Clean up native context slots and add new ones.

Newly added native context slots are used to avoid accessing
the js builtins object to get native functions.

R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1294583006

Cr-Commit-Position: refs/heads/master@{#30181}

include/v8.h

@@ -6937,7 +6937,7 @@ class Internals {
   static const int kJSObjectHeaderSize = 3 * kApiPointerSize;
   static const int kFixedArrayHeaderSize = 2 * kApiPointerSize;
   static const int kContextHeaderSize = 2 * kApiPointerSize;
-  static const int kContextEmbedderDataIndex = 83;
+  static const int kContextEmbedderDataIndex = 27;
   static const int kFullStringRepresentationMask = 0x07;
   static const int kStringEncodingMask = 0x4;
   static const int kExternalTwoByteRepresentationTag = 0x02;

src/api.cc

@@ -2813,34 +2813,23 @@ bool Value::IsUint32() const {
 }
 
 
-static bool CheckConstructor(i::Isolate* isolate,
-                             i::Handle<i::JSObject> obj,
-                             const char* class_name) {
-  i::Handle<i::Object> constr(obj->map()->GetConstructor(), isolate);
-  if (!constr->IsJSFunction()) return false;
-  i::Handle<i::JSFunction> func = i::Handle<i::JSFunction>::cast(constr);
-  return func->shared()->native() && constr.is_identical_to(
-      i::Object::GetProperty(isolate,
-                             isolate->js_builtins_object(),
-                             class_name).ToHandleChecked());
-}
-
-
 bool Value::IsNativeError() const {
   i::Handle<i::Object> obj = Utils::OpenHandle(this);
-  if (obj->IsJSObject()) {
-    i::Handle<i::JSObject> js_obj(i::JSObject::cast(*obj));
-    i::Isolate* isolate = js_obj->GetIsolate();
-    return CheckConstructor(isolate, js_obj, "$Error") ||
-        CheckConstructor(isolate, js_obj, "$EvalError") ||
-        CheckConstructor(isolate, js_obj, "$RangeError") ||
-        CheckConstructor(isolate, js_obj, "$ReferenceError") ||
-        CheckConstructor(isolate, js_obj, "$SyntaxError") ||
-        CheckConstructor(isolate, js_obj, "$TypeError") ||
-        CheckConstructor(isolate, js_obj, "$URIError");
-  } else {
-    return false;
-  }
+  if (!obj->IsJSObject()) return false;
+  i::Handle<i::JSObject> js_obj = i::Handle<i::JSObject>::cast(obj);
+  i::Isolate* isolate = js_obj->GetIsolate();
+  i::Handle<i::Object> constructor(js_obj->map()->GetConstructor(), isolate);
+  if (!constructor->IsJSFunction()) return false;
+  i::Handle<i::JSFunction> function =
+      i::Handle<i::JSFunction>::cast(constructor);
+  if (!function->shared()->native()) return false;
+  return function.is_identical_to(isolate->error_function()) ||
+         function.is_identical_to(isolate->eval_error_function()) ||
+         function.is_identical_to(isolate->range_error_function()) ||
+         function.is_identical_to(isolate->reference_error_function()) ||
+         function.is_identical_to(isolate->syntax_error_function()) ||
+         function.is_identical_to(isolate->type_error_function()) ||
+         function.is_identical_to(isolate->uri_error_function());
 }
 
 
@@ -7640,26 +7629,27 @@ String::Value::~Value() {
 }
 
 
-#define DEFINE_ERROR(NAME)                                            \
-  Local<Value> Exception::NAME(v8::Local<v8::String> raw_message) {   \
-    i::Isolate* isolate = i::Isolate::Current();                      \
-    LOG_API(isolate, #NAME);                                          \
-    ENTER_V8(isolate);                                                \
-    i::Object* error;                                                 \
-    {                                                                 \
-      i::HandleScope scope(isolate);                                  \
-      i::Handle<i::String> message = Utils::OpenHandle(*raw_message); \
-      error = *isolate->factory()->NewError("$" #NAME, message);      \
-    }                                                                 \
-    i::Handle<i::Object> result(error, isolate);                      \
-    return Utils::ToLocal(result);                                    \
-  }
-
-DEFINE_ERROR(RangeError)
-DEFINE_ERROR(ReferenceError)
-DEFINE_ERROR(SyntaxError)
-DEFINE_ERROR(TypeError)
-DEFINE_ERROR(Error)
+#define DEFINE_ERROR(NAME, name)                                         \
+  Local<Value> Exception::NAME(v8::Local<v8::String> raw_message) {      \
+    i::Isolate* isolate = i::Isolate::Current();                         \
+    LOG_API(isolate, #NAME);                                             \
+    ENTER_V8(isolate);                                                   \
+    i::Object* error;                                                    \
+    {                                                                    \
+      i::HandleScope scope(isolate);                                     \
+      i::Handle<i::String> message = Utils::OpenHandle(*raw_message);    \
+      i::Handle<i::JSFunction> constructor = isolate->name##_function(); \
+      error = *isolate->factory()->NewError(constructor, message);       \
+    }                                                                    \
+    i::Handle<i::Object> result(error, isolate);                         \
+    return Utils::ToLocal(result);                                       \
+  }
+
+DEFINE_ERROR(RangeError, range_error)
+DEFINE_ERROR(ReferenceError, reference_error)
+DEFINE_ERROR(SyntaxError, syntax_error)
+DEFINE_ERROR(TypeError, type_error)
+DEFINE_ERROR(Error, error)
 
