diff -r 000000000000 -r 6474c204b198 js/src/jsfun.cpp
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/js/src/jsfun.cpp	Wed Dec 31 06:09:35 2014 +0100
@@ -0,0 +1,1926 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ * vim: set ts=8 sts=4 et sw=4 tw=99:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * JS function support.
+ */
+
+#include "jsfuninlines.h"
+
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/PodOperations.h"
+
+#include <string.h>
+
+#include "jsapi.h"
+#include "jsarray.h"
+#include "jsatom.h"
+#include "jscntxt.h"
+#include "jsobj.h"
+#include "jsproxy.h"
+#include "jsscript.h"
+#include "jsstr.h"
+#include "jstypes.h"
+#include "jswrapper.h"
+
+#include "builtin/Eval.h"
+#include "builtin/Object.h"
+#include "frontend/BytecodeCompiler.h"
+#include "frontend/TokenStream.h"
+#include "gc/Marking.h"
+#ifdef JS_ION
+#include "jit/Ion.h"
+#include "jit/JitFrameIterator.h"
+#endif
+#include "vm/Interpreter.h"
+#include "vm/Shape.h"
+#include "vm/StringBuffer.h"
+#include "vm/WrapperObject.h"
+#include "vm/Xdr.h"
+
+#include "jsscriptinlines.h"
+
+#include "vm/Interpreter-inl.h"
+#include "vm/Stack-inl.h"
+
+using namespace js;
+using namespace js::gc;
+using namespace js::types;
+using namespace js::frontend;
+
+using mozilla::ArrayLength;
+using mozilla::PodCopy;
+
+static bool
+fun_getProperty(JSContext *cx, HandleObject obj_, HandleId id, MutableHandleValue vp)
+{
+    RootedObject obj(cx, obj_);
+    while (!obj->is<JSFunction>()) {
+        if (!JSObject::getProto(cx, obj, &obj))
+            return false;
+        if (!obj)
+            return true;
+    }
+    RootedFunction fun(cx, &obj->as<JSFunction>());
+
+    /* Set to early to null in case of error */
+    vp.setNull();
+
+    /* Find fun's top-most activation record. */
+    NonBuiltinScriptFrameIter iter(cx);
+    for (; !iter.done(); ++iter) {
+        if (!iter.isFunctionFrame() || iter.isEvalFrame())
+            continue;
+        if (iter.callee() == fun)
+            break;
+    }
+    if (iter.done())
+        return true;
+
+    if (JSID_IS_ATOM(id, cx->names().arguments)) {
+        if (fun->hasRest()) {
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
+                                 JSMSG_FUNCTION_ARGUMENTS_AND_REST);
+            return false;
+        }
+        /* Warn if strict about f.arguments or equivalent unqualified uses. */
+        if (!JS_ReportErrorFlagsAndNumber(cx, JSREPORT_WARNING | JSREPORT_STRICT, js_GetErrorMessage,
+                                          nullptr, JSMSG_DEPRECATED_USAGE, js_arguments_str)) {
+            return false;
+        }
+
+        ArgumentsObject *argsobj = ArgumentsObject::createUnexpected(cx, iter);
+        if (!argsobj)
+            return false;
+
+#ifdef JS_ION
+        // Disabling compiling of this script in IonMonkey.
+        // IonMonkey does not guarantee |f.arguments| can be
+        // fully recovered, so we try to mitigate observing this behavior by
+        // detecting its use early.
+        JSScript *script = iter.script();
+        jit::ForbidCompilation(cx, script);
+#endif
+
+        vp.setObject(*argsobj);
+        return true;
+    }
+
+    if (JSID_IS_ATOM(id, cx->names().caller)) {
+        ++iter;
+        if (iter.done() || !iter.isFunctionFrame()) {
+            JS_ASSERT(vp.isNull());
+            return true;
+        }
+
+        /* Callsite clones should never escape to script. */
+        JSObject &maybeClone = iter.calleev().toObject();
+        if (maybeClone.is<JSFunction>())
+            vp.setObject(*maybeClone.as<JSFunction>().originalFunction());
+        else
+            vp.set(iter.calleev());
+
+        if (!cx->compartment()->wrap(cx, vp))
+            return false;
+
+        /*
+         * Censor the caller if we don't have full access to it.
+         */
+        RootedObject caller(cx, &vp.toObject());
+        if (caller->is<WrapperObject>() && Wrapper::wrapperHandler(caller)->hasSecurityPolicy()) {
+            vp.setNull();
+        } else if (caller->is<JSFunction>()) {
+            JSFunction *callerFun = &caller->as<JSFunction>();
+            if (callerFun->isInterpreted() && callerFun->strict()) {
+                JS_ReportErrorFlagsAndNumber(cx, JSREPORT_ERROR, js_GetErrorMessage, nullptr,
+                                             JSMSG_CALLER_IS_STRICT);
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    MOZ_ASSUME_UNREACHABLE("fun_getProperty");
+}
+
+
+
+/* NB: no sentinels at ends -- use ArrayLength to bound loops.
+ * Properties censored into [[ThrowTypeError]] in strict mode. */
+static const uint16_t poisonPillProps[] = {
+    NAME_OFFSET(arguments),
+    NAME_OFFSET(caller),
+};
+
+static bool
+fun_enumerate(JSContext *cx, HandleObject obj)
+{
+    JS_ASSERT(obj->is<JSFunction>());
+
+    RootedId id(cx);
+    bool found;
+
+    if (!obj->isBoundFunction() && !obj->as<JSFunction>().isArrow()) {
+        id = NameToId(cx->names().prototype);
+        if (!JSObject::hasProperty(cx, obj, id, &found))
+            return false;
+    }
+
+    id = NameToId(cx->names().length);
+    if (!JSObject::hasProperty(cx, obj, id, &found))
+        return false;
+
+    id = NameToId(cx->names().name);
+    if (!JSObject::hasProperty(cx, obj, id, &found))
+        return false;
+
+    for (unsigned i = 0; i < ArrayLength(poisonPillProps); i++) {
+        const uint16_t offset = poisonPillProps[i];
+        id = NameToId(AtomStateOffsetToName(cx->names(), offset));
+        if (!JSObject::hasProperty(cx, obj, id, &found))
+            return false;
+    }
+
+    return true;
+}
+
+static JSObject *
+ResolveInterpretedFunctionPrototype(JSContext *cx, HandleObject obj)
+{
+#ifdef DEBUG
+    JSFunction *fun = &obj->as<JSFunction>();
+    JS_ASSERT(fun->isInterpreted());
+    JS_ASSERT(!fun->isFunctionPrototype());
+#endif
+
+    // Assert that fun is not a compiler-created function object, which
+    // must never leak to script or embedding code and then be mutated.
+    // Also assert that obj is not bound, per the ES5 15.3.4.5 ref above.
+    JS_ASSERT(!IsInternalFunctionObject(obj));
+    JS_ASSERT(!obj->isBoundFunction());
+
+    // Make the prototype object an instance of Object with the same parent as
+    // the function object itself, unless the function is an ES6 generator.  In
+    // that case, per the 15 July 2013 ES6 draft, section 15.19.3, its parent is
+    // the GeneratorObjectPrototype singleton.
+    bool isStarGenerator = obj->as<JSFunction>().isStarGenerator();
+    Rooted<GlobalObject*> global(cx, &obj->global());
+    JSObject *objProto;
+    if (isStarGenerator)
+        objProto = GlobalObject::getOrCreateStarGeneratorObjectPrototype(cx, global);
+    else
+        objProto = obj->global().getOrCreateObjectPrototype(cx);
+    if (!objProto)
+        return nullptr;
+    const Class *clasp = &JSObject::class_;
+
+    RootedObject proto(cx, NewObjectWithGivenProto(cx, clasp, objProto, nullptr, SingletonObject));
+    if (!proto)
+        return nullptr;
+
+    // Per ES5 15.3.5.2 a user-defined function's .prototype property is
+    // initially non-configurable, non-enumerable, and writable.
+    RootedValue protoVal(cx, ObjectValue(*proto));
+    if (!JSObject::defineProperty(cx, obj, cx->names().prototype,
+                                  protoVal, JS_PropertyStub, JS_StrictPropertyStub,
+                                  JSPROP_PERMANENT))
+    {
+        return nullptr;
+    }
+
+    // Per ES5 13.2 the prototype's .constructor property is configurable,
+    // non-enumerable, and writable.  However, per the 15 July 2013 ES6 draft,
+    // section 15.19.3, the .prototype of a generator function does not link
+    // back with a .constructor.
