[stubs] Port FastFunctionBindStub to TF

[stubs] Port FastFunctionBindStub to TF

BUG=chromium:608675
LOG=N

Committed: https://crrev.com/2b991784a4b7d212bc92e31f0da3e48603da1180
Cr-Commit-Position: refs/heads/master@{#41439}

[danno, 2016-12-01 07:19:41]

The CQ bit was checked by danno@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-01 07:19:50]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-01 07:21:21]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-01 07:21:22]

Dry run: Try jobs failed on following builders:
  v8_android_arm_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_android_arm_compile_rel/...)
  v8_linux64_asan_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng/buil...)
  v8_linux64_avx2_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_avx2_rel_ng/buil...)
  v8_linux64_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_rel_ng/builds/17119)
  v8_linux_arm64_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_arm64_rel_ng/build...)
  v8_linux_dbg_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_dbg_ng/builds/17173)
  v8_linux_gcc_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_gcc_compile_rel/bu...)
  v8_linux_mips64el_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_mips64el_compile_r...)
  v8_linux_nodcheck_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_nodcheck_rel_ng/bu...)
  v8_linux_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_rel_ng/builds/17086)
  v8_presubmit on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_presubmit/builds/29717)
  v8_win_nosnap_shared_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_win_nosnap_shared_rel_ng...)

[danno, 2016-12-01 07:24:31]

The CQ bit was checked by danno@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-01 07:24:40]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-01 07:28:30]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-01 07:28:34]

Dry run: Try jobs failed on following builders:
  v8_linux64_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_rel_ng/builds/17120)

[danno, 2016-12-01 07:40:08]

The CQ bit was checked by danno@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-01 07:40:17]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-01 07:46:06]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-01 07:46:07]

Dry run: Try jobs failed on following builders:
  v8_linux64_gyp_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_gyp_rel_ng/build...)

[danno, 2016-12-01 09:41:36]

The CQ bit was checked by danno@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-01 09:41:40]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-01 10:09:14]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-01 10:09:15]

Dry run: This issue passed the CQ dry run.

[danno, 2016-12-01 10:20:10]

danno@chromium.org changed reviewers:
+ ishell@chromium.org, jkummerow@chromium.org

[danno, 2016-12-01 10:20:11]

PTAL

[Igor Sheludko, 2016-12-01 11:50:41]

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
File src/builtins/builtins-function.cc (right):

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:268: Node* argc = assembler.Parameter(1);
1) BuiltinDescriptor::kArgumentsCount?

2) argc is Int32, but the code below assumes that it's IntPtr. Probably the same
applies to all the other builtins that use BuiltinDescriptor.

Maybe CodeStubArguments should be the bottleneck which gets
BuiltinsDescriptor::kArgumentsCount parameter and converts it to intptr.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:269: Node* context = assembler.Parameter(2);
BuiltinDescriptor::kContext

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:270: Node* new_target =
assembler.Parameter(0);
BuiltinDescriptor::kNewTarget

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:293:
assembler.GotoIf(assembler.Word32Equal(test, mask_node), &slow);
You can use IsDictionaryMap(receiver_map) here. 

And FYI: we have CSA::IsSet family of helpers.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:301: CodeStubAssembler::ParameterMode mode =
assembler.OptimalParameterMode();
descriptors_length is not used anywhere else so you can just do
SmiLessThanOrEqual comparison below and avoid unnecessary untagging.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:305:
assembler.IntPtrLessThanOrEqual(descriptors_length,
I prefer to use unsigned comparisons for lengths.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:316:
assembler.Int32Constant(DescriptorArray::ToKeyIndex(length_index)));
Use IntPtrConstant() and pass INTPTR_PARAMETERS mode.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:319: maybe_length, assembler.HeapConstant(
LoadRoot

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:328: assembler.GotoIf(
GotoUnless(IsAccessorInfoMap(length_value_map), ...)

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:338:
assembler.Int32Constant(DescriptorArray::ToKeyIndex(name_index)));
Same here.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:341: maybe_name, assembler.HeapConstant(
LoadRoot.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:347:
assembler.Int32Constant(DescriptorArray::ToValueIndex(name_index)));
Same here.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:350: assembler.GotoIf(
Same here.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:364: Node* bit_field =
assembler.LoadObjectField(
LoadMapBitField

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:370:
assembler.GotoIf(assembler.Word32Equal(bits, mask_node), &with_constructor);
IsSetWord32(bit_field, mask)

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:397: assembler.IntPtrLessThanOrEqual(argc,
assembler.IntPtrConstant(1)),
I'd use unsigned comparison.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:399: Node* one = assembler.IntPtrConstant(1);
Please either use this in the whole function or inline (I'd do this).

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:410: SKIP_WRITE_BARRIER, 0,
I don't think we can skip WB here.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:419:
argument_array.Bind(assembler.LoadRoot(Heap::kEmptyFixedArrayRootIndex));
EmptyFixedArrayConstant()

BTW, feel free to add more stuff to HEAP_CONSTANT_LIST.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:431:
bound_receiver.Bind(assembler.LoadRoot(Heap::kUndefinedValueRootIndex));
UndefinedConstant()

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:443:
assembler.StoreMapNoWriteBarrier(bound_function, bound_function_map.value());
We can't skip this WB. The incremental part of the barrier should still be
triggered non-root values. 

