[builtins] Sanitize receiver patching for API functions.

src/x64/builtins-x64.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if V8_TARGET_ARCH_X64
 
 #include "src/code-factory.h"
 #include "src/codegen.h"
 #include "src/deoptimizer.h"
 #include "src/full-codegen/full-codegen.h"
@@ skipping 2314 matching lines @@
 
 static void CompatibleReceiverCheck(MacroAssembler* masm, Register receiver,
                                     Register function_template_info,
                                     Register scratch0, Register scratch1,
                                     Register scratch2,
                                     Label* receiver_check_failed) {
   Register signature = scratch0;
   Register map = scratch1;
   Register constructor = scratch2;
 
-  // If the receiver is not an object, jump to receiver_check_failed.
-  __ CmpObjectType(receiver, FIRST_JS_OBJECT_TYPE, kScratchRegister);
-  __ j(below, receiver_check_failed);
-
   // If there is no signature, return the holder.
   __ movp(signature, FieldOperand(function_template_info,
                                   FunctionTemplateInfo::kSignatureOffset));
   __ CompareRoot(signature, Heap::kUndefinedValueRootIndex);
   Label receiver_check_passed;
   __ j(equal, &receiver_check_passed, Label::kNear);
 
   // Walk the prototype chain.
   Label prototype_loop_start;
   __ bind(&prototype_loop_start);
@@ skipping 52 matching lines @@
   //  -- rdi                : callee
   //  -- rsi                : context
   //  -- rsp[0]             : return address
   //  -- rsp[8]             : last argument
   //  -- ...
   //  -- rsp[rax * 8]       : first argument
   //  -- rsp[(rax + 1) * 8] : receiver
   // -----------------------------------
 
   StackArgumentsAccessor args(rsp, rax);
-  __ movp(rcx, args.GetReceiverOperand());
-
-  // Update the receiver if this is a contextual call.
-  Label set_global_proxy, valid_receiver;
-  __ CompareRoot(rcx, Heap::kUndefinedValueRootIndex);
-  __ j(equal, &set_global_proxy);
-  __ bind(&valid_receiver);
 
   // Load the FunctionTemplateInfo.
   __ movp(rbx, FieldOperand(rdi, JSFunction::kSharedFunctionInfoOffset));
   __ movp(rbx, FieldOperand(rbx, SharedFunctionInfo::kFunctionDataOffset));
 
   // Do the compatible receiver check.
   Label receiver_check_failed;
+  __ movp(rcx, args.GetReceiverOperand());
   CompatibleReceiverCheck(masm, rcx, rbx, rdx, r8, r9, &receiver_check_failed);
 
   // Get the callback offset from the FunctionTemplateInfo, and jump to the
   // beginning of the code.
   __ movp(rdx, FieldOperand(rbx, FunctionTemplateInfo::kCallCodeOffset));
   __ movp(rdx, FieldOperand(rdx, CallHandlerInfo::kFastHandlerOffset));
   __ addp(rdx, Immediate(Code::kHeaderSize - kHeapObjectTag));
   __ jmp(rdx);
 
-  __ bind(&set_global_proxy);
-  __ movp(rcx, NativeContextOperand());
-  __ movp(rcx, ContextOperand(rcx, Context::GLOBAL_PROXY_INDEX));
-  __ movp(args.GetReceiverOperand(), rcx);
-  __ jmp(&valid_receiver, Label::kNear);
-
   // Compatible receiver check failed: pop return address, arguments and
   // receiver and throw an Illegal Invocation exception.
   __ bind(&receiver_check_failed);
   __ PopReturnAddressTo(rbx);
   __ leap(rax, Operand(rax, times_pointer_size, 1 * kPointerSize));
   __ addp(rsp, rax);
   __ PushReturnAddressFrom(rbx);
   {
     FrameScope scope(masm, StackFrame::INTERNAL);
     __ TailCallRuntime(Runtime::kThrowIllegalInvocation);
@@ skipping 53 matching lines @@
   __ ret(0);
 }
 
 
 #undef __
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_TARGET_ARCH_X64