[turbofan] Fix Reflect.getPrototypeOf on primitives.

This fixes the lowering of Reflect.getPrototypeOf and friends to not
perform a [[ToObject]] coercion, but bailout instead. We ensure to
exclude primitive values from the lowering. This makes the lowering
uniform between "Reflect.getPrototypeOf" and "Object.getPrototypeOf".

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-740116
BUG=chromium:740116

Change-Id: If986ee2a3ae4e8f1fd227bdeb4668f523b0dea84
Reviewed-on: https://chromium-review.googlesource.com/565295Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46556}

src/compiler/js-call-reducer.cc

@@ -393,17 +393,12 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
   NodeProperties::InferReceiverMapsResult result =
       NodeProperties::InferReceiverMaps(object, effect, &object_maps);
   if (result != NodeProperties::kNoReceiverMaps) {
-    Handle<Map> candidate_map(
-        object_maps[0]->GetPrototypeChainRootMap(isolate()));
+    Handle<Map> candidate_map = object_maps[0];
     Handle<Object> candidate_prototype(candidate_map->prototype(), isolate());
 
-    // We cannot deal with primitives here.
-    if (candidate_map->IsPrimitiveMap()) return NoChange();
-
     // Check if we can constant-fold the {candidate_prototype}.
     for (size_t i = 0; i < object_maps.size(); ++i) {
-      Handle<Map> const object_map(
-          object_maps[i]->GetPrototypeChainRootMap(isolate()));
+      Handle<Map> object_map = object_maps[i];
       if (object_map->IsSpecialReceiverMap() ||
           object_map->has_hidden_prototype() ||
           object_map->prototype() != *candidate_prototype) {
@@ -412,6 +407,9 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
         // with hidden prototypes at this point.
         return NoChange();
       }
+      // The above check also excludes maps for primitive values, which is
+      // important because we are not applying [[ToObject]] here as expected.
+      DCHECK(!object_map->IsPrimitiveMap() && object_map->IsJSReceiverMap());
       if (result == NodeProperties::kUnreliableReceiverMaps &&
           !object_map->is_stable()) {
         return NoChange();

test/mjsunit/regress/regress-crbug-740116.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestReflectGetPrototypeOfOnPrimitive() {
+  function f() { return Reflect.getPrototypeOf(""); }
+  assertThrows(f, TypeError);
+  assertThrows(f, TypeError);
+  %OptimizeFunctionOnNextCall(f);
+  assertThrows(f, TypeError);
+})();
+
+(function TestObjectGetPrototypeOfOnPrimitive() {
+  function f() { return Object.getPrototypeOf(""); }
+  assertSame(String.prototype, f());
+  assertSame(String.prototype, f());
+  %OptimizeFunctionOnNextCall(f);
+  assertSame(String.prototype, f());
+})();
+
+(function TestDunderProtoOnPrimitive() {
+  function f() { return "".__proto__; }
+  assertSame(String.prototype, f());
+  assertSame(String.prototype, f());
+  %OptimizeFunctionOnNextCall(f);
+  assertSame(String.prototype, f());
+})();