Adding upstream version 1:115.7.0.upstream/1%115.7.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1979 insertions, 0 deletions

diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
new file mode 100644
index 0000000000..01e1da2f0a
--- /dev/null
+++ b/js/src/vm/JSFunction.cpp
@@ -0,0 +1,1979 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * JS function support.
+ */
+
+#include "vm/JSFunction-inl.h"
+
+#include "mozilla/CheckedInt.h"
+#include "mozilla/Maybe.h"
+#include "mozilla/Range.h"
+
+#include <algorithm>
+#include <string.h>
+
+#include "jsapi.h"
+#include "jstypes.h"
+
+#include "builtin/Array.h"
+#include "builtin/BigInt.h"
+#include "builtin/Object.h"
+#include "builtin/Symbol.h"
+#include "frontend/BytecodeCompilation.h"
+#include "frontend/BytecodeCompiler.h"
+#include "frontend/FrontendContext.h"  // AutoReportFrontendContext, ManualReportFrontendContext
+#include "jit/InlinableNatives.h"
+#include "jit/Ion.h"
+#include "js/CallNonGenericMethod.h"
+#include "js/CompilationAndEvaluation.h"
+#include "js/CompileOptions.h"
+#include "js/friend/ErrorMessages.h"  // js::GetErrorMessage, JSMSG_*
+#include "js/friend/StackLimits.h"    // js::AutoCheckRecursionLimit
+#include "js/PropertySpec.h"
+#include "js/SourceText.h"
+#include "js/StableStringChars.h"
+#include "js/Wrapper.h"
+#include "util/DifferentialTesting.h"
+#include "util/StringBuffer.h"
+#include "util/Text.h"
+#include "vm/BooleanObject.h"
+#include "vm/BoundFunctionObject.h"
+#include "vm/Compartment.h"
+#include "vm/FunctionFlags.h"          // js::FunctionFlags
+#include "vm/GeneratorAndAsyncKind.h"  // js::GeneratorKind, js::FunctionAsyncKind
+#include "vm/GlobalObject.h"
+#include "vm/Interpreter.h"
+#include "vm/JSAtom.h"
+#include "vm/JSContext.h"
+#include "vm/JSObject.h"
+#include "vm/JSScript.h"
+#include "vm/NumberObject.h"
+#include "vm/PlainObject.h"  // js::PlainObject
+#include "vm/SelfHosting.h"
+#include "vm/Shape.h"
+#include "vm/StringObject.h"
+#include "vm/WellKnownAtom.h"  // js_*_str
+#include "wasm/AsmJS.h"
+#ifdef ENABLE_RECORD_TUPLE
+#  include "vm/RecordType.h"
+#  include "vm/TupleType.h"
+#endif
+
+#include "vm/Interpreter-inl.h"
+#include "vm/JSScript-inl.h"
+
+using namespace js;
+
+using mozilla::CheckedInt;
+using mozilla::Maybe;
+using mozilla::Some;
+
+using JS::AutoStableStringChars;
+using JS::CompileOptions;
+using JS::SourceOwnership;
+using JS::SourceText;
+
+static bool fun_enumerate(JSContext* cx, HandleObject obj) {
+  MOZ_ASSERT(obj->is<JSFunction>());
+
+  RootedId id(cx);
+  bool found;
+
+  if (obj->as<JSFunction>().needsPrototypeProperty()) {
+    id = NameToId(cx->names().prototype);
+    if (!HasOwnProperty(cx, obj, id, &found)) {
+      return false;
+    }
+  }
+
+  if (!obj->as<JSFunction>().hasResolvedLength()) {
+    id = NameToId(cx->names().length);
+    if (!HasOwnProperty(cx, obj, id, &found)) {
+      return false;
+    }
+  }
+
+  if (!obj->as<JSFunction>().hasResolvedName()) {
+    id = NameToId(cx->names().name);
+    if (!HasOwnProperty(cx, obj, id, &found)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+bool IsFunction(HandleValue v) {
+  return v.isObject() && v.toObject().is<JSFunction>();
+}
+
+static bool AdvanceToActiveCallLinear(JSContext* cx,
+                                      NonBuiltinScriptFrameIter& iter,
+                                      HandleFunction fun) {
+  MOZ_ASSERT(!fun->isBuiltin());
+
+  for (; !iter.done(); ++iter) {
+    if (!iter.isFunctionFrame()) {
+      continue;
+    }
+    if (iter.matchCallee(cx, fun)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+void js::ThrowTypeErrorBehavior(JSContext* cx) {
+  JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                            JSMSG_THROW_TYPE_ERROR);
+}
+
+static bool IsSloppyNormalFunction(JSFunction* fun) {
+  // FunctionDeclaration or FunctionExpression in sloppy mode.
+  if (fun->kind() == FunctionFlags::NormalFunction) {
+    if (fun->isBuiltin()) {
+      return false;
+    }
+
+    if (fun->isGenerator() || fun->isAsync()) {
+      return false;
+    }
+
+    MOZ_ASSERT(fun->isInterpreted());
+    return !fun->strict();
+  }
+
+  // Or asm.js function in sloppy mode.
+  if (fun->kind() == FunctionFlags::AsmJS) {
+    return !IsAsmJSStrictModeModuleOrFunction(fun);
+  }
+
+  return false;
+}
+
+// Beware: this function can be invoked on *any* function! That includes
+// natives, strict mode functions, bound functions, arrow functions,
+// self-hosted functions and constructors, asm.js functions, functions with
+// destructuring arguments and/or a rest argument, and probably a few more I
+// forgot. Turn back and save yourself while you still can. It's too late for
+// me.
+static bool ArgumentsRestrictions(JSContext* cx, HandleFunction fun) {
+  // Throw unless the function is a sloppy, normal function.
+  // TODO (bug 1057208): ensure semantics are correct for all possible
+  // pairings of callee/caller.
+  if (!IsSloppyNormalFunction(fun)) {
+    ThrowTypeErrorBehavior(cx);
+    return false;
+  }
+
+  return true;
+}
+
+bool ArgumentsGetterImpl(JSContext* cx, const CallArgs& args) {
+  MOZ_ASSERT(IsFunction(args.thisv()));
+
+  RootedFunction fun(cx, &args.thisv().toObject().as<JSFunction>());
+  if (!ArgumentsRestrictions(cx, fun)) {
+    return false;
+  }
+
+  // Function.arguments isn't standard (not even Annex B), so it isn't
+  // worth the effort to guarantee that we can always recover it from
+  // an Ion frame. Always return null for differential fuzzing.
+  if (js::SupportDifferentialTesting()) {
+    args.rval().setNull();
+    return true;
+  }
+
+  // Return null if this function wasn't found on the stack.
+  NonBuiltinScriptFrameIter iter(cx);
+  if (!AdvanceToActiveCallLinear(cx, iter, fun)) {
+    args.rval().setNull();
+    return true;
+  }
+
+  Rooted<ArgumentsObject*> argsobj(cx,
+                                   ArgumentsObject::createUnexpected(cx, iter));
+  if (!argsobj) {
+    return false;
+  }
+
+#ifndef JS_CODEGEN_NONE
+  // Disabling compiling of this script in IonMonkey.  IonMonkey doesn't
+  // guarantee |f.arguments| can be fully recovered, so we try to mitigate
+  // observing this behavior by detecting its use early.
+  JSScript* script = iter.script();
+  jit::ForbidCompilation(cx, script);
+#endif
+
+  args.rval().setObject(*argsobj);
+  return true;
+}
+
+static bool ArgumentsGetter(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  return CallNonGenericMethod<IsFunction, ArgumentsGetterImpl>(cx, args);
+}
+
+bool ArgumentsSetterImpl(JSContext* cx, const CallArgs& args) {
+  MOZ_ASSERT(IsFunction(args.thisv()));
+
+  RootedFunction fun(cx, &args.thisv().toObject().as<JSFunction>());
+  if (!ArgumentsRestrictions(cx, fun)) {
+    return false;
+  }
+
+  // If the function passes the gauntlet, return |undefined|.
+  args.rval().setUndefined();
+  return true;
+}
+
+static bool ArgumentsSetter(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  return CallNonGenericMethod<IsFunction, ArgumentsSetterImpl>(cx, args);
+}
+
+// Beware: this function can be invoked on *any* function! That includes
+// natives, strict mode functions, bound functions, arrow functions,
+// self-hosted functions and constructors, asm.js functions, functions with
+// destructuring arguments and/or a rest argument, and probably a few more I
+// forgot. Turn back and save yourself while you still can. It's too late for
+// me.
+static bool CallerRestrictions(JSContext* cx, HandleFunction fun) {
+  // Throw unless the function is a sloppy, normal function.
+  // TODO (bug 1057208): ensure semantics are correct for all possible
+  // pairings of callee/caller.
