[runtime] Remove nedless branch in ToObject builtin

Change-Id: I61d9e2555fa6063e6e047f7cadb9fbcf4cdba312
Reviewed-on: https://chromium-review.googlesource.com/654869
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47925}

src/builtins/builtins-conversion-gen.cc

@@ -312,7 +312,7 @@ TF_BUILTIN(ToInteger, CodeStubAssembler) {
 
 // ES6 section 7.1.13 ToObject (argument)
 TF_BUILTIN(ToObject, CodeStubAssembler) {
-  Label if_number(this, Label::kDeferred), if_notsmi(this), if_jsreceiver(this),
+  Label if_smi(this, Label::kDeferred), if_jsreceiver(this),
       if_noconstructor(this, Label::kDeferred), if_wrapjsvalue(this);
 
   Node* context = Parameter(Descriptor::kContext);
@@ -321,13 +321,9 @@ TF_BUILTIN(ToObject, CodeStubAssembler) {
   VARIABLE(constructor_function_index_var,
            MachineType::PointerRepresentation());
 
-  Branch(TaggedIsSmi(object), &if_number, &if_notsmi);
+  GotoIf(TaggedIsSmi(object), &if_smi);
 
-  BIND(&if_notsmi);
   Node* map = LoadMap(object);
-
-  GotoIf(IsHeapNumberMap(map), &if_number);
-
   Node* instance_type = LoadMapInstanceType(map);
   GotoIf(IsJSReceiverInstanceType(instance_type), &if_jsreceiver);
 
@@ -338,7 +334,7 @@ TF_BUILTIN(ToObject, CodeStubAssembler) {
   constructor_function_index_var.Bind(constructor_function_index);
   Goto(&if_wrapjsvalue);
 
-  BIND(&if_number);
+  BIND(&if_smi);
   constructor_function_index_var.Bind(
       IntPtrConstant(Context::NUMBER_FUNCTION_INDEX));
   Goto(&if_wrapjsvalue);

test/mjsunit/value-of.js

@@ -25,8 +25,18 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-function MyException() { }
+let valueOf = Object.prototype.valueOf;
+
+assertEquals('object', typeof valueOf.call(true));
+assertEquals('object', typeof valueOf.call(false));
+assertEquals('object', typeof valueOf.call(1.23));
+assertEquals('object', typeof valueOf.call(0));
+assertEquals('object', typeof valueOf.call('a'));
+assertEquals('object', typeof valueOf.call(Symbol.isConcatSpreadable));
+assertThrows(() => valueOf.call(undefined), TypeError);
+assertThrows(() => valueOf.call(null), TypeError);
 
+function MyException() { }
 var o = new Object();
 o.valueOf = function() { throw new MyException(); }