ee8d9f2eba
This fixes several problems with instanceof and constant field tracking in the compiler: - properly bailout on numbers and non-functions at @@hasInstance. - deopt on changes of @@hasInstance property. Bug: v8:8361 Change-Id: I4a1cf9e29d72076f2d37a7c703f18cb2fb8f4040 Reviewed-on: https://chromium-review.googlesource.com/c/1322449 Commit-Queue: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#57532}
107 lines
2.0 KiB
JavaScript
107 lines
2.0 KiB
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
(function NonConstHasInstance() {
|
|
var C = {
|
|
[Symbol.hasInstance] : () => true
|
|
};
|
|
|
|
function f() {
|
|
return {} instanceof C;
|
|
}
|
|
|
|
assertTrue(f());
|
|
assertTrue(f());
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertTrue(f());
|
|
C[Symbol.hasInstance] = () => false;
|
|
assertFalse(f());
|
|
})();
|
|
|
|
(function NumberHasInstance() {
|
|
var C = {
|
|
[Symbol.hasInstance] : 0.1
|
|
};
|
|
|
|
function f(b, C) {
|
|
if (b) return {} instanceof C;
|
|
return false;
|
|
}
|
|
|
|
function g(b) {
|
|
return f(b, C);
|
|
}
|
|
|
|
assertFalse(f(true, Number));
|
|
assertFalse(f(true, Number));
|
|
assertFalse(g(false));
|
|
assertFalse(g(false));
|
|
%OptimizeFunctionOnNextCall(g);
|
|
assertThrows(() => g(true));
|
|
})();
|
|
|
|
(function NonFunctionHasInstance() {
|
|
var C = {
|
|
[Symbol.hasInstance] : {}
|
|
};
|
|
|
|
function f(b, C) {
|
|
if (b) return {} instanceof C;
|
|
return false;
|
|
}
|
|
|
|
function g(b) {
|
|
return f(b, C);
|
|
}
|
|
|
|
assertFalse(f(true, Number));
|
|
assertFalse(f(true, Number));
|
|
assertFalse(g(false));
|
|
assertFalse(g(false));
|
|
%OptimizeFunctionOnNextCall(g);
|
|
assertThrows(() => g(true));
|
|
})();
|
|
|
|
(function NonConstHasInstanceProto() {
|
|
var B = {
|
|
[Symbol.hasInstance]() { return true; }
|
|
};
|
|
|
|
var C = { __proto__ : B };
|
|
|
|
function f() {
|
|
return {} instanceof C;
|
|
}
|
|
|
|
assertTrue(f());
|
|
assertTrue(f());
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertTrue(f());
|
|
B[Symbol.hasInstance] = () => { return false; };
|
|
assertFalse(f());
|
|
})();
|
|
|
|
(function HasInstanceOverwriteOnProto() {
|
|
var A = {
|
|
[Symbol.hasInstance] : () => false
|
|
}
|
|
|
|
var B = { __proto__ : A };
|
|
|
|
var C = { __proto__ : B };
|
|
|
|
function f() {
|
|
return {} instanceof C;
|
|
}
|
|
|
|
assertFalse(f());
|
|
assertFalse(f());
|
|
%OptimizeFunctionOnNextCall(f);
|
|
assertFalse(f());
|
|
B[Symbol.hasInstance] = () => { return true; };
|
|
assertTrue(f());
|
|
})();
|