Index: src/ia32/lithium-codegen-ia32.cc |
diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc |
index b6a6382017fa9d08088a5619383baa3ec456d672..d725191558b144e15f6617fce505103b825baa56 100644 |
--- a/src/ia32/lithium-codegen-ia32.cc |
+++ b/src/ia32/lithium-codegen-ia32.cc |
@@ -2116,6 +2116,9 @@ void LCodeGen::DoArgumentsLength(LArgumentsLength* instr) { |
void LCodeGen::DoApplyArguments(LApplyArguments* instr) { |
Register receiver = ToRegister(instr->receiver()); |
+ Register length = ToRegister(instr->length()); |
+ Register elements = ToRegister(instr->elements()); |
+ Register temp = ToRegister(instr->TempAt(0)); |
ASSERT(ToRegister(instr->function()).is(edi)); |
ASSERT(ToRegister(instr->result()).is(eax)); |
@@ -2125,14 +2128,19 @@ void LCodeGen::DoApplyArguments(LApplyArguments* instr) { |
__ cmp(receiver, Factory::null_value()); |
__ j(equal, &global_receiver); |
__ cmp(receiver, Factory::undefined_value()); |
- __ j(not_equal, &receiver_ok); |
+ __ j(equal, &global_receiver); |
+ |
+ // The receiver should be a JS object. |
+ __ test(receiver, Immediate(kSmiTagMask)); |
+ DeoptimizeIf(equal, instr->environment()); |
+ __ CmpObjectType(receiver, FIRST_JS_OBJECT_TYPE, temp); |
+ DeoptimizeIf(below, instr->environment()); |
+ __ jmp(&receiver_ok); |
+ |
__ bind(&global_receiver); |
__ mov(receiver, GlobalObjectOperand()); |
__ bind(&receiver_ok); |
- Register length = ToRegister(instr->length()); |
- Register elements = ToRegister(instr->elements()); |
- |
Label invoke; |
// Copy the arguments to this function possibly from the |