Commit Graph

85 Commits

Author SHA1 Message Date
dslomov@chromium.org
f5c632b5e1 Ensure that ToPositiveInteger is optimizable.
'throw %NAME(..)' cause hydrogen optimizations to be disabled for
surrounding function. This patch rectifies.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/71153004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17832 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-18 14:07:24 +00:00
yangguo@chromium.org
b2df9bca3f Use %_IsMinusZero where applicable to replace hackery.
R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/68453005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17649 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-12 14:20:53 +00:00
yangguo@chromium.org
94eb5904a6 Fix error message wording when instanceof throws.
R=bmeurer@chromium.org
BUG=82797, v8:1593

Review URL: https://codereview.chromium.org/66463002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17587 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-11-08 11:45:56 +00:00
yangguo@chromium.org
8ef4b0ca83 Cosmetic: Add macros for NaN, undefined and Infinity to native js code.
Nobody should need to use $NaN, 0/0, 1/0 and void 0.

R=mvstanton@chromium.org
BUG=

Review URL: https://codereview.chromium.org/27491002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@17252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-10-17 10:02:45 +00:00
svenpanne@chromium.org
bc6fe88030 Desugar bitwise negation into XOR and kill all UnaryOp stuff.
R=mstarzinger@chromium.org, verwaest@chromium.org

Review URL: https://codereview.chromium.org/22184004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16073 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-06 13:34:51 +00:00
svenpanne@chromium.org
e544f130c5 Remove unused UNARY_MINUS builtin.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/22146002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@16038 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-08-05 07:00:38 +00:00
rossberg@chromium.org
929e193fc2 Tweak error message
R=yangguo@chromium.org
BUG=v8:2758

Review URL: https://codereview.chromium.org/18759002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15503 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-07-05 08:34:31 +00:00
dslomov@chromium.org
e6e0ee0708 Update typed arrays behavior to match ES6 rev 15. Remove TO_POSITIVE_INTEGER and throw on negative length arguments.
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/17572009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@15298 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-06-24 13:58:52 +00:00
rossberg@chromium.org
b449691db2 ES6 symbols: fix corner cases of equality operators
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/13552002

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14128 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-04-03 17:06:22 +00:00
rossberg@chromium.org
83d4a41dec ES6 symbols: turn symbols into a proper primitive type
(qua last week's TC39)

Specifically:
- Install Symbol constructor function on the global object.
- Adjust code generation for typeof.
- Remove IsSymbol built-in, IS_SYMBOL macro now defined using typeof.
- Remove hack that allowed symbols as constructor results, and some other special cases.
- Remove symbol_delegate and GetDelegate function.
- Extend ToBoolean stub to handle symbols.
- Extend ToNumber to return NaN on symbols.
- Poison symbol's toString function, and thereby ToString on symbols.

R=mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12957004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14051 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-22 16:33:50 +00:00
rossberg@chromium.org
5c93b18eb2 ES6 symbols: Allow symbols as property names
Since symbols and strings share a common representation, most of this change is about consistently replacing 'String' with 'Name' in all places where property names are expected. In particular, no new logic at all is necessary for maps, property dictionaries, or transitions. :) The only places where an actual case distinction is needed have to do with generated type checks, and with conversions of names to strings (especially in logger and profiler).

Left in some TODOs wrt to the API: interceptors and native getters don't accept symbols as property names yet, because that would require extending the external v8.h.

(Baseline CL: https://codereview.chromium.org/12296026/)

R=verwaest@chromium.org,mstarzinger@chromium.org
BUG=v8:2158

Review URL: https://codereview.chromium.org/12330012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13811 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2013-03-04 15:00:57 +00:00
erikcorry
9fda0c19c3 MIPS: Do the qNaN fixup at de-serialization time. This is a commit of https://chromiumcodereview.appspot.com/10093007/ for Paul Lind
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@11405 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-04-20 14:12:49 +00:00
rossberg@chromium.org
1336b913d0 Make built-ins strict mode conforming, and support a --use-strict flag.
* Turned all uses of 'const' into 'var'.
* Turned all uses of local 'function' into 'var'.
* Added a couple of missing toplevel 'var' declarations.

One consequence is that the properties on the builtin object  are no longer
non-writable, and I had to adapt one test. Is that a problem?

Unfortunately, we cannot actually switch the library scripts to strict mode
by default, because that makes observable things like poisoned .caller properties
for library functions.

