[es6] Perform the IsConstructor test in GetSuperConstructor.

src/code-stub-assembler.cc

Index: src/code-stub-assembler.cc
diff --git a/src/code-stub-assembler.cc b/src/code-stub-assembler.cc
index c93af865c3418a16a36f2b24ee5f8d55fb7114ae..fd0e739e1b3bbc4d74eae5ff4c76b3ed9ec82207 100644
--- a/src/code-stub-assembler.cc
+++ b/src/code-stub-assembler.cc
@@ -2880,6 +2880,13 @@ Node* CodeStubAssembler::IsCallableMap(Node* map) {
       Int32Constant(0));
 }
 
+Node* CodeStubAssembler::IsConstructorMap(Node* map) {
+  CSA_ASSERT(this, IsMap(map));
+  return Word32NotEqual(
+      Word32And(LoadMapBitField(map), Int32Constant(1 << Map::kIsConstructor)),
+      Int32Constant(0));
+}
+
 Node* CodeStubAssembler::IsSpecialReceiverInstanceType(Node* instance_type) {
   STATIC_ASSERT(JS_GLOBAL_OBJECT_TYPE <= LAST_SPECIAL_RECEIVER_TYPE);
   return Int32LessThanOrEqual(instance_type,
@@ -7818,6 +7825,43 @@ Node* CodeStubAssembler::Typeof(Node* value, Node* context) {
   return result_var.value();
 }
 
+Node* CodeStubAssembler::GetSuperConstructor(Node* active_function,
+                                             Node* context) {
+  Label is_not_object(this, Label::kDeferred),
+      is_not_constructor(this, Label::kDeferred), out(this);
+  Variable result(this, MachineRepresentation::kTagged);
+
+  Node* map = LoadMap(active_function);
+  Node* prototype = LoadMapPrototype(map);
+  GotoIf(TaggedIsSmi(active_function), &is_not_object);

[Benedikt Meurer, 2016/12/09 18:30:28]

This looks wrong. You first load the map, thereby assuming it's a HeapObject,
then you do a Smi check later.

The active_function is always a JSFunction, you should CSA_ASSERT that. If it's
ever anything but a JSFunction, then you're in trouble. The active_function is
always passed the this_function_var, which refers to the JSFunction in the
activation record.

+
+  Node* prototype_map = LoadMap(prototype);
+  GotoUnless(IsConstructorMap(prototype_map), &is_not_constructor);
+
+  result.Bind(prototype);
+  Goto(&out);
+
+  Bind(&is_not_object);

[Benedikt Meurer, 2016/12/09 18:30:28]

You don't need this label and the message below. The active_function is always a
JSFunction, the only error condition is that the prototype of the
active_function is not a constructor.

+  {
+    CallRuntime(Runtime::kThrowTypeError, context,
+                SmiConstant(MessageTemplate::kMethodCalledOnWrongObject),
+                HeapConstant(factory()->NewStringFromStaticChars("super")));
+    result.Bind(UndefinedConstant());  // Never reached.
+    Goto(&out);
+  }
+
+  Bind(&is_not_constructor);
+  {
+    CallRuntime(Runtime::kThrowNotSuperConstructor, context, prototype,
+                active_function);
+    result.Bind(UndefinedConstant());  // Never reached.
+    Goto(&out);
+  }
+
+  Bind(&out);
+  return result.value();
+}
+
 Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
                                     Node* context) {
   Label return_runtime(this, Label::kDeferred), end(this);