1 /*
   2  * Copyright (c) 2010, 2013, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 package jdk.nashorn.internal.runtime;
  27 
  28 import static jdk.nashorn.internal.codegen.CompilerConstants.staticCallNoLookup;
  29 import static jdk.nashorn.internal.codegen.CompilerConstants.virtualCall;
  30 import static jdk.nashorn.internal.codegen.CompilerConstants.virtualCallNoLookup;
  31 import static jdk.nashorn.internal.lookup.Lookup.MH;
  32 import static jdk.nashorn.internal.runtime.ECMAErrors.referenceError;
  33 import static jdk.nashorn.internal.runtime.ECMAErrors.typeError;
  34 import static jdk.nashorn.internal.runtime.JSType.UNDEFINED_DOUBLE;
  35 import static jdk.nashorn.internal.runtime.JSType.UNDEFINED_INT;
  36 import static jdk.nashorn.internal.runtime.JSType.UNDEFINED_LONG;
  37 import static jdk.nashorn.internal.runtime.PropertyDescriptor.CONFIGURABLE;
  38 import static jdk.nashorn.internal.runtime.PropertyDescriptor.ENUMERABLE;
  39 import static jdk.nashorn.internal.runtime.PropertyDescriptor.GET;
  40 import static jdk.nashorn.internal.runtime.PropertyDescriptor.SET;
  41 import static jdk.nashorn.internal.runtime.PropertyDescriptor.VALUE;
  42 import static jdk.nashorn.internal.runtime.PropertyDescriptor.WRITABLE;
  43 import static jdk.nashorn.internal.runtime.ScriptRuntime.UNDEFINED;
  44 import static jdk.nashorn.internal.runtime.UnwarrantedOptimismException.INVALID_PROGRAM_POINT;
  45 import static jdk.nashorn.internal.runtime.UnwarrantedOptimismException.isValid;
  46 import static jdk.nashorn.internal.runtime.arrays.ArrayIndex.getArrayIndex;
  47 import static jdk.nashorn.internal.runtime.arrays.ArrayIndex.isValidArrayIndex;
  48 import static jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.isScopeFlag;
  49 import static jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor.isStrictFlag;
  50 import static jdk.nashorn.internal.runtime.linker.NashornGuards.explicitInstanceOfCheck;
  51 
  52 import java.lang.invoke.MethodHandle;
  53 import java.lang.invoke.MethodHandles;
  54 import java.lang.invoke.MethodType;
  55 import java.lang.invoke.SwitchPoint;
  56 import java.util.AbstractMap;
  57 import java.util.ArrayList;
  58 import java.util.Arrays;
  59 import java.util.Collection;
  60 import java.util.Collections;
  61 import java.util.HashSet;
  62 import java.util.Iterator;
  63 import java.util.LinkedHashSet;
  64 import java.util.List;
  65 import java.util.Map;
  66 import java.util.Set;
  67 import java.util.concurrent.atomic.LongAdder;
  68 import jdk.internal.dynalink.CallSiteDescriptor;
  69 import jdk.internal.dynalink.linker.GuardedInvocation;
  70 import jdk.internal.dynalink.linker.LinkRequest;
  71 import jdk.internal.dynalink.support.CallSiteDescriptorFactory;
  72 import jdk.nashorn.internal.codegen.CompilerConstants.Call;
  73 import jdk.nashorn.internal.codegen.ObjectClassGenerator;
  74 import jdk.nashorn.internal.codegen.types.Type;
  75 import jdk.nashorn.internal.lookup.Lookup;
  76 import jdk.nashorn.internal.objects.AccessorPropertyDescriptor;
  77 import jdk.nashorn.internal.objects.DataPropertyDescriptor;
  78 import jdk.nashorn.internal.objects.Global;
  79 import jdk.nashorn.internal.objects.NativeArray;
  80 import jdk.nashorn.internal.runtime.arrays.ArrayData;
  81 import jdk.nashorn.internal.runtime.arrays.ArrayIndex;
  82 import jdk.nashorn.internal.runtime.linker.Bootstrap;
  83 import jdk.nashorn.internal.runtime.linker.LinkerCallSite;
  84 import jdk.nashorn.internal.runtime.linker.NashornCallSiteDescriptor;
  85 import jdk.nashorn.internal.runtime.linker.NashornGuards;
  86 
  87 /**
  88  * Base class for generic JavaScript objects.
  89  * <p>
  90  * Notes:
  91  * <ul>
  92  * <li>The map is used to identify properties in the object.</li>
  93  * <li>If the map is modified then it must be cloned and replaced.  This notifies
  94  *     any code that made assumptions about the object that things have changed.
  95  *     Ex. CallSites that have been validated must check to see if the map has
  96  *     changed (or a map from a different object type) and hence relink the method
  97  *     to call.</li>
  98  * <li>Modifications of the map include adding/deleting attributes or changing a
  99  *     function field value.</li>
 100  * </ul>
 101  */
 102 
 103 public abstract class ScriptObject implements PropertyAccess, Cloneable {
 104     /** __proto__ special property name inside object literals. ES6 draft. */
 105     public static final String PROTO_PROPERTY_NAME   = "__proto__";
 106 
 107     /** Search fall back routine name for "no such method" */
 108     public static final String NO_SUCH_METHOD_NAME   = "__noSuchMethod__";
 109 
 110     /** Search fall back routine name for "no such property" */
 111     public static final String NO_SUCH_PROPERTY_NAME = "__noSuchProperty__";
 112 
 113     /** Per ScriptObject flag - is this an array object? */
 114     public static final int IS_ARRAY               = 1 << 0;
 115 
 116     /** Per ScriptObject flag - is this an arguments object? */
 117     public static final int IS_ARGUMENTS           = 1 << 1;
 118 
 119     /** Is length property not-writable? */
 120     public static final int IS_LENGTH_NOT_WRITABLE = 1 << 2;
 121 
 122     /** Is this a builtin object? */
 123     public static final int IS_BUILTIN             = 1 << 3;
 124 
 125     /**
 126      * Spill growth rate - by how many elements does {@link ScriptObject#primitiveSpill} and
 127      * {@link ScriptObject#objectSpill} when full
 128      */
 129     public static final int SPILL_RATE = 8;
 130 
 131     /** Map to property information and accessor functions. Ordered by insertion. */
 132     private PropertyMap map;
 133 
 134     /** objects proto. */
 135     private ScriptObject proto;
 136 
 137     /** Object flags. */
 138     private int flags;
 139 
 140     /** Area for primitive properties added to object after instantiation, see {@link AccessorProperty} */
 141     protected long[]   primitiveSpill;
 142 
 143     /** Area for reference properties added to object after instantiation, see {@link AccessorProperty} */
 144     protected Object[] objectSpill;
 145 
 146     /** Indexed array data. */
 147     private ArrayData arrayData;
 148 
 149     /** Method handle to retrieve prototype of this object */
 150     public static final MethodHandle GETPROTO      = findOwnMH_V("getProto", ScriptObject.class);
 151 
 152     static final MethodHandle MEGAMORPHIC_GET    = findOwnMH_V("megamorphicGet", Object.class, String.class, boolean.class);
 153     static final MethodHandle GLOBALFILTER       = findOwnMH_S("globalFilter", Object.class, Object.class);
 154     static final MethodHandle DECLARE_AND_SET    = findOwnMH_V("declareAndSet", void.class, String.class, Object.class);
 155 
 156     private static final MethodHandle TRUNCATINGFILTER   = findOwnMH_S("truncatingFilter", Object[].class, int.class, Object[].class);
 157     private static final MethodHandle KNOWNFUNCPROPGUARDSELF = findOwnMH_S("knownFunctionPropertyGuardSelf", boolean.class, Object.class, PropertyMap.class, MethodHandle.class, ScriptFunction.class);
 158     private static final MethodHandle KNOWNFUNCPROPGUARDPROTO = findOwnMH_S("knownFunctionPropertyGuardProto", boolean.class, Object.class, PropertyMap.class, MethodHandle.class, int.class, ScriptFunction.class);
 159 
 160     private static final ArrayList<MethodHandle> PROTO_FILTERS = new ArrayList<>();
 161 
 162     /** Method handle for getting the array data */
 163     public static final Call GET_ARRAY          = virtualCall(MethodHandles.lookup(), ScriptObject.class, "getArray", ArrayData.class);
 164 
 165     /** Method handle for getting a function argument at a given index. Used from MapCreator */
 166     public static final Call GET_ARGUMENT       = virtualCall(MethodHandles.lookup(), ScriptObject.class, "getArgument", Object.class, int.class);
 167 
 168     /** Method handle for setting a function argument at a given index. Used from MapCreator */
 169     public static final Call SET_ARGUMENT       = virtualCall(MethodHandles.lookup(), ScriptObject.class, "setArgument", void.class, int.class, Object.class);
 170 
 171     /** Method handle for getting the proto of a ScriptObject */
 172     public static final Call GET_PROTO          = virtualCallNoLookup(ScriptObject.class, "getProto", ScriptObject.class);
 173 
 174     /** Method handle for getting the proto of a ScriptObject */
 175     public static final Call GET_PROTO_DEPTH    = virtualCallNoLookup(ScriptObject.class, "getProto", ScriptObject.class, int.class);
 176 
 177     /** Method handle for setting the proto of a ScriptObject */
 178     public static final Call SET_GLOBAL_OBJECT_PROTO = staticCallNoLookup(ScriptObject.class, "setGlobalObjectProto", void.class, ScriptObject.class);
 179 
 180     /** Method handle for setting the proto of a ScriptObject after checking argument */
 181     public static final Call SET_PROTO_FROM_LITERAL    = virtualCallNoLookup(ScriptObject.class, "setProtoFromLiteral", void.class, Object.class);
 182 
 183     /** Method handle for setting the user accessors of a ScriptObject */
 184     //TODO fastpath this
 185     public static final Call SET_USER_ACCESSORS = virtualCall(MethodHandles.lookup(), ScriptObject.class, "setUserAccessors", void.class, String.class, ScriptFunction.class, ScriptFunction.class);
 186 
 187     static final MethodHandle[] SET_SLOW = new MethodHandle[] {
 188         findOwnMH_V("set", void.class, Object.class, int.class, int.class),
 189         findOwnMH_V("set", void.class, Object.class, long.class, int.class),
 190         findOwnMH_V("set", void.class, Object.class, double.class, int.class),
 191         findOwnMH_V("set", void.class, Object.class, Object.class, int.class)
 192     };
 193 
 194     /** Method handle to reset the map of this ScriptObject */
 195     public static final Call SET_MAP = virtualCallNoLookup(ScriptObject.class, "setMap", void.class, PropertyMap.class);
 196 
 197     static final MethodHandle CAS_MAP           = findOwnMH_V("compareAndSetMap", boolean.class, PropertyMap.class, PropertyMap.class);
 198     static final MethodHandle EXTENSION_CHECK   = findOwnMH_V("extensionCheck", boolean.class, boolean.class, String.class);
 199     static final MethodHandle ENSURE_SPILL_SIZE = findOwnMH_V("ensureSpillSize", Object.class, int.class);
 200 
 201     /**
 202      * Constructor
 203      */
 204     public ScriptObject() {
 205         this(null);
 206     }
 207 
 208     /**
 209     * Constructor
 210     *
 211     * @param map {@link PropertyMap} used to create the initial object
 212     */
 213     public ScriptObject(final PropertyMap map) {
 214         if (Context.DEBUG) {
 215             ScriptObject.count.increment();
 216         }
 217         this.arrayData = ArrayData.EMPTY_ARRAY;
 218         this.setMap(map == null ? PropertyMap.newMap() : map);
 219     }
 220 
 221     /**
 222      * Constructor that directly sets the prototype to {@code proto} and property map to
 223      * {@code map} without invalidating the map as calling {@link #setProto(ScriptObject)}
 224      * would do. This should only be used for objects that are always constructed with the
 225      * same combination of prototype and property map.
 226      *
 227      * @param proto the prototype object
 228      * @param map initial {@link PropertyMap}
 229      */
 230     protected ScriptObject(final ScriptObject proto, final PropertyMap map) {
 231         this(map);
 232         this.proto = proto;
 233     }
 234 
 235     /**
 236      * Constructor used to instantiate spill properties directly. Used from
 237      * SpillObjectCreator.
 238      *
 239      * @param map            property maps
 240      * @param primitiveSpill primitive spills
 241      * @param objectSpill    reference spills
 242      */
 243     public ScriptObject(final PropertyMap map, final long[] primitiveSpill, final Object[] objectSpill) {
 244         this(map);
 245         this.primitiveSpill = primitiveSpill;
 246         this.objectSpill    = objectSpill;
 247         assert primitiveSpill == null || primitiveSpill.length == objectSpill.length : " primitive spill pool size is not the same length as object spill pool size";
 248     }
 249 
 250     /**
 251      * Check whether this is a global object
 252      * @return true if global
 253      */
 254     protected boolean isGlobal() {
 255         return false;
 256     }
 257 
 258     private static int alignUp(final int size, final int alignment) {
 259         return size + alignment - 1 & ~(alignment - 1);
 260     }
 261 
 262     /**
 263      * Given a number of properties, return the aligned to SPILL_RATE
 264      * buffer size required for the smallest spill pool needed to
 265      * house them
 266      * @param nProperties number of properties
 267      * @return property buffer length, a multiple of SPILL_RATE
 268      */
 269     public static int spillAllocationLength(final int nProperties) {
 270         return alignUp(nProperties, SPILL_RATE);
 271     }
 272 
 273     /**
 274      * Copy all properties from the source object with their receiver bound to the source.
 275      * This function was known as mergeMap
 276      *
 277      * @param source The source object to copy from.
 278      */
 279     public void addBoundProperties(final ScriptObject source) {
 280         addBoundProperties(source, source.getMap().getProperties());
 281     }
 282 
 283     /**
 284      * Copy all properties from the array with their receiver bound to the source.
 285      *
 286      * @param source The source object to copy from.
 287      * @param properties The array of properties to copy.
 288      */
 289     public void addBoundProperties(final ScriptObject source, final Property[] properties) {
 290         PropertyMap newMap = this.getMap();
 291         final boolean extensible = newMap.isExtensible();
 292 
 293         for (final Property property : properties) {
 294             newMap = addBoundProperty(newMap, source, property, extensible);
 295         }
 296 
 297         this.setMap(newMap);
 298     }
 299 
 300     /**
 301      * Add a bound property from {@code source}, using the interim property map {@code propMap}, and return the
 302      * new interim property map.
 303      *
 304      * @param propMap the property map
 305      * @param source the source object
 306      * @param property the property to be added
 307      * @param extensible whether the current object is extensible or not
 308      * @return the new property map
 309      */
 310     protected PropertyMap addBoundProperty(final PropertyMap propMap, final ScriptObject source, final Property property, final boolean extensible) {
 311         PropertyMap newMap = propMap;
 312         final String key = property.getKey();
 313         final Property oldProp = newMap.findProperty(key);
 314         if (oldProp == null) {
 315             if (! extensible) {
 316                 throw typeError("object.non.extensible", key, ScriptRuntime.safeToString(this));
 317             }
 318 
 319             if (property instanceof UserAccessorProperty) {
 320                 // Note: we copy accessor functions to this object which is semantically different from binding.
 321                 final UserAccessorProperty prop = this.newUserAccessors(key, property.getFlags(), property.getGetterFunction(source), property.getSetterFunction(source));
 322                 newMap = newMap.addPropertyNoHistory(prop);
 323             } else {
 324                 newMap = newMap.addPropertyBind((AccessorProperty)property, source);
 325             }
 326         } else {
 327             // See ECMA section 10.5 Declaration Binding Instantiation
 328             // step 5 processing each function declaration.
 329             if (property.isFunctionDeclaration() && !oldProp.isConfigurable()) {
 330                 if (oldProp instanceof UserAccessorProperty ||
 331                         !(oldProp.isWritable() && oldProp.isEnumerable())) {
 332                     throw typeError("cant.redefine.property", key, ScriptRuntime.safeToString(this));
 333                 }
 334             }
 335         }
 336         return newMap;
 337     }
 338 
 339     /**
 340      * Copy all properties from the array with their receiver bound to the source.
 341      *
 342      * @param source The source object to copy from.
 343      * @param properties The collection of accessor properties to copy.
 344      */
 345     public void addBoundProperties(final Object source, final AccessorProperty[] properties) {
 346         PropertyMap newMap = this.getMap();
 347         final boolean extensible = newMap.isExtensible();
 348 
 349         for (final AccessorProperty property : properties) {
 350             final String key = property.getKey();
 351 
 352             if (newMap.findProperty(key) == null) {
 353                 if (! extensible) {
 354                     throw typeError("object.non.extensible", key, ScriptRuntime.safeToString(this));
 355                 }
 356                 newMap = newMap.addPropertyBind(property, source);
 357             }
 358         }
 359 
 360         this.setMap(newMap);
 361     }
 362 
 363     /**
 364      * Bind the method handle to the specified receiver, while preserving its original type (it will just ignore the
 365      * first argument in lieu of the bound argument).
 366      * @param methodHandle Method handle to bind to.
 367      * @param receiver     Object to bind.
 368      * @return Bound method handle.
 369      */
 370     static MethodHandle bindTo(final MethodHandle methodHandle, final Object receiver) {
 371         return MH.dropArguments(MH.bindTo(methodHandle, receiver), 0, methodHandle.type().parameterType(0));
 372     }
 373 
 374     /**
 375      * Return a property iterator.
 376      * @return Property iterator.
 377      */
 378     public Iterator<String> propertyIterator() {
 379         return new KeyIterator(this);
 380     }
 381 
 382     /**
 383      * Return a property value iterator.
 384      * @return Property value iterator.