+  if (!IsSloppyNormalFunction(fun)) {
+    ThrowTypeErrorBehavior(cx);
+    return false;
+  }
+
+  return true;
+}
+
+bool CallerGetterImpl(JSContext* cx, const CallArgs& args) {
+  MOZ_ASSERT(IsFunction(args.thisv()));
+
+  // Beware!  This function can be invoked on *any* function!  It can't
+  // assume it'll never be invoked on natives, strict mode functions, bound
+  // functions, or anything else that ordinarily has immutable .caller
+  // defined with [[ThrowTypeError]].
+  RootedFunction fun(cx, &args.thisv().toObject().as<JSFunction>());
+  if (!CallerRestrictions(cx, fun)) {
+    return false;
+  }
+
+  // Also return null if this function wasn't found on the stack.
+  NonBuiltinScriptFrameIter iter(cx);
+  if (!AdvanceToActiveCallLinear(cx, iter, fun)) {
+    args.rval().setNull();
+    return true;
+  }
+
+  ++iter;
+  while (!iter.done() && iter.isEvalFrame()) {
+    ++iter;
+  }
+
+  if (iter.done() || !iter.isFunctionFrame()) {
+    args.rval().setNull();
+    return true;
+  }
+
+  RootedObject caller(cx, iter.callee(cx));
+  if (!cx->compartment()->wrap(cx, &caller)) {
+    return false;
+  }
+
+  // Censor the caller if we don't have full access to it.  If we do, but the
+  // caller is a function with strict mode code, throw a TypeError per ES5.
+  // If we pass these checks, we can return the computed caller.
+  {
+    JSObject* callerObj = CheckedUnwrapStatic(caller);
+    if (!callerObj) {
+      args.rval().setNull();
+      return true;
+    }
+
+    if (JS_IsDeadWrapper(callerObj)) {
+      JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                                JSMSG_DEAD_OBJECT);
+      return false;
+    }
+
+    JSFunction* callerFun = &callerObj->as<JSFunction>();
+    MOZ_ASSERT(!callerFun->isBuiltin(),
+               "non-builtin iterator returned a builtin?");
+
+    if (callerFun->strict() || callerFun->isAsync() ||
+        callerFun->isGenerator()) {
+      args.rval().setNull();
+      return true;
+    }
+  }
+
+  args.rval().setObject(*caller);
+  return true;
+}
+
+static bool CallerGetter(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  return CallNonGenericMethod<IsFunction, CallerGetterImpl>(cx, args);
+}
+
+bool CallerSetterImpl(JSContext* cx, const CallArgs& args) {
+  MOZ_ASSERT(IsFunction(args.thisv()));
+
+  // We just have to return |undefined|, but first we call CallerGetterImpl
+  // because we need the same strict-mode and security checks.
+
+  if (!CallerGetterImpl(cx, args)) {
+    return false;
+  }
+
+  args.rval().setUndefined();
+  return true;
+}
+
+static bool CallerSetter(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  return CallNonGenericMethod<IsFunction, CallerSetterImpl>(cx, args);
+}
+
+static const JSPropertySpec function_properties[] = {
+    JS_PSGS("arguments", ArgumentsGetter, ArgumentsSetter, 0),
+    JS_PSGS("caller", CallerGetter, CallerSetter, 0), JS_PS_END};
+
+static bool ResolveInterpretedFunctionPrototype(JSContext* cx,
+                                                HandleFunction fun,
+                                                HandleId id) {
+  MOZ_ASSERT(fun->isInterpreted() || fun->isAsmJSNative());
+  MOZ_ASSERT(id == NameToId(cx->names().prototype));
+
+  // Assert that fun is not a compiler-created function object, which
+  // must never leak to script or embedding code and then be mutated.
+  // Also assert that fun is not bound, per the ES5 15.3.4.5 ref above.
+  MOZ_ASSERT(!IsInternalFunctionObject(*fun));
+
+  // Make the prototype object an instance of Object with the same parent as
+  // the function object itself, unless the function is an ES6 generator.  In
+  // that case, per the 15 July 2013 ES6 draft, section 15.19.3, its parent is
+  // the GeneratorObjectPrototype singleton.
+  bool isGenerator = fun->isGenerator();
+  Rooted<GlobalObject*> global(cx, &fun->global());
+  RootedObject objProto(cx);
+  if (isGenerator && fun->isAsync()) {
+    objProto = GlobalObject::getOrCreateAsyncGeneratorPrototype(cx, global);
+  } else if (isGenerator) {
+    objProto = GlobalObject::getOrCreateGeneratorObjectPrototype(cx, global);
+  } else {
+    objProto = &global->getObjectPrototype();
+  }
+  if (!objProto) {
+    return false;
+  }
+
+  Rooted<PlainObject*> proto(
+      cx, NewPlainObjectWithProto(cx, objProto, TenuredObject));
+  if (!proto) {
+    return false;
+  }
+
+  // Per ES5 13.2 the prototype's .constructor property is configurable,
+  // non-enumerable, and writable.  However, per the 15 July 2013 ES6 draft,
+  // section 15.19.3, the .prototype of a generator function does not link
+  // back with a .constructor.
+  if (!isGenerator) {
+    RootedValue objVal(cx, ObjectValue(*fun));
+    if (!DefineDataProperty(cx, proto, cx->names().constructor, objVal, 0)) {
+      return false;
+    }
+  }
+
+  // Per ES5 15.3.5.2 a user-defined function's .prototype property is
+  // initially non-configurable, non-enumerable, and writable.
+  RootedValue protoVal(cx, ObjectValue(*proto));
+  return DefineDataProperty(cx, fun, id, protoVal,
+                            JSPROP_PERMANENT | JSPROP_RESOLVING);
+}
+
+bool JSFunction::needsPrototypeProperty() {
+  /*
+   * Built-in functions do not have a .prototype property per ECMA-262,
+   * or (Object.prototype, Function.prototype, etc.) have that property
+   * created eagerly.
+   *
+   * ES6 9.2.8 MakeConstructor defines the .prototype property on constructors.
+   * Generators are not constructors, but they have a .prototype property
+   * anyway, according to errata to ES6. See bug 1191486.
+   *
+   * Thus all of the following don't get a .prototype property:
+   * - Methods (that are not class-constructors or generators)
+   * - Arrow functions
+   * - Function.prototype
+   * - Async functions
+   */
+  return !isBuiltin() && (isConstructor() || isGenerator());
+}
+
+bool JSFunction::hasNonConfigurablePrototypeDataProperty() {
+  if (!isBuiltin()) {
+    return needsPrototypeProperty();
+  }
+
+  if (isSelfHostedBuiltin()) {
+    // Self-hosted constructors have a non-configurable .prototype data
+    // property.
+    if (!isConstructor()) {
+      return false;
+    }
+#ifdef DEBUG
+    PropertyName* prototypeName =
+        runtimeFromMainThread()->commonNames->prototype;
+    Maybe<PropertyInfo> prop = lookupPure(prototypeName);
+    MOZ_ASSERT(prop.isSome());
+    MOZ_ASSERT(prop->isDataProperty());
+    MOZ_ASSERT(!prop->configurable());
+#endif
+    return true;
+  }
+
+  if (!isConstructor()) {
+    // We probably don't have a .prototype property. Avoid the lookup below.
+    return false;
+  }
+
+  PropertyName* prototypeName = runtimeFromMainThread()->commonNames->prototype;
+  Maybe<PropertyInfo> prop = lookupPure(prototypeName);
+  return prop.isSome() && prop->isDataProperty() && !prop->configurable();
+}
+
+static bool fun_mayResolve(const JSAtomState& names, jsid id, JSObject*) {
+  if (!id.isAtom()) {
+    return false;
+  }
+
+  JSAtom* atom = id.toAtom();
+  return atom == names.prototype || atom == names.length || atom == names.name;
+}
+
+static bool fun_resolve(JSContext* cx, HandleObject obj, HandleId id,
+                        bool* resolvedp) {
+  if (!id.isAtom()) {
+    return true;
+  }
+
+  RootedFunction fun(cx, &obj->as<JSFunction>());
+
+  if (id.isAtom(cx->names().prototype)) {
+    if (!fun->needsPrototypeProperty()) {
+      return true;
+    }
+
+    if (!ResolveInterpretedFunctionPrototype(cx, fun, id)) {
+      return false;
+    }
+
+    *resolvedp = true;
+    return true;
+  }
+
+  bool isLength = id.isAtom(cx->names().length);
+  if (isLength || id.isAtom(cx->names().name)) {
+    MOZ_ASSERT(!IsInternalFunctionObject(*obj));
+
+    RootedValue v(cx);
+
+    // Since f.length and f.name are configurable, they could be resolved
+    // and then deleted:
+    //     function f(x) {}
+    //     assertEq(f.length, 1);
+    //     delete f.length;
+    //     assertEq(f.name, "f");
+    //     delete f.name;
+    // Afterwards, asking for f.length or f.name again will cause this
+    // resolve hook to run again. Defining the property again the second
+    // time through would be a bug.