 #undef DEFINE_ERROR
 

src/bootstrapper.cc

@@ -1148,12 +1148,8 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> global_object,
 
   {  // --- D a t e ---
     // Builtin functions for Date.prototype.
-    Handle<JSFunction> date_fun =
-        InstallFunction(global, "Date", JS_DATE_TYPE, JSDate::kSize,
-                        isolate->initial_object_prototype(),
-                        Builtins::kIllegal);
-
-    native_context()->set_date_function(*date_fun);
+    InstallFunction(global, "Date", JS_DATE_TYPE, JSDate::kSize,
+                    isolate->initial_object_prototype(), Builtins::kIllegal);
   }
 
 
@@ -1255,7 +1251,18 @@ void Genesis::InitializeGlobal(Handle<GlobalObject> global_object,
     Handle<JSObject> json_object = factory->NewJSObject(cons, TENURED);
     DCHECK(json_object->IsJSObject());
     JSObject::AddProperty(global, name, json_object, DONT_ENUM);
-    native_context()->set_json_object(*json_object);
+  }
+
+  {  // -- M a t h
+    Handle<String> name = factory->InternalizeUtf8String("Math");
+    Handle<JSFunction> cons = factory->NewFunction(name);
+    JSFunction::SetInstancePrototype(
+        cons,
+        Handle<Object>(native_context()->initial_object_prototype(), isolate));
+    cons->SetInstanceClassName(*name);
+    Handle<JSObject> json_object = factory->NewJSObject(cons, TENURED);
+    DCHECK(json_object->IsJSObject());
+    JSObject::AddProperty(global, name, json_object, DONT_ENUM);
   }
 
   {  // -- A r r a y B u f f e r
@@ -1766,6 +1773,8 @@ void Bootstrapper::ImportNatives(Isolate* isolate, Handle<JSObject> container) {
   INSTALL_NATIVE(JSFunction, "ToNumber", to_number_fun);
   INSTALL_NATIVE(JSFunction, "ToString", to_string_fun);
   INSTALL_NATIVE(JSFunction, "ToDetailString", to_detail_string_fun);
+  INSTALL_NATIVE(JSFunction, "NoSideEffectToString",
+                 no_side_effect_to_string_fun);
   INSTALL_NATIVE(JSFunction, "ToInteger", to_integer_fun);
   INSTALL_NATIVE(JSFunction, "ToLength", to_length_fun);
 
@@ -1773,6 +1782,15 @@ void Bootstrapper::ImportNatives(Isolate* isolate, Handle<JSObject> container) {
   INSTALL_NATIVE(JSFunction, "GetStackTraceLine", get_stack_trace_line_fun);
   INSTALL_NATIVE(JSFunction, "ToCompletePropertyDescriptor",
                  to_complete_property_descriptor);
+  INSTALL_NATIVE(JSFunction, "JsonSerializeAdapter", json_serialize_adapter);
+
+  INSTALL_NATIVE(JSFunction, "Error", error_function);
+  INSTALL_NATIVE(JSFunction, "EvalError", eval_error_function);
+  INSTALL_NATIVE(JSFunction, "RangeError", range_error_function);
+  INSTALL_NATIVE(JSFunction, "ReferenceError", reference_error_function);
+  INSTALL_NATIVE(JSFunction, "SyntaxError", syntax_error_function);
+  INSTALL_NATIVE(JSFunction, "TypeError", type_error_function);
+  INSTALL_NATIVE(JSFunction, "URIError", uri_error_function);
 
