[ES6] Implement ES6 arrow function syntax. Arrow function specific features. Lexical bind of this
https://bugs.webkit.org/show_bug.cgi?id=144956

Source/JavaScriptCore:

Patch by Aleksandr Skachkov <gskachkov@gmail.com> on 2015-08-17
Reviewed by Saam Barati.

Added support of ES6 arrow function specific feature, lexical bind of this and no constructor. http://wiki.ecmascript.org/doku.php?id=harmony:arrow_function_syntax
In patch were implemented the following cases:
   this - variable |this| is point to the |this| of the function where arrow function is declared. Lexical bind of |this|
   constructor - the using of the command |new| for arrow function leads to runtime error
   call(), apply(), bind()  - methods can only pass in arguments, but has no effect on |this|

* CMakeLists.txt:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/BytecodeList.json:
* bytecode/BytecodeUseDef.h:
(JSC::computeUsesForBytecodeOffset):
(JSC::computeDefsForBytecodeOffset):
* bytecode/CodeBlock.cpp:
(JSC::CodeBlock::dumpBytecode):
* bytecode/ExecutableInfo.h:
(JSC::ExecutableInfo::ExecutableInfo):
(JSC::ExecutableInfo::isArrowFunction):
* bytecode/UnlinkedCodeBlock.cpp:
(JSC::UnlinkedCodeBlock::UnlinkedCodeBlock):
* bytecode/UnlinkedCodeBlock.h:
(JSC::UnlinkedCodeBlock::isArrowFunction):
* bytecode/UnlinkedFunctionExecutable.cpp:
(JSC::generateFunctionCodeBlock):
(JSC::UnlinkedFunctionExecutable::UnlinkedFunctionExecutable):
(JSC::UnlinkedFunctionExecutable::codeBlockFor):
* bytecode/UnlinkedFunctionExecutable.h:
* bytecompiler/BytecodeGenerator.cpp:
(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::emitNewFunctionCommon):
(JSC::BytecodeGenerator::emitNewFunctionExpression):
(JSC::BytecodeGenerator::emitNewArrowFunctionExpression):
(JSC::BytecodeGenerator::emitLoadArrowFunctionThis):
* bytecompiler/BytecodeGenerator.h:
* bytecompiler/NodesCodegen.cpp:
(JSC::ArrowFuncExprNode::emitBytecode):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* dfg/DFGCapabilities.cpp:
(JSC::DFG::capabilityLevel):
* dfg/DFGClobberize.h:
(JSC::DFG::clobberize):
* dfg/DFGDoesGC.cpp:
(JSC::DFG::doesGC):
* dfg/DFGFixupPhase.cpp:
(JSC::DFG::FixupPhase::fixupNode):
* dfg/DFGNode.h:
(JSC::DFG::Node::convertToPhantomNewFunction):
(JSC::DFG::Node::hasCellOperand):
(JSC::DFG::Node::isFunctionAllocation):
* dfg/DFGNodeType.h:
* dfg/DFGObjectAllocationSinkingPhase.cpp:
* dfg/DFGPredictionPropagationPhase.cpp:
(JSC::DFG::PredictionPropagationPhase::propagate):
* dfg/DFGPromotedHeapLocation.cpp:
(WTF::printInternal):
* dfg/DFGPromotedHeapLocation.h:
* dfg/DFGSafeToExecute.h:
(JSC::DFG::safeToExecute):
* dfg/DFGSpeculativeJIT.cpp:
(JSC::DFG::SpeculativeJIT::compileLoadArrowFunctionThis):
(JSC::DFG::SpeculativeJIT::compileNewFunctionCommon):
(JSC::DFG::SpeculativeJIT::compileNewFunction):
* dfg/DFGSpeculativeJIT.h:
(JSC::DFG::SpeculativeJIT::callOperation):
* dfg/DFGSpeculativeJIT32_64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGSpeculativeJIT64.cpp:
(JSC::DFG::SpeculativeJIT::compile):
* dfg/DFGStoreBarrierInsertionPhase.cpp:
* dfg/DFGStructureRegistrationPhase.cpp:
(JSC::DFG::StructureRegistrationPhase::run):
* ftl/FTLAbstractHeapRepository.cpp:
* ftl/FTLAbstractHeapRepository.h:
* ftl/FTLCapabilities.cpp:
(JSC::FTL::canCompile):
* ftl/FTLIntrinsicRepository.h:
* ftl/FTLLowerDFGToLLVM.cpp:
(JSC::FTL::DFG::LowerDFGToLLVM::compileNode):
(JSC::FTL::DFG::LowerDFGToLLVM::compileNewFunction):
(JSC::FTL::DFG::LowerDFGToLLVM::compileLoadArrowFunctionThis):
* ftl/FTLOperations.cpp:
(JSC::FTL::operationMaterializeObjectInOSR):
* interpreter/Interpreter.cpp:
* interpreter/Interpreter.h:
* jit/CCallHelpers.h:
(JSC::CCallHelpers::setupArgumentsWithExecState): Added 3 arguments version for windows build.
