Revert "[builtins] Add FastCallFunction builtin that elides some checks"

This reverts commit 99e13e58.

Reason for revert: Reverting in favor of a general mechanism for this in Torque.

Original change's description:
> [builtins] Add FastCallFunction builtin that elides some checks
> 
> This CL adds a new "Call" stub that can be used by builtins that will
> call the same JS call-back function often (e.g. compare function in
> Array.p.sort). The checks have to be done upfront once, but can then
> be omitted.
> 
> R=​jgruber@chromium.org
> 
> Bug: v8:7861
> Change-Id: Id6e4ca27c3d488a7b1f708cbcb4cbe6cc382513e
> Reviewed-on: https://chromium-review.googlesource.com/1208574
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55769}

TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7861
Change-Id: I47260993ef2a16bd5348bb0b46da4d34d33ea10b
Reviewed-on: https://chromium-review.googlesource.com/1226871
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55897}

src/builtins/arm/builtins-arm.cc

@@ -1724,33 +1724,6 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Jump(code, RelocInfo::CODE_TARGET);
 }
 
-// static
-// The CSA macro "BranchIfCanUseFastCallFunction" should be used to determine
-// whether a JSFunction can be called using this stub.
-void Builtins::Generate_FastCallFunction(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r0 : the number of arguments (not including the receiver)
-  //  -- r1 : the function to call (checked to be a JSFunction)
-  // -----------------------------------
-  __ AssertFunction(r1);
-  __ ldr(cp, FieldMemOperand(r1, JSFunction::kContextOffset));
-
-  // ----------- S t a t e -------------
-  //  -- r0 : the number of arguments (not including the receiver)
-  //  -- r1 : the function to call (checked to be a JSFunction)
-  //  -- cp : the function context.
-  // -----------------------------------
-
-  // On function call, call into the debugger if necessary.
-  __ CheckDebugHook(r1, no_reg, ParameterCount(r0), ParameterCount(r0));
-  __ LoadRoot(r3, Heap::kUndefinedValueRootIndex);
-
-  Register code = kJavaScriptCallCodeStartRegister;
-  __ ldr(code, FieldMemOperand(r1, JSFunction::kCodeOffset));
-  __ add(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(code);
-}
-
 // static
 void Builtins::Generate_CallFunction(MacroAssembler* masm,
                                      ConvertReceiverMode mode) {

src/builtins/arm64/builtins-arm64.cc

@@ -2073,34 +2073,6 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Jump(code, RelocInfo::CODE_TARGET);
 }
 
-// static
-// The CSA macro "BranchIfCanUseFastCallFunction" should be used to determine
-// whether a JSFunction can be called using this stub.
-void Builtins::Generate_FastCallFunction(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- x0 : the number of arguments (not including the receiver)
-  //  -- x1 : the function to call (checked to be a JSFunction)
-  // -----------------------------------
-  __ AssertFunction(x1);
-  __ Ldr(cp, FieldMemOperand(x1, JSFunction::kContextOffset));
-
-  // ----------- S t a t e -------------
-  //  -- x0 : the number of arguments (not including the receiver)
-  //  -- x1 : the function to call (checked to be a JSFunction)
-  //  -- cp : the function context.
-  // -----------------------------------
-
-  // On function call, call into the debugger if necessary.
-  __ Mov(x2, x0);
-  __ CheckDebugHook(x1, no_reg, ParameterCount(x0), ParameterCount(x2));
-  __ LoadRoot(x3, Heap::kUndefinedValueRootIndex);
-
-  Register code = kJavaScriptCallCodeStartRegister;
-  __ Ldr(code, FieldMemOperand(x1, JSFunction::kCodeOffset));
-  __ Add(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(code);
-}
-
 // static
 void Builtins::Generate_CallFunction(MacroAssembler* masm,
                                      ConvertReceiverMode mode) {

src/builtins/base.tq

@@ -761,8 +761,6 @@ extern macro Call(
 extern macro Call(
     Context, Callable, Object, Object, Object, Object, Object, Object): Object;
 