+    if (!isStarGenerator) {
+        RootedValue objVal(cx, ObjectValue(*obj));
+        if (!JSObject::defineProperty(cx, proto, cx->names().constructor,
+                                      objVal, JS_PropertyStub, JS_StrictPropertyStub, 0))
+        {
+            return nullptr;
+        }
+    }
+
+    return proto;
+}
+
+bool
+js::FunctionHasResolveHook(const JSAtomState &atomState, PropertyName *name)
+{
+    if (name == atomState.prototype || name == atomState.length || name == atomState.name)
+        return true;
+
+    for (unsigned i = 0; i < ArrayLength(poisonPillProps); i++) {
+        const uint16_t offset = poisonPillProps[i];
+
+        if (name == AtomStateOffsetToName(atomState, offset))
+            return true;
+    }
+
+    return false;
+}
+
+bool
+js::fun_resolve(JSContext *cx, HandleObject obj, HandleId id, MutableHandleObject objp)
+{
+    if (!JSID_IS_ATOM(id))
+        return true;
+
+    RootedFunction fun(cx, &obj->as<JSFunction>());
+
+    if (JSID_IS_ATOM(id, cx->names().prototype)) {
+        /*
+         * Built-in functions do not have a .prototype property per ECMA-262,
+         * or (Object.prototype, Function.prototype, etc.) have that property
+         * created eagerly.
+         *
+         * ES5 15.3.4: the non-native function object named Function.prototype
+         * does not have a .prototype property.
+         *
+         * ES5 15.3.4.5: bound functions don't have a prototype property. The
+         * isBuiltin() test covers this case because bound functions are native
+         * (and thus built-in) functions by definition/construction.
+         *
+         * ES6 19.2.4.3: arrow functions also don't have a prototype property.
+         */
+        if (fun->isBuiltin() || fun->isArrow() || fun->isFunctionPrototype())
+            return true;
+
+        if (!ResolveInterpretedFunctionPrototype(cx, fun))
+            return false;
+        objp.set(fun);
+        return true;
+    }
+
+    if (JSID_IS_ATOM(id, cx->names().length) || JSID_IS_ATOM(id, cx->names().name)) {
+        JS_ASSERT(!IsInternalFunctionObject(obj));
+
+        RootedValue v(cx);
+        if (JSID_IS_ATOM(id, cx->names().length)) {
+            if (fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))
+                return false;
+            uint16_t length = fun->hasScript() ? fun->nonLazyScript()->funLength() :
+                fun->nargs() - fun->hasRest();
+            v.setInt32(length);
+        } else {
+            v.setString(fun->atom() == nullptr ? cx->runtime()->emptyString : fun->atom());
+        }
+
+        if (!DefineNativeProperty(cx, fun, id, v, JS_PropertyStub, JS_StrictPropertyStub,
+                                  JSPROP_PERMANENT | JSPROP_READONLY)) {
+            return false;
+        }
+        objp.set(fun);
+        return true;
+    }
+
+    for (unsigned i = 0; i < ArrayLength(poisonPillProps); i++) {
+        const uint16_t offset = poisonPillProps[i];
+
+        if (JSID_IS_ATOM(id, AtomStateOffsetToName(cx->names(), offset))) {
+            JS_ASSERT(!IsInternalFunctionObject(fun));
+
+            PropertyOp getter;
+            StrictPropertyOp setter;
+            unsigned attrs = JSPROP_PERMANENT | JSPROP_SHARED;
+            if (fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))
+                return false;
+            if (fun->isInterpreted() ? fun->strict() : fun->isBoundFunction()) {
+                JSObject *throwTypeError = fun->global().getThrowTypeError();
+
+                getter = CastAsPropertyOp(throwTypeError);
+                setter = CastAsStrictPropertyOp(throwTypeError);
+                attrs |= JSPROP_GETTER | JSPROP_SETTER;
+            } else {
+                getter = fun_getProperty;
+                setter = JS_StrictPropertyStub;
+            }
+
+            if (!DefineNativeProperty(cx, fun, id, UndefinedHandleValue, getter, setter, attrs))
+                return false;
+            objp.set(fun);
+            return true;
+        }
+    }
+
+    return true;
+}
+
+template<XDRMode mode>
+bool
+js::XDRInterpretedFunction(XDRState<mode> *xdr, HandleObject enclosingScope, HandleScript enclosingScript,
+                           MutableHandleObject objp)
+{
+    enum FirstWordFlag {
+        HasAtom             = 0x1,
+        IsStarGenerator     = 0x2,
+        IsLazy              = 0x4,
+        HasSingletonType    = 0x8
+    };
+
+    /* NB: Keep this in sync with CloneFunctionAndScript. */
+    RootedAtom atom(xdr->cx());
+    uint32_t firstword = 0;        /* bitmask of FirstWordFlag */
+    uint32_t flagsword = 0;        /* word for argument count and fun->flags */
+
+    JSContext *cx = xdr->cx();
+    RootedFunction fun(cx);
+    RootedScript script(cx);
+    Rooted<LazyScript *> lazy(cx);
+
+    if (mode == XDR_ENCODE) {
+        fun = &objp->as<JSFunction>();
+        if (!fun->isInterpreted()) {
+            JSAutoByteString funNameBytes;
+            if (const char *name = GetFunctionNameBytes(cx, fun, &funNameBytes)) {
+                JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
+                                     JSMSG_NOT_SCRIPTED_FUNCTION, name);
+            }
+            return false;
+        }
+
+        if (fun->atom() || fun->hasGuessedAtom())
+            firstword |= HasAtom;
+
+        if (fun->isStarGenerator())
+            firstword |= IsStarGenerator;
+
+        if (fun->isInterpretedLazy()) {
+            // This can only happen for re-lazified cloned functions, so this
+            // does not apply to any JSFunction produced by the parser, only to
+            // JSFunction created by the runtime.
+            JS_ASSERT(!fun->lazyScript()->maybeScript());
+
+            // Encode a lazy script.
+            firstword |= IsLazy;
+            lazy = fun->lazyScript();
+        } else {
+            // Encode the script.
+            script = fun->nonLazyScript();
+        }
+
+        if (fun->hasSingletonType())
+            firstword |= HasSingletonType;
+
+        atom = fun->displayAtom();
+        flagsword = (fun->nargs() << 16) | fun->flags();
+
+        // The environment of any function which is not reused will always be
+        // null, it is later defined when a function is cloned or reused to
+        // mirror the scope chain.
+        JS_ASSERT_IF(fun->hasSingletonType() &&
+                     !((lazy && lazy->hasBeenCloned()) || (script && script->hasBeenCloned())),
+                     fun->environment() == nullptr);
+    }
+
+    if (!xdr->codeUint32(&firstword))
+        return false;
+
+    if ((firstword & HasAtom) && !XDRAtom(xdr, &atom))
+        return false;
+    if (!xdr->codeUint32(&flagsword))
+        return false;
+
+    if (mode == XDR_DECODE) {
+        JSObject *proto = nullptr;
+        if (firstword & IsStarGenerator) {
+            proto = GlobalObject::getOrCreateStarGeneratorFunctionPrototype(cx, cx->global());
+            if (!proto)
+                return false;
+        }
+
+        gc::AllocKind allocKind = JSFunction::FinalizeKind;
+        if (uint16_t(flagsword) & JSFunction::EXTENDED)
+            allocKind = JSFunction::ExtendedFinalizeKind;
+        fun = NewFunctionWithProto(cx, NullPtr(), nullptr, 0, JSFunction::INTERPRETED,
+                                   /* parent = */ NullPtr(), NullPtr(), proto,
+                                   allocKind, TenuredObject);
+        if (!fun)
+            return false;
+        script = nullptr;
+    }
+
+    if (firstword & IsLazy) {
+        if (!XDRLazyScript(xdr, enclosingScope, enclosingScript, fun, &lazy))
+            return false;
+    } else {
+        if (!XDRScript(xdr, enclosingScope, enclosingScript, fun, &script))
+            return false;
+    }
+
+    if (mode == XDR_DECODE) {
+        fun->setArgCount(flagsword >> 16);
+        fun->setFlags(uint16_t(flagsword));
+        fun->initAtom(atom);
+        if (firstword & IsLazy) {
+            fun->initLazyScript(lazy);
+        } else {
+            fun->initScript(script);
+            script->setFunction(fun);
+            JS_ASSERT(fun->nargs() == script->bindings.numArgs());
+        }
+
+        bool singleton = firstword & HasSingletonType;
+        if (!JSFunction::setTypeForScriptedFunction(cx, fun, singleton))
+            return false;
+        objp.set(fun);
+    }
+
+    return true;
+}
+
+template bool
+js::XDRInterpretedFunction(XDRState<XDR_ENCODE> *, HandleObject, HandleScript, MutableHandleObject);
+
+template bool
+js::XDRInterpretedFunction(XDRState<XDR_DECODE> *, HandleObject, HandleScript, MutableHandleObject);
+
+JSObject *
+js::CloneFunctionAndScript(JSContext *cx, HandleObject enclosingScope, HandleFunction srcFun)
+{
+    /* NB: Keep this in sync with XDRInterpretedFunction. */
+    JSObject *cloneProto = nullptr;
+    if (srcFun->isStarGenerator()) {
+        cloneProto = GlobalObject::getOrCreateStarGeneratorFunctionPrototype(cx, cx->global());
+        if (!cloneProto)
+            return nullptr;
+    }
+
+    gc::AllocKind allocKind = JSFunction::FinalizeKind;
+    if (srcFun->isExtended())
+        allocKind = JSFunction::ExtendedFinalizeKind;
+    RootedFunction clone(cx, NewFunctionWithProto(cx, NullPtr(), nullptr, 0,
+                                                  JSFunction::INTERPRETED, NullPtr(), NullPtr(),
+                                                  cloneProto, allocKind, TenuredObject));
+    if (!clone)
+        return nullptr;
+
+    RootedScript srcScript(cx, srcFun->getOrCreateScript(cx));
+    if (!srcScript)
+        return nullptr;
+    RootedScript clonedScript(cx, CloneScript(cx, enclosingScope, clone, srcScript));
+    if (!clonedScript)
+        return nullptr;
+
+    clone->setArgCount(srcFun->nargs());
+    clone->setFlags(srcFun->flags());
+    clone->initAtom(srcFun->displayAtom());
+    clone->initScript(clonedScript);
+    clonedScript->setFunction(clone);
+    if (!JSFunction::setTypeForScriptedFunction(cx, clone))
+        return nullptr;
+
+    RootedScript cloneScript(cx, clone->nonLazyScript());
+    CallNewScriptHook(cx, cloneScript, clone);
+    return clone;
+}
+
+/*
+ * [[HasInstance]] internal method for Function objects: fetch the .prototype
+ * property of its 'this' parameter, and walks the prototype chain of v (only
+ * if v is an object) returning true if .prototype is found.
