| Index: src/runtime.js | 
| diff --git a/src/runtime.js b/src/runtime.js | 
| index fff0884df00054dfba016bd7d9f5e32c81e42e93..e4cb4ff312a86f8e09e757ec4114d2a9f7b48d49 100644 | 
| --- a/src/runtime.js | 
| +++ b/src/runtime.js | 
| @@ -418,7 +418,7 @@ function APPLY_PREPARE(args) { | 
| // that takes care of more eventualities. | 
| if (IS_ARRAY(args)) { | 
| length = args.length; | 
| -    if (%_IsSmi(length) && length >= 0 && length < 0x800000 && | 
| +    if (%_IsSmi(length) && length >= 0 && length < kSafeArgumentsLength && | 
| IS_SPEC_FUNCTION(this)) { | 
| return length; | 
| } | 
| @@ -429,7 +429,7 @@ function APPLY_PREPARE(args) { | 
| // We can handle any number of apply arguments if the stack is | 
| // big enough, but sanity check the value to avoid overflow when | 
| // multiplying with pointer size. | 
| -  if (length > 0x800000) { | 
| +  if (length > kSafeArgumentsLength) { | 
| throw %MakeRangeError('stack_overflow', []); | 
| } | 
|  | 
| @@ -449,6 +449,93 @@ function APPLY_PREPARE(args) { | 
| } | 
|  | 
|  | 
| +function REFLECT_APPLY_PREPARE(args) { | 
| +  var length; | 
| +  // First check whether length is a positive Smi and args is an | 
| +  // array. This is the fast case. If this fails, we do the slow case | 
| +  // that takes care of more eventualities. | 
| +  if (IS_ARRAY(args)) { | 
| +    length = args.length; | 
| +    if (%_IsSmi(length) && length >= 0 && length < kSafeArgumentsLength && | 
| +        IS_SPEC_FUNCTION(this)) { | 
| +      return length; | 
| +    } | 
| +  } | 
| + | 
| +  if (!IS_SPEC_FUNCTION(this)) { | 
| +    throw %MakeTypeError('called_non_callable', [ %ToString(this) ]); | 
| +  } | 
| + | 
| +  if (!IS_SPEC_OBJECT(args)) { | 
| +    throw %MakeTypeError('reflect_apply_wrong_args', [ ]); | 
| +  } | 
| + | 
| +  length = %ToLength(args.length); | 
| + | 
| +  // We can handle any number of apply arguments if the stack is | 
| +  // big enough, but sanity check the value to avoid overflow when | 
| +  // multiplying with pointer size. | 
| +  if (length > kSafeArgumentsLength) { | 
| +    throw %MakeRangeError('stack_overflow', []); | 
| +  } | 
| + | 
| +  // Return the length which is the number of arguments to copy to the | 
| +  // stack. It is guaranteed to be a small integer at this point. | 
| +  return length; | 
| +} | 
| + | 
| + | 
| +function REFLECT_CONSTRUCT_PREPARE(args, newTarget) { | 
| +  var length; | 
| +  var ctorOk = IS_SPEC_FUNCTION(this) && %IsConstructor(this); | 
| +  var newTargetOk = IS_SPEC_FUNCTION(newTarget) && %IsConstructor(newTarget); | 
| + | 
| +  // First check whether length is a positive Smi and args is an | 
| +  // array. This is the fast case. If this fails, we do the slow case | 
| +  // that takes care of more eventualities. | 
| +  if (IS_ARRAY(args)) { | 
| +    length = args.length; | 
| +    if (%_IsSmi(length) && length >= 0 && length < kSafeArgumentsLength && | 
| +        ctorOk && newTargetOk) { | 
| +      return length; | 
| +    } | 
| +  } | 
| + | 
| +  if (!ctorOk) { | 
| +    if (!IS_SPEC_FUNCTION(this)) { | 
| +      throw %MakeTypeError('called_non_callable', [ %ToString(this) ]); | 
| +    } else { | 
| +      throw %MakeTypeError('not_constructor', [ %ToString(this) ]); | 
| +    } | 
| +  } | 
| + | 
| +  if (!newTargetOk) { | 
| +    if (!IS_SPEC_FUNCTION(newTarget)) { | 
| +      throw %MakeTypeError('called_non_callable', [ %ToString(newTarget) ]); | 
| +    } else { | 
| +      throw %MakeTypeError('not_constructor', [ %ToString(newTarget) ]); | 
| +    } | 
| +  } | 
| + | 
| +  if (!IS_SPEC_OBJECT(args)) { | 
| +    throw %MakeTypeError('reflect_construct_wrong_args', [ ]); | 
| +  } | 
| + | 
| +  length = %ToLength(args.length); | 
| + | 
| +  // We can handle any number of apply arguments if the stack is | 
| +  // big enough, but sanity check the value to avoid overflow when | 
| +  // multiplying with pointer size. | 
| +  if (length > kSafeArgumentsLength) { | 
| +    throw %MakeRangeError('stack_overflow', []); | 
| +  } | 
| + | 
| +  // Return the length which is the number of arguments to copy to the | 
| +  // stack. It is guaranteed to be a small integer at this point. | 
| +  return length; | 
| +} | 
| + | 
| + | 
| function STACK_OVERFLOW(length) { | 
| throw %MakeRangeError('stack_overflow', []); | 
| } | 
|  |