-extern macro FastCall(Context, Callable, Object, Object): Object;
-
 extern macro ExtractFixedArray(FixedArrayBase, Smi, Smi, Smi): FixedArrayBase;
 extern macro ExtractFixedArray(FixedArrayBase, Smi, Smi, Smi,
     constexpr ExtractFixedArrayFlags): FixedArrayBase;
@@ -830,9 +828,6 @@ macro NumberIsNaN(number: Number): bool {
 }
 
 extern macro BranchIfToBooleanIsTrue(Object): never labels Taken, NotTaken;
-extern macro BranchIfCanUseFastCallFunction(HeapObject, int32):
-    never labels Taken,
-    NotTaken;
 
 macro ToBoolean(obj: Object): bool {
   if (BranchIfToBooleanIsTrue(obj)) {

src/builtins/builtins-call-gen.cc

@@ -46,11 +46,6 @@ void Builtins::Generate_Call_ReceiverIsAny(MacroAssembler* masm) {
   Generate_Call(masm, ConvertReceiverMode::kAny);
 }
 
-void Builtins::Generate_FastCallFunction_ReceiverIsNullOrUndefined(
-    MacroAssembler* masm) {
-  Generate_FastCallFunction(masm);
-}
-
 void Builtins::Generate_CallVarargs(MacroAssembler* masm) {
   Generate_CallOrConstructVarargs(masm, masm->isolate()->builtins()->Call());
 }
@@ -235,9 +230,9 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithArrayLike(
   }
 }
 
-// Takes a FixedArray of doubles and creates a new FixedArray with those
-// doubles boxed as HeapNumbers, then tail calls CallVarargs/ConstructVarargs
-// depending on whether {new_target} was passed.
+// Takes a FixedArray of doubles and creates a new FixedArray with those doubles
+// boxed as HeapNumbers, then tail calls CallVarargs/ConstructVarargs depending
+// on whether {new_target} was passed.
 void CallOrConstructBuiltinsAssembler::CallOrConstructDoubleVarargs(
     TNode<Object> target, SloppyTNode<Object> new_target,
     TNode<FixedDoubleArray> elements, TNode<Int32T> length,

src/builtins/builtins-definitions.h

@@ -51,8 +51,6 @@ namespace internal {
   ASM(Call_ReceiverIsNotNullOrUndefined)                                       \
   ASM(Call_ReceiverIsAny)                                                      \
                                                                                \
-  ASM(FastCallFunction_ReceiverIsNullOrUndefined)                              \
-                                                                               \
   /* ES6 section 9.5.12[[Call]] ( thisArgument, argumentsList ) */             \
   TFC(CallProxy, CallTrampoline, 1)                                            \
   ASM(CallVarargs)                                                             \

src/builtins/builtins.h

@@ -165,8 +165,6 @@ class Builtins {
   static void Generate_CallFunction(MacroAssembler* masm,
                                     ConvertReceiverMode mode);
 
-  static void Generate_FastCallFunction(MacroAssembler* masm);
-
   static void Generate_CallBoundFunctionImpl(MacroAssembler* masm);
 
   static void Generate_Call(MacroAssembler* masm, ConvertReceiverMode mode);

src/builtins/ia32/builtins-ia32.cc

@@ -1853,33 +1853,6 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Jump(code, RelocInfo::CODE_TARGET);
 }
 
-// static
-// The CSA macro "BranchIfCanUseFastCallFunction" should be used to determine
-// whether a JSFunction can be called using this stub.
-void Builtins::Generate_FastCallFunction(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- eax : the number of arguments (not including the receiver)
-  //  -- edi : the function to call (checked to be a JSFunction)
-  // -----------------------------------
-  __ AssertFunction(edi);
-  __ mov(esi, FieldOperand(edi, JSFunction::kContextOffset));
-
-  // ----------- S t a t e -------------
-  //  -- eax : the number of arguments (not including the receiver)
-  //  -- edi : the function to call (checked to be a JSFunction)
-  //  -- esi : the function context.
-  // -----------------------------------
-
-  // On function call, call into the debugger if necessary.
-  __ CheckDebugHook(edi, no_reg, ParameterCount(eax), ParameterCount(eax));
-  __ mov(edx, __ isolate()->factory()->undefined_value());
-
-  static_assert(kJavaScriptCallCodeStartRegister == ecx, "ABI mismatch");
-  __ mov(ecx, FieldOperand(edi, JSFunction::kCodeOffset));
-  __ add(ecx, Immediate(Code::kHeaderSize - kHeapObjectTag));
-  __ jmp(ecx);
-}
-
 // static
 void Builtins::Generate_CallFunction(MacroAssembler* masm,
                                      ConvertReceiverMode mode) {

src/builtins/mips/builtins-mips.cc

@@ -1722,33 +1722,6 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Jump(code, RelocInfo::CODE_TARGET);
 }
 
