Support WeakMap
https://bugs.webkit.org/show_bug.cgi?id=120912

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Add support for ES6 WeakMap.  Add the cluster of boilerplate
classes around the core WeakMapData class.

WeakMapData is a simple object->value hash table that uses a
combo of WeakReferenceHarvester to conditionally keep the weak
value reference live, and UnconditionalFinalizer to clean the
dead keys from the table post-GC.

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj:
* JavaScriptCore.vcxproj/JavaScriptCore.vcxproj.filters:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* runtime/CommonIdentifiers.h:
* runtime/JSGlobalObject.cpp:
* runtime/JSGlobalObject.h:
(JSC::JSGlobalObject::weakMapDataStructure):
* runtime/JSWeakMap.cpp: Added.
(JSC::JSWeakMap::finishCreation):
(JSC::JSWeakMap::visitChildren):
* runtime/JSWeakMap.h: Added.
(JSC::JSWeakMap::createStructure):
(JSC::JSWeakMap::create):
(JSC::JSWeakMap::weakMapData):
(JSC::JSWeakMap::JSWeakMap):
* runtime/WeakMapConstructor.cpp: Added.
(JSC::WeakMapConstructor::finishCreation):
(JSC::constructWeakMap):
(JSC::WeakMapConstructor::getConstructData):
(JSC::WeakMapConstructor::getCallData):
* runtime/WeakMapConstructor.h: Added.
(JSC::WeakMapConstructor::create):
(JSC::WeakMapConstructor::createStructure):
(JSC::WeakMapConstructor::WeakMapConstructor):
* runtime/WeakMapData.cpp: Added.
(JSC::WeakMapData::WeakMapData):
(JSC::WeakMapData::finishCreation):
(JSC::WeakMapData::destroy):
(JSC::WeakMapData::visitChildren):
(JSC::WeakMapData::set):
(JSC::WeakMapData::get):
(JSC::WeakMapData::remove):
(JSC::WeakMapData::contains):
(JSC::WeakMapData::clear):
(JSC::WeakMapData::DeadKeyCleaner::visitWeakReferences):
(JSC::WeakMapData::DeadKeyCleaner::finalizeUnconditionally):
* runtime/WeakMapData.h: Added.
(JSC::WeakMapData::create):
(JSC::WeakMapData::createStructure):
(JSC::WeakMapData::DeadKeyCleaner::DeadKeyCleaner):
* runtime/WeakMapPrototype.cpp: Added.
(JSC::WeakMapPrototype::finishCreation):
(JSC::getWeakMapData):
(JSC::protoFuncWeakMapClear):
(JSC::protoFuncWeakMapDelete):
(JSC::protoFuncWeakMapGet):
(JSC::protoFuncWeakMapHas):
(JSC::protoFuncWeakMapSet):
* runtime/WeakMapPrototype.h: Added.
(JSC::WeakMapPrototype::create):
(JSC::WeakMapPrototype::createStructure):
(JSC::WeakMapPrototype::WeakMapPrototype):

LayoutTests:

Basic tests.

* js/basic-weakmap-expected.txt: Added.
* js/basic-weakmap.html: Added.
* js/script-tests/basic-weakmap.js: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155473 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/runtime/CommonIdentifiers.h b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
index 6480f0f..5422c7a 100644
--- a/Source/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/Source/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -143,6 +143,7 @@
     macro(size) \
     macro(Map)\
     macro(Set)\
+    macro(WeakMap)\
     macro(add)
 
 #define JSC_COMMON_IDENTIFIERS_EACH_KEYWORD(macro) \
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
index 05fe857..371d3e7 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -71,6 +71,7 @@
 #include "JSTypedArrayConstructors.h"
 #include "JSTypedArrayPrototypes.h"
 #include "JSTypedArrays.h"
+#include "JSWeakMap.h"
 #include "JSWithScope.h"
 #include "LegacyProfiler.h"
 #include "Lookup.h"
@@ -99,6 +100,9 @@
 #include "StrictEvalActivation.h"
 #include "StringConstructor.h"
 #include "StringPrototype.h"
+#include "WeakMapConstructor.h"
+#include "WeakMapData.h"
+#include "WeakMapPrototype.h"
 