   INSTALL_NATIVE(Symbol, "promiseStatus", promise_status);
   INSTALL_NATIVE(Symbol, "promiseValue", promise_value);
@@ -1782,6 +1800,8 @@ void Bootstrapper::ImportNatives(Isolate* isolate, Handle<JSObject> container) {
   INSTALL_NATIVE(JSFunction, "PromiseChain", promise_chain);
   INSTALL_NATIVE(JSFunction, "PromiseCatch", promise_catch);
   INSTALL_NATIVE(JSFunction, "PromiseThen", promise_then);
+  INSTALL_NATIVE(JSFunction, "PromiseHasUserDefinedRejectHandler",
+                 promise_has_user_defined_reject_handler);
 
   INSTALL_NATIVE(JSFunction, "ObserveNotifyChange", observers_notify_change);
   INSTALL_NATIVE(JSFunction, "ObserveEnqueueSpliceRecord",

src/contexts.h

@@ -94,15 +94,16 @@ enum BindingFlags {
   V(ARRAY_FUNCTION_INDEX, JSFunction, array_function)                          \
   V(JS_ARRAY_MAPS_INDEX, Object, js_array_maps)                                \
   V(JS_ARRAY_STRONG_MAPS_INDEX, Object, js_array_strong_maps)                  \
-  V(DATE_FUNCTION_INDEX, JSFunction, date_function)                            \
-  V(JSON_OBJECT_INDEX, JSObject, json_object)                                  \
   V(REGEXP_FUNCTION_INDEX, JSFunction, regexp_function)                        \
   V(INITIAL_OBJECT_PROTOTYPE_INDEX, JSObject, initial_object_prototype)        \
   V(INITIAL_ARRAY_PROTOTYPE_INDEX, JSObject, initial_array_prototype)          \
+  V(EMBEDDER_DATA_INDEX, FixedArray, embedder_data)                            \
   V(CREATE_DATE_FUN_INDEX, JSFunction, create_date_fun)                        \
   V(TO_NUMBER_FUN_INDEX, JSFunction, to_number_fun)                            \
   V(TO_STRING_FUN_INDEX, JSFunction, to_string_fun)                            \
   V(TO_DETAIL_STRING_FUN_INDEX, JSFunction, to_detail_string_fun)              \
+  V(NO_SIDE_EFFECT_TO_STRING_FUN_INDEX, JSFunction,                            \
+    no_side_effect_to_string_fun)                                              \
   V(TO_INTEGER_FUN_INDEX, JSFunction, to_integer_fun)                          \
   V(TO_LENGTH_FUN_INDEX, JSFunction, to_length_fun)                            \
   V(GLOBAL_EVAL_FUN_INDEX, JSFunction, global_eval_fun)                        \
@@ -136,9 +137,7 @@ enum BindingFlags {
   V(SLOW_ALIASED_ARGUMENTS_MAP_INDEX, Map, slow_aliased_arguments_map)         \
   V(STRICT_ARGUMENTS_MAP_INDEX, Map, strict_arguments_map)                     \
   V(MESSAGE_LISTENERS_INDEX, JSObject, message_listeners)                      \
-  V(MAKE_MESSAGE_FUN_INDEX, JSFunction, make_message_fun)                      \
   V(GET_STACK_TRACE_LINE_INDEX, JSFunction, get_stack_trace_line_fun)          \
-  V(CONFIGURE_GLOBAL_INDEX, JSFunction, configure_global_fun)                  \
   V(FUNCTION_CACHE_INDEX, ObjectHashTable, function_cache)                     \
   V(NORMALIZED_MAP_CACHE_INDEX, Object, normalized_map_cache)                  \
   V(RUNTIME_CONTEXT_INDEX, Context, runtime_context)                           \
@@ -150,10 +149,16 @@ enum BindingFlags {
   V(CONTEXT_EXTENSION_FUNCTION_INDEX, JSFunction, context_extension_function)  \
   V(MAP_CACHE_INDEX, Object, map_cache)                                        \
   V(STRONG_MAP_CACHE_INDEX, Object, strong_map_cache)                          \
-  V(EMBEDDER_DATA_INDEX, FixedArray, embedder_data)                            \
   V(ALLOW_CODE_GEN_FROM_STRINGS_INDEX, Object, allow_code_gen_from_strings)    \
   V(ERROR_MESSAGE_FOR_CODE_GEN_FROM_STRINGS_INDEX, Object,                     \
     error_message_for_code_gen_from_strings)                                   \
+  V(ERROR_FUNCTION_INDEX, JSFunction, error_function)                          \
+  V(EVAL_ERROR_FUNCTION_INDEX, JSFunction, eval_error_function)                \
+  V(RANGE_ERROR_FUNCTION_INDEX, JSFunction, range_error_function)              \
+  V(REFERENCE_ERROR_FUNCTION_INDEX, JSFunction, reference_error_function)      \
+  V(SYNTAX_ERROR_FUNCTION_INDEX, JSFunction, syntax_error_function)            \
+  V(TYPE_ERROR_FUNCTION_INDEX, JSFunction, type_error_function)                \
+  V(URI_ERROR_FUNCTION_INDEX, JSFunction, uri_error_function)                  \
   V(PROMISE_STATUS_INDEX, Symbol, promise_status)                              \
   V(PROMISE_VALUE_INDEX, Symbol, promise_value)                                \
   V(PROMISE_CREATE_INDEX, JSFunction, promise_create)                          \
@@ -162,8 +167,11 @@ enum BindingFlags {
   V(PROMISE_CHAIN_INDEX, JSFunction, promise_chain)                            \
   V(PROMISE_CATCH_INDEX, JSFunction, promise_catch)                            \
   V(PROMISE_THEN_INDEX, JSFunction, promise_then)                              \
+  V(PROMISE_HAS_USER_DEFINED_REJECT_HANDLER_INDEX, JSFunction,                 \
+    promise_has_user_defined_reject_handler)                                   \
   V(TO_COMPLETE_PROPERTY_DESCRIPTOR_INDEX, JSFunction,                         \
     to_complete_property_descriptor)                                           \
+  V(JSON_SERIALIZE_ADAPTER_INDEX, JSFunction, json_serialize_adapter)          \
   V(DERIVED_HAS_TRAP_INDEX, JSFunction, derived_has_trap)                      \
   V(DERIVED_GET_TRAP_INDEX, JSFunction, derived_get_trap)                      \
   V(DERIVED_SET_TRAP_INDEX, JSFunction, derived_set_trap)                      \
@@ -323,144 +331,11 @@ class Context: public FixedArray {
     // scope info (block contexts), or the module instance (module contexts).
     EXTENSION_INDEX,
     GLOBAL_OBJECT_INDEX,
-    MIN_CONTEXT_SLOTS,
-
-    // This slot holds the thrown value in catch contexts.
-    THROWN_OBJECT_INDEX = MIN_CONTEXT_SLOTS,
 