* jit/JIT.cpp:
(JSC::JIT::privateCompileMainPass):
* jit/JIT.h:
* jit/JITInlines.h:
(JSC::JIT::callOperation):
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_load_arrowfunction_this):
(JSC::JIT::emit_op_new_func_exp):
(JSC::JIT::emitNewFuncExprCommon):
(JSC::JIT::emit_op_new_arrow_func_exp):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_load_arrowfunction_this):
* jit/JITOperations.cpp:
* jit/JITOperations.h:
* llint/LLIntOffsetsExtractor.cpp:
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
(JSC::LLInt::setUpCall):
* llint/LLIntSlowPaths.h:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:
* parser/ASTBuilder.h:
(JSC::ASTBuilder::createFunctionMetadata):
(JSC::ASTBuilder::createArrowFunctionExpr):
* parser/NodeConstructors.h:
(JSC::BaseFuncExprNode::BaseFuncExprNode):
(JSC::FuncExprNode::FuncExprNode):
(JSC::ArrowFuncExprNode::ArrowFuncExprNode):
* parser/Nodes.cpp:
(JSC::FunctionMetadataNode::FunctionMetadataNode):
* parser/Nodes.h:
(JSC::ExpressionNode::isArrowFuncExprNode):
* parser/Parser.cpp:
(JSC::Parser<LexerType>::parseFunctionBody):
(JSC::Parser<LexerType>::parseFunctionInfo):
* parser/SyntaxChecker.h:
(JSC::SyntaxChecker::createFunctionMetadata):
* runtime/Executable.cpp:
(JSC::ScriptExecutable::newCodeBlockFor):
* runtime/Executable.h:
* runtime/JSArrowFunction.cpp: Added.
(JSC::JSArrowFunction::destroy):
(JSC::JSArrowFunction::create):
(JSC::JSArrowFunction::JSArrowFunction):
(JSC::JSArrowFunction::createWithInvalidatedReallocationWatchpoint):
(JSC::JSArrowFunction::visitChildren):
(JSC::JSArrowFunction::getConstructData):
* runtime/JSArrowFunction.h: Added.
(JSC::JSArrowFunction::allocationSize):
(JSC::JSArrowFunction::createImpl):
(JSC::JSArrowFunction::boundThis):
(JSC::JSArrowFunction::createStructure):
(JSC::JSArrowFunction::offsetOfThisValue):
* runtime/JSFunction.h:
* runtime/JSFunctionInlines.h:
(JSC::JSFunction::JSFunction):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::init):
(JSC::JSGlobalObject::visitChildren):
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::arrowFunctionStructure):
* tests/stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js: Added.
* tests/stress/arrowfunction-activation-sink-osrexit-default-value.js: Added.
* tests/stress/arrowfunction-activation-sink-osrexit.js: Added.
* tests/stress/arrowfunction-activation-sink.js: Added.
* tests/stress/arrowfunction-bound.js: Added.
* tests/stress/arrowfunction-call.js: Added.
* tests/stress/arrowfunction-constructor.js: Added.
* tests/stress/arrowfunction-lexical-bind-this-1.js: Added.
* tests/stress/arrowfunction-lexical-bind-this-2.js: Added.
* tests/stress/arrowfunction-lexical-bind-this-3.js: Added.
* tests/stress/arrowfunction-lexical-bind-this-4.js: Added.
* tests/stress/arrowfunction-lexical-bind-this-5.js: Added.
* tests/stress/arrowfunction-lexical-bind-this-6.js: Added.
* tests/stress/arrowfunction-lexical-this-activation-sink-osrexit.js: Added.
* tests/stress/arrowfunction-lexical-this-activation-sink.js: Added.
* tests/stress/arrowfunction-lexical-this-sinking-no-double-allocate.js: Added.
* tests/stress/arrowfunction-lexical-this-sinking-osrexit.js: Added.
* tests/stress/arrowfunction-lexical-this-sinking-put.js: Added.
* tests/stress/arrowfunction-others.js: Added.
* tests/stress/arrowfunction-run-10-1.js: Added.
* tests/stress/arrowfunction-run-10-2.js: Added.
* tests/stress/arrowfunction-run-10000-1.js: Added.
* tests/stress/arrowfunction-run-10000-2.js: Added.
* tests/stress/arrowfunction-sinking-no-double-allocate.js: Added.
* tests/stress/arrowfunction-sinking-osrexit.js: Added.
* tests/stress/arrowfunction-sinking-put.js: Added.
* tests/stress/arrowfunction-tdz.js: Added.
* tests/stress/arrowfunction-typeof.js: Added.

