sgjesse@chromium.org 562f90d375 Ensure correct boxing of values when calling functions on them ... When a function is called with a value type as the receiver this is now boxed as an object. This is a low-impact solution where the receiver is only boxed when required. For IC calls to the V8 builtins values are not boxed and as most of the functions on String.prototype, Number.prototype and Boolean.prototype are sitting there most IC calls on values will not need any boxing of the receiver. For calls which are not IC calls but calls through the CallFunctionStub a flag is used to determine whether the receiver might be a value and only when that is the case will the receiver be boxed. No changtes to Function.call and Function.apply - they already boxed values. According to the ES5 spec the receiver should not be boxed for these functions, but current browsers have not adopted that change yet. BUG=223 TEST=test/mjsunit/value-wrapper.js TEST=test/mjsunit/regress/regress-crbug-3184.js Review URL: http://codereview.chromium.org/542087 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@3617 ce2b1a6d-e550-0410-aec6-3dcde31c8c00		2010-01-15 13:42:32 +00:00
..
bug-222.js	Added one test case and moved another.	2009-02-09 08:46:26 +00:00
bug-900066.js	Changed copyright header from google inc. to v8 project authors.	2008-09-09 20:08:45 +00:00
bug-941049.js	Changed copyright header from google inc. to v8 project authors.	2008-09-09 20:08:45 +00:00
bug-1344252.js	Revert change 1509 that flush ICs when adding setters on an object or	2009-03-19 15:06:00 +00:00