[es2015] Remove the @@hasInstance protector cell.

[es2015] Remove the @@hasInstance protector cell.

We cannot skip the @@hasInstance lookup in instanceof depending on a
global protector cell, as the lookup of the property is observable
via proxies or accessors. So remove the global protector and properly
implement CSA::InstanceOf via GetPropertyStub, with an appropriate
fast-path for Function.prototype[@@hasInstance] where we call the
builtin code object directly if the function matches, skipping all
the checks from the call sequence, and also avoid the redundant
ToBoolean conversion on the result.

R=yangguo@chromium.org
TBR=ulan@chromium.org
BUG=v8:5958
Review-Url: https://codereview.chromium.org/2684033012
Cr-Commit-Position: refs/heads/master@{#43137}
Committed: https://chromium.googlesource.com/v8/v8/+/1a2362089ce2af3ed2241110deecfabe80abd28a

[Benedikt Meurer, 2017-02-10 21:24:55]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-10 21:24:57]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-10 21:56:46]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-02-10 21:56:47]

Dry run: This issue passed the CQ dry run.

[Yang, 2017-02-10 22:38:49]

https://codereview.chromium.org/2684033012/diff/1/src/builtins/builtins.h
File src/builtins/builtins.h (right):

https://codereview.chromium.org/2684033012/diff/1/src/builtins/builtins.h#new...
src/builtins/builtins.h:648: /* instanceof */                                   
                         \
wrong comment?

[Benedikt Meurer, 2017-02-11 17:39:17]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-11 17:39:19]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2017-02-11 17:40:23]

PTAL

https://codereview.chromium.org/2684033012/diff/1/src/builtins/builtins.h
File src/builtins/builtins.h (right):

https://codereview.chromium.org/2684033012/diff/1/src/builtins/builtins.h#new...
src/builtins/builtins.h:648: /* instanceof */                                   
                         \
Copy&paste

[commit-bot: I haz the power, 2017-02-11 18:04:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-02-11 18:04:56]

Dry run: This issue passed the CQ dry run.

[Yang, 2017-02-13 06:08:23]

On 2017/02/11 17:40:23, Benedikt Meurer wrote:
> PTAL
> 
> https://codereview.chromium.org/2684033012/diff/1/src/builtins/builtins.h
> File src/builtins/builtins.h (right):
> 
>
https://codereview.chromium.org/2684033012/diff/1/src/builtins/builtins.h#new...
> src/builtins/builtins.h:648: /* instanceof */                                 
 
>                          \
> Copy&paste

lgtm.

[Benedikt Meurer, 2017-02-13 06:10:38]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2017-02-13 06:10:42]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-13 06:13:51]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-02-13 06:13:53]

Try jobs failed on following builders:
  v8_presubmit on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_presubmit/builds/34567)

[Benedikt Meurer, 2017-02-13 06:14:19]

Description was changed from

==========
[es2015] Remove the @@hasInstance protector cell.

We cannot skip the @@hasInstance lookup in instanceof depending on a
global protector cell, as the lookup of the property is observable
via proxies or accessors. So remove the global protector and properly
implement CSA::InstanceOf via GetPropertyStub, with an appropriate
fast-path for Function.prototype[@@hasInstance] where we call the
builtin code object directly if the function matches, skipping all
the checks from the call sequence, and also avoid the redundant
ToBoolean conversion on the result.

R=yangguo@chromium.org
BUG=v8:5958
==========

to

==========
[es2015] Remove the @@hasInstance protector cell.

We cannot skip the @@hasInstance lookup in instanceof depending on a
global protector cell, as the lookup of the property is observable
via proxies or accessors. So remove the global protector and properly
implement CSA::InstanceOf via GetPropertyStub, with an appropriate
fast-path for Function.prototype[@@hasInstance] where we call the
builtin code object directly if the function matches, skipping all
the checks from the call sequence, and also avoid the redundant
ToBoolean conversion on the result.