FYI: I'm working on a CL where I'm adding SetMap which triggers map write
barrier and checking correctness of all the StoreMapNoWriteBarrier usages.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:444: assembler.StoreObjectFieldNoWriteBarrier(
We can't skip WB here.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:446:
assembler.StoreObjectFieldNoWriteBarrier(bound_function,
and here

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:449: assembler.StoreObjectFieldNoWriteBarrier(
This one we could probably skip if arguments_array is still in new space but
that's not guaranteed.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:452: Node* empty_fixed_array =
assembler.LoadRoot(Heap::kEmptyFixedArrayRootIndex);
EmptyFixedArrayConstant();

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:465: new_target, argc);
Note: this |argc| must be Int32 again.

[Igor Sheludko, 2016-12-01 13:46:07]

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
File src/builtins/builtins-function.cc (right):

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:443:
assembler.StoreMapNoWriteBarrier(bound_function, bound_function_map.value());
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> We can't skip this WB. The incremental part of the barrier should still be
> triggered non-root values. 
> 
> FYI: I'm working on a CL where I'm adding SetMap which triggers map write
> barrier and checking correctness of all the StoreMapNoWriteBarrier usages.

Please ignore this. I was wrong here...

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:444: assembler.StoreObjectFieldNoWriteBarrier(
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> We can't skip WB here.

... and here ...

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:446:
assembler.StoreObjectFieldNoWriteBarrier(bound_function,
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> and here

... and here ...

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:449: assembler.StoreObjectFieldNoWriteBarrier(
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> This one we could probably skip if arguments_array is still in new space but
> that's not guaranteed.

... and here.

[danno, 2016-12-01 15:43:33]

I think I addressed all of the review comments. Please take another look.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
File src/builtins/builtins-function.cc (right):

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:268: Node* argc = assembler.Parameter(1);
On 2016/12/01 11:50:41, Igor Sheludko wrote:
> 1) BuiltinDescriptor::kArgumentsCount?
> 
> 2) argc is Int32, but the code below assumes that it's IntPtr. Probably the
same
> applies to all the other builtins that use BuiltinDescriptor.
> 
> Maybe CodeStubArguments should be the bottleneck which gets
> BuiltinsDescriptor::kArgumentsCount parameter and converts it to intptr.
> 

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:269: Node* context = assembler.Parameter(2);
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> BuiltinDescriptor::kContext

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:270: Node* new_target =
assembler.Parameter(0);
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> BuiltinDescriptor::kNewTarget

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:293:
assembler.GotoIf(assembler.Word32Equal(test, mask_node), &slow);
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> You can use IsDictionaryMap(receiver_map) here. 
> 
> And FYI: we have CSA::IsSet family of helpers.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:301: CodeStubAssembler::ParameterMode mode =
assembler.OptimalParameterMode();
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> descriptors_length is not used anywhere else so you can just do
> SmiLessThanOrEqual comparison below and avoid unnecessary untagging.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:305:
assembler.IntPtrLessThanOrEqual(descriptors_length,
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> I prefer to use unsigned comparisons for lengths.

Acknowledged.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:316:
assembler.Int32Constant(DescriptorArray::ToKeyIndex(length_index)));
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> Use IntPtrConstant() and pass INTPTR_PARAMETERS mode.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:319: maybe_length, assembler.HeapConstant(
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> LoadRoot

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:328: assembler.GotoIf(
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> GotoUnless(IsAccessorInfoMap(length_value_map), ...)

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:338:
assembler.Int32Constant(DescriptorArray::ToKeyIndex(name_index)));
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> Same here.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:341: maybe_name, assembler.HeapConstant(
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> LoadRoot.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:347:
assembler.Int32Constant(DescriptorArray::ToValueIndex(name_index)));
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> Same here.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:350: assembler.GotoIf(
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> Same here.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:364: Node* bit_field =
assembler.LoadObjectField(
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> LoadMapBitField

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:370:
assembler.GotoIf(assembler.Word32Equal(bits, mask_node), &with_constructor);
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> IsSetWord32(bit_field, mask)

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:397: assembler.IntPtrLessThanOrEqual(argc,
assembler.IntPtrConstant(1)),
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> I'd use unsigned comparison.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:399: Node* one = assembler.IntPtrConstant(1);
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> Please either use this in the whole function or inline (I'd do this).

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:410: SKIP_WRITE_BARRIER, 0,
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> I don't think we can skip WB here.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:419:
argument_array.Bind(assembler.LoadRoot(Heap::kEmptyFixedArrayRootIndex));
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> EmptyFixedArrayConstant()
> 
> BTW, feel free to add more stuff to HEAP_CONSTANT_LIST.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:431:
bound_receiver.Bind(assembler.LoadRoot(Heap::kUndefinedValueRootIndex));
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> UndefinedConstant()

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:443:
assembler.StoreMapNoWriteBarrier(bound_function, bound_function_map.value());
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> We can't skip this WB. The incremental part of the barrier should still be
> triggered non-root values. 
> 
> FYI: I'm working on a CL where I'm adding SetMap which triggers map write
> barrier and checking correctness of all the StoreMapNoWriteBarrier usages.

