ES6: Object.setPrototypeOf(func, null) breaks instanceof

src/parsing/parser.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/parsing/parser.h"
 
 #include "src/api.h"
 #include "src/ast/ast.h"
 #include "src/ast/ast-expression-rewriter.h"
 #include "src/ast/ast-expression-visitor.h"
@@ skipping 6085 matching lines @@
 //
 //   do {
 //     let O = lhs;
 //     let C = rhs;
 //     if (!IS_RECEIVER(C)) throw MakeTypeError(kNonObjectInInstanceOfCheck);
 //     let handler_result = C[Symbol.hasInstance];
 //     if (handler_result === undefined) {
 //       if (!IS_CALLABLE(C)) {
 //         throw MakeTypeError(kCalledNonCallableInstanceOf);
 //       }
-//       handler_result = %ordinary_has_instance(C, O);
+//       handler_result = %_GetOrdinaryHasInstance()
+//       handler_result = %_Call(handler_result, C, O);
 //     } else {
 //       handler_result = !!(%_Call(handler_result, C, O));
 //     }
 //     handler_result;
 //   }
 //
 Expression* ParserTraits::RewriteInstanceof(Expression* lhs, Expression* rhs,
                                             int pos) {
   const int nopos = RelocInfo::kNoPosition;
 
@@ skipping 24 matching lines @@
 
   // if (!IS_RECEIVER(C)) throw MakeTypeError(kNonObjectInInstanceOfCheck);
   Statement* validate_C;
   {
     auto args = new (zone) ZoneList<Expression*>(1, zone);
     args->Add(factory->NewVariableProxy(var_C), zone);
     Expression* is_receiver_call =
         factory->NewCallRuntime(Runtime::kInlineIsJSReceiver, args, nopos);
     Expression* call =
         NewThrowTypeError(MessageTemplate::kNonObjectInInstanceOfCheck,
-                          avfactory->empty_string(), nopos);
+                          avfactory->empty_string(), pos);
     Statement* throw_call = factory->NewExpressionStatement(call, nopos);
 
     validate_C =
         factory->NewIfStatement(is_receiver_call,
                                 factory->NewEmptyStatement(nopos),
                                 throw_call,
                                 nopos);
   }
 
   // let handler_result = C[Symbol.hasInstance];
   Variable* var_handler_result = scope->NewTemporary(avfactory->empty_string());
   Statement* initialize_handler;
   {
     Expression* hasInstance_symbol_literal =
         factory->NewSymbolLiteral("hasInstance_symbol", RelocInfo::kNoPosition);
     Expression* prop = factory->NewProperty(factory->NewVariableProxy(var_C),
                                             hasInstance_symbol_literal, pos);
     Expression* handler_proxy = factory->NewVariableProxy(var_handler_result);
     Expression* assignment =
         factory->NewAssignment(Token::ASSIGN, handler_proxy, prop, nopos);
     initialize_handler = factory->NewExpressionStatement(assignment, nopos);
   }
 
   // if (handler_result === undefined) {
   //   if (!IS_CALLABLE(C)) {
   //     throw MakeTypeError(kCalledNonCallableInstanceOf);
   //   }
-  //   result = %ordinary_has_instance(C, O);
+  //   handler_result = %_GetOrdinaryHasInstance()
+  //   handler_result = %_Call(handler_result, C, O);
   // } else {
   //   handler_result = !!%_Call(handler_result, C, O);
   // }
   Statement* call_handler;
   {
     Expression* condition = factory->NewCompareOperation(
         Token::EQ_STRICT, factory->NewVariableProxy(var_handler_result),
         factory->NewUndefinedLiteral(nopos), nopos);
 
-    Block* then_side = factory->NewBlock(nullptr, 2, false, nopos);
+    Block* then_side = factory->NewBlock(nullptr, 3, false, nopos);
     {
       Expression* throw_expr =
           NewThrowTypeError(MessageTemplate::kCalledNonCallableInstanceOf,
-                            avfactory->empty_string(), nopos);
+                            avfactory->empty_string(), pos);
       Statement* validate_C = CheckCallable(var_C, throw_expr);
-      ZoneList<Expression*>* args = new (zone) ZoneList<Expression*>(2, zone);
+
+      ZoneList<Expression*>* empty_args =
+          new (zone) ZoneList<Expression*>(0, zone);
+      Expression* ordinary_has_instance = factory->NewCallRuntime(
+          Runtime::kInlineGetOrdinaryHasInstance, empty_args, pos);
+      Expression* handler_proxy = factory->NewVariableProxy(var_handler_result);
+      Expression* assignment_handler = factory->NewAssignment(
+          Token::ASSIGN, handler_proxy, ordinary_has_instance, nopos);
+      Statement* assignment_get_handler =
+          factory->NewExpressionStatement(assignment_handler, nopos);
+
+      ZoneList<Expression*>* args = new (zone) ZoneList<Expression*>(3, zone);
+      args->Add(factory->NewVariableProxy(var_handler_result), zone);
       args->Add(factory->NewVariableProxy(var_C), zone);
       args->Add(factory->NewVariableProxy(var_O), zone);
-      CallRuntime* call = factory->NewCallRuntime(
-          Context::ORDINARY_HAS_INSTANCE_INDEX, args, pos);
+      Expression* call =
+          factory->NewCallRuntime(Runtime::kInlineCall, args, pos);
       Expression* result_proxy = factory->NewVariableProxy(var_handler_result);
       Expression* assignment =
           factory->NewAssignment(Token::ASSIGN, result_proxy, call, nopos);
       Statement* assignment_return =
           factory->NewExpressionStatement(assignment, nopos);
 
       then_side->statements()->Add(validate_C, zone);
+      then_side->statements()->Add(assignment_get_handler, zone);
       then_side->statements()->Add(assignment_return, zone);
     }
 
     Statement* else_side;
     {
       auto args = new (zone) ZoneList<Expression*>(3, zone);
       args->Add(factory->NewVariableProxy(var_handler_result), zone);
       args->Add(factory->NewVariableProxy(var_C), zone);
       args->Add(factory->NewVariableProxy(var_O), zone);
       Expression* call =
@@ skipping 565 matching lines @@
                         try_block, target);
     final_loop = target;
   }
 
   return final_loop;
 }
 
 
 }  // namespace internal
 }  // namespace v8