     // These slots are only in native contexts.
-    GLOBAL_PROXY_INDEX = MIN_CONTEXT_SLOTS,
-    SECURITY_TOKEN_INDEX,
-    SLOPPY_ARGUMENTS_MAP_INDEX,
-    FAST_ALIASED_ARGUMENTS_MAP_INDEX,
-    SLOW_ALIASED_ARGUMENTS_MAP_INDEX,
-    STRICT_ARGUMENTS_MAP_INDEX,
-    REGEXP_RESULT_MAP_INDEX,
-    SLOPPY_FUNCTION_MAP_INDEX,
-    SLOPPY_FUNCTION_WITH_READONLY_PROTOTYPE_MAP_INDEX,
-    STRICT_FUNCTION_MAP_INDEX,
-    STRONG_FUNCTION_MAP_INDEX,
-    SLOPPY_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX,
-    STRICT_FUNCTION_WITHOUT_PROTOTYPE_MAP_INDEX,
-    STRONG_CONSTRUCTOR_MAP_INDEX,
-    BOUND_FUNCTION_MAP_INDEX,
-    INITIAL_OBJECT_PROTOTYPE_INDEX,
-    INITIAL_ARRAY_PROTOTYPE_INDEX,
-    BOOLEAN_FUNCTION_INDEX,
-    NUMBER_FUNCTION_INDEX,
-    STRING_FUNCTION_INDEX,
-    STRING_FUNCTION_PROTOTYPE_MAP_INDEX,
-    SYMBOL_FUNCTION_INDEX,
-    FLOAT32X4_FUNCTION_INDEX,
-    INT32X4_FUNCTION_INDEX,
-    BOOL32X4_FUNCTION_INDEX,
-    INT16X8_FUNCTION_INDEX,
-    BOOL16X8_FUNCTION_INDEX,
-    INT8X16_FUNCTION_INDEX,
-    BOOL8X16_FUNCTION_INDEX,
-    OBJECT_FUNCTION_INDEX,
-    JS_OBJECT_STRONG_MAP_INDEX,
-    INTERNAL_ARRAY_FUNCTION_INDEX,
-    ARRAY_FUNCTION_INDEX,
-    JS_ARRAY_MAPS_INDEX,
-    JS_ARRAY_STRONG_MAPS_INDEX,
-    DATE_FUNCTION_INDEX,
-    JSON_OBJECT_INDEX,
-    REGEXP_FUNCTION_INDEX,
-    CREATE_DATE_FUN_INDEX,
-    TO_NUMBER_FUN_INDEX,
-    TO_STRING_FUN_INDEX,
-    TO_DETAIL_STRING_FUN_INDEX,
-    TO_INTEGER_FUN_INDEX,
-    GLOBAL_EVAL_FUN_INDEX,
-    ARRAY_BUFFER_FUN_INDEX,
-    ARRAY_BUFFER_MAP_INDEX,
-    UINT8_ARRAY_FUN_INDEX,
-    INT8_ARRAY_FUN_INDEX,
-    UINT16_ARRAY_FUN_INDEX,
-    INT16_ARRAY_FUN_INDEX,
-    UINT32_ARRAY_FUN_INDEX,
-    INT32_ARRAY_FUN_INDEX,
-    FLOAT32_ARRAY_FUN_INDEX,
-    FLOAT64_ARRAY_FUN_INDEX,
-    UINT8_CLAMPED_ARRAY_FUN_INDEX,
-    INT8_ARRAY_EXTERNAL_MAP_INDEX,
-    UINT8_ARRAY_EXTERNAL_MAP_INDEX,
-    INT16_ARRAY_EXTERNAL_MAP_INDEX,
-    UINT16_ARRAY_EXTERNAL_MAP_INDEX,
-    INT32_ARRAY_EXTERNAL_MAP_INDEX,
-    UINT32_ARRAY_EXTERNAL_MAP_INDEX,
-    FLOAT32_ARRAY_EXTERNAL_MAP_INDEX,
-    FLOAT64_ARRAY_EXTERNAL_MAP_INDEX,
-    UINT8_CLAMPED_ARRAY_EXTERNAL_MAP_INDEX,
-    DATA_VIEW_FUN_INDEX,
-    SHARED_ARRAY_BUFFER_FUN_INDEX,
