[builtins] Also port the Object.prototype.__proto__ accessors to C++.

These accessors also always call into C++ anyways, so there's no point
in having the JavaScript wrappers.

R=yangguo@chromium.org
BUG=v8:5049, chromium:655963

Committed: https://crrev.com/ede69cfabd790fe9f171b5d1f426ea0fc55e3c98
Review-Url: https://codereview.chromium.org/2417183002
Cr-Original-Commit-Position: refs/heads/master@{#40298}
Cr-Commit-Position: refs/heads/master@{#40306}

src/bootstrapper.cc

@@ -459,14 +459,14 @@ void SimpleInstallGetterSetter(Handle<JSObject> base, Handle<String> name,
       Name::ToFunctionName(name, isolate->factory()->get_string())
           .ToHandleChecked();
   Handle<JSFunction> getter =
-      SimpleCreateFunction(isolate, getter_name, call_getter, 0, false);
+      SimpleCreateFunction(isolate, getter_name, call_getter, 0, true);
   getter->shared()->set_native(true);
 
   Handle<String> setter_name =
       Name::ToFunctionName(name, isolate->factory()->set_string())
           .ToHandleChecked();
   Handle<JSFunction> setter =
-      SimpleCreateFunction(isolate, setter_name, call_setter, 0, false);
+      SimpleCreateFunction(isolate, setter_name, call_setter, 1, true);
   setter->shared()->set_native(true);
 
   JSObject::DefineAccessor(base, name, getter, setter, attribs).Check();
@@ -1198,6 +1198,11 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(
         isolate->initial_object_prototype(), "propertyIsEnumerable",
         Builtins::kObjectPrototypePropertyIsEnumerable, 1, false);
+
+    SimpleInstallGetterSetter(isolate->initial_object_prototype(),
+                              factory->proto_string(),
+                              Builtins::kObjectPrototypeGetProto,
+                              Builtins::kObjectPrototypeSetProto, DONT_ENUM);
   }
 
   Handle<JSObject> global(native_context()->global_object());

src/builtins/builtins-object.cc

@@ -722,6 +722,51 @@ BUILTIN(ObjectSetPrototypeOf) {
   return *receiver;
 }
 
+// ES6 section B.2.2.1.1 get Object.prototype.__proto__
+BUILTIN(ObjectPrototypeGetProto) {
+  HandleScope scope(isolate);
+  // 1. Let O be ? ToObject(this value).
+  Handle<JSReceiver> receiver;
+  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+      isolate, receiver, Object::ToObject(isolate, args.receiver()));
+
+  // 2. Return ? O.[[GetPrototypeOf]]().
+  RETURN_RESULT_OR_FAILURE(isolate,
+                           JSReceiver::GetPrototype(isolate, receiver));
+}
+
+// ES6 section B.2.2.1.2 set Object.prototype.__proto__
+BUILTIN(ObjectPrototypeSetProto) {
+  HandleScope scope(isolate);
+  // 1. Let O be ? RequireObjectCoercible(this value).
+  Handle<Object> object = args.receiver();
+  if (object->IsNull(isolate) || object->IsUndefined(isolate)) {
+    THROW_NEW_ERROR_RETURN_FAILURE(
+        isolate, NewTypeError(MessageTemplate::kCalledOnNullOrUndefined,
+                              isolate->factory()->NewStringFromAsciiChecked(
+                                  "set Object.prototype.__proto__")));
+  }
+
+  // 2. If Type(proto) is neither Object nor Null, return undefined.
+  Handle<Object> proto = args.at<Object>(1);
+  if (!proto->IsNull(isolate) && !proto->IsJSReceiver()) {
+    return isolate->heap()->undefined_value();
+  }
+
+  // 3. If Type(O) is not Object, return undefined.
+  if (!object->IsJSReceiver()) return isolate->heap()->undefined_value();
+  Handle<JSReceiver> receiver = Handle<JSReceiver>::cast(object);
+
+  // 4. Let status be ? O.[[SetPrototypeOf]](proto).
+  // 5. If status is false, throw a TypeError exception.
+  MAYBE_RETURN(
+      JSReceiver::SetPrototype(receiver, proto, true, Object::THROW_ON_ERROR),
+      isolate->heap()->exception());
+
+  // Return undefined.
+  return isolate->heap()->undefined_value();
+}
+
 // ES6 section 19.1.2.6 Object.getOwnPropertyDescriptor ( O, P )
 BUILTIN(ObjectGetOwnPropertyDescriptor) {
   HandleScope scope(isolate);