-// static
-// The CSA macro "BranchIfCanUseFastCallFunction" should be used to determine
-// whether a JSFunction can be called using this stub.
-void Builtins::Generate_FastCallFunction(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : the number of arguments (not including the receiver)
-  //  -- a1 : the function to call (checked to be a JSFunction)
-  // -----------------------------------
-  __ AssertFunction(a1);
-  __ lw(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
-
-  // ----------- S t a t e -------------
-  //  -- a0 : the number of arguments (not including the receiver)
-  //  -- a1 : the function to call (checked to be a JSFunction)
-  //  -- cp : the function context.
-  // -----------------------------------
-
-  // On function call, call into the debugger if necessary.
-  __ CheckDebugHook(a1, no_reg, ParameterCount(a0), ParameterCount(a0));
-  __ LoadRoot(a3, Heap::kUndefinedValueRootIndex);
-
-  Register code = kJavaScriptCallCodeStartRegister;
-  __ lw(code, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Addu(code, code, Code::kHeaderSize - kHeapObjectTag);
-  __ Jump(code);
-}
-
 // static
 void Builtins::Generate_CallFunction(MacroAssembler* masm,
                                      ConvertReceiverMode mode) {

src/builtins/mips64/builtins-mips64.cc

@@ -1743,33 +1743,6 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Jump(code, RelocInfo::CODE_TARGET);
 }
 
-// static
-// The CSA macro "BranchIfCanUseFastCallFunction" should be used to determine
-// whether a JSFunction can be called using this stub.
-void Builtins::Generate_FastCallFunction(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- a0 : the number of arguments (not including the receiver)
-  //  -- a1 : the function to call (checked to be a JSFunction)
-  // -----------------------------------
-  __ AssertFunction(a1);
-  __ Ld(cp, FieldMemOperand(a1, JSFunction::kContextOffset));
-
-  // ----------- S t a t e -------------
-  //  -- a0 : the number of arguments (not including the receiver)
-  //  -- a1 : the function to call (checked to be a JSFunction)
-  //  -- cp : the function context.
-  // -----------------------------------
-
-  // On function call, call into the debugger if necessary.
-  __ CheckDebugHook(a1, no_reg, ParameterCount(a0), ParameterCount(a0));
-  __ LoadRoot(a3, Heap::kUndefinedValueRootIndex);
-
-  Register code = kJavaScriptCallCodeStartRegister;
-  __ Ld(code, FieldMemOperand(a1, JSFunction::kCodeOffset));
-  __ Daddu(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ Jump(code);
-}
-
 // static
 void Builtins::Generate_CallFunction(MacroAssembler* masm,
                                      ConvertReceiverMode mode) {

src/builtins/ppc/builtins-ppc.cc

@@ -1792,33 +1792,6 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Jump(code, RelocInfo::CODE_TARGET);
 }
 
-// static
-// The CSA macro "BranchIfCanUseFastCallFunction" should be used to determine
-// whether a JSFunction can be called using this stub.
-void Builtins::Generate_FastCallFunction(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r3 : the number of arguments (not including the receiver)
-  //  -- r4 : the function to call (checked to be a JSFunction)
-  // -----------------------------------
-  __ AssertFunction(r4);
-  __ LoadP(cp, FieldMemOperand(r4, JSFunction::kContextOffset));
-
-  // ----------- S t a t e -------------
-  //  -- r3 : the number of arguments (not including the receiver)
-  //  -- r4 : the function to call (checked to be a JSFunction)
-  //  -- cp : the function context.
-  // -----------------------------------
-
-  // On function call, call into the debugger if necessary.
-  __ CheckDebugHook(r4, no_reg, ParameterCount(r3), ParameterCount(r3));
-  __ LoadRoot(r6, Heap::kUndefinedValueRootIndex);
-
-  Register code = kJavaScriptCallCodeStartRegister;
-  __ LoadP(code, FieldMemOperand(r4, JSFunction::kCodeOffset));
-  __ addi(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(code);
-}
-
 // static
 void Builtins::Generate_CallFunction(MacroAssembler* masm,
                                      ConvertReceiverMode mode) {

src/builtins/s390/builtins-s390.cc

@@ -1797,33 +1797,6 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Jump(code, RelocInfo::CODE_TARGET);
 }
 
