Implement Function.prototype.toMethod.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 307bcbf13cdc539eaf041e835fa97910e0caa34c..1c2ecf040375e5b23b83e58571878be8c8407058 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9396,6 +9396,54 @@ void JSFunction::MarkInOptimizationQueue() {
 }
 
 
+Handle<JSFunction> JSFunction::Copy(Handle<JSFunction> function) {
+  Isolate* isolate = function->GetIsolate();
+  Handle<Map> map(function->map());
+  Handle<SharedFunctionInfo> shared(function->shared());
+  Handle<Context> context(function->context());
+  Handle<JSFunction> clone =
+    isolate->factory()->NewFunctionWithMapFromSharedFunctionInfo(
+        map, shared, context);
+
+  if (shared->bound()) {
+    clone->set_function_bindings(function->function_bindings());
+  }
+
+  clone->set_properties(

[arv (Not doing code reviews), 2014/08/20 15:35:53]

For F.p.toMethod we should not copy the properties. However if we use private
own property for the [[HomeObject]] we need to at least handle that.

+      *isolate->factory()->NewFixedArray(function->properties()->length()));
+
+  Handle<FixedArrayBase> original_elements(function->elements());

[Toon Verwaest, 2014/08/20 07:43:11]

Use the ElementsAccessor Copy method instead.

+  if (original_elements->length() > 0) {
+    if (original_elements->IsFixedArray()) {
+      clone->set_elements(*isolate->factory()->CopyFixedArray(
+            Handle<FixedArray>::cast(original_elements)));
+    } else if (original_elements->IsFixedDoubleArray()) {
+      clone->set_elements(*isolate->factory()->CopyFixedDoubleArray(
+            Handle<FixedDoubleArray>::cast(original_elements)));
+    } else {
+      CHECK(false);
+    }
+  }
+
+
+  Handle<DescriptorArray> descriptors(map->instance_descriptors());
+  for (int i = 0; i < map->NumberOfOwnDescriptors(); i++) {
+    Handle<Name> name(descriptors->GetKey(i));
+    PropertyDetails details(descriptors->GetDetails(i));
+    if (details.type() == NORMAL || details.type() == FIELD) {

[Toon Verwaest, 2014/08/20 07:43:11]

NORMAL is not a valid entry for descriptors. Only FIELD needs to be copied.
We should better separate those ...

That also indicates though that if your function is in dictionary mode, you
don't copy anything from the backing store. Hence you'll lose all your
properties. For fast mode you copy them. Please add a test that normalizes the
function before binding. (The runtime function to turn something into dictionary
mode is called %OptimizeObjectForAddingMultipleProperties).

What about having separate methods to copy named and indexed properties,
extracted from the regular object copying mechanism?

+      Handle<Object> value =
+        Object::GetProperty(function, name).ToHandleChecked();
+      JSObject::SetOwnPropertyIgnoreAttributes(
+          clone,
+          name,
+          value,
+          details.attributes()).Assert();
+    }
+  }
+  return clone;
+}
+
+
 void SharedFunctionInfo::AddToOptimizedCodeMap(
     Handle<SharedFunctionInfo> shared,
     Handle<Context> native_context,