+    //     assertEq(f.length, 0);  // gets Function.prototype.length!
+    //     assertEq(f.name, "");  // gets Function.prototype.name!
+    // We use the RESOLVED_LENGTH and RESOLVED_NAME flags as a hack to prevent
+    // this bug.
+    if (isLength) {
+      if (fun->hasResolvedLength()) {
+        return true;
+      }
+
+      uint16_t len = 0;
+      if (!JSFunction::getUnresolvedLength(cx, fun, &len)) {
+        return false;
+      }
+      v.setInt32(len);
+    } else {
+      if (fun->hasResolvedName()) {
+        return true;
+      }
+
+      v.setString(fun->infallibleGetUnresolvedName(cx));
+    }
+
+    if (!NativeDefineDataProperty(cx, fun, id, v,
+                                  JSPROP_READONLY | JSPROP_RESOLVING)) {
+      return false;
+    }
+
+    if (isLength) {
+      fun->setResolvedLength();
+    } else {
+      fun->setResolvedName();
+    }
+
+    *resolvedp = true;
+    return true;
+  }
+
+  return true;
+}
+
+/* ES6 (04-25-16) 19.2.3.6 Function.prototype [ @@hasInstance ] */
+static bool fun_symbolHasInstance(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+
+  if (args.length() < 1) {
+    args.rval().setBoolean(false);
+    return true;
+  }
+
+  /* Step 1. */
+  HandleValue func = args.thisv();
+
+  // Primitives are non-callable and will always return false from
+  // OrdinaryHasInstance.
+  if (!func.isObject()) {
+    args.rval().setBoolean(false);
+    return true;
+  }
+
+  RootedObject obj(cx, &func.toObject());
+
+  /* Step 2. */
+  bool result;
+  if (!OrdinaryHasInstance(cx, obj, args[0], &result)) {
+    return false;
+  }
+
+  args.rval().setBoolean(result);
+  return true;
+}
+
+/*
+ * ES6 (4-25-16) 7.3.19 OrdinaryHasInstance
+ */
+bool JS::OrdinaryHasInstance(JSContext* cx, HandleObject objArg, HandleValue v,
+                             bool* bp) {
+  AssertHeapIsIdle();
+  cx->check(objArg, v);
+
+  RootedObject obj(cx, objArg);
+
+  /* Step 1. */
+  if (!obj->isCallable()) {
+    *bp = false;
+    return true;
+  }
+
+  /* Step 2. */
+  if (obj->is<BoundFunctionObject>()) {
+    /* Steps 2a-b. */
+    AutoCheckRecursionLimit recursion(cx);
+    if (!recursion.check(cx)) {
+      return false;
+    }
+    obj = obj->as<BoundFunctionObject>().getTarget();
+    return InstanceofOperator(cx, obj, v, bp);
+  }
+
+  /* Step 3. */
+  if (!v.isObject()) {
+    *bp = false;
+    return true;
+  }
+
+  /* Step 4. */
+  RootedValue pval(cx);
+  if (!GetProperty(cx, obj, obj, cx->names().prototype, &pval)) {
+    return false;
+  }
+
+  /* Step 5. */
+  if (pval.isPrimitive()) {
+    /*
+     * Throw a runtime error if instanceof is called on a function that
+     * has a non-object as its .prototype value.
+     */
+    RootedValue val(cx, ObjectValue(*obj));
+    ReportValueError(cx, JSMSG_BAD_PROTOTYPE, -1, val, nullptr);
+    return false;
+  }
+
+  /* Step 6. */
+  RootedObject pobj(cx, &pval.toObject());
+  bool isPrototype;
+  if (!IsPrototypeOf(cx, pobj, &v.toObject(), &isPrototype)) {
+    return false;
+  }
+  *bp = isPrototype;
+  return true;
+}
+
+inline void JSFunction::trace(JSTracer* trc) {
+  // Functions can be be marked as interpreted despite having no script yet at
+  // some points when parsing, and can be lazy with no lazy script for
+  // self-hosted code.
+  MOZ_ASSERT(!getFixedSlot(NativeJitInfoOrInterpretedScriptSlot).isGCThing());
+  if (isInterpreted() && hasBaseScript()) {
+    if (BaseScript* script = baseScript()) {
+      TraceManuallyBarrieredEdge(trc, &script, "JSFunction script");
+      // Self-hosted scripts are shared with workers but are never relocated.
+      // Skip unnecessary writes to prevent the possible data race.
+      if (baseScript() != script) {
+        HeapSlot& slot = getFixedSlotRef(NativeJitInfoOrInterpretedScriptSlot);
+        slot.unbarrieredSet(JS::PrivateValue(script));
+      }
+    }
+  }
+  // wasm/asm.js exported functions need to keep WasmInstantObject alive,
+  // access it via WASM_INSTANCE_SLOT extended slot.
+  if (isAsmJSNative() || isWasm()) {
+    const Value& v = getExtendedSlot(FunctionExtended::WASM_INSTANCE_SLOT);
+    if (!v.isUndefined()) {
+      auto* instance = static_cast<wasm::Instance*>(v.toPrivate());
+      wasm::TraceInstanceEdge(trc, instance, "JSFunction instance");
+    }
+  }
+}
+
+static void fun_trace(JSTracer* trc, JSObject* obj) {
+  obj->as<JSFunction>().trace(trc);
+}
+
+static JSObject* CreateFunctionConstructor(JSContext* cx, JSProtoKey key) {
+  Rooted<GlobalObject*> global(cx, cx->global());
+  RootedObject functionProto(cx, &global->getPrototype(JSProto_Function));
+
+  RootedObject functionCtor(
+      cx, NewFunctionWithProto(
+              cx, Function, 1, FunctionFlags::NATIVE_CTOR, nullptr,
+              Handle<PropertyName*>(cx->names().Function), functionProto,
+              gc::AllocKind::FUNCTION, TenuredObject));
+  if (!functionCtor) {
+    return nullptr;
+  }
+
+  return functionCtor;
+}
+
+static bool FunctionPrototype(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  args.rval().setUndefined();
+  return true;
+}
+
+static JSObject* CreateFunctionPrototype(JSContext* cx, JSProtoKey key) {
+  Rooted<GlobalObject*> self(cx, cx->global());
+
+  RootedObject objectProto(cx, &self->getPrototype(JSProto_Object));
+
+  return NewFunctionWithProto(
+      cx, FunctionPrototype, 0, FunctionFlags::NATIVE_FUN, nullptr,
+      Handle<PropertyName*>(cx->names().empty), objectProto,
+      gc::AllocKind::FUNCTION, TenuredObject);
+}
+
+JSString* js::FunctionToStringCache::lookup(BaseScript* script) const {
+  for (size_t i = 0; i < NumEntries; i++) {
+    if (entries_[i].script == script) {
+      return entries_[i].string;
+    }
+  }
+  return nullptr;
+}
+
+void js::FunctionToStringCache::put(BaseScript* script, JSString* string) {
+  for (size_t i = NumEntries - 1; i > 0; i--) {
+    entries_[i] = entries_[i - 1];
+  }
+
+  entries_[0].set(script, string);
+}
+
+JSString* js::FunctionToString(JSContext* cx, HandleFunction fun,
+                               bool isToSource) {
+  if (IsAsmJSModule(fun)) {
+    return AsmJSModuleToString(cx, fun, isToSource);
+  }
+  if (IsAsmJSFunction(fun)) {
+    return AsmJSFunctionToString(cx, fun);
+  }
+
+  // Self-hosted built-ins should not expose their source code.
+  bool haveSource = fun->isInterpreted() && !fun->isSelfHostedBuiltin();
+
+  // If we're in toSource mode, put parentheses around lambda functions so
+  // that eval returns lambda, not function statement.
+  bool addParentheses =
+      haveSource && isToSource && (fun->isLambda() && !fun->isArrow());
+
+  if (haveSource) {
+    if (!ScriptSource::loadSource(cx, fun->baseScript()->scriptSource(),
+                                  &haveSource)) {
+      return nullptr;
+    }
+  }
+
+  // Fast path for the common case, to avoid StringBuffer overhead.