LayoutTests:

Patch by Skachkov Oleksandr <gskachkov@gmail.com> on 2015-08-17
Reviewed by Saam Barati.

* js/arrowfunction-bind-expected.txt: Added.
* js/arrowfunction-bind.html: Added.
* js/arrowfunction-call-expected.txt: Added.
* js/arrowfunction-call.html: Added.
* js/arrowfunction-constructor-expected.txt: Added.
* js/arrowfunction-constructor.html: Added.
* js/arrowfunction-lexical-bind-this-expected.txt: Added.
* js/arrowfunction-lexical-bind-this.html: Added.
* js/arrowfunction-others-expected.txt: Added.
* js/arrowfunction-others.html: Added.
* js/arrowfunction-tdz-expected.txt: Added.
* js/arrowfunction-tdz.html: Added.
* js/arrowfunction-typeof-expected.txt: Added.
* js/arrowfunction-typeof.html: Added.
* js/regress/arrowfunction-call-expected.txt: Added.
* js/regress/arrowfunction-call.html: Added.
* js/regress/script-tests/arrowfunction-call.js: Added.
* js/regress/script-tests/function-call.js: Added.
* js/script-tests/arrowfunction-bind.js: Added.
* js/script-tests/arrowfunction-call.js: Added.
* js/script-tests/arrowfunction-constructor.js: Added.
* js/script-tests/arrowfunction-lexical-bind-this.js: Added.
* js/script-tests/arrowfunction-others.js: Added.
* js/script-tests/arrowfunction-tdz.js: Added.
* js/script-tests/arrowfunction-typeof.js: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@188545 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/runtime/Executable.cpp b/Source/JavaScriptCore/runtime/Executable.cpp
index 0ab1672..9dc694f 100644
--- a/Source/JavaScriptCore/runtime/Executable.cpp
+++ b/Source/JavaScriptCore/runtime/Executable.cpp
@@ -236,8 +236,7 @@
     DebuggerMode debuggerMode = globalObject->hasDebugger() ? DebuggerOn : DebuggerOff;
     ProfilerMode profilerMode = globalObject->hasProfiler() ? ProfilerOn : ProfilerOff;
     UnlinkedFunctionCodeBlock* unlinkedCodeBlock =
-        executable->m_unlinkedExecutable->codeBlockFor(
-            *vm, executable->m_source, kind, debuggerMode, profilerMode, error);
+    executable->m_unlinkedExecutable->codeBlockFor(*vm, executable->m_source, kind, debuggerMode, profilerMode, error, executable->isArrowFunction());
     recordParse(executable->m_unlinkedExecutable->features(), executable->m_unlinkedExecutable->hasCapturedVariables(), firstLine(), lastLine(), startColumn(), endColumn()); 
     if (!unlinkedCodeBlock) {
         exception = vm->throwException(
diff --git a/Source/JavaScriptCore/runtime/Executable.h b/Source/JavaScriptCore/runtime/Executable.h
index bce2428..cf2bde8 100644
--- a/Source/JavaScriptCore/runtime/Executable.h
+++ b/Source/JavaScriptCore/runtime/Executable.h
@@ -474,7 +474,7 @@
 
