Commit 2870061
deps: cherry-pick 5b5d24b for X87 from V8 upstream
Original commit message:
port 2aa070b (r34863)
original commit message:
Repair this to match what the runtime correctly does,
by first checking if the function is a constructor
before we access the prototype.
BUG=
Review URL: https://codereview.chromium.org/1809333002
Cr-Commit-Position: refs/heads/master@{#34880}
Fixes: #7592 for X87
PR-URL: #7638
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>1 parent e5cce7a commit 2870061
1 file changed
Lines changed: 5 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1835,6 +1835,11 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { | |||
| 1835 | 1835 | __ CmpObjectType(function, JS_FUNCTION_TYPE, function_map); | |
| 1836 | 1836 | __ j(not_equal, &slow_case); | |
| 1837 | 1837 | ||
| 1838 | + // Go to the runtime if the function is not a constructor. | ||
| 1839 | + __ test_b(FieldOperand(function_map, Map::kBitFieldOffset), | ||
| 1840 | + static_cast<uint8_t>(1 << Map::kIsConstructor)); | ||
| 1841 | + __ j(zero, &slow_case); | ||
| 1842 | + | ||
| 1838 | 1843 | // Ensure that {function} has an instance prototype. | |
| 1839 | 1844 | __ test_b(FieldOperand(function_map, Map::kBitFieldOffset), | |
| 1840 | 1845 | static_cast<uint8_t>(1 << Map::kHasNonInstancePrototype)); | |
0 commit comments