 385      */
 386     public Iterator<Object> valueIterator() {
 387         return new ValueIterator(this);
 388     }
 389 
 390     /**
 391      * ECMA 8.10.1 IsAccessorDescriptor ( Desc )
 392      * @return true if this has a {@link AccessorPropertyDescriptor} with a getter or a setter
 393      */
 394     public final boolean isAccessorDescriptor() {
 395         return has(GET) || has(SET);
 396     }
 397 
 398     /**
 399      * ECMA 8.10.2 IsDataDescriptor ( Desc )
 400      * @return true if this has a {@link DataPropertyDescriptor}, i.e. the object has a property value and is writable
 401      */
 402     public final boolean isDataDescriptor() {
 403         return has(VALUE) || has(WRITABLE);
 404     }
 405 
 406     /**
 407       * ECMA 8.10.5 ToPropertyDescriptor ( Obj )
 408       *
 409       * @return property descriptor
 410       */
 411     public final PropertyDescriptor toPropertyDescriptor() {
 412         final Global global = Context.getGlobal();
 413 
 414         final PropertyDescriptor desc;
 415         if (isDataDescriptor()) {
 416             if (has(SET) || has(GET)) {
 417                 throw typeError(global, "inconsistent.property.descriptor");
 418             }
 419 
 420             desc = global.newDataDescriptor(UNDEFINED, false, false, false);
 421         } else if (isAccessorDescriptor()) {
 422             if (has(VALUE) || has(WRITABLE)) {
 423                 throw typeError(global, "inconsistent.property.descriptor");
 424             }
 425 
 426             desc = global.newAccessorDescriptor(UNDEFINED, UNDEFINED, false, false);
 427         } else {
 428             desc = global.newGenericDescriptor(false, false);
 429         }
 430 
 431         return desc.fillFrom(this);
 432     }
 433 
 434     /**
 435      * ECMA 8.10.5 ToPropertyDescriptor ( Obj )
 436      *
 437      * @param global  global scope object
 438      * @param obj object to create property descriptor from
 439      *
 440      * @return property descriptor
 441      */
 442     public static PropertyDescriptor toPropertyDescriptor(final Global global, final Object obj) {
 443         if (obj instanceof ScriptObject) {
 444             return ((ScriptObject)obj).toPropertyDescriptor();
 445         }
 446 
 447         throw typeError(global, "not.an.object", ScriptRuntime.safeToString(obj));
 448     }
 449 
 450     /**
 451      * ECMA 8.12.1 [[GetOwnProperty]] (P)
 452      *
 453      * @param key property key
 454      *
 455      * @return Returns the Property Descriptor of the named own property of this
 456      * object, or undefined if absent.
 457      */
 458     public Object getOwnPropertyDescriptor(final String key) {
 459         final Property property = getMap().findProperty(key);
 460 
 461         final Global global = Context.getGlobal();
 462 
 463         if (property != null) {
 464             final ScriptFunction get   = property.getGetterFunction(this);
 465             final ScriptFunction set   = property.getSetterFunction(this);
 466 
 467             final boolean configurable = property.isConfigurable();
 468             final boolean enumerable   = property.isEnumerable();
 469             final boolean writable     = property.isWritable();
 470 
 471             if (property instanceof UserAccessorProperty) {
 472                 return global.newAccessorDescriptor(
 473                     get != null ?
 474                         get :
 475                         UNDEFINED,
 476                     set != null ?
 477                         set :
 478                         UNDEFINED,
 479                     configurable,
 480                     enumerable);
 481             }
 482 
 483             return global.newDataDescriptor(getWithProperty(property), configurable, enumerable, writable);
 484         }
 485 
 486         final int index = getArrayIndex(key);
 487         final ArrayData array = getArray();
 488 
 489         if (array.has(index)) {
 490             return array.getDescriptor(global, index);
 491         }
 492 
 493         return UNDEFINED;
 494     }
 495 
 496     /**
 497      * ECMA 8.12.2 [[GetProperty]] (P)
 498      *
 499      * @param key property key
 500      *
 501      * @return Returns the fully populated Property Descriptor of the named property
 502      * of this object, or undefined if absent.
 503      */
 504     public Object getPropertyDescriptor(final String key) {
 505         final Object res = getOwnPropertyDescriptor(key);
 506 
 507         if (res != UNDEFINED) {
 508             return res;
 509         } else if (getProto() != null) {
 510             return getProto().getOwnPropertyDescriptor(key);
 511         } else {
 512             return UNDEFINED;
 513         }
 514     }
 515 
 516     /**
 517      * Invalidate any existing global constant method handles that may exist for {@code key}.
 518      * @param key the property name
 519      */
 520     protected void invalidateGlobalConstant(final String key) {
 521         final GlobalConstants globalConstants = getGlobalConstants();
 522         if (globalConstants != null) {
 523             globalConstants.delete(key);
 524         }
 525     }
 526 
 527     /**
 528      * ECMA 8.12.9 [[DefineOwnProperty]] (P, Desc, Throw)
 529      *
 530      * @param key the property key
 531      * @param propertyDesc the property descriptor
 532      * @param reject is the property extensible - true means new definitions are rejected
 533      *
 534      * @return true if property was successfully defined
 535      */
 536     public boolean defineOwnProperty(final String key, final Object propertyDesc, final boolean reject) {
 537         final Global             global  = Context.getGlobal();
 538         final PropertyDescriptor desc    = toPropertyDescriptor(global, propertyDesc);
 539         final Object             current = getOwnPropertyDescriptor(key);
 540         final String             name    = JSType.toString(key);
 541 
 542         invalidateGlobalConstant(key);
 543 
 544         if (current == UNDEFINED) {
 545             if (isExtensible()) {
 546                 // add a new own property
 547                 addOwnProperty(key, desc);
 548                 return true;
 549             }
 550             // new property added to non-extensible object
 551             if (reject) {
 552                 throw typeError(global, "object.non.extensible", name, ScriptRuntime.safeToString(this));
 553             }
 554             return false;
 555         }
 556 
 557         // modifying an existing property
 558         final PropertyDescriptor currentDesc = (PropertyDescriptor)current;
 559         final PropertyDescriptor newDesc     = desc;
 560 
 561         if (newDesc.type() == PropertyDescriptor.GENERIC && !newDesc.has(CONFIGURABLE) && !newDesc.has(ENUMERABLE)) {
 562             // every descriptor field is absent
 563             return true;
 564         }
 565 
 566         if (newDesc.hasAndEquals(currentDesc)) {
 567             // every descriptor field of the new is same as the current
 568             return true;
 569         }
 570 
 571         if (!currentDesc.isConfigurable()) {
 572             if (newDesc.has(CONFIGURABLE) && newDesc.isConfigurable()) {
 573                 // not configurable can not be made configurable
 574                 if (reject) {
 575                     throw typeError(global, "cant.redefine.property", name, ScriptRuntime.safeToString(this));
 576                 }
 577                 return false;
 578             }
 579 
 580             if (newDesc.has(ENUMERABLE) &&
 581                 currentDesc.isEnumerable() != newDesc.isEnumerable()) {
 582                 // cannot make non-enumerable as enumerable or vice-versa
 583                 if (reject) {
 584                     throw typeError(global, "cant.redefine.property", name, ScriptRuntime.safeToString(this));
 585                 }
 586                 return false;
 587             }
 588         }
 589 
 590         int propFlags = Property.mergeFlags(currentDesc, newDesc);
 591         Property property = getMap().findProperty(key);
 592 
 593         if (currentDesc.type() == PropertyDescriptor.DATA &&
 594                 (newDesc.type() == PropertyDescriptor.DATA ||
 595                  newDesc.type() == PropertyDescriptor.GENERIC)) {
 596             if (!currentDesc.isConfigurable() && !currentDesc.isWritable()) {
 597                 if (newDesc.has(WRITABLE) && newDesc.isWritable() ||
 598                     newDesc.has(VALUE) && !ScriptRuntime.sameValue(currentDesc.getValue(), newDesc.getValue())) {
 599                     if (reject) {
 600                         throw typeError(global, "cant.redefine.property", name, ScriptRuntime.safeToString(this));
 601                     }
 602                     return false;
 603                 }
 604             }
 605 
 606             final boolean newValue = newDesc.has(VALUE);
 607             final Object value     = newValue ? newDesc.getValue() : currentDesc.getValue();
 608 
 609             if (newValue && property != null) {
 610                 // Temporarily clear flags.
 611                 property = modifyOwnProperty(property, 0);
 612                 set(key, value, 0);
 613                 //this might change the map if we change types of the property
 614                 //hence we need to read it again. note that we should probably
 615                 //have the setter return the new property throughout and in
 616                 //general respect Property return values from modify and add
 617                 //functions - which we don't seem to do at all here :-(
 618                 //There is already a bug filed to generify PropertyAccess so we
 619                 //can have the setter return e.g. a Property
 620                 property = getMap().findProperty(key);
 621             }
 622 
 623             if (property == null) {
 624                 // promoting an arrayData value to actual property
 625                 addOwnProperty(key, propFlags, value);
 626                 checkIntegerKey(key);
 627             } else {
 628                 // Now set the new flags
 629                 modifyOwnProperty(property, propFlags);
 630             }
 631         } else if (currentDesc.type() == PropertyDescriptor.ACCESSOR &&
 632                    (newDesc.type() == PropertyDescriptor.ACCESSOR ||
 633                     newDesc.type() == PropertyDescriptor.GENERIC)) {
 634             if (!currentDesc.isConfigurable()) {
 635                 if (newDesc.has(PropertyDescriptor.GET) && !ScriptRuntime.sameValue(currentDesc.getGetter(), newDesc.getGetter()) ||
 636                     newDesc.has(PropertyDescriptor.SET) && !ScriptRuntime.sameValue(currentDesc.getSetter(), newDesc.getSetter())) {
 637                     if (reject) {
 638                         throw typeError(global, "cant.redefine.property", name, ScriptRuntime.safeToString(this));
 639                     }
 640                     return false;
 641                 }
 642             }
 643             // New set the new features.
 644             modifyOwnProperty(property, propFlags,
 645                                       newDesc.has(GET) ? newDesc.getGetter() : currentDesc.getGetter(),
 646                                       newDesc.has(SET) ? newDesc.getSetter() : currentDesc.getSetter());
 647         } else {
 648             // changing descriptor type
 649             if (!currentDesc.isConfigurable()) {
 650                 // not configurable can not be made configurable
 651                 if (reject) {
 652                     throw typeError(global, "cant.redefine.property", name, ScriptRuntime.safeToString(this));
 653                 }
 654                 return false;
 655             }
 656 
 657             propFlags = 0;
 658 
 659             // Preserve only configurable and enumerable from current desc
 660             // if those are not overridden in the new property descriptor.
 661             boolean value = newDesc.has(CONFIGURABLE) ? newDesc.isConfigurable() : currentDesc.isConfigurable();
 662             if (!value) {
 663                 propFlags |= Property.NOT_CONFIGURABLE;
 664             }
 665             value = newDesc.has(ENUMERABLE)? newDesc.isEnumerable() : currentDesc.isEnumerable();
 666             if (!value) {
 667                 propFlags |= Property.NOT_ENUMERABLE;
 668             }
 669 
 670             final int type = newDesc.type();
 671             if (type == PropertyDescriptor.DATA) {
 672                 // get writable from the new descriptor
 673                 value = newDesc.has(WRITABLE) && newDesc.isWritable();
 674                 if (!value) {
 675                     propFlags |= Property.NOT_WRITABLE;
 676                 }
 677 
 678                 // delete the old property
 679                 deleteOwnProperty(property);
 680                 // add new data property
 681                 addOwnProperty(key, propFlags, newDesc.getValue());
 682             } else if (type == PropertyDescriptor.ACCESSOR) {
 683                 if (property == null) {
 684                     addOwnProperty(key, propFlags,
 685                                      newDesc.has(GET) ? newDesc.getGetter() : null,
 686                                      newDesc.has(SET) ? newDesc.getSetter() : null);
 687                 } else {
 688                     // Modify old property with the new features.
 689                     modifyOwnProperty(property, propFlags,
 690                                         newDesc.has(GET) ? newDesc.getGetter() : null,
 691                                         newDesc.has(SET) ? newDesc.getSetter() : null);
 692                 }
 693             }
 694         }
 695 
 696         checkIntegerKey(key);
 697 
 698         return true;
 699     }
 700 
 701     /**
 702      * Almost like defineOwnProperty(int,Object) for arrays this one does
 703      * not add 'gap' elements (like the array one does).
 704      *
 705      * @param index key for property
 706      * @param value value to define
 707      */
 708     public void defineOwnProperty(final int index, final Object value) {
 709         assert isValidArrayIndex(index) : "invalid array index";
 710         final long longIndex = ArrayIndex.toLongIndex(index);
 711         final long oldLength = getArray().length();
 712         if (longIndex >= oldLength) {
 713             setArray(getArray().ensure(longIndex));
 714             doesNotHaveEnsureDelete(longIndex, oldLength, false);
 715         }
 716         setArray(getArray().set(index, value, false));
 717     }
 718 
 719     private void checkIntegerKey(final String key) {
 720         final int index = getArrayIndex(key);
 721 
 722         if (isValidArrayIndex(index)) {
 723             final ArrayData data = getArray();
 724 
 725             if (data.has(index)) {
 726                 setArray(data.delete(index));
 727             }
 728         }
 729     }
 730 
 731     /**
 732       * Add a new property to the object.
 733       *
 734       * @param key          property key
 735       * @param propertyDesc property descriptor for property
 736       */
 737     public final void addOwnProperty(final String key, final PropertyDescriptor propertyDesc) {
 738         // Already checked that there is no own property with that key.
 739         PropertyDescriptor pdesc = propertyDesc;
 740 
 741         final int propFlags = Property.toFlags(pdesc);
 742 
 743         if (pdesc.type() == PropertyDescriptor.GENERIC) {
 744             final Global global = Context.getGlobal();
 745             final PropertyDescriptor dDesc = global.newDataDescriptor(UNDEFINED, false, false, false);
 746 
 747             dDesc.fillFrom((ScriptObject)pdesc);
 748             pdesc = dDesc;
 749         }
 750 
 751         final int type = pdesc.type();
 752         if (type == PropertyDescriptor.DATA) {
 753             addOwnProperty(key, propFlags, pdesc.getValue());
 754         } else if (type == PropertyDescriptor.ACCESSOR) {
 755             addOwnProperty(key, propFlags,
 756                     pdesc.has(GET) ? pdesc.getGetter() : null,
 757                     pdesc.has(SET) ? pdesc.getSetter() : null);
 758         }
 759 
 760         checkIntegerKey(key);
 761     }
 762 
 763     /**
 764      * Low level property API (not using property descriptors)
 765      * <p>
 766      * Find a property in the prototype hierarchy. Note: this is final and not
 767      * a good idea to override. If you have to, use
 768      * {jdk.nashorn.internal.objects.NativeArray{@link #getProperty(String)} or
 769      * {jdk.nashorn.internal.objects.NativeArray{@link #getPropertyDescriptor(String)} as the
 770      * overriding way to find array properties
 771      *
 772      * @see jdk.nashorn.internal.objects.NativeArray
 773      *
 774      * @param key  Property key.
 775      * @param deep Whether the search should look up proto chain.
 776      *
 777      * @return FindPropertyData or null if not found.
 778      */
 779     public final FindProperty findProperty(final String key, final boolean deep) {
 780         return findProperty(key, deep, this);
 781     }
 782 
 783     /**
 784      * Low level property API (not using property descriptors)
 785      * <p>
 786      * Find a property in the prototype hierarchy. Note: this is not a good idea
 787      * to override except as it was done in {@link WithObject}.
 788      * If you have to, use
 789      * {jdk.nashorn.internal.objects.NativeArray{@link #getProperty(String)} or
 790      * {jdk.nashorn.internal.objects.NativeArray{@link #getPropertyDescriptor(String)} as the
 791      * overriding way to find array properties
 792      *
 793      * @see jdk.nashorn.internal.objects.NativeArray
 794      *
 795      * @param key  Property key.
 796      * @param deep Whether the search should look up proto chain.
 797      * @param start the object on which the lookup was originally initiated
 798      *
 799      * @return FindPropertyData or null if not found.
 800      */
 801     protected FindProperty findProperty(final String key, final boolean deep, final ScriptObject start) {
 802 
 803         final PropertyMap selfMap  = getMap();
 804         final Property    property = selfMap.findProperty(key);
 805 
 806         if (property != null) {
 807             return new FindProperty(start, this, property);
 808         }
 809 
 810         if (deep) {
 811             final ScriptObject myProto = getProto();
 812             if (myProto != null) {
 813                 return myProto.findProperty(key, deep, start);
 814             }
 815         }
 816 
 817         return null;
 818     }
 819 
 820     /**
 821      * Low level property API. This is similar to {@link #findProperty(String, boolean)} but returns a
 822      * {@code boolean} value instead of a {@link FindProperty} object.
 823      * @param key  Property key.
 824      * @param deep Whether the search should look up proto chain.
 825      * @return true if the property was found.
 826      */
 827     boolean hasProperty(final String key, final boolean deep) {
 828         if (getMap().findProperty(key) != null) {
 829             return true;
 830         }
 831 
 832         if (deep) {
 833             final ScriptObject myProto = getProto();
 834             if (myProto != null) {
 835                 return myProto.hasProperty(key, deep);
 836             }
 837         }
 838 
 839         return false;
 840     }
 841 
 842     private SwitchPoint findBuiltinSwitchPoint(final String key) {
 843         for (ScriptObject myProto = getProto(); myProto != null; myProto = myProto.getProto()) {
 844             final Property prop = myProto.getMap().findProperty(key);
 845             if (prop != null) {
 846                 final SwitchPoint sp = prop.getBuiltinSwitchPoint();
 847                 if (sp != null && !sp.hasBeenInvalidated()) {
 848                     return sp;
 849                 }
 850             }
 851         }
 852         return null;
 853     }
 854 
 855     /**
 856      * Add a new property to the object.
 857      * <p>
 858      * This a more "low level" way that doesn't involve {@link PropertyDescriptor}s
 859      *
 860      * @param key             Property key.
 861      * @param propertyFlags   Property flags.
 862      * @param getter          Property getter, or null if not defined
 863      * @param setter          Property setter, or null if not defined
 864      *
 865      * @return New property.
 866      */
 867     public final Property addOwnProperty(final String key, final int propertyFlags, final ScriptFunction getter, final ScriptFunction setter) {
 868         return addOwnProperty(newUserAccessors(key, propertyFlags, getter, setter));
 869     }
 870 
 871     /**
 872      * Add a new property to the object.
 873      * <p>
 874      * This a more "low level" way that doesn't involve {@link PropertyDescriptor}s
 875      *
 876      * @param key             Property key.
 877      * @param propertyFlags   Property flags.
 878      * @param value           Value of property
 879      *
 880      * @return New property.
 881      */
 882     public final Property addOwnProperty(final String key, final int propertyFlags, final Object value) {
 883         return addSpillProperty(key, propertyFlags, value, true);
 884     }
 885 
 886     /**
 887      * Add a new property to the object.
 888      * <p>
 889      * This a more "low level" way that doesn't involve {@link PropertyDescriptor}s
 890      *
 891      * @param newProperty property to add
 892      *
 893      * @return New property.
 894      */
 895     public final Property addOwnProperty(final Property newProperty) {
 896         PropertyMap oldMap = getMap();
 897         while (true) {
 898             final PropertyMap newMap = oldMap.addProperty(newProperty);
 899             if (!compareAndSetMap(oldMap, newMap)) {
 900                 oldMap = getMap();
 901                 final Property oldProperty = oldMap.findProperty(newProperty.getKey());
 902 
 903                 if (oldProperty != null) {
 904                     return oldProperty;
 905                 }
 906             } else {
 907                 return newProperty;
 908             }
 909         }
 910     }
 911 
 912     private void erasePropertyValue(final Property property) {
 913         // Erase the property field value with undefined. If the property is defined
 914         // by user-defined accessors, we don't want to call the setter!!
 915         if (!(property instanceof UserAccessorProperty)) {
 916             assert property != null;
 917             property.setValue(this, this, UNDEFINED, false);
 918         }
 919     }
 920 
 921     /**
 922      * Delete a property from the object.
 923      *
 924      * @param property Property to delete.
 925      *
 926      * @return true if deleted.
 927      */
 928     public final boolean deleteOwnProperty(final Property property) {
 929         erasePropertyValue(property);
 930         PropertyMap oldMap = getMap();
 931 
 932         while (true) {
 933             final PropertyMap newMap = oldMap.deleteProperty(property);
 934 
 935             if (newMap == null) {
 936                 return false;
 937             }
 938 
 939             if (!compareAndSetMap(oldMap, newMap)) {
 940                 oldMap = getMap();
 941             } else {
 942                 // delete getter and setter function references so that we don't leak
 943                 if (property instanceof UserAccessorProperty) {
 944                     ((UserAccessorProperty)property).setAccessors(this, getMap(), null);
 945                 }
 946 
 947                 invalidateGlobalConstant(property.getKey());
 948                 return true;
 949             }
 950         }
 951 
 952     }
 953 
 954     /**
 955      * Fast initialization functions for ScriptFunctions that are strict, to avoid
 956      * creating setters that probably aren't used. Inject directly into the spill pool
 957      * the defaults for "arguments" and "caller"
 958      *
 959      * @param key           property key
 960      * @param propertyFlags flags
 961      * @param getter        getter for {@link UserAccessorProperty}, null if not present or N/A
 962      * @param setter        setter for {@link UserAccessorProperty}, null if not present or N/A
 963      */
 964     protected final void initUserAccessors(final String key, final int propertyFlags, final ScriptFunction getter, final ScriptFunction setter) {
 965         final PropertyMap oldMap = getMap();
 966         final int slot = oldMap.getFreeSpillSlot();
 967         ensureSpillSize(slot);
 968         objectSpill[slot] = new UserAccessorProperty.Accessors(getter, setter);
 969         Property    newProperty;
 970         PropertyMap newMap;
 971         do {
 972             newProperty = new UserAccessorProperty(key, propertyFlags, slot);
 973             newMap = oldMap.addProperty(newProperty);
 974         } while (!compareAndSetMap(oldMap, newMap));
 975     }
 976 
 977     /**
 978      * Modify a property in the object
 979      *
 980      * @param oldProperty    property to modify
 981      * @param propertyFlags  new property flags
 982      * @param getter         getter for {@link UserAccessorProperty}, null if not present or N/A
 983      * @param setter         setter for {@link UserAccessorProperty}, null if not present or N/A
 984      *
 985      * @return new property
 986      */
 987     public final Property modifyOwnProperty(final Property oldProperty, final int propertyFlags, final ScriptFunction getter, final ScriptFunction setter) {
 988         Property newProperty;
 989 
 990         if (oldProperty instanceof UserAccessorProperty) {
 991             final UserAccessorProperty uc = (UserAccessorProperty)oldProperty;
 992             final int slot = uc.getSlot();
 993 
 994             assert uc.getLocalType() == Object.class;
 995             final UserAccessorProperty.Accessors gs = uc.getAccessors(this); //this crashes
 996             assert gs != null;
 997             //reuse existing getter setter for speed
 998             gs.set(getter, setter);
 999             if (uc.getFlags() == propertyFlags) {
1000                 return oldProperty;
1001             }
1002             newProperty = new UserAccessorProperty(uc.getKey(), propertyFlags, slot);
1003         } else {
1004             // erase old property value and create new user accessor property
1005             erasePropertyValue(oldProperty);
1006             newProperty = newUserAccessors(oldProperty.getKey(), propertyFlags, getter, setter);
1007         }
1008 
1009         return modifyOwnProperty(oldProperty, newProperty);
1010     }
1011 
1012     /**
1013       * Modify a property in the object
1014       *
1015       * @param oldProperty    property to modify
1016       * @param propertyFlags  new property flags
1017       *
1018       * @return new property
1019       */
1020     public final Property modifyOwnProperty(final Property oldProperty, final int propertyFlags) {
1021         return modifyOwnProperty(oldProperty, oldProperty.setFlags(propertyFlags));
1022     }
1023 
1024     /**
1025      * Modify a property in the object, replacing a property with a new one
1026      *
1027      * @param oldProperty   property to replace
1028      * @param newProperty   property to replace it with
1029      *
1030      * @return new property
1031      */
1032     private Property modifyOwnProperty(final Property oldProperty, final Property newProperty) {
1033         if (oldProperty == newProperty) {
1034             return newProperty; //nop
1035         }
1036 
1037         assert newProperty.getKey().equals(oldProperty.getKey()) : "replacing property with different key";
1038 
1039         PropertyMap oldMap = getMap();
1040 
1041         while (true) {
1042             final PropertyMap newMap = oldMap.replaceProperty(oldProperty, newProperty);
1043 
1044             if (!compareAndSetMap(oldMap, newMap)) {
1045                 oldMap = getMap();
1046                 final Property oldPropertyLookup = oldMap.findProperty(oldProperty.getKey());
1047 
1048                 if (oldPropertyLookup != null && oldPropertyLookup.equals(newProperty)) {
1049                     return oldPropertyLookup;
1050                 }
1051             } else {
1052                 return newProperty;
1053             }
1054         }
1055     }
1056 
1057     /**
1058      * Update getter and setter in an object literal.
1059      *
1060      * @param key    Property key.
1061      * @param getter {@link UserAccessorProperty} defined getter, or null if none
1062      * @param setter {@link UserAccessorProperty} defined setter, or null if none
1063      */
1064     public final void setUserAccessors(final String key, final ScriptFunction getter, final ScriptFunction setter) {
1065         final Property oldProperty = getMap().findProperty(key);
1066         if (oldProperty instanceof UserAccessorProperty) {
1067             modifyOwnProperty(oldProperty, oldProperty.getFlags(), getter, setter);
1068         } else {
1069             addOwnProperty(newUserAccessors(key, oldProperty != null ? oldProperty.getFlags() : 0, getter, setter));
1070         }
1071     }
1072 
1073     private static int getIntValue(final FindProperty find, final int programPoint) {
1074         final MethodHandle getter = find.getGetter(int.class, programPoint, null);
1075         if (getter != null) {
1076             try {
1077                 return (int)getter.invokeExact((Object)find.getGetterReceiver());
1078             } catch (final Error|RuntimeException e) {
1079                 throw e;
1080             } catch (final Throwable e) {
1081                 throw new RuntimeException(e);
1082             }
1083         }
1084 
1085         return UNDEFINED_INT;
1086     }
1087 
1088     private static long getLongValue(final FindProperty find, final int programPoint) {
1089         final MethodHandle getter = find.getGetter(long.class, programPoint, null);
1090         if (getter != null) {
1091             try {
1092                 return (long)getter.invokeExact((Object)find.getGetterReceiver());
1093             } catch (final Error|RuntimeException e) {
1094                 throw e;
1095             } catch (final Throwable e) {
1096                 throw new RuntimeException(e);
1097             }
1098         }
1099 
1100         return UNDEFINED_LONG;
1101     }
1102 
1103     private static double getDoubleValue(final FindProperty find, final int programPoint) {
1104         final MethodHandle getter = find.getGetter(double.class, programPoint, null);
1105         if (getter != null) {
1106             try {
1107                 return (double)getter.invokeExact((Object)find.getGetterReceiver());
1108             } catch (final Error|RuntimeException e) {
1109                 throw e;
1110             } catch (final Throwable e) {
1111                 throw new RuntimeException(e);
1112             }
1113         }
1114 
1115         return UNDEFINED_DOUBLE;
1116     }
1117 
1118     /**
1119      * Return methodHandle of value function for call.
1120      *
1121      * @param find      data from find property.
1122      * @param type      method type of function.
1123      * @param bindName  null or name to bind to second argument (property not found method.)
1124      *
1125      * @return value of property as a MethodHandle or null.
1126      */
1127     protected MethodHandle getCallMethodHandle(final FindProperty find, final MethodType type, final String bindName) {
1128         return getCallMethodHandle(find.getObjectValue(), type, bindName);
1129     }
1130 
1131     /**
1132      * Return methodHandle of value function for call.
1133      *
1134      * @param value     value of receiver, it not a {@link ScriptFunction} this will return null.
1135      * @param type      method type of function.
1136      * @param bindName  null or name to bind to second argument (property not found method.)
1137      *
1138      * @return value of property as a MethodHandle or null.
1139      */
1140     protected static MethodHandle getCallMethodHandle(final Object value, final MethodType type, final String bindName) {
1141         return value instanceof ScriptFunction ? ((ScriptFunction)value).getCallMethodHandle(type, bindName) : null;
1142     }
1143 
1144     /**
1145      * Get value using found property.
1146      *
1147      * @param property Found property.
1148      *
1149      * @return Value of property.
1150      */
1151     public final Object getWithProperty(final Property property) {
1152         return new FindProperty(this, this, property).getObjectValue();
1153     }
1154 
1155     /**
1156      * Get a property given a key
1157      *
1158      * @param key property key
1159      *
1160      * @return property for key
1161      */
1162     public final Property getProperty(final String key) {
1163         return getMap().findProperty(key);
1164     }
1165 
1166     /**
1167      * Overridden by {@link jdk.nashorn.internal.objects.NativeArguments} class (internal use.)
1168      * Used for argument access in a vararg function using parameter name.
1169      * Returns the argument at a given key (index)
1170      *
1171      * @param key argument index
1172      *
1173      * @return the argument at the given position, or undefined if not present
1174      */
1175     public Object getArgument(final int key) {
1176         return get(key);
1177     }
1178 
1179     /**
1180      * Overridden by {@link jdk.nashorn.internal.objects.NativeArguments} class (internal use.)
1181      * Used for argument access in a vararg function using parameter name.
1182      * Returns the argument at a given key (index)
1183      *
1184      * @param key   argument index
1185      * @param value the value to write at the given index
1186      */
1187     public void setArgument(final int key, final Object value) {
1188         set(key, value, 0);
1189     }
1190 
1191     /**
1192      * Return the current context from the object's map.
1193      * @return Current context.
1194      */
1195     protected Context getContext() {
1196         return Context.fromClass(getClass());
1197     }
1198 
1199     /**
1200      * Return the map of an object.
1201      * @return PropertyMap object.
1202      */
1203     public final PropertyMap getMap() {
1204         return map;
1205     }
1206 
1207     /**
1208      * Set the initial map.
1209      * @param map Initial map.
1210      */
1211     public final void setMap(final PropertyMap map) {
1212         this.map = map;
1213     }
1214 
1215     /**
1216      * Conditionally set the new map if the old map is the same.
1217      * @param oldMap Map prior to manipulation.
1218      * @param newMap Replacement map.
1219      * @return true if the operation succeeded.
1220      */
1221     protected final boolean compareAndSetMap(final PropertyMap oldMap, final PropertyMap newMap) {
1222         if (oldMap == this.map) {
1223             this.map = newMap;
1224             return true;
1225         }
1226         return false;
1227      }
1228 
1229     /**
1230      * Return the __proto__ of an object.
1231      * @return __proto__ object.
1232      */
1233     public final ScriptObject getProto() {
1234         return proto;
1235     }
1236 
1237     /**
1238      * Get the proto of a specific depth
1239      * @param n depth
1240      * @return proto at given depth
1241      */
1242     public final ScriptObject getProto(final int n) {
1243         assert n > 0;
1244         ScriptObject p = getProto();
1245         for (int i = n; i-- > 0;) {
1246             p = p.getProto();
1247         }
1248         return p;
1249     }
1250 
1251     /**
1252      * Set the __proto__ of an object.
1253      * @param newProto new __proto__ to set.
1254      */
1255     public final void setProto(final ScriptObject newProto) {
1256         final ScriptObject oldProto = proto;
1257 
1258         if (oldProto != newProto) {
1259             proto = newProto;
1260 
1261             // Let current listeners know that the prototype has changed and set our map
1262             final PropertyListeners listeners = getMap().getListeners();
1263             if (listeners != null) {
1264                 listeners.protoChanged();
1265             }
1266             // Replace our current allocator map with one that is associated with the new prototype.
1267             setMap(getMap().changeProto(newProto));
1268         }
1269     }
1270 
1271     /**
1272      * Set the initial __proto__ of this object. This should be used instead of
1273      * {@link #setProto} if it is known that the current property map will not be
1274      * used on a new object with any other parent property map, so we can pass over
1275      * property map invalidation/evolution.
1276      *
1277      * @param initialProto the initial __proto__ to set.
1278      */
1279     public void setInitialProto(final ScriptObject initialProto) {
1280         this.proto = initialProto;
1281     }
1282 
1283     /**
1284      * Invoked from generated bytecode to initialize the prototype of object literals to the global Object prototype.
1285      * @param obj the object literal that needs to have its prototype initialized to the global Object prototype.
1286      */
1287     public static void setGlobalObjectProto(final ScriptObject obj) {
1288         obj.setInitialProto(Global.objectPrototype());
1289     }
1290 
1291     /**
1292      * Set the __proto__ of an object with checks.
1293      * This is the built-in operation [[SetPrototypeOf]]
1294      * See ES6 draft spec: 9.1.2 [[SetPrototypeOf]] (V)
1295      *
1296      * @param newProto Prototype to set.
1297      */
1298     public final void setPrototypeOf(final Object newProto) {
1299         if (newProto == null || newProto instanceof ScriptObject) {
1300             if (! isExtensible()) {
1301                 // okay to set same proto again - even if non-extensible
1302 
1303                 if (newProto == getProto()) {
1304                     return;
1305                 }
1306                 throw typeError("__proto__.set.non.extensible", ScriptRuntime.safeToString(this));
1307             }
1308 
1309             // check for circularity
1310             ScriptObject p = (ScriptObject)newProto;
1311             while (p != null) {
1312                 if (p == this) {
1313                     throw typeError("circular.__proto__.set", ScriptRuntime.safeToString(this));
1314                 }
1315                 p = p.getProto();
1316             }
1317             setProto((ScriptObject)newProto);
1318         } else {
1319             throw typeError("cant.set.proto.to.non.object", ScriptRuntime.safeToString(this), ScriptRuntime.safeToString(newProto));
1320         }
1321     }
1322 
1323     /**
1324      * Set the __proto__ of an object from an object literal.
1325      * See ES6 draft spec: B.3.1 __proto__ Property Names in
1326      * Object Initializers. Step 6 handling of "__proto__".
1327      *
1328      * @param newProto Prototype to set.
1329      */
1330     public final void setProtoFromLiteral(final Object newProto) {
1331         if (newProto == null || newProto instanceof ScriptObject) {
1332             setPrototypeOf(newProto);
1333         } else {
1334             // Some non-object, non-null. Then, we need to set
1335             // Object.prototype as the new __proto__
1336             //
1337             // var obj = { __proto__ : 34 };
1338             // print(obj.__proto__ === Object.prototype); // => true
1339             setPrototypeOf(Global.objectPrototype());
1340         }
1341     }
1342 
1343     /**
1344      * return an array of all property keys - all inherited, non-enumerable included.
1345      * This is meant for source code completion by interactive shells or editors.
1346      *
1347      * @return Array of keys, order of properties is undefined.
1348      */
1349     public String[] getAllKeys() {
1350         final Set<String> keys = new HashSet<>();
1351         final Set<String> nonEnumerable = new HashSet<>();
1352         for (ScriptObject self = this; self != null; self = self.getProto()) {
1353             keys.addAll(Arrays.asList(self.getOwnKeys(true, nonEnumerable)));
1354         }
1355         return keys.toArray(new String[keys.size()]);
1356     }
1357 
1358     /**
1359      * return an array of own property keys associated with the object.
1360      *
1361      * @param all True if to include non-enumerable keys.
1362      * @return Array of keys.
1363      */
1364     public final String[] getOwnKeys(final boolean all) {
1365         return getOwnKeys(all, null);
1366     }
1367 
1368     /**
1369      * return an array of own property keys associated with the object.
1370      *
1371      * @param all True if to include non-enumerable keys.
1372      * @param nonEnumerable set of non-enumerable properties seen already.Used
1373        to filter out shadowed, but enumerable properties from proto children.
1374      * @return Array of keys.
