[es6] Better support for built-ins subclassing.

src/ia32/builtins-ia32.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_IA32
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 262 matching lines @@
 
     // Allocate the new receiver object using the runtime call.
     // edx: original constructor
     __ bind(&rt_call);
     int offset = kPointerSize;
 
     // Must restore esi (context) and edi (constructor) before calling
     // runtime.
     __ mov(esi, Operand(ebp, StandardFrameConstants::kContextOffset));
     __ mov(edi, Operand(esp, offset));
-    __ push(edi);  // argument 2/1: constructor function
-    __ push(edx);  // argument 3/2: original constructor
+    __ push(edi);  // constructor function
+    __ push(edx);  // original constructor
     __ CallRuntime(Runtime::kNewObject, 2);
     __ mov(ebx, eax);  // store result in ebx
 
     // New object allocated.
     // ebx: newly allocated object
     __ bind(&allocated);
 
     // Restore the parameters.
     __ pop(edx);  // new.target
     __ pop(edi);  // Constructor function.
@@ skipping 1059 matching lines @@
     __ TailCallRuntime(Runtime::kSymbolDescriptiveString, 1, 1);
   }
 }
 
 
 // static
 void Builtins::Generate_StringConstructor_ConstructStub(MacroAssembler* masm) {
   // ----------- S t a t e -------------
   //  -- eax                 : number of arguments
   //  -- edi                 : constructor function
+  //  -- edx                 : original constructor
   //  -- esp[0]              : return address
   //  -- esp[(argc - n) * 4] : arg[n] (zero-based)
   //  -- esp[(argc + 1) * 4] : receiver
   // -----------------------------------
 
   // 1. Load the first argument into ebx and get rid of the rest (including the
   // receiver).
   {
     Label no_arguments, done;
     __ test(eax, eax);
     __ j(zero, &no_arguments, Label::kNear);
     __ mov(ebx, Operand(esp, eax, times_pointer_size, 0));
     __ jmp(&done, Label::kNear);
     __ bind(&no_arguments);
     __ LoadRoot(ebx, Heap::kempty_stringRootIndex);
     __ bind(&done);
     __ PopReturnAddressTo(ecx);
     __ lea(esp, Operand(esp, eax, times_pointer_size, kPointerSize));
     __ PushReturnAddressFrom(ecx);
   }
 
   // 2. Make sure ebx is a string.
   {
     Label convert, done_convert;
     __ JumpIfSmi(ebx, &convert, Label::kNear);
-    __ CmpObjectType(ebx, FIRST_NONSTRING_TYPE, edx);
+    __ CmpObjectType(ebx, FIRST_NONSTRING_TYPE, ecx);
     __ j(below, &done_convert);
     __ bind(&convert);
     {
       FrameScope scope(masm, StackFrame::INTERNAL);
       ToStringStub stub(masm->isolate());
       __ Push(edi);
+      __ Push(edx);
       __ Move(eax, ebx);
       __ CallStub(&stub);
       __ Move(ebx, eax);
+      __ Pop(edx);
       __ Pop(edi);
     }
     __ bind(&done_convert);
   }
 
   // 3. Allocate a JSValue wrapper for the string.
   {
     // ----------- S t a t e -------------
     //  -- ebx : the first argument
     //  -- edi : constructor function
+    //  -- edx : original constructor
     // -----------------------------------
 
-    Label allocate, done_allocate;
+    Label allocate, done_allocate, rt_call;
+
+    // Fall back to runtime if the original constructor and constructor differ.
+    __ cmp(edx, edi);
+    __ j(not_equal, &rt_call);
+
     __ Allocate(JSValue::kSize, eax, ecx, no_reg, &allocate, TAG_OBJECT);
     __ bind(&done_allocate);
 
     // Initialize the JSValue in eax.
     __ LoadGlobalFunctionInitialMap(edi, ecx);
     __ mov(FieldOperand(eax, HeapObject::kMapOffset), ecx);
     __ mov(FieldOperand(eax, JSObject::kPropertiesOffset),
            masm->isolate()->factory()->empty_fixed_array());
     __ mov(FieldOperand(eax, JSObject::kElementsOffset),
            masm->isolate()->factory()->empty_fixed_array());
     __ mov(FieldOperand(eax, JSValue::kValueOffset), ebx);
     STATIC_ASSERT(JSValue::kSize == 4 * kPointerSize);
     __ Ret();
 
     // Fallback to the runtime to allocate in new space.
     __ bind(&allocate);
     {
       FrameScope scope(masm, StackFrame::INTERNAL);
       __ Push(ebx);
       __ Push(edi);
       __ Push(Smi::FromInt(JSValue::kSize));
       __ CallRuntime(Runtime::kAllocateInNewSpace, 1);
       __ Pop(edi);
       __ Pop(ebx);
     }
     __ jmp(&done_allocate);
+
+    // Fallback to the runtime to create new object.
+    __ bind(&rt_call);
+    {
+      FrameScope scope(masm, StackFrame::INTERNAL);
+      __ Push(ebx);
+      __ Push(edi);
+      __ Push(edi);  // constructor function
+      __ Push(edx);  // original constructor
+      __ CallRuntime(Runtime::kNewObject, 2);
+      __ Pop(edi);
+      __ Pop(ebx);
+    }
+    __ mov(FieldOperand(eax, JSValue::kValueOffset), ebx);
+    __ Ret();
   }
 }
 
 
 static void ArgumentsAdaptorStackCheck(MacroAssembler* masm,
                                        Label* stack_overflow) {
   // ----------- S t a t e -------------
   //  -- eax : actual number of arguments
   //  -- ebx : expected number of arguments
   //  -- edi : function (passed through to callee)
@@ skipping 450 matching lines @@
 
   __ bind(&ok);
   __ ret(0);
 }
 
 #undef __
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_IA32