Skip to content

Commit

Permalink
deps: cherry-pick 5b5d24b for X87 from V8 upstream
Browse files Browse the repository at this point in the history
Original commit message:

    port 2aa070b (r34863)

    original commit message:
        Repair this to match what the runtime correctly does,
        by first checking if the function is a constructor
        before we access the prototype.

    BUG=

    Review URL: https://codereview.chromium.org/1809333002

    Cr-Commit-Position: refs/heads/master@{#34880}

Fixes: #7592 for X87
PR-URL: #7638
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>
  • Loading branch information
fhinkel authored and evanlucas committed Jul 21, 2016
1 parent e5cce7a commit 2870061
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions deps/v8/src/x87/code-stubs-x87.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1835,6 +1835,11 @@ void InstanceOfStub::Generate(MacroAssembler* masm) {
__ CmpObjectType(function, JS_FUNCTION_TYPE, function_map);
__ j(not_equal, &slow_case);

// Go to the runtime if the function is not a constructor.
__ test_b(FieldOperand(function_map, Map::kBitFieldOffset),
static_cast<uint8_t>(1 << Map::kIsConstructor));
__ j(zero, &slow_case);

// Ensure that {function} has an instance prototype.
__ test_b(FieldOperand(function_map, Map::kBitFieldOffset),
static_cast<uint8_t>(1 << Map::kHasNonInstancePrototype));
Expand Down

0 comments on commit 2870061

Please sign in to comment.