[intl] Bind NumberFormat.prototype.format to the proper receiver

Also fix type-check to check receiver for JSReceiver, not JSObject,
and add a test for DateTimeFormat verifying that it already
has the proper behavior.

Bug: chromium:881023
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I950c86094dfb9634e0b7e49bcbbb022fa81a71f7
Reviewed-on: https://chromium-review.googlesource.com/1225612
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55880}

src/builtins/builtins-intl.cc

@@ -362,14 +362,15 @@ BUILTIN(NumberFormatPrototypeFormatNumber) {
 
   // 1. Let nf be the this value.
   // 2. If Type(nf) is not Object, throw a TypeError exception.
-  CHECK_RECEIVER(JSObject, format_holder, method);
+  CHECK_RECEIVER(JSReceiver, receiver, method);
 
   // 3. Let nf be ? UnwrapNumberFormat(nf).
-  Handle<JSNumberFormat> nf;
+  Handle<JSNumberFormat> number_format;
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, nf, JSNumberFormat::UnwrapNumberFormat(isolate, format_holder));
+      isolate, number_format,
+      JSNumberFormat::UnwrapNumberFormat(isolate, receiver));
 
-  Handle<Object> bound_format = Handle<Object>(nf->bound_format(), isolate);
+  Handle<Object> bound_format(number_format->bound_format(), isolate);
 
   // 4. If nf.[[BoundFormat]] is undefined, then
   if (!bound_format->IsUndefined(isolate)) {
@@ -379,10 +380,10 @@ BUILTIN(NumberFormatPrototypeFormatNumber) {
   }
 
   Handle<JSFunction> new_bound_format_function = CreateBoundFunction(
-      isolate, format_holder, Builtins::kNumberFormatInternalFormatNumber, 1);
+      isolate, number_format, Builtins::kNumberFormatInternalFormatNumber, 1);
 
   // 4. c. Set nf.[[BoundFormat]] to F.
-  nf->set_bound_format(*new_bound_format_function);
+  number_format->set_bound_format(*new_bound_format_function);
 
   // 5. Return nf.[[BoundFormat]].
   return *new_bound_format_function;

test/intl/date-format/format-is-bound.js

@@ -37,3 +37,10 @@ dateArray.forEach(dtf.format);
 
 // Formatting a date should work in a direct call.
 dtf.format();
+
+// format should be bound properly even if created from a non-instance
+var legacy = Intl.DateTimeFormat.call(
+    Object.create(Intl.DateTimeFormat));
+var boundFormat = legacy.format;
+assertEquals(dtf.format(12345), legacy.format(12345));
+assertEquals(dtf.format(54321), boundFormat(54321));

test/intl/number-format/format-is-bound.js

@@ -42,3 +42,9 @@ nf.format(12345);
 
 // Reading the format doesn't add any additional property keys
 assertEquals(beforeCount, Object.getOwnPropertyNames(nf).length);
+
+// format should be bound properly even if created from a non-instance
+var legacy = Intl.NumberFormat.call(Object.create(Intl.NumberFormat));
+var boundFormat = legacy.format;
+assertEquals(nf.format(12345), legacy.format(12345));
+assertEquals(nf.format(54321), boundFormat(54321));