Also removed dead flag code in Compiler::Compile.

R=yangguo@chromium.org
BUG=
TEST=

Review URL: https://chromiumcodereview.appspot.com/9415010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10758 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2012-02-20 13:48:24 +00:00
lrn@chromium.org
c7fccff9af Clean up JavaScript files to better follow coding standard.
Multiline conditionals must use braces.
Semicolons are not optional.

Review URL: http://codereview.chromium.org/8701006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10074 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-11-28 12:11:00 +00:00
rossberg@chromium.org
70dc2fe968 Implement for-in loop for proxies.
Fix related corner case for Object.keys.
Remove obsolete GET_KEYS builtin.

R=ricow@chromium.org
BUG=
TEST=

Review URL: http://codereview.chromium.org/8256015

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9760 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-24 15:56:18 +00:00
mstarzinger@chromium.org
67c9a03922 Fix handling Function.apply for non-array arguments.
R=rossberg@chromium.org
TEST=mjsunit/apply,test262

Review URL: http://codereview.chromium.org/8342034

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9709 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-19 13:56:18 +00:00
lrn@chromium.org
5152d2e0da Reimplement Function.prototype.bind.
Make instanceof work correctly.

BUG=v8:893

Review URL: http://codereview.chromium.org/8199004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9659 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-10-17 12:44:16 +00:00
rossberg@chromium.org
e04d0b23a8 Make integer indexed properties ("elements") work for proxies.
Rehome some Object/JSReceiver/JSObject methods.

R=ricow@chromium.org,kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7795055

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9381 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-22 10:45:37 +00:00
rossberg@chromium.org
07469fa5ae Make function proxies work as constructors.
R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7628021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9310 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-16 12:26:29 +00:00
lrn@chromium.org
724962846c Make built-in functions not call .apply on functions.
Uses the new %Apply runtime function instead.
Removes last(?) dependency on user-mungable infrastructure.

Review URL: http://codereview.chromium.org/7887031

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9277 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-14 12:33:57 +00:00
rossberg@chromium.org
e645597aa7 Implement function proxies (except for their use as constructors).
Introduce new %Apply native.

Extend Execution::Call to optionally handle receiver rewriting (needed for %Apply).

Fix Function.prototype.bind for functions that have .apply modified.

R=kmillikin@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7623011

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9258 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-13 11:42:57 +00:00
lrn@chromium.org
1b4cb57c52 Cleanup of messages.js.
Lock down some otherwise modifiable objects that don't need it.

Review URL: http://codereview.chromium.org/7828003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9089 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-09-01 07:39:22 +00:00
yangguo@chromium.org
431b51aca7 Rollback of r8903
Review URL: http://codereview.chromium.org/7620012

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8909 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-08-11 16:11:07 +00:00
yangguo@chromium.org
189be860aa Quick fix to issue 1593
BUG=v8:1593

Review URL: http://codereview.chromium.org/7622009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8903 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-08-11 15:18:55 +00:00
rossberg@chromium.org
f7ff89ea02 Implement `in' for proxies.
R=ager@chromium.org
BUG=v8:1543
TEST=

Review URL: http://codereview.chromium.org/7390028

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@8681 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-07-19 09:38:59 +00:00
rossberg@chromium.org
30ecaa2f6c Move derived get trap from builtins to global context.
Review URL: http://codereview.chromium.org/7017008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7936 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-18 14:00:34 +00:00
rossberg@chromium.org
05fd779dd3 Implement get trap for proxies.
TODO: reflective Object methods not handled yet.

BUG=
TEST=

Review URL: http://codereview.chromium.org/7035007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7902 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-16 16:33:58 +00:00
rossberg@chromium.org
e14402b1df A first skeleton for introducing Harmony proxies.
1) Add new type JSProxy for representing proxy objects.
   Currently devoid of functionality, i.e., all properties are undefined.

2) Some rudimentary global $Proxy functions to create proxies.

Next step: Hook up getProperty and getOwnProperty handlers. Will probably
require introducing a new LookupResult type, which is a mixture of
INTERCEPTOR (handles any property) and CALLBACK (calls back to JS).
Can we unify this somehow?

TODO: Should probably rename existing Proxy type to something like
"Foreign", to avoid confusion.