+  if (!addParentheses && haveSource) {
+    FunctionToStringCache& cache = cx->zone()->functionToStringCache();
+    if (JSString* str = cache.lookup(fun->baseScript())) {
+      return str;
+    }
+
+    BaseScript* script = fun->baseScript();
+    size_t start = script->toStringStart();
+    size_t end = script->toStringEnd();
+    JSString* str =
+        (end - start <= ScriptSource::SourceDeflateLimit)
+            ? script->scriptSource()->substring(cx, start, end)
+            : script->scriptSource()->substringDontDeflate(cx, start, end);
+    if (!str) {
+      return nullptr;
+    }
+
+    cache.put(fun->baseScript(), str);
+    return str;
+  }
+
+  JSStringBuilder out(cx);
+  if (addParentheses) {
+    if (!out.append('(')) {
+      return nullptr;
+    }
+  }
+
+  if (haveSource) {
+    if (!fun->baseScript()->appendSourceDataForToString(cx, out)) {
+      return nullptr;
+    }
+  } else if (!isToSource) {
+    // For the toString() output the source representation must match
+    // NativeFunction when no source text is available.
+    //
+    // NativeFunction:
+    //   function PropertyName[~Yield,~Await]opt (
+    //      FormalParameters[~Yield,~Await] ) { [native code] }
+    //
+    // Additionally, if |fun| is a well-known intrinsic object and is not
+    // identified as an anonymous function, the portion of the returned
+    // string that would be matched by IdentifierName must be the initial
+    // value of the name property of |fun|.
+
+    auto hasGetterOrSetterPrefix = [](JSAtom* name) {
+      auto hasGetterOrSetterPrefix = [](const auto* chars) {
+        return (chars[0] == 'g' || chars[0] == 's') && chars[1] == 'e' &&
+               chars[2] == 't' && chars[3] == ' ';
+      };
+
+      JS::AutoCheckCannotGC nogc;
+      return name->length() >= 4 &&
+             (name->hasLatin1Chars()
+                  ? hasGetterOrSetterPrefix(name->latin1Chars(nogc))
+                  : hasGetterOrSetterPrefix(name->twoByteChars(nogc)));
+    };
+
+    if (!out.append("function")) {
+      return nullptr;
+    }
+
+    // We don't want to fully parse the function's name here because of
+    // performance reasons, so only append the name if we're confident it
+    // can be matched as the 'PropertyName' grammar production.
+    if (fun->explicitName() &&
+        (fun->kind() == FunctionFlags::NormalFunction ||
+         fun->kind() == FunctionFlags::Wasm ||
+         fun->kind() == FunctionFlags::ClassConstructor)) {
+      if (!out.append(' ')) {
+        return nullptr;
+      }
+
+      // Built-in getters or setters are classified as normal
+      // functions, strip any leading "get " or "set " if present.
+      JSAtom* name = fun->explicitName();
+      size_t offset = hasGetterOrSetterPrefix(name) ? 4 : 0;
+      if (!out.appendSubstring(name, offset, name->length() - offset)) {
+        return nullptr;
+      }
+    }
+
+    if (!out.append("() {\n    [native code]\n}")) {
+      return nullptr;
+    }
+  } else {
+    if (fun->isAsync()) {
+      if (!out.append("async ")) {
+        return nullptr;
+      }
+    }
+
+    if (!fun->isArrow()) {
+      if (!out.append("function")) {
+        return nullptr;
+      }
+
+      if (fun->isGenerator()) {
+        if (!out.append('*')) {
+          return nullptr;
+        }
+      }
+    }
+
+    if (fun->explicitName()) {
+      if (!out.append(' ')) {
+        return nullptr;
+      }
+      if (!out.append(fun->explicitName())) {
+        return nullptr;
+      }
+    }
+
+    if (!out.append("() {\n    [native code]\n}")) {
+      return nullptr;
+    }
+  }
+
+  if (addParentheses) {
+    if (!out.append(')')) {
+      return nullptr;
+    }
+  }
+
+  return out.finishString();
+}
+
+JSString* fun_toStringHelper(JSContext* cx, HandleObject obj, bool isToSource) {
+  if (!obj->is<JSFunction>()) {
+    if (JSFunToStringOp op = obj->getOpsFunToString()) {
+      return op(cx, obj, isToSource);
+    }
+
+    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                              JSMSG_INCOMPATIBLE_PROTO, js_Function_str,
+                              js_toString_str, "object");
+    return nullptr;
+  }
+
+  return FunctionToString(cx, obj.as<JSFunction>(), isToSource);
+}
+
+bool js::fun_toString(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  MOZ_ASSERT(IsFunctionObject(args.calleev()));
+
+  RootedObject obj(cx, ToObject(cx, args.thisv()));
+  if (!obj) {
+    return false;
+  }
+
+  JSString* str = fun_toStringHelper(cx, obj, /* isToSource = */ false);
+  if (!str) {
+    return false;
+  }
+
+  args.rval().setString(str);
+  return true;
+}
+
+static bool fun_toSource(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  MOZ_ASSERT(IsFunctionObject(args.calleev()));
+
+  RootedObject obj(cx, ToObject(cx, args.thisv()));
+  if (!obj) {
+    return false;
+  }
+
+  RootedString str(cx);
+  if (obj->isCallable()) {
+    str = fun_toStringHelper(cx, obj, /* isToSource = */ true);
+  } else {
+    str = ObjectToSource(cx, obj);
+  }
+  if (!str) {
+    return false;
+  }
+
+  args.rval().setString(str);
+  return true;
+}
+
+bool js::fun_call(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+
+  HandleValue func = args.thisv();
+
+  // We don't need to do this -- Call would do it for us -- but the error
+  // message is *much* better if we do this here.  (Without this,
+  // JSDVG_SEARCH_STACK tries to decompile |func| as if it were |this| in
+  // the scripted caller's frame -- so for example
+  //
+  //   Function.prototype.call.call({});
+  //
+  // would identify |{}| as |this| as being the result of evaluating
+  // |Function.prototype.call| and would conclude, "Function.prototype.call
+  // is not a function".  Grotesque.)
+  if (!IsCallable(func)) {
+    ReportIncompatibleMethod(cx, args, &FunctionClass);
+    return false;
+  }
+
+  size_t argCount = args.length();
+  if (argCount > 0) {
+    argCount--;  // strip off provided |this|
+  }
+
+  InvokeArgs iargs(cx);
+  if (!iargs.init(cx, argCount)) {
+    return false;
+  }
+
+  for (size_t i = 0; i < argCount; i++) {
+    iargs[i].set(args[i + 1]);
+  }
+
+  return Call(cx, func, args.get(0), iargs, args.rval(), CallReason::FunCall);
+}
+
+// ES5 15.3.4.3
+bool js::fun_apply(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+
+  // Step 1.
+  //
+  // Note that we must check callability here, not at actual call time,
+  // because extracting argument values from the provided arraylike might
+  // have side effects or throw an exception.
+  HandleValue fval = args.thisv();
+  if (!IsCallable(fval)) {
+    ReportIncompatibleMethod(cx, args, &FunctionClass);
+    return false;
+  }
+
+  // Step 2.
+  if (args.length() < 2 || args[1].isNullOrUndefined()) {
+    return fun_call(cx, (args.length() > 0) ? 1 : 0, vp);
+  }
+
+  // Step 3.
+  if (!args[1].isObject()) {
+    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                              JSMSG_BAD_APPLY_ARGS, js_apply_str);
+    return false;
+  }
+
+  // Steps 4-5 (note erratum removing steps originally numbered 5 and 7 in
+  // original version of ES5).
+  RootedObject aobj(cx, &args[1].toObject());
+  uint64_t length;
+  if (!GetLengthProperty(cx, aobj, &length)) {
+    return false;
+  }
+
+  // Step 6.
+  InvokeArgs args2(cx);
+  if (!args2.init(cx, length)) {
+    return false;
+  }
+
+  MOZ_ASSERT(length <= ARGS_LENGTH_MAX);
+
+  // Steps 7-8.
+  if (!GetElements(cx, aobj, length, args2.array())) {
+    return false;
+  }
+
+  // Step 9.
