CallIC and KeyedCallIC not wrapping this.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index 968b45d0b61f4ac27c102cdc8dae927cc8c51ff2..446511191aa6c9d0277016804d810ef3f8339516 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -458,14 +458,11 @@ MaybeObject* CallICBase::LoadFunction(State state,
     return TypeError("non_object_property_call", object, name);
   }
 
-  if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
-    ReceiverToObject(object);
-  }
-
   // Check if the name is trivially convertible to an index and get
   // the element if so.
   uint32_t index;
-  if (name->AsArrayIndex(&index)) {
+  // TODO(mmaly): One cannot hang number-indexed functions off of values, right?

[Martin Maly, 2011/02/16 04:56:17]

I couldn't come up with a way where value could actually be valid here. I may be
wrong though...

[Mads Ager (chromium), 2011/02/16 10:43:54]

I think that is because we have a bug here. I think you should leave this code
as is. GetElement should deal with prototypes for value objects the same way
that GetProperty does.

The case that we should hit here is:

Number.prototype[0] = function() { print('asdf'); }
(0)["0"]()

We do not hit this and we throw an error. This is inconsistent and we should
change it. Let's file a bug report and deal with that in a separate change.

[Martin Maly, 2011/02/17 05:25:55]

Done.

+  if (object->IsJSObject() && name->AsArrayIndex(&index)) {
     Object* result;
     { MaybeObject* maybe_result = object->GetElement(index);
       if (!maybe_result->ToObject(&result)) return maybe_result;
@@ -490,6 +487,7 @@ MaybeObject* CallICBase::LoadFunction(State state,
     if (IsContextual(object)) {
       return ReferenceError("not_defined", name);
     }
+    // TODO(mmaly): Should we do ToObject here?

[Mads Ager (chromium), 2011/02/16 10:43:54]

Nope, there is no change to this code and it makes sense to use the value object
for error reporting. That is what you attempted to call something on.

The ReceiverToObject call only changes the receiver on the stack I believe, so
you have not made any change to behavior here.

[Martin Maly, 2011/02/17 05:25:55]

Done.

     return TypeError("undefined_method", object, name);
   }
 
@@ -505,6 +503,14 @@ MaybeObject* CallICBase::LoadFunction(State state,
         object->GetProperty(*object, &lookup, *name, &attr);
     if (!maybe_result->ToObject(&result)) return maybe_result;
   }
+
+  // For non-strict mode functions, make receiver an object.
+  if ((!result->IsJSFunction() ||
+      !JSFunction::cast(result)->shared()->strict_mode()) &&
+      (object->IsString() || object->IsNumber() || object->IsBoolean())) {
+    ReceiverToObject(object);

[Vitaly Repeshko, 2011/02/16 11:52:12]

1. Since this is now done after UpdateCaches, please fix TryUpdateExtraICState.
It assumes it's invoked with a wrapped receiver.

2. For builtin functions it would be nice to avoid wrapping the receiver. It
could be as simple as checking whether the function is a builtin here. If turns
out to be more involved feel free to ignore this suggestion.

[Martin Maly, 2011/02/17 05:25:55]

Done and done. for the builtin change I ran full test battery in debug mode, all
clean, so I suppose it was as easy as checking for builtin function here. Thanks
for the suggestion.

+  }
+
   if (lookup.type() == INTERCEPTOR) {
     // If the object does not have the requested property, check which
     // exception we need to throw.