From 0957bd96ac9ef98ef8edd8a3d754963c1b925ce6 Mon Sep 17 00:00:00 2001
From: "Ben L. Titzer" <titzer@chromium.org>
Date: Mon, 23 Oct 2017 14:24:53 +0200
Subject: [PATCH] [wasm] Fix subclassing for WebAssembly.* types.

R=rossberg@chromium.org

Bug: chromium:772636
Change-Id: I885f8657eb755953be17d7bf32aef2629092b9c2
Reviewed-on: https://chromium-review.googlesource.com/733086
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48830}
---
 src/objects.cc              |  4 ++++
 test/mjsunit/wasm/js-api.js | 14 ++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/src/objects.cc b/src/objects.cc
index 05273438ed..1c46003949 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -12829,6 +12829,10 @@ bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
     case JS_VALUE_TYPE:
     case JS_WEAK_MAP_TYPE:
     case JS_WEAK_SET_TYPE:
+    case WASM_INSTANCE_TYPE:
+    case WASM_MEMORY_TYPE:
+    case WASM_MODULE_TYPE:
+    case WASM_TABLE_TYPE:
       return true;
 
     case BIGINT_TYPE:
diff --git a/test/mjsunit/wasm/js-api.js b/test/mjsunit/wasm/js-api.js
index d2e0336d3b..c2f9e2cb21 100644
--- a/test/mjsunit/wasm/js-api.js
+++ b/test/mjsunit/wasm/js-api.js
@@ -889,3 +889,17 @@ assertInstantiateSuccess(importingModuleBinary, {'': {f: () => {}}});
 assertInstantiateSuccess(importingModuleBinary.buffer, {'': {f: () => {}}});
 assertInstantiateSuccess(
     memoryImportingModuleBinary, {'': {'my_memory': scratch_memory}});
+
+(function TestSubclassing() {
+  class M extends WebAssembly.Module { }
+  assertThrows(() => new M());
+
+  class I extends WebAssembly.Instance { }
+  assertThrows(() => new I());
+
+  class T extends WebAssembly.Table { }
+  assertThrows(() => new T());
+
+  class Y extends WebAssembly.Memory { }
+  assertThrows(() => new Y());
+})();