+  return Call(cx, fval, args[0], args2, args.rval(), CallReason::FunCall);
+}
+
+static const JSFunctionSpec function_methods[] = {
+    JS_FN(js_toSource_str, fun_toSource, 0, 0),
+    JS_FN(js_toString_str, fun_toString, 0, 0),
+    JS_FN(js_apply_str, fun_apply, 2, 0),
+    JS_FN(js_call_str, fun_call, 1, 0),
+    JS_INLINABLE_FN("bind", BoundFunctionObject::functionBind, 1, 0,
+                    FunctionBind),
+    JS_SYM_FN(hasInstance, fun_symbolHasInstance, 1,
+              JSPROP_READONLY | JSPROP_PERMANENT),
+    JS_FS_END};
+
+static const JSClassOps JSFunctionClassOps = {
+    nullptr,         // addProperty
+    nullptr,         // delProperty
+    fun_enumerate,   // enumerate
+    nullptr,         // newEnumerate
+    fun_resolve,     // resolve
+    fun_mayResolve,  // mayResolve
+    nullptr,         // finalize
+    nullptr,         // call
+    nullptr,         // construct
+    fun_trace,       // trace
+};
+
+static const ClassSpec JSFunctionClassSpec = {
+    CreateFunctionConstructor, CreateFunctionPrototype, nullptr, nullptr,
+    function_methods,          function_properties};
+
+const JSClass js::FunctionClass = {
+    js_Function_str,
+    JSCLASS_HAS_CACHED_PROTO(JSProto_Function) |
+        JSCLASS_HAS_RESERVED_SLOTS(JSFunction::SlotCount),
+    &JSFunctionClassOps, &JSFunctionClassSpec};
+
+const JSClass js::ExtendedFunctionClass = {
+    js_Function_str,
+    JSCLASS_HAS_CACHED_PROTO(JSProto_Function) |
+        JSCLASS_HAS_RESERVED_SLOTS(FunctionExtended::SlotCount),
+    &JSFunctionClassOps, &JSFunctionClassSpec};
+
+const JSClass* const js::FunctionClassPtr = &FunctionClass;
+const JSClass* const js::FunctionExtendedClassPtr = &ExtendedFunctionClass;
+
+bool JSFunction::isDerivedClassConstructor() const {
+  bool derived = hasBaseScript() && baseScript()->isDerivedClassConstructor();
+  MOZ_ASSERT_IF(derived, isClassConstructor());
+  return derived;
+}
+
+bool JSFunction::isSyntheticFunction() const {
+  bool synthetic = hasBaseScript() && baseScript()->isSyntheticFunction();
+  MOZ_ASSERT_IF(synthetic, isMethod());
+  return synthetic;
+}
+
+/* static */
+bool JSFunction::delazifyLazilyInterpretedFunction(JSContext* cx,
+                                                   HandleFunction fun) {
+  MOZ_ASSERT(fun->hasBaseScript());
+  MOZ_ASSERT(cx->compartment() == fun->compartment());
+
+  // The function must be same-compartment but might be cross-realm. Make sure
+  // the script is created in the function's realm.
+  AutoRealm ar(cx, fun);
+
+  Rooted<BaseScript*> lazy(cx, fun->baseScript());
+  RootedFunction canonicalFun(cx, lazy->function());
+
+  // If this function is non-canonical, then use the canonical function first
+  // to get the delazified script. This may result in calling this method
+  // again on the canonical function. This ensures the canonical function is
+  // always non-lazy if any of the clones are non-lazy.
+  if (fun != canonicalFun) {
+    JSScript* script = JSFunction::getOrCreateScript(cx, canonicalFun);
+    if (!script) {
+      return false;
+    }
+
+    // Delazifying the canonical function should naturally make us non-lazy
+    // because we share a BaseScript with the canonical function.
+    MOZ_ASSERT(fun->hasBytecode());
+    return true;
+  }
+
+  // Finally, compile the script if it really doesn't exist.
+  AutoReportFrontendContext fc(cx);
+  if (!frontend::DelazifyCanonicalScriptedFunction(cx, &fc, fun)) {
+    // The frontend shouldn't fail after linking the function and the
+    // non-lazy script together.
+    MOZ_ASSERT(fun->baseScript() == lazy);
+    MOZ_ASSERT(lazy->isReadyForDelazification());
+    return false;
+  }
+
+  return true;
+}
+
+/* static */
+bool JSFunction::delazifySelfHostedLazyFunction(JSContext* cx,
+                                                js::HandleFunction fun) {
+  MOZ_ASSERT(cx->compartment() == fun->compartment());
+
+  // The function must be same-compartment but might be cross-realm. Make sure
+  // the script is created in the function's realm.
+  AutoRealm ar(cx, fun);
+
+  /* Lazily cloned self-hosted script. */
+  MOZ_ASSERT(fun->isSelfHostedBuiltin());
+  Rooted<PropertyName*> funName(cx, GetClonedSelfHostedFunctionName(fun));
+  if (!funName) {
+    return false;
+  }
+  return cx->runtime()->delazifySelfHostedFunction(cx, funName, fun);
+}
+
+void JSFunction::maybeRelazify(JSRuntime* rt) {
+  MOZ_ASSERT(!isIncomplete(), "Cannot relazify incomplete functions");
+
+  // Don't relazify functions in compartments that are active.
+  Realm* realm = this->realm();
+  if (!rt->allowRelazificationForTesting) {
+    if (realm->compartment()->gcState.hasEnteredRealm) {
+      return;
+    }
+
+    MOZ_ASSERT(!realm->hasBeenEnteredIgnoringJit());
+  }
+
+  // Don't relazify if the realm is being debugged. The debugger side-tables
+  // such as the set of active breakpoints require bytecode to exist.
+  if (realm->isDebuggee()) {
+    return;
+  }
+
+  // Don't relazify if we are collecting coverage so that we do not lose count
+  // information.
+  if (coverage::IsLCovEnabled()) {
+    return;
+  }
+
+  // Check the script's eligibility.
+  JSScript* script = nonLazyScript();
+  if (!script->allowRelazify()) {
+    return;
+  }
+  MOZ_ASSERT(script->isRelazifiable());
+
+  // There must not be any JIT code attached since the relazification process
+  // does not know how to discard it. In general, the GC should discard most JIT
+  // code before attempting relazification.
+  if (script->hasJitScript()) {
+    return;
+  }
+
+  if (isSelfHostedBuiltin()) {
+    gc::PreWriteBarrier(script);
+    initSelfHostedLazyScript(&rt->selfHostedLazyScript.ref());
+  } else {
+    script->relazify(rt);
+  }
+}
+
+js::GeneratorKind JSFunction::clonedSelfHostedGeneratorKind() const {
+  MOZ_ASSERT(hasSelfHostedLazyScript());
+
+  // This is a lazy clone of a self-hosted builtin. It has no BaseScript, and
+  // `this->flags_` does not contain the generator kind. Consult the
+  // implementation in the self-hosting realm, which has a BaseScript.
+  MOZ_RELEASE_ASSERT(isExtended());
+  PropertyName* name = GetClonedSelfHostedFunctionName(this);
+  return runtimeFromMainThread()->getSelfHostedFunctionGeneratorKind(name);
+}
+
+// ES2018 draft rev 2aea8f3e617b49df06414eb062ab44fad87661d3
+// 19.2.1.1.1 CreateDynamicFunction( constructor, newTarget, kind, args )
+static bool CreateDynamicFunction(JSContext* cx, const CallArgs& args,
+                                  GeneratorKind generatorKind,
+                                  FunctionAsyncKind asyncKind) {
+  using namespace frontend;
+
+  // Steps 1-5.
+  bool isGenerator = generatorKind == GeneratorKind::Generator;
+  bool isAsync = asyncKind == FunctionAsyncKind::AsyncFunction;
+
+  RootedScript maybeScript(cx);
+  const char* filename;
+  unsigned lineno;
+  bool mutedErrors;
+  uint32_t pcOffset;
+  DescribeScriptedCallerForCompilation(cx, &maybeScript, &filename, &lineno,
+                                       &pcOffset, &mutedErrors);
+
+  const char* introductionType = "Function";
+  if (isAsync) {
+    if (isGenerator) {
+      introductionType = "AsyncGenerator";
+    } else {
+      introductionType = "AsyncFunction";
+    }
+  } else if (isGenerator) {
+    introductionType = "GeneratorFunction";
+  }
+
+  const char* introducerFilename = filename;
+  if (maybeScript && maybeScript->scriptSource()->introducerFilename()) {
+    introducerFilename = maybeScript->scriptSource()->introducerFilename();
+  }
+
+  CompileOptions options(cx);
+  options.setMutedErrors(mutedErrors)
+      .setFileAndLine(filename, 1)
+      .setNoScriptRval(false)
+      .setIntroductionInfo(introducerFilename, introductionType, lineno,
+                           pcOffset)
+      .setDeferDebugMetadata();
+
+  JSStringBuilder sb(cx);
+
+  if (isAsync) {
+    if (!sb.append("async ")) {
+      return false;
+    }
+  }
+  if (!sb.append("function")) {
+    return false;
+  }
+  if (isGenerator) {
+    if (!sb.append('*')) {
+      return false;
+    }
+  }
+
+  if (!sb.append(" anonymous(")) {
+    return false;
+  }
+
+  if (args.length() > 1) {
+    RootedString str(cx);
+
+    // Steps 10, 14.d.
+    unsigned n = args.length() - 1;
+
+    for (unsigned i = 0; i < n; i++) {
+      // Steps 14.a-b, 14.d.i-ii.
+      str = ToString<CanGC>(cx, args[i]);
+      if (!str) {
+        return false;
+      }
+
+      // Steps 14.b, 14.d.iii.
+      if (!sb.append(str)) {
+        return false;
+      }
+
+      if (i < args.length() - 2) {
+        // Step 14.d.iii.
+        if (!sb.append(',')) {
+          return false;
+        }
+      }
+    }
+  }
+
+  if (!sb.append('\n')) {
+    return false;
+  }
+
+  // Remember the position of ")".