1375      */
1376     protected String[] getOwnKeys(final boolean all, final Set<String> nonEnumerable) {
1377         final List<Object> keys    = new ArrayList<>();
1378         final PropertyMap  selfMap = this.getMap();
1379 
1380         final ArrayData array  = getArray();
1381 
1382         for (final Iterator<Long> iter = array.indexIterator(); iter.hasNext(); ) {
1383             keys.add(JSType.toString(iter.next().longValue()));
1384         }
1385 
1386         for (final Property property : selfMap.getProperties()) {
1387             final boolean enumerable = property.isEnumerable();
1388             final String key = property.getKey();
1389             if (all) {
1390                 keys.add(key);
1391             } else if (enumerable) {
1392                 // either we don't have non-enumerable filter set or filter set
1393                 // does not contain the current property.
1394                 if (nonEnumerable == null || !nonEnumerable.contains(key)) {
1395                     keys.add(key);
1396                 }
1397             } else {
1398                 // store this non-enumerable property for later proto walk
1399                 if (nonEnumerable != null) {
1400                     nonEnumerable.add(key);
1401                 }
1402             }
1403         }
1404 
1405         return keys.toArray(new String[keys.size()]);
1406     }
1407 
1408     /**
1409      * Check if this ScriptObject has array entries. This means that someone has
1410      * set values with numeric keys in the object.
1411      *
1412      * @return true if array entries exists.
1413      */
1414     public boolean hasArrayEntries() {
1415         return getArray().length() > 0 || getMap().containsArrayKeys();
1416     }
1417 
1418     /**
1419      * Return the valid JavaScript type name descriptor
1420      *
1421      * @return "Object"
1422      */
1423     public String getClassName() {
1424         return "Object";
1425     }
1426 
1427     /**
1428      * {@code length} is a well known property. This is its getter.
1429      * Note that this *may* be optimized by other classes
1430      *
1431      * @return length property value for this ScriptObject
1432      */
1433     public Object getLength() {
1434         return get("length");
1435     }
1436 
1437     /**
1438      * Stateless toString for ScriptObjects.
1439      *
1440      * @return string description of this object, e.g. {@code [object Object]}
1441      */
1442     public String safeToString() {
1443         return "[object " + getClassName() + "]";
1444     }
1445 
1446     /**
1447      * Return the default value of the object with a given preferred type hint.
1448      * The preferred type hints are String.class for type String, Number.class
1449      * for type Number. <p>
1450      *
1451      * A <code>hint</code> of null means "no hint".
1452      *
1453      * ECMA 8.12.8 [[DefaultValue]](hint)
1454      *
1455      * @param typeHint the preferred type hint
1456      * @return the default value
1457      */
1458     public Object getDefaultValue(final Class<?> typeHint) {
1459         // We delegate to Global, as the implementation uses dynamic call sites to invoke object's "toString" and
1460         // "valueOf" methods, and in order to avoid those call sites from becoming megamorphic when multiple contexts
1461         // are being executed in a long-running program, we move the code and their associated dynamic call sites
1462         // (Global.TO_STRING and Global.VALUE_OF) into per-context code.
1463         return Context.getGlobal().getDefaultValue(this, typeHint);
1464     }
1465 
1466     /**
1467      * Checking whether a script object is an instance of another. Used
1468      * in {@link ScriptFunction} for hasInstance implementation, walks
1469      * the proto chain
1470      *
1471      * @param instance instance to check
1472      * @return true if 'instance' is an instance of this object
1473      */
1474     public boolean isInstance(final ScriptObject instance) {
1475         return false;
1476     }
1477 
1478     /**
1479      * Flag this ScriptObject as non extensible
1480      *
1481      * @return the object after being made non extensible
1482      */
1483     public ScriptObject preventExtensions() {
1484         PropertyMap oldMap = getMap();
1485         while (!compareAndSetMap(oldMap,  getMap().preventExtensions())) {
1486             oldMap = getMap();
1487         }
1488 
1489         //invalidate any fast array setters
1490         final ArrayData array = getArray();
1491         assert array != null;
1492         setArray(ArrayData.preventExtension(array));
1493         return this;
1494     }
1495 
1496     /**
1497      * Check whether if an Object (not just a ScriptObject) represents JavaScript array
1498      *
1499      * @param obj object to check
1500      *
1501      * @return true if array
1502      */
1503     public static boolean isArray(final Object obj) {
1504         return obj instanceof ScriptObject && ((ScriptObject)obj).isArray();
1505     }
1506 
1507     /**
1508      * Check if this ScriptObject is an array
1509      * @return true if array
1510      */
1511     public final boolean isArray() {
1512         return (flags & IS_ARRAY) != 0;
1513     }
1514 
1515     /**
1516      * Flag this ScriptObject as being an array
1517      */
1518     public final void setIsArray() {
1519         flags |= IS_ARRAY;
1520     }
1521 
1522     /**
1523      * Check if this ScriptObject is an {@code arguments} vector
1524      * @return true if arguments vector
1525      */
1526     public final boolean isArguments() {
1527         return (flags & IS_ARGUMENTS) != 0;
1528     }
1529 
1530     /**
1531      * Flag this ScriptObject as being an {@code arguments} vector
1532      */
1533     public final void setIsArguments() {
1534         flags |= IS_ARGUMENTS;
1535     }
1536 
1537     /**
1538      * Check if this object has non-writable length property
1539      *
1540      * @return {@code true} if 'length' property is non-writable
1541      */
1542     public boolean isLengthNotWritable() {
1543         return (flags & IS_LENGTH_NOT_WRITABLE) != 0;
1544     }
1545 
1546     /**
1547      * Flag this object as having non-writable length property.
1548      */
1549     public void setIsLengthNotWritable() {
1550         flags |= IS_LENGTH_NOT_WRITABLE;
1551     }
1552 
1553     /**
1554      * Get the {@link ArrayData}, for this ScriptObject, ensuring it is of a type
1555      * that can handle elementType
1556      * @param elementType elementType
1557      * @return array data
1558      */
1559     public final ArrayData getArray(final Class<?> elementType) {
1560         if (elementType == null) {
1561             return arrayData;
1562         }
1563         final ArrayData newArrayData = arrayData.convert(elementType);
1564         if (newArrayData != arrayData) {
1565             arrayData = newArrayData;
1566         }
1567         return newArrayData;
1568     }
1569 
1570     /**
1571      * Get the {@link ArrayData} for this ScriptObject if it is an array
1572      * @return array data
1573      */
1574     public final ArrayData getArray() {
1575         return arrayData;
1576     }
1577 
1578     /**
1579      * Set the {@link ArrayData} for this ScriptObject if it is to be an array
1580      * @param arrayData the array data
1581      */
1582     public final void setArray(final ArrayData arrayData) {
1583         this.arrayData = arrayData;
1584     }
1585 
1586     /**
1587      * Check if this ScriptObject is extensible
1588      * @return true if extensible
1589      */
1590     public boolean isExtensible() {
1591         return getMap().isExtensible();
1592     }
1593 
1594     /**
1595      * ECMAScript 15.2.3.8 - seal implementation
1596      * @return the sealed ScriptObject
1597      */
1598     public ScriptObject seal() {
1599         PropertyMap oldMap = getMap();
1600 
1601         while (true) {
1602             final PropertyMap newMap = getMap().seal();
1603 
1604             if (!compareAndSetMap(oldMap, newMap)) {
1605                 oldMap = getMap();
1606             } else {
1607                 setArray(ArrayData.seal(getArray()));
1608                 return this;
1609             }
1610         }
1611     }
1612 
1613     /**
1614      * Check whether this ScriptObject is sealed
1615      * @return true if sealed
1616      */
1617     public boolean isSealed() {
1618         return getMap().isSealed();
1619     }
1620 
1621     /**
1622      * ECMA 15.2.39 - freeze implementation. Freeze this ScriptObject
1623      * @return the frozen ScriptObject
1624      */
1625     public ScriptObject freeze() {
1626         PropertyMap oldMap = getMap();
1627 
1628         while (true) {
1629             final PropertyMap newMap = getMap().freeze();
1630 
1631             if (!compareAndSetMap(oldMap, newMap)) {
1632                 oldMap = getMap();
1633             } else {
1634                 setArray(ArrayData.freeze(getArray()));
1635                 return this;
1636             }
1637         }
1638     }
1639 
1640     /**
1641      * Check whether this ScriptObject is frozen
1642      * @return true if frozen
1643      */
1644     public boolean isFrozen() {
1645         return getMap().isFrozen();
1646     }
1647 
1648     /**
1649      * Check whether this ScriptObject is scope
1650      * @return true if scope
1651      */
1652     public boolean isScope() {
1653         return false;
1654     }
1655 
1656     /**
1657      * Tag this script object as built in
1658      */
1659     public final void setIsBuiltin() {
1660         flags |= IS_BUILTIN;
1661     }
1662 
1663     /**
1664      * Check if this script object is built in
1665      * @return true if build in
1666      */
1667     public final boolean isBuiltin() {
1668         return (flags & IS_BUILTIN) != 0;
1669     }
1670 
1671     /**
1672      * Clears the properties from a ScriptObject
1673      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1674      *
1675      * @param strict strict mode or not
1676      */
1677     public void clear(final boolean strict) {
1678         final Iterator<String> iter = propertyIterator();
1679         while (iter.hasNext()) {
1680             delete(iter.next(), strict);
1681         }
1682     }
1683 
1684     /**
1685      * Checks if a property with a given key is present in a ScriptObject
1686      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1687      *
1688      * @param key the key to check for
1689      * @return true if a property with the given key exists, false otherwise
1690      */
1691     public boolean containsKey(final Object key) {
1692         return has(key);
1693     }
1694 
1695     /**
1696      * Checks if a property with a given value is present in a ScriptObject
1697      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1698      *
1699      * @param value value to check for
1700      * @return true if a property with the given value exists, false otherwise
1701      */
1702     public boolean containsValue(final Object value) {
1703         final Iterator<Object> iter = valueIterator();
1704         while (iter.hasNext()) {
1705             if (iter.next().equals(value)) {
1706                 return true;
1707             }
1708         }
1709         return false;
1710     }
1711 
1712     /**
1713      * Returns the set of {@literal <property, value>} entries that make up this
1714      * ScriptObject's properties
1715      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1716      *
1717      * @return an entry set of all the properties in this object
1718      */
1719     public Set<Map.Entry<Object, Object>> entrySet() {
1720         final Iterator<String> iter = propertyIterator();
1721         final Set<Map.Entry<Object, Object>> entries = new HashSet<>();
1722         while (iter.hasNext()) {
1723             final Object key = iter.next();
1724             entries.add(new AbstractMap.SimpleImmutableEntry<>(key, get(key)));
1725         }
1726         return Collections.unmodifiableSet(entries);
1727     }
1728 
1729     /**
1730      * Check whether a ScriptObject contains no properties
1731      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1732      *
1733      * @return true if object has no properties
1734      */
1735     public boolean isEmpty() {
1736         return !propertyIterator().hasNext();
1737     }
1738 
1739     /**
1740      * Return the set of keys (property names) for all properties
1741      * in this ScriptObject
1742      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1743      *
1744      * @return keySet of this ScriptObject
1745      */
1746     public Set<Object> keySet() {
1747         final Iterator<String> iter = propertyIterator();
1748         final Set<Object> keySet = new HashSet<>();
1749         while (iter.hasNext()) {
1750             keySet.add(iter.next());
1751         }
1752         return Collections.unmodifiableSet(keySet);
1753     }
1754 
1755     /**
1756      * Put a property in the ScriptObject
1757      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1758      *
1759      * @param key property key
1760      * @param value property value
1761      * @param strict strict mode or not
1762      * @return oldValue if property with same key existed already
1763      */
1764     public Object put(final Object key, final Object value, final boolean strict) {
1765         final Object oldValue = get(key);
1766         final int scriptObjectFlags = strict ? NashornCallSiteDescriptor.CALLSITE_STRICT : 0;
1767         set(key, value, scriptObjectFlags);
1768         return oldValue;
1769     }
1770 
1771     /**
1772      * Put several properties in the ScriptObject given a mapping
1773      * of their keys to their values
1774      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1775      *
1776      * @param otherMap a {@literal <key,value>} map of properties to add
1777      * @param strict strict mode or not
1778      */
1779     public void putAll(final Map<?, ?> otherMap, final boolean strict) {
1780         final int scriptObjectFlags = strict ? NashornCallSiteDescriptor.CALLSITE_STRICT : 0;
1781         for (final Map.Entry<?, ?> entry : otherMap.entrySet()) {
1782             set(entry.getKey(), entry.getValue(), scriptObjectFlags);
1783         }
1784     }
1785 
1786     /**
1787      * Remove a property from the ScriptObject.
1788      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1789      *
1790      * @param key the key of the property
1791      * @param strict strict mode or not
1792      * @return the oldValue of the removed property
1793      */
1794     public Object remove(final Object key, final boolean strict) {
1795         final Object oldValue = get(key);
1796         delete(key, strict);
1797         return oldValue;
1798     }
1799 
1800     /**
1801      * Return the size of the ScriptObject - i.e. the number of properties
1802      * it contains
1803      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1804      *
1805      * @return number of properties in ScriptObject
1806      */
1807     public int size() {
1808         int n = 0;
1809         for (final Iterator<String> iter = propertyIterator(); iter.hasNext(); iter.next()) {
1810             n++;
1811         }
1812         return n;
1813     }
1814 
1815     /**
1816      * Return the values of the properties in the ScriptObject
1817      * (java.util.Map-like method to help ScriptObjectMirror implementation)
1818      *
1819      * @return collection of values for the properties in this ScriptObject
1820      */
1821     public Collection<Object> values() {
1822         final List<Object>     values = new ArrayList<>(size());
1823         final Iterator<Object> iter   = valueIterator();
1824         while (iter.hasNext()) {
1825             values.add(iter.next());
1826         }
1827         return Collections.unmodifiableList(values);
1828     }
1829 
1830     /**
1831      * Lookup method that, given a CallSiteDescriptor, looks up the target
1832      * MethodHandle and creates a GuardedInvocation
1833      * with the appropriate guard(s).
1834      *
1835      * @param desc call site descriptor
1836      * @param request the link request
1837      *
1838      * @return GuardedInvocation for the callsite
1839      */
1840     public GuardedInvocation lookup(final CallSiteDescriptor desc, final LinkRequest request) {
1841         final int c = desc.getNameTokenCount();
1842         // JavaScript is "immune" to all currently defined Dynalink composite operation - getProp is the same as getElem
1843         // is the same as getMethod as JavaScript objects have a single namespace for all three. Therefore, we don't
1844         // care about them, and just link to whatever is the first operation.
1845         final String operator = CallSiteDescriptorFactory.tokenizeOperators(desc).get(0);
1846         // NOTE: we support getElem and setItem as JavaScript doesn't distinguish items from properties. Nashorn itself
1847         // emits "dyn:getProp:identifier" for "<expr>.<identifier>" and "dyn:getElem" for "<expr>[<expr>]", but we are
1848         // more flexible here and dispatch not on operation name (getProp vs. getElem), but rather on whether the
1849         // operation has an associated name or not.
1850         switch (operator) {
1851         case "getProp":
1852         case "getElem":
1853         case "getMethod":
1854             return c > 2 ? findGetMethod(desc, request, operator) : findGetIndexMethod(desc, request);
1855         case "setProp":
1856         case "setElem":
1857             return c > 2 ? findSetMethod(desc, request) : findSetIndexMethod(desc, request);
1858         case "call":
1859             return findCallMethod(desc, request);
1860         case "new":
1861             return findNewMethod(desc, request);
1862         case "callMethod":
1863             return findCallMethodMethod(desc, request);
1864         default:
1865             return null;
1866         }
1867     }
1868 
1869     /**
1870      * Find the appropriate New method for an invoke dynamic call.
1871      *
1872      * @param desc The invoke dynamic call site descriptor.
1873      * @param request The link request
1874      *
1875      * @return GuardedInvocation to be invoked at call site.
1876      */
1877     protected GuardedInvocation findNewMethod(final CallSiteDescriptor desc, final LinkRequest request) {
1878         return notAFunction(desc);
1879     }
1880 
1881     /**
1882      * Find the appropriate CALL method for an invoke dynamic call.
1883      * This generates "not a function" always
1884      *
1885      * @param desc    the call site descriptor.
1886      * @param request the link request
1887      *
1888      * @return GuardedInvocation to be invoked at call site.
1889      */
1890     protected GuardedInvocation findCallMethod(final CallSiteDescriptor desc, final LinkRequest request) {
1891         return notAFunction(desc);
1892     }
1893 
1894     private GuardedInvocation notAFunction(final CallSiteDescriptor desc) {
1895         throw typeError("not.a.function", NashornCallSiteDescriptor.getFunctionErrorMessage(desc, this));
1896     }
1897 
1898     /**
1899      * Find an implementation for a "dyn:callMethod" operation. Note that Nashorn internally never uses
1900      * "dyn:callMethod", but instead always emits two call sites in bytecode, one for "dyn:getMethod", and then another
1901      * one for "dyn:call". Explicit support for "dyn:callMethod" is provided for the benefit of potential external
1902      * callers. The implementation itself actually folds a "dyn:getMethod" method handle into a "dyn:call" method handle.
1903      *
1904      * @param desc    the call site descriptor.
1905      * @param request the link request
1906      *
1907      * @return GuardedInvocation to be invoked at call site.
1908      */
1909     protected GuardedInvocation findCallMethodMethod(final CallSiteDescriptor desc, final LinkRequest request) {
1910         // R(P0, P1, ...)
1911         final MethodType callType = desc.getMethodType();
1912         // use type Object(P0) for the getter
1913         final CallSiteDescriptor getterType = desc.changeMethodType(MethodType.methodType(Object.class, callType.parameterType(0)));
1914         final GuardedInvocation getter = findGetMethod(getterType, request, "getMethod");
1915 
1916         // Object(P0) => Object(P0, P1, ...)
1917         final MethodHandle argDroppingGetter = MH.dropArguments(getter.getInvocation(), 1, callType.parameterList().subList(1, callType.parameterCount()));
1918         // R(Object, P0, P1, ...)
