1a2362089c
We cannot skip the @@hasInstance lookup in instanceof depending on a global protector cell, as the lookup of the property is observable via proxies or accessors. So remove the global protector and properly implement CSA::InstanceOf via GetPropertyStub, with an appropriate fast-path for Function.prototype[@@hasInstance] where we call the builtin code object directly if the function matches, skipping all the checks from the call sequence, and also avoid the redundant ToBoolean conversion on the result. R=yangguo@chromium.org TBR=ulan@chromium.org BUG=v8:5958 Review-Url: https://codereview.chromium.org/2684033012 Cr-Commit-Position: refs/heads/master@{#43137}
17 lines
419 B
JavaScript
17 lines
419 B
JavaScript
// Copyright 2017 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
class A {}
|
|
class B {}
|
|
|
|
A.__proto__ = new Proxy(A.__proto__, {
|
|
get: function (target, property, receiver) {
|
|
if (property === Symbol.hasInstance) throw new B;
|
|
}
|
|
});
|
|
|
|
assertThrows(() => (new A) instanceof A, B);
|