-// static
-// The CSA macro "BranchIfCanUseFastCallFunction" should be used to determine
-// whether a JSFunction can be called using this stub.
-void Builtins::Generate_FastCallFunction(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- r2 : the number of arguments (not including the receiver)
-  //  -- r3 : the function to call (checked to be a JSFunction)
-  // -----------------------------------
-  __ AssertFunction(r3);
-  __ LoadP(cp, FieldMemOperand(r3, JSFunction::kContextOffset));
-
-  // ----------- S t a t e -------------
-  //  -- r2 : the number of arguments (not including the receiver)
-  //  -- r3 : the function to call (checked to be a JSFunction)
-  //  -- cp : the function context.
-  // -----------------------------------
-
-  // On function call, call into the debugger if necessary.
-  __ CheckDebugHook(r3, no_reg, ParameterCount(r2), ParameterCount(r2));
-  __ LoadRoot(r5, Heap::kUndefinedValueRootIndex);
-
-  Register code = kJavaScriptCallCodeStartRegister;
-  __ LoadP(code, FieldMemOperand(r3, JSFunction::kCodeOffset));
-  __ AddP(code, code, Operand(Code::kHeaderSize - kHeapObjectTag));
-  __ JumpToJSEntry(code);
-}
-
 // static
 void Builtins::Generate_CallFunction(MacroAssembler* masm,
                                      ConvertReceiverMode mode) {

src/builtins/x64/builtins-x64.cc

@@ -1903,32 +1903,6 @@ void Builtins::Generate_CallOrConstructForwardVarargs(MacroAssembler* masm,
   __ Jump(code, RelocInfo::CODE_TARGET);
 }
 
-// static
-// The CSA macro "BranchIfCanUseFastCallFunction" should be used to determine
-// whether a JSFunction can be called using this stub.
-void Builtins::Generate_FastCallFunction(MacroAssembler* masm) {
-  // ----------- S t a t e -------------
-  //  -- rax : the number of arguments (not including the receiver)
-  //  -- rdi : the function to call (checked to be a JSFunction)
-  // -----------------------------------
-  __ AssertFunction(rdi);
-  __ movp(rsi, FieldOperand(rdi, JSFunction::kContextOffset));
-
-  // ----------- S t a t e -------------
-  //  -- rax : the number of arguments (not including the receiver)
-  //  -- rdi : the function to call (checked to be a JSFunction)
-  //  -- rsi : the function context.
-  // -----------------------------------
-
-  // On function call, call into the debugger if necessary.
-  __ CheckDebugHook(rdi, no_reg, ParameterCount(rax), ParameterCount(rax));
-  __ LoadRoot(rdx, Heap::kUndefinedValueRootIndex);
-
-  __ movp(rcx, FieldOperand(rdi, JSFunction::kCodeOffset));
-  __ addp(rcx, Immediate(Code::kHeaderSize - kHeapObjectTag));
-  __ jmp(rcx);
-}
-
 // static
 void Builtins::Generate_CallFunction(MacroAssembler* masm,
                                      ConvertReceiverMode mode) {

src/code-stub-assembler.cc

@@ -2604,58 +2604,6 @@ TNode<Map> CodeStubAssembler::LoadJSArrayElementsMap(
       LoadContextElement(native_context, Context::ArrayMapIndex(kind)));
 }
 
