGeneric,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "Number.prototype.toString")));
+  }
+  double const value_number = value->Number();
+
+  // If no {radix} was specified, just return ToString of {value}.
+  if (radix->IsUndefined(isolate)) {
+    return *isolate->factory()->NumberToString(value);
+  }
+
+  // Convert the {radix} to an integer first.
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, radix,
+                                     Object::ToInteger(isolate, radix));
+  double const radix_number = radix->Number();
+
+  // If {radix} is 10, just return ToString of {value}.
+  if (radix_number == 10.0) return *isolate->factory()->NumberToString(value);
+
+  // Make sure the {radix} is within the valid range.
+  if (radix_number < 2.0 || radix_number > 36.0) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewRangeError(MessageTemplate::kToRadixFormatRange));
+  }
+
+  // Fast case where the result is a one character string.
+  if (IsUint32Double(value_number) && value_number < radix_number) {
+    // Character array used for conversion.
+    static const char kCharTable[] = "0123456789abcdefghijklmnopqrstuvwxyz";
+    return *isolate->factory()->LookupSingleCharacterStringFromCode(
+        kCharTable[static_cast<uint32_t>(value_number)]);
+  }
+
+  // Slow case.
+  if (std::isnan(value_number)) return isolate->heap()->nan_string();
+  if (std::isinf(value_number)) {
+    return (value_number < 0.0) ? isolate->heap()->minus_infinity_string()
+                                : isolate->heap()->infinity_string();
+  }
+  char* const str =
+      DoubleToRadixCString(value_number, static_cast<int>(radix_number));
+  Handle<String> result = isolate->factory()->NewStringFromAsciiChecked(str);
+  DeleteArray(str);
+  return *result;
+}
+
+// ES6 section 20.1.3.7 Number.prototype.valueOf ( )
+void Builtins::Generate_NumberPrototypeValueOf(CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Node* result = assembler->ToThisValue(
+      context, receiver, PrimitiveType::kNumber, "Number.prototype.valueOf");
+  assembler->Return(result);
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-proxy.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+namespace v8 {
+namespace internal {
+
+// ES6 section 26.2.1.1 Proxy ( target, handler ) for the [[Call]] case.
+BUILTIN(ProxyConstructor) {
+  HandleScope scope(isolate);
+  THROW_NEW_ERROR_RETURN_FAILURE(
+      isolate,
+      NewTypeError(MessageTemplate::kConstructorNotFunction,
+                   isolate->factory()->NewStringFromAsciiChecked("Proxy")));
+}
+
+// ES6 section 26.2.1.1 Proxy ( target, handler ) for the [[Construct]] case.
+BUILTIN(ProxyConstructor_ConstructStub) {
+  HandleScope scope(isolate);
+  DCHECK(isolate->proxy_function()->IsConstructor());
+  Handle<Object> target = args.atOrUndefined(isolate, 1);
+  Handle<Object> handler = args.atOrUndefined(isolate, 2);
+  RETURN_RESULT_OR_FAILURE(isolate, JSProxy::New(isolate, target, handler));
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-symbol.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// ES6 section 19.4 Symbol Objects
+
+// ES6 section 19.4.1.1 Symbol ( [ description ] ) for the [[Call]] case.
+BUILTIN(SymbolConstructor) {
+  HandleScope scope(isolate);
+  Handle<Symbol> result = isolate->factory()->NewSymbol();
+  Handle<Object> description = args.atOrUndefined(isolate, 1);
+  if (!description->IsUndefined(isolate)) {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, description,
+                                       Object::ToString(isolate, description));
+    result->set_name(*description);
+  }
+  return *result;
+}
+
+// ES6 section 19.4.1.1 Symbol ( [ description ] ) for the [[Construct]] case.
+BUILTIN(SymbolConstructor_ConstructStub) {
+  HandleScope scope(isolate);
+  THROW_NEW_ERROR_RETURN_FAILURE(
+      isolate, NewTypeError(MessageTemplate::kNotConstructor,
+                            isolate->factory()->Symbol_string()));
+}
+
+// ES6 section 19.4.3.4 Symbol.prototype [ @@toPrimitive ] ( hint )
+void Builtins::Generate_SymbolPrototypeToPrimitive(
+    CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(4);
+
+  Node* result =
+      assembler->ToThisValue(context, receiver, PrimitiveType::kSymbol,
+                             "Symbol.prototype [ @@toPrimitive ]");
+  assembler->Return(result);
+}
+
+// ES6 section 19.4.3.2 Symbol.prototype.toString ( )
+void Builtins::Generate_SymbolPrototypeToString(CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Node* value = assembler->ToThisValue(
+      context, receiver, PrimitiveType::kSymbol, "Symbol.prototype.toString");
+  Node* result =
+      assembler->CallRuntime(Runtime::kSymbolDescriptiveString, context, value);
+  assembler->Return(result);
+}
+
+// ES6 section 19.4.3.3 Symbol.prototype.valueOf ( )
+void Builtins::Generate_SymbolPrototypeValueOf(CodeStubAssembler* assembler) {
+  typedef compiler::Node Node;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  Node* result = assembler->ToThisValue(
+      context, receiver, PrimitiveType::kSymbol, "Symbol.prototype.valueOf");
+  assembler->Return(result);
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins-typedarray.cc