 #if ENABLE(PROMISES)
 #include "JSPromise.h"
@@ -309,6 +313,7 @@
 
 
     m_mapDataStructure.set(exec->vm(), this, MapData::createStructure(exec->vm(), this, jsNull()));
+    m_weakMapDataStructure.set(exec->vm(), this, WeakMapData::createStructure(exec->vm(), this, jsNull()));
 
 #define CREATE_PROTOTYPE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
     m_ ## lowerName ## Prototype.set(exec->vm(), this, capitalName##Prototype::create(exec, this, capitalName##Prototype::createStructure(exec->vm(), this, m_objectPrototype.get()))); \
@@ -640,6 +645,7 @@
 #undef VISIT_SIMPLE_TYPE
 
     visitor.append(&thisObject->m_mapDataStructure);
+    visitor.append(&thisObject->m_weakMapDataStructure);
 
     for (unsigned i = NUMBER_OF_TYPED_ARRAY_TYPES; i--;) {
         visitor.append(&thisObject->m_typedArrays[i].prototype);
diff --git a/Source/JavaScriptCore/runtime/JSGlobalObject.h b/Source/JavaScriptCore/runtime/JSGlobalObject.h
index da61894..82ff29c 100644
--- a/Source/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/Source/JavaScriptCore/runtime/JSGlobalObject.h
@@ -80,6 +80,7 @@
     macro(Number, number, numberObject, NumberObject, Number) \
     macro(Error, error, error, ErrorInstance, Error) \
     macro(JSArrayBuffer, arrayBuffer, arrayBuffer, JSArrayBuffer, ArrayBuffer) \
+    macro(WeakMap, weakMap, weakMap, JSWeakMap, WeakMap) \
 
 #define DECLARE_SIMPLE_BUILTIN_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
     class JS ## capitalName; \
@@ -200,6 +201,7 @@
 #endif // ENABLE(PROMISES)
 
     WriteBarrier<Structure> m_mapDataStructure;
+    WriteBarrier<Structure> m_weakMapDataStructure;
 