-void CodeStubAssembler::BranchIfCanUseFastCallFunction(
-    TNode<HeapObject> callable, TNode<Int32T> actualParameterCount,
-    Label* if_true, Label* if_false) {
-  GotoIfNot(IsJSFunction(callable), if_false);
-
-  TNode<JSFunction> function = CAST(callable);
-  TNode<SharedFunctionInfo> sfi = LoadSharedFunctionInfo(function);
-  TNode<Word32T> flags = UncheckedCast<Word32T>(LoadObjectField(
-      sfi, SharedFunctionInfo::kFlagsOffset, MachineType::Uint32()));
-
-  GotoIf(IsSetWord32<SharedFunctionInfo::IsClassConstructorBit>(flags),
-         if_false);
-
-  // Receiver needs to be converted for non-native sloppy mode functions.
-  GotoIfNot(IsSetWord32(flags, SharedFunctionInfo::IsNativeBit::kMask |
-                                   SharedFunctionInfo::IsStrictBit::kMask),
-            if_false);
-
-  Branch(Word32Equal(actualParameterCount, LoadFormalParameterCount(sfi)),
-         if_true, if_false);
-}
-
-TNode<BoolT> CodeStubAssembler::CanUseFastCallFunction(
-    TNode<HeapObject> callable, TNode<Int32T> actualParameterCount) {
-  Label if_true(this), if_false(this), done(this);
-  TVARIABLE(BoolT, result);
-  BranchIfCanUseFastCallFunction(callable, actualParameterCount, &if_true,
-                                 &if_false);
-  BIND(&if_true);
-  result = Int32TrueConstant();
-  Goto(&done);
-
-  BIND(&if_false);
-  result = Int32FalseConstant();
-  Goto(&done);
-
-  BIND(&done);
-  return result.value();
-}
-
-TNode<SharedFunctionInfo> CodeStubAssembler::LoadSharedFunctionInfo(
-    TNode<JSFunction> function) {
-  return CAST(LoadObjectField(function, JSFunction::kSharedFunctionInfoOffset));
-}
-
-TNode<Int32T> CodeStubAssembler::LoadFormalParameterCount(
-    TNode<SharedFunctionInfo> sfi) {
-  return UncheckedCast<Int32T>(
-      LoadObjectField(sfi, SharedFunctionInfo::kFormalParameterCountOffset,
-                      MachineType::Uint16()));
-}
-
 TNode<BoolT> CodeStubAssembler::IsGeneratorFunction(
     TNode<JSFunction> function) {
   TNode<SharedFunctionInfo> const shared_function_info =

src/code-stub-assembler.h

@@ -679,34 +679,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                         callable, receiver, args...));
   }
 
-  // Checks whether we can use "FastCall" instead of "Call" when calling
-  // a JSFunction. This can be used for builtins where the user provides a
-  // callback. The callback doesn't change during execution of the builtin, so
-  // a lot of the checks that "Call" does can be done once upfront.
-  //
-  // These checks need to be kept in-sync with the "FastCall" and "Call*" stubs.
-  void BranchIfCanUseFastCallFunction(TNode<HeapObject> callable,
-                                      TNode<Int32T> actualParameterCount,
-                                      Label* if_true, Label* if_false);
-
-  // Uses the above function to simply return {true} or {false}, used in a
-  // CSA_SLOW_ASSERT.
-  TNode<BoolT> CanUseFastCallFunction(TNode<HeapObject> callable,
-                                      TNode<Int32T> actualParameterCount);
-
-  template <class... TArgs>
-  TNode<Object> FastCall(TNode<Context> context, TNode<Object> callable,
-                         TArgs... args) {
-    CSA_SLOW_ASSERT(this, CanUseFastCallFunction(
-                              CAST(callable), Int32Constant(sizeof...(TArgs))));
-
-    Callable call(isolate()->builtins()->builtin_handle(
-                      Builtins::kFastCallFunction_ReceiverIsNullOrUndefined),
-                  CallTrampolineDescriptor{});
-    return UncheckedCast<Object>(
-        CallJS(call, context, callable, UndefinedConstant(), args...));
-  }
-
   template <class A, class F, class G>
   TNode<A> Select(SloppyTNode<BoolT> condition, const F& true_body,
                   const G& false_body) {
@@ -1171,9 +1143,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Map> LoadJSArrayElementsMap(SloppyTNode<Int32T> kind,
                                     SloppyTNode<Context> native_context);
 
