Bug 1716901 - Use GetBuiltinConstructor instead of bare self-hosting constructors. r=jandem

Instead of defining (slimmed-down) constructors on the instrinsics holder,
simply use the JSOp::BuiltinObject mechanism (which uses ProtoKey slots on the
GlobalObject). This reduces the initialization requirements on the self-hosted
global which simplifies removing it later. Using `BuiltinObject` instead of
`GetIntrinsic` loses BaselineInterpreter support but the cases here are
uncommon.

Differential Revision: https://phabricator.services.mozilla.com/D118106

js/src/builtin/Sorting.js

@@ -141,6 +141,7 @@ function RadixSort(array, len, buffer, nbytes, signed, floating, comparefn) {
                      : callFunction(CallTypedArrayMethodIfWrapped, array,
                                     "TypedArrayByteOffsetMethod");
 
+        let Int32Array = GetBuiltinConstructor("Int32Array");
         view = new Int32Array(buffer, offset, len);
 
         // Flip sign bit for positive numbers; flip all bits for negative

js/src/builtin/intl/CommonFunctions.js

@@ -697,6 +697,7 @@ var intlFallbackSymbolHolder = { value: undefined };
 function intlFallbackSymbol() {
     var fallbackSymbol = intlFallbackSymbolHolder.value;
     if (!fallbackSymbol) {
+        let Symbol = GetBuiltinConstructor("Symbol");
         fallbackSymbol = Symbol("IntlLegacyConstructedSymbol");
         intlFallbackSymbolHolder.value = fallbackSymbol;
     }

js/src/vm/BuiltinObjectKind.cpp

@@ -19,6 +19,8 @@ static JSProtoKey ToProtoKey(BuiltinObjectKind kind) {
       return JSProto_Array;
     case BuiltinObjectKind::ArrayBuffer:
       return JSProto_ArrayBuffer;
+    case BuiltinObjectKind::Int32Array:
+      return JSProto_Int32Array;
     case BuiltinObjectKind::Iterator:
       return JSProto_Iterator;
     case BuiltinObjectKind::Promise:
@@ -27,6 +29,8 @@ static JSProtoKey ToProtoKey(BuiltinObjectKind kind) {
       return JSProto_RegExp;
     case BuiltinObjectKind::SharedArrayBuffer:
       return JSProto_SharedArrayBuffer;
+    case BuiltinObjectKind::Symbol:
+      return JSProto_Symbol;
 
     case BuiltinObjectKind::FunctionPrototype:
       return JSProto_Function;
@@ -52,10 +56,12 @@ static bool IsPrototype(BuiltinObjectKind kind) {
   switch (kind) {
     case BuiltinObjectKind::Array:
     case BuiltinObjectKind::ArrayBuffer:
+    case BuiltinObjectKind::Int32Array:
     case BuiltinObjectKind::Iterator:
     case BuiltinObjectKind::Promise:
     case BuiltinObjectKind::RegExp:
     case BuiltinObjectKind::SharedArrayBuffer:
+    case BuiltinObjectKind::Symbol:
       return false;
 
     case BuiltinObjectKind::FunctionPrototype:
@@ -82,6 +88,9 @@ BuiltinObjectKind js::BuiltinConstructorForName(
   if (name == frontend::TaggedParserAtomIndex::WellKnown::ArrayBuffer()) {
     return BuiltinObjectKind::ArrayBuffer;
   }
+  if (name == frontend::TaggedParserAtomIndex::WellKnown::Int32Array()) {
+    return BuiltinObjectKind::Int32Array;
+  }
   if (name == frontend::TaggedParserAtomIndex::WellKnown::Iterator()) {
     return BuiltinObjectKind::Iterator;
   }
@@ -94,6 +103,9 @@ BuiltinObjectKind js::BuiltinConstructorForName(
   if (name == frontend::TaggedParserAtomIndex::WellKnown::SharedArrayBuffer()) {
     return BuiltinObjectKind::SharedArrayBuffer;
   }
+  if (name == frontend::TaggedParserAtomIndex::WellKnown::Symbol()) {
+    return BuiltinObjectKind::Symbol;
+  }
   return BuiltinObjectKind::None;
 }
 
@@ -143,6 +155,8 @@ const char* js::BuiltinObjectName(BuiltinObjectKind kind) {
       return "Array";
     case BuiltinObjectKind::ArrayBuffer:
       return "ArrayBuffer";
+    case BuiltinObjectKind::Int32Array:
+      return "Int32Array";
     case BuiltinObjectKind::Iterator:
       return "Iterator";
     case BuiltinObjectKind::Promise:
@@ -151,6 +165,8 @@ const char* js::BuiltinObjectName(BuiltinObjectKind kind) {
       return "RegExp";
     case BuiltinObjectKind::SharedArrayBuffer:
       return "SharedArrayBuffer";
+    case BuiltinObjectKind::Symbol:
+      return "Symbol";
 
     case BuiltinObjectKind::FunctionPrototype:
       return "Function.prototype";

js/src/vm/BuiltinObjectKind.h

@@ -29,10 +29,12 @@ enum class BuiltinObjectKind : uint8_t {
   // Built-in constructors.
   Array,
   ArrayBuffer,
+  Int32Array,
   Iterator,
   Promise,
   RegExp,
   SharedArrayBuffer,
+  Symbol,
 
   // Built-in prototypes.
   FunctionPrototype,

js/src/vm/GlobalObject.cpp

@@ -763,32 +763,6 @@ bool GlobalObject::initStandardClasses(JSContext* cx,
   return true;
 }
 
-/**
- * Initializes a builtin constructor and its prototype without defining any
- * properties or functions on it.
- *
- * Used in self-hosting to install the few builtin constructors required by
- * self-hosted builtins.
- */
-static bool InitBareBuiltinCtor(JSContext* cx, Handle<GlobalObject*> global,
-                                JSProtoKey protoKey) {
-  MOZ_ASSERT(cx->runtime()->isSelfHostingGlobal(global));
-  const JSClass* clasp = ProtoKeyToClass(protoKey);
-  RootedObject proto(cx);
-  proto = clasp->specCreatePrototypeHook()(cx, protoKey);
-  if (!proto) {
-    return false;
-  }
-
-  RootedObject ctor(cx, clasp->specCreateConstructorHook()(cx, protoKey));
-  if (!ctor) {
-    return false;
-  }
-
-  return GlobalObject::initBuiltinConstructor(cx, global, protoKey, ctor,
-                                              proto);
-}
-
 /**
  * The self-hosting global only gets a small subset of all standard classes.
  * Even those are only created as bare constructors without any properties
@@ -805,12 +779,7 @@ bool GlobalObject::initSelfHostingBuiltins(JSContext* cx,
     return false;
   }
 
-  return InitBareBuiltinCtor(cx, global, JSProto_Array) &&
-         InitBareBuiltinCtor(cx, global, JSProto_TypedArray) &&
-         InitBareBuiltinCtor(cx, global, JSProto_Uint8Array) &&
-         InitBareBuiltinCtor(cx, global, JSProto_Int32Array) &&
-         InitBareBuiltinCtor(cx, global, JSProto_Symbol) &&
-         DefineFunctions(cx, global, builtins, AsIntrinsic);
+  return DefineFunctions(cx, global, builtins, AsIntrinsic);
 }
 
 /* static */