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/builtins/builtins.h"
+#include "src/builtins/builtins-utils.h"
+
+namespace v8 {
+namespace internal {
+
+// -----------------------------------------------------------------------------
+// ES6 section 22.2 TypedArray Objects
+
+// ES6 section 22.2.3.1 get %TypedArray%.prototype.buffer
+BUILTIN(TypedArrayPrototypeBuffer) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSTypedArray, typed_array, "get TypedArray.prototype.buffer");
+  return *typed_array->GetBuffer();
+}
+
+namespace {
+
+void Generate_TypedArrayProtoypeGetter(CodeStubAssembler* assembler,
+                                       const char* method_name,
+                                       int object_offset) {
+  typedef CodeStubAssembler::Label Label;
+  typedef compiler::Node Node;
+
+  Node* receiver = assembler->Parameter(0);
+  Node* context = assembler->Parameter(3);
+
+  // Check if the {receiver} is actually a JSTypedArray.
+  Label if_receiverisincompatible(assembler, Label::kDeferred);
+  assembler->GotoIf(assembler->WordIsSmi(receiver), &if_receiverisincompatible);
+  Node* receiver_instance_type = assembler->LoadInstanceType(receiver);
+  assembler->GotoUnless(
+      assembler->Word32Equal(receiver_instance_type,
+                             assembler->Int32Constant(JS_TYPED_ARRAY_TYPE)),
+      &if_receiverisincompatible);
+
+  // Check if the {receiver}'s JSArrayBuffer was neutered.
+  Node* receiver_buffer =
+      assembler->LoadObjectField(receiver, JSTypedArray::kBufferOffset);
+  Node* receiver_buffer_bit_field = assembler->LoadObjectField(
+      receiver_buffer, JSArrayBuffer::kBitFieldOffset, MachineType::Uint32());
+  Label if_receiverisneutered(assembler, Label::kDeferred);
+  assembler->GotoUnless(
+      assembler->Word32Equal(
+          assembler->Word32And(
+              receiver_buffer_bit_field,
+              assembler->Int32Constant(JSArrayBuffer::WasNeutered::kMask)),
+          assembler->Int32Constant(0)),
+      &if_receiverisneutered);
+  assembler->Return(assembler->LoadObjectField(receiver, object_offset));
+
+  assembler->Bind(&if_receiverisneutered);
+  {
+    // The {receiver}s buffer was neutered, default to zero.
+    assembler->Return(assembler->SmiConstant(0));
+  }
+
+  assembler->Bind(&if_receiverisincompatible);
+  {
+    // The {receiver} is not a valid JSGeneratorObject.
+    Node* result = assembler->CallRuntime(
+        Runtime::kThrowIncompatibleMethodReceiver, context,
+        assembler->HeapConstant(assembler->factory()->NewStringFromAsciiChecked(
+            method_name, TENURED)),
+        receiver);
+    assembler->Return(result);  // Never reached.
+  }
+}
+
+}  // namespace
+
+// ES6 section 22.2.3.2 get %TypedArray%.prototype.byteLength
+void Builtins::Generate_TypedArrayPrototypeByteLength(
+    CodeStubAssembler* assembler) {
+  Generate_TypedArrayProtoypeGetter(assembler,
+                                    "get TypedArray.prototype.byteLength",
+                                    JSTypedArray::kByteLengthOffset);
+}
+
+// ES6 section 22.2.3.3 get %TypedArray%.prototype.byteOffset
+void Builtins::Generate_TypedArrayPrototypeByteOffset(
+    CodeStubAssembler* assembler) {
+  Generate_TypedArrayProtoypeGetter(assembler,
+                                    "get TypedArray.prototype.byteOffset",
+                                    JSTypedArray::kByteOffsetOffset);
+}
+
+// ES6 section 22.2.3.18 get %TypedArray%.prototype.length
+void Builtins::Generate_TypedArrayPrototypeLength(
+    CodeStubAssembler* assembler) {
+  Generate_TypedArrayProtoypeGetter(assembler,
+                                    "get TypedArray.prototype.length",
+                                    JSTypedArray::kLengthOffset);
+}
+
+}  // namespace internal
+}  // namespace v8

src/builtins/builtins.h

@@ -401,6 +401,7 @@ namespace internal {
   CPP(NumberPrototypeToString)                                               \
   /* ES6 section 20.1.3.7 Number.prototype.valueOf ( ) */                    \
   TFJ(NumberPrototypeValueOf, 1)                                             \
+                                                                             \
   /* Object */                                                               \
   CPP(ObjectAssign)                                                          \
   CPP(ObjectCreate)                                                          \
@@ -575,6 +576,10 @@ class Builtins {
   static void Generate_Adaptor(MacroAssembler* masm, Address builtin_address,
                                ExitFrameType exit_frame_type);
 
+  static MaybeHandle<JSFunction> CompileString(Handle<Context> context,
+                                               Handle<String> source,
+                                               ParseRestriction restriction);
+
  private:
   Builtins();
 

src/v8.gyp

@@ -486,7 +486,24 @@
         'bit-vector.h',
         'bootstrapper.cc',
         'bootstrapper.h',
+        'builtins/builtins-arraybuffer.cc',
         'builtins/builtins-array.cc',
+        'builtins/builtins-boolean.cc',
+        'builtins/builtins-dataview.cc',
+        'builtins/builtins-date.cc',
+        'builtins/builtins-function.cc',
+        'builtins/builtins-global.cc',
+        'builtins/builtins-internal.cc',
+        'builtins/builtins-json.cc',
+        'builtins/builtins-math.cc',
+        'builtins/builtins-number.cc',
+        'builtins/builtins-object.cc',
+        'builtins/builtins-proxy.cc',
+        'builtins/builtins-reflect.cc',
+        'builtins/builtins-sharedarraybuffer.cc',
+        'builtins/builtins-string.cc',
+        'builtins/builtins-symbol.cc',
+        'builtins/builtins-typedarray.cc',
         'builtins/builtins-utils.h',
         'builtins/builtins.cc',
         'builtins/builtins.h',