ES6: Object.setPrototypeOf(func, null) breaks instanceof

test/mjsunit/allocation-site-info.js

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 299 matching lines @@
   assertTrue(new type(1,2,3) instanceof type);
 }
 
 function instanceof_check2(type) {
   assertTrue(new type() instanceof type);
   assertTrue(new type(5) instanceof type);
   assertTrue(new type(1,2,3) instanceof type);
 }
 
 var realmBArray = Realm.eval(realmB, "Array");
+// Two calls with Array because ES6 instanceof desugars into a load of Array,
+// and load has a premonomorphic state.
+instanceof_check(Array);
 instanceof_check(Array);
 instanceof_check(realmBArray);
 
 // instanceof_check2 is here because the call site goes through a state.
 // Since instanceof_check(Array) was first called with the current context
 // Array function, it went from (uninit->Array) then (Array->megamorphic).
 // We'll get a different state traversal if we start with realmBArray.
 // It'll go (uninit->realmBArray) then (realmBArray->megamorphic). Recognize
 // that state "Array" implies an AllocationSite is present, and code is
 // configured to use it.
+
+// Two calls with realmBArray because ES6 instanceof desugars into a load of
+// realmBArray, and load has a premonomorphic state.
+instanceof_check2(realmBArray);
 instanceof_check2(realmBArray);
 instanceof_check2(Array);
 
   %OptimizeFunctionOnNextCall(instanceof_check);
 
 // No de-opt will occur because HCallNewArray wasn't selected, on account of
 // the call site not being monomorphic to Array.
 instanceof_check(Array);
 assertOptimized(instanceof_check);
 instanceof_check(realmBArray);
@@ skipping 120 matching lines @@
   assertKind(elements_kind.fast_smi_only, obj[1][0]);
   obj[0][0] = 3.5;
   obj[1][0][0] = "goodbye";
   assertKind(elements_kind.fast_double, obj[0]);
   assertKind(elements_kind.fast, obj[1][0]);
 
   obj = get_deep_nested_literal();
   assertKind(elements_kind.fast_double, obj[0]);
   assertKind(elements_kind.fast, obj[1][0]);
 })();