src/builtins/builtins.h

@@ -539,6 +539,8 @@ namespace internal {
   /* ES6 section 19.1.3.6 Object.prototype.toString () */                     \
   TFJ(ObjectProtoToString, 1)                                                 \
   CPP(ObjectPrototypePropertyIsEnumerable)                                    \
+  CPP(ObjectPrototypeGetProto)                                                \
+  CPP(ObjectPrototypeSetProto)                                                \
   CPP(ObjectSeal)                                                             \
   CPP(ObjectValues)                                                           \
                                                                               \

src/js/v8natives.js

@@ -104,22 +104,6 @@ function GetMethod(obj, p) {
   throw %make_type_error(kCalledNonCallable, typeof func);
 }
 
-// ES6 B.2.2.1.1
-function ObjectGetProto() {
-  return %object_get_prototype_of(this);
-}
-
-
-// ES6 B.2.2.1.2
-function ObjectSetProto(proto) {
-  CHECK_OBJECT_COERCIBLE(this, "Object.prototype.__proto__");
-
-  if ((IS_RECEIVER(proto) || IS_NULL(proto)) && IS_RECEIVER(this)) {
-    %SetPrototype(this, proto);
-  }
-}
-
-
 // ES6 19.1.1.1
 function ObjectConstructor(x) {
   if (GlobalObject != new.target && !IS_UNDEFINED(new.target)) {
@@ -151,8 +135,6 @@ utils.InstallFunctions(GlobalObject.prototype, DONT_ENUM, [
   // __defineSetter__ is added in bootstrapper.cc.
   // __lookupSetter__ is added in bootstrapper.cc.
 ]);
-utils.InstallGetterSetter(
-    GlobalObject.prototype, "__proto__", ObjectGetProto, ObjectSetProto);
 
 
 // ----------------------------------------------------------------------------

src/runtime/runtime-object.cc

@@ -250,18 +250,6 @@ RUNTIME_FUNCTION(Runtime_InternalSetPrototype) {
   return *obj;
 }
 
-
-RUNTIME_FUNCTION(Runtime_SetPrototype) {
-  HandleScope scope(isolate);
-  DCHECK(args.length() == 2);
-  CONVERT_ARG_HANDLE_CHECKED(JSReceiver, obj, 0);
-  CONVERT_ARG_HANDLE_CHECKED(Object, prototype, 1);
-  MAYBE_RETURN(
-      JSReceiver::SetPrototype(obj, prototype, true, Object::THROW_ON_ERROR),
-      isolate->heap()->exception());
-  return *obj;
-}
-
 RUNTIME_FUNCTION(Runtime_OptimizeObjectForAddingMultipleProperties) {
   HandleScope scope(isolate);
   DCHECK(args.length() == 2);

src/runtime/runtime.h

@@ -380,7 +380,6 @@ namespace internal {
   F(GetPrototype, 1, 1)                              \
   F(ObjectHasOwnProperty, 2, 1)                      \
   F(InternalSetPrototype, 2, 1)                      \
-  F(SetPrototype, 2, 1)                              \
   F(OptimizeObjectForAddingMultipleProperties, 2, 1) \
   F(GetProperty, 2, 1)                               \
   F(KeyedGetProperty, 2, 1)                          \