     void clearCode();
 
-    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None); }
+    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, false); }
 
     unsigned numVariables() { return m_unlinkedEvalCodeBlock->numVariables(); }
     unsigned numberOfFunctionDecls() { return m_unlinkedEvalCodeBlock->numberOfFunctionDecls(); }
@@ -530,7 +530,7 @@
 
     void clearCode();
 
-    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None); }
+    ExecutableInfo executableInfo() const { return ExecutableInfo(needsActivation(), usesEval(), isStrictMode(), false, false, ConstructorKind::None, false); }
 
 private:
     friend class ScriptExecutable;
@@ -633,6 +633,7 @@
     FunctionMode functionMode() { return m_unlinkedExecutable->functionMode(); }
     bool isBuiltinFunction() const { return m_unlinkedExecutable->isBuiltinFunction(); }
     ConstructAbility constructAbility() const { return m_unlinkedExecutable->constructAbility(); }
+    bool isArrowFunction() const { return m_unlinkedExecutable->isArrowFunction(); }
     bool isClassConstructorFunction() const { return m_unlinkedExecutable->isClassConstructorFunction(); }
     const Identifier& name() { return m_unlinkedExecutable->name(); }
     const Identifier& inferredName() { return m_unlinkedExecutable->inferredName(); }
diff --git a/Source/JavaScriptCore/runtime/JSArrowFunction.cpp b/Source/JavaScriptCore/runtime/JSArrowFunction.cpp
new file mode 100644
index 0000000..951c260
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSArrowFunction.cpp
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) 2015 Aleksandr Skachkov <gskachkov@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSArrowFunction.h"
+
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSCInlines.h"
+#include "JSCJSValue.h"
+#include "JSFunction.h"
+#include "JSFunctionInlines.h"
+#include "JSObject.h"
+#include "PropertySlot.h"
+#include "VM.h"
+
+namespace JSC {
+
+const ClassInfo JSArrowFunction::s_info = { "ArrowFunction", &Base::s_info, 0, CREATE_METHOD_TABLE(JSArrowFunction) };
+
+void JSArrowFunction::destroy(JSCell* cell)
+{
+    static_cast<JSArrowFunction*>(cell)->JSArrowFunction::~JSArrowFunction();
+}
+
+JSArrowFunction* JSArrowFunction::create(VM& vm, FunctionExecutable* executable, JSScope* scope, JSValue boundThis)
+{
+    JSArrowFunction* result = createImpl(vm, executable, scope, boundThis);
+    executable->singletonFunction()->notifyWrite(vm, result, "Allocating an arrow function");
+    return result;
+}
+
+JSArrowFunction::JSArrowFunction(VM& vm, FunctionExecutable* executable, JSScope* scope, JSValue boundThis)
+    : Base(vm, executable, scope, scope->globalObject()->arrowFunctionStructure())
+    , m_boundThis(vm, this, boundThis)
+{
+}
+
+JSArrowFunction* JSArrowFunction::createWithInvalidatedReallocationWatchpoint(VM& vm, FunctionExecutable* executable, JSScope* scope, JSValue boundThis)
+{
+    ASSERT(executable->singletonFunction()->hasBeenInvalidated());
+    return create(vm, executable, scope, boundThis);
+}
+
+void JSArrowFunction::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    JSArrowFunction* thisObject = jsCast<JSArrowFunction*>(cell);
