ES6: Object.setPrototypeOf(func, null) breaks instanceof

test/mjsunit/harmony/proxies.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1000 matching lines @@
 
 
 (function TestInstanceofProxy() {
   var o0 = Object.create(null)
   var o1 = {}
   var o2 = Object.create(o0)
   var o3 = Object.create(o1)
   var o4 = Object.create(o2)
   var o5 = Object.create(o3)
 
-  function handler(o) { return {get: function() { return o } } }
+  function handler(o) {
+    return {
+      get: function(r, p) {
+        // We want to test prototype lookup, so ensure the proxy
+        // offers OrdinaryHasInstance behavior.
+        if (p === Symbol.hasInstance) {
+          return undefined;
+        }
+        return o;
+      }
+    }
+  }
+
   var f0 = new Proxy(function() {}, handler(o0))
   var f1 = new Proxy(function() {}, handler(o1))
   var f2 = new Proxy(function() {}, handler(o2))
   var f3 = new Proxy(function() {}, handler(o3))
   var f4 = new Proxy(function() {}, handler(o4))
   var f5 = new Proxy(function() {}, handler(o4))
 
   assertFalse(null instanceof f0)
   assertFalse(o0 instanceof f0)
   assertFalse(o0 instanceof f1)
@@ skipping 453 matching lines @@
   var o = new C();
 
   function f() {
     return o.x;
   }
   assertEquals(10, f());
   assertEquals(10, f());
   %OptimizeFunctionOnNextCall(f);
   assertEquals(10, f());
 })();