[runtime] Make all built-in functions strict.

According to ES#sec-built-in-function-objects all built-in functions
must be strict.

This is a preliminary CL before changing the way we define built-in
functions in native JS files.

Bug: v8:6459
Change-Id: I8e60b342f04ea1b0843fe1990334cbb9b26ebac4
Reviewed-on: https://chromium-review.googlesource.com/546215Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46237}

src/factory.cc

@@ -1486,6 +1486,7 @@ Handle<JSFunction> Factory::NewFunction(Handle<Map> map,
   Handle<Context> context(isolate()->native_context());
   Handle<SharedFunctionInfo> info =
       NewSharedFunctionInfo(name, code, map->is_constructor());
+  // Proper language mode in shared function info will be set outside.
   DCHECK(is_sloppy(info->language_mode()));
   DCHECK(!map->IsUndefined(isolate()));
   DCHECK(
@@ -1504,8 +1505,10 @@ Handle<JSFunction> Factory::NewFunction(Handle<Map> map,
 
 
 Handle<JSFunction> Factory::NewFunction(Handle<String> name) {
-  return NewFunction(
-      isolate()->sloppy_function_map(), name, MaybeHandle<Code>());
+  Handle<JSFunction> result =
+      NewFunction(isolate()->sloppy_function_map(), name, MaybeHandle<Code>());
+  DCHECK(is_sloppy(result->shared()->language_mode()));
+  return result;
 }
 
 
@@ -1515,7 +1518,9 @@ Handle<JSFunction> Factory::NewFunctionWithoutPrototype(Handle<String> name,
   Handle<Map> map = is_strict
                         ? isolate()->strict_function_without_prototype_map()
                         : isolate()->sloppy_function_without_prototype_map();
-  return NewFunction(map, name, code);
+  Handle<JSFunction> result = NewFunction(map, name, code);
+  result->shared()->set_language_mode(is_strict ? STRICT : SLOPPY);
+  return result;
 }
 
 
@@ -1526,6 +1531,7 @@ Handle<JSFunction> Factory::NewFunction(Handle<String> name, Handle<Code> code,
                               : isolate()->sloppy_function_map();
   Handle<JSFunction> result = NewFunction(map, name, code);
   result->set_prototype_or_initial_map(*prototype);
+  result->shared()->set_language_mode(is_strict ? STRICT : SLOPPY);
   return result;
 }
 

src/js/collection.js

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 (function(global, utils) {
+
 "use strict";
 
 %CheckIsBootstrapping();

src/js/max-min.js

@@ -4,6 +4,8 @@
 
 (function(global, utils) {
 
+"use strict";
+
 %CheckIsBootstrapping();
 
 function MaxSimple(a, b) {

src/js/messages.js

@@ -6,6 +6,8 @@
 
 (function(global, utils) {
 
+"use strict";
+
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------

src/js/spread.js

@@ -4,7 +4,7 @@
 
 (function(global, utils) {
 
-'use strict';
+"use strict";
 
 // -------------------------------------------------------------------
 // Imports

src/js/string.js

@@ -4,6 +4,8 @@
 
 (function(global, utils) {
 
+"use strict";
+
 %CheckIsBootstrapping();
 
 // -------------------------------------------------------------------

src/js/v8natives.js

@@ -4,6 +4,8 @@
 
 (function(global, utils) {
 
+"use strict";
+
 %CheckIsBootstrapping();
 
 // ----------------------------------------------------------------------------

test/mjsunit/function-caller.js

@@ -46,11 +46,9 @@ f(null);
 // Check called from eval.
 eval('f(null)');
 
-// Check called from strict builtin functions.
+// Check called from builtin functions.
 [null, null].sort(f);
 [null].forEach(f, null);
-
-// Check called from sloppy builtin functions.
 "abel".replace(/b/g, function h() {
-   assertEquals(String.prototype.replace, h.caller);
+   assertEquals(null, h.caller);
 });

test/mjsunit/fuzz-accessors.js

@@ -26,7 +26,11 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 var builtInPropertyNames = [
-  'prototype', 'length', 'caller', 0, 1, '$1', 'arguments', 'name', 'message', 'constructor'
+  'prototype', 'length', 0, 1, '$1', 'name', 'message', 'constructor'
+];
+
+var builtInPropertyNamesMayThrow = [
+  'caller', 'arguments'
 ];
 
 function getAnException() {
@@ -77,6 +81,13 @@ function runTest(fun) {
         var propertyName = builtInPropertyNames[k];
         fun(obj, propertyName);
       }
+      for (var k in builtInPropertyNamesMayThrow) {
+        var propertyName = builtInPropertyNamesMayThrow[k];
+        try {
+          fun(obj, propertyName);
+        } catch (e) {
+        }
+      }
     }
   }
 }

test/mjsunit/harmony/async-from-sync-iterator.js

@@ -625,6 +625,11 @@ if (testFailed) {
 }
 
 (function ExtractedAsyncFromSyncIteratorMethods() {
+  // TODO(ishell, caitp): Rewrite the test without using function.caller.
+  // According to ES#sec-built-in-function-objects all built-in functions
+  // must be strict. And ES#sec-forbidden-extensions states that the value of
+  // a function.caller must not be a strict function.
+  return;
   // Async-from-Sync iterator methods can be extracted via function.caller.
   // TODO(caitp): test extracted `throw` method using yield* in async generator.
   let extractor = [0, 1, 2, 3, 4,5,6,7,8,9];

test/mjsunit/regress/regress-682349.js

@@ -6,7 +6,7 @@
 
 let success = false;
 function f() {
-  success = (f.caller.arguments === null);
+  success = (f.caller === null);
 }
 Promise.resolve().then(f);
 %RunMicrotasks();

test/mjsunit/test-native-method-names.js

@@ -12,6 +12,9 @@ function CheckMethodEx(object, prop_name, function_name, length) {
   assertTrue(desc.configurable);
   assertTrue(desc.writable);
   assertThrows(() => new desc.value());
+  // Check that built-in function is strict.
+  assertThrows(() => desc.value.arguments);
+  assertThrows(() => desc.value.caller);
 }
 
 function CheckMethod(object, name, length) {
@@ -32,6 +35,9 @@ function CheckGetter(object, name) {
   assertEquals(0, desc.get.length);
   assertFalse(desc.enumerable);
   assertTrue(desc.configurable);
+  // Check that built-in function is strict.
+  assertThrows(() => desc.get.arguments);
+  assertThrows(() => desc.get.caller);
 }