1919         final MethodHandle invoker = Bootstrap.createDynamicInvoker("dyn:call", callType.insertParameterTypes(0, argDroppingGetter.type().returnType()));
1920         // Fold Object(P0, P1, ...) into R(Object, P0, P1, ...) => R(P0, P1, ...)
1921         return getter.replaceMethods(MH.foldArguments(invoker, argDroppingGetter), getter.getGuard());
1922     }
1923 
1924     /**
1925      * Test whether this object contains in its prototype chain or is itself a with-object.
1926      * @return true if a with-object was found
1927      */
1928     boolean hasWithScope() {
1929         return false;
1930     }
1931 
1932     /**
1933      * Add a filter to the first argument of {@code methodHandle} that calls its {@link #getProto()} method
1934      * {@code depth} times.
1935      * @param methodHandle a method handle
1936      * @param depth        distance to target prototype
1937      * @return the filtered method handle
1938      */
1939     static MethodHandle addProtoFilter(final MethodHandle methodHandle, final int depth) {
1940         if (depth == 0) {
1941             return methodHandle;
1942         }
1943         final int listIndex = depth - 1; // We don't need 0-deep walker
1944         MethodHandle filter = listIndex < PROTO_FILTERS.size() ? PROTO_FILTERS.get(listIndex) : null;
1945 
1946         if (filter == null) {
1947             filter = addProtoFilter(GETPROTO, depth - 1);
1948             PROTO_FILTERS.add(null);
1949             PROTO_FILTERS.set(listIndex, filter);
1950         }
1951 
1952         return MH.filterArguments(methodHandle, 0, filter.asType(filter.type().changeReturnType(methodHandle.type().parameterType(0))));
1953     }
1954 
1955     /**
1956      * Find the appropriate GET method for an invoke dynamic call.
1957      *
1958      * @param desc     the call site descriptor
1959      * @param request  the link request
1960      * @param operator operator for get: getProp, getMethod, getElem etc
1961      *
1962      * @return GuardedInvocation to be invoked at call site.
1963      */
1964     protected GuardedInvocation findGetMethod(final CallSiteDescriptor desc, final LinkRequest request, final String operator) {
1965         final boolean explicitInstanceOfCheck = explicitInstanceOfCheck(desc, request);
1966 
1967         String name;
1968         name = desc.getNameToken(CallSiteDescriptor.NAME_OPERAND);
1969         if (NashornCallSiteDescriptor.isApplyToCall(desc)) {
1970             if (Global.isBuiltinFunctionPrototypeApply()) {
1971                 name = "call";
1972             }
1973         }
1974 
1975         if (request.isCallSiteUnstable() || hasWithScope()) {
1976             return findMegaMorphicGetMethod(desc, name, "getMethod".equals(operator));
1977         }
1978 
1979         final FindProperty find = findProperty(name, true);
1980         MethodHandle mh;
1981 
1982         if (find == null) {
1983             switch (operator) {
1984             case "getElem": // getElem only gets here if element name is constant, so treat it like a property access
1985             case "getProp":
1986                 return noSuchProperty(desc, request);
1987             case "getMethod":
1988                 return noSuchMethod(desc, request);
1989             default:
1990                 throw new AssertionError(operator); // never invoked with any other operation
1991             }
1992         }
1993 
1994         final GlobalConstants globalConstants = getGlobalConstants();
1995         if (globalConstants != null) {
1996             final GuardedInvocation cinv = globalConstants.findGetMethod(find, this, desc);
1997             if (cinv != null) {
1998                 return cinv;
1999             }
2000         }
2001 
2002         final Class<?> returnType = desc.getMethodType().returnType();
2003         final Property property   = find.getProperty();
2004 
2005         final int programPoint = NashornCallSiteDescriptor.isOptimistic(desc) ?
2006                 NashornCallSiteDescriptor.getProgramPoint(desc) :
2007                 UnwarrantedOptimismException.INVALID_PROGRAM_POINT;
2008 
2009         mh = find.getGetter(returnType, programPoint, request);
2010         // Get the appropriate guard for this callsite and property.
2011         final MethodHandle guard = NashornGuards.getGuard(this, property, desc, explicitInstanceOfCheck);
2012         final ScriptObject owner = find.getOwner();
2013         final Class<ClassCastException> exception = explicitInstanceOfCheck ? null : ClassCastException.class;
2014 
2015         final SwitchPoint protoSwitchPoint;
2016 
2017         if (mh == null) {
2018             mh = Lookup.emptyGetter(returnType);
2019             protoSwitchPoint = getProtoSwitchPoint(name, owner);
2020         } else if (!find.isSelf()) {
2021             assert mh.type().returnType().equals(returnType) :
2022                     "return type mismatch for getter " + mh.type().returnType() + " != " + returnType;
2023             if (!(property instanceof UserAccessorProperty)) {
2024                 // Add a filter that replaces the self object with the prototype owning the property.
2025                 mh = addProtoFilter(mh, find.getProtoChainLength());
2026             }
2027             protoSwitchPoint = getProtoSwitchPoint(name, owner);
2028         } else {
2029             protoSwitchPoint = null;
2030         }
2031 
2032         final GuardedInvocation inv = new GuardedInvocation(mh, guard, protoSwitchPoint, exception);
2033         return inv.addSwitchPoint(findBuiltinSwitchPoint(name));
2034     }
2035 
2036     private static GuardedInvocation findMegaMorphicGetMethod(final CallSiteDescriptor desc, final String name, final boolean isMethod) {
2037         Context.getContextTrusted().getLogger(ObjectClassGenerator.class).warning("Megamorphic getter: " + desc + " " + name + " " +isMethod);
2038         final MethodHandle invoker = MH.insertArguments(MEGAMORPHIC_GET, 1, name, isMethod);
2039         final MethodHandle guard   = getScriptObjectGuard(desc.getMethodType(), true);
2040         return new GuardedInvocation(invoker, guard);
2041     }
2042 
2043     @SuppressWarnings("unused")
2044     private Object megamorphicGet(final String key, final boolean isMethod) {
2045         final FindProperty find = findProperty(key, true);
2046         if (find != null) {
2047             return find.getObjectValue();
2048         }
2049 
2050         return isMethod ? getNoSuchMethod(key, INVALID_PROGRAM_POINT) : invokeNoSuchProperty(key, INVALID_PROGRAM_POINT);
2051     }
2052 
2053     // Marks a property as declared and sets its value. Used as slow path for block-scoped LET and CONST
2054     @SuppressWarnings("unused")
2055     private void declareAndSet(final String key, final Object value) {
2056         final PropertyMap oldMap = getMap();
2057         final FindProperty find = findProperty(key, false);
2058         assert find != null;
2059 
2060         final Property property = find.getProperty();
2061         assert property != null;
2062         assert property.needsDeclaration();
2063 
2064         final PropertyMap newMap = oldMap.replaceProperty(property, property.removeFlags(Property.NEEDS_DECLARATION));
2065         setMap(newMap);
2066         set(key, value, 0);
2067     }
2068 
2069     /**
2070      * Find the appropriate GETINDEX method for an invoke dynamic call.
2071      *
2072      * @param desc    the call site descriptor
2073      * @param request the link request
2074      *
2075      * @return GuardedInvocation to be invoked at call site.
2076      */
2077     protected GuardedInvocation findGetIndexMethod(final CallSiteDescriptor desc, final LinkRequest request) {
2078         final MethodType callType                = desc.getMethodType();
2079         final Class<?>   returnType              = callType.returnType();
2080         final Class<?>   returnClass             = returnType.isPrimitive() ? returnType : Object.class;
2081         final Class<?>   keyClass                = callType.parameterType(1);
2082         final boolean    explicitInstanceOfCheck = explicitInstanceOfCheck(desc, request);
2083 
2084         final String name;
2085         if (returnClass.isPrimitive()) {
2086             //turn e.g. get with a double into getDouble
2087             final String returnTypeName = returnClass.getName();
2088             name = "get" + Character.toUpperCase(returnTypeName.charAt(0)) + returnTypeName.substring(1, returnTypeName.length());
2089         } else {
2090             name = "get";
2091         }
2092 
2093         final MethodHandle mh = findGetIndexMethodHandle(returnClass, name, keyClass, desc);
2094         return new GuardedInvocation(mh, getScriptObjectGuard(callType, explicitInstanceOfCheck), (SwitchPoint)null, explicitInstanceOfCheck ? null : ClassCastException.class);
2095     }
2096 
2097     private static MethodHandle getScriptObjectGuard(final MethodType type, final boolean explicitInstanceOfCheck) {
2098         return ScriptObject.class.isAssignableFrom(type.parameterType(0)) ? null : NashornGuards.getScriptObjectGuard(explicitInstanceOfCheck);
2099     }
2100 
2101     /**
2102      * Find a handle for a getIndex method
2103      * @param returnType     return type for getter
2104      * @param name           name
2105      * @param elementType    index type for getter
2106      * @param desc           call site descriptor
2107      * @return method handle for getter
2108      */
2109     protected MethodHandle findGetIndexMethodHandle(final Class<?> returnType, final String name, final Class<?> elementType, final CallSiteDescriptor desc) {
2110         if (!returnType.isPrimitive()) {
2111             return findOwnMH_V(getClass(), name, returnType, elementType);
2112         }
2113 
2114         return MH.insertArguments(
2115                 findOwnMH_V(getClass(), name, returnType, elementType, int.class),
2116                 2,
2117                 NashornCallSiteDescriptor.isOptimistic(desc) ?
2118                         NashornCallSiteDescriptor.getProgramPoint(desc) :
2119                         INVALID_PROGRAM_POINT);
2120     }
2121 
2122     /**
2123      * Get a switch point for a property with the given {@code name} that will be invalidated when
2124      * the property definition is changed in this object's prototype chain. Returns {@code null} if
2125      * the property is defined in this object itself.
2126      *
2127      * @param name the property name
2128      * @param owner the property owner, null if property is not defined
2129      * @return a SwitchPoint or null
2130      */
2131     public final SwitchPoint getProtoSwitchPoint(final String name, final ScriptObject owner) {
2132         if (owner == this || getProto() == null) {
2133             return null;
2134         }
2135 
2136         for (ScriptObject obj = this; obj != owner && obj.getProto() != null; obj = obj.getProto()) {
2137             final ScriptObject parent = obj.getProto();
2138             parent.getMap().addListener(name, obj.getMap());
2139         }
2140 
2141         return getMap().getSwitchPoint(name);
2142     }
2143 
2144     /**
2145      * Find the appropriate SET method for an invoke dynamic call.
2146      *
2147      * @param desc    the call site descriptor
2148      * @param request the link request
2149      *
2150      * @return GuardedInvocation to be invoked at call site.
2151      */
2152     protected GuardedInvocation findSetMethod(final CallSiteDescriptor desc, final LinkRequest request) {
2153         final String name = desc.getNameToken(CallSiteDescriptor.NAME_OPERAND);
2154 
2155         if (request.isCallSiteUnstable() || hasWithScope()) {
2156             return findMegaMorphicSetMethod(desc, name);
2157         }
2158 
2159         final boolean explicitInstanceOfCheck = explicitInstanceOfCheck(desc, request);
2160 
2161         /*
2162          * If doing property set on a scope object, we should stop proto search on the first
2163          * non-scope object. Without this, for example, when assigning "toString" on global scope,
2164          * we'll end up assigning it on it's proto - which is Object.prototype.toString !!
2165          *
2166          * toString = function() { print("global toString"); } // don't affect Object.prototype.toString
2167          */
2168         FindProperty find = findProperty(name, true, this);
2169 
2170         // If it's not a scope search, then we don't want any inherited properties except those with user defined accessors.
2171         if (find != null && find.isInherited() && !(find.getProperty() instanceof UserAccessorProperty)) {
2172             // We should still check if inherited data property is not writable
2173             if (isExtensible() && !find.getProperty().isWritable()) {
2174                 return createEmptySetMethod(desc, explicitInstanceOfCheck, "property.not.writable", true);
2175             }
2176             // Otherwise, forget the found property unless this is a scope callsite and the owner is a scope object as well.
2177             if (!NashornCallSiteDescriptor.isScope(desc) || !find.getOwner().isScope()) {
2178                 find = null;
2179             }
2180         }
2181 
2182         if (find != null) {
2183             if (!find.getProperty().isWritable() && !NashornCallSiteDescriptor.isDeclaration(desc)) {
2184                 if (NashornCallSiteDescriptor.isScope(desc) && find.getProperty().isLexicalBinding()) {
2185                     throw typeError("assign.constant", name); // Overwriting ES6 const should throw also in non-strict mode.
2186                 }
2187                 // Existing, non-writable property
2188                 return createEmptySetMethod(desc, explicitInstanceOfCheck, "property.not.writable", true);
2189             }
2190         } else {
2191             if (!isExtensible()) {
2192                 return createEmptySetMethod(desc, explicitInstanceOfCheck, "object.non.extensible", false);
2193             }
2194         }
2195 
2196         final GuardedInvocation inv = new SetMethodCreator(this, find, desc, request).createGuardedInvocation(findBuiltinSwitchPoint(name));
2197 
2198         final GlobalConstants globalConstants = getGlobalConstants();
2199         if (globalConstants != null) {
2200             final GuardedInvocation cinv = globalConstants.findSetMethod(find, this, inv, desc, request);
2201             if (cinv != null) {
2202                 return cinv;
2203             }
2204         }
2205 
2206         return inv;
2207     }
2208 
2209     private GlobalConstants getGlobalConstants() {
2210         // Avoid hitting getContext() which might be costly for a non-Global unless needed.
2211         return GlobalConstants.GLOBAL_ONLY && !isGlobal() ? null : getContext().getGlobalConstants();
2212     }
2213 
2214     private GuardedInvocation createEmptySetMethod(final CallSiteDescriptor desc, final boolean explicitInstanceOfCheck, final String strictErrorMessage, final boolean canBeFastScope) {
2215         final String  name = desc.getNameToken(CallSiteDescriptor.NAME_OPERAND);
2216         if (NashornCallSiteDescriptor.isStrict(desc)) {
2217             throw typeError(strictErrorMessage, name, ScriptRuntime.safeToString(this));
2218         }
2219         assert canBeFastScope || !NashornCallSiteDescriptor.isFastScope(desc);
2220         return new GuardedInvocation(
2221                 Lookup.EMPTY_SETTER,
2222                 NashornGuards.getMapGuard(getMap(), explicitInstanceOfCheck),
2223                 getProtoSwitchPoint(name, null),
2224                 explicitInstanceOfCheck ? null : ClassCastException.class);
2225     }
2226 
2227     @SuppressWarnings("unused")
2228     private boolean extensionCheck(final boolean isStrict, final String name) {
2229         if (isExtensible()) {
2230             return true; //go on and do the set. this is our guard
2231         } else if (isStrict) {
2232             //throw an error for attempting to do the set in strict mode
2233             throw typeError("object.non.extensible", name, ScriptRuntime.safeToString(this));
2234         } else {
2235             //not extensible, non strict - this is a nop
2236             return false;
2237         }
2238     }
2239 
2240     private GuardedInvocation findMegaMorphicSetMethod(final CallSiteDescriptor desc, final String name) {
2241         final MethodType        type = desc.getMethodType().insertParameterTypes(1, Object.class);
2242         //never bother with ClassCastExceptionGuard for megamorphic callsites
2243         final GuardedInvocation inv = findSetIndexMethod(getClass(), desc, false, type);
2244         return inv.replaceMethods(MH.insertArguments(inv.getInvocation(), 1, name), inv.getGuard());
2245     }
2246 
2247     @SuppressWarnings("unused")
2248     private static Object globalFilter(final Object object) {
2249         ScriptObject sobj = (ScriptObject) object;
2250         while (sobj != null && !(sobj instanceof Global)) {
2251             sobj = sobj.getProto();
2252         }
2253         return sobj;
2254     }
2255 
2256     /**
2257      * Lookup function for the set index method, available for subclasses as well, e.g. {@link NativeArray}
2258      * provides special quick accessor linkage for continuous arrays that are represented as Java arrays
2259      *
2260      * @param desc    call site descriptor
2261      * @param request link request
2262      *
2263      * @return GuardedInvocation to be invoked at call site.
2264      */
2265     protected GuardedInvocation findSetIndexMethod(final CallSiteDescriptor desc, final LinkRequest request) { // array, index, value
2266         return findSetIndexMethod(getClass(), desc, explicitInstanceOfCheck(desc, request), desc.getMethodType());
2267     }
2268 
2269     /**
2270      * Find the appropriate SETINDEX method for an invoke dynamic call.
2271      *
2272      * @param clazz the receiver class
2273      * @param desc  the call site descriptor
2274      * @param explicitInstanceOfCheck add an explicit instanceof check?
2275      * @param callType the method type at the call site
2276      *
2277      * @return GuardedInvocation to be invoked at call site.
2278      */
2279     private static GuardedInvocation findSetIndexMethod(final Class<? extends ScriptObject> clazz, final CallSiteDescriptor desc, final boolean explicitInstanceOfCheck, final MethodType callType) {
2280         assert callType.parameterCount() == 3;
2281         final Class<?> keyClass   = callType.parameterType(1);
2282         final Class<?> valueClass = callType.parameterType(2);
2283 
2284         MethodHandle methodHandle = findOwnMH_V(clazz, "set", void.class, keyClass, valueClass, int.class);
2285         methodHandle = MH.insertArguments(methodHandle, 3, NashornCallSiteDescriptor.getFlags(desc));
2286 
2287         return new GuardedInvocation(methodHandle, getScriptObjectGuard(callType, explicitInstanceOfCheck), (SwitchPoint)null, explicitInstanceOfCheck ? null : ClassCastException.class);
2288     }
2289 
2290     /**
2291      * Fall back if a function property is not found.
2292      * @param desc The call site descriptor
2293      * @param request the link request
2294      * @return GuardedInvocation to be invoked at call site.