+    ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+    Base::visitChildren(thisObject, visitor);
+
+    visitor.append(&thisObject->m_boundThis);
+}
+
+ConstructType JSArrowFunction::getConstructData(JSCell*, ConstructData&)
+{
+    return ConstructTypeNone;
+}
+
+} // namespace JSC
diff --git a/Source/JavaScriptCore/runtime/JSArrowFunction.h b/Source/JavaScriptCore/runtime/JSArrowFunction.h
new file mode 100644
index 0000000..7f56f68
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSArrowFunction.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2015 Aleksandr Skachkov <gskachkov@gmail.com>.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSArrowFunction_h
+#define JSArrowFunction_h
+
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+
+namespace JSC {
+    
+class JSGlobalObject;
+class LLIntOffsetsExtractor;
+class LLIntDesiredOffsets;
+    
+class JSArrowFunction : public JSFunction {
+    friend class JIT;
+#if ENABLE(DFG_JIT)
+    friend class DFG::SpeculativeJIT;
+    friend class DFG::JITCompiler;
+#endif
+    friend class VM;
+public:
+    typedef JSFunction Base;
+
+    static JSArrowFunction* create(VM&, FunctionExecutable*, JSScope*, JSValue);
+    static JSArrowFunction* createWithInvalidatedReallocationWatchpoint(VM&, FunctionExecutable*, JSScope*, JSValue);
+
+    static void destroy(JSCell*);
+    
+    static size_t allocationSize(size_t inlineCapacity)
+    {
+        ASSERT_UNUSED(inlineCapacity, !inlineCapacity);
+        return sizeof(JSArrowFunction);
+    }
+    
+    static JSArrowFunction* createImpl(VM& vm, FunctionExecutable* executable, JSScope* scope, JSValue boundThis)
+    {
+        JSArrowFunction* function = new (NotNull, allocateCell<JSArrowFunction>(vm.heap)) JSArrowFunction(vm, executable, scope, boundThis);
+        ASSERT(function->structure()->globalObject());
+        function->finishCreation(vm);
+        return function;
+    }
+    
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+
+    JSValue boundThis() { return m_boundThis.get(); }
+    
+    DECLARE_EXPORT_INFO;
+    
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        ASSERT(globalObject);
+        return Structure::create(vm, globalObject, prototype, TypeInfo(JSFunctionType, StructureFlags), info());
+    }
+    
+    static inline ptrdiff_t offsetOfThisValue()
+    {
+        return OBJECT_OFFSETOF(JSArrowFunction, m_boundThis);
+    }
+    
+    const static unsigned StructureFlags = Base::StructureFlags;
+
+protected:
+    static void visitChildren(JSCell*, SlotVisitor&);
+        
+private:
+    JSArrowFunction(VM&, FunctionExecutable*, JSScope*, JSValue);
+    
+    friend class LLIntOffsetsExtractor;
+    
+    WriteBarrier<Unknown> m_boundThis;
+};
+    
+} // namespace JSC
+
+#endif // JSArrowFunction_h
diff --git a/Source/JavaScriptCore/runtime/JSFunction.h b/Source/JavaScriptCore/runtime/JSFunction.h
index 0b87d75..928350e 100644
--- a/Source/JavaScriptCore/runtime/JSFunction.h
+++ b/Source/JavaScriptCore/runtime/JSFunction.h
@@ -141,6 +141,7 @@
 protected:
     JS_EXPORT_PRIVATE JSFunction(VM&, JSGlobalObject*, Structure*);
     JSFunction(VM&, FunctionExecutable*, JSScope*);
+    JSFunction(VM&, FunctionExecutable*, JSScope*, Structure*);
 
