[proxies] Correctly handle proxies in Function.prototype.bind

src/js/v8natives.js

Index: src/js/v8natives.js
diff --git a/src/js/v8natives.js b/src/js/v8natives.js
index 0003f9f5096d51e34ecfaf2ee2be8951eb75f060..28ebdfab6b8471ad3f9d84d31cc07b1f0e84d9e1 100644
--- a/src/js/v8natives.js
+++ b/src/js/v8natives.js
@@ -1302,9 +1302,7 @@ function FunctionToString() {
 }
 
 
-// ES5 15.3.4.5
 // ES6 9.2.3.2 Function.prototype.bind(thisArg , ...args)
-// TODO(cbruni): check again and remove FunctionProxies section further down
 function FunctionBind(this_arg) { // Length is 1.
   if (!IS_CALLABLE(this)) throw MakeTypeError(kFunctionBind);
 
@@ -1337,15 +1335,16 @@ function FunctionBind(this_arg) { // Length is 1.
   };
 
   var new_length = 0;
-  var old_length = this.length;
-  // FunctionProxies might provide a non-UInt32 value. If so, ignore it.
-  if ((typeof old_length === "number") &&
-      ((old_length >>> 0) === old_length)) {
-    var argc = %_ArgumentsLength();
-    if (argc > 0) argc--;  // Don't count the thisArg as parameter.
-    new_length = old_length - argc;
-    if (new_length < 0) new_length = 0;
+  if (ObjectGetOwnPropertyDescriptor(this, "length") !== UNDEFINED) {
+    var old_length = this.length;
+    if (IS_NUMBER(old_length)) {
+      var argc = %_ArgumentsLength();
+      if (argc > 0) argc--;  // Don't count the thisArg as parameter.
+      new_length = TO_INTEGER(old_length) - argc;
+      if (new_length < 0) new_length = 0;
+    }
   }
+
   // This runtime function finds any remaining arguments on the stack,
   // so we don't pass the arguments object.
   var result = %FunctionBindArguments(boundFunction, this,