[intl] Avoid modifying options bag from constructor

Previously, the Intl.DateTimeFormat constructor and other related paths had
a bug where the options bag passed in would be modified in place. This patch
makes V8's Intl implementation follow the specification's logic to avoid
such a modification.

BUG=v8:4219

Review-Url: https://codereview.chromium.org/2587703002
Cr-Commit-Position: refs/heads/master@{#41826}

src/bootstrapper.cc

@@ -1156,8 +1156,6 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
 
     SimpleInstallFunction(object_function, factory->assign_string(),
                           Builtins::kObjectAssign, 2, false);
-    SimpleInstallFunction(object_function, factory->create_string(),
-                          Builtins::kObjectCreate, 2, true);
     SimpleInstallFunction(object_function, "getOwnPropertyDescriptor",
                           Builtins::kObjectGetOwnPropertyDescriptor, 2, false);
     SimpleInstallFunction(object_function,
@@ -1174,6 +1172,11 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(object_function, "seal",
                           Builtins::kObjectSeal, 1, false);
 
+    Handle<JSFunction> object_create =
+        SimpleInstallFunction(object_function, factory->create_string(),
+                              Builtins::kObjectCreate, 2, true);
+    native_context()->set_object_create(*object_create);
+
     Handle<JSFunction> object_define_properties = SimpleInstallFunction(
         object_function, "defineProperties",
         Builtins::kObjectDefineProperties, 2, true);

src/contexts.h

@@ -43,6 +43,7 @@ enum ContextLookupFlags {
   V(MAKE_SYNTAX_ERROR_INDEX, JSFunction, make_syntax_error)                  \
   V(MAKE_TYPE_ERROR_INDEX, JSFunction, make_type_error)                      \
   V(MAKE_URI_ERROR_INDEX, JSFunction, make_uri_error)                        \
+  V(OBJECT_CREATE, JSFunction, object_create)                                \
   V(OBJECT_DEFINE_PROPERTIES, JSFunction, object_define_properties)          \
   V(OBJECT_DEFINE_PROPERTY, JSFunction, object_define_property)              \
   V(OBJECT_FREEZE, JSFunction, object_freeze)                                \

src/js/i18n.js

@@ -1518,6 +1518,8 @@ function toDateTimeOptions(options, required, defaults) {
     options = TO_OBJECT(options);
   }
 
+  options = %object_create(options);
+
   var needsDefault = true;
   if ((required === 'date' || required === 'any') &&
       (!IS_UNDEFINED(options.weekday) || !IS_UNDEFINED(options.year) ||

test/cctest/interpreter/bytecode_expectations/CallRuntime.golden

@@ -79,7 +79,7 @@ bytecodes: [
                 B(Star), R(0),
                 B(CreateArrayLiteral), U8(0), U8(0), U8(9),
                 B(Star), R(1),
-                B(CallJSRuntime), U8(156), R(0), U8(2),
+                B(CallJSRuntime), U8(157), R(0), U8(2),
   /*   44 S> */ B(Return),
 ]
 constant pool: [

test/cctest/interpreter/bytecode_expectations/SuperCallAndSpread.golden

@@ -126,14 +126,14 @@ bytecodes: [
                 B(LdaUndefined),
                 B(Star), R(7),
                 B(Mov), R(2), R(8),
-  /*  152 E> */ B(CallJSRuntime), U8(156), R(7), U8(2),
+  /*  152 E> */ B(CallJSRuntime), U8(157), R(7), U8(2),
                 B(Star), R(7),
                 B(CreateArrayLiteral), U8(1), U8(1), U8(9),
                 B(Star), R(8),
-                B(CallJSRuntime), U8(155), R(5), U8(4),
+                B(CallJSRuntime), U8(156), R(5), U8(4),
                 B(Star), R(5),
                 B(Mov), R(0), R(6),
-  /*  140 E> */ B(CallJSRuntime), U8(152), R(3), U8(4),
+  /*  140 E> */ B(CallJSRuntime), U8(153), R(3), U8(4),
                 B(Star), R(3),
                 B(Ldar), R(this),
                 B(JumpIfNotHole), U8(4),

test/intl/date-format/unmodified-options.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let options = {};
+new Intl.DateTimeFormat(undefined, options);
+assertEquals([], Object.getOwnPropertyNames(options));
+
+let date = new Date();
+date.toLocaleString(undefined, options);
+assertEquals([], Object.getOwnPropertyNames(options));
+
+date.toLocaleDateString(undefined, options);
+assertEquals([], Object.getOwnPropertyNames(options));
+
+date.toLocaleTimeString(undefined, options);
+assertEquals([], Object.getOwnPropertyNames(options));

test/mjsunit/regress/regress-builtinbust-7.js

@@ -24,7 +24,7 @@ if ("Intl" in this) {
   assertDoesNotThrow(function() {
     date.toLocaleDateString("de-DE", options_incomplete);
   });
-  assertTrue(options_incomplete.hasOwnProperty("year"));
+  assertFalse(options_incomplete.hasOwnProperty("year"));
 
   assertDoesNotThrow(function() { date.toLocaleDateString("de-DE", undefined); });
   assertDoesNotThrow(function() { date.toLocaleDateString("de-DE"); });