Review URL: http://codereview.chromium.org/6932068

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7887 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-13 10:58:25 +00:00
lrn@chromium.org
569574b7bf Fix implementation of == to correctly convert Date objects to primitives.
Fix issue 1356

BUG=v8:1356
TEST=mjsunit/double-equals

Review URL: http://codereview.chromium.org/6912021

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7761 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-05-03 12:15:14 +00:00
mmaly@chromium.org
9adaeb6a17 Strict mode delete of non-configurable property.
Strict mode flag is passed to runtime DELETE function
and then to JSObject::Delete(Property/Element) as STRICT_DELETION enum.
When deleting non-configurable property/eleemnt, TypeError is thrown.
Adding mozilla test to .gitignore.
Incorporate CR feedback.

Review URL: http://codereview.chromium.org/6515005/

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6782 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-02-14 23:41:47 +00:00
sandholm@chromium.org
e90249bde1 Avoid double checking for IS_NUMBER by calling NonNumToNum instead of ToNumber
when the argument is known not to be a number.  
Review URL: http://codereview.chromium.org/6061008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6181 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2011-01-05 13:52:00 +00:00
lrn@chromium.org
b20f0968fa Change DefaultString and DefaultNumber to match the spec required behavior.
Previously it did two reads of the .toString and .valueOf properties where
only one was allowed.

Review URL: http://codereview.chromium.org/5950001

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6047 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-12-16 12:49:55 +00:00
serya@chromium.org
71548e969b Using array index hash code for string-to-number conversion.
Review URL: http://codereview.chromium.org/3141022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5362 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-27 11:47:12 +00:00
sgjesse@chromium.org
8e0cd6db8a Handle overwriting valueOf on String objects correctly when adding
This adds a check to the fast case string add to ensure that the String object still have the default valueOf function. The default valueOf is sitting on a hidden prototype of String.prototype.

Before using the fast case valueOf the object is checked for a local valueOf property. For slow case objects this check always reports true (the dictionary is not probed, so valueOf might be there) and for fast case objects the descriptor array is checked for the valueOf symbol (just liniar scan). After that the prototype is checked for beeing the initial value of String.prototype. If this all pass (that is the default valueOf is still in place) this result is cached on the map making the check fast the next time.

This is only implemented in the optimizing compiler, as the two usages of %_IsStringWrapperSafeForDefaultValueOf is never hit by the full compiler.

I will port to x64 and ARM when this has been reviewed for ia32.

I will remove the performance counters prior to final commit.

BUG=http://code.google.com/p/v8/issues/detail?id=760
TEST=test/mjsunit/regress/regress-760-1.js
TEST=test/mjsunit/regress/regress-760-2.js

Review URL: http://codereview.chromium.org/3117006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5252 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-12 13:43:08 +00:00
sgjesse@chromium.org
fcfe6d74d9 Minor change to for-in
Return (smi) 0 instead of object null from the FILTER_KEY builtin.

Add a test which tests keys being deleted during for-in.
Review URL: http://codereview.chromium.org/3170004

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5243 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-08-11 13:46:10 +00:00
ricow@chromium.org
4957326521 Refactor type checks in v8natives.js and runtime.js.
This includes adding a new inline IsSpecObject method to the code
generator.  The old approach was somehow ineffecient since we would
call both IsObject, IsUndetectable and IsFunction to determine if
something was an object according to the spec. This change introduces
a new macro that determines if something is an object according to the
spec (and this does not include null). 

This change also corrects a few places where undetectable objects was
not allowed even when they should be (priorly they would use only
IS_SPEC_OBJECT_OR_NULL, which would return false on an undetectable
object, the new IS_SPEC_OBJECT returns true on an undetectable object.

Review URL: http://codereview.chromium.org/2877018

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5087 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-16 11:21:08 +00:00
ager@chromium.org
f6e049b0ce Remove the special error message for overflows when using
Function.prototype.apply.  This avoids having more than one error
message for stack overflow situations which makes testing a pain.

Review URL: http://codereview.chromium.org/2967003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@5045 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-07-12 15:29:25 +00:00
whesse@chromium.org
363060ca23 Ensure that ToPrimitive is called on all objects involved in comparisons <, <=, >, >=. Ensures that ToPrimitive is called when comparing an object to undefined. Fixes bugs on all platforms.
Review URL: http://codereview.chromium.org/2834022

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4971 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-06-29 06:47:19 +00:00
ricow@chromium.org
7bbfc8fc53 Refactor the samevalue internal method and add tests for this method.
Noticing that the only difference between samevalue and strict equality is on
numbers we can simplify SameValue.

