[TurboFan] Fix JSNativeContextSpecialization::InferReceiverMap

[TurboFan] Fix JSNativeContextSpecialization::InferReceiverMap

Before the fix it checked whether the initial map of the base constructor pointed back to the new target. That's only true if initial_map->new_target_is_base() (new.target == target). Now it properly checks that the initial map of the original constructor (new.target) was created in combination with target by checking back that new.target->initial_map()->constructor() == target.

BUG=

Review-Url: https://codereview.chromium.org/2621303003
Cr-Commit-Position: refs/heads/master@{#42263}
Committed: https://chromium.googlesource.com/v8/v8/+/2bca05685f6d7302124a54a2b1028cbad8f2c7b3

[Toon Verwaest, 2017-01-12 10:53:36]

verwaest@chromium.org changed reviewers:
+ bmeurer@chromium.org

[Toon Verwaest, 2017-01-12 10:53:36]

ptal

[Benedikt Meurer, 2017-01-12 10:54:15]

Nice, thanks. LGTM.

[Toon Verwaest, 2017-01-12 10:55:19]

The CQ bit was checked by verwaest@chromium.org

[commit-bot: I haz the power, 2017-01-12 10:55:31]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-12 11:23:49]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1484218519781400, "parent_rev":
"e46893c6c42213646cc0f41f74a7141adcd7e01c", "commit_rev":
"2bca05685f6d7302124a54a2b1028cbad8f2c7b3"}

[commit-bot: I haz the power, 2017-01-12 11:23:54]

Description was changed from

==========
[TurboFan] Fix JSNativeContextSpecialization::InferReceiverMap

Before the fix it checked whether the initial map of the base constructor
pointed back to the new target. That's only true if
initial_map->new_target_is_base() (new.target == target). Now it properly checks
that the initial map of the original constructor (new.target) was created in
combination with target by checking back that
new.target->initial_map()->constructor() == target.

BUG=
==========

to

==========
[TurboFan] Fix JSNativeContextSpecialization::InferReceiverMap

Before the fix it checked whether the initial map of the base constructor
pointed back to the new target. That's only true if
initial_map->new_target_is_base() (new.target == target). Now it properly checks
that the initial map of the original constructor (new.target) was created in
combination with target by checking back that
new.target->initial_map()->constructor() == target.

BUG=

Review-Url: https://codereview.chromium.org/2621303003
Cr-Commit-Position: refs/heads/master@{#42263}
Committed:
https://chromium.googlesource.com/v8/v8/+/2bca05685f6d7302124a54a2b1028cbad8f...
==========

[commit-bot: I haz the power, 2017-01-12 11:23:54]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/v8/v8/+/2bca05685f6d7302124a54a2b1028cbad8f...