Fix issues with name and length on poison pill function

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/api-natives.h"
 #include "src/code-stubs.h"
 #include "src/extensions/externalize-string-extension.h"
@@ skipping 278 matching lines @@
   Isolate* isolate_;
   Handle<Context> result_;
   Handle<Context> native_context_;
 
   // Function maps. Function maps are created initially with a read only
   // prototype for the processing of JS builtins. Later the function maps are
   // replaced in order to make prototype writable. These are the final, writable
   // prototype, maps.
   Handle<Map> sloppy_function_map_writable_prototype_;
   Handle<Map> strict_function_map_writable_prototype_;
-  Handle<JSFunction> strict_poison_function;
+  Handle<JSFunction> strict_poison_function_;
   Handle<JSFunction> generator_poison_function;
 
   BootstrapperActive active_;
   friend class Bootstrapper;
 };
 
 
 void Bootstrapper::Iterate(ObjectVisitor* v) {
   extensions_cache_.Iterate(v);
   v->Synchronize(VisitorSynchronization::kExtensions);
@@ skipping 297 matching lines @@
   Handle<AccessorInfo> name =
       Accessors::FunctionNameInfo(isolate(), ro_attribs);
   {  // Add name.
     AccessorConstantDescriptor d(Handle<Name>(Name::cast(name->name())), name,
                                  ro_attribs);
     map->AppendDescriptor(&d);
   }
 }
 
 
-// ECMAScript 5th Edition, 13.2.3
+// ECMAScript 6th Edition, 9.2.7.1
 Handle<JSFunction> Genesis::GetStrictPoisonFunction() {
-  if (strict_poison_function.is_null()) {
+  if (strict_poison_function_.is_null()) {
     Handle<String> name = factory()->InternalizeOneByteString(
         STATIC_CHAR_VECTOR("ThrowTypeError"));
     Handle<Code> code(isolate()->builtins()->builtin(
         Builtins::kStrictModePoisonPill));
-    strict_poison_function = factory()->NewFunctionWithoutPrototype(name, code);
-    strict_poison_function->set_map(native_context()->sloppy_function_map());
-    strict_poison_function->shared()->DontAdaptArguments();
+    Handle<JSFunction> function =
+        factory()->NewFunctionWithoutPrototype(name, code);
+    function->set_map(native_context()->sloppy_function_map());
+    function->shared()->DontAdaptArguments();
 
-    JSObject::PreventExtensions(strict_poison_function).Assert();
+    // %ThrowTypeError% must not have a name property.
+    JSReceiver::DeleteProperty(function, factory()->name_string()).Assert();

[adamk, 2015/04/07 20:02:58]

So this'll put this into "slow" mode, but we don't really care since no one will
ever look at properties on this object?

[arv (Not doing code reviews), 2015/04/07 20:10:16]

Yes. But that is fine since the would have to extract the accessor and use its
properties. There is no valid reason to do that.

+
+    // length needs to be non configurable
+    LookupIterator it(function, factory()->length_string());
+    CHECK_EQ(LookupIterator::ACCESSOR, it.state());

[adamk, 2015/04/07 20:02:58]

Seems like this could be a DCHECK_EQ just as well.

[arv (Not doing code reviews), 2015/04/07 20:10:16]

It had to be CHECK before when I was using lower level primitives. I'll change
it (if it works).

+    DCHECK(it.HolderIsReceiverOrHiddenPrototype());
+    Handle<Object> value(Smi::FromInt(function->shared()->length()), isolate());
+    JSObject::SetOwnPropertyIgnoreAttributes(

[adamk, 2015/04/07 20:02:57]

So does this end up getting rid of the accessor? But it's OK because it will
never change?

[arv (Not doing code reviews), 2015/04/07 20:10:16]

Yes. But let me expand the test to make sure that writing to it fails.

+        function, factory()->length_string(), value,
+        static_cast<PropertyAttributes>(DONT_ENUM | DONT_DELETE | READ_ONLY))
+        .Assert();
+
+    JSObject::PreventExtensions(function).Assert();
+
+    strict_poison_function_ = function;
   }
-  return strict_poison_function;
+  return strict_poison_function_;
 }
 
 
 Handle<JSFunction> Genesis::GetGeneratorPoisonFunction() {
   if (generator_poison_function.is_null()) {
     Handle<String> name = factory()->InternalizeOneByteString(
         STATIC_CHAR_VECTOR("ThrowTypeError"));
     Handle<Code> code(isolate()->builtins()->builtin(
         Builtins::kGeneratorPoisonPill));
     generator_poison_function = factory()->NewFunctionWithoutPrototype(
@@ skipping 2322 matching lines @@
   return from + sizeof(NestingCounterType);
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 } }  // namespace v8::internal