+ */
+static bool
+fun_hasInstance(JSContext *cx, HandleObject objArg, MutableHandleValue v, bool *bp)
+{
+    RootedObject obj(cx, objArg);
+
+    while (obj->is<JSFunction>() && obj->isBoundFunction())
+        obj = obj->as<JSFunction>().getBoundFunctionTarget();
+
+    RootedValue pval(cx);
+    if (!JSObject::getProperty(cx, obj, obj, cx->names().prototype, &pval))
+        return false;
+
+    if (pval.isPrimitive()) {
+        /*
+         * Throw a runtime error if instanceof is called on a function that
+         * has a non-object as its .prototype value.
+         */
+        RootedValue val(cx, ObjectValue(*obj));
+        js_ReportValueError(cx, JSMSG_BAD_PROTOTYPE, -1, val, js::NullPtr());
+        return false;
+    }
+
+    RootedObject pobj(cx, &pval.toObject());
+    bool isDelegate;
+    if (!IsDelegate(cx, pobj, v, &isDelegate))
+        return false;
+    *bp = isDelegate;
+    return true;
+}
+
+inline void
+JSFunction::trace(JSTracer *trc)
+{
+    if (isExtended()) {
+        MarkValueRange(trc, ArrayLength(toExtended()->extendedSlots),
+                       toExtended()->extendedSlots, "nativeReserved");
+    }
+
+    if (atom_)
+        MarkString(trc, &atom_, "atom");
+
+    if (isInterpreted()) {
+        // Functions can be be marked as interpreted despite having no script
+        // yet at some points when parsing, and can be lazy with no lazy script
+        // for self-hosted code.
+        if (hasScript() && u.i.s.script_) {
+            // Functions can be relazified under the following conditions:
+            // - their compartment isn't currently executing scripts or being
+            //   debugged
+            // - they are not in the self-hosting compartment
+            // - they aren't generators
+            // - they don't have JIT code attached
+            // - they haven't ever been inlined
+            // - they don't have child functions
+            // - they have information for un-lazifying them again later
+            // This information can either be a LazyScript, or the name of a
+            // self-hosted function which can be cloned over again. The latter
+            // is stored in the first extended slot.
+            if (IS_GC_MARKING_TRACER(trc) && !compartment()->hasBeenEntered() &&
+                !compartment()->debugMode() && !compartment()->isSelfHosting &&
+                u.i.s.script_->isRelazifiable() && (!isSelfHostedBuiltin() || isExtended()))
+            {
+                relazify(trc);
+            } else {
+                MarkScriptUnbarriered(trc, &u.i.s.script_, "script");
+            }
+        } else if (isInterpretedLazy() && u.i.s.lazy_) {
+            MarkLazyScriptUnbarriered(trc, &u.i.s.lazy_, "lazyScript");
+        }
+        if (u.i.env_)
+            MarkObjectUnbarriered(trc, &u.i.env_, "fun_callscope");
+    }
+}
+
+static void
+fun_trace(JSTracer *trc, JSObject *obj)
+{
+    obj->as<JSFunction>().trace(trc);
+}
+
+const Class JSFunction::class_ = {
+    js_Function_str,
+    JSCLASS_NEW_RESOLVE | JSCLASS_IMPLEMENTS_BARRIERS |
+    JSCLASS_HAS_CACHED_PROTO(JSProto_Function),
+    JS_PropertyStub,         /* addProperty */
+    JS_DeletePropertyStub,   /* delProperty */
+    JS_PropertyStub,         /* getProperty */
+    JS_StrictPropertyStub,   /* setProperty */
+    fun_enumerate,
+    (JSResolveOp)js::fun_resolve,
+    JS_ConvertStub,
+    nullptr,                 /* finalize    */
+    nullptr,                 /* call        */
+    fun_hasInstance,
+    nullptr,                 /* construct   */
+    fun_trace
+};
+
+const Class* const js::FunctionClassPtr = &JSFunction::class_;
+
+/* Find the body of a function (not including braces). */
+bool
+js::FindBody(JSContext *cx, HandleFunction fun, ConstTwoByteChars chars, size_t length,
+         size_t *bodyStart, size_t *bodyEnd)
+{
+    // We don't need principals, since those are only used for error reporting.
+    CompileOptions options(cx);
+    options.setFileAndLine("internal-findBody", 0);
+
+    // For asm.js modules, there's no script.
+    if (fun->hasScript())
+        options.setVersion(fun->nonLazyScript()->getVersion());
+
+    AutoKeepAtoms keepAtoms(cx->perThreadData);
+    TokenStream ts(cx, options, chars.get(), length, nullptr);
+    int nest = 0;
+    bool onward = true;
+    // Skip arguments list.
+    do {
+        switch (ts.getToken()) {
+          case TOK_NAME:
+          case TOK_YIELD:
+            if (nest == 0)
+                onward = false;
+            break;
+          case TOK_LP:
+            nest++;
+            break;
+          case TOK_RP:
+            if (--nest == 0)
+                onward = false;
+            break;
+          case TOK_ERROR:
+            // Must be memory.
+            return false;
+          default:
+            break;
+        }
+    } while (onward);
+    TokenKind tt = ts.getToken();
+    if (tt == TOK_ARROW)
+        tt = ts.getToken();
+    if (tt == TOK_ERROR)
+        return false;
+    bool braced = tt == TOK_LC;
+    JS_ASSERT_IF(fun->isExprClosure(), !braced);
+    *bodyStart = ts.currentToken().pos.begin;
+    if (braced)
+        *bodyStart += 1;
+    ConstTwoByteChars end(chars.get() + length, chars.get(), length);
+    if (end[-1] == '}') {
+        end--;
+    } else {
+        JS_ASSERT(!braced);
+        for (; unicode::IsSpaceOrBOM2(end[-1]); end--)
+            ;
+    }
+    *bodyEnd = end - chars;
+    JS_ASSERT(*bodyStart <= *bodyEnd);
+    return true;
+}
+
+JSString *
+js::FunctionToString(JSContext *cx, HandleFunction fun, bool bodyOnly, bool lambdaParen)
+{
+    if (fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))
+        return nullptr;
+
+    if (IsAsmJSModule(fun))
+        return AsmJSModuleToString(cx, fun, !lambdaParen);
+    if (IsAsmJSFunction(fun))
+        return AsmJSFunctionToString(cx, fun);
+
+    StringBuffer out(cx);
+    RootedScript script(cx);
+
+    if (fun->hasScript()) {
+        script = fun->nonLazyScript();
+        if (script->isGeneratorExp()) {
+            if ((!bodyOnly && !out.append("function genexp() {")) ||
+                !out.append("\n    [generator expression]\n") ||
+                (!bodyOnly && !out.append("}")))
+            {
+                return nullptr;
+            }
+            return out.finishString();
+        }
+    }
+    if (!bodyOnly) {
+        // If we're not in pretty mode, put parentheses around lambda functions.
