e272a2f722
For JSCreate nodes with constant inputs we cannot simply assume that the new.target input is a JSFunction, since it can essentially be any JSReceiver that is a constructor, i.e. it can also be a JSBoundFunction. Bug: chromium:801627 Change-Id: Ia37bf9c0a751e4665e1167a3771fbe166473c979 Reviewed-on: https://chromium-review.googlesource.com/866493 Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Cr-Commit-Position: refs/heads/master@{#50563}
25 lines
541 B
JavaScript
25 lines
541 B
JavaScript
// Copyright 2018 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax --enable-slow-asserts
|
|
|
|
class Base {
|
|
constructor() {
|
|
this.x = 1;
|
|
}
|
|
}
|
|
|
|
class Derived extends Base {
|
|
constructor() {
|
|
super();
|
|
}
|
|
}
|
|
|
|
// Feed a bound function as new.target
|
|
// to the profiler, so HeapObjectMatcher
|
|
// can find it.
|
|
Reflect.construct(Derived, [], Object.bind());
|
|
%OptimizeFunctionOnNextCall(Derived);
|
|
new Derived();
|