[runtime] Remove unnecessary casts of species constructor.

... which caused assertion failures in --enable-slow-asserts mode.
The surrounding code treated the constructor value properly so regression
test is not necessary.

Bug: chromium:726622
Change-Id: Icd43d9117a1125bec8feca8eca5708993de2c3ef
Reviewed-on: https://chromium-review.googlesource.com/516626Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45543}

src/builtins/builtins-arraybuffer.cc

@@ -201,8 +201,7 @@ static Object* SliceHelper(BuiltinArguments args, Isolate* isolate,
 
     Handle<Object> new_obj;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, new_obj,
-        Execution::New(Handle<JSFunction>::cast(ctor), argc, argv.start()));
+        isolate, new_obj, Execution::New(isolate, ctor, argc, argv.start()));
 
     new_ = Handle<JSReceiver>::cast(new_obj);
   }

src/execution.cc

@@ -194,9 +194,9 @@ MaybeHandle<Object> Execution::Call(Isolate* isolate, Handle<Object> callable,
 
 
 // static
-MaybeHandle<Object> Execution::New(Handle<JSFunction> constructor, int argc,
-                                   Handle<Object> argv[]) {
-  return New(constructor->GetIsolate(), constructor, constructor, argc, argv);
+MaybeHandle<Object> Execution::New(Isolate* isolate, Handle<Object> constructor,
+                                   int argc, Handle<Object> argv[]) {
+  return New(isolate, constructor, constructor, argc, argv);
 }
 
 

src/execution.h

@@ -33,7 +33,8 @@ class Execution final : public AllStatic {
 
   // Construct object from function, the caller supplies an array of
   // arguments.
-  MUST_USE_RESULT static MaybeHandle<Object> New(Handle<JSFunction> constructor,
+  MUST_USE_RESULT static MaybeHandle<Object> New(Isolate* isolate,
+                                                 Handle<Object> constructor,
                                                  int argc,
                                                  Handle<Object> argv[]);
   MUST_USE_RESULT static MaybeHandle<Object> New(Isolate* isolate,

src/objects.cc

@@ -17180,13 +17180,14 @@ size_t JSTypedArray::element_size() {
 
 // static
 MaybeHandle<JSTypedArray> JSTypedArray::Create(Isolate* isolate,
-                                               Handle<JSFunction> default_ctor,
+                                               Handle<Object> default_ctor,
                                                int argc, Handle<Object>* argv,
                                                const char* method_name) {
   // 1. Let newTypedArray be ? Construct(constructor, argumentList).
   Handle<Object> new_obj;
-  ASSIGN_RETURN_ON_EXCEPTION(
-      isolate, new_obj, Execution::New(default_ctor, argc, argv), JSTypedArray);
+  ASSIGN_RETURN_ON_EXCEPTION(isolate, new_obj,
+                             Execution::New(isolate, default_ctor, argc, argv),
+                             JSTypedArray);
 
   // 2. Perform ? ValidateTypedArray(newTypedArray).
   Handle<JSTypedArray> new_array;
@@ -17239,8 +17240,7 @@ MaybeHandle<JSTypedArray> JSTypedArray::SpeciesCreate(
       JSTypedArray);
 
   // 4. Return ? TypedArrayCreate(constructor, argumentList).
-  return Create(isolate, Handle<JSFunction>::cast(ctor), argc, argv,
-                method_name);
+  return Create(isolate, ctor, argc, argv, method_name);
 }
 
 void JSGlobalObject::InvalidatePropertyCell(Handle<JSGlobalObject> global,

src/objects.h

@@ -8656,8 +8656,8 @@ class JSTypedArray: public JSArrayBufferView {
                                                    const char* method_name);
   // ES7 section 22.2.4.6 Create ( constructor, argumentList )
   static MaybeHandle<JSTypedArray> Create(Isolate* isolate,
-                                          Handle<JSFunction> default_ctor,
-                                          int argc, Handle<Object>* argv,
+                                          Handle<Object> default_ctor, int argc,
+                                          Handle<Object>* argv,
                                           const char* method_name);
   // ES7 section 22.2.4.7 TypedArraySpeciesCreate ( exemplar, argumentList )
   static MaybeHandle<JSTypedArray> SpeciesCreate(Isolate* isolate,

src/runtime/runtime-regexp.cc

@@ -1636,10 +1636,10 @@ RUNTIME_FUNCTION(Runtime_RegExpSplit) {
     argv[0] = recv;
     argv[1] = new_flags;
 
-    Handle<JSFunction> ctor_fun = Handle<JSFunction>::cast(ctor);
     Handle<Object> splitter_obj;
     ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-        isolate, splitter_obj, Execution::New(ctor_fun, argc, argv.start()));
+        isolate, splitter_obj,
+        Execution::New(isolate, ctor, argc, argv.start()));
 
     splitter = Handle<JSReceiver>::cast(splitter_obj);
   }