[proxies] Correctly handle proxies in Function.prototype.bind

src/js/v8natives.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 (function(global, utils) {
 
 %CheckIsBootstrapping();
 
 // ----------------------------------------------------------------------------
 // Imports
@@ skipping 1284 matching lines @@
       : (isGenerator ? 'function* ' : 'function ');
   return head + name + source;
 }
 
 
 function FunctionToString() {
   return FunctionSourceString(this);
 }
 
 
-// ES5 15.3.4.5
 // ES6 9.2.3.2 Function.prototype.bind(thisArg , ...args)
-// TODO(cbruni): check again and remove FunctionProxies section further down
 function FunctionBind(this_arg) { // Length is 1.
   if (!IS_CALLABLE(this)) throw MakeTypeError(kFunctionBind);
 
   var boundFunction = function () {
     // Poison .arguments and .caller, but is otherwise not detectable.
     "use strict";
     // This function must not use any object literals (Object, Array, RegExp),
     // since the literals-array is being used to store the bound data.
     if (!IS_UNDEFINED(new.target)) {
       return %NewObjectFromBound(boundFunction);
@@ skipping 12 matching lines @@
     for (var i = 0; i < bound_argc; i++) {
       argv[i] = bindings[i + 2];
     }
     for (var j = 0; j < argc; j++) {
       argv[i++] = %_Arguments(j);
     }
     return %Apply(bindings[0], bindings[1], argv, 0, bound_argc + argc);
   };
 
   var new_length = 0;
-  var old_length = this.length;
-  // FunctionProxies might provide a non-UInt32 value. If so, ignore it.
-  if ((typeof old_length === "number") &&
-      ((old_length >>> 0) === old_length)) {
-    var argc = %_ArgumentsLength();
-    if (argc > 0) argc--;  // Don't count the thisArg as parameter.
-    new_length = old_length - argc;
-    if (new_length < 0) new_length = 0;
+  if (ObjectGetOwnPropertyDescriptor(this, "length") !== UNDEFINED) {
+    var old_length = this.length;
+    if (IS_NUMBER(old_length)) {
+      var argc = %_ArgumentsLength();
+      if (argc > 0) argc--;  // Don't count the thisArg as parameter.
+      new_length = TO_INTEGER(old_length) - argc;
+      if (new_length < 0) new_length = 0;
+    }
   }
+
   // This runtime function finds any remaining arguments on the stack,
   // so we don't pass the arguments object.
   var result = %FunctionBindArguments(boundFunction, this,
                                       this_arg, new_length);
 
   var name = this.name;
   var bound_name = IS_STRING(name) ? name : "";
   %DefineDataPropertyUnchecked(result, "name", "bound " + bound_name,
                                DONT_ENUM | READ_ONLY);
 
@@ skipping 93 matching lines @@
   to.ObjectIsSealed = ObjectIsSealed;
   to.ObjectKeys = ObjectKeys;
 });
 
 %InstallToContext([
   "global_eval_fun", GlobalEval,
   "object_value_of", ObjectValueOf,
 ]);
 
 })