+  Maybe<uint32_t> parameterListEnd = Some(uint32_t(sb.length()));
+  static_assert(FunctionConstructorMedialSigils[0] == ')');
+
+  if (!sb.append(FunctionConstructorMedialSigils.data(),
+                 FunctionConstructorMedialSigils.length())) {
+    return false;
+  }
+
+  if (args.length() > 0) {
+    // Steps 13, 14.e, 15.
+    RootedString body(cx, ToString<CanGC>(cx, args[args.length() - 1]));
+    if (!body || !sb.append(body)) {
+      return false;
+    }
+  }
+
+  if (!sb.append(FunctionConstructorFinalBrace.data(),
+                 FunctionConstructorFinalBrace.length())) {
+    return false;
+  }
+
+  // The parser only accepts two byte strings.
+  if (!sb.ensureTwoByteChars()) {
+    return false;
+  }
+
+  RootedString functionText(cx, sb.finishString());
+  if (!functionText) {
+    return false;
+  }
+
+  // Block this call if security callbacks forbid it.
+  if (!cx->isRuntimeCodeGenEnabled(JS::RuntimeCode::JS, functionText)) {
+    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                              JSMSG_CSP_BLOCKED_FUNCTION);
+    return false;
+  }
+
+  // Steps 7.a-b, 8.a-b, 9.a-b, 16-28.
+  AutoStableStringChars linearChars(cx);
+  if (!linearChars.initTwoByte(cx, functionText)) {
+    return false;
+  }
+
+  SourceText<char16_t> srcBuf;
+  if (!srcBuf.initMaybeBorrowed(cx, linearChars)) {
+    return false;
+  }
+
+  FunctionSyntaxKind syntaxKind = FunctionSyntaxKind::Expression;
+
+  RootedFunction fun(cx);
+  JSProtoKey protoKey;
+  if (isAsync) {
+    if (isGenerator) {
+      fun = CompileStandaloneAsyncGenerator(cx, options, srcBuf,
+                                            parameterListEnd, syntaxKind);
+      protoKey = JSProto_AsyncGeneratorFunction;
+    } else {
+      fun = CompileStandaloneAsyncFunction(cx, options, srcBuf,
+                                           parameterListEnd, syntaxKind);
+      protoKey = JSProto_AsyncFunction;
+    }
+  } else {
+    if (isGenerator) {
+      fun = CompileStandaloneGenerator(cx, options, srcBuf, parameterListEnd,
+                                       syntaxKind);
+      protoKey = JSProto_GeneratorFunction;
+    } else {
+      fun = CompileStandaloneFunction(cx, options, srcBuf, parameterListEnd,
+                                      syntaxKind);
+      protoKey = JSProto_Function;
+    }
+  }
+  if (!fun) {
+    return false;
+  }
+
+  RootedValue undefValue(cx);
+  RootedScript funScript(cx, JS_GetFunctionScript(cx, fun));
+  JS::InstantiateOptions instantiateOptions(options);
+  if (funScript &&
+      !UpdateDebugMetadata(cx, funScript, instantiateOptions, undefValue,
+                           nullptr, maybeScript, maybeScript)) {
+    return false;
+  }
+
+  if (fun->isInterpreted()) {
+    fun->initEnvironment(&cx->global()->lexicalEnvironment());
+  }
+
+  // Steps 6, 29.
+  RootedObject proto(cx);
+  if (!GetPrototypeFromBuiltinConstructor(cx, args, protoKey, &proto)) {
+    return false;
+  }
+
+  // Steps 7.d, 8.d (implicit).
+  // Call SetPrototype if an explicit prototype was given.
+  if (proto && !SetPrototype(cx, fun, proto)) {
+    return false;
+  }
+
+  // Step 38.
+  args.rval().setObject(*fun);
+  return true;
+}
+
+bool js::Function(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  return CreateDynamicFunction(cx, args, GeneratorKind::NotGenerator,
+                               FunctionAsyncKind::SyncFunction);
+}
+
+bool js::Generator(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  return CreateDynamicFunction(cx, args, GeneratorKind::Generator,
+                               FunctionAsyncKind::SyncFunction);
+}
+
+bool js::AsyncFunctionConstructor(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  return CreateDynamicFunction(cx, args, GeneratorKind::NotGenerator,
+                               FunctionAsyncKind::AsyncFunction);
+}
+
+bool js::AsyncGeneratorConstructor(JSContext* cx, unsigned argc, Value* vp) {
+  CallArgs args = CallArgsFromVp(argc, vp);
+  return CreateDynamicFunction(cx, args, GeneratorKind::Generator,
+                               FunctionAsyncKind::AsyncFunction);
+}
+
+bool JSFunction::isBuiltinFunctionConstructor() {
+  return maybeNative() == Function || maybeNative() == Generator;
+}
+
+bool JSFunction::needsExtraBodyVarEnvironment() const {
+  if (isNativeFun()) {
+    return false;
+  }
+
+  if (!nonLazyScript()->functionHasExtraBodyVarScope()) {
+    return false;
+  }
+
+  return nonLazyScript()->functionExtraBodyVarScope()->hasEnvironment();
+}
+
+bool JSFunction::needsNamedLambdaEnvironment() const {
+  if (!isNamedLambda()) {
+    return false;
+  }
+
+  LexicalScope* scope = nonLazyScript()->maybeNamedLambdaScope();
+  if (!scope) {
+    return false;
+  }
+
+  return scope->hasEnvironment();
+}
+
+bool JSFunction::needsCallObject() const {
+  if (isNativeFun()) {
+    return false;
+  }
+
+  MOZ_ASSERT(hasBytecode());
+
+  // Note: this should be kept in sync with
+  // FunctionBox::needsCallObjectRegardlessOfBindings().
+  MOZ_ASSERT_IF(
+      baseScript()->funHasExtensibleScope() || isGenerator() || isAsync(),
+      nonLazyScript()->bodyScope()->hasEnvironment());
+
+  return nonLazyScript()->bodyScope()->hasEnvironment();
+}
+
+#ifdef DEBUG
+static JSObject* SkipEnvironmentObjects(JSObject* env) {
+  if (!env) {
+    return nullptr;
+  }
+  while (env->is<EnvironmentObject>()) {
+    env = &env->as<EnvironmentObject>().enclosingEnvironment();
+  }
+  return env;
+}
+
+static bool NewFunctionEnvironmentIsWellFormed(JSContext* cx,
+                                               HandleObject env) {
+  // Assert that the terminating environment is null, global, or a debug
+  // scope proxy. All other cases of polluting global scope behavior are
+  // handled by EnvironmentObjects (viz. non-syntactic DynamicWithObject and
+  // NonSyntacticVariablesObject).
+  RootedObject terminatingEnv(cx, SkipEnvironmentObjects(env));
+  return !terminatingEnv || terminatingEnv == cx->global() ||
+         terminatingEnv->is<DebugEnvironmentProxy>();
+}
+#endif
+
+static inline const JSClass* FunctionClassForAllocKind(
+    gc::AllocKind allocKind) {
+  return (allocKind == gc::AllocKind::FUNCTION) ? FunctionClassPtr
+                                                : FunctionExtendedClassPtr;
+}
+
+static void AssertClassMatchesAllocKind(const JSClass* clasp,
+                                        gc::AllocKind kind) {
+#ifdef DEBUG
+  if (kind == gc::AllocKind::FUNCTION_EXTENDED) {
+    MOZ_ASSERT(clasp == FunctionExtendedClassPtr);
+  } else {
+    MOZ_ASSERT(kind == gc::AllocKind::FUNCTION);
+    MOZ_ASSERT(clasp == FunctionClassPtr);
+  }
+#endif
+}
+
+static SharedShape* GetFunctionShape(JSContext* cx, const JSClass* clasp,
+                                     JSObject* proto, gc::AllocKind allocKind) {
+  AssertClassMatchesAllocKind(clasp, allocKind);
+
+  size_t nfixed = GetGCKindSlots(allocKind);
+  return SharedShape::getInitialShape(
+      cx, clasp, cx->realm(), TaggedProto(proto), nfixed, ObjectFlags());
+}
+
+SharedShape* GlobalObject::createFunctionShapeWithDefaultProto(JSContext* cx,
+                                                               bool extended) {
+  GlobalObjectData& data = cx->global()->data();
+  HeapPtr<SharedShape*>& shapeRef =
+      extended ? data.extendedFunctionShapeWithDefaultProto
+               : data.functionShapeWithDefaultProto;
+  MOZ_ASSERT(!shapeRef);
+
+  RootedObject proto(cx,
+                     GlobalObject::getOrCreatePrototype(cx, JSProto_Function));
+  if (!proto) {
+    return nullptr;
+  }
+
+  // Creating %Function.prototype% can end up initializing the shape.