+        if (fun->isInterpreted() && !lambdaParen && fun->isLambda() && !fun->isArrow()) {
+            if (!out.append("("))
+                return nullptr;
+        }
+        if (!fun->isArrow()) {
+            if (!(fun->isStarGenerator() ? out.append("function* ") : out.append("function ")))
+                return nullptr;
+        }
+        if (fun->atom()) {
+            if (!out.append(fun->atom()))
+                return nullptr;
+        }
+    }
+    bool haveSource = fun->isInterpreted() && !fun->isSelfHostedBuiltin();
+    if (haveSource && !script->scriptSource()->hasSourceData() &&
+        !JSScript::loadSource(cx, script->scriptSource(), &haveSource))
+    {
+        return nullptr;
+    }
+    if (haveSource) {
+        RootedString srcStr(cx, script->sourceData(cx));
+        if (!srcStr)
+            return nullptr;
+        Rooted<JSFlatString *> src(cx, srcStr->ensureFlat(cx));
+        if (!src)
+            return nullptr;
+
+        ConstTwoByteChars chars(src->chars(), src->length());
+        bool exprBody = fun->isExprClosure();
+
+        // The source data for functions created by calling the Function
+        // constructor is only the function's body.  This depends on the fact,
+        // asserted below, that in Function("function f() {}"), the inner
+        // function's sourceStart points to the '(', not the 'f'.
+        bool funCon = !fun->isArrow() &&
+                      script->sourceStart() == 0 &&
+                      script->sourceEnd() == script->scriptSource()->length() &&
+                      script->scriptSource()->argumentsNotIncluded();
+
+        // Functions created with the constructor can't be arrow functions or
+        // expression closures.
+        JS_ASSERT_IF(funCon, !fun->isArrow());
+        JS_ASSERT_IF(funCon, !exprBody);
+        JS_ASSERT_IF(!funCon && !fun->isArrow(), src->length() > 0 && chars[0] == '(');
+
+        // If a function inherits strict mode by having scopes above it that
+        // have "use strict", we insert "use strict" into the body of the
+        // function. This ensures that if the result of toString is evaled, the
+        // resulting function will have the same semantics.
+        bool addUseStrict = script->strict() && !script->explicitUseStrict() && !fun->isArrow();
+
+        bool buildBody = funCon && !bodyOnly;
+        if (buildBody) {
+            // This function was created with the Function constructor. We don't
+            // have source for the arguments, so we have to generate that. Part
+            // of bug 755821 should be cobbling the arguments passed into the
+            // Function constructor into the source string.
+            if (!out.append("("))
+                return nullptr;
+
+            // Fish out the argument names.
+            BindingVector *localNames = cx->new_<BindingVector>(cx);
+            ScopedJSDeletePtr<BindingVector> freeNames(localNames);
+            if (!FillBindingVector(script, localNames))
+                return nullptr;
+            for (unsigned i = 0; i < fun->nargs(); i++) {
+                if ((i && !out.append(", ")) ||
+                    (i == unsigned(fun->nargs() - 1) && fun->hasRest() && !out.append("...")) ||
+                    !out.append((*localNames)[i].name())) {
+                    return nullptr;
+                }
+            }
+            if (!out.append(") {\n"))
+                return nullptr;
+        }
+        if ((bodyOnly && !funCon) || addUseStrict) {
+            // We need to get at the body either because we're only supposed to
+            // return the body or we need to insert "use strict" into the body.
+            size_t bodyStart = 0, bodyEnd;
+
+            // If the function is defined in the Function constructor, we
+            // already have a body.
+            if (!funCon) {
+                JS_ASSERT(!buildBody);
+                if (!FindBody(cx, fun, chars, src->length(), &bodyStart, &bodyEnd))
+                    return nullptr;
+            } else {
+                bodyEnd = src->length();
+            }
+
+            if (addUseStrict) {
+                // Output source up to beginning of body.
+                if (!out.append(chars, bodyStart))
+                    return nullptr;
+                if (exprBody) {
+                    // We can't insert a statement into a function with an
+                    // expression body. Do what the decompiler did, and insert a
+                    // comment.
+                    if (!out.append("/* use strict */ "))
+                        return nullptr;
+                } else {
+                    if (!out.append("\n\"use strict\";\n"))
+                        return nullptr;
+                }
+            }
+
+            // Output just the body (for bodyOnly) or the body and possibly
+            // closing braces (for addUseStrict).
+            size_t dependentEnd = bodyOnly ? bodyEnd : src->length();
+            if (!out.append(chars + bodyStart, dependentEnd - bodyStart))
+                return nullptr;
+        } else {
+            if (!out.append(src))
+                return nullptr;
+        }
+        if (buildBody) {
+            if (!out.append("\n}"))
+                return nullptr;
+        }
+        if (bodyOnly) {
+            // Slap a semicolon on the end of functions with an expression body.
+            if (exprBody && !out.append(";"))
+                return nullptr;
+        } else if (!lambdaParen && fun->isLambda() && !fun->isArrow()) {
+            if (!out.append(")"))
+                return nullptr;
+        }
+    } else if (fun->isInterpreted() && !fun->isSelfHostedBuiltin()) {
+        if ((!bodyOnly && !out.append("() {\n    ")) ||
+            !out.append("[sourceless code]") ||
+            (!bodyOnly && !out.append("\n}")))
+            return nullptr;
+        if (!lambdaParen && fun->isLambda() && !fun->isArrow() && !out.append(")"))
+            return nullptr;
+    } else {
+        JS_ASSERT(!fun->isExprClosure());
+
+        if ((!bodyOnly && !out.append("() {\n    "))
+            || !out.append("[native code]")
+            || (!bodyOnly && !out.append("\n}")))
+        {
+            return nullptr;
+        }
+    }
+    return out.finishString();
+}
+
+JSString *
+fun_toStringHelper(JSContext *cx, HandleObject obj, unsigned indent)
+{
+    if (!obj->is<JSFunction>()) {
+        if (obj->is<ProxyObject>())
+            return Proxy::fun_toString(cx, obj, indent);
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
+                             JSMSG_INCOMPATIBLE_PROTO,
+                             js_Function_str, js_toString_str,
+                             "object");
+        return nullptr;
+    }
+
+    RootedFunction fun(cx, &obj->as<JSFunction>());
+    return FunctionToString(cx, fun, false, indent != JS_DONT_PRETTY_PRINT);
+}
+
+static bool
+fun_toString(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    JS_ASSERT(IsFunctionObject(args.calleev()));
+
+    uint32_t indent = 0;
+
+    if (args.length() != 0 && !ToUint32(cx, args[0], &indent))
+        return false;
+
+    RootedObject obj(cx, ToObject(cx, args.thisv()));
+    if (!obj)
+        return false;
+
+    RootedString str(cx, fun_toStringHelper(cx, obj, indent));
+    if (!str)
+        return false;
+
+    args.rval().setString(str);
+    return true;
+}
+
+#if JS_HAS_TOSOURCE
+static bool
+fun_toSource(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    JS_ASSERT(IsFunctionObject(args.calleev()));
+
+    RootedObject obj(cx, ToObject(cx, args.thisv()));
+    if (!obj)
+        return false;
+
+    RootedString str(cx);
+    if (obj->isCallable())
+        str = fun_toStringHelper(cx, obj, JS_DONT_PRETTY_PRINT);
+    else
+        str = ObjectToSource(cx, obj);
+
+    if (!str)
+        return false;
+    args.rval().setString(str);
+    return true;
+}
+#endif
+
+bool
+js_fun_call(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    HandleValue fval = args.thisv();
+    if (!js_IsCallable(fval)) {
+        ReportIncompatibleMethod(cx, args, &JSFunction::class_);
+        return false;
+    }
+
+    args.setCallee(fval);
+    args.setThis(args.get(0));
+
+    if (args.length() > 0) {
+        for (size_t i = 0; i < args.length() - 1; i++)
+            args[i].set(args[i + 1]);
+        args = CallArgsFromVp(args.length() - 1, vp);
+    }
+
+    return Invoke(cx, args);
+}
+
+// ES5 15.3.4.3
+bool
+js_fun_apply(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    // Step 1.
+    HandleValue fval = args.thisv();
+    if (!js_IsCallable(fval)) {
+        ReportIncompatibleMethod(cx, args, &JSFunction::class_);
+        return false;
+    }
+
+    // Step 2.
+    if (args.length() < 2 || args[1].isNullOrUndefined())
+        return js_fun_call(cx, (args.length() > 0) ? 1 : 0, vp);
+
+    InvokeArgs args2(cx);
+
+    // A JS_OPTIMIZED_ARGUMENTS magic value means that 'arguments' flows into
+    // this apply call from a scripted caller and, as an optimization, we've
+    // avoided creating it since apply can simply pull the argument values from
+    // the calling frame (which we must do now).
+    if (args[1].isMagic(JS_OPTIMIZED_ARGUMENTS)) {
+        // Step 3-6.
+        ScriptFrameIter iter(cx);
+        JS_ASSERT(iter.numActualArgs() <= ARGS_LENGTH_MAX);
+        if (!args2.init(iter.numActualArgs()))
+            return false;
+
+        args2.setCallee(fval);
+        args2.setThis(args[0]);
+
+        // Steps 7-8.