2295      */
2296     public GuardedInvocation noSuchMethod(final CallSiteDescriptor desc, final LinkRequest request) {
2297         final String       name      = desc.getNameToken(2);
2298         final FindProperty find      = findProperty(NO_SUCH_METHOD_NAME, true);
2299         final boolean      scopeCall = isScope() && NashornCallSiteDescriptor.isScope(desc);
2300 
2301         if (find == null) {
2302             return noSuchProperty(desc, request);
2303         }
2304 
2305         final boolean explicitInstanceOfCheck = explicitInstanceOfCheck(desc, request);
2306 
2307         final Object value = find.getObjectValue();
2308         if (!(value instanceof ScriptFunction)) {
2309             return createEmptyGetter(desc, explicitInstanceOfCheck, name);
2310         }
2311 
2312         final ScriptFunction func = (ScriptFunction)value;
2313         final Object         thiz = scopeCall && func.isStrict() ? UNDEFINED : this;
2314         // TODO: It'd be awesome if we could bind "name" without binding "this".
2315         // Since we're binding this we must use an identity guard here.
2316         return new GuardedInvocation(
2317                 MH.dropArguments(
2318                         MH.constant(
2319                                 ScriptFunction.class,
2320                                 func.createBound(thiz, new Object[] { name })),
2321                         0,
2322                         Object.class),
2323                 NashornGuards.combineGuards(
2324                         NashornGuards.getIdentityGuard(this),
2325                         NashornGuards.getMapGuard(getMap(), true)));
2326     }
2327 
2328     /**
2329      * Fall back if a property is not found.
2330      * @param desc the call site descriptor.
2331      * @param request the link request
2332      * @return GuardedInvocation to be invoked at call site.
2333      */
2334     public GuardedInvocation noSuchProperty(final CallSiteDescriptor desc, final LinkRequest request) {
2335         final String       name        = desc.getNameToken(CallSiteDescriptor.NAME_OPERAND);
2336         final FindProperty find        = findProperty(NO_SUCH_PROPERTY_NAME, true);
2337         final boolean      scopeAccess = isScope() && NashornCallSiteDescriptor.isScope(desc);
2338 
2339         if (find != null) {
2340             final Object   value = find.getObjectValue();
2341             ScriptFunction func  = null;
2342             MethodHandle   mh    = null;
2343 
2344             if (value instanceof ScriptFunction) {
2345                 func = (ScriptFunction)value;
2346                 mh   = getCallMethodHandle(func, desc.getMethodType(), name);
2347             }
2348 
2349             if (mh != null) {
2350                 assert func != null;
2351                 if (scopeAccess && func.isStrict()) {
2352                     mh = bindTo(mh, UNDEFINED);
2353                 }
2354 
2355                 return new GuardedInvocation(
2356                         mh,
2357                         find.isSelf()?
2358                             getKnownFunctionPropertyGuardSelf(
2359                                 getMap(),
2360                                 find.getGetter(Object.class, INVALID_PROGRAM_POINT, request),
2361                                 func)
2362                             :
2363                             //TODO this always does a scriptobject check
2364                             getKnownFunctionPropertyGuardProto(
2365                                 getMap(),
2366                                 find.getGetter(Object.class, INVALID_PROGRAM_POINT, request),
2367                                 find.getProtoChainLength(),
2368                                 func),
2369                         getProtoSwitchPoint(NO_SUCH_PROPERTY_NAME, find.getOwner()),
2370                         //TODO this doesn't need a ClassCastException as guard always checks script object
2371                         null);
2372             }
2373         }
2374 
2375         if (scopeAccess) {
2376             throw referenceError("not.defined", name);
2377         }
2378 
2379         return createEmptyGetter(desc, explicitInstanceOfCheck(desc, request), name);
2380     }
2381 
2382     /**
2383      * Invoke fall back if a property is not found.
2384      * @param name Name of property.
2385      * @param programPoint program point
2386      * @return Result from call.
2387      */
2388     protected Object invokeNoSuchProperty(final String name, final int programPoint) {
2389         final FindProperty find = findProperty(NO_SUCH_PROPERTY_NAME, true);
2390 
2391         Object ret = UNDEFINED;
2392 
2393         if (find != null) {
2394             final Object func = find.getObjectValue();
2395 
2396             if (func instanceof ScriptFunction) {
2397                 ret = ScriptRuntime.apply((ScriptFunction)func, this, name);
2398             }
2399         }
2400 
2401         if (isValid(programPoint)) {
2402             throw new UnwarrantedOptimismException(ret, programPoint);
2403         }
2404 
2405         return ret;
2406     }
2407 
2408 
2409     /**
2410      * Get __noSuchMethod__ as a function bound to this object and {@code name} if it is defined.
2411      * @param name the method name
2412      * @return the bound function, or undefined
2413      */
2414     private Object getNoSuchMethod(final String name, final int programPoint) {
2415         final FindProperty find = findProperty(NO_SUCH_METHOD_NAME, true);
2416 
2417         if (find == null) {
2418             return invokeNoSuchProperty(name, programPoint);
2419         }
2420 
2421         final Object value = find.getObjectValue();
2422         if (!(value instanceof ScriptFunction)) {
2423             return UNDEFINED;
2424         }
2425 
2426         return ((ScriptFunction)value).createBound(this, new Object[] {name});
2427     }
2428 
2429     private GuardedInvocation createEmptyGetter(final CallSiteDescriptor desc, final boolean explicitInstanceOfCheck, final String name) {
2430         if (NashornCallSiteDescriptor.isOptimistic(desc)) {
2431             throw new UnwarrantedOptimismException(UNDEFINED, NashornCallSiteDescriptor.getProgramPoint(desc), Type.OBJECT);
2432         }
2433 
2434         return new GuardedInvocation(Lookup.emptyGetter(desc.getMethodType().returnType()),
2435                 NashornGuards.getMapGuard(getMap(), explicitInstanceOfCheck), getProtoSwitchPoint(name, null),
2436                 explicitInstanceOfCheck ? null : ClassCastException.class);
2437     }
2438 
2439     private abstract static class ScriptObjectIterator <T extends Object> implements Iterator<T> {
2440         protected T[] values;
2441         protected final ScriptObject object;
2442         private int index;
2443 
2444         ScriptObjectIterator(final ScriptObject object) {
2445             this.object = object;
2446         }
2447 
2448         protected abstract void init();
2449 
2450         @Override
2451         public boolean hasNext() {
2452             if (values == null) {
2453                 init();
2454             }
2455             return index < values.length;
2456         }
2457 
2458         @Override
2459         public T next() {
2460             if (values == null) {
2461                 init();
2462             }
2463             return values[index++];
2464         }
2465 
2466         @Override
2467         public void remove() {
2468             throw new UnsupportedOperationException("remove");
2469         }
2470     }
2471 
2472     private static class KeyIterator extends ScriptObjectIterator<String> {
2473         KeyIterator(final ScriptObject object) {
2474             super(object);
2475         }
2476 
2477         @Override
2478         protected void init() {
2479             final Set<String> keys = new LinkedHashSet<>();
2480             final Set<String> nonEnumerable = new HashSet<>();
2481             for (ScriptObject self = object; self != null; self = self.getProto()) {
2482                 keys.addAll(Arrays.asList(self.getOwnKeys(false, nonEnumerable)));
2483             }
2484             this.values = keys.toArray(new String[keys.size()]);
2485         }
2486     }
2487 
2488     private static class ValueIterator extends ScriptObjectIterator<Object> {
2489         ValueIterator(final ScriptObject object) {
2490             super(object);
2491         }
2492 
2493         @Override
2494         protected void init() {
2495             final ArrayList<Object> valueList = new ArrayList<>();
2496             final Set<String> nonEnumerable = new HashSet<>();
2497             for (ScriptObject self = object; self != null; self = self.getProto()) {
2498                 for (final String key : self.getOwnKeys(false, nonEnumerable)) {
2499                     valueList.add(self.get(key));
2500                 }
2501             }
2502             this.values = valueList.toArray(new Object[valueList.size()]);
2503         }
2504     }
2505 
2506     /**
2507      * Add a spill property for the given key.
2508      * @param key    Property key.
2509      * @param flags  Property flags.
2510      * @return Added property.
2511      */
2512     private Property addSpillProperty(final String key, final int flags, final Object value, final boolean hasInitialValue) {
2513         final PropertyMap propertyMap = getMap();
2514         final int fieldSlot  = propertyMap.getFreeFieldSlot();
2515         final int propertyFlags = flags | (useDualFields() ? Property.DUAL_FIELDS : 0);
2516 
2517         Property property;
2518         if (fieldSlot > -1) {
2519             property = hasInitialValue ?
2520                 new AccessorProperty(key, propertyFlags, fieldSlot, this, value) :
2521                 new AccessorProperty(key, propertyFlags, getClass(), fieldSlot);
2522             property = addOwnProperty(property);
2523         } else {
2524             final int spillSlot = propertyMap.getFreeSpillSlot();
2525             property = hasInitialValue ?
2526                 new SpillProperty(key, propertyFlags, spillSlot, this, value) :
2527                 new SpillProperty(key, propertyFlags, spillSlot);
2528             property = addOwnProperty(property);
2529             ensureSpillSize(property.getSlot());
2530         }
2531         return property;
2532     }
2533 
2534     /**
2535      * Add a spill entry for the given key.
2536      * @param key Property key.
2537      * @return Setter method handle.
2538      */
2539     MethodHandle addSpill(final Class<?> type, final String key) {
2540         return addSpillProperty(key, 0, null, false).getSetter(type, getMap());
2541     }
2542 
2543     /**
2544      * Make sure arguments are paired correctly, with respect to more parameters than declared,
2545      * fewer parameters than declared and other things that JavaScript allows. This might involve
2546      * creating collectors.
2547      *
2548      * @param methodHandle method handle for invoke
2549      * @param callType     type of the call
2550      *
2551      * @return method handle with adjusted arguments
2552      */
2553     protected static MethodHandle pairArguments(final MethodHandle methodHandle, final MethodType callType) {
2554         return pairArguments(methodHandle, callType, null);
2555     }
2556 
2557     /**
2558      * Make sure arguments are paired correctly, with respect to more parameters than declared,
2559      * fewer parameters than declared and other things that JavaScript allows. This might involve
2560      * creating collectors.
2561      *
2562      * Make sure arguments are paired correctly.
2563      * @param methodHandle MethodHandle to adjust.
2564      * @param callType     MethodType of the call site.
2565      * @param callerVarArg true if the caller is vararg, false otherwise, null if it should be inferred from the
2566      * {@code callType}; basically, if the last parameter type of the call site is an array, it'll be considered a
2567      * variable arity call site. These are ordinarily rare; Nashorn code generator creates variable arity call sites
2568      * when the call has more than {@link LinkerCallSite#ARGLIMIT} parameters.
2569      *
2570      * @return method handle with adjusted arguments
2571      */
2572     public static MethodHandle pairArguments(final MethodHandle methodHandle, final MethodType callType, final Boolean callerVarArg) {
2573         final MethodType methodType = methodHandle.type();
2574         if (methodType.equals(callType.changeReturnType(methodType.returnType()))) {
2575             return methodHandle;
2576         }
2577 
2578         final int parameterCount = methodType.parameterCount();
2579         final int callCount      = callType.parameterCount();
2580 
2581         final boolean isCalleeVarArg = parameterCount > 0 && methodType.parameterType(parameterCount - 1).isArray();
2582         final boolean isCallerVarArg = callerVarArg != null ? callerVarArg : callCount > 0 &&
2583                 callType.parameterType(callCount - 1).isArray();
2584 
2585         if (isCalleeVarArg) {
2586             return isCallerVarArg ?
2587                 methodHandle :
2588                 MH.asCollector(methodHandle, Object[].class, callCount - parameterCount + 1);
2589         }
2590 
2591         if (isCallerVarArg) {
2592             return adaptHandleToVarArgCallSite(methodHandle, callCount);
2593         }
2594 
2595         if (callCount < parameterCount) {
2596             final int      missingArgs = parameterCount - callCount;
2597             final Object[] fillers     = new Object[missingArgs];
2598 
2599             Arrays.fill(fillers, UNDEFINED);
2600 
2601             if (isCalleeVarArg) {
2602                 fillers[missingArgs - 1] = ScriptRuntime.EMPTY_ARRAY;
2603             }
2604 
2605             return MH.insertArguments(
2606                 methodHandle,
2607                 parameterCount - missingArgs,
2608                 fillers);
2609         }
2610 
2611         if (callCount > parameterCount) {
2612             final int discardedArgs = callCount - parameterCount;
2613 
2614             final Class<?>[] discards = new Class<?>[discardedArgs];
2615             Arrays.fill(discards, Object.class);
2616 
2617             return MH.dropArguments(methodHandle, callCount - discardedArgs, discards);
2618         }
2619 
2620         return methodHandle;
2621     }
2622 
2623     static MethodHandle adaptHandleToVarArgCallSite(final MethodHandle mh, final int callSiteParamCount) {
2624         final int spreadArgs = mh.type().parameterCount() - callSiteParamCount + 1;
2625         return MH.filterArguments(
2626             MH.asSpreader(
2627                 mh,
2628                 Object[].class,
2629                 spreadArgs),
2630             callSiteParamCount - 1,
2631             MH.insertArguments(
2632                 TRUNCATINGFILTER,
2633                 0,
2634                 spreadArgs)
2635             );
2636     }
2637 
2638     @SuppressWarnings("unused")
2639     private static Object[] truncatingFilter(final int n, final Object[] array) {
2640         final int length = array == null ? 0 : array.length;
2641         if (n == length) {
2642             return array == null ? ScriptRuntime.EMPTY_ARRAY : array;
2643         }
2644 
2645         final Object[] newArray = new Object[n];
2646 
2647         if (array != null) {
2648             System.arraycopy(array, 0, newArray, 0, Math.min(n, length));
2649         }
2650 
2651         if (length < n) {
2652             final Object fill = UNDEFINED;
2653 
2654             for (int i = length; i < n; i++) {
2655                 newArray[i] = fill;
2656             }
2657         }
2658 
2659         return newArray;
2660     }
2661 
2662     /**
2663       * Numeric length setter for length property
2664       *
2665       * @param newLength new length to set
2666       */
2667     public final void setLength(final long newLength) {
2668         ArrayData data = getArray();
2669         final long arrayLength = data.length();
2670         if (newLength == arrayLength) {
2671             return;
2672         }
2673 
2674         if (newLength > arrayLength) {
2675             data = data.ensure(newLength - 1);
2676             if (data.canDelete(arrayLength, newLength - 1, false)) {
2677                data = data.delete(arrayLength, newLength - 1);
2678             }
2679             setArray(data);
2680             return;
2681         }
2682 
2683         if (newLength < arrayLength) {
2684            long actualLength = newLength;
2685 
2686            // Check for numeric keys in property map and delete them or adjust length, depending on whether
2687            // they're defined as configurable. See ES5 #15.4.5.2
2688            if (getMap().containsArrayKeys()) {
2689 
2690                for (long l = arrayLength - 1; l >= newLength; l--) {
2691                    final FindProperty find = findProperty(JSType.toString(l), false);
2692 
2693                    if (find != null) {
2694 
2695                        if (find.getProperty().isConfigurable()) {
2696                            deleteOwnProperty(find.getProperty());
2697                        } else {
2698                            actualLength = l + 1;
2699                            break;
2700                        }
2701                    }
2702                }
2703            }
2704 
2705            setArray(data.shrink(actualLength));
2706            data.setLength(actualLength);
2707        }
2708     }
2709 
2710     private int getInt(final int index, final String key, final int programPoint) {
2711         if (isValidArrayIndex(index)) {
2712             for (ScriptObject object = this; ; ) {
2713                 if (object.getMap().containsArrayKeys()) {
2714                     final FindProperty find = object.findProperty(key, false, this);
2715 
2716                     if (find != null) {
2717                         return getIntValue(find, programPoint);
2718                     }
2719                 }
2720 
2721                 if ((object = object.getProto()) == null) {
2722                     break;
2723                 }
2724 
2725                 final ArrayData array = object.getArray();
2726 
2727                 if (array.has(index)) {
2728                     return isValid(programPoint) ?
2729                         array.getIntOptimistic(index, programPoint) :
2730                         array.getInt(index);
2731                 }
2732             }
2733         } else {
2734             final FindProperty find = findProperty(key, true);
2735 
2736             if (find != null) {
2737                 return getIntValue(find, programPoint);
2738             }
2739         }
2740 
2741         return JSType.toInt32(invokeNoSuchProperty(key, programPoint));
2742     }
2743 
2744     @Override
2745     public int getInt(final Object key, final int programPoint) {
2746         final Object    primitiveKey = JSType.toPrimitive(key, String.class);
2747         final int       index        = getArrayIndex(primitiveKey);
2748         final ArrayData array        = getArray();
2749 
2750         if (array.has(index)) {
2751             return isValid(programPoint) ? array.getIntOptimistic(index, programPoint) : array.getInt(index);
2752         }
2753 
2754         return getInt(index, JSType.toString(primitiveKey), programPoint);
2755     }
2756 
2757     @Override
2758     public int getInt(final double key, final int programPoint) {
2759         final int       index = getArrayIndex(key);
2760         final ArrayData array = getArray();
2761 
2762         if (array.has(index)) {
2763             return isValid(programPoint) ? array.getIntOptimistic(index, programPoint) : array.getInt(index);
2764         }
2765 
2766         return getInt(index, JSType.toString(key), programPoint);
2767     }
2768 
2769     @Override
2770     public int getInt(final long key, final int programPoint) {
2771         final int       index = getArrayIndex(key);
2772         final ArrayData array = getArray();
2773 
2774         if (array.has(index)) {
2775             return isValid(programPoint) ? array.getIntOptimistic(index, programPoint) : array.getInt(index);
2776         }
2777 
2778         return getInt(index, JSType.toString(key), programPoint);
2779     }
2780 
2781     @Override
2782     public int getInt(final int key, final int programPoint) {
2783         final int       index = getArrayIndex(key);
2784         final ArrayData array = getArray();
2785 
2786         if (array.has(index)) {
2787             return isValid(programPoint) ? array.getIntOptimistic(key, programPoint) : array.getInt(key);
2788         }
2789 
2790         return getInt(index, JSType.toString(key), programPoint);
2791     }
2792 
2793     private long getLong(final int index, final String key, final int programPoint) {
2794         if (isValidArrayIndex(index)) {
2795             for (ScriptObject object = this; ; ) {
2796                 if (object.getMap().containsArrayKeys()) {
2797                     final FindProperty find = object.findProperty(key, false, this);
2798                     if (find != null) {
2799                         return getLongValue(find, programPoint);
2800                     }
2801                 }
2802 
2803                 if ((object = object.getProto()) == null) {
2804                     break;
2805                 }
2806 
2807                 final ArrayData array = object.getArray();
2808 
2809                 if (array.has(index)) {
2810                     return isValid(programPoint) ?
