Migrate Object.prototype.valueOf to CSA

BUG=v8:6005

Review-Url: https://codereview.chromium.org/2724833002
Cr-Commit-Position: refs/heads/master@{#43539}

src/bootstrapper.cc

@@ -1270,6 +1270,10 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     SimpleInstallFunction(object_function, factory->values_string(),
                           Builtins::kObjectValues, 1, false);
 
+    Handle<JSFunction> object_value_of = SimpleInstallFunction(
+        isolate->initial_object_prototype(), "valueOf",
+        Builtins::kObjectPrototypeValueOf, 0, true);
+    native_context()->set_object_value_of(*object_value_of);
     SimpleInstallFunction(isolate->initial_object_prototype(),
                           "__defineGetter__", Builtins::kObjectDefineGetter, 2,
                           true);

src/builtins/builtins-object.cc

@@ -310,6 +310,17 @@ TF_BUILTIN(ObjectProtoToString, ObjectBuiltinsAssembler) {
   }
 }
 
+// ES6 19.3.7 Object.prototype.valueOf
+TF_BUILTIN(ObjectPrototypeValueOf, CodeStubAssembler) {
+  Node* receiver = Parameter(0);
+  Node* context = Parameter(3);
+
+  Callable to_object = CodeFactory::ToObject(isolate());
+  receiver = CallStub(to_object, context, receiver);
+
+  Return(receiver);
+}
+
 TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
   Node* prototype = Parameter(1);
   Node* properties = Parameter(2);

src/builtins/builtins.h

@@ -633,6 +633,7 @@ class Isolate;
   CPP(ObjectPreventExtensions)                                                 \
   /* ES6 section 19.1.3.6 Object.prototype.toString () */                      \
   TFJ(ObjectProtoToString, 0)                                                  \
+  TFJ(ObjectPrototypeValueOf, 0)                                               \
   CPP(ObjectPrototypePropertyIsEnumerable)                                     \
   CPP(ObjectPrototypeGetProto)                                                 \
   CPP(ObjectPrototypeSetProto)                                                 \

src/debug/debug-evaluate.cc

@@ -261,7 +261,7 @@ namespace {
 
 bool IntrinsicHasNoSideEffect(Runtime::FunctionId id) {
   switch (id) {
-    // Whitelist for intrinsics amd runtime functions.
+    // Whitelist for intrinsics and runtime functions.
     // Conversions.
     case Runtime::kToInteger:
     case Runtime::kInlineToInteger:
@@ -405,6 +405,8 @@ bool BytecodeHasNoSideEffect(interpreter::Bytecode bytecode) {
 bool BuiltinHasNoSideEffect(Builtins::Name id) {
   switch (id) {
     // Whitelist for builtins.
+    // Object builtins.
+    case Builtins::kObjectPrototypeValueOf:
     // Array builtins.
     case Builtins::kArrayCode:
     case Builtins::kArrayIndexOf:

src/js/v8natives.js

@@ -30,12 +30,6 @@ function ObjectToLocaleString() {
 }
 
 
-// ES6 19.1.3.7 Object.prototype.valueOf()
-function ObjectValueOf() {
-  return TO_OBJECT(this);
-}
-
-
 // ES6 19.1.3.3 Object.prototype.isPrototypeOf(V)
 function ObjectIsPrototypeOf(V) {
   if (!IS_RECEIVER(V)) return false;
@@ -75,7 +69,7 @@ function ObjectConstructor(x) {
 utils.InstallFunctions(GlobalObject.prototype, DONT_ENUM, [
   "toString", ObjectToString,
   "toLocaleString", ObjectToLocaleString,
-  "valueOf", ObjectValueOf,
+  // valueOf is added in bootstrapper.cc.
   "isPrototypeOf", ObjectIsPrototypeOf,
   // propertyIsEnumerable is added in bootstrapper.cc.
   // __defineGetter__ is added in bootstrapper.cc.
@@ -112,8 +106,4 @@ utils.Export(function(to) {
   to.ObjectHasOwnProperty = GlobalObject.prototype.hasOwnProperty;
 });
 
-%InstallToContext([
-  "object_value_of", ObjectValueOf,
-]);
-
 })

test/cctest/test-serialize.cc

@@ -868,7 +868,7 @@ TEST(CustomSnapshotDataBlobWithWarmup) {
     CHECK(IsCompiled("Math.abs"));
     CHECK(!IsCompiled("g"));
     CHECK(!IsCompiled("String.raw"));
-    CHECK(!IsCompiled("Object.valueOf"));
+    CHECK(!IsCompiled("Array.prototype.sort"));
     CHECK_EQ(5, CompileRun("a")->Int32Value(context).FromJust());
   }
   isolate->Dispose();