+        iter.unaliasedForEachActual(cx, CopyTo(args2.array()));
+    } else {
+        // Step 3.
+        if (!args[1].isObject()) {
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
+                                 JSMSG_BAD_APPLY_ARGS, js_apply_str);
+            return false;
+        }
+
+        // Steps 4-5 (note erratum removing steps originally numbered 5 and 7 in
+        // original version of ES5).
+        RootedObject aobj(cx, &args[1].toObject());
+        uint32_t length;
+        if (!GetLengthProperty(cx, aobj, &length))
+            return false;
+
+        // Step 6.
+        if (length > ARGS_LENGTH_MAX) {
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_TOO_MANY_FUN_APPLY_ARGS);
+            return false;
+        }
+
+        if (!args2.init(length))
+            return false;
+
+        // Push fval, obj, and aobj's elements as args.
+        args2.setCallee(fval);
+        args2.setThis(args[0]);
+
+        // Steps 7-8.
+        if (!GetElements(cx, aobj, length, args2.array()))
+            return false;
+    }
+
+    // Step 9.
+    if (!Invoke(cx, args2))
+        return false;
+
+    args.rval().set(args2.rval());
+    return true;
+}
+
+static const uint32_t JSSLOT_BOUND_FUNCTION_THIS       = 0;
+static const uint32_t JSSLOT_BOUND_FUNCTION_ARGS_COUNT = 1;
+
+static const uint32_t BOUND_FUNCTION_RESERVED_SLOTS = 2;
+
+inline bool
+JSFunction::initBoundFunction(JSContext *cx, HandleValue thisArg,
+                              const Value *args, unsigned argslen)
+{
+    RootedFunction self(cx, this);
+
+    /*
+     * Convert to a dictionary to set the BOUND_FUNCTION flag and increase
+     * the slot span to cover the arguments and additional slots for the 'this'
+     * value and arguments count.
+     */
+    if (!self->toDictionaryMode(cx))
+        return false;
+
+    if (!self->setFlag(cx, BaseShape::BOUND_FUNCTION))
+        return false;
+
+    if (!JSObject::setSlotSpan(cx, self, BOUND_FUNCTION_RESERVED_SLOTS + argslen))
+        return false;
+
+    self->setSlot(JSSLOT_BOUND_FUNCTION_THIS, thisArg);
+    self->setSlot(JSSLOT_BOUND_FUNCTION_ARGS_COUNT, PrivateUint32Value(argslen));
+
+    self->initSlotRange(BOUND_FUNCTION_RESERVED_SLOTS, args, argslen);
+
+    return true;
+}
+
+const js::Value &
+JSFunction::getBoundFunctionThis() const
+{
+    JS_ASSERT(isBoundFunction());
+
+    return getSlot(JSSLOT_BOUND_FUNCTION_THIS);
+}
+
+const js::Value &
+JSFunction::getBoundFunctionArgument(unsigned which) const
+{
+    JS_ASSERT(isBoundFunction());
+    JS_ASSERT(which < getBoundFunctionArgumentCount());
+
+    return getSlot(BOUND_FUNCTION_RESERVED_SLOTS + which);
+}
+
+size_t
+JSFunction::getBoundFunctionArgumentCount() const
+{
+    JS_ASSERT(isBoundFunction());
+
+    return getSlot(JSSLOT_BOUND_FUNCTION_ARGS_COUNT).toPrivateUint32();
+}
+
+/* static */ bool
+JSFunction::createScriptForLazilyInterpretedFunction(JSContext *cx, HandleFunction fun)
+{
+    JS_ASSERT(fun->isInterpretedLazy());
+
+    Rooted<LazyScript*> lazy(cx, fun->lazyScriptOrNull());
+    if (lazy) {
+        // Trigger a pre barrier on the lazy script being overwritten.
+        if (cx->zone()->needsBarrier())
+            LazyScript::writeBarrierPre(lazy);
+
+        // Suppress GC for now although we should be able to remove this by
+        // making 'lazy' a Rooted<LazyScript*> (which requires adding a
+        // THING_ROOT_LAZY_SCRIPT).
+        AutoSuppressGC suppressGC(cx);
+
+        RootedScript script(cx, lazy->maybeScript());
+
+        if (script) {
+            fun->setUnlazifiedScript(script);
+            // Remember the lazy script on the compiled script, so it can be
+            // stored on the function again in case of re-lazification.
+            // Only functions without inner functions are re-lazified.
+            if (!lazy->numInnerFunctions())
+                script->setLazyScript(lazy);
+            return true;
+        }
+
+        if (fun != lazy->functionNonDelazifying()) {
+            if (!lazy->functionDelazifying(cx))
+                return false;
+            script = lazy->functionNonDelazifying()->nonLazyScript();
+            if (!script)
+                return false;
+
+            fun->setUnlazifiedScript(script);
+            return true;
+        }
+
+        // Lazy script caching is only supported for leaf functions. If a
+        // script with inner functions was returned by the cache, those inner
+        // functions would be delazified when deep cloning the script, even if
+        // they have never executed.
+        //
+        // Additionally, the lazy script cache is not used during incremental
+        // GCs, to avoid resurrecting dead scripts after incremental sweeping
+        // has started.
+        if (!lazy->numInnerFunctions() && !JS::IsIncrementalGCInProgress(cx->runtime())) {
+            LazyScriptCache::Lookup lookup(cx, lazy);
+            cx->runtime()->lazyScriptCache.lookup(lookup, script.address());
+        }
+
+        if (script) {
+            RootedObject enclosingScope(cx, lazy->enclosingScope());
+            RootedScript clonedScript(cx, CloneScript(cx, enclosingScope, fun, script));
+            if (!clonedScript)
+                return false;
+
+            clonedScript->setSourceObject(lazy->sourceObject());
+
+            fun->initAtom(script->functionNonDelazifying()->displayAtom());
+            clonedScript->setFunction(fun);
+
+            fun->setUnlazifiedScript(clonedScript);
+
+            CallNewScriptHook(cx, clonedScript, fun);
+
+            if (!lazy->maybeScript())
+                lazy->initScript(clonedScript);
+            return true;
+        }
+
+        JS_ASSERT(lazy->source()->hasSourceData());
+
+        // Parse and compile the script from source.
+        SourceDataCache::AutoHoldEntry holder;
+        const jschar *chars = lazy->source()->chars(cx, holder);
+        if (!chars)
+            return false;
+
+        const jschar *lazyStart = chars + lazy->begin();
+        size_t lazyLength = lazy->end() - lazy->begin();
+
+        if (!frontend::CompileLazyFunction(cx, lazy, lazyStart, lazyLength))
+            return false;
+
+        script = fun->nonLazyScript();
+
+        // Remember the compiled script on the lazy script itself, in case
+        // there are clones of the function still pointing to the lazy script.
+        if (!lazy->maybeScript())
+            lazy->initScript(script);
+
+        // Try to insert the newly compiled script into the lazy script cache.
+        if (!lazy->numInnerFunctions()) {
+            // A script's starting column isn't set by the bytecode emitter, so
+            // specify this from the lazy script so that if an identical lazy
+            // script is encountered later a match can be determined.
+            script->setColumn(lazy->column());
+
+            LazyScriptCache::Lookup lookup(cx, lazy);
+            cx->runtime()->lazyScriptCache.insert(lookup, script);
+
+            // Remember the lazy script on the compiled script, so it can be
+            // stored on the function again in case of re-lazification.
+            // Only functions without inner functions are re-lazified.
+            script->setLazyScript(lazy);
+        }
+        return true;
+    }
+
+    /* Lazily cloned self-hosted script. */
+    JS_ASSERT(fun->isSelfHostedBuiltin());
+    RootedAtom funAtom(cx, &fun->getExtendedSlot(0).toString()->asAtom());
+    if (!funAtom)
+        return false;
+    Rooted<PropertyName *> funName(cx, funAtom->asPropertyName());
+    return cx->runtime()->cloneSelfHostedFunctionScript(cx, funName, fun);
+}
+
+void
+JSFunction::relazify(JSTracer *trc)
+{
+    JSScript *script = nonLazyScript();
+    JS_ASSERT(script->isRelazifiable());
+    JS_ASSERT(!compartment()->hasBeenEntered());
+    JS_ASSERT(!compartment()->debugMode());
+
+    // If the script's canonical function isn't lazy, we have to mark the
+    // script. Otherwise, the following scenario would leave it unmarked
+    // and cause it to be swept while a function is still expecting it to be
+    // valid:
+    // 1. an incremental GC slice causes the canonical function to relazify
+    // 2. a clone is used and delazifies the canonical function
+    // 3. another GC slice causes the clone to relazify
+    // The result is that no function marks the script, but the canonical
+    // function expects it to be valid.
