Turbofan instanceof lowering needs to address proxies.

Turbofan instanceof lowering needs to address proxies.

BUG=

Committed: https://crrev.com/3f648d7b443152179eef6f3737c22357ab8e5eb6
Cr-Commit-Position: refs/heads/master@{#32788}

[mvstanton, 2015-12-10 18:40:30]

mvstanton@chromium.org changed reviewers:
+ bmeurer@chromium.org

[mvstanton, 2015-12-10 18:40:30]

Hi Benedikt, here is the proxy change, thx for the look!

[Benedikt Meurer, 2015-12-10 19:48:55]

Nice. LGTM.

[Benedikt Meurer, 2015-12-11 04:39:08]

You'll probably need to introduce a typing rule for %HasInPrototypeChain to make
the verifier happy again.

[mvstanton, 2015-12-11 10:03:57]

The CQ bit was checked by mvstanton@chromium.org

[mvstanton, 2015-12-11 10:03:57]

The patchset sent to the CQ was uploaded after l-g-t-m from bmeurer@chromium.org
Link to the patchset: https://codereview.chromium.org/1518773003/#ps30003
(title: "Missing typer rule.")

[commit-bot: I haz the power, 2015-12-11 10:04:09]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1518773003/30003
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1518773003/30003

[mvstanton, 2015-12-11 10:40:09]

Right on, done, thx!

[Toon Verwaest, 2015-12-11 10:59:58]

verwaest@chromium.org changed reviewers:
+ verwaest@chromium.org

[Toon Verwaest, 2015-12-11 10:59:59]

As far as I understand, this introduces a security issue. If someone does
other_window instanceof o, where other_window is from a different origin but has
an JSProxy on the prototype chain, you have a cross-origin call which through
prepareStackTrace=(e,s)=>s can get access to the calling origin.

[commit-bot: I haz the power, 2015-12-11 11:02:56]

Committed patchset #3 (id:30003)

[commit-bot: I haz the power, 2015-12-11 11:03:14]

Description was changed from

==========
Turbofan instanceof lowering needs to address proxies.

BUG=
==========

to

==========
Turbofan instanceof lowering needs to address proxies.

BUG=

Committed: https://crrev.com/3f648d7b443152179eef6f3737c22357ab8e5eb6
Cr-Commit-Position: refs/heads/master@{#32788}
==========

[commit-bot: I haz the power, 2015-12-11 11:03:15]

Patchset 3 (id:??) landed as
https://crrev.com/3f648d7b443152179eef6f3737c22357ab8e5eb6
Cr-Commit-Position: refs/heads/master@{#32788}

[Toon Verwaest, 2015-12-11 12:04:05]

Ok, I see you use r.left, basically restarting. That should be safe. The
instanceof stub is broken though :)