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:443:
assembler.StoreMapNoWriteBarrier(bound_function, bound_function_map.value());
On 2016/12/01 13:46:07, Igor Sheludko wrote:
> On 2016/12/01 11:50:40, Igor Sheludko wrote:
> > We can't skip this WB. The incremental part of the barrier should still be
> > triggered non-root values. 
> > 
> > FYI: I'm working on a CL where I'm adding SetMap which triggers map write
> > barrier and checking correctness of all the StoreMapNoWriteBarrier usages.
> 
> Please ignore this. I was wrong here...

Acknowledged.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:446:
assembler.StoreObjectFieldNoWriteBarrier(bound_function,
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> and here

Acknowledged.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:449: assembler.StoreObjectFieldNoWriteBarrier(
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> This one we could probably skip if arguments_array is still in new space but
> that's not guaranteed.

Acknowledged.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:452: Node* empty_fixed_array =
assembler.LoadRoot(Heap::kEmptyFixedArrayRootIndex);
On 2016/12/01 11:50:40, Igor Sheludko wrote:
> EmptyFixedArrayConstant();

Done.

https://codereview.chromium.org/2532483002/diff/120001/src/builtins/builtins-...
src/builtins/builtins-function.cc:465: new_target, argc);
On 2016/12/01 11:50:39, Igor Sheludko wrote:
> Note: this |argc| must be Int32 again.

Done.

[danno, 2016-12-01 15:44:19]

The CQ bit was checked by danno@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-01 15:44:23]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-01 15:48:12]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-01 15:48:13]

Dry run: Try jobs failed on following builders:
  v8_linux64_avx2_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_avx2_rel_ng/buil...)
  v8_linux64_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_rel_ng/builds/17173)
  v8_linux_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_rel_ng/builds/17140)

[Igor Sheludko, 2016-12-01 16:17:40]

lgtm with nits:

https://codereview.chromium.org/2532483002/diff/140001/src/builtins/builtins-...
File src/builtins/builtins-function.cc (right):

https://codereview.chromium.org/2532483002/diff/140001/src/builtins/builtins-...
src/builtins/builtins-function.cc:295: assembler.LoadObjectField(receiver_map,
Map::kDescriptorsOffset);
LoadMapDescriptors()

https://codereview.chromium.org/2532483002/diff/140001/src/builtins/builtins-...
src/builtins/builtins-function.cc:308:
assembler.IntPtrConstant(DescriptorArray::ToKeyIndex(length_index)),
The cleanup CL has landed and you can now write here:
  ... = LoadFixedArrayElement(
    descriptors, DescriptorArray::ToKeyIndex(length_index));

https://codereview.chromium.org/2532483002/diff/140001/src/builtins/builtins-...
src/builtins/builtins-function.cc:357:
bound_function_map.Bind(assembler.LoadContextElement(
I think native_context is not available in this block.

[danno, 2016-12-01 17:28:45]

The CQ bit was checked by danno@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-12-01 17:28:51]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-01 18:04:02]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-12-01 18:04:03]

Dry run: This issue passed the CQ dry run.

[danno, 2016-12-01 21:12:58]

The CQ bit was checked by danno@chromium.org

[danno, 2016-12-01 21:12:58]

The patchset sent to the CQ was uploaded after l-g-t-m from ishell@chromium.org
Link to the patchset: https://codereview.chromium.org/2532483002/#ps160001
(title: "Review feedback")

[commit-bot: I haz the power, 2016-12-01 21:13:08]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-12-01 21:15:10]

CQ is committing da patch.

Bot data: {"patchset_id": 160001, "attempt_start_ts": 1480626778429860,
"parent_rev": "c94c4090b6c1f59815279a49cd0d3687f5cec534", "commit_rev":
"987ea5295e753be824ce2d34684814f59f427716"}

[commit-bot: I haz the power, 2016-12-01 21:15:19]

Committed patchset #9 (id:160001)

[commit-bot: I haz the power, 2016-12-01 21:15:57]

Description was changed from

==========
[stubs] Port FastFunctionBindStub to TF

BUG=chromium:608675
LOG=N
==========

to

==========
[stubs] Port FastFunctionBindStub to TF

BUG=chromium:608675
LOG=N

Committed: https://crrev.com/2b991784a4b7d212bc92e31f0da3e48603da1180
Cr-Commit-Position: refs/heads/master@{#41439}
==========

[commit-bot: I haz the power, 2016-12-01 21:15:59]

Patchset 9 (id:??) landed as
https://crrev.com/2b991784a4b7d212bc92e31f0da3e48603da1180
Cr-Commit-Position: refs/heads/master@{#41439}