+    if (script->functionNonDelazifying()->hasScript())
+        MarkScriptUnbarriered(trc, &u.i.s.script_, "script");
+
+    flags_ &= ~INTERPRETED;
+    flags_ |= INTERPRETED_LAZY;
+    LazyScript *lazy = script->maybeLazyScript();
+    u.i.s.lazy_ = lazy;
+    if (lazy) {
+        JS_ASSERT(!isSelfHostedBuiltin());
+        // If this is the script stored in the lazy script to be cloned
+        // for un-lazifying other functions, reset it so the script can
+        // be freed.
+        if (lazy->maybeScript() == script)
+            lazy->resetScript();
+        MarkLazyScriptUnbarriered(trc, &u.i.s.lazy_, "lazyScript");
+    } else {
+        JS_ASSERT(isSelfHostedBuiltin());
+        JS_ASSERT(isExtended());
+        JS_ASSERT(getExtendedSlot(0).toString()->isAtom());
+    }
+}
+
+/* ES5 15.3.4.5.1 and 15.3.4.5.2. */
+bool
+js::CallOrConstructBoundFunction(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    RootedFunction fun(cx, &args.callee().as<JSFunction>());
+    JS_ASSERT(fun->isBoundFunction());
+
+    /* 15.3.4.5.1 step 1, 15.3.4.5.2 step 3. */
+    unsigned argslen = fun->getBoundFunctionArgumentCount();
+
+    if (args.length() + argslen > ARGS_LENGTH_MAX) {
+        js_ReportAllocationOverflow(cx);
+        return false;
+    }
+
+    /* 15.3.4.5.1 step 3, 15.3.4.5.2 step 1. */
+    RootedObject target(cx, fun->getBoundFunctionTarget());
+
+    /* 15.3.4.5.1 step 2. */
+    const Value &boundThis = fun->getBoundFunctionThis();
+
+    InvokeArgs invokeArgs(cx);
+    if (!invokeArgs.init(args.length() + argslen))
+        return false;
+
+    /* 15.3.4.5.1, 15.3.4.5.2 step 4. */
+    for (unsigned i = 0; i < argslen; i++)
+        invokeArgs[i].set(fun->getBoundFunctionArgument(i));
+    PodCopy(invokeArgs.array() + argslen, vp + 2, args.length());
+
+    /* 15.3.4.5.1, 15.3.4.5.2 step 5. */
+    invokeArgs.setCallee(ObjectValue(*target));
+
+    bool constructing = args.isConstructing();
+    if (!constructing)
+        invokeArgs.setThis(boundThis);
+
+    if (constructing ? !InvokeConstructor(cx, invokeArgs) : !Invoke(cx, invokeArgs))
+        return false;
+
+    args.rval().set(invokeArgs.rval());
+    return true;
+}
+
+static bool
+fun_isGenerator(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    JSFunction *fun;
+    if (!IsFunctionObject(args.thisv(), &fun)) {
+        args.rval().setBoolean(false);
+        return true;
+    }
+
+    args.rval().setBoolean(fun->isGenerator());
+    return true;
+}
+
+/* ES5 15.3.4.5. */
+static bool
+fun_bind(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    /* Step 1. */
+    Value thisv = args.thisv();
+
+    /* Step 2. */
+    if (!js_IsCallable(thisv)) {
+        ReportIncompatibleMethod(cx, args, &JSFunction::class_);
+        return false;
+    }
+
+    /* Step 3. */
+    Value *boundArgs = nullptr;
+    unsigned argslen = 0;
+    if (args.length() > 1) {
+        boundArgs = args.array() + 1;
+        argslen = args.length() - 1;
+    }
+
+    /* Steps 7-9. */
+    RootedValue thisArg(cx, args.length() >= 1 ? args[0] : UndefinedValue());
+    RootedObject target(cx, &thisv.toObject());
+    JSObject *boundFunction = js_fun_bind(cx, target, thisArg, boundArgs, argslen);
+    if (!boundFunction)
+        return false;
+
+    /* Step 22. */
+    args.rval().setObject(*boundFunction);
+    return true;
+}
+
+JSObject*
+js_fun_bind(JSContext *cx, HandleObject target, HandleValue thisArg,
+            Value *boundArgs, unsigned argslen)
+{
+    /* Steps 15-16. */
+    unsigned length = 0;
+    if (target->is<JSFunction>()) {
+        unsigned nargs = target->as<JSFunction>().nargs();
+        if (nargs > argslen)
+            length = nargs - argslen;
+    }
+
+    /* Step 4-6, 10-11. */
+    RootedAtom name(cx, target->is<JSFunction>() ? target->as<JSFunction>().atom() : nullptr);
+
+    RootedObject funobj(cx, NewFunction(cx, js::NullPtr(), CallOrConstructBoundFunction, length,
+                                        JSFunction::NATIVE_CTOR, target, name));
+    if (!funobj)
+        return nullptr;
+
+    /* NB: Bound functions abuse |parent| to store their target. */
+    if (!JSObject::setParent(cx, funobj, target))
+        return nullptr;
+
+    if (!funobj->as<JSFunction>().initBoundFunction(cx, thisArg, boundArgs, argslen))
+        return nullptr;
+
+    /* Steps 17, 19-21 are handled by fun_resolve. */
+    /* Step 18 is the default for new functions. */
+    return funobj;
+}
+
+/*
+ * Report "malformed formal parameter" iff no illegal char or similar scanner
+ * error was already reported.
+ */
+static bool
+OnBadFormal(JSContext *cx, TokenKind tt)
+{
+    if (tt != TOK_ERROR)
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_FORMAL);
+    else
+        JS_ASSERT(cx->isExceptionPending());
+    return false;
+}
+
+const JSFunctionSpec js::function_methods[] = {
+#if JS_HAS_TOSOURCE
+    JS_FN(js_toSource_str,   fun_toSource,   0,0),
+#endif
+    JS_FN(js_toString_str,   fun_toString,   0,0),
+    JS_FN(js_apply_str,      js_fun_apply,   2,0),
+    JS_FN(js_call_str,       js_fun_call,    1,0),
+    JS_FN("bind",            fun_bind,       1,0),
+    JS_FN("isGenerator",     fun_isGenerator,0,0),
+    JS_FS_END
+};
+
+static bool
+FunctionConstructor(JSContext *cx, unsigned argc, Value *vp, GeneratorKind generatorKind)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    RootedString arg(cx);   // used multiple times below
+
+    /* Block this call if security callbacks forbid it. */
+    Rooted<GlobalObject*> global(cx, &args.callee().global());
+    if (!GlobalObject::isRuntimeCodeGenEnabled(cx, global)) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_CSP_BLOCKED_FUNCTION);
+        return false;
+    }
+
+    AutoKeepAtoms keepAtoms(cx->perThreadData);
+    AutoNameVector formals(cx);
+
+    bool hasRest = false;
+
+    bool isStarGenerator = generatorKind == StarGenerator;
+    JS_ASSERT(generatorKind != LegacyGenerator);
+
+    RootedScript maybeScript(cx);
+    const char *filename;
+    unsigned lineno;
+    JSPrincipals *originPrincipals;
+    uint32_t pcOffset;
+    DescribeScriptedCallerForCompilation(cx, &maybeScript, &filename, &lineno, &pcOffset,
+                                         &originPrincipals);
+
+    const char *introductionType = "Function";
+    if (generatorKind != NotGenerator)
+        introductionType = "GeneratorFunction";
+
+    const char *introducerFilename = filename;
+    if (maybeScript && maybeScript->scriptSource()->introducerFilename())
+        introducerFilename = maybeScript->scriptSource()->introducerFilename();
+
+    CompileOptions options(cx);
+    options.setOriginPrincipals(originPrincipals)
+           .setFileAndLine(filename, 1)
+           .setNoScriptRval(false)
+           .setCompileAndGo(true)
+           .setIntroductionInfo(introducerFilename, introductionType, lineno, maybeScript, pcOffset);
+
+    unsigned n = args.length() ? args.length() - 1 : 0;
+    if (n > 0) {
+        /*
+         * Collect the function-argument arguments into one string, separated
+         * by commas, then make a tokenstream from that string, and scan it to
+         * get the arguments.  We need to throw the full scanner at the
+         * problem, because the argument string can legitimately contain
+         * comments and linefeeds.  XXX It might be better to concatenate
+         * everything up into a function definition and pass it to the
+         * compiler, but doing it this way is less of a delta from the old
+         * code.  See ECMA 15.3.2.1.
+         */
+        size_t args_length = 0;
+        for (unsigned i = 0; i < n; i++) {
+            /* Collect the lengths for all the function-argument arguments. */
+            arg = ToString<CanGC>(cx, args[i]);
+            if (!arg)
+                return false;
+            args[i].setString(arg);
+
+            /*
+             * Check for overflow.  The < test works because the maximum
+             * JSString length fits in 2 fewer bits than size_t has.