 #define DEFINE_STORAGE_FOR_SIMPLE_TYPE(capitalName, lowerName, properName, instanceType, jsName) \
     WriteBarrier<capitalName ## Prototype> m_ ## lowerName ## Prototype; \
@@ -398,6 +400,7 @@
     Structure* internalFunctionStructure() const { return m_internalFunctionStructure.get(); }
     Structure* mapStructure() const { return m_mapStructure.get(); }
     Structure* mapDataStructure() const { return m_mapDataStructure.get(); }
+    Structure* weakMapDataStructure() const { return m_weakMapDataStructure.get(); }
     Structure* regExpMatchesArrayStructure() const { return m_regExpMatchesArrayStructure.get(); }
     Structure* regExpStructure() const { return m_regExpStructure.get(); }
     Structure* setStructure() const { return m_setStructure.get(); }
diff --git a/Source/JavaScriptCore/runtime/JSWeakMap.cpp b/Source/JavaScriptCore/runtime/JSWeakMap.cpp
new file mode 100644
index 0000000..fe6b790
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSWeakMap.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWeakMap.h"
+
+#include "JSCJSValueInlines.h"
+#include "SlotVisitorInlines.h"
+#include "WeakMapData.h"
+
+namespace JSC {
+
+const ClassInfo JSWeakMap::s_info = { "WeakMap", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(JSWeakMap) };
+
+void JSWeakMap::finishCreation(VM& vm, JSGlobalObject* globalObject)
+{
+    Base::finishCreation(vm);
+    m_weakMapData.set(vm, this, WeakMapData::create(vm, globalObject));
+}
+
+void JSWeakMap::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    Base::visitChildren(cell, visitor);
+    JSWeakMap* thisObj = jsCast<JSWeakMap*>(cell);
+    visitor.append(&thisObj->m_weakMapData);
+}
+
+}
diff --git a/Source/JavaScriptCore/runtime/JSWeakMap.h b/Source/JavaScriptCore/runtime/JSWeakMap.h
new file mode 100644
index 0000000..93c2d84
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/JSWeakMap.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWeakMap_h
+#define JSWeakMap_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class WeakMapData;
+
+class JSWeakMap : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    DECLARE_EXPORT_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    static JSWeakMap* create(ExecState* exec, Structure* structure)
+    {
+        VM& vm = exec->vm();
+        JSWeakMap* instance = new (NotNull, allocateCell<JSWeakMap>(vm.heap)) JSWeakMap(vm, structure);
+        instance->finishCreation(vm, structure->globalObject());
+        return instance;
+    }
+
+    WeakMapData* weakMapData() { return m_weakMapData.get(); }
+
+    JSValue get(CallFrame*, JSObject*);
+    bool has(CallFrame*, JSObject*);
+    bool remove(CallFrame*, JSObject*);
+
+    void set(CallFrame*, JSObject*, JSValue);
+    void clear(CallFrame*);
+
+private:
+
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+
+    JSWeakMap(VM& vm, Structure* structure)
+        : Base(vm, structure)
+    {
+    }
+
+    void finishCreation(VM&, JSGlobalObject*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+
+    WriteBarrier<WeakMapData> m_weakMapData;
+};
+
+}
+
+#endif // !defined(JSWeakMap_h)
diff --git a/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp b/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp
new file mode 100644
index 0000000..d1ff1dd
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/WeakMapConstructor.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WeakMapConstructor.h"
+
+#include "JSCJSValueInlines.h"
+#include "JSCellInlines.h"
+#include "JSGlobalObject.h"
+#include "JSWeakMap.h"
+#include "WeakMapPrototype.h"
+
+namespace JSC {
+
+const ClassInfo WeakMapConstructor::s_info = { "Function", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(WeakMapConstructor) };
+
+void WeakMapConstructor::finishCreation(ExecState* exec, WeakMapPrototype* prototype)
+{
+    Base::finishCreation(exec->vm(), prototype->classInfo()->className);
+    putDirectWithoutTransition(exec->vm(), exec->propertyNames().prototype, prototype, DontEnum | DontDelete | ReadOnly);
+    putDirectWithoutTransition(exec->vm(), exec->propertyNames().length, jsNumber(0), ReadOnly | DontEnum | DontDelete);
+}
+
+static EncodedJSValue JSC_HOST_CALL constructWeakMap(ExecState* exec)
+{
