Commit e5cce7a
deps: cherry-pick 3a903c4 for PPC from V8 upstream
Original commit message:
PPC: InstanceOfStub incorrectly interprets the hole as a prototype.
Port 2aa070b
Original commit message:
Repair this to match what the runtime correctly does,
by first checking if the function is a constructor
before we access the prototype.
R=mvstanton@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com,
michael_dawson@ca.ibm.com
BUG=
Review URL: https://codereview.chromium.org/1811013002
Cr-Commit-Position: refs/heads/master@{#34869}
Fixes: #7592 for PPC
PR-URL: #7638
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>1 parent e239045 commit e5cce7a
1 file changed
Lines changed: 5 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1409,8 +1409,12 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { | |||
| 1409 | 1409 | __ CompareObjectType(function, function_map, scratch, JS_FUNCTION_TYPE); | |
| 1410 | 1410 | __ bne(&slow_case); | |
| 1411 | 1411 | ||
| 1412 | - // Ensure that {function} has an instance prototype. | ||
| 1412 | + // Go to the runtime if the function is not a constructor. | ||
| 1413 | 1413 | __ lbz(scratch, FieldMemOperand(function_map, Map::kBitFieldOffset)); | |
| 1414 | + __ TestBit(scratch, Map::kIsConstructor, r0); | ||
| 1415 | + __ beq(&slow_case, cr0); | ||
| 1416 | + | ||
| 1417 | + // Ensure that {function} has an instance prototype. | ||
| 1414 | 1418 | __ TestBit(scratch, Map::kHasNonInstancePrototype, r0); | |
| 1415 | 1419 | __ bne(&slow_case, cr0); | |
| 1416 | 1420 | ||
0 commit comments