Reapply 7763, including arm and x64 variants.

The only difference to revision 7763 is the implementation in the
builtins file for arm and x64, plus a move of Array.prototype.toString
and Array.prototype.toLocaleString from should throw on null or
undefined to the non generic test cases in the function-call test (due
to us not currently supporting generic cases with these to functions)
Review URL: http://codereview.chromium.org/6928007

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@7786 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/arm/builtins-arm.cc

@@ -1238,11 +1238,21 @@ void Builtins::Generate_FunctionCall(MacroAssembler* masm) {
 
     // Do not transform the receiver for strict mode functions.
     __ ldr(r2, FieldMemOperand(r1, JSFunction::kSharedFunctionInfoOffset));
-    __ ldr(r2, FieldMemOperand(r2, SharedFunctionInfo::kCompilerHintsOffset));
-    __ tst(r2, Operand(1 << (SharedFunctionInfo::kStrictModeFunction +
+    __ ldr(r3, FieldMemOperand(r2, SharedFunctionInfo::kCompilerHintsOffset));
+    __ tst(r3, Operand(1 << (SharedFunctionInfo::kStrictModeFunction +
                              kSmiTagSize)));
     __ b(ne, &shift_arguments);
 
+    // Do not transform the receiver for native (shared already in r2).
+    __ ldr(r2, FieldMemOperand(r2, SharedFunctionInfo::kScriptOffset));
+    __ LoadRoot(r3, Heap::kUndefinedValueRootIndex);
+    __ cmp(r2, r3);
+    __ b(eq, &shift_arguments);
+    __ ldr(r2, FieldMemOperand(r2, Script::kTypeOffset));
+    __ mov(r2, Operand(r2, ASR, kSmiTagSize));
+    __ cmp(r2, Operand(Script::TYPE_NATIVE));
+    __ b(eq, &shift_arguments);
+
     // Compute the receiver in non-strict mode.
     __ add(r2, sp, Operand(r0, LSL, kPointerSizeLog2));
     __ ldr(r2, MemOperand(r2, -kPointerSize));
@@ -1252,10 +1262,10 @@ void Builtins::Generate_FunctionCall(MacroAssembler* masm) {
     __ tst(r2, Operand(kSmiTagMask));
     __ b(eq, &convert_to_object);
 
-    __ LoadRoot(r3, Heap::kNullValueRootIndex);
+    // Heap::kUndefinedValueRootIndex is already in r3.
     __ cmp(r2, r3);
     __ b(eq, &use_global_receiver);
-    __ LoadRoot(r3, Heap::kUndefinedValueRootIndex);
+    __ LoadRoot(r3, Heap::kNullValueRootIndex);
     __ cmp(r2, r3);
     __ b(eq, &use_global_receiver);
 
@@ -1416,19 +1426,29 @@ void Builtins::Generate_FunctionApply(MacroAssembler* masm) {
   __ ldr(r0, MemOperand(fp, kRecvOffset));
 
   // Do not transform the receiver for strict mode functions.
-  __ ldr(r1, FieldMemOperand(r1, SharedFunctionInfo::kCompilerHintsOffset));
-  __ tst(r1, Operand(1 << (SharedFunctionInfo::kStrictModeFunction +
+  __ ldr(r2, FieldMemOperand(r1, SharedFunctionInfo::kCompilerHintsOffset));
+  __ tst(r2, Operand(1 << (SharedFunctionInfo::kStrictModeFunction +
                            kSmiTagSize)));
   __ b(ne, &push_receiver);
 
+  // Do not transform the receiver for native (shared already in r1).
+  __ ldr(r1, FieldMemOperand(r1, SharedFunctionInfo::kScriptOffset));
+  __ LoadRoot(r2, Heap::kUndefinedValueRootIndex);
+  __ cmp(r1, r2);
+  __ b(eq, &push_receiver);
+  __ ldr(r1, FieldMemOperand(r1, Script::kTypeOffset));
+  __ mov(r1, Operand(r1, ASR, kSmiTagSize));
+  __ cmp(r1, Operand(Script::TYPE_NATIVE));
+  __ b(eq, &push_receiver);
+
   // Compute the receiver in non-strict mode.
   __ tst(r0, Operand(kSmiTagMask));
   __ b(eq, &call_to_object);
   __ LoadRoot(r1, Heap::kNullValueRootIndex);
   __ cmp(r0, r1);
   __ b(eq, &use_global_receiver);
-  __ LoadRoot(r1, Heap::kUndefinedValueRootIndex);
-  __ cmp(r0, r1);
+  // Heap::kUndefinedValueRootIndex is already in r2.
+  __ cmp(r0, r2);
   __ b(eq, &use_global_receiver);
 
   // Check if the receiver is already a JavaScript object.