-  TNode<SharedFunctionInfo> LoadSharedFunctionInfo(TNode<JSFunction> function);
-  TNode<Int32T> LoadFormalParameterCount(TNode<SharedFunctionInfo> sfi);
-
   TNode<BoolT> IsGeneratorFunction(TNode<JSFunction> function);
   TNode<BoolT> HasPrototypeProperty(TNode<JSFunction> function, TNode<Map> map);
   void GotoIfPrototypeRequiresRuntimeLookup(TNode<JSFunction> function,

test/js-perf-test/ArraySort/sort-base.js

@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-"use strict";
-
 const kArraySize = 4000;
 let template_array = [];
 

test/mjsunit/array-sort-fast-call-builtin.js

-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Exercises the check that determines whether to use the
-// "FastCallFunction_" stub when calling the comparison function.
-
-(function TestClassConstructorAsCmpFn() {
-  class FooBar {};
-  assertThrows(() => [1, 2].sort(FooBar));
-})();
-
-
-const globalThis = this;
-(function TestGlobalProxyIsSetAsReceiverWhenSloppy() {
-  [1, 2].sort((a, b) => {
-    assertSame(globalThis, this);
-    return a - b;
-  });
-})();
-
-
-(function TestReceiverIsUndefinedWhenStrict() {
-  "use strict";
-
-  [1, 2].sort((a, b) => {
-    assertSame(undefined, this);
-    return a - b;
-  });
-})();
-
-
-(function TestBoundFunctionAsCmpFn() {
-  const object = { foo: "bar" };
-
-  function cmpfn(a, b) {
-    assertSame(this, object);
-    assertSame(this.foo, "bar");
-    return a - b;
-  };
-
-  const bound_cmpfn = cmpfn.bind(object);
-  [1, 2].sort(bound_cmpfn);
-})();

third_party/v8/builtins/array-sort.tq

@@ -323,21 +323,6 @@ module array {
     return v;
   }
 
-  builtin FastSortCompareUserFn(
-      context: Context, comparefn: Object, x: Object, y: Object): Number {
-    assert(comparefn != Undefined);
-    const cmpfn: Callable = UnsafeCast<Callable>(comparefn);
-
-    // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
-    const v: Number = ToNumber_Inline(context, FastCall(context, cmpfn, x, y));
-
-    // b. If v is NaN, return +0.
-    if (NumberIsNaN(v)) return 0;
-
-    // c. return v.
-    return v;
-  }
-
   builtin CanUseSameAccessor<ElementsAccessor : type>(
       context: Context, receiver: JSReceiver, initialReceiverMap: Object,
       initialReceiverLength: Number): Boolean {
@@ -1662,24 +1647,6 @@ module array {
         CanUseSameAccessor<GenericElementsAccessor>;
   }
 
-  // If no comparison function was provided, the default lexicographic compare
-  // is used. Otherwise we try to use a faster JS call by eliding some checks.
-  macro InitializeSortCompareFn(sortState: FixedArray, comparefnObj: Object) {
-    if (comparefnObj == Undefined) {
-      sortState[kSortComparePtrIdx] = SortCompareDefault;
-      return;
-    }
-
-    assert(TaggedIsNotSmi(comparefnObj));
-    assert(IsCallable(UnsafeCast<HeapObject>(comparefnObj)));
-
-    sortState[kSortComparePtrIdx] =
-        BranchIfCanUseFastCallFunction(
-            UnsafeCast<HeapObject>(comparefnObj), 2) ?
-        FastSortCompareUserFn :
-        SortCompareUserFn;
-  }
-
   macro ArrayTimSortImpl(context: Context, sortState: FixedArray, length: Smi)
   labels Bailout {
     InitializeSortState(sortState);
@@ -1771,10 +1738,11 @@ module array {
     let map: Map = obj.map;
 
     const sortState: FixedArray = AllocateZeroedFixedArray(kSortStateSize);
-    InitializeSortCompareFn(sortState, comparefnObj);
 
     sortState[kReceiverIdx] = obj;
     sortState[kUserCmpFnIdx] = comparefnObj;
+    sortState[kSortComparePtrIdx] =
+        comparefnObj != Undefined ? SortCompareUserFn : SortCompareDefault;
     sortState[kInitialReceiverMapIdx] = map;
     sortState[kBailoutStatusIdx] = kSuccess;