def7dc3d4b
Fix super calls so that arguments are evaluated before the super constructor is checked to be in fact a constructor. A new bytecode is introduced to split the IsConstructor check out from the current GetSuperConstructor bytecode. Bug: v8:10111 Change-Id: I3af99e32a34d99493806bb01b547d6f671cdc9de Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2493077 Commit-Queue: Shu-yu Guo <syg@chromium.org> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#70881}
27 lines
678 B
JavaScript
27 lines
678 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
var sentinelObject = {};
|
|
var evaluatedArg = false;
|
|
class C extends Object {
|
|
constructor() {
|
|
try {
|
|
super(evaluatedArg = true);
|
|
} catch (e) {
|
|
assertInstanceof(e, TypeError);
|
|
return sentinelObject;
|
|
}
|
|
}
|
|
}
|
|
|
|
%PrepareFunctionForOptimization(C);
|
|
Object.setPrototypeOf(C, parseInt);
|
|
assertSame(sentinelObject, new C());
|
|
assertSame(sentinelObject, new C());
|
|
%OptimizeFunctionOnNextCall(C)
|
|
assertSame(sentinelObject, new C());
|
|
assertTrue(evaluatedArg);
|