Implement function proxies (except for their use as constructors).

src/runtime.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 347 matching lines @@
     %HasElement(x, this) : %HasProperty(x, %ToString(this));
 }
 
 
 // ECMA-262, section 11.8.6, page 54. To make the implementation more
 // efficient, the return value should be zero if the 'this' is an
 // instance of F, and non-zero if not. This makes it possible to avoid
 // an expensive ToBoolean conversion in the generated code.
 function INSTANCE_OF(F) {
   var V = this;
-  if (!IS_FUNCTION(F)) {
+  if (!IS_SPEC_FUNCTION(F)) {
     throw %MakeTypeError('instanceof_function_expected', [V]);
   }
 
   // If V is not an object, return false.
   if (!IS_SPEC_OBJECT(V)) {
     return 1;
   }
 
   // Get the prototype of F; if it is not an object, throw an error.
   var O = F.prototype;
@@ skipping 19 matching lines @@
 function FILTER_KEY(key) {
   var string = %ToString(key);
   if (%HasProperty(this, string)) return string;
   return 0;
 }
 
 
 function CALL_NON_FUNCTION() {
   var delegate = %GetFunctionDelegate(this);
   if (!IS_FUNCTION(delegate)) {
-    throw %MakeTypeError('called_non_callable', [typeof this]);
+    if (%IsJSFunctionProxy(this)) {

[Kevin Millikin (Chromium), 2011/09/08 17:30:40]

Can we get into this case, where CALL_NON_FUNCTION is invoked on a function
proxy?  If so, another design is to have %GetFunctionDelegate return the call
trap.  I don't know if that makes things simpler, or less simple, or about the
same.

[rossberg, 2011/09/09 17:05:30]

Done (subsuming part of change 7849021).

+      delegate = %GetCallTrap(this);
+    } else {
+      throw %MakeTypeError('called_non_callable', [typeof this]);
+    }
   }
   return delegate.apply(this, arguments);
 }
 
 
 function CALL_NON_FUNCTION_AS_CONSTRUCTOR() {
   var delegate = %GetConstructorDelegate(this);
   if (!IS_FUNCTION(delegate)) {
-    throw %MakeTypeError('called_non_callable', [typeof this]);
+    if (%IsJSFunctionProxy(this)) {
+      delegate = %GetConstructTrap(this);
+    } else {
+      throw %MakeTypeError('called_non_callable', [typeof this]);
+    }
   }
   return delegate.apply(this, arguments);
 }
 
 
+function CALL_FUNCTION_PROXY() {
+  var arity = %_ArgumentsLength() - 1;
+  var proxy = arguments[arity];  // The proxy comes in as an additional arg.

[Kevin Millikin (Chromium), 2011/09/08 17:30:40]

You can also use %_Arguments(arity) to get the arguments without allocating the
arguments object.

[rossberg, 2011/09/09 17:05:30]

Done (although we have to materialize the arguments object anyway).

+  var trap = %GetCallTrap(proxy);
+  // TODO(rossberg): hm, shouldn't I be using $Function and friends?
+  // But how do I get it in a builtin?
+  return global.Function.prototype.apply.call(

[Kevin Millikin (Chromium), 2011/09/08 17:30:40]

You can't, the JS builtins are called with the context of their caller (and
don't depend on it).  I think you'll have to implement a runtime function to do
some of the work here.

[rossberg, 2011/09/09 17:05:30]

I implemented an %Apply native.

+    trap, this, global.Array.prototype.slice.call(arguments, 0, arity));
+}
+
+
+function CALL_FUNCTION_PROXY_AS_CONSTRUCTOR(proxy) {
+  var trap = %GetConstructTrap(proxy);
+  var receiver = void 0;
+  if (!IS_UNDEFINED(trap)) {
+    trap = %GetCallTrap(proxy);
+    var proto = proxy.prototype;
+    if (!IS_SPEC_OBJECT(proto) && proto !== null) {
+      throw MakeTypeError("proto_object_or_null", [proto]);
+    }
+    receiver = new global.Object();
+    receiver.__proto__ = proto;
+  }
+  return global.Function.prototype.apply.call(
+    trap, this, global.Array.prototype.shift.call(arguments));
+}
+
+
 function APPLY_PREPARE(args) {
   var length;
   // First check whether length is a positive Smi and args is an
   // array. This is the fast case. If this fails, we do the slow case
   // that takes care of more eventualities.
   if (IS_ARRAY(args)) {
     length = args.length;
-    if (%_IsSmi(length) && length >= 0 && length < 0x800000 && IS_FUNCTION(this)) {
+    if (%_IsSmi(length) && length >= 0 && length < 0x800000 &&
+        IS_SPEC_FUNCTION(this)) {
       return length;
     }
   }
 
   length = (args == null) ? 0 : %ToUint32(args.length);
 
   // We can handle any number of apply arguments if the stack is
   // big enough, but sanity check the value to avoid overflow when
   // multiplying with pointer size.
   if (length > 0x800000) {
     throw %MakeRangeError('stack_overflow', []);
   }
 
-  if (!IS_FUNCTION(this)) {
+  if (!IS_SPEC_FUNCTION(this)) {
     throw %MakeTypeError('apply_non_function', [ %ToString(this), typeof this ]);
   }
 
   // Make sure the arguments list has the right type.
   if (args != null && !IS_ARRAY(args) && !IS_ARGUMENTS(args)) {
     throw %MakeTypeError('apply_wrong_args', []);
   }
 
   // Return the length which is the number of arguments to copy to the
   // stack. It is guaranteed to be a small integer at this point.
@@ skipping 147 matching lines @@
   // Even though the type of null is "object", null is still
   // considered a primitive value. IS_SPEC_OBJECT handles this correctly
   // (i.e., it will return false if x is null).
   return !IS_SPEC_OBJECT(x);
 }
 
 
 // ECMA-262, section 8.6.2.6, page 28.
 function DefaultNumber(x) {
   var valueOf = x.valueOf;
-  if (IS_FUNCTION(valueOf)) {
+  if (IS_SPEC_FUNCTION(valueOf)) {
     var v = %_CallFunction(x, valueOf);
     if (%IsPrimitive(v)) return v;
   }
 
   var toString = x.toString;
-  if (IS_FUNCTION(toString)) {
+  if (IS_SPEC_FUNCTION(toString)) {
     var s = %_CallFunction(x, toString);
     if (%IsPrimitive(s)) return s;
   }
 
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
 
 // ECMA-262, section 8.6.2.6, page 28.
 function DefaultString(x) {
   var toString = x.toString;
-  if (IS_FUNCTION(toString)) {
+  if (IS_SPEC_FUNCTION(toString)) {
     var s = %_CallFunction(x, toString);
     if (%IsPrimitive(s)) return s;
   }
 
   var valueOf = x.valueOf;
-  if (IS_FUNCTION(valueOf)) {
+  if (IS_SPEC_FUNCTION(valueOf)) {
     var v = %_CallFunction(x, valueOf);
     if (%IsPrimitive(v)) return v;
   }
 
   throw %MakeTypeError('cannot_convert_to_primitive', []);
 }
 
 
 // NOTE: Setting the prototype for Array must take place as early as
 // possible due to code generation for array literals.  When
 // generating code for a array literal a boilerplate array is created
 // that is cloned when running the code.  It is essential that the
 // boilerplate gets the right prototype.
 %FunctionSetPrototype($Array, new $Array(0));