eb1c9e2723
When walking up the prototype chain during OrdinaryHasInstance, we first check if the current prototype equals the expected one, and only afterwards check the current prototype against null. That's obviously wrong if we check something like Proxy, whose prototype is null. R=yangguo@chromium.org BUG=v8:5085 Review-Url: https://codereview.chromium.org/2041103007 Cr-Commit-Position: refs/heads/master@{#36840}
15 lines
352 B
JavaScript
15 lines
352 B
JavaScript
// Copyright 2016 the V8 project authors. All rights reserved.
|
|
// Use of this source code is governed by a BSD-style license that can be
|
|
// found in the LICENSE file.
|
|
|
|
// Flags: --allow-natives-syntax
|
|
|
|
function foo(x) {
|
|
return x instanceof Proxy;
|
|
}
|
|
|
|
assertFalse(foo({}));
|
|
assertFalse(foo({}));
|
|
%OptimizeFunctionOnNextCall(foo);
|
|
assertFalse(foo({}));
|