[proxies] throw TypeError in [[Call]] if is_callable Map bit is unset

src/runtime/runtime-proxy.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/runtime/runtime-utils.h"
 
 #include "src/arguments.h"
 #include "src/elements.h"
 #include "src/factory.h"
 #include "src/isolate-inl.h"
 #include "src/objects-inl.h"
 
 namespace v8 {
 namespace internal {
 
 
 // ES6 9.5.13 [[Call]] (thisArgument, argumentsList)
 RUNTIME_FUNCTION(Runtime_JSProxyCall) {
   HandleScope scope(isolate);
   DCHECK_LE(2, args.length());
   // thisArgument == receiver
   CONVERT_ARG_HANDLE_CHECKED(Object, receiver, 0);
   CONVERT_ARG_HANDLE_CHECKED(JSProxy, proxy, args.length() - 1);
+
+  if (V8_UNLIKELY(!proxy->target()->IsCallable())) {
+    // TODO(caitp): Remove when handled in compiler/backends/builtins
+    Handle<String> callsite = Runtime::RenderCallSite(isolate, proxy);
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kCalledNonCallable, callsite));

[Camillo Bruni, 2016/03/02 17:41:03]

Would you mind fixing it directly in PLATFORM/builtins-PLATFORM.cc Generate_Call
should be fairly straight forward?
This solution will probably throw in the wrong context...

[caitp (gmail), 2016/03/02 18:26:57]

Done, with ports for ia32, x64, arm and arm64

+  }
+
   Handle<String> trap_name = isolate->factory()->apply_string();
   // 1. Let handler be the value of the [[ProxyHandler]] internal slot of O.
   Handle<Object> handler(proxy->handler(), isolate);
   // 2. If handler is null, throw a TypeError exception.
   if (proxy->IsRevoked()) {
     THROW_NEW_ERROR_RETURN_FAILURE(
         isolate, NewTypeError(MessageTemplate::kProxyRevoked, trap_name));
   }
   // 3. Assert: Type(handler) is Object.
   DCHECK(handler->IsJSReceiver());
@@ skipping 132 matching lines @@
 RUNTIME_FUNCTION(Runtime_JSProxyRevoke) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 1);
   CONVERT_ARG_HANDLE_CHECKED(JSProxy, proxy, 0);
   JSProxy::Revoke(proxy);
   return isolate->heap()->undefined_value();
 }
 
 }  // namespace internal
 }  // namespace v8