Implement function proxies (except for their use as constructors).

Implement function proxies (except for their use as constructors).

Introduce new %Apply native.

Extend Execution::Call to optionally handle receiver rewriting (needed for %Apply).

Fix Function.prototype.bind for functions that have .apply modified.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Committed: http://code.google.com/p/v8/source/detail?r=9258

[rossberg, 2011-08-31 15:27:12]

I uploaded a patch that introduces a new IS_SPEC_FUNCTION predicate instead of
hacking IS_FUNCTION (which is used in a few places to check for actual
JSFunctions).

[Kevin Millikin (Chromium), 2011-09-08 17:30:40]

Whew.  OK, the only issue is Function.prototype.apply in the JS builtins.  I
think you'll need a runtime function to help with that one.

http://codereview.chromium.org/7623011/diff/6001/src/ia32/builtins-ia32.cc
File src/ia32/builtins-ia32.cc (right):

http://codereview.chromium.org/7623011/diff/6001/src/ia32/builtins-ia32.cc#ne...
src/ia32/builtins-ia32.cc:705: __ pop(edx);
This is return address, right?  It needs a // return address. comment.

http://codereview.chromium.org/7623011/diff/6001/src/ia32/builtins-ia32.cc#ne...
src/ia32/builtins-ia32.cc:780: __ mov(ebx, Operand(ebp, 3 * kPointerSize));
I guess you should name '3' and '4' in this code since you're changing it.

http://codereview.chromium.org/7623011/diff/6001/src/runtime.cc
File src/runtime.cc (right):

http://codereview.chromium.org/7623011/diff/6001/src/runtime.cc#newcode639
src/runtime.cc:639: ? isolate->heap()->true_value() :
isolate->heap()->false_value();
return isolate->heap()->ToBoolean(obj->IsJSFunctionProxy());

http://codereview.chromium.org/7623011/diff/6001/src/runtime.js
File src/runtime.js (right):

http://codereview.chromium.org/7623011/diff/6001/src/runtime.js#newcode408
src/runtime.js:408: if (%IsJSFunctionProxy(this)) {
Can we get into this case, where CALL_NON_FUNCTION is invoked on a function
proxy?  If so, another design is to have %GetFunctionDelegate return the call
trap.  I don't know if that makes things simpler, or less simple, or about the
same.

http://codereview.chromium.org/7623011/diff/6001/src/runtime.js#newcode433
src/runtime.js:433: var proxy = arguments[arity];  // The proxy comes in as an
additional arg.
You can also use %_Arguments(arity) to get the arguments without allocating the
arguments object.

http://codereview.chromium.org/7623011/diff/6001/src/runtime.js#newcode437
src/runtime.js:437: return global.Function.prototype.apply.call(
You can't, the JS builtins are called with the context of their caller (and
don't depend on it).  I think you'll have to implement a runtime function to do
some of the work here.

[rossberg, 2011-09-09 17:05:30]

OK, I introduced an %Apply native function to handle it. For that, I also had to
extend Execution::Call to do receiver rewriting if necessary.

http://codereview.chromium.org/7623011/diff/6001/src/ia32/builtins-ia32.cc
File src/ia32/builtins-ia32.cc (right):

http://codereview.chromium.org/7623011/diff/6001/src/ia32/builtins-ia32.cc#ne...
src/ia32/builtins-ia32.cc:705: __ pop(edx);
On 2011/09/08 17:30:40, Kevin Millikin wrote:
> This is return address, right?  It needs a // return address. comment.

Done (here and in -x64).

http://codereview.chromium.org/7623011/diff/6001/src/ia32/builtins-ia32.cc#ne...
src/ia32/builtins-ia32.cc:780: __ mov(ebx, Operand(ebp, 3 * kPointerSize));
On 2011/09/08 17:30:40, Kevin Millikin wrote:
> I guess you should name '3' and '4' in this code since you're changing it.

