[proxies] Correctly handle proxies in Function.prototype.bind

src/runtime/runtime-function.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/accessors.h"
 #include "src/arguments.h"
 #include "src/compiler.h"
 #include "src/deoptimizer.h"
@@ skipping 372 matching lines @@
       Handle<Object> val = Handle<Object>(frame->GetParameter(i), isolate);
       param_data[prefix_argc + i] = val;
     }
     return param_data;
   }
 }
 
 
 RUNTIME_FUNCTION(Runtime_FunctionBindArguments) {
   HandleScope scope(isolate);
-  DCHECK(args.length() == 4);
+  DCHECK(args.length() == 5);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, bound_function, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSReceiver, bindee, 1);
   CONVERT_ARG_HANDLE_CHECKED(Object, this_object, 2);
   CONVERT_NUMBER_ARG_HANDLE_CHECKED(new_length, 3);
+  CONVERT_ARG_HANDLE_CHECKED(Object, proto, 4);
 
   // TODO(lrn): Create bound function in C++ code from premade shared info.
   bound_function->shared()->set_bound(true);
   bound_function->shared()->set_optimized_code_map(
       isolate->heap()->cleared_optimized_code_map());
   bound_function->shared()->set_inferred_name(isolate->heap()->empty_string());
   bound_function->shared()->set_construct_stub(
       *isolate->builtins()->JSBuiltinsConstructStub());
   // Get all arguments of calling function (Function.prototype.bind).
   int argc = 0;
@@ skipping 31 matching lines @@
   for (int j = 0; j < argc; j++, out_index++) {
     new_bindings->set_binding(out_index, *arguments[j + 1]);
   }
   new_bindings->set_map_no_write_barrier(isolate->heap()->fixed_array_map());
   bound_function->set_function_bindings(*new_bindings);
 
   // Update length. Have to remove the prototype first so that map migration
   // is happy about the number of fields.
   RUNTIME_ASSERT(bound_function->RemovePrototype());
 
-  // The new function should have the same [[Prototype]] as the bindee.
+  // The new function should have the given prototype.
   Handle<Map> bound_function_map =
       bindee->IsConstructor()
           ? isolate->bound_function_with_constructor_map()
           : isolate->bound_function_without_constructor_map();
-  PrototypeIterator iter(isolate, bindee);
-  Handle<Object> proto = PrototypeIterator::GetCurrent(iter);
   if (bound_function_map->prototype() != *proto) {
     bound_function_map = Map::TransitionToPrototype(bound_function_map, proto,
                                                     REGULAR_PROTOTYPE);
   }
   JSObject::MigrateToMap(bound_function, bound_function_map);
   DCHECK_EQ(bindee->IsConstructor(), bound_function->IsConstructor());
 
   Handle<String> length_string = isolate->factory()->length_string();
   // These attributes must be kept in sync with how the bootstrapper
   // configures the bound_function_map retrieved above.
@@ skipping 149 matching lines @@
 
 RUNTIME_FUNCTION(Runtime_ThrowStrongModeTooFewArguments) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 0);
   THROW_NEW_ERROR_RETURN_FAILURE(isolate,
                                  NewTypeError(MessageTemplate::kStrongArity));
 }
 
 }  // namespace internal
 }  // namespace v8