+    JSGlobalObject* globalObject = asInternalFunction(exec->callee())->globalObject();
+    Structure* structure = globalObject->weakMapStructure();
+    return JSValue::encode(JSWeakMap::create(exec, structure));
+}
+
+ConstructType WeakMapConstructor::getConstructData(JSCell*, ConstructData& constructData)
+{
+    constructData.native.function = constructWeakMap;
+    return ConstructTypeHost;
+}
+
+CallType WeakMapConstructor::getCallData(JSCell*, CallData&)
+{
+    return CallTypeNone;
+}
+
+}
diff --git a/Source/JavaScriptCore/runtime/WeakMapConstructor.h b/Source/JavaScriptCore/runtime/WeakMapConstructor.h
new file mode 100644
index 0000000..2c485ef
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/WeakMapConstructor.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WeakMapConstructor_h
+#define WeakMapConstructor_h
+
+#include "InternalFunction.h"
+
+namespace JSC {
+
+class WeakMapPrototype;
+
+class WeakMapConstructor : public InternalFunction {
+public:
+    typedef InternalFunction Base;
+
+    static WeakMapConstructor* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure, WeakMapPrototype* prototype)
+    {
+        WeakMapConstructor* constructor = new (NotNull, allocateCell<WeakMapConstructor>(*exec->heap())) WeakMapConstructor(globalObject, structure);
+        constructor->finishCreation(exec, prototype);
+        return constructor;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    WeakMapConstructor(JSGlobalObject* globalObject, Structure* structure)
+        : Base(globalObject, structure)
+    {
+    }
+    void finishCreation(ExecState*, WeakMapPrototype*);
+    static ConstructType getConstructData(JSCell*, ConstructData&);
+    static CallType getCallData(JSCell*, CallData&);
+};
+
+}
+
+#endif // !defined(WeakMapConstructor_h)
diff --git a/Source/JavaScriptCore/runtime/WeakMapData.cpp b/Source/JavaScriptCore/runtime/WeakMapData.cpp
new file mode 100644
index 0000000..4706d1b
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/WeakMapData.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WeakMapData.h"
+
+#include "CopiedAllocator.h"
+#include "CopyVisitorInlines.h"
+#include "ExceptionHelpers.h"
+#include "JSCJSValueInlines.h"
+#include "SlotVisitorInlines.h"
+
+#include <wtf/MathExtras.h>
+
+
+namespace JSC {
+
+const ClassInfo WeakMapData::s_info = { "WeakMapData", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(WeakMapData) };
+
+WeakMapData::WeakMapData(VM& vm, JSGlobalObject* globalObject)
+    : Base(vm, globalObject->weakMapDataStructure())
+    , m_deadKeyCleaner(this)
+{
+}
+
+void WeakMapData::finishCreation(VM& vm)
+{
+    Base::finishCreation(vm);
+}
+
+void WeakMapData::destroy(JSCell* cell)
+{
+    static_cast<WeakMapData*>(cell)->~WeakMapData();
+}
+
+void WeakMapData::visitChildren(JSCell* cell, SlotVisitor& visitor)
+{
+    Base::visitChildren(cell, visitor);
+    WeakMapData* thisObj = jsCast<WeakMapData*>(cell);
+    visitor.addUnconditionalFinalizer(&thisObj->m_deadKeyCleaner);
+    visitor.addWeakReferenceHarvester(&thisObj->m_deadKeyCleaner);
+
+    // Rough approximation of the external storage needed for the hashtable.
+    // This isn't exact, but it is close enough, and proportional to the actual
+    // external mermory usage.
+    visitor.reportExtraMemoryUsage(thisObj->m_map.capacity() * (sizeof(JSObject*) + sizeof(WriteBarrier<Unknown>)));
+}
+
+void WeakMapData::set(CallFrame* callFrame, JSObject* key, JSValue value)
+{
+    // Here we force the write barrier on the key.
+    auto result = m_map.add(WriteBarrier<JSObject>(callFrame->vm(), this, key).get(), WriteBarrier<Unknown>());
+    result.iterator->value.set(callFrame->vm(), this, value);
+}
+
+JSValue WeakMapData::get(JSObject* key)
+{
+    auto iter = m_map.find(key);
+    if (iter == m_map.end())
+        return jsUndefined();
+    return iter->value.get();
+}
+
+bool WeakMapData::remove(JSObject* key)
+{
+    auto iter = m_map.find(key);
+    if (iter == m_map.end())
+        return false;
+
+    m_map.remove(iter);
+    return true;
+}
+
+bool WeakMapData::contains(JSObject* key)
+{
+    return m_map.contains(key);
+}
+
+void WeakMapData::clear()
+{
+    m_map.clear();
+}
+
+void WeakMapData::DeadKeyCleaner::visitWeakReferences(SlotVisitor& visitor)