-    MESSAGE_LISTENERS_INDEX,
-    MAKE_MESSAGE_FUN_INDEX,
-    GET_STACK_TRACE_LINE_INDEX,
-    CONFIGURE_GLOBAL_INDEX,
-    FUNCTION_CACHE_INDEX,
-    NORMALIZED_MAP_CACHE_INDEX,
-    RUNTIME_CONTEXT_INDEX,
-    CALL_AS_FUNCTION_DELEGATE_INDEX,
-    CALL_AS_CONSTRUCTOR_DELEGATE_INDEX,
-    SCRIPT_FUNCTION_INDEX,
-    OPAQUE_REFERENCE_FUNCTION_INDEX,
-    CONTEXT_EXTENSION_FUNCTION_INDEX,
-    OUT_OF_MEMORY_INDEX,
-    EMBEDDER_DATA_INDEX,
-    ALLOW_CODE_GEN_FROM_STRINGS_INDEX,
-    ERROR_MESSAGE_FOR_CODE_GEN_FROM_STRINGS_INDEX,
-    RUN_MICROTASKS_INDEX,
-    ENQUEUE_MICROTASK_INDEX,
-    PROMISE_STATUS_INDEX,
-    PROMISE_VALUE_INDEX,
-    PROMISE_CREATE_INDEX,
-    PROMISE_RESOLVE_INDEX,
-    PROMISE_REJECT_INDEX,
-    PROMISE_CHAIN_INDEX,
-    PROMISE_CATCH_INDEX,
-    PROMISE_THEN_INDEX,
-    TO_COMPLETE_PROPERTY_DESCRIPTOR_INDEX,
-    DERIVED_HAS_TRAP_INDEX,
-    DERIVED_GET_TRAP_INDEX,
-    DERIVED_SET_TRAP_INDEX,
-    PROXY_ENUMERATE_INDEX,
-    OBSERVERS_NOTIFY_CHANGE_INDEX,
-    OBSERVERS_ENQUEUE_SPLICE_INDEX,
-    OBSERVERS_BEGIN_SPLICE_INDEX,
-    OBSERVERS_END_SPLICE_INDEX,
-    NATIVE_OBJECT_OBSERVE_INDEX,
-    NATIVE_OBJECT_GET_NOTIFIER_INDEX,
-    NATIVE_OBJECT_NOTIFIER_PERFORM_CHANGE,
-    SLOPPY_GENERATOR_FUNCTION_MAP_INDEX,
-    STRICT_GENERATOR_FUNCTION_MAP_INDEX,
-    STRONG_GENERATOR_FUNCTION_MAP_INDEX,
-    GENERATOR_OBJECT_PROTOTYPE_MAP_INDEX,
-    ITERATOR_RESULT_MAP_INDEX,
-    JS_MAP_FUN_INDEX,
-    JS_MAP_MAP_INDEX,
-    JS_SET_FUN_INDEX,
-    JS_SET_MAP_INDEX,
-    MAP_GET_METHOD_INDEX,
-    MAP_SET_METHOD_INDEX,
-    MAP_HAS_METHOD_INDEX,
-    MAP_DELETE_METHOD_INDEX,
-    SET_ADD_METHOD_INDEX,
-    SET_HAS_METHOD_INDEX,
-    SET_DELETE_METHOD_INDEX,
-    MAP_FROM_ARRAY_INDEX,
-    SET_FROM_ARRAY_INDEX,
-    MAP_ITERATOR_MAP_INDEX,
-    SET_ITERATOR_MAP_INDEX,
-    ARRAY_VALUES_ITERATOR_INDEX,
-    SCRIPT_CONTEXT_TABLE_INDEX,
-    MAP_CACHE_INDEX,
-    STRONG_MAP_CACHE_INDEX,
-    TO_LENGTH_FUN_INDEX,
-    NATIVES_UTILS_OBJECT_INDEX,
-    EXTRAS_EXPORTS_OBJECT_INDEX,
-    CODE_STUB_EXPORTS_OBJECT_INDEX,
+#define NATIVE_CONTEXT_SLOT(index, type, name) index,
+    NATIVE_CONTEXT_FIELDS(NATIVE_CONTEXT_SLOT)
+#undef NATIVE_CONTEXT_SLOT
 
