Set the current context to the function's context when entering to LAP.

src/x64/code-stubs-x64.cc

Index: src/x64/code-stubs-x64.cc
diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index fc080f4c4cc2fc63abbf122d7d4f4e23b903892d..4e95a1ffb56679ffdfd8d743020402fddf470f6a 100644
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -2836,15 +2836,20 @@ void CallApiCallbackStub::Generate(MacroAssembler* masm) {
   // holder
   __ Push(holder);
 
-  __ movp(scratch, rsp);
-  // Push return address back on stack.
-  __ PushReturnAddressFrom(return_address);
-
-  if (!this->is_lazy()) {
+  if (this->is_lazy()) {
+    // load context from holder
+    __ movp(scratch, FieldOperand(holder, HeapObject::kMapOffset));

[Yuki, 2017/03/28 14:16:58]

|holder| seems pointing to the receiver object instead of the prototype object. 
Is this expected?

I'd like to get the prototype object's creation context.  But, I'm not sure how
to get it...

NamedLoadHandlerCompiler::CompileLoadCallback() seems having |holder|, which is
passed to GenerateApiAccessorCall as |accessor_holder|.
https://cs.chromium.org/chromium/src/v8/src/ic/handler-compiler.cc?rcl=9e60c6...

PropertyHandlerCompiler::GenerateApiAccessorCall() seems looking up a holder,
but the result is CallOptimization::kHolderIsReceiver.
https://cs.chromium.org/chromium/src/v8/src/ic/x64/handler-compiler-x64.cc?rc...

Do you have any clues?

[jochen (gone - plz use gerrit), 2017/03/28 14:43:39]

is that only the case for your test? In that case, I think you need to install a
signature on the accessor

[Yuki, 2017/03/29 14:19:41]

I only tested with the new unittest.  I installed the signature on the accessor
(in PS5), but no luck.  It still fails.

By the way, in Blink, info.Holder() points to the receiver object instead of the
prototype object.  Is |holder| here equivalent to
FunctionCallbackInfo::Holder(), or a different thing?

+    __ GetMapConstructor(scratch, scratch, context);
+    __ movp(context, FieldOperand(scratch, JSFunction::kContextOffset));
+  } else {
     // load context from callee
     __ movp(context, FieldOperand(callee, JSFunction::kContextOffset));
   }
 
+  __ movp(scratch, rsp);
+  // Push return address back on stack.
+  __ PushReturnAddressFrom(return_address);
+
   // Allocate the v8::Arguments structure in the arguments' space since
   // it's not controlled by GC.
   const int kApiStackSpace = 3;