+{
+    m_liveKeyCount = 0;
+    for (auto it = m_target->m_map.begin(), end = m_target->m_map.end(); it != end; ++it) {
+        if (!Heap::isMarked(it->key))
+            continue;
+        m_liveKeyCount++;
+        visitor.append(&it->value);
+    }
+    RELEASE_ASSERT(m_liveKeyCount <= m_target->m_map.size());
+}
+
+void WeakMapData::DeadKeyCleaner::finalizeUnconditionally()
+{
+    if (m_liveKeyCount > m_target->m_map.size() / 2) {
+        RELEASE_ASSERT(m_liveKeyCount <= m_target->m_map.size());
+        int deadCount = m_target->m_map.size() - m_liveKeyCount;
+        if (!deadCount)
+            return;
+        Vector<JSObject*> deadEntries;
+        deadEntries.reserveCapacity(deadCount);
+        for (auto it = m_target->m_map.begin(), end = m_target->m_map.end(); it != end; ++it) {
+            if (Heap::isMarked(it->key))
+                continue;
+            deadEntries.uncheckedAppend(it->key);
+        }
+        for (size_t i = 0; i < deadEntries.size(); i++)
+            m_target->m_map.remove(deadEntries[i]);
+    } else {
+        MapType newMap;
+        for (auto it = m_target->m_map.begin(), end = m_target->m_map.end(); it != end; ++it) {
+            if (!Heap::isMarked(it->key))
+                continue;
+            newMap.add(it->key, it->value);
+        }
+        m_target->m_map.swap(newMap);
+    }
+}
+
+}
diff --git a/Source/JavaScriptCore/runtime/WeakMapData.h b/Source/JavaScriptCore/runtime/WeakMapData.h
new file mode 100644
index 0000000..e163985
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/WeakMapData.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2013 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WeakMapData_h
+#define WeakMapData_h
+
+#include "CallFrame.h"
+#include "JSCJSValue.h"
+#include "JSDestructibleObject.h"
+
+#include <wtf/HashFunctions.h>
+#include <wtf/HashMap.h>
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+class WeakImpl;
+class WeakMapData;
+
+class WeakMapData : public JSDestructibleObject {
+public:
+    typedef JSDestructibleObject Base;
+
+    static WeakMapData* create(VM& vm, JSGlobalObject* globalObject)
+    {
+        WeakMapData* weakMapData = new (NotNull, allocateCell<WeakMapData>(vm.heap)) WeakMapData(vm, globalObject);
+        weakMapData->finishCreation(vm);
+        return weakMapData;
+    }
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+    void set(CallFrame*, JSObject*, JSValue);
+    JSValue get(JSObject*);
+    bool remove(JSObject*);
+    void removeDead(JSObject*);
+    bool contains(JSObject*);
+    void clear();
+
+    DECLARE_INFO;
+    static const unsigned StructureFlags = OverridesVisitChildren | Base::StructureFlags;
+
+private:
+    WeakMapData(VM&, JSGlobalObject*);
+    static void destroy(JSCell*);
+    static void visitChildren(JSCell*, SlotVisitor&);
+    void finishCreation(VM&);
+
+    class DeadKeyCleaner : public UnconditionalFinalizer, public WeakReferenceHarvester {
+    public:
+        DeadKeyCleaner(WeakMapData* target)
+            : m_target(target)
+        {
+        }
+    private:
+        virtual void visitWeakReferences(SlotVisitor&);
+        virtual void finalizeUnconditionally();
+        int m_liveKeyCount;
+        WeakMapData* m_target;
+    };
+    DeadKeyCleaner m_deadKeyCleaner;
+    typedef HashMap<JSObject*, WriteBarrier<Unknown>> MapType;
+    MapType m_map;
+};
+
+}
+
+#endif /* !defined(WeakMapData_h) */
diff --git a/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp b/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp
new file mode 100644
index 0000000..ff2ffa3
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/WeakMapPrototype.cpp
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WeakMapPrototype.h"
+
+#include "JSCJSValueInlines.h"
+#include "JSWeakMap.h"
+#include "WeakMapData.h"
+
+namespace JSC {
+
+const ClassInfo WeakMapPrototype::s_info = { "WeakMap", &Base::s_info, 0, 0, CREATE_METHOD_TABLE(WeakMapPrototype) };
+
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapClear(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapDelete(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapGet(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapHas(ExecState*);