src/array.js

@@ -397,6 +397,11 @@ function ArrayToLocaleString() {
 
 
 function ArrayJoin(separator) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.join"]);
+  }
+
   if (IS_UNDEFINED(separator)) {
     separator = ',';
   } else if (!IS_STRING(separator)) {
@@ -413,6 +418,11 @@ function ArrayJoin(separator) {
 // Removes the last element from the array and returns it. See
 // ECMA-262, section 15.4.4.6.
 function ArrayPop() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.pop"]);
+  }
+
   var n = TO_UINT32(this.length);
   if (n == 0) {
     this.length = n;
@@ -429,6 +439,11 @@ function ArrayPop() {
 // Appends the arguments to the end of the array and returns the new
 // length of the array. See ECMA-262, section 15.4.4.7.
 function ArrayPush() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.push"]);
+  }
+
   var n = TO_UINT32(this.length);
   var m = %_ArgumentsLength();
   for (var i = 0; i < m; i++) {
@@ -440,6 +455,11 @@ function ArrayPush() {
 
 
 function ArrayConcat(arg1) {  // length == 1
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.concat"]);
+  }
+
   var arg_count = %_ArgumentsLength();
   var arrays = new InternalArray(1 + arg_count);
   arrays[0] = this;
@@ -496,6 +516,11 @@ function SparseReverse(array, len) {
 
 
 function ArrayReverse() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.reverse"]);
+  }
+
   var j = TO_UINT32(this.length) - 1;
 
   if (UseSparseVariant(this, j, IS_ARRAY(this))) {
@@ -527,6 +552,11 @@ function ArrayReverse() {
 
 
 function ArrayShift() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.shift"]);
+  }
+
   var len = TO_UINT32(this.length);
 
   if (len === 0) {
@@ -548,6 +578,11 @@ function ArrayShift() {
 
 
 function ArrayUnshift(arg1) {  // length == 1
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.unshift"]);
+  }
+
   var len = TO_UINT32(this.length);
   var num_arguments = %_ArgumentsLength();
 
@@ -567,6 +602,11 @@ function ArrayUnshift(arg1) {  // length == 1
 
 
 function ArraySlice(start, end) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.slice"]);
+  }
+
   var len = TO_UINT32(this.length);
   var start_i = TO_INTEGER(start);
   var end_i = len;
@@ -604,6 +644,11 @@ function ArraySlice(start, end) {
 
 
 function ArraySplice(start, delete_count) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.splice"]);
+  }
+
   var num_arguments = %_ArgumentsLength();
 
   var len = TO_UINT32(this.length);
@@ -675,6 +720,11 @@ function ArraySplice(start, delete_count) {
 
 
 function ArraySort(comparefn) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.sort"]);
+  }
+
   // In-place QuickSort algorithm.
   // For short (length <= 22) arrays, insertion sort is used for efficiency.
 
@@ -936,6 +986,11 @@ function ArraySort(comparefn) {
 // preserving the semantics, since the calls to the receiver function can add
 // or delete elements from the array.
 function ArrayFilter(f, receiver) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.filter"]);
+  }
+
   if (!IS_FUNCTION(f)) {
     throw MakeTypeError('called_non_callable', [ f ]);
   }
@@ -957,6 +1012,11 @@ function ArrayFilter(f, receiver) {
 
 
 function ArrayForEach(f, receiver) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.forEach"]);
+  }
+
   if (!IS_FUNCTION(f)) {
     throw MakeTypeError('called_non_callable', [ f ]);
   }
@@ -975,6 +1035,11 @@ function ArrayForEach(f, receiver) {
 // Executes the function once for each element present in the
 // array until it finds one where callback returns true.
 function ArraySome(f, receiver) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.some"]);
+  }
+
   if (!IS_FUNCTION(f)) {
     throw MakeTypeError('called_non_callable', [ f ]);
   }
@@ -992,6 +1057,11 @@ function ArraySome(f, receiver) {
 
 
 function ArrayEvery(f, receiver) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.every"]);
+  }
+
   if (!IS_FUNCTION(f)) {
     throw MakeTypeError('called_non_callable', [ f ]);
   }
@@ -1008,6 +1078,11 @@ function ArrayEvery(f, receiver) {
 }
 
 function ArrayMap(f, receiver) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.map"]);
+  }
+
   if (!IS_FUNCTION(f)) {
     throw MakeTypeError('called_non_callable', [ f ]);
   }
@@ -1028,6 +1103,11 @@ function ArrayMap(f, receiver) {
 
 
 function ArrayIndexOf(element, index) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.indexOf"]);
+  }
+
   var length = TO_UINT32(this.length);
   if (length == 0) return -1;
   if (IS_UNDEFINED(index)) {
@@ -1085,6 +1165,11 @@ function ArrayIndexOf(element, index) {
 
 
 function ArrayLastIndexOf(element, index) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.lastIndexOf"]);
+  }
+
   var length = TO_UINT32(this.length);
   if (length == 0) return -1;
   if (%_ArgumentsLength() < 2) {
@@ -1138,6 +1223,11 @@ function ArrayLastIndexOf(element, index) {
 
 
 function ArrayReduce(callback, current) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.reduce"]);
+  }
+
   if (!IS_FUNCTION(callback)) {
     throw MakeTypeError('called_non_callable', [callback]);
   }
@@ -1167,6 +1257,11 @@ function ArrayReduce(callback, current) {
 }
 
 function ArrayReduceRight(callback, current) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Array.prototype.reduceRight"]);
+  }
+
   if (!IS_FUNCTION(callback)) {
     throw MakeTypeError('called_non_callable', [callback]);
   }

src/date.js

@@ -684,7 +684,7 @@ function DateGetUTCDate() {
 
 // ECMA 262 - 15.9.5.16
 function DateGetDay() {
-  var t = %_ValueOf(this);
+  var t = DATE_VALUE(this);
   if (NUMBER_IS_NAN(t)) return t;
   return WeekDay(LocalTimeNoCheck(t));
 }
@@ -692,7 +692,7 @@ function DateGetDay() {
 
 // ECMA 262 - 15.9.5.17
 function DateGetUTCDay() {
-  var t = %_ValueOf(this);
+  var t = DATE_VALUE(this);
   if (NUMBER_IS_NAN(t)) return t;
   return WeekDay(t);
 }

src/ia32/builtins-ia32.cc

@@ -599,6 +599,15 @@ void Builtins::Generate_FunctionCall(MacroAssembler* masm) {
               1 << SharedFunctionInfo::kStrictModeBitWithinByte);
     __ j(not_equal, &shift_arguments);
 
+    // Do not transform the receiver for natives (shared already in ebx).
+    __ mov(ebx, FieldOperand(ebx, SharedFunctionInfo::kScriptOffset));
+    __ cmp(ebx, factory->undefined_value());
+    __ j(equal, &shift_arguments);
+    __ mov(ebx, FieldOperand(ebx, Script::kTypeOffset));
+    __ SmiUntag(ebx);
+    __ cmp(ebx, Script::TYPE_NATIVE);
+    __ j(equal, &shift_arguments);
+
     // Compute the receiver in non-strict mode.
     __ mov(ebx, Operand(esp, eax, times_4, 0));  // First argument.
     __ test(ebx, Immediate(kSmiTagMask));
@@ -755,10 +764,20 @@ void Builtins::Generate_FunctionApply(MacroAssembler* masm) {
             1 << SharedFunctionInfo::kStrictModeBitWithinByte);
   __ j(not_equal, &push_receiver);
 
+  Factory* factory = masm->isolate()->factory();
+
+  // Do not transform the receiver for natives (shared already in ecx).
+  __ mov(ecx, FieldOperand(ecx, SharedFunctionInfo::kScriptOffset));
+  __ cmp(ecx, factory->undefined_value());
+  __ j(equal, &push_receiver);
+  __ mov(ecx, FieldOperand(ecx, Script::kTypeOffset));
+  __ SmiUntag(ecx);
+  __ cmp(ecx, Script::TYPE_NATIVE);
+  __ j(equal, &push_receiver);
+
   // Compute the receiver in non-strict mode.
   __ test(ebx, Immediate(kSmiTagMask));
   __ j(zero, &call_to_object);
-  Factory* factory = masm->isolate()->factory();
   __ cmp(ebx, factory->null_value());
   __ j(equal, &use_global_receiver);
   __ cmp(ebx, factory->undefined_value());

src/messages.js

@@ -207,6 +207,7 @@ function FormatMessage(message) {
       invalid_json:                 ["String '", "%0", "' is not valid JSON"],
       circular_structure:           ["Converting circular structure to JSON"],
       obj_ctor_property_non_object: ["Object.", "%0", " called on non-object"],
+      called_on_null_or_undefined:  ["%0", " called on null or undefined"],
       array_indexof_not_defined:    ["Array.getIndexOf: Argument undefined"],
       object_not_extensible:        ["Can't add property ", "%0", ", object is not extensible"],
       illegal_access:               ["Illegal access"],
@@ -1070,6 +1071,10 @@ function errorToStringDetectCycle() {
 }
 
 function errorToString() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Error.prototype.toString"]);
+  }
   // This helper function is needed because access to properties on
   // the builtins object do not work inside of a catch clause.
   function isCyclicErrorMarker(o) { return o === cyclic_error_marker; }

src/string.js

@@ -62,6 +62,10 @@ function StringValueOf() {
 
 // ECMA-262, section 15.5.4.4
 function StringCharAt(pos) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.charAt"]);
+  }
   var result = %_StringCharAt(this, pos);
   if (%_IsSmi(result)) {
     result = %_StringCharAt(TO_STRING_INLINE(this), TO_INTEGER(pos));
@@ -72,6 +76,10 @@ function StringCharAt(pos) {
 
 // ECMA-262 section 15.5.4.5
 function StringCharCodeAt(pos) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.charCodeAt"]);
+  }
   var result = %_StringCharCodeAt(this, pos);
   if (!%_IsSmi(result)) {
     result = %_StringCharCodeAt(TO_STRING_INLINE(this), TO_INTEGER(pos));
@@ -82,6 +90,9 @@ function StringCharCodeAt(pos) {
 
 // ECMA-262, section 15.5.4.6
 function StringConcat() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined", ["String.prototype.concat"]);
+  }
   var len = %_ArgumentsLength();
   var this_as_string = TO_STRING_INLINE(this);
   if (len === 1) {
@@ -102,6 +113,10 @@ function StringConcat() {
 
 // ECMA-262 section 15.5.4.7
 function StringIndexOf(pattern /* position */) {  // length == 1
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.indexOf"]);
+  }
   var subject = TO_STRING_INLINE(this);
   pattern = TO_STRING_INLINE(pattern);
   var index = 0;
@@ -117,6 +132,10 @@ function StringIndexOf(pattern /* position */) {  // length == 1
 
 // ECMA-262 section 15.5.4.8
 function StringLastIndexOf(pat /* position */) {  // length == 1
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.lastIndexOf"]);
+  }
   var sub = TO_STRING_INLINE(this);
   var subLength = sub.length;
   var pat = TO_STRING_INLINE(pat);
@@ -146,6 +165,10 @@ function StringLastIndexOf(pat /* position */) {  // length == 1
 // This function is implementation specific.  For now, we do not
 // do anything locale specific.
 function StringLocaleCompare(other) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.localeCompare"]);
+  }
   if (%_ArgumentsLength() === 0) return 0;
   return %StringLocaleCompare(TO_STRING_INLINE(this), 
                               TO_STRING_INLINE(other));
@@ -154,6 +177,10 @@ function StringLocaleCompare(other) {
 
 // ECMA-262 section 15.5.4.10
 function StringMatch(regexp) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.match"]);
+  }
   var subject = TO_STRING_INLINE(this);
   if (IS_REGEXP(regexp)) {
     if (!regexp.global) return RegExpExecNoTests(regexp, subject, 0);
@@ -187,6 +214,10 @@ var reusableMatchInfo = [2, "", "", -1, -1];
 
 // ECMA-262, section 15.5.4.11
 function StringReplace(search, replace) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.replace"]);
+  }
   var subject = TO_STRING_INLINE(this);
 
   // Delegate to one of the regular expression variants if necessary.
@@ -467,6 +498,10 @@ function StringReplaceNonGlobalRegExpWithFunction(subject, regexp, replace) {
 
 // ECMA-262 section 15.5.4.12
 function StringSearch(re) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.search"]);
+  }
   var regexp;
   if (IS_STRING(re)) {
     regexp = %_GetFromCache(STRING_TO_REGEXP_CACHE_ID, re);
@@ -485,6 +520,10 @@ function StringSearch(re) {
 
 // ECMA-262 section 15.5.4.13
 function StringSlice(start, end) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.slice"]);
+  }
   var s = TO_STRING_INLINE(this);
   var s_len = s.length;
   var start_i = TO_INTEGER(start);
@@ -520,6 +559,10 @@ function StringSlice(start, end) {
 
 // ECMA-262 section 15.5.4.14
 function StringSplit(separator, limit) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.split"]);
+  }
   var subject = TO_STRING_INLINE(this);
   limit = (IS_UNDEFINED(limit)) ? 0xffffffff : TO_UINT32(limit);
   if (limit === 0) return [];
@@ -613,6 +656,10 @@ function StringSplit(separator, limit) {
 
 // ECMA-262 section 15.5.4.15
 function StringSubstring(start, end) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.subString"]);
+  }
   var s = TO_STRING_INLINE(this);
   var s_len = s.length;
 
@@ -646,6 +693,10 @@ function StringSubstring(start, end) {
 
 // This is not a part of ECMA-262.
 function StringSubstr(start, n) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.substr"]);
+  }
   var s = TO_STRING_INLINE(this);
   var len;
 
@@ -686,37 +737,65 @@ function StringSubstr(start, n) {
 
 // ECMA-262, 15.5.4.16
 function StringToLowerCase() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.toLowerCase"]);
+  }
   return %StringToLowerCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.17
 function StringToLocaleLowerCase() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.toLocaleLowerCase"]);
+  }
   return %StringToLowerCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.18
 function StringToUpperCase() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.toUpperCase"]);
+  }
   return %StringToUpperCase(TO_STRING_INLINE(this));
 }
 
 
 // ECMA-262, 15.5.4.19
 function StringToLocaleUpperCase() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.toLocaleUpperCase"]);
+  }
   return %StringToUpperCase(TO_STRING_INLINE(this));
 }
 
 // ES5, 15.5.4.20
 function StringTrim() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.trim"]);
+  }
   return %StringTrim(TO_STRING_INLINE(this), true, true);
 }
 
 function StringTrimLeft() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.trimLeft"]);
+  }
   return %StringTrim(TO_STRING_INLINE(this), true, false);
 }
 
 function StringTrimRight() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["String.prototype.trimRight"]);
+  }
   return %StringTrim(TO_STRING_INLINE(this), false, true);
 }
 

src/v8natives.js

@@ -208,12 +208,20 @@ $Object.prototype.constructor = $Object;
 
 // ECMA-262 - 15.2.4.2
 function ObjectToString() {
+  if (IS_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    return '[object Undefined]';
+  }
+  if (IS_NULL(this)) return  '[object Null]';
   return "[object " + %_ClassOf(ToObject(this)) + "]";
 }
 
 
 // ECMA-262 - 15.2.4.3
 function ObjectToLocaleString() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Object.prototype.toLocaleString"]);
+  }
   return this.toString();
 }
 
@@ -232,6 +240,10 @@ function ObjectHasOwnProperty(V) {
 
 // ECMA-262 - 15.2.4.6
 function ObjectIsPrototypeOf(V) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Object.prototype.isPrototypeOf"]);
+  }
   if (!IS_SPEC_OBJECT(V)) return false;
   return %IsInPrototypeChain(this, V);
 }
@@ -1062,6 +1074,10 @@ function NumberToString(radix) {
 
 // ECMA-262 section 15.7.4.3
 function NumberToLocaleString() {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Number.prototype.toLocaleString"]);
+  }
   return this.toString();
 }
 
@@ -1082,6 +1098,10 @@ function NumberToFixed(fractionDigits) {
   if (f < 0 || f > 20) {
     throw new $RangeError("toFixed() digits argument must be between 0 and 20");
   }
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Number.prototype.toFixed"]);
+  }
   var x = ToNumber(this);
   return %NumberToFixed(x, f);
 }
@@ -1096,6 +1116,10 @@ function NumberToExponential(fractionDigits) {
       throw new $RangeError("toExponential() argument must be between 0 and 20");
     }
   }
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Number.prototype.toExponential"]);
+  }
   var x = ToNumber(this);
   return %NumberToExponential(x, f);
 }
@@ -1103,6 +1127,10 @@ function NumberToExponential(fractionDigits) {
 
 // ECMA-262 section 15.7.4.7
 function NumberToPrecision(precision) {
+  if (IS_NULL_OR_UNDEFINED(this) && !IS_UNDETECTABLE(this)) {
+    throw MakeTypeError("called_on_null_or_undefined",
+                        ["Number.prototype.toPrecision"]);
+  }
   if (IS_UNDEFINED(precision)) return ToString(%_ValueOf(this));
   var p = TO_INTEGER(precision);
   if (p < 1 || p > 21) {
@@ -1171,6 +1199,7 @@ function FunctionSourceString(func) {
   }
 
   var source = %FunctionGetSourceCode(func);
+  if (!IS_STRING(source)) return "NOT A string";
   if (!IS_STRING(source) || %FunctionIsBuiltin(func)) {
     var name = %FunctionGetName(func);
     if (name) {

src/x64/builtins-x64.cc

@@ -658,6 +658,15 @@ void Builtins::Generate_FunctionCall(MacroAssembler* masm) {
              Immediate(1 << SharedFunctionInfo::kStrictModeBitWithinByte));
     __ j(not_equal, &shift_arguments);
 
+    // Do not transform the receiver for natives.
+    // SharedFunctionInfo is already loaded into rbx.
+    __ movq(rbx, FieldOperand(rbx, SharedFunctionInfo::kScriptOffset));
+    __ CompareRoot(rbx, Heap::kUndefinedValueRootIndex);
+    __ j(equal, &shift_arguments);
+    __ SmiCompare(FieldOperand(rbx, Script::kTypeOffset),
+               Smi::FromInt(Script::TYPE_NATIVE));
+    __ j(equal, &shift_arguments);
+
     // Compute the receiver in non-strict mode.
     __ movq(rbx, Operand(rsp, rax, times_pointer_size, 0));
     __ JumpIfSmi(rbx, &convert_to_object);
@@ -822,6 +831,15 @@ void Builtins::Generate_FunctionApply(MacroAssembler* masm) {
            Immediate(1 << SharedFunctionInfo::kStrictModeBitWithinByte));
   __ j(not_equal, &push_receiver);
 
+  // Do not transform the receiver for natives.
+  // SharedFunctionInfo is already loaded into rdx.
+  __ movq(rdx, FieldOperand(rdx, SharedFunctionInfo::kScriptOffset));
+  __ CompareRoot(rdx, Heap::kUndefinedValueRootIndex);
+  __ j(equal, &push_receiver);
+  __ SmiCompare(FieldOperand(rdx, Script::kTypeOffset),
+             Smi::FromInt(Script::TYPE_NATIVE));
+  __ j(equal, &push_receiver);
+
   // Compute the receiver in non-strict mode.
   __ JumpIfSmi(rbx, &call_to_object);
   __ CompareRoot(rbx, Heap::kNullValueRootIndex);

test/es5conform/es5conform.status

@@ -172,14 +172,6 @@ chapter15/15.2/15.2.3/15.2.3.4/15.2.3.4-4-34: FAIL_OK
 # SUBSETFAIL
 chapter15/15.2/15.2.3/15.2.3.4/15.2.3.4-4-35: FAIL_OK
 
-# Bad test - the spec does not say anything about throwing errors
-# on calling Array.prototype.indexOf with undefined as argument.
-chapter15/15.4/15.4.4/15.4.4.14/15.4.4.14-1-1: FAIL_OK
-
-# Bad test - the spec does not say anything about throwing errors
-# on calling Array.prototype.indexOf with null as argument.
-chapter15/15.4/15.4.4/15.4.4.14/15.4.4.14-1-2: FAIL_OK
-
 # Bad test - the test at the end should be "i === true".
 chapter15/15.4/15.4.4/15.4.4.17/15.4.4.17-8-10: FAIL_OK
 
@@ -204,10 +196,6 @@ chapter15/15.4/15.4.4/15.4.4.22/15.4.4.22-9-c-ii-4-s: SKIP
 # have no effect on the actual array on which reduceRight is called.
 chapter15/15.4/15.4.4/15.4.4.22/15.4.4.22-9-7: FAIL_OK
 
-# We do not implement trim correctly on null and undefined.
-chapter15/15.5/15.5.4/15.5.4.20/15.5.4.20-1-1: FAIL
-chapter15/15.5/15.5.4/15.5.4.20/15.5.4.20-1-2: FAIL
-
 # We do not correctly recognize \uFEFF as whitespace
 chapter15/15.5/15.5.4/15.5.4.20/15.5.4.20-4-10: FAIL
 chapter15/15.5/15.5.4/15.5.4.20/15.5.4.20-4-18: FAIL

test/mjsunit/function-call.js

+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+var should_throw_on_null_and_undefined =
+    [Object.prototype.toLocaleString,
+     Object.prototype.valueOf,
+     Object.prototype.hasOwnProperty,
+     Object.prototype.isPrototypeOf,
+     Object.prototype.propertyIsEnumerable,
+     Array.prototype.concat,
+     Array.prototype.join,
+     Array.prototype.pop,
+     Array.prototype.push,
+     Array.prototype.reverse,
+     Array.prototype.shift,
+     Array.prototype.slice,
+     Array.prototype.sort,
+     Array.prototype.splice,
+     Array.prototype.unshift,
+     Array.prototype.indexOf,
+     Array.prototype.lastIndexOf,
+     Array.prototype.every,
+     Array.prototype.some,
+     Array.prototype.forEach,
+     Array.prototype.map,
+     Array.prototype.filter,
+     Array.prototype.reduce,
+     Array.prototype.reduceRight,
+     String.prototype.charAt,
+     String.prototype.charCodeAt,
+     String.prototype.concat,
+     String.prototype.indexOf,
+     String.prototype.lastIndexOf,
+     String.prototype.localeCompare,
+     String.prototype.match,
+     String.prototype.replace,
+     String.prototype.search,
+     String.prototype.slice,
+     String.prototype.split,
+     String.prototype.substring,
+     String.prototype.toLowerCase,
+     String.prototype.toLocaleLowerCase,
+     String.prototype.toUpperCase,
+     String.prototype.toLocaleUpperCase,
+     String.prototype.trim,
+     Number.prototype.toLocaleString,
+     Error.prototype.toString];
+
+// Non generic natives do not work on any input other than the specific
+// type, but since this change will allow call to be invoked with undefined
+// or null as this we still explicitly test that we throw on these here.
+var non_generic =
+    [Array.prototype.toString,
+     Array.prototype.toLocaleString,
+     Function.prototype.toString,
+     Function.prototype.call,
+     Function.prototype.apply,
+     String.prototype.toString,
+     String.prototype.valueOf,
+     Boolean.prototype.toString,
+     Boolean.prototype.valueOf,
+     Number.prototype.toString,
+     Number.prototype.valueOf,
+     Number.prototype.toFixed,
+     Number.prototype.toExponential,
+     Number.prototype.toPrecision,
+     Date.prototype.toString,
+     Date.prototype.toDateString,
+     Date.prototype.toTimeString,
+     Date.prototype.toLocaleString,
+     Date.prototype.toLocaleDateString,
+     Date.prototype.toLocaleTimeString,
+     Date.prototype.valueOf,
+     Date.prototype.getTime,
+     Date.prototype.getFullYear,
+     Date.prototype.getUTCFullYear,
+     Date.prototype.getMonth,
+     Date.prototype.getUTCMonth,
+     Date.prototype.getDate,
+     Date.prototype.getUTCDate,
+     Date.prototype.getDay,
+     Date.prototype.getUTCDay,
+     Date.prototype.getHours,
+     Date.prototype.getUTCHours,
+     Date.prototype.getMinutes,
+     Date.prototype.getUTCMinutes,
+     Date.prototype.getSeconds,
+     Date.prototype.getUTCSeconds,
+     Date.prototype.getMilliseconds,
+     Date.prototype.getUTCMilliseconds,
+     Date.prototype.getTimezoneOffset,
+     Date.prototype.setTime,
+     Date.prototype.setMilliseconds,
+     Date.prototype.setUTCMilliseconds,
+     Date.prototype.setSeconds,
+     Date.prototype.setUTCSeconds,
+     Date.prototype.setMinutes,
+     Date.prototype.setUTCMinutes,
+     Date.prototype.setHours,
+     Date.prototype.setUTCHours,
+     Date.prototype.setDate,
+     Date.prototype.setUTCDate,
+     Date.prototype.setMonth,
+     Date.prototype.setUTCMonth,
+     Date.prototype.setFullYear,
+     Date.prototype.setUTCFullYear,
+     Date.prototype.toUTCString,
+     Date.prototype.toISOString,
+     Date.prototype.toJSON,
+     RegExp.prototype.exec,
+     RegExp.prototype.test,
+     RegExp.prototype.toString];
+
+
+// Mapping functions.
+var mapping_functions =
+    [Array.prototype.every,
+     Array.prototype.some,
+     Array.prototype.forEach,
+     Array.prototype.map,
+     Array.prototype.filter];
+
+// Reduce functions.
+var reducing_functions =
+    [Array.prototype.reduce,
+     Array.prototype.reduceRight];
+
+// Test that all natives using the ToObject call throw the right exception.
+for (var i = 0; i < should_throw_on_null_and_undefined.length; i++) {
+  // Sanity check that all functions are correct
+  assertEquals(typeof(should_throw_on_null_and_undefined[i]), "function");
+
+  try {
+    // We call all functions with no parameters, which means that essential
+    // parameters will have the undefined value.
+    // The test for whether the "this" value is null or undefined is always
+    // performed before access to the other parameters, so even if the
+    // undefined value is an invalid argument value, it mustn't change
+    // the result of the test.
+    should_throw_on_null_and_undefined[i].call(null);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue("called_on_null_or_undefined" == e.type ||
+               "null_to_object" == e.type);
+  }
+
+  try {
+    should_throw_on_null_and_undefined[i].call(undefined);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue("called_on_null_or_undefined" == e.type ||
+               "null_to_object" == e.type);
+  }
+
+  try {
+    should_throw_on_null_and_undefined[i].apply(null);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue("called_on_null_or_undefined" == e.type ||
+               "null_to_object" == e.type);
+  }
+
+  try {
+    should_throw_on_null_and_undefined[i].apply(undefined);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue("called_on_null_or_undefined" == e.type ||
+               "null_to_object" == e.type);
+  }
+}
+
+// Test that all natives that are non generic throw on null and undefined.
+for (var i = 0; i < non_generic.length; i++) {
+  // Sanity check that all functions are correct
+  assertEquals(typeof(non_generic[i]), "function");
+  try {
+    non_generic[i].call(null);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue(e instanceof TypeError);
+  }
+
+  try {
+    non_generic[i].call(null);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue(e instanceof TypeError);
+  }
+
+  try {
+    non_generic[i].apply(null);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue(e instanceof TypeError);
+  }
+
+  try {
+    non_generic[i].apply(null);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue(e instanceof TypeError);
+  }
+}
+
+
+// Test that we still throw when calling with thisArg null or undefined
+// through an array mapping function.
+var array = [1,2,3,4,5];
+for (var j = 0; j < mapping_functions.length; j++) {
+  for (var i = 0; i < should_throw_on_null_and_undefined.length; i++) {
+    try {
+      mapping_functions[j].call(array,
+                                should_throw_on_null_and_undefined[i],
+                                null);
+      assertUnreachable();
+    } catch (e) {
+      assertTrue("called_on_null_or_undefined" == e.type ||
+                 "null_to_object" == e.type);
+    }
+
+    try {
+      mapping_functions[j].call(array,
+                                should_throw_on_null_and_undefined[i],
+                                undefined);
+      assertUnreachable();
+    } catch (e) {
+      assertTrue("called_on_null_or_undefined" == e.type ||
+                 "null_to_object" == e.type);
+    }
+  }
+}
+
+for (var j = 0; j < mapping_functions.length; j++) {
+  for (var i = 0; i < non_generic.length; i++) {
+    try {
+      mapping_functions[j].call(array,
+                                non_generic[i],
+                                null);
+      assertUnreachable();
+    } catch (e) {
+      assertTrue(e instanceof TypeError);
+    }
+
+    try {
+      mapping_functions[j].call(array,
+                                non_generic[i],
+                                undefined);
+      assertUnreachable();
+    } catch (e) {
+      assertTrue(e instanceof TypeError);
+    }
+  }
+}
+
+
+// Reduce functions do a call with null as this argument.
+for (var j = 0; j < reducing_functions.length; j++) {
+  for (var i = 0; i < should_throw_on_null_and_undefined.length; i++) {
+    try {
+      reducing_functions[j].call(array, should_throw_on_null_and_undefined[i]);
+      assertUnreachable();
+    } catch (e) {
+      assertTrue("called_on_null_or_undefined" == e.type ||
+                 "null_to_object" == e.type);
+    }
+
+    try {
+      reducing_functions[j].call(array, should_throw_on_null_and_undefined[i]);
+      assertUnreachable();
+    } catch (e) {
+      assertTrue("called_on_null_or_undefined" == e.type ||
+                 "null_to_object" == e.type);
+    }
+  }
+}
+
+for (var j = 0; j < reducing_functions.length; j++) {
+  for (var i = 0; i < non_generic.length; i++) {
+    try {
+      reducing_functions[j].call(array, non_generic[i]);
+      assertUnreachable();
+    } catch (e) {
+      assertTrue(e instanceof TypeError);
+    }
+
+    try {
+      reducing_functions[j].call(array, non_generic[i]);
+      assertUnreachable();
+    } catch (e) {
+      assertTrue(e instanceof TypeError);
+    }
+  }
+}
+
+
+// Object.prototype.toString()
+assertEquals(Object.prototype.toString.call(null),
+             '[object Null]')
+
+assertEquals(Object.prototype.toString.call(undefined),
+             '[object Undefined]')

test/mjsunit/regress/regress-485.js

@@ -38,19 +38,6 @@ var builtin = Object.prototype.valueOf;  // Builtin function that returns this.
 
 assertEquals(global, builtin(), "Direct call to builtin");
 
-assertEquals(global, builtin.call(), "call() to builtin");
-assertEquals(global, builtin.call(null), "call(null) to builtin");
-assertEquals(global, builtin.call(undefined), "call(undefined) to builtin");
-
-assertEquals(global, builtin.apply(), "apply() to builtin");
-assertEquals(global, builtin.apply(null), "apply(null) to builtin");
-assertEquals(global, builtin.apply(undefined), "apply(undefined) to builtin");
-
-assertEquals(global, builtin.call.call(builtin), "call.call() to builtin");
-assertEquals(global, builtin.call.apply(builtin), "call.apply() to builtin");
-assertEquals(global, builtin.apply.call(builtin), "apply.call() to builtin");
-assertEquals(global, builtin.apply.apply(builtin), "apply.apply() to builtin");
-
 
 // Builtin that depends on value of this to compute result.
 var builtin2 = Object.prototype.toString;

test/mozilla/mozilla.status

@@ -610,6 +610,9 @@ js1_5/Regress/regress-306633: FAIL
 # We fail on out of memory.  The important thing is not to crash.
 js1_5/Regress/regress-303213: FAIL || TIMEOUT if $mode == debug
 
+# This test fails since we now throw in String.prototype.match when apply
+# is given null or undefined as this argument (and so does firefox nightly).
+js1_5/Regress/regress-295052: FAIL
 
 # Bug 1202592: New ecma_3/String/15.5.4.11 is failing.
 ecma_3/String/15.5.4.11: FAIL

test/sputnik/sputnik.status

@@ -179,7 +179,6 @@ S11.1.5_A4.2: FAIL_OK
 S9.9_A1: FAIL_OK
 S9.9_A2: FAIL_OK
 
-
 ##################### SKIPPED TESTS #####################
 
 # These tests take a looong time to run in debug mode.
@@ -189,26 +188,6 @@ S15.1.3.1_A2.5_T1: PASS, SKIP if $mode == debug
 # V8 Bug: http://code.google.com/p/v8/issues/detail?id=1196
 S8.7_A5_T2: FAIL
 
-# V8 bugs: http://code.google.com/p/v8/issues/detail?id=1198
-# V8 should not wrap this when calling builtin functions
-S15.2.4.3_A12: FAIL
-S15.2.4.7_A13: FAIL
-# Object.prototype.toString
-S15.2.4.2_A12: FAIL
-S15.2.4.2_A13: FAIL
-# Object.prototype.toLocaleString
-S15.2.4.3_A13: FAIL
-S15.2.4.4_A13: FAIL
-S15.2.4.4_A12: FAIL
-# Object.prototype.propertyIsEnumerable
-S15.2.4.7_A12: FAIL
-# Object.prototype.hasOwnProperty
-S15.2.4.5_A12: FAIL
-S15.2.4.5_A13: FAIL
-# Object.prototype.isPrototypeOf
-S15.2.4.6_A13: FAIL
-S15.2.4.6_A12: FAIL
-
 # Invalid test case (recent change adding var changes semantics)
 S8.3_A1_T1: FAIL
 # Test bug: http://code.google.com/p/sputniktests/issues/detail?id=35
@@ -270,6 +249,7 @@ S11.4.3_A3.6: FAIL_OK
 S15.10.7_A3_T2: FAIL_OK
 S15.10.7_A3_T1: FAIL_OK
 
+
 [ $arch == arm ]
 
 # BUG(3251225): Tests that timeout with --nocrankshaft.