[turbofan] Implement the implicit ToObject for property access.

src/compiler/js-native-context-specialization.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/js-native-context-specialization.h"
 
 #include "src/accessors.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
@@ skipping 16 matching lines @@
 
 
 JSNativeContextSpecialization::JSNativeContextSpecialization(
     Editor* editor, JSGraph* jsgraph, Flags flags,
     Handle<GlobalObject> global_object, CompilationDependencies* dependencies,
     Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
       flags_(flags),
       global_object_(global_object),
+      native_context_(global_object->native_context(), isolate()),
       dependencies_(dependencies),
       zone_(zone) {}
 
 
 Reduction JSNativeContextSpecialization::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kJSLoadGlobal:
       return ReduceJSLoadGlobal(node);
     case IrOpcode::kJSStoreGlobal:
       return ReduceJSStoreGlobal(node);
@@ skipping 381 matching lines @@
 
     // Don't search on the prototype chain for special indices in case of
     // integer indexed exotic objects (see ES6 section 9.4.5).
     if (map->IsJSTypedArrayMap() && name->IsString() &&
         IsSpecialIndex(isolate()->unicode_cache(), String::cast(*name))) {
       break;
     }
 
     // Walk up the prototype chain.
     if (!map->prototype()->IsJSObject()) {
-      // TODO(bmeurer): Handle the not found case if the prototype is null.
-      break;
+      // Perform the implicit ToObject for primitives here.
+      // Implemented according to ES6 section 7.3.2 GetV (V, P).
+      Handle<JSFunction> constructor;
+      if (Map::GetConstructorFunction(map, native_context())
+              .ToHandle(&constructor)) {
+        map = handle(constructor->initial_map(), isolate());
+        DCHECK(map->prototype()->IsJSObject());
+      } else {
+        // TODO(bmeurer): Handle the not found case if the prototype is null.
+        break;
+      }
     }
     Handle<JSObject> map_prototype(JSObject::cast(map->prototype()), isolate());
     if (map_prototype->map()->is_deprecated()) {
       // Try to migrate the prototype object so we don't embed the deprecated
       // map into the optimized code.
       JSObject::TryMigrateInstance(map_prototype);
     }
     map = handle(map_prototype->map(), isolate());
     holder = map_prototype;
   }
@@ skipping 436 matching lines @@
   result->immutable = IsImmutableVariableMode(lookup_result.mode);
   result->index = lookup_result.slot_index;
   return true;
 }
 
 
 void JSNativeContextSpecialization::AssumePrototypesStable(
     Type* receiver_type, Handle<JSObject> holder) {
   // Determine actual holder and perform prototype chain checks.
   for (auto i = receiver_type->Classes(); !i.Done(); i.Advance()) {
-    Handle<Map> const map = i.Current();
+    Handle<Map> map = i.Current();
+    // Perform the implicit ToObject for primitives here.
+    // Implemented according to ES6 section 7.3.2 GetV (V, P).
+    Handle<JSFunction> constructor;
+    if (Map::GetConstructorFunction(map, native_context())
+            .ToHandle(&constructor)) {
+      map = handle(constructor->initial_map(), isolate());
+    }
     for (PrototypeIterator j(map);; j.Advance()) {
       // Check that the {prototype} still has the same map.  All prototype
       // maps are guaranteed to be stable, so it's sufficient to add a
       // stability dependency here.
       Handle<JSReceiver> const prototype =
           PrototypeIterator::GetCurrent<JSReceiver>(j);
       dependencies()->AssumeMapStable(handle(prototype->map(), isolate()));
       // Stop once we get to the holder.
       if (prototype.is_identical_to(holder)) break;
     }
@@ skipping 31 matching lines @@
 }
 
 
 SimplifiedOperatorBuilder* JSNativeContextSpecialization::simplified() const {
   return jsgraph()->simplified();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8