     void finishCreation(VM&, NativeExecutable*, int length, const String& name);
     using Base::finishCreation;
diff --git a/Source/JavaScriptCore/runtime/JSFunctionInlines.h b/Source/JavaScriptCore/runtime/JSFunctionInlines.h
index f6c6d58..f059584 100644
--- a/Source/JavaScriptCore/runtime/JSFunctionInlines.h
+++ b/Source/JavaScriptCore/runtime/JSFunctionInlines.h
@@ -44,6 +44,13 @@
     , m_rareData()
 {
 }
+    
+inline JSFunction::JSFunction(VM& vm, FunctionExecutable* executable, JSScope* scope, Structure* structure)
+    : Base(vm, scope, structure)
+    , m_executable(vm, this, executable)
+    , m_rareData()
+{
+}
 
 inline FunctionExecutable* JSFunction::jsExecutable() const
 {
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 25ace92..15264ef 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -60,6 +60,7 @@
 #include "JSArrayBufferConstructor.h"
 #include "JSArrayBufferPrototype.h"
 #include "JSArrayIterator.h"
+#include "JSArrowFunction.h"
 #include "JSBoundFunction.h"
 #include "JSCInlines.h"
 #include "JSCallbackConstructor.h"
@@ -260,6 +261,7 @@
     exec->setCallee(m_globalCallee.get());
 
     m_functionStructure.set(vm, this, JSFunction::createStructure(vm, this, m_functionPrototype.get()));
+    m_arrowFunctionStructure.set(vm, this, JSArrowFunction::createStructure(vm, this, m_functionPrototype.get()));
     m_boundFunctionStructure.set(vm, this, JSBoundFunction::createStructure(vm, this, m_functionPrototype.get()));
     m_namedFunctionStructure.set(vm, this, Structure::addPropertyTransition(vm, m_functionStructure.get(), vm.propertyNames->name, DontDelete | ReadOnly | DontEnum, m_functionNameOffset));
     m_internalFunctionStructure.set(vm, this, InternalFunction::createStructure(vm, this, m_functionPrototype.get()));
@@ -797,6 +799,7 @@
     visitor.append(&thisObject->m_calleeStructure);
     visitor.append(&thisObject->m_functionStructure);
     visitor.append(&thisObject->m_boundFunctionStructure);
+    visitor.append(&thisObject->m_arrowFunctionStructure);
     visitor.append(&thisObject->m_namedFunctionStructure);
     visitor.append(&thisObject->m_symbolObjectStructure);
     visitor.append(&thisObject->m_regExpStructure);
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index 9986bcf..bd12b29 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -232,6 +232,7 @@
     WriteBarrier<Structure> m_calleeStructure;
     WriteBarrier<Structure> m_functionStructure;
     WriteBarrier<Structure> m_boundFunctionStructure;
+    WriteBarrier<Structure> m_arrowFunctionStructure;
     WriteBarrier<Structure> m_namedFunctionStructure;
     PropertyOffset m_functionNameOffset;
     WriteBarrier<Structure> m_privateNameStructure;
@@ -462,6 +463,7 @@
     Structure* calleeStructure() const { return m_calleeStructure.get(); }
     Structure* functionStructure() const { return m_functionStructure.get(); }
     Structure* boundFunctionStructure() const { return m_boundFunctionStructure.get(); }
+    Structure* arrowFunctionStructure() const { return m_arrowFunctionStructure.get(); }
     Structure* namedFunctionStructure() const { return m_namedFunctionStructure.get(); }
     PropertyOffset functionNameOffset() const { return m_functionNameOffset; }
     Structure* numberObjectStructure() const { return m_numberObjectStructure.get(); }