+             */
+            size_t old_args_length = args_length;
+            args_length = old_args_length + arg->length();
+            if (args_length < old_args_length) {
+                js_ReportAllocationOverflow(cx);
+                return false;
+            }
+        }
+
+        /* Add 1 for each joining comma and check for overflow (two ways). */
+        size_t old_args_length = args_length;
+        args_length = old_args_length + n - 1;
+        if (args_length < old_args_length ||
+            args_length >= ~(size_t)0 / sizeof(jschar)) {
+            js_ReportAllocationOverflow(cx);
+            return false;
+        }
+
+        /*
+         * Allocate a string to hold the concatenated arguments, including room
+         * for a terminating 0. Mark cx->tempLifeAlloc for later release, to
+         * free collected_args and its tokenstream in one swoop.
+         */
+        LifoAllocScope las(&cx->tempLifoAlloc());
+        jschar *cp = cx->tempLifoAlloc().newArray<jschar>(args_length + 1);
+        if (!cp) {
+            js_ReportOutOfMemory(cx);
+            return false;
+        }
+        ConstTwoByteChars collected_args(cp, args_length + 1);
+
+        /*
+         * Concatenate the arguments into the new string, separated by commas.
+         */
+        for (unsigned i = 0; i < n; i++) {
+            arg = args[i].toString();
+            size_t arg_length = arg->length();
+            const jschar *arg_chars = arg->getChars(cx);
+            if (!arg_chars)
+                return false;
+            (void) js_strncpy(cp, arg_chars, arg_length);
+            cp += arg_length;
+
+            /* Add separating comma or terminating 0. */
+            *cp++ = (i + 1 < n) ? ',' : 0;
+        }
+
+        /*
+         * Initialize a tokenstream that reads from the given string.  No
+         * StrictModeGetter is needed because this TokenStream won't report any
+         * strict mode errors.  Any strict mode errors which might be reported
+         * here (duplicate argument names, etc.) will be detected when we
+         * compile the function body.
+         */
+        TokenStream ts(cx, options, collected_args.get(), args_length,
+                       /* strictModeGetter = */ nullptr);
+        bool yieldIsValidName = ts.versionNumber() < JSVERSION_1_7 && !isStarGenerator;
+
+        /* The argument string may be empty or contain no tokens. */
+        TokenKind tt = ts.getToken();
+        if (tt != TOK_EOF) {
+            for (;;) {
+                /*
+                 * Check that it's a name.  This also implicitly guards against
+                 * TOK_ERROR, which was already reported.
+                 */
+                if (hasRest) {
+                    ts.reportError(JSMSG_PARAMETER_AFTER_REST);
+                    return false;
+                }
+
+                if (tt == TOK_YIELD && yieldIsValidName)
+                    tt = TOK_NAME;
+
+                if (tt != TOK_NAME) {
+                    if (tt == TOK_TRIPLEDOT) {
+                        hasRest = true;
+                        tt = ts.getToken();
+                        if (tt == TOK_YIELD && yieldIsValidName)
+                            tt = TOK_NAME;
+                        if (tt != TOK_NAME) {
+                            if (tt != TOK_ERROR)
+                                ts.reportError(JSMSG_NO_REST_NAME);
+                            return false;
+                        }
+                    } else {
+                        return OnBadFormal(cx, tt);
+                    }
+                }
+
+                if (!formals.append(ts.currentName()))
+                    return false;
+
+                /*
+                 * Get the next token.  Stop on end of stream.  Otherwise
+                 * insist on a comma, get another name, and iterate.
+                 */
+                tt = ts.getToken();
+                if (tt == TOK_EOF)
+                    break;
+                if (tt != TOK_COMMA)
+                    return OnBadFormal(cx, tt);
+                tt = ts.getToken();
+            }
+        }
+    }
+
+#ifdef DEBUG
+    for (unsigned i = 0; i < formals.length(); ++i) {
+        JSString *str = formals[i];
+        JS_ASSERT(str->asAtom().asPropertyName() == formals[i]);
+    }
+#endif
+
+    RootedString str(cx);
+    if (!args.length())
+        str = cx->runtime()->emptyString;
+    else
+        str = ToString<CanGC>(cx, args[args.length() - 1]);
+    if (!str)
+        return false;
+    JSLinearString *linear = str->ensureLinear(cx);
+    if (!linear)
+        return false;
+
+    JS::Anchor<JSString *> strAnchor(str);
+    const jschar *chars = linear->chars();
+    size_t length = linear->length();
+
+    /*
+     * NB: (new Function) is not lexically closed by its caller, it's just an
+     * anonymous function in the top-level scope that its constructor inhabits.
+     * Thus 'var x = 42; f = new Function("return x"); print(f())' prints 42,
+     * and so would a call to f from another top-level's script or function.
+     */
+    RootedAtom anonymousAtom(cx, cx->names().anonymous);
+    JSObject *proto = nullptr;
+    if (isStarGenerator) {
+        proto = GlobalObject::getOrCreateStarGeneratorFunctionPrototype(cx, global);
+        if (!proto)
+            return false;
+    }
+    RootedFunction fun(cx, NewFunctionWithProto(cx, js::NullPtr(), nullptr, 0,
+                                                JSFunction::INTERPRETED_LAMBDA, global,
+                                                anonymousAtom, proto,
+                                                JSFunction::FinalizeKind, TenuredObject));
+    if (!fun)
+        return false;
+
+    if (!JSFunction::setTypeForScriptedFunction(cx, fun))
+        return false;
+
+    if (hasRest)
+        fun->setHasRest();
+
+    bool ok;
+    SourceBufferHolder srcBuf(chars, length, SourceBufferHolder::NoOwnership);
+    if (isStarGenerator)
+        ok = frontend::CompileStarGeneratorBody(cx, &fun, options, formals, srcBuf);
+    else
+        ok = frontend::CompileFunctionBody(cx, &fun, options, formals, srcBuf);
+    args.rval().setObject(*fun);
+    return ok;
+}
+
+bool
+js::Function(JSContext *cx, unsigned argc, Value *vp)
+{
+    return FunctionConstructor(cx, argc, vp, NotGenerator);
+}
+
+bool
+js::Generator(JSContext *cx, unsigned argc, Value *vp)
+{
+    return FunctionConstructor(cx, argc, vp, StarGenerator);
+}
+
+bool
+JSFunction::isBuiltinFunctionConstructor()
+{
+    return maybeNative() == Function || maybeNative() == Generator;
+}
+
+JSFunction *
+js::NewFunction(ExclusiveContext *cx, HandleObject funobjArg, Native native, unsigned nargs,
+                JSFunction::Flags flags, HandleObject parent, HandleAtom atom,
+                gc::AllocKind allocKind /* = JSFunction::FinalizeKind */,
+                NewObjectKind newKind /* = GenericObject */)
+{
+    return NewFunctionWithProto(cx, funobjArg, native, nargs, flags, parent, atom, nullptr,
+                                allocKind, newKind);
+}
+
+JSFunction *
+js::NewFunctionWithProto(ExclusiveContext *cx, HandleObject funobjArg, Native native,
+                         unsigned nargs, JSFunction::Flags flags, HandleObject parent,
+                         HandleAtom atom, JSObject *proto,
+                         gc::AllocKind allocKind /* = JSFunction::FinalizeKind */,
+                         NewObjectKind newKind /* = GenericObject */)
+{
+    JS_ASSERT(allocKind == JSFunction::FinalizeKind || allocKind == JSFunction::ExtendedFinalizeKind);
+    JS_ASSERT(sizeof(JSFunction) <= gc::Arena::thingSize(JSFunction::FinalizeKind));
+    JS_ASSERT(sizeof(FunctionExtended) <= gc::Arena::thingSize(JSFunction::ExtendedFinalizeKind));
+
+    RootedObject funobj(cx, funobjArg);
+    if (funobj) {
+        JS_ASSERT(funobj->is<JSFunction>());
+        JS_ASSERT(funobj->getParent() == parent);
+        JS_ASSERT_IF(native, funobj->hasSingletonType());
+    } else {
+        // Don't give asm.js module functions a singleton type since they
+        // are cloned (via CloneFunctionObjectIfNotSingleton) which assumes
+        // that hasSingletonType implies isInterpreted.