+  if (shapeRef) {
+    return shapeRef;
+  }
+
+  gc::AllocKind allocKind =
+      extended ? gc::AllocKind::FUNCTION_EXTENDED : gc::AllocKind::FUNCTION;
+  const JSClass* clasp = FunctionClassForAllocKind(allocKind);
+
+  SharedShape* shape = GetFunctionShape(cx, clasp, proto, allocKind);
+  if (!shape) {
+    return nullptr;
+  }
+
+  shapeRef.init(shape);
+  return shape;
+}
+
+JSFunction* js::NewFunctionWithProto(
+    JSContext* cx, Native native, unsigned nargs, FunctionFlags flags,
+    HandleObject enclosingEnv, Handle<JSAtom*> atom, HandleObject proto,
+    gc::AllocKind allocKind /* = AllocKind::FUNCTION */,
+    NewObjectKind newKind /* = GenericObject */) {
+  MOZ_ASSERT(allocKind == gc::AllocKind::FUNCTION ||
+             allocKind == gc::AllocKind::FUNCTION_EXTENDED);
+  MOZ_ASSERT_IF(native, !enclosingEnv);
+  MOZ_ASSERT(NewFunctionEnvironmentIsWellFormed(cx, enclosingEnv));
+
+  // NOTE: Keep this in sync with `CreateFunctionFast` in Stencil.cpp
+
+  const JSClass* clasp = FunctionClassForAllocKind(allocKind);
+
+  Rooted<SharedShape*> shape(cx);
+  if (!proto) {
+    bool extended = (allocKind == gc::AllocKind::FUNCTION_EXTENDED);
+    shape = GlobalObject::getFunctionShapeWithDefaultProto(cx, extended);
+  } else {
+    shape = GetFunctionShape(cx, clasp, proto, allocKind);
+  }
+  if (!shape) {
+    return nullptr;
+  }
+
+  gc::Heap heap = GetInitialHeap(newKind, clasp);
+  JSFunction* fun = JSFunction::create(cx, allocKind, heap, shape);
+  if (!fun) {
+    return nullptr;
+  }
+
+  if (allocKind == gc::AllocKind::FUNCTION_EXTENDED) {
+    flags.setIsExtended();
+  }
+
+  // Disallow flags that require special union arms to be initialized.
+  MOZ_ASSERT(!flags.hasSelfHostedLazyScript());
+  MOZ_ASSERT(!flags.isWasmWithJitEntry());
+
+  /* Initialize all function members. */
+  fun->setArgCount(uint16_t(nargs));
+  fun->setFlags(flags);
+  if (fun->isInterpreted()) {
+    fun->initScript(nullptr);
+    fun->initEnvironment(enclosingEnv);
+  } else {
+    MOZ_ASSERT(fun->isNativeFun());
+    fun->initNative(native, nullptr);
+  }
+  fun->initAtom(atom);
+
+  return fun;
+}
+
+bool js::GetFunctionPrototype(JSContext* cx, js::GeneratorKind generatorKind,
+                              js::FunctionAsyncKind asyncKind,
+                              js::MutableHandleObject proto) {
+  if (generatorKind == js::GeneratorKind::NotGenerator) {
+    if (asyncKind == js::FunctionAsyncKind::SyncFunction) {
+      proto.set(nullptr);
+      return true;
+    }
+
+    proto.set(
+        GlobalObject::getOrCreateAsyncFunctionPrototype(cx, cx->global()));
+  } else {
+    if (asyncKind == js::FunctionAsyncKind::SyncFunction) {
+      proto.set(GlobalObject::getOrCreateGeneratorFunctionPrototype(
+          cx, cx->global()));
+    } else {
+      proto.set(GlobalObject::getOrCreateAsyncGenerator(cx, cx->global()));
+    }
+  }
+  return !!proto;
+}
+
+#ifdef DEBUG
+static bool CanReuseScriptForClone(JS::Realm* realm, HandleFunction fun,
+                                   HandleObject newEnclosingEnv) {
+  MOZ_ASSERT(fun->isInterpreted());
+
+  if (realm != fun->realm()) {
+    return false;
+  }
+
+  if (newEnclosingEnv->is<GlobalObject>()) {
+    return true;
+  }
+
+  // Don't need to clone the script if newEnclosingEnv is a syntactic scope,
+  // since in that case we have some actual scope objects on our scope chain and
+  // whatnot; whoever put them there should be responsible for setting our
+  // script's flags appropriately.  We hit this case for JSOp::Lambda, for
+  // example.
+  if (IsSyntacticEnvironment(newEnclosingEnv)) {
+    return true;
+  }
+
+  // We need to clone the script if we're not already marked as having a
+  // non-syntactic scope. The HasNonSyntacticScope flag is not computed for lazy
+  // scripts so fallback to checking the scope chain.
+  BaseScript* script = fun->baseScript();
+  return script->hasNonSyntacticScope() ||
+         script->enclosingScope()->hasOnChain(ScopeKind::NonSyntactic);
+}
+#endif
+
+static inline JSFunction* NewFunctionClone(JSContext* cx, HandleFunction fun,
+                                           HandleObject proto) {
+  MOZ_ASSERT(cx->realm() == fun->realm());
+  MOZ_ASSERT(proto);
+
+  const JSClass* clasp = fun->getClass();
+  gc::AllocKind allocKind = fun->getAllocKind();
+  AssertClassMatchesAllocKind(clasp, allocKind);
+
+  // If |fun| also has |proto| as prototype (the common case) we can reuse its
+  // shape for the clone. This works because |fun| isn't exposed to script.
+  Rooted<SharedShape*> shape(cx);
+  if (fun->staticPrototype() == proto) {
+    shape = fun->sharedShape();
+    MOZ_ASSERT(shape->propMapLength() == 0);
+    MOZ_ASSERT(shape->objectFlags().isEmpty());
+    MOZ_ASSERT(shape->realm() == cx->realm());
+  } else {
+    shape = GetFunctionShape(cx, clasp, proto, allocKind);
+    if (!shape) {
+      return nullptr;
+    }
+  }
+
+  JSFunction* clone =
+      JSFunction::create(cx, allocKind, gc::Heap::Default, shape);
+  if (!clone) {
+    return nullptr;
+  }
+
+  constexpr uint16_t NonCloneableFlags =
+      FunctionFlags::RESOLVED_LENGTH | FunctionFlags::RESOLVED_NAME;
+
+  FunctionFlags flags = fun->flags();
+  flags.clearFlags(NonCloneableFlags);
+
+  clone->setArgCount(fun->nargs());
+  clone->setFlags(flags);
+
+  // Note: |clone| and |fun| are same-zone so we don't need to call markAtom.
+  clone->initAtom(fun->displayAtom());
+
+  return clone;
+}
+
+JSFunction* js::CloneFunctionReuseScript(JSContext* cx, HandleFunction fun,
+                                         HandleObject enclosingEnv,
+                                         HandleObject proto) {
+  MOZ_ASSERT(cx->realm() == fun->realm());
+  MOZ_ASSERT(NewFunctionEnvironmentIsWellFormed(cx, enclosingEnv));
+  MOZ_ASSERT(fun->isInterpreted());
+  MOZ_ASSERT(CanReuseScriptForClone(cx->realm(), fun, enclosingEnv));
+
+  RootedFunction clone(cx, NewFunctionClone(cx, fun, proto));
+  if (!clone) {
+    return nullptr;
+  }
+
+  if (fun->hasBaseScript()) {
+    BaseScript* base = fun->baseScript();
+    clone->initScript(base);
+    clone->initEnvironment(enclosingEnv);
+  } else {
+    MOZ_ASSERT(fun->hasSelfHostedLazyScript());
+    SelfHostedLazyScript* lazy = fun->selfHostedLazyScript();
+    clone->initSelfHostedLazyScript(lazy);
+    clone->initEnvironment(enclosingEnv);
+  }
+
+#ifdef DEBUG
+  // Assert extended slots don't need to be copied.
+  if (fun->isExtended()) {
+    for (unsigned i = 0; i < FunctionExtended::NUM_EXTENDED_SLOTS; i++) {
+      MOZ_ASSERT(fun->getExtendedSlot(i).isUndefined());
+      MOZ_ASSERT(clone->getExtendedSlot(i).isUndefined());
+    }
+  }
+#endif
+
+  return clone;
+}
+
+JSFunction* js::CloneAsmJSModuleFunction(JSContext* cx, HandleFunction fun) {
+  MOZ_ASSERT(fun->isNativeFun());
+  MOZ_ASSERT(IsAsmJSModule(fun));
+  MOZ_ASSERT(fun->isExtended());
+  MOZ_ASSERT(cx->compartment() == fun->compartment());
+
+  RootedObject proto(cx, fun->staticPrototype());
+  JSFunction* clone = NewFunctionClone(cx, fun, proto);
+  if (!clone) {
+    return nullptr;
+  }
+
+  MOZ_ASSERT(fun->native() == InstantiateAsmJS);
+  MOZ_ASSERT(!fun->hasJitInfo());
+  clone->initNative(InstantiateAsmJS, nullptr);
+
+  JSObject* moduleObj =
+      &fun->getExtendedSlot(FunctionExtended::ASMJS_MODULE_SLOT).toObject();
+  clone->initExtendedSlot(FunctionExtended::ASMJS_MODULE_SLOT,
+                          ObjectValue(*moduleObj));
+
+  return clone;
+}
+
+static JSAtom* SymbolToFunctionName(JSContext* cx, JS::Symbol* symbol,
+                                    FunctionPrefixKind prefixKind) {
+  // Step 4.a.
