CallIC and KeyedCallIC not wrapping this.

src/ic.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 440 matching lines @@
 MaybeObject* CallICBase::LoadFunction(State state,
                                       Code::ExtraICState extra_ic_state,
                                       Handle<Object> object,
                                       Handle<String> name) {
   // If the object is undefined or null it's illegal to try to get any
   // of its properties; throw a TypeError in that case.
   if (object->IsUndefined() || object->IsNull()) {
     return TypeError("non_object_property_call", object, name);
   }
 
-  if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
-    ReceiverToObject(object);
-  }
-
   // Check if the name is trivially convertible to an index and get
   // the element if so.
   uint32_t index;
-  if (name->AsArrayIndex(&index)) {
+  // TODO(mmaly): One cannot hang number-indexed functions off of values, right?

[Martin Maly, 2011/02/16 04:56:17]

I couldn't come up with a way where value could actually be valid here. I may be
wrong though...

[Mads Ager (chromium), 2011/02/16 10:43:54]

I think that is because we have a bug here. I think you should leave this code
as is. GetElement should deal with prototypes for value objects the same way
that GetProperty does.

The case that we should hit here is:

Number.prototype[0] = function() { print('asdf'); }
(0)["0"]()

We do not hit this and we throw an error. This is inconsistent and we should
change it. Let's file a bug report and deal with that in a separate change.

[Martin Maly, 2011/02/17 05:25:55]

Done.

+  if (object->IsJSObject() && name->AsArrayIndex(&index)) {
     Object* result;
     { MaybeObject* maybe_result = object->GetElement(index);
       if (!maybe_result->ToObject(&result)) return maybe_result;
     }
 
     if (result->IsJSFunction()) return result;
 
     // Try to find a suitable function delegate for the object at hand.
     result = TryCallAsFunction(result);
     if (result->IsJSFunction()) return result;
 
     // Otherwise, it will fail in the lookup step.
   }
 
   // Lookup the property in the object.
   LookupResult lookup;
   LookupForRead(*object, *name, &lookup);
 
   if (!lookup.IsProperty()) {
     // If the object does not have the requested property, check which
     // exception we need to throw.
     if (IsContextual(object)) {
       return ReferenceError("not_defined", name);
     }
+    // TODO(mmaly): Should we do ToObject here?

[Mads Ager (chromium), 2011/02/16 10:43:54]

Nope, there is no change to this code and it makes sense to use the value object
for error reporting. That is what you attempted to call something on.

The ReceiverToObject call only changes the receiver on the stack I believe, so
you have not made any change to behavior here.

[Martin Maly, 2011/02/17 05:25:55]

Done.

     return TypeError("undefined_method", object, name);
   }
 
   // Lookup is valid: Update inline cache and stub cache.
   if (FLAG_use_ic) {
     UpdateCaches(&lookup, state, extra_ic_state, object, name);
   }
 
   // Get the property.
   PropertyAttributes attr;
   Object* result;
   { MaybeObject* maybe_result =
         object->GetProperty(*object, &lookup, *name, &attr);
     if (!maybe_result->ToObject(&result)) return maybe_result;
   }
+
+  // For non-strict mode functions, make receiver an object.
+  if ((!result->IsJSFunction() ||
+      !JSFunction::cast(result)->shared()->strict_mode()) &&
+      (object->IsString() || object->IsNumber() || object->IsBoolean())) {
+    ReceiverToObject(object);

[Vitaly Repeshko, 2011/02/16 11:52:12]

1. Since this is now done after UpdateCaches, please fix TryUpdateExtraICState.
It assumes it's invoked with a wrapped receiver.

2. For builtin functions it would be nice to avoid wrapping the receiver. It
could be as simple as checking whether the function is a builtin here. If turns
out to be more involved feel free to ignore this suggestion.

[Martin Maly, 2011/02/17 05:25:55]

Done and done. for the builtin change I ran full test battery in debug mode, all
clean, so I suppose it was as easy as checking for builtin function here. Thanks
for the suggestion.

+  }
+
   if (lookup.type() == INTERCEPTOR) {
     // If the object does not have the requested property, check which
     // exception we need to throw.
     if (attr == ABSENT) {
       if (IsContextual(object)) {
         return ReferenceError("not_defined", name);
       }
       return TypeError("undefined_method", object, name);
     }
   }
@@ skipping 1768 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal