[builtins] Fix fast path of Function.prototype.bind.

Bug: chromium:827013
Change-Id: I07a04cbe278b35dcd822d71d0a39a19aa9b46eb3
Reviewed-on: https://chromium-review.googlesource.com/993053
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52331}

src/builtins/builtins-function-gen.cc

@@ -45,8 +45,13 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   // the actual value on the object changes.
   Comment("Check descriptor array length");
   TNode<DescriptorArray> descriptors = LoadMapDescriptors(receiver_map);
-  Node* descriptors_length = LoadFixedArrayBaseLength(descriptors);
-  GotoIf(SmiLessThanOrEqual(descriptors_length, SmiConstant(1)), &slow);
+  // Minimum descriptor array length required for fast path.
+  const int min_descriptors_length = DescriptorArray::LengthFor(Max(
+      JSFunction::kLengthDescriptorIndex, JSFunction::kNameDescriptorIndex));
+  TNode<Smi> descriptors_length = LoadFixedArrayBaseLength(descriptors);
+  GotoIf(SmiLessThanOrEqual(descriptors_length,
+                            SmiConstant(min_descriptors_length)),
+         &slow);
 
   // Check whether the length and name properties are still present as
   // AccessorInfo objects. In that case, their value can be recomputed even if
@@ -66,15 +71,15 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
     GotoIfNot(IsAccessorInfoMap(length_value_map), &slow);
 
     const int name_index = JSFunction::kNameDescriptorIndex;
-    Node* maybe_name = LoadFixedArrayElement(
-        descriptors, DescriptorArray::ToKeyIndex(name_index));
+    TNode<Name> maybe_name = CAST(LoadFixedArrayElement(
+        descriptors, DescriptorArray::ToKeyIndex(name_index)));
     GotoIf(WordNotEqual(maybe_name, LoadRoot(Heap::kname_stringRootIndex)),
            &slow);
 
-    Node* maybe_name_accessor = LoadFixedArrayElement(
+    TNode<Object> maybe_name_accessor = LoadFixedArrayElement(
         descriptors, DescriptorArray::ToValueIndex(name_index));
     GotoIf(TaggedIsSmi(maybe_name_accessor), &slow);
-    Node* name_value_map = LoadMap(maybe_name_accessor);
+    TNode<Map> name_value_map = LoadMap(CAST(maybe_name_accessor));
     GotoIfNot(IsAccessorInfoMap(name_value_map), &slow);
   }
 

test/mjsunit/regress/regress-crbug-827013.js

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function Test() {
+  var f = () => 42;
+  delete f.length;
+  delete f.name;
+
+  var g = Object.create(f);
+  for (var i = 0; i < 5; i++) {
+    g.dummy;
+  }
+  assertTrue(%HasFastProperties(f));
+
+  var h = f.bind(this);
+})();