The old version did not return a correct answer if called on two strings since 
StringEquals (from runtime.cc) returns an answer that is the negated value 
(if treated as a boolean).


Review URL: http://codereview.chromium.org/2136024

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4713 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-25 10:35:55 +00:00
ricow@chromium.org
fb58bc06c6 Fixes issue 712 causing non-configurable accessors to be overwritable by using
Object.defineProperty with empty property descriptor.

The issue is fixed by implementing step 5 and 6 from DefineOwnProperty in the
specification (ES5 8.12.9).

This also fixes a bug in SameValue when used on boolean values (it
would priorly return a number - not a boolean).

Review URL: http://codereview.chromium.org/2131019

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4708 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-25 06:25:27 +00:00
ricow@chromium.org
b9df5aa295 Create IS_SPEC_OBJECT macro to simplify javescript code.
v8natives and runtime.js updated to use new macro and simplified when possible.

Review URL: http://codereview.chromium.org/2006008

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-10 08:58:41 +00:00
podivilov@chromium.org
d9587ab8d6 Port string keyed load IC improvements (r4444) to ARM.
Review URL: http://codereview.chromium.org/1769014

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4573 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-05-04 09:32:07 +00:00
sgjesse@chromium.org
c0976e9276 Add number string cache lookup for heap numbers to generatred code (on top of the already existing smi lookup)
Added a number to string runtime function which does not try to do a cache lookup as the number is known to not be in the cahce.
Review URL: http://codereview.chromium.org/1602010

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4355 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-04-07 11:13:05 +00:00
kmillikin@chromium.org
1cf0439ca7 Remove trailing regexp from .js files.
Removed trailing whitespace using regexp replace.  No other changes.

Review URL: http://codereview.chromium.org/1559006

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@4314 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-03-30 07:15:23 +00:00
vitalyr@chromium.org
dd7b55eb9f Implemented one-char cache lookup in generated code.
This speeds up string,charAt(n) and string[n].

Review URL: http://codereview.chromium.org/660184

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3980 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-26 20:14:20 +00:00
vitalyr@chromium.org
c03db75853 Some string optimizations:
* Inlined checks for strings and regexps.
 * Rewrote split for the non-regexp case.
 * Implemented one-char case for lastIndexOf.

Review URL: http://codereview.chromium.org/596122

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3917 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-19 13:07:37 +00:00
kmillikin@chromium.org
3c0d77f32e Fix stack corruption when calling non-function.
Fix for issue 603.

Revision r3484 removed the property name from the call stack for
call ICs.  When a non-function was called via a call IC and
Function.prototype.call, an extra value was left on the stack that the
caller could not know to clean up.

Fix is to change the JS builtin used for calling non-functions.  It
now gets the callee as receiver, rather than iterating stack frames
and finding it on the expression stack of its JS caller.

Review URL: http://codereview.chromium.org/604064

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3882 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-17 08:26:50 +00:00
sgjesse@chromium.org
6093d0dbf5 Inline NumberToString
NumberToString in runtime JavaScript is inlined through a call to a stub. Currently the stub only checks the number string cache and only if the number is a smi. Code is shared with the inlining of number string cache lookup when adding a smi to a string.
Review URL: http://codereview.chromium.org/604062

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3865 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-16 09:41:11 +00:00
ricow@chromium.org
f74a08d8ee Added Object.defineProperty + needed internal functionality:
DefineOwnProperty (changed to allow for redefinition of existing property)
  SameValue
  Extra info on propertydescriptor
  GetProperty
  HasProperty

Currently the DefineOrRedefineAccessorProperty deletes the existing
property on the object if it is a dataproperty (FIELD or NORMAL) and
adds a new one. This can potentially be optimized.


Review URL: http://codereview.chromium.org/555149

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-02-03 13:10:03 +00:00
sgjesse@chromium.org
67f9e191f9 Fix some usage of "this" in builtins
The implementation of Object.prototype.valueOf and Object.prototype.toString now calls ToObject on "this" as mandated by the spec.
Review URL: http://codereview.chromium.org/542112

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3651 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
2010-01-19 14:15:47 +00:00