Don't exchange null and undefined with the global object in function.prototype.{call, apply} for ...

src/string.js

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 44 matching lines @@
 // ECMA-262 section 15.5.4.3
 function StringValueOf() {
   if (!IS_STRING(this) && !IS_STRING_WRAPPER(this))
     throw new $TypeError('String.prototype.valueOf is not generic');
   return %_ValueOf(this);
 }
 
 
 // ECMA-262, section 15.5.4.4
 function StringCharAt(pos) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["charAt"]);
+  }
+
   var result = %_StringCharAt(this, pos);
   if (%_IsSmi(result)) {
     result = %_StringCharAt(TO_STRING_INLINE(this), TO_INTEGER(pos));
   }
   return result;
 }
 
 
 // ECMA-262 section 15.5.4.5
 function StringCharCodeAt(pos) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["charCodeAt"]);
+  }
+
   var result = %_StringCharCodeAt(this, pos);
   if (!%_IsSmi(result)) {
     result = %_StringCharCodeAt(TO_STRING_INLINE(this), TO_INTEGER(pos));
   }
   return result;
 }
 
 
 // ECMA-262, section 15.5.4.6
 function StringConcat() {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["concat"]);
+  }
   var len = %_ArgumentsLength();
   var this_as_string = TO_STRING_INLINE(this);
   if (len === 1) {
     return this_as_string + %_Arguments(0);
   }
   var parts = new InternalArray(len + 1);
   parts[0] = this_as_string;
   for (var i = 0; i < len; i++) {
     var part = %_Arguments(i);
     parts[i + 1] = TO_STRING_INLINE(part);
   }
   return %StringBuilderConcat(parts, len + 1, "");
 }
 
 // Match ES3 and Safari
 %FunctionSetLength(StringConcat, 1);
 
 
 // ECMA-262 section 15.5.4.7
 function StringIndexOf(pattern /* position */) {  // length == 1
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["indexOf"]);
+  }
   var subject = TO_STRING_INLINE(this);
   pattern = TO_STRING_INLINE(pattern);
   var index = 0;
   if (%_ArgumentsLength() > 1) {
     index = %_Arguments(1);  // position
     index = TO_INTEGER(index);
     if (index < 0) index = 0;
     if (index > subject.length) index = subject.length;
   }
   return %StringIndexOf(subject, pattern, index);
 }
 
 
 // ECMA-262 section 15.5.4.8
 function StringLastIndexOf(pat /* position */) {  // length == 1
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["lastIndexOf"]);
+  }
   var sub = TO_STRING_INLINE(this);
   var subLength = sub.length;
   var pat = TO_STRING_INLINE(pat);
   var patLength = pat.length;
   var index = subLength - patLength;
   if (%_ArgumentsLength() > 1) {
     var position = ToNumber(%_Arguments(1));
     if (!NUMBER_IS_NAN(position)) {
       position = TO_INTEGER(position);
       if (position < 0) {
         position = 0;
       }
       if (position + patLength < subLength) {
         index = position
       }
     }
   }
   if (index < 0) {
     return -1;
   }
   return %StringLastIndexOf(sub, pat, index);
 }
 
 
 // ECMA-262 section 15.5.4.9
 //
 // This function is implementation specific.  For now, we do not
 // do anything locale specific.
 function StringLocaleCompare(other) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["localeCompare"]);
+  }
   if (%_ArgumentsLength() === 0) return 0;
   return %StringLocaleCompare(TO_STRING_INLINE(this), 
                               TO_STRING_INLINE(other));
 }
 
 
 // ECMA-262 section 15.5.4.10
 function StringMatch(regexp) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["match"]);
+  }
   var subject = TO_STRING_INLINE(this);
   if (IS_REGEXP(regexp)) {
     if (!regexp.global) return RegExpExecNoTests(regexp, subject, 0);
     %_Log('regexp', 'regexp-match,%0S,%1r', [subject, regexp]);
     // lastMatchInfo is defined in regexp.js.
     return %StringMatch(subject, regexp, lastMatchInfo);
   }
   // Non-regexp argument.
   regexp = new $RegExp(regexp);
   return RegExpExecNoTests(regexp, subject, 0);
@@ skipping 13 matching lines @@
 // This has the same size as the lastMatchInfo array, and can be used for
 // functions that expect that structure to be returned.  It is used when the
 // needle is a string rather than a regexp.  In this case we can't update
 // lastMatchArray without erroneously affecting the properties on the global
 // RegExp object.
 var reusableMatchInfo = [2, "", "", -1, -1];
 
 
 // ECMA-262, section 15.5.4.11
 function StringReplace(search, replace) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["replace"]);
+  }
   var subject = TO_STRING_INLINE(this);
 
   // Delegate to one of the regular expression variants if necessary.
   if (IS_REGEXP(search)) {
     %_Log('regexp', 'regexp-replace,%0r,%1S', [search, subject]);
     if (IS_FUNCTION(replace)) {
       if (search.global) {
         return StringReplaceGlobalRegExpWithFunction(subject, search, replace);
       } else {
         return StringReplaceNonGlobalRegExpWithFunction(subject,
@@ skipping 260 matching lines @@
   result.add(replacement);  // The add method converts to string if necessary.
   // Can't use matchInfo any more from here, since the function could
   // overwrite it.
   result.addSpecialSlice(endOfMatch, subject.length);
   return result.generate();
 }
 