+        if (native && !IsAsmJSModuleNative(native))
+            newKind = SingletonObject;
+        funobj = NewObjectWithClassProto(cx, &JSFunction::class_, proto,
+                                         SkipScopeParent(parent), allocKind, newKind);
+        if (!funobj)
+            return nullptr;
+    }
+    RootedFunction fun(cx, &funobj->as<JSFunction>());
+
+    if (allocKind == JSFunction::ExtendedFinalizeKind)
+        flags = JSFunction::Flags(flags | JSFunction::EXTENDED);
+
+    /* Initialize all function members. */
+    fun->setArgCount(uint16_t(nargs));
+    fun->setFlags(flags);
+    if (fun->isInterpreted()) {
+        JS_ASSERT(!native);
+        fun->mutableScript().init(nullptr);
+        fun->initEnvironment(parent);
+    } else {
+        JS_ASSERT(fun->isNative());
+        JS_ASSERT(native);
+        fun->initNative(native, nullptr);
+    }
+    if (allocKind == JSFunction::ExtendedFinalizeKind)
+        fun->initializeExtended();
+    fun->initAtom(atom);
+
+    return fun;
+}
+
+JSFunction *
+js::CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent, gc::AllocKind allocKind,
+                        NewObjectKind newKindArg /* = GenericObject */)
+{
+    JS_ASSERT(parent);
+    JS_ASSERT(!fun->isBoundFunction());
+
+    bool useSameScript = cx->compartment() == fun->compartment() &&
+                         !fun->hasSingletonType() &&
+                         !types::UseNewTypeForClone(fun);
+
+    if (!useSameScript && fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))
+        return nullptr;
+
+    NewObjectKind newKind = useSameScript ? newKindArg : SingletonObject;
+    JSObject *cloneProto = nullptr;
+    if (fun->isStarGenerator()) {
+        cloneProto = GlobalObject::getOrCreateStarGeneratorFunctionPrototype(cx, cx->global());
+        if (!cloneProto)
+            return nullptr;
+    }
+    JSObject *cloneobj = NewObjectWithClassProto(cx, &JSFunction::class_, cloneProto,
+                                                 SkipScopeParent(parent), allocKind, newKind);
+    if (!cloneobj)
+        return nullptr;
+    RootedFunction clone(cx, &cloneobj->as<JSFunction>());
+
+    uint16_t flags = fun->flags() & ~JSFunction::EXTENDED;
+    if (allocKind == JSFunction::ExtendedFinalizeKind)
+        flags |= JSFunction::EXTENDED;
+
+    clone->setArgCount(fun->nargs());
+    clone->setFlags(flags);
+    if (fun->hasScript()) {
+        clone->initScript(fun->nonLazyScript());
+        clone->initEnvironment(parent);
+    } else if (fun->isInterpretedLazy()) {
+        LazyScript *lazy = fun->lazyScriptOrNull();
+        clone->initLazyScript(lazy);
+        clone->initEnvironment(parent);
+    } else {
+        clone->initNative(fun->native(), fun->jitInfo());
+    }
+    clone->initAtom(fun->displayAtom());
+
+    if (allocKind == JSFunction::ExtendedFinalizeKind) {
+        if (fun->isExtended() && fun->compartment() == cx->compartment()) {
+            for (unsigned i = 0; i < FunctionExtended::NUM_EXTENDED_SLOTS; i++)
+                clone->initExtendedSlot(i, fun->getExtendedSlot(i));
+        } else {
+            clone->initializeExtended();
+        }
+    }
+
+    if (useSameScript) {
+        /*
+         * Clone the function, reusing its script. We can use the same type as
+         * the original function provided that its prototype is correct.
+         */
+        if (fun->getProto() == clone->getProto())
+            clone->setType(fun->type());
+        return clone;
+    }
+
+    RootedFunction cloneRoot(cx, clone);
+
+    /*
+     * Across compartments we have to clone the script for interpreted
+     * functions. Cross-compartment cloning only happens via JSAPI
+     * (JS_CloneFunctionObject) which dynamically ensures that 'script' has
+     * no enclosing lexical scope (only the global scope).
+     */
+    if (cloneRoot->isInterpreted() && !CloneFunctionScript(cx, fun, cloneRoot, newKindArg))
+        return nullptr;
+
+    return cloneRoot;
+}
+
+JSFunction *
+js::DefineFunction(JSContext *cx, HandleObject obj, HandleId id, Native native,
+                   unsigned nargs, unsigned flags, AllocKind allocKind /* = FinalizeKind */,
+                   NewObjectKind newKind /* = GenericObject */)
+{
+    PropertyOp gop;
+    StrictPropertyOp sop;
+
+    RootedFunction fun(cx);
+
+    if (flags & JSFUN_STUB_GSOPS) {
+        /*
+         * JSFUN_STUB_GSOPS is a request flag only, not stored in fun->flags or
+         * the defined property's attributes. This allows us to encode another,
+         * internal flag using the same bit, JSFUN_EXPR_CLOSURE -- see jsfun.h
+         * for more on this.
+         */
+        flags &= ~JSFUN_STUB_GSOPS;
+        gop = JS_PropertyStub;
+        sop = JS_StrictPropertyStub;
+    } else {
+        gop = nullptr;
+        sop = nullptr;
+    }
+
+    JSFunction::Flags funFlags;
+    if (!native)
+        funFlags = JSFunction::INTERPRETED_LAZY;
+    else
+        funFlags = JSAPIToJSFunctionFlags(flags);
+    RootedAtom atom(cx, JSID_IS_ATOM(id) ? JSID_TO_ATOM(id) : nullptr);
+    fun = NewFunction(cx, NullPtr(), native, nargs, funFlags, obj, atom, allocKind, newKind);
+    if (!fun)
+        return nullptr;
+
+    RootedValue funVal(cx, ObjectValue(*fun));
+    if (!JSObject::defineGeneric(cx, obj, id, funVal, gop, sop, flags & ~JSFUN_FLAGS_MASK))
+        return nullptr;
+
+    return fun;
+}
+
+bool
+js::IsConstructor(const Value &v)
+{
+    // Step 2.
+    if (!v.isObject())
+        return false;
+
+    // Step 3-4, a bit complex for us, since we have several flavors of
+    // [[Construct]] internal method.
+    JSObject &obj = v.toObject();
+    if (obj.is<JSFunction>()) {
+        JSFunction &fun = obj.as<JSFunction>();
+        return fun.isNativeConstructor() || fun.isInterpretedConstructor();
+    }
+    return obj.getClass()->construct != nullptr;
+}
+
+void
+js::ReportIncompatibleMethod(JSContext *cx, CallReceiver call, const Class *clasp)
+{
+    RootedValue thisv(cx, call.thisv());
+
+#ifdef DEBUG
+    if (thisv.isObject()) {
+        JS_ASSERT(thisv.toObject().getClass() != clasp ||
+                  !thisv.toObject().isNative() ||
+                  !thisv.toObject().getProto() ||
+                  thisv.toObject().getProto()->getClass() != clasp);
+    } else if (thisv.isString()) {
+        JS_ASSERT(clasp != &StringObject::class_);
+    } else if (thisv.isNumber()) {
+        JS_ASSERT(clasp != &NumberObject::class_);
+    } else if (thisv.isBoolean()) {
+        JS_ASSERT(clasp != &BooleanObject::class_);
+    } else {
+        JS_ASSERT(thisv.isUndefined() || thisv.isNull());
+    }
+#endif
+
+    if (JSFunction *fun = ReportIfNotFunction(cx, call.calleev())) {
+        JSAutoByteString funNameBytes;
+        if (const char *funName = GetFunctionNameBytes(cx, fun, &funNameBytes)) {
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_PROTO,
+                                 clasp->name, funName, InformalValueTypeName(thisv));
+        }
+    }
+}
+
+void
+js::ReportIncompatible(JSContext *cx, CallReceiver call)
+{
+    if (JSFunction *fun = ReportIfNotFunction(cx, call.calleev())) {
+        JSAutoByteString funNameBytes;
+        if (const char *funName = GetFunctionNameBytes(cx, fun, &funNameBytes)) {
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_INCOMPATIBLE_METHOD,
+                                 funName, "method", InformalValueTypeName(call.thisv()));
+        }
+    }
+}
+
+bool
+JSObject::hasIdempotentProtoChain() const
+{
+    // Return false if obj (or an object on its proto chain) is non-native or
+    // has a resolve or lookup hook.
+    JSObject *obj = const_cast<JSObject *>(this);
+    while (true) {
+        if (!obj->isNative())
+            return false;
+
+        JSResolveOp resolve = obj->getClass()->resolve;
+        if (resolve != JS_ResolveStub && resolve != (JSResolveOp) js::fun_resolve)
+            return false;
+
+        if (obj->getOps()->lookupProperty || obj->getOps()->lookupGeneric || obj->getOps()->lookupElement)
+            return false;
+
+        obj = obj->getProto();
+        if (!obj)
+            return true;
+    }
+
+    MOZ_ASSUME_UNREACHABLE("Should not get here");
+}
+
+namespace JS {
+namespace detail {
+
+JS_PUBLIC_API(void)
+CheckIsValidConstructible(Value calleev)
+{
+    JSObject *callee = &calleev.toObject();
+    if (callee->is<JSFunction>())
+        JS_ASSERT(callee->as<JSFunction>().isNativeConstructor());
+    else
+        JS_ASSERT(callee->getClass()->construct != nullptr);
+}
+
+} // namespace detail
+} // namespace JS