     // Properties from here are treated as weak references by the full GC.
     // Scavenge treats them as strong references.
@@ -471,7 +346,11 @@ class Context: public FixedArray {
 
     // Total number of slots.
     NATIVE_CONTEXT_SLOTS,
-    FIRST_WEAK_SLOT = OPTIMIZED_FUNCTIONS_LIST
+    FIRST_WEAK_SLOT = OPTIMIZED_FUNCTIONS_LIST,
+
+    MIN_CONTEXT_SLOTS = GLOBAL_PROXY_INDEX,
+    // This slot holds the thrown value in catch contexts.
+    THROWN_OBJECT_INDEX = MIN_CONTEXT_SLOTS,
   };
 
   // Direct slot access.

src/debug/debug.cc

@@ -1823,10 +1823,7 @@ void Debug::OnPromiseReject(Handle<JSObject> promise, Handle<Object> value) {
 
 MaybeHandle<Object> Debug::PromiseHasUserDefinedRejectHandler(
     Handle<JSObject> promise) {
-  Handle<JSFunction> fun = Handle<JSFunction>::cast(
-      JSReceiver::GetDataProperty(isolate_->js_builtins_object(),
-                                  isolate_->factory()->NewStringFromStaticChars(
-                                      "$promiseHasUserDefinedRejectHandler")));
+  Handle<JSFunction> fun = isolate_->promise_has_user_defined_reject_handler();
   return Execution::Call(isolate_, fun, promise, 0, NULL);
 }
 

src/factory.cc

@@ -1250,18 +1250,15 @@ Handle<Object> Factory::NewError(const char* maker, const char* message,
 }
 
 
-Handle<Object> Factory::NewError(const char* constructor,
+Handle<Object> Factory::NewError(Handle<JSFunction> constructor,
                                  Handle<String> message) {
-  Handle<String> constr = InternalizeUtf8String(constructor);
-  Handle<JSFunction> fun = Handle<JSFunction>::cast(Object::GetProperty(
-      isolate()->js_builtins_object(), constr).ToHandleChecked());
   Handle<Object> argv[] = { message };
 
   // Invoke the JavaScript factory method. If an exception is thrown while
   // running the factory method, use the exception as the result.
   Handle<Object> result;
   MaybeHandle<Object> exception;
-  if (!Execution::TryCall(fun, undefined_value(), arraysize(argv), argv,
+  if (!Execution::TryCall(constructor, undefined_value(), arraysize(argv), argv,
                           &exception)
            .ToHandle(&result)) {
     Handle<Object> exception_obj;

src/factory.h

@@ -551,7 +551,8 @@ class Factory final {
                           Handle<JSArray> args);
   Handle<String> EmergencyNewError(const char* message, Handle<JSArray> args);
 
-  Handle<Object> NewError(const char* constructor, Handle<String> message);
+  Handle<Object> NewError(Handle<JSFunction> constructor,
+                          Handle<String> message);
 