2811                         array.getLongOptimistic(index, programPoint) :
2812                         array.getLong(index);
2813                 }
2814             }
2815         } else {
2816             final FindProperty find = findProperty(key, true);
2817 
2818             if (find != null) {
2819                 return getLongValue(find, programPoint);
2820             }
2821         }
2822 
2823         return JSType.toLong(invokeNoSuchProperty(key, programPoint));
2824     }
2825 
2826     @Override
2827     public long getLong(final Object key, final int programPoint) {
2828         final Object    primitiveKey = JSType.toPrimitive(key, String.class);
2829         final int       index        = getArrayIndex(primitiveKey);
2830         final ArrayData array        = getArray();
2831 
2832         if (array.has(index)) {
2833             return isValid(programPoint) ? array.getLongOptimistic(index, programPoint) : array.getLong(index);
2834         }
2835 
2836         return getLong(index, JSType.toString(primitiveKey), programPoint);
2837     }
2838 
2839     @Override
2840     public long getLong(final double key, final int programPoint) {
2841         final int       index = getArrayIndex(key);
2842         final ArrayData array = getArray();
2843 
2844         if (array.has(index)) {
2845             return isValid(programPoint) ? array.getLongOptimistic(index, programPoint) : array.getLong(index);
2846         }
2847 
2848         return getLong(index, JSType.toString(key), programPoint);
2849     }
2850 
2851     @Override
2852     public long getLong(final long key, final int programPoint) {
2853         final int       index = getArrayIndex(key);
2854         final ArrayData array = getArray();
2855 
2856         if (array.has(index)) {
2857             return isValid(programPoint) ? array.getLongOptimistic(index, programPoint) : array.getLong(index);
2858         }
2859 
2860         return getLong(index, JSType.toString(key), programPoint);
2861     }
2862 
2863     @Override
2864     public long getLong(final int key, final int programPoint) {
2865         final int       index = getArrayIndex(key);
2866         final ArrayData array = getArray();
2867 
2868         if (array.has(index)) {
2869             return isValid(programPoint) ? array.getLongOptimistic(key, programPoint) : array.getLong(key);
2870         }
2871 
2872         return getLong(index, JSType.toString(key), programPoint);
2873     }
2874 
2875     private double getDouble(final int index, final String key, final int programPoint) {
2876         if (isValidArrayIndex(index)) {
2877             for (ScriptObject object = this; ; ) {
2878                 if (object.getMap().containsArrayKeys()) {
2879                     final FindProperty find = object.findProperty(key, false, this);
2880                     if (find != null) {
2881                         return getDoubleValue(find, programPoint);
2882                     }
2883                 }
2884 
2885                 if ((object = object.getProto()) == null) {
2886                     break;
2887                 }
2888 
2889                 final ArrayData array = object.getArray();
2890 
2891                 if (array.has(index)) {
2892                     return isValid(programPoint) ?
2893                         array.getDoubleOptimistic(index, programPoint) :
2894                         array.getDouble(index);
2895                 }
2896             }
2897         } else {
2898             final FindProperty find = findProperty(key, true);
2899 
2900             if (find != null) {
2901                 return getDoubleValue(find, programPoint);
2902             }
2903         }
2904 
2905         return JSType.toNumber(invokeNoSuchProperty(key, INVALID_PROGRAM_POINT));
2906     }
2907 
2908     @Override
2909     public double getDouble(final Object key, final int programPoint) {
2910         final Object    primitiveKey = JSType.toPrimitive(key, String.class);
2911         final int       index        = getArrayIndex(primitiveKey);
2912         final ArrayData array        = getArray();
2913 
2914         if (array.has(index)) {
2915             return isValid(programPoint) ? array.getDoubleOptimistic(index, programPoint) : array.getDouble(index);
2916         }
2917 
2918         return getDouble(index, JSType.toString(primitiveKey), programPoint);
2919     }
2920 
2921     @Override
2922     public double getDouble(final double key, final int programPoint) {
2923         final int       index = getArrayIndex(key);
2924         final ArrayData array = getArray();
2925 
2926         if (array.has(index)) {
2927             return isValid(programPoint) ? array.getDoubleOptimistic(index, programPoint) : array.getDouble(index);
2928         }
2929 
2930         return getDouble(index, JSType.toString(key), programPoint);
2931     }
2932 
2933     @Override
2934     public double getDouble(final long key, final int programPoint) {
2935         final int       index = getArrayIndex(key);
2936         final ArrayData array = getArray();
2937 
2938         if (array.has(index)) {
2939             return isValid(programPoint) ? array.getDoubleOptimistic(index, programPoint) : array.getDouble(index);
2940         }
2941 
2942         return getDouble(index, JSType.toString(key), programPoint);
2943     }
2944 
2945     @Override
2946     public double getDouble(final int key, final int programPoint) {
2947         final int       index = getArrayIndex(key);
2948         final ArrayData array = getArray();
2949 
2950         if (array.has(index)) {
2951             return isValid(programPoint) ? array.getDoubleOptimistic(key, programPoint) : array.getDouble(key);
2952         }
2953 
2954         return getDouble(index, JSType.toString(key), programPoint);
2955     }
2956 
2957     private Object get(final int index, final String key) {
2958         if (isValidArrayIndex(index)) {
2959             for (ScriptObject object = this; ; ) {
2960                 if (object.getMap().containsArrayKeys()) {
2961                     final FindProperty find = object.findProperty(key, false, this);
2962 
2963                     if (find != null) {
2964                         return find.getObjectValue();
2965                     }
2966                 }
2967 
2968                 if ((object = object.getProto()) == null) {
2969                     break;
2970                 }
2971 
2972                 final ArrayData array = object.getArray();
2973 
2974                 if (array.has(index)) {
2975                     return array.getObject(index);
2976                 }
2977             }
2978         } else {
2979             final FindProperty find = findProperty(key, true);
2980 
2981             if (find != null) {
2982                 return find.getObjectValue();
2983             }
2984         }
2985 
2986         return invokeNoSuchProperty(key, INVALID_PROGRAM_POINT);
2987     }
2988 
2989     @Override
2990     public Object get(final Object key) {
2991         final Object    primitiveKey = JSType.toPrimitive(key, String.class);
2992         final int       index        = getArrayIndex(primitiveKey);
2993         final ArrayData array        = getArray();
2994 
2995         if (array.has(index)) {
2996             return array.getObject(index);
2997         }
2998 
2999         return get(index, JSType.toString(primitiveKey));
3000     }
3001 
3002     @Override
3003     public Object get(final double key) {
3004         final int index = getArrayIndex(key);
3005         final ArrayData array = getArray();
3006 
3007         if (array.has(index)) {
3008             return array.getObject(index);
3009         }
3010 
3011         return get(index, JSType.toString(key));
3012     }
3013 
3014     @Override
3015     public Object get(final long key) {
3016         final int index = getArrayIndex(key);
3017         final ArrayData array = getArray();
3018 
3019         if (array.has(index)) {
3020             return array.getObject(index);
3021         }
3022 
3023         return get(index, JSType.toString(key));
3024     }
3025 
3026     @Override
3027     public Object get(final int key) {
3028         final int index = getArrayIndex(key);
3029         final ArrayData array = getArray();
3030 
3031         if (array.has(index)) {
3032             return array.getObject(index);
3033         }
3034 
3035         return get(index, JSType.toString(key));
3036     }
3037 
3038     private boolean doesNotHaveCheckArrayKeys(final long longIndex, final int value, final int callSiteFlags) {
3039         if (getMap().containsArrayKeys()) {
3040             final String       key  = JSType.toString(longIndex);
3041             final FindProperty find = findProperty(key, true);
3042             if (find != null) {
3043                 setObject(find, callSiteFlags, key, value);
3044                 return true;
3045             }
3046         }
3047         return false;
3048     }
3049 
3050     private boolean doesNotHaveCheckArrayKeys(final long longIndex, final long value, final int callSiteFlags) {
3051         if (getMap().containsArrayKeys()) {
3052             final String       key  = JSType.toString(longIndex);
3053             final FindProperty find = findProperty(key, true);
3054             if (find != null) {
3055                 setObject(find, callSiteFlags, key, value);
3056                 return true;
3057             }
3058         }
3059         return false;
3060     }
3061 
3062     private boolean doesNotHaveCheckArrayKeys(final long longIndex, final double value, final int callSiteFlags) {
3063          if (getMap().containsArrayKeys()) {
3064             final String       key  = JSType.toString(longIndex);
3065             final FindProperty find = findProperty(key, true);
3066             if (find != null) {
3067                 setObject(find, callSiteFlags, key, value);
3068                 return true;
3069             }
3070         }
3071         return false;
3072     }
3073 
3074     private boolean doesNotHaveCheckArrayKeys(final long longIndex, final Object value, final int callSiteFlags) {
3075         if (getMap().containsArrayKeys()) {
3076             final String       key  = JSType.toString(longIndex);
3077             final FindProperty find = findProperty(key, true);
3078             if (find != null) {
3079                 setObject(find, callSiteFlags, key, value);
3080                 return true;
3081             }
3082         }
3083         return false;
3084     }
3085 
3086     //value agnostic
3087     private boolean doesNotHaveEnsureLength(final long longIndex, final long oldLength, final int callSiteFlags) {
3088         if (longIndex >= oldLength) {
3089             if (!isExtensible()) {
3090                 if (isStrictFlag(callSiteFlags)) {
3091                     throw typeError("object.non.extensible", JSType.toString(longIndex), ScriptRuntime.safeToString(this));
3092                 }
3093                 return true;
3094             }
3095             setArray(getArray().ensure(longIndex));
3096         }
3097         return false;
3098     }
3099 
3100     private void doesNotHaveEnsureDelete(final long longIndex, final long oldLength, final boolean strict) {
3101         if (longIndex > oldLength) {
3102             ArrayData array = getArray();
3103             if (array.canDelete(oldLength, longIndex - 1, strict)) {
3104                 array = array.delete(oldLength, longIndex - 1);
3105             }
3106             setArray(array);
3107         }
3108     }
3109 
3110     private void doesNotHave(final int index, final int value, final int callSiteFlags) {
3111         final long oldLength = getArray().length();
3112         final long longIndex = ArrayIndex.toLongIndex(index);
3113         if (!doesNotHaveCheckArrayKeys(longIndex, value, callSiteFlags) && !doesNotHaveEnsureLength(longIndex, oldLength, callSiteFlags)) {
3114             final boolean strict = isStrictFlag(callSiteFlags);
3115             setArray(getArray().set(index, value, strict));
3116             doesNotHaveEnsureDelete(longIndex, oldLength, strict);
3117         }
3118     }
3119 
3120     private void doesNotHave(final int index, final long value, final int callSiteFlags) {
3121         final long oldLength = getArray().length();
3122         final long longIndex = ArrayIndex.toLongIndex(index);
3123         if (!doesNotHaveCheckArrayKeys(longIndex, value, callSiteFlags) && !doesNotHaveEnsureLength(longIndex, oldLength, callSiteFlags)) {
3124             final boolean strict = isStrictFlag(callSiteFlags);
3125             setArray(getArray().set(index, value, strict));
3126             doesNotHaveEnsureDelete(longIndex, oldLength, strict);
3127         }
3128     }
3129 
3130     private void doesNotHave(final int index, final double value, final int callSiteFlags) {
3131         final long oldLength = getArray().length();
3132         final long longIndex = ArrayIndex.toLongIndex(index);
3133         if (!doesNotHaveCheckArrayKeys(longIndex, value, callSiteFlags) && !doesNotHaveEnsureLength(longIndex, oldLength, callSiteFlags)) {
3134             final boolean strict = isStrictFlag(callSiteFlags);
3135             setArray(getArray().set(index, value, strict));
3136             doesNotHaveEnsureDelete(longIndex, oldLength, strict);
3137         }
3138     }
3139 
3140     private void doesNotHave(final int index, final Object value, final int callSiteFlags) {
3141         final long oldLength = getArray().length();
3142         final long longIndex = ArrayIndex.toLongIndex(index);
3143         if (!doesNotHaveCheckArrayKeys(longIndex, value, callSiteFlags) && !doesNotHaveEnsureLength(longIndex, oldLength, callSiteFlags)) {
3144             final boolean strict = isStrictFlag(callSiteFlags);
3145             setArray(getArray().set(index, value, strict));
3146             doesNotHaveEnsureDelete(longIndex, oldLength, strict);
3147         }
3148     }
3149 
3150     /**
3151      * This is the most generic of all Object setters. Most of the others use this in some form.
3152      * TODO: should be further specialized
3153      *
3154      * @param find          found property
3155      * @param callSiteFlags callsite flags
3156      * @param key           property key
3157      * @param value         property value
3158      */
3159     public final void setObject(final FindProperty find, final int callSiteFlags, final String key, final Object value) {
3160         FindProperty f = find;
3161 
3162         invalidateGlobalConstant(key);
3163 
3164         if (f != null && f.isInherited() && !(f.getProperty() instanceof UserAccessorProperty)) {
3165             final boolean isScope = isScopeFlag(callSiteFlags);
3166             // If the start object of the find is not this object it means the property was found inside a
3167             // 'with' statement expression (see WithObject.findProperty()). In this case we forward the 'set'
3168             // to the 'with' object.
3169             // Note that although a 'set' operation involving a with statement follows scope rules outside
3170             // the 'with' expression (the 'set' operation is performed on the owning prototype if it exists),
3171             // it follows non-scope rules inside the 'with' expression (set is performed on the top level object).
3172             // This is why we clear the callsite flags and FindProperty in the forward call to the 'with' object.
3173             if (isScope && f.getSelf() != this) {
3174                 f.getSelf().setObject(null, 0, key, value);
3175                 return;
3176             }
3177             // Setting a property should not modify the property in prototype unless this is a scope callsite
3178             // and the owner is a scope object as well (with the exception of 'with' statement handled above).
3179             if (!isScope || !f.getOwner().isScope()) {
3180                 f = null;
3181             }
3182         }
3183 
3184         if (f != null) {
3185             if (!f.getProperty().isWritable()) {
3186                 if (isScopeFlag(callSiteFlags) && f.getProperty().isLexicalBinding()) {
3187                     throw typeError("assign.constant", key); // Overwriting ES6 const should throw also in non-strict mode.
3188                 }
3189                 if (isStrictFlag(callSiteFlags)) {
3190                     throw typeError("property.not.writable", key, ScriptRuntime.safeToString(this));
3191                 }
3192                 return;
3193             }
3194 
3195             f.setValue(value, isStrictFlag(callSiteFlags));
3196 
3197         } else if (!isExtensible()) {
3198             if (isStrictFlag(callSiteFlags)) {
3199                 throw typeError("object.non.extensible", key, ScriptRuntime.safeToString(this));
3200             }
3201         } else {
3202             ScriptObject sobj = this;
3203             // undefined scope properties are set in the global object.
3204             if (isScope()) {
3205                 while (sobj != null && !(sobj instanceof Global)) {
3206                     sobj = sobj.getProto();
3207                 }
3208                 assert sobj != null : "no parent global object in scope";
3209             }
3210             //this will unbox any Number object to its primitive type in case the
3211             //property supports primitive types, so it doesn't matter that it comes
3212             //in as an Object.