 
 // ECMA-262 section 15.5.4.12
 function StringSearch(re) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["search"]);
+  }
   var regexp;
   if (IS_STRING(re)) {
     regexp = %_GetFromCache(STRING_TO_REGEXP_CACHE_ID, re);
   } else if (IS_REGEXP(re)) {
     regexp = re;
   } else {
     regexp = new $RegExp(re);
   }
   var match = DoRegExpExec(regexp, TO_STRING_INLINE(this), 0);
   if (match) {
     return match[CAPTURE0];
   }
   return -1;
 }
 
 
 // ECMA-262 section 15.5.4.13
 function StringSlice(start, end) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["slice"]);
+  }
   var s = TO_STRING_INLINE(this);
   var s_len = s.length;
   var start_i = TO_INTEGER(start);
   var end_i = s_len;
   if (end !== void 0)
     end_i = TO_INTEGER(end);
 
   if (start_i < 0) {
     start_i += s_len;
     if (start_i < 0)
@@ skipping 15 matching lines @@
   var num_c = end_i - start_i;
   if (num_c < 0)
     num_c = 0;
 
   return SubString(s, start_i, start_i + num_c);
 }
 
 
 // ECMA-262 section 15.5.4.14
 function StringSplit(separator, limit) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["split"]);
+  }
   var subject = TO_STRING_INLINE(this);
   limit = (IS_UNDEFINED(limit)) ? 0xffffffff : TO_UINT32(limit);
   if (limit === 0) return [];
 
   // ECMA-262 says that if separator is undefined, the result should
   // be an array of size 1 containing the entire string.  SpiderMonkey
   // and KJS have this behavior only when no separator is given.  If
   // undefined is explicitly given, they convert it to a string and
   // use that.  We do as SpiderMonkey and KJS.
   if (%_ArgumentsLength() === 0) {
@@ skipping 73 matching lines @@
     }
 
     startIndex = currentIndex = endIndex;
   }
   return result;
 }
 
 
 // ECMA-262 section 15.5.4.15
 function StringSubstring(start, end) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["subString"]);
+  }
   var s = TO_STRING_INLINE(this);
   var s_len = s.length;
 
   var start_i = TO_INTEGER(start);
   if (start_i < 0) {
     start_i = 0;
   } else if (start_i > s_len) {
     start_i = s_len;
   }
 
@@ skipping 13 matching lines @@
   }
 
   return (start_i + 1 == end_i
           ? %_StringCharAt(s, start_i)
           : %_SubString(s, start_i, end_i));
 }
 
 
 // This is not a part of ECMA-262.
 function StringSubstr(start, n) {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["substr"]);
+  }
   var s = TO_STRING_INLINE(this);
   var len;
 
   // Correct n: If not given, set to string length; if explicitly
   // set to undefined, zero, or negative, returns empty string.
   if (n === void 0) {
     len = s.length;
   } else {
     len = TO_INTEGER(n);
     if (len <= 0) return '';
@@ skipping 20 matching lines @@
   if (end > s.length) end = s.length;
 
   return (start + 1 == end
           ? %_StringCharAt(s, start)
           : %_SubString(s, start, end));
 }
 
 
 // ECMA-262, 15.5.4.16
 function StringToLowerCase() {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["toLowerCase"]);
+  }
   return %StringToLowerCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.17
 function StringToLocaleLowerCase() {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["toLocaleLowerCase"]);
+  }
   return %StringToLowerCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.18
 function StringToUpperCase() {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["toUpperCase"]);
+  }
   return %StringToUpperCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.19
 function StringToLocaleUpperCase() {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["toLocaleUpperCase"]);
+  }
   return %StringToUpperCase(TO_STRING_INLINE(this));
 }
 
 // ES5, 15.5.4.20
 function StringTrim() {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["trim"]);
+  }
   return %StringTrim(TO_STRING_INLINE(this), true, true);
 }
 
 function StringTrimLeft() {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["trimLeft"]);
+  }
   return %StringTrim(TO_STRING_INLINE(this), true, false);
 }
 
 function StringTrimRight() {
+  if (IS_NULL_OR_UNDEFINED(this)) {
+    throw MakeTypeError("obj_ctor_property_non_object", ["trimRight"]);
+  }
+
   return %StringTrim(TO_STRING_INLINE(this), false, true);
 }
 
 var static_charcode_array = new InternalArray(4);
 
 // ECMA-262, section 15.5.3.2
 function StringFromCharCode(code) {
   var n = %_ArgumentsLength();
   if (n == 1) {
     if (!%_IsSmi(code)) code = ToNumber(code);
@@ skipping 176 matching lines @@
     "italics", StringItalics,
     "small", StringSmall,
     "strike", StringStrike,
     "sub", StringSub,
     "sup", StringSup
   ));
 }
 
 
 SetupString();