   Handle<Object> NewInvalidStringLengthError() {
     return NewRangeError(MessageTemplate::kInvalidStringLength);

src/isolate.cc

@@ -332,15 +332,12 @@ static bool IsVisibleInStackTrace(JSFunction* fun,
 Handle<Object> Isolate::CaptureSimpleStackTrace(Handle<JSObject> error_object,
                                                 Handle<Object> caller) {
   // Get stack trace limit.
-  Handle<Object> error = Object::GetProperty(
-      this, js_builtins_object(), "$Error").ToHandleChecked();
-  if (!error->IsJSObject()) return factory()->undefined_value();
-
+  Handle<JSObject> error = error_function();
   Handle<String> stackTraceLimit =
       factory()->InternalizeUtf8String("stackTraceLimit");
   DCHECK(!stackTraceLimit.is_null());
-  Handle<Object> stack_trace_limit = JSReceiver::GetDataProperty(
-      Handle<JSObject>::cast(error), stackTraceLimit);
+  Handle<Object> stack_trace_limit =
+      JSReceiver::GetDataProperty(error, stackTraceLimit);
   if (!stack_trace_limit->IsNumber()) return factory()->undefined_value();
   int limit = FastD2IChecked(stack_trace_limit->Number());
   limit = Max(limit, 0);  // Ensure that limit is not negative.
@@ -1344,12 +1341,7 @@ bool Isolate::ComputeLocationFromStackTrace(MessageLocation* target,
 // the Error object.
 bool Isolate::IsErrorObject(Handle<Object> obj) {
   if (!obj->IsJSObject()) return false;
-
-  Handle<String> error_key =
-      factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("$Error"));
-  Handle<Object> error_constructor = Object::GetProperty(
-      js_builtins_object(), error_key).ToHandleChecked();
-
+  Handle<Object> error_constructor = error_function();
   DisallowHeapAllocation no_gc;
   for (PrototypeIterator iter(this, *obj, PrototypeIterator::START_AT_RECEIVER);
        !iter.IsAtEnd(); iter.Advance()) {

src/json-stringifier.h

@@ -358,16 +358,11 @@ BasicJsonStringifier::Result BasicJsonStringifier::SerializeGeneric(
     Handle<Object> key,
     bool deferred_comma,
     bool deferred_key) {
-  Handle<JSObject> builtins(isolate_->native_context()->builtins(), isolate_);
-  Handle<JSFunction> builtin = Handle<JSFunction>::cast(
-      Object::GetProperty(isolate_, builtins, "$jsonSerializeAdapter")
-          .ToHandleChecked());
-
+  Handle<JSFunction> fun = isolate_->json_serialize_adapter();
   Handle<Object> argv[] = { key, object };
   Handle<Object> result;
   ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-      isolate_, result,
-      Execution::Call(isolate_, builtin, object, 2, argv),
+      isolate_, result, Execution::Call(isolate_, fun, object, 2, argv),
       EXCEPTION);
   if (result->IsUndefined()) return UNCHANGED;
   if (deferred_key) {

src/json.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-var $jsonSerializeAdapter;
-
 (function(global, utils) {
 
 "use strict";
@@ -244,11 +242,15 @@ utils.InstallFunctions(GlobalJSON, DONT_ENUM, [
 // -------------------------------------------------------------------
 // JSON Builtins
 
-$jsonSerializeAdapter = function(key, object) {
+function JsonSerializeAdapter(key, object) {
   var holder = {};
   holder[key] = object;
   // No need to pass the actual holder since there is no replacer function.
   return JSONSerialize(key, holder, UNDEFINED, new InternalArray(), "", "");
 }
 
+utils.ExportToRuntime(function(to) {
+  to.JsonSerializeAdapter = JsonSerializeAdapter;
+});
+
 })

src/math.js

@@ -12,6 +12,7 @@ var rngstate;  // Initialized to a Uint32Array during genesis.
 // -------------------------------------------------------------------
 // Imports
 
+var GlobalMath = global.Math;
 var GlobalObject = global.Object;
 var InternalArray = utils.InternalArray;
 
@@ -287,20 +288,10 @@ function CubeRoot(x) {
 
 // -------------------------------------------------------------------
 
-// Instance class name can only be set on functions. That is the only
-// purpose for MathConstructor.
-function MathConstructor() {}
-
-var Math = new MathConstructor();
-
-%InternalSetPrototype(Math, GlobalObject.prototype);
-%AddNamedProperty(global, "Math", Math, DONT_ENUM);
-%FunctionSetInstanceClassName(MathConstructor, 'Math');
-
-%AddNamedProperty(Math, symbolToStringTag, "Math", READ_ONLY | DONT_ENUM);
+%AddNamedProperty(GlobalMath, symbolToStringTag, "Math", READ_ONLY | DONT_ENUM);
 
 // Set up math constants.
-utils.InstallConstants(Math, [
+utils.InstallConstants(GlobalMath, [
   // ECMA-262, section 15.8.1.1.
   "E", 2.7182818284590452354,
   // ECMA-262, section 15.8.1.2.
@@ -317,7 +308,7 @@ utils.InstallConstants(Math, [
 