Done.

http://codereview.chromium.org/7623011/diff/6001/src/runtime.cc
File src/runtime.cc (right):

http://codereview.chromium.org/7623011/diff/6001/src/runtime.cc#newcode639
src/runtime.cc:639: ? isolate->heap()->true_value() :
isolate->heap()->false_value();
On 2011/09/08 17:30:40, Kevin Millikin wrote:
> return isolate->heap()->ToBoolean(obj->IsJSFunctionProxy());

Done.

http://codereview.chromium.org/7623011/diff/6001/src/runtime.js
File src/runtime.js (right):

http://codereview.chromium.org/7623011/diff/6001/src/runtime.js#newcode408
src/runtime.js:408: if (%IsJSFunctionProxy(this)) {
On 2011/09/08 17:30:40, Kevin Millikin wrote:
> Can we get into this case, where CALL_NON_FUNCTION is invoked on a function
> proxy?  If so, another design is to have %GetFunctionDelegate return the call
> trap.  I don't know if that makes things simpler, or less simple, or about the
> same.

Done (subsuming part of change 7849021).

http://codereview.chromium.org/7623011/diff/6001/src/runtime.js#newcode433
src/runtime.js:433: var proxy = arguments[arity];  // The proxy comes in as an
additional arg.
On 2011/09/08 17:30:40, Kevin Millikin wrote:
> You can also use %_Arguments(arity) to get the arguments without allocating
the
> arguments object.

Done (although we have to materialize the arguments object anyway).

http://codereview.chromium.org/7623011/diff/6001/src/runtime.js#newcode437
src/runtime.js:437: return global.Function.prototype.apply.call(
On 2011/09/08 17:30:40, Kevin Millikin wrote:
> You can't, the JS builtins are called with the context of their caller (and
> don't depend on it).  I think you'll have to implement a runtime function to
do
> some of the work here.

I implemented an %Apply native.

[Kevin Millikin (Chromium), 2011-09-12 14:42:47]

LGTM.

http://codereview.chromium.org/7623011/diff/12001/src/execution.cc
File src/execution.cc (right):

http://codereview.chromium.org/7623011/diff/12001/src/execution.cc#newcode165
src/execution.cc:165: // Is there a way to get the proper global object if func
is a builtin?
I guess I'm not sure what is proper.  isolate()->global_context()->builtins() is
the builtins object, isolate()->global_object()->global_receiver() is the global
receiver of the current context.

http://codereview.chromium.org/7623011/diff/12001/src/execution.h
File src/execution.h (right):

http://codereview.chromium.org/7623011/diff/12001/src/execution.h#newcode58
src/execution.h:58: // and object.
"and object" ==> "an object"

[rossberg, 2011-09-12 15:17:25]

http://codereview.chromium.org/7623011/diff/12001/src/execution.cc
File src/execution.cc (right):

http://codereview.chromium.org/7623011/diff/12001/src/execution.cc#newcode165
src/execution.cc:165: // Is there a way to get the proper global object if func
is a builtin?
On 2011/09/12 14:42:47, Kevin Millikin wrote:
> I guess I'm not sure what is proper.  isolate()->global_context()->builtins()
is
> the builtins object, isolate()->global_object()->global_receiver() is the
global
> receiver of the current context.

Ah, thanks, the latter is what I was looking for, but somehow missed. Because
func->context()->global()->g_r() gives me the JSBuiltin object if func happens
to be a builtin, which would not be good (and breaks one of the tests).

Now, the only thing that still puzzles me is how that very logic is used in the
generated FunctionApply builtin without causing the same issue...

http://codereview.chromium.org/7623011/diff/12001/src/execution.h
File src/execution.h (right):

http://codereview.chromium.org/7623011/diff/12001/src/execution.h#newcode58
src/execution.h:58: // and object.
On 2011/09/12 14:42:47, Kevin Millikin wrote:
> "and object" ==> "an object"

Done.