R=yangguo@chromium.org
TBR=ulan@chromium.org
BUG=v8:5958
==========

[Benedikt Meurer, 2017-02-13 06:14:25]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2017-02-13 06:14:33]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-13 06:36:44]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-02-13 06:36:47]

Failed to apply patch for src/code-stub-assembler.h:
While running git apply --index -p1;
  error: patch failed: src/code-stub-assembler.h:33
  error: src/code-stub-assembler.h: patch does not apply

Patch:       src/code-stub-assembler.h
Index: src/code-stub-assembler.h
diff --git a/src/code-stub-assembler.h b/src/code-stub-assembler.h
index
38f2602f9adb2d44cb60f3ea83a30ce79cbb1a07..46ddc79bededbda09aec2573bfec6ca45a8899a1
100644
--- a/src/code-stub-assembler.h
+++ b/src/code-stub-assembler.h
@@ -33,6 +33,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol
};
   V(FixedCOWArrayMap, FixedCOWArrayMap)               \
   V(FixedDoubleArrayMap, FixedDoubleArrayMap)         \
   V(FunctionTemplateInfoMap, FunctionTemplateInfoMap) \
+  V(has_instance_symbol, HasInstanceSymbol)           \
   V(HeapNumberMap, HeapNumberMap)                     \
   V(MinusZeroValue, MinusZero)                        \
   V(NanValue, Nan)                                    \
@@ -695,6 +696,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public
compiler::CodeAssembler {
   Node* IsJSReceiver(Node* object);
   Node* IsMap(Node* object);
   Node* IsCallableMap(Node* map);
+  Node* IsCallable(Node* object);
   Node* IsBoolean(Node* object);
   Node* IsName(Node* object);
   Node* IsSymbol(Node* object);

[Benedikt Meurer, 2017-02-13 06:51:18]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2017-02-13 06:51:18]

The patchset sent to the CQ was uploaded after l-g-t-m from yangguo@chromium.org
Link to the patchset: https://codereview.chromium.org/2684033012/#ps60001
(title: "REBASE")

[commit-bot: I haz the power, 2017-02-13 06:51:26]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2017-02-13 06:51:27]

Patchset #3 (id:40001) has been deleted

[commit-bot: I haz the power, 2017-02-13 07:16:28]

CQ is committing da patch.

Bot data: {"patchset_id": 60001, "attempt_start_ts": 1486968678013050,
"parent_rev": "ff10ed552035a380e028fd5359fa29aaeae79b75", "commit_rev":
"1a2362089ce2af3ed2241110deecfabe80abd28a"}

[commit-bot: I haz the power, 2017-02-13 07:16:33]

Description was changed from

==========
[es2015] Remove the @@hasInstance protector cell.

We cannot skip the @@hasInstance lookup in instanceof depending on a
global protector cell, as the lookup of the property is observable
via proxies or accessors. So remove the global protector and properly
implement CSA::InstanceOf via GetPropertyStub, with an appropriate
fast-path for Function.prototype[@@hasInstance] where we call the
builtin code object directly if the function matches, skipping all
the checks from the call sequence, and also avoid the redundant
ToBoolean conversion on the result.

R=yangguo@chromium.org
TBR=ulan@chromium.org
BUG=v8:5958
==========

to

==========
[es2015] Remove the @@hasInstance protector cell.

We cannot skip the @@hasInstance lookup in instanceof depending on a
global protector cell, as the lookup of the property is observable
via proxies or accessors. So remove the global protector and properly
implement CSA::InstanceOf via GetPropertyStub, with an appropriate
fast-path for Function.prototype[@@hasInstance] where we call the
builtin code object directly if the function matches, skipping all
the checks from the call sequence, and also avoid the redundant
ToBoolean conversion on the result.

R=yangguo@chromium.org
TBR=ulan@chromium.org
BUG=v8:5958

Review-Url: https://codereview.chromium.org/2684033012
Cr-Commit-Position: refs/heads/master@{#43137}
Committed:
https://chromium.googlesource.com/v8/v8/+/1a2362089ce2af3ed2241110deecfabe80a...
==========

[commit-bot: I haz the power, 2017-02-13 07:16:34]

Committed patchset #3 (id:60001) as
https://chromium.googlesource.com/v8/v8/+/1a2362089ce2af3ed2241110deecfabe80a...