 // Set up non-enumerable functions of the Math object and
 // set their names.
-utils.InstallFunctions(Math, DONT_ENUM, [
+utils.InstallFunctions(GlobalMath, DONT_ENUM, [
   "random", MathRandom,
   "abs", MathAbs,
   "acos", MathAcosJS,

src/messages.cc

@@ -81,7 +81,7 @@ void MessageHandler::ReportMessage(Isolate* isolate, MessageLocation* loc,
     Handle<Object> argument(message->argument(), isolate);
     Handle<Object> args[] = {argument};
     MaybeHandle<Object> maybe_stringified = Execution::TryCall(
-        isolate->to_detail_string_fun(), isolate->js_builtins_object(),
+        isolate->to_detail_string_fun(), isolate->factory()->undefined_value(),
         arraysize(args), args);
     Handle<Object> stringified;
     if (!maybe_stringified.ToHandle(&stringified)) {
@@ -297,11 +297,7 @@ Handle<String> MessageTemplate::FormatMessage(Isolate* isolate,
   if (arg->IsString()) {
     result_string = Handle<String>::cast(arg);
   } else {
-    Handle<String> fmt_str = factory->InternalizeOneByteString(
-        STATIC_CHAR_VECTOR("$noSideEffectToString"));
-    Handle<JSFunction> fun = Handle<JSFunction>::cast(
-        Object::GetProperty(isolate->js_builtins_object(), fmt_str)
-            .ToHandleChecked());
+    Handle<JSFunction> fun = isolate->no_side_effect_to_string_fun();
 
     MaybeHandle<Object> maybe_result =
         Execution::TryCall(fun, factory->undefined_value(), 1, &arg);

src/messages.js

@@ -10,17 +10,8 @@ var $internalErrorSymbol;
 var $messageGetPositionInLine;
 var $messageGetLineNumber;
 var $messageGetSourceLine;
-var $noSideEffectToString;
 var $stackOverflowBoilerplate;
 var $stackTraceSymbol;
-var $toDetailString;
-var $Error;
-var $EvalError;
-var $RangeError;
-var $ReferenceError;
-var $SyntaxError;
-var $TypeError;
-var $URIError;
 var MakeError;
 var MakeEvalError;
 var MakeRangeError;
@@ -1018,16 +1009,6 @@ $errorToString = ErrorToString;
 $messageGetPositionInLine = GetPositionInLine;
 $messageGetLineNumber = GetLineNumber;
 $messageGetSourceLine = GetSourceLine;
-$noSideEffectToString = NoSideEffectToString;
-$toDetailString = ToDetailString;
-
-$Error = GlobalError;
-$EvalError = GlobalEvalError;
-$RangeError = GlobalRangeError;
-$ReferenceError = GlobalReferenceError;
-$SyntaxError = GlobalSyntaxError;
-$TypeError = GlobalTypeError;
-$URIError = GlobalURIError;
 
 MakeError = function(type, arg0, arg1, arg2) {
   return MakeGenericError(GlobalError, type, arg0, arg1, arg2);
@@ -1076,7 +1057,16 @@ captureStackTrace = function captureStackTrace(obj, cons_opt) {
 GlobalError.captureStackTrace = captureStackTrace;
 
 utils.ExportToRuntime(function(to) {
+  to.Error = GlobalError;
+  to.EvalError = GlobalEvalError;
+  to.RangeError = GlobalRangeError;
+  to.ReferenceError = GlobalReferenceError;
+  to.SyntaxError = GlobalSyntaxError;
+  to.TypeError = GlobalTypeError;
+  to.URIError = GlobalURIError;
   to.GetStackTraceLine = GetStackTraceLine;
+  to.NoSideEffectToString = NoSideEffectToString;
+  to.ToDetailString = ToDetailString;
 });
 
 });

src/prologue.js

@@ -270,7 +270,6 @@ InstallFunctions(utils, NONE, [
 ExportToRuntime(function(to) {
   to.ToNumber = $toNumber;
   to.ToString = $toString;
-  to.ToDetailString = $toDetailString;
   to.ToInteger = $toInteger;
   to.ToLength = $toLength;
 });

src/promise.js

@@ -380,7 +380,6 @@ utils.InstallFunctions(GlobalPromise.prototype, DONT_ENUM, [
   "catch", PromiseCatch
 ]);
 
-$promiseHasUserDefinedRejectHandler = PromiseHasUserDefinedRejectHandler;
 $promiseStatus = promiseStatus;
 $promiseValue = promiseValue;
 
@@ -393,6 +392,7 @@ utils.ExportToRuntime(function(to) {
   to.PromiseChain = PromiseChain;
   to.PromiseCatch = PromiseCatch;
   to.PromiseThen = PromiseThen;
+  to.PromiseHasUserDefinedRejectHandler = PromiseHasUserDefinedRejectHandler;
 });
 
 })