Fix handling of this in direct calls to function proxies.

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index f54f0d79ed3acc7bf53e9de9988d81a285be3e76..279eade459ca3b18afbab0ed73dfca4324b20bd0 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -413,7 +413,7 @@ Object* CallICBase::TryCallAsFunction(Object* object) {
   Handle<Object> target(object, isolate());
   Handle<Object> delegate = Execution::GetFunctionDelegate(target);
 
-  if (delegate->IsJSFunction()) {
+  if (delegate->IsJSFunction() && !object->IsJSFunctionProxy()) {
     // Patch the receiver and use the delegate as the function to
     // invoke. This is used for invoking objects as if they were
     // functions.
@@ -430,6 +430,9 @@ Object* CallICBase::TryCallAsFunction(Object* object) {
 
 void CallICBase::ReceiverToObjectIfRequired(Handle<Object> callee,
                                             Handle<Object> object) {
+  while (callee->IsJSFunctionProxy())
+    callee = Handle<Object>(JSFunctionProxy::cast(*callee)->call_trap());

[Kevin Millikin (Chromium), 2011/10/13 14:36:40]

V8 style is braces around this body (unless it could fit on the previous line).

+
   if (callee->IsJSFunction()) {
     Handle<JSFunction> function = Handle<JSFunction>::cast(callee);
     if (function->shared()->strict_mode() || function->IsBuiltin()) {