+static EncodedJSValue JSC_HOST_CALL protoFuncWeakMapSet(ExecState*);
+
+void WeakMapPrototype::finishCreation(ExecState* exec, JSGlobalObject* globalObject)
+{
+    VM& vm = exec->vm();
+
+    Base::finishCreation(vm);
+    ASSERT(inherits(info()));
+    vm.prototypeMap.addPrototype(this);
+
+    JSC_NATIVE_FUNCTION(exec->propertyNames().clear, protoFuncWeakMapClear, DontEnum, 0);
+    JSC_NATIVE_FUNCTION(exec->propertyNames().deleteKeyword, protoFuncWeakMapDelete, DontEnum, 1);
+    JSC_NATIVE_FUNCTION(exec->propertyNames().get, protoFuncWeakMapGet, DontEnum, 1);
+    JSC_NATIVE_FUNCTION(exec->propertyNames().has, protoFuncWeakMapHas, DontEnum, 1);
+    JSC_NATIVE_FUNCTION(exec->propertyNames().set, protoFuncWeakMapSet, DontEnum, 2);
+}
+
+static WeakMapData* getWeakMapData(CallFrame* callFrame, JSValue value)
+{
+    if (!value.isObject()) {
+        throwTypeError(callFrame, WTF::ASCIILiteral("Called WeakMap function on non-object"));
+        return 0;
+    }
+
+    if (JSWeakMap* weakMap = jsDynamicCast<JSWeakMap*>(value))
+        return weakMap->weakMapData();
+
+    throwTypeError(callFrame, WTF::ASCIILiteral("Called WeakMap function on a non-WeakMap object"));
+    return 0;
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapClear(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    map->clear();
+    return JSValue::encode(jsUndefined());
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapDelete(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    if (!key.isObject())
+        return JSValue::encode(throwTypeError(callFrame, WTF::ASCIILiteral("A WeakMap cannot have a non-object key")));
+    return JSValue::encode(jsBoolean(map->remove(asObject(key))));
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapGet(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    if (!key.isObject())
+        return JSValue::encode(throwTypeError(callFrame, WTF::ASCIILiteral("A WeakMap cannot have a non-object key")));
+    return JSValue::encode(map->get(asObject(key)));
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapHas(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    if (!key.isObject())
+        return JSValue::encode(throwTypeError(callFrame, WTF::ASCIILiteral("A WeakMap cannot have a non-object key")));
+    return JSValue::encode(jsBoolean(map->contains(asObject(key))));
+}
+
+EncodedJSValue JSC_HOST_CALL protoFuncWeakMapSet(CallFrame* callFrame)
+{
+    WeakMapData* map = getWeakMapData(callFrame, callFrame->thisValue());
+    if (!map)
+        return JSValue::encode(jsUndefined());
+    JSValue key = callFrame->argument(0);
+    if (!key.isObject())
+        return JSValue::encode(throwTypeError(callFrame, WTF::ASCIILiteral("Attempted to set a non-object key in a WeakMap")));
+    map->set(callFrame, asObject(key), callFrame->argument(1));
+    return JSValue::encode(callFrame->thisValue());
+}
+
+}
diff --git a/Source/JavaScriptCore/runtime/WeakMapPrototype.h b/Source/JavaScriptCore/runtime/WeakMapPrototype.h
new file mode 100644
index 0000000..785e49e
--- /dev/null
+++ b/Source/JavaScriptCore/runtime/WeakMapPrototype.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2013 Apple, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WeakMapPrototype_h
+#define WeakMapPrototype_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class WeakMapPrototype : public JSNonFinalObject {
+public:
+    typedef JSNonFinalObject Base;
+
+    static WeakMapPrototype* create(ExecState* exec, JSGlobalObject* globalObject, Structure* structure)
+    {
+        WeakMapPrototype* prototype = new (NotNull, allocateCell<WeakMapPrototype>(*exec->heap())) WeakMapPrototype(exec, structure);
+        prototype->finishCreation(exec, globalObject);
+        return prototype;
+    }
+
+    DECLARE_INFO;
+
+    static Structure* createStructure(VM& vm, JSGlobalObject* globalObject, JSValue prototype)
+    {
+        return Structure::create(vm, globalObject, prototype, TypeInfo(ObjectType, StructureFlags), info());
+    }
+
+private:
+    WeakMapPrototype(ExecState* exec, Structure* structure)
+        : Base(exec->vm(), structure)
+    {
+    }
+    void finishCreation(ExecState*, JSGlobalObject*);
+};
+
+}
+
+#endif // !defined(WeakMapPrototype_h)