3213             sobj.addSpillProperty(key, 0, value, true);
3214         }
3215     }
3216 
3217     @Override
3218     public void set(final Object key, final int value, final int callSiteFlags) {
3219         final Object primitiveKey = JSType.toPrimitive(key, String.class);
3220         final int    index        = getArrayIndex(primitiveKey);
3221 
3222         if (isValidArrayIndex(index)) {
3223             final ArrayData data = getArray();
3224             if (data.has(index)) {
3225                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3226             } else {
3227                 doesNotHave(index, value, callSiteFlags);
3228             }
3229 
3230             return;
3231         }
3232 
3233         final String propName = JSType.toString(primitiveKey);
3234         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3235     }
3236 
3237     @Override
3238     public void set(final Object key, final long value, final int callSiteFlags) {
3239         final Object primitiveKey = JSType.toPrimitive(key, String.class);
3240         final int    index        = getArrayIndex(primitiveKey);
3241 
3242         if (isValidArrayIndex(index)) {
3243             final ArrayData data = getArray();
3244             if (data.has(index)) {
3245                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3246             } else {
3247                 doesNotHave(index, value, callSiteFlags);
3248             }
3249 
3250             return;
3251         }
3252 
3253         final String propName = JSType.toString(primitiveKey);
3254         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3255     }
3256 
3257     @Override
3258     public void set(final Object key, final double value, final int callSiteFlags) {
3259         final Object primitiveKey = JSType.toPrimitive(key, String.class);
3260         final int    index        = getArrayIndex(primitiveKey);
3261 
3262         if (isValidArrayIndex(index)) {
3263             final ArrayData data = getArray();
3264             if (data.has(index)) {
3265                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3266             } else {
3267                 doesNotHave(index, value, callSiteFlags);
3268             }
3269 
3270             return;
3271         }
3272 
3273         final String propName = JSType.toString(primitiveKey);
3274         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3275     }
3276 
3277     @Override
3278     public void set(final Object key, final Object value, final int callSiteFlags) {
3279         final Object primitiveKey = JSType.toPrimitive(key, String.class);
3280         final int    index        = getArrayIndex(primitiveKey);
3281 
3282         if (isValidArrayIndex(index)) {
3283             final ArrayData data = getArray();
3284             if (data.has(index)) {
3285                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3286             } else {
3287                 doesNotHave(index, value, callSiteFlags);
3288             }
3289 
3290             return;
3291         }
3292 
3293         final String propName = JSType.toString(primitiveKey);
3294         setObject(findProperty(propName, true), callSiteFlags, propName, value);
3295     }
3296 
3297     @Override
3298     public void set(final double key, final int value, final int callSiteFlags) {
3299         final int index = getArrayIndex(key);
3300 
3301         if (isValidArrayIndex(index)) {
3302             final ArrayData data = getArray();
3303             if (data.has(index)) {
3304                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3305             } else {
3306                 doesNotHave(index, value, callSiteFlags);
3307             }
3308 
3309             return;
3310         }
3311 
3312         final String propName = JSType.toString(key);
3313         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3314     }
3315 
3316     @Override
3317     public void set(final double key, final long value, final int callSiteFlags) {
3318         final int index = getArrayIndex(key);
3319 
3320         if (isValidArrayIndex(index)) {
3321             final ArrayData data = getArray();
3322             if (data.has(index)) {
3323                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3324             } else {
3325                 doesNotHave(index, value, callSiteFlags);
3326             }
3327 
3328             return;
3329         }
3330 
3331         final String propName = JSType.toString(key);
3332         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3333     }
3334 
3335     @Override
3336     public void set(final double key, final double value, final int callSiteFlags) {
3337         final int index = getArrayIndex(key);
3338 
3339         if (isValidArrayIndex(index)) {
3340             final ArrayData data = getArray();
3341             if (data.has(index)) {
3342                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3343             } else {
3344                 doesNotHave(index, value, callSiteFlags);
3345             }
3346 
3347             return;
3348         }
3349 
3350         final String propName = JSType.toString(key);
3351         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3352     }
3353 
3354     @Override
3355     public void set(final double key, final Object value, final int callSiteFlags) {
3356         final int index = getArrayIndex(key);
3357 
3358         if (isValidArrayIndex(index)) {
3359             final ArrayData data = getArray();
3360             if (data.has(index)) {
3361                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3362             } else {
3363                 doesNotHave(index, value, callSiteFlags);
3364             }
3365 
3366             return;
3367         }
3368 
3369         final String propName = JSType.toString(key);
3370         setObject(findProperty(propName, true), callSiteFlags, propName, value);
3371     }
3372 
3373     @Override
3374     public void set(final long key, final int value, final int callSiteFlags) {
3375         final int index = getArrayIndex(key);
3376 
3377         if (isValidArrayIndex(index)) {
3378             final ArrayData data = getArray();
3379             if (data.has(index)) {
3380                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3381             } else {
3382                 doesNotHave(index, value, callSiteFlags);
3383             }
3384 
3385             return;
3386         }
3387 
3388         final String propName = JSType.toString(key);
3389         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3390     }
3391 
3392     @Override
3393     public void set(final long key, final long value, final int callSiteFlags) {
3394         final int index = getArrayIndex(key);
3395 
3396         if (isValidArrayIndex(index)) {
3397             final ArrayData data = getArray();
3398             if (data.has(index)) {
3399                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3400             } else {
3401                 doesNotHave(index, value, callSiteFlags);
3402             }
3403 
3404             return;
3405         }
3406 
3407         final String propName = JSType.toString(key);
3408         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3409     }
3410 
3411     @Override
3412     public void set(final long key, final double value, final int callSiteFlags) {
3413         final int index = getArrayIndex(key);
3414 
3415         if (isValidArrayIndex(index)) {
3416             final ArrayData data = getArray();
3417             if (data.has(index)) {
3418                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3419             } else {
3420                 doesNotHave(index, value, callSiteFlags);
3421             }
3422 
3423             return;
3424         }
3425 
3426         final String propName = JSType.toString(key);
3427         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3428     }
3429 
3430     @Override
3431     public void set(final long key, final Object value, final int callSiteFlags) {
3432         final int index = getArrayIndex(key);
3433 
3434         if (isValidArrayIndex(index)) {
3435             final ArrayData data = getArray();
3436             if (data.has(index)) {
3437                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3438             } else {
3439                 doesNotHave(index, value, callSiteFlags);
3440             }
3441 
3442             return;
3443         }
3444 
3445         final String propName = JSType.toString(key);
3446         setObject(findProperty(propName, true), callSiteFlags, propName, value);
3447     }
3448 
3449     @Override
3450     public void set(final int key, final int value, final int callSiteFlags) {
3451         final int index = getArrayIndex(key);
3452         if (isValidArrayIndex(index)) {
3453             if (getArray().has(index)) {
3454                 final ArrayData data = getArray();
3455                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3456             } else {
3457                 doesNotHave(index, value, callSiteFlags);
3458             }
3459             return;
3460         }
3461 
3462         final String propName = JSType.toString(key);
3463         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3464     }
3465 
3466     @Override
3467     public void set(final int key, final long value, final int callSiteFlags) {
3468         final int index = getArrayIndex(key);
3469 
3470         if (isValidArrayIndex(index)) {
3471             final ArrayData data = getArray();
3472             if (data.has(index)) {
3473                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3474             } else {
3475                 doesNotHave(index, value, callSiteFlags);
3476             }
3477 
3478             return;
3479         }
3480 
3481         final String propName = JSType.toString(key);
3482         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3483     }
3484 
3485     @Override
3486     public void set(final int key, final double value, final int callSiteFlags) {
3487         final int index = getArrayIndex(key);
3488 
3489         if (isValidArrayIndex(index)) {
3490             final ArrayData data = getArray();
3491             if (data.has(index)) {
3492                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3493             } else {
3494                 doesNotHave(index, value, callSiteFlags);
3495             }
3496 
3497             return;
3498         }
3499 
3500         final String propName = JSType.toString(key);
3501         setObject(findProperty(propName, true), callSiteFlags, propName, JSType.toObject(value));
3502     }
3503 
3504     @Override
3505     public void set(final int key, final Object value, final int callSiteFlags) {
3506         final int index = getArrayIndex(key);
3507 
3508         if (isValidArrayIndex(index)) {
3509             final ArrayData data = getArray();
3510             if (data.has(index)) {
3511                 setArray(data.set(index, value, isStrictFlag(callSiteFlags)));
3512             } else {
3513                 doesNotHave(index, value, callSiteFlags);
3514             }
3515 
3516             return;
3517         }
3518 
3519         final String propName = JSType.toString(key);
3520         setObject(findProperty(propName, true), callSiteFlags, propName, value);
3521     }
3522 
3523     @Override
3524     public boolean has(final Object key) {
3525         final Object primitiveKey = JSType.toPrimitive(key);
3526         final int    index        = getArrayIndex(primitiveKey);
3527         return isValidArrayIndex(index) ? hasArrayProperty(index) : hasProperty(JSType.toString(primitiveKey), true);
3528     }
3529 
3530     @Override
3531     public boolean has(final double key) {
3532         final int index = getArrayIndex(key);
3533         return isValidArrayIndex(index) ? hasArrayProperty(index) : hasProperty(JSType.toString(key), true);
3534     }
3535 
3536     @Override
3537     public boolean has(final long key) {
3538         final int index = getArrayIndex(key);
3539         return isValidArrayIndex(index) ? hasArrayProperty(index) : hasProperty(JSType.toString(key), true);
3540     }
3541 
3542     @Override
3543     public boolean has(final int key) {
3544         final int index = getArrayIndex(key);
3545         return isValidArrayIndex(index) ? hasArrayProperty(index) : hasProperty(JSType.toString(key), true);
3546     }
3547 
3548     private boolean hasArrayProperty(final int index) {
3549         boolean hasArrayKeys = false;
3550 
3551         for (ScriptObject self = this; self != null; self = self.getProto()) {
3552             if (self.getArray().has(index)) {
3553                 return true;
3554             }
3555             hasArrayKeys = hasArrayKeys || self.getMap().containsArrayKeys();
3556         }
3557 
3558         return hasArrayKeys && hasProperty(ArrayIndex.toKey(index), true);
3559     }
3560 
3561     @Override
3562     public boolean hasOwnProperty(final Object key) {
3563         final Object primitiveKey = JSType.toPrimitive(key, String.class);
3564         final int    index        = getArrayIndex(primitiveKey);
3565         return isValidArrayIndex(index) ? hasOwnArrayProperty(index) : hasProperty(JSType.toString(primitiveKey), false);
3566     }
3567 
3568     @Override
3569     public boolean hasOwnProperty(final int key) {
3570         final int index = getArrayIndex(key);
3571         return isValidArrayIndex(index) ? hasOwnArrayProperty(index) : hasProperty(JSType.toString(key), false);
3572     }
3573 
3574     @Override
3575     public boolean hasOwnProperty(final long key) {
3576         final int index = getArrayIndex(key);
3577         return isValidArrayIndex(index) ? hasOwnArrayProperty(index) : hasProperty(JSType.toString(key), false);
3578     }
3579 
3580     @Override
3581     public boolean hasOwnProperty(final double key) {
3582         final int index = getArrayIndex(key);
3583         return isValidArrayIndex(index) ? hasOwnArrayProperty(index) : hasProperty(JSType.toString(key), false);
3584     }
3585 
3586     private boolean hasOwnArrayProperty(final int index) {
3587         return getArray().has(index) || getMap().containsArrayKeys() && hasProperty(ArrayIndex.toKey(index), false);
3588     }
3589 
3590     @Override
3591     public boolean delete(final int key, final boolean strict) {
3592         final int index = getArrayIndex(key);
3593         final ArrayData array = getArray();
3594 
3595         if (array.has(index)) {
3596             if (array.canDelete(index, strict)) {
3597                 setArray(array.delete(index));
3598                 return true;
3599             }
3600             return false;
3601         }
3602         return deleteObject(JSType.toObject(key), strict);
3603     }
3604 
3605     @Override
3606     public boolean delete(final long key, final boolean strict) {
3607         final int index = getArrayIndex(key);
3608         final ArrayData array = getArray();
3609 
3610         if (array.has(index)) {
3611             if (array.canDelete(index, strict)) {
3612                 setArray(array.delete(index));
3613                 return true;
3614             }
3615             return false;
3616         }
3617 
3618         return deleteObject(JSType.toObject(key), strict);
3619     }
3620 
3621     @Override
3622     public boolean delete(final double key, final boolean strict) {
3623         final int index = getArrayIndex(key);
3624         final ArrayData array = getArray();
3625 
3626         if (array.has(index)) {
3627             if (array.canDelete(index, strict)) {
3628                 setArray(array.delete(index));
3629                 return true;
3630             }
3631             return false;
3632         }
3633 
3634         return deleteObject(JSType.toObject(key), strict);
3635     }
3636 
3637     @Override
3638     public boolean delete(final Object key, final boolean strict) {
3639         final Object    primitiveKey = JSType.toPrimitive(key, String.class);
3640         final int       index        = getArrayIndex(primitiveKey);
3641         final ArrayData array        = getArray();
3642 
3643         if (array.has(index)) {
3644             if (array.canDelete(index, strict)) {
3645                 setArray(array.delete(index));
3646                 return true;
3647             }
3648             return false;
3649         }
3650 
3651         return deleteObject(primitiveKey, strict);
3652     }
3653 
3654     private boolean deleteObject(final Object key, final boolean strict) {
3655         final String propName = JSType.toString(key);
3656         final FindProperty find = findProperty(propName, false);
3657 
3658         if (find == null) {
3659             return true;
3660         }
3661 
3662         if (!find.getProperty().isConfigurable()) {
3663             if (strict) {
3664                 throw typeError("cant.delete.property", propName, ScriptRuntime.safeToString(this));
3665             }
3666             return false;
3667         }
3668 
3669         final Property prop = find.getProperty();
3670         deleteOwnProperty(prop);
3671 
3672         return true;
3673     }
3674 
3675     /**
3676      * Return a shallow copy of this ScriptObject.
3677      * @return a shallow copy.
3678      */
3679     public final ScriptObject copy() {
3680         try {
3681             return clone();
3682         } catch (final CloneNotSupportedException e) {
3683             throw new RuntimeException(e);
3684         }
3685     }
3686 
3687     @Override
3688     protected ScriptObject clone() throws CloneNotSupportedException {
3689         final ScriptObject clone = (ScriptObject) super.clone();
3690         if (objectSpill != null) {
3691             clone.objectSpill = objectSpill.clone();
3692             if (primitiveSpill != null) {
3693                 clone.primitiveSpill = primitiveSpill.clone();
3694             }
3695         }
3696         clone.arrayData = arrayData.copy();
3697         return clone;
3698     }
3699 
3700     /**
3701      * Make a new UserAccessorProperty property. getter and setter functions are stored in
3702      * this ScriptObject and slot values are used in property object.
3703      *
3704      * @param key the property name
3705      * @param propertyFlags attribute flags of the property
3706      * @param getter getter function for the property
3707      * @param setter setter function for the property
3708      * @return the newly created UserAccessorProperty
3709      */
3710     protected final UserAccessorProperty newUserAccessors(final String key, final int propertyFlags, final ScriptFunction getter, final ScriptFunction setter) {
3711         final UserAccessorProperty uc = getMap().newUserAccessors(key, propertyFlags);
3712         //property.getSetter(Object.class, getMap());
3713         uc.setAccessors(this, getMap(), new UserAccessorProperty.Accessors(getter, setter));
3714         return uc;
3715     }
3716 
3717     /**
3718      * Returns {@code true} if properties for this object should use dual field mode, {@code false} otherwise.
3719      * @return {@code true} if dual fields should be used.
3720      */
3721     protected boolean useDualFields() {
3722         return !StructureLoader.isSingleFieldStructure(getClass().getName());
3723     }
3724 
3725     Object ensureSpillSize(final int slot) {
3726         final int oldLength = objectSpill == null ? 0 : objectSpill.length;
3727         if (slot < oldLength) {
3728             return this;
3729         }
3730         final int newLength = alignUp(slot + 1, SPILL_RATE);
3731         final Object[] newObjectSpill    = new Object[newLength];
3732         final long[]   newPrimitiveSpill = useDualFields() ? new long[newLength] : null;
3733 
3734         if (objectSpill != null) {
3735             System.arraycopy(objectSpill, 0, newObjectSpill, 0, oldLength);
3736             if (primitiveSpill != null && newPrimitiveSpill != null) {
3737                 System.arraycopy(primitiveSpill, 0, newPrimitiveSpill, 0, oldLength);
3738             }
3739         }
3740 
3741         this.primitiveSpill = newPrimitiveSpill;
3742         this.objectSpill    = newObjectSpill;
3743 
3744         return this;
3745     }
3746 
3747     private static MethodHandle findOwnMH_V(final Class<? extends ScriptObject> clazz, final String name, final Class<?> rtype, final Class<?>... types) {
3748         // TODO: figure out how can it work for NativeArray$Prototype etc.
3749         return MH.findVirtual(MethodHandles.lookup(), ScriptObject.class, name, MH.type(rtype, types));
3750     }
3751 
3752     private static MethodHandle findOwnMH_V(final String name, final Class<?> rtype, final Class<?>... types) {
3753         return findOwnMH_V(ScriptObject.class, name, rtype, types);
3754     }
3755 
3756     private static MethodHandle findOwnMH_S(final String name, final Class<?> rtype, final Class<?>... types) {
3757         return MH.findStatic(MethodHandles.lookup(), ScriptObject.class, name, MH.type(rtype, types));
3758     }
3759 
3760     private static MethodHandle getKnownFunctionPropertyGuardSelf(final PropertyMap map, final MethodHandle getter, final ScriptFunction func) {
3761         return MH.insertArguments(KNOWNFUNCPROPGUARDSELF, 1, map, getter, func);
3762     }
3763 
3764     @SuppressWarnings("unused")
3765     private static boolean knownFunctionPropertyGuardSelf(final Object self, final PropertyMap map, final MethodHandle getter, final ScriptFunction func) {
3766         if (self instanceof ScriptObject && ((ScriptObject)self).getMap() == map) {
3767             try {
3768                 return getter.invokeExact(self) == func;
3769             } catch (final RuntimeException | Error e) {
3770                 throw e;
3771             } catch (final Throwable t) {
3772                 throw new RuntimeException(t);
3773             }
3774         }
3775 
3776         return false;
3777     }
3778 
3779     private static MethodHandle getKnownFunctionPropertyGuardProto(final PropertyMap map, final MethodHandle getter, final int depth, final ScriptFunction func) {
3780         return MH.insertArguments(KNOWNFUNCPROPGUARDPROTO, 1, map, getter, depth, func);
3781     }
3782 
3783     private static ScriptObject getProto(final ScriptObject self, final int depth) {
3784         ScriptObject proto = self;
3785         for (int d = 0; d < depth; d++) {
3786             proto = proto.getProto();
3787             if (proto == null) {
3788                 return null;
3789             }
3790         }
3791 
3792         return proto;
3793     }
3794 
3795     @SuppressWarnings("unused")
3796     private static boolean knownFunctionPropertyGuardProto(final Object self, final PropertyMap map, final MethodHandle getter, final int depth, final ScriptFunction func) {
3797         if (self instanceof ScriptObject && ((ScriptObject)self).getMap() == map) {
3798             final ScriptObject proto = getProto((ScriptObject)self, depth);
3799             if (proto == null) {
3800                 return false;
3801             }
3802             try {
3803                 return getter.invokeExact((Object)proto) == func;
3804             } catch (final RuntimeException | Error e) {
3805                 throw e;
3806             } catch (final Throwable t) {
3807                 throw new RuntimeException(t);
3808             }
3809         }
3810 
3811         return false;
3812     }
3813 
3814     /** This is updated only in debug mode - counts number of {@code ScriptObject} instances created */
3815     private static LongAdder count;
3816 
3817     static {
3818         if (Context.DEBUG) {
3819             count = new LongAdder();
3820         }
3821     }
3822     /**
3823      * Get number of {@code ScriptObject} instances created. If not running in debug
3824      * mode this is always 0
3825      *
3826      * @return number of ScriptObjects created
3827      */
3828     public static long getCount() {
3829         return count.longValue();
3830     }
3831 }