[es6] Perform the IsConstructor test in GetSuperConstructor.

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 2862 matching lines @@
                         Int32Constant(0));
 }
 
 Node* CodeStubAssembler::IsCallableMap(Node* map) {
   CSA_ASSERT(this, IsMap(map));
   return Word32NotEqual(
       Word32And(LoadMapBitField(map), Int32Constant(1 << Map::kIsCallable)),
       Int32Constant(0));
 }
 
+Node* CodeStubAssembler::IsConstructorMap(Node* map) {
+  CSA_ASSERT(this, IsMap(map));
+  return Word32NotEqual(
+      Word32And(LoadMapBitField(map), Int32Constant(1 << Map::kIsConstructor)),
+      Int32Constant(0));
+}
+
 Node* CodeStubAssembler::IsSpecialReceiverInstanceType(Node* instance_type) {
   STATIC_ASSERT(JS_GLOBAL_OBJECT_TYPE <= LAST_SPECIAL_RECEIVER_TYPE);
   return Int32LessThanOrEqual(instance_type,
                               Int32Constant(LAST_SPECIAL_RECEIVER_TYPE));
 }
 
 Node* CodeStubAssembler::IsStringInstanceType(Node* instance_type) {
   STATIC_ASSERT(INTERNALIZED_STRING_TYPE == FIRST_TYPE);
   return Int32LessThan(instance_type, Int32Constant(FIRST_NONSTRING_TYPE));
 }
@@ skipping 4918 matching lines @@
     result_var.Bind(HeapConstant(isolate()->factory()->type##_string())); \
     Goto(&return_result);                                                 \
   }
   SIMD128_TYPES(SIMD128_BIND_RETURN)
 #undef SIMD128_BIND_RETURN
 
   Bind(&return_result);
   return result_var.value();
 }
 
+Node* CodeStubAssembler::GetSuperConstructor(Node* active_function,
+                                             Node* context) {
+  Label is_not_object(this, Label::kDeferred),
+      is_not_constructor(this, Label::kDeferred), out(this);
+  Variable result(this, MachineRepresentation::kTagged);
+
+  Node* map = LoadMap(active_function);
+  Node* prototype = LoadMapPrototype(map);
+  GotoIf(TaggedIsSmi(active_function), &is_not_object);

[Benedikt Meurer, 2016/12/09 18:30:28]

This looks wrong. You first load the map, thereby assuming it's a HeapObject,
then you do a Smi check later.

The active_function is always a JSFunction, you should CSA_ASSERT that. If it's
ever anything but a JSFunction, then you're in trouble. The active_function is
always passed the this_function_var, which refers to the JSFunction in the
activation record.

+
+  Node* prototype_map = LoadMap(prototype);
+  GotoUnless(IsConstructorMap(prototype_map), &is_not_constructor);
+
+  result.Bind(prototype);
+  Goto(&out);
+
+  Bind(&is_not_object);

[Benedikt Meurer, 2016/12/09 18:30:28]

You don't need this label and the message below. The active_function is always a
JSFunction, the only error condition is that the prototype of the
active_function is not a constructor.

+  {
+    CallRuntime(Runtime::kThrowTypeError, context,
+                SmiConstant(MessageTemplate::kMethodCalledOnWrongObject),
+                HeapConstant(factory()->NewStringFromStaticChars("super")));
+    result.Bind(UndefinedConstant());  // Never reached.
+    Goto(&out);
+  }
+
+  Bind(&is_not_constructor);
+  {
+    CallRuntime(Runtime::kThrowNotSuperConstructor, context, prototype,
+                active_function);
+    result.Bind(UndefinedConstant());  // Never reached.
+    Goto(&out);
+  }
+
+  Bind(&out);
+  return result.value();
+}
+
 Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
                                     Node* context) {
   Label return_runtime(this, Label::kDeferred), end(this);
   Variable result(this, MachineRepresentation::kTagged);
 
   // Check if no one installed @@hasInstance somewhere.
   GotoUnless(
       WordEqual(LoadObjectField(LoadRoot(Heap::kHasInstanceProtectorRootIndex),
                                 PropertyCell::kValueOffset),
                 SmiConstant(Smi::FromInt(Isolate::kProtectorValid))),
@@ skipping 391 matching lines @@
 
 Node* CodeStubAssembler::IsDebugActive() {
   Node* is_debug_active = Load(
       MachineType::Uint8(),
       ExternalConstant(ExternalReference::debug_is_active_address(isolate())));
   return WordNotEqual(is_debug_active, Int32Constant(0));
 }
 
 }  // namespace internal
 }  // namespace v8