+  JSAtom* desc = symbol->description();
+
+  // Step 4.b, no prefix fastpath.
+  if (!desc && prefixKind == FunctionPrefixKind::None) {
+    return cx->names().empty;
+  }
+
+  // Step 5 (reordered).
+  StringBuffer sb(cx);
+  if (prefixKind == FunctionPrefixKind::Get) {
+    if (!sb.append("get ")) {
+      return nullptr;
+    }
+  } else if (prefixKind == FunctionPrefixKind::Set) {
+    if (!sb.append("set ")) {
+      return nullptr;
+    }
+  }
+
+  // Step 4.b.
+  if (desc) {
+    // Note: Private symbols are wedged in, as implementation wise they're
+    // PrivateNameSymbols with a the source level name as a description
+    // i.e. obj.#f desugars to obj.[PrivateNameSymbol("#f")], however
+    // they don't use the symbol naming, but rather property naming.
+    if (symbol->isPrivateName()) {
+      if (!sb.append(desc)) {
+        return nullptr;
+      }
+    } else {
+      // Step 4.c.
+      if (!sb.append('[') || !sb.append(desc) || !sb.append(']')) {
+        return nullptr;
+      }
+    }
+  }
+  return sb.finishAtom();
+}
+
+static JSAtom* NameToFunctionName(JSContext* cx, HandleValue name,
+                                  FunctionPrefixKind prefixKind) {
+  MOZ_ASSERT(name.isString() || name.isNumeric());
+
+  if (prefixKind == FunctionPrefixKind::None) {
+    return ToAtom<CanGC>(cx, name);
+  }
+
+  JSString* nameStr = ToString(cx, name);
+  if (!nameStr) {
+    return nullptr;
+  }
+
+  StringBuffer sb(cx);
+  if (prefixKind == FunctionPrefixKind::Get) {
+    if (!sb.append("get ")) {
+      return nullptr;
+    }
+  } else {
+    if (!sb.append("set ")) {
+      return nullptr;
+    }
+  }
+  if (!sb.append(nameStr)) {
+    return nullptr;
+  }
+  return sb.finishAtom();
+}
+
+/*
+ * Return an atom for use as the name of a builtin method with the given
+ * property id.
+ *
+ * Function names are always strings. If id is the well-known @@iterator
+ * symbol, this returns "[Symbol.iterator]".  If a prefix is supplied the final
+ * name is |prefix + " " + name|.
+ *
+ * Implements steps 3-5 of 9.2.11 SetFunctionName in ES2016.
+ */
+JSAtom* js::IdToFunctionName(
+    JSContext* cx, HandleId id,
+    FunctionPrefixKind prefixKind /* = FunctionPrefixKind::None */) {
+  MOZ_ASSERT(id.isString() || id.isSymbol() || id.isInt());
+
+  // No prefix fastpath.
+  if (id.isAtom() && prefixKind == FunctionPrefixKind::None) {
+    return id.toAtom();
+  }
+
+  // Step 3 (implicit).
+
+  // Step 4.
+  if (id.isSymbol()) {
+    return SymbolToFunctionName(cx, id.toSymbol(), prefixKind);
+  }
+
+  // Step 5.
+  RootedValue idv(cx, IdToValue(id));
+  return NameToFunctionName(cx, idv, prefixKind);
+}
+
+bool js::SetFunctionName(JSContext* cx, HandleFunction fun, HandleValue name,
+                         FunctionPrefixKind prefixKind) {
+  MOZ_ASSERT(name.isString() || name.isSymbol() || name.isNumeric());
+
+  // `fun` is a newly created function, so it can't already have an inferred
+  // name.
+  MOZ_ASSERT(!fun->hasInferredName());
+
+  // Anonymous functions should neither have an own 'name' property nor a
+  // resolved name at this point.
+  MOZ_ASSERT(!fun->containsPure(cx->names().name));
+  MOZ_ASSERT(!fun->hasResolvedName());
+
+  JSAtom* funName = name.isSymbol()
+                        ? SymbolToFunctionName(cx, name.toSymbol(), prefixKind)
+                        : NameToFunctionName(cx, name, prefixKind);
+  if (!funName) {
+    return false;
+  }
+
+  fun->setInferredName(funName);
+
+  return true;
+}
+
+JSFunction* js::DefineFunction(
+    JSContext* cx, HandleObject obj, HandleId id, Native native, unsigned nargs,
+    unsigned flags, gc::AllocKind allocKind /* = AllocKind::FUNCTION */) {
+  Rooted<JSAtom*> atom(cx, IdToFunctionName(cx, id));
+  if (!atom) {
+    return nullptr;
+  }
+
+  MOZ_ASSERT(native);
+
+  RootedFunction fun(cx);
+  if (flags & JSFUN_CONSTRUCTOR) {
+    fun = NewNativeConstructor(cx, native, nargs, atom, allocKind);
+  } else {
+    fun = NewNativeFunction(cx, native, nargs, atom, allocKind);
+  }
+
+  if (!fun) {
+    return nullptr;
+  }
+
+  RootedValue funVal(cx, ObjectValue(*fun));
+  if (!DefineDataProperty(cx, obj, id, funVal, flags & ~JSFUN_FLAGS_MASK)) {
+    return nullptr;
+  }
+
+  return fun;
+}
+
+void js::ReportIncompatibleMethod(JSContext* cx, const CallArgs& args,
+                                  const JSClass* clasp) {
+  RootedValue thisv(cx, args.thisv());
+
+#ifdef DEBUG
+  switch (thisv.type()) {
+    case ValueType::Object:
+      MOZ_ASSERT(thisv.toObject().getClass() != clasp ||
+                 !thisv.toObject().is<NativeObject>() ||
+                 !thisv.toObject().staticPrototype() ||
+                 thisv.toObject().staticPrototype()->getClass() != clasp);
+      break;
+#  ifdef ENABLE_RECORD_TUPLE
+    case ValueType::ExtendedPrimitive:
+      MOZ_CRASH("ExtendedPrimitive is not supported yet");
+      break;
+#  endif
+    case ValueType::String:
+      MOZ_ASSERT(clasp != &StringObject::class_);
+      break;
+    case ValueType::Double:
+    case ValueType::Int32:
+      MOZ_ASSERT(clasp != &NumberObject::class_);
+      break;
+    case ValueType::Boolean:
+      MOZ_ASSERT(clasp != &BooleanObject::class_);
+      break;
+    case ValueType::Symbol:
+      MOZ_ASSERT(clasp != &SymbolObject::class_);
+      break;
+    case ValueType::BigInt:
+      MOZ_ASSERT(clasp != &BigIntObject::class_);
+      break;
+    case ValueType::Undefined:
+    case ValueType::Null:
+      break;
+    case ValueType::Magic:
+    case ValueType::PrivateGCThing:
+      MOZ_CRASH("unexpected type");
+  }
+#endif
+
+  if (JSFunction* fun = ReportIfNotFunction(cx, args.calleev())) {
+    UniqueChars funNameBytes;
+    if (const char* funName = GetFunctionNameBytes(cx, fun, &funNameBytes)) {
+      JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr,
+                               JSMSG_INCOMPATIBLE_PROTO, clasp->name, funName,
+                               InformalValueTypeName(thisv));
+    }
+  }
+}
+
+void js::ReportIncompatible(JSContext* cx, const CallArgs& args) {
+  if (JSFunction* fun = ReportIfNotFunction(cx, args.calleev())) {
+    UniqueChars funNameBytes;
+    if (const char* funName = GetFunctionNameBytes(cx, fun, &funNameBytes)) {
+      JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr,
+                               JSMSG_INCOMPATIBLE_METHOD, funName, "method",
+                               InformalValueTypeName(args.thisv()));
+    }
+  }
+}
+
+namespace JS {
+namespace detail {
+
+JS_PUBLIC_API void CheckIsValidConstructible(const Value& calleev) {
+  MOZ_ASSERT(calleev.toObject().isConstructor());
+}
+
+}  // namespace detail
+}  // namespace JS