Make FunctionTemplate::HasInstance checks work with remote contexts.

src/api.cc

Index: src/api.cc
diff --git a/src/api.cc b/src/api.cc
index 3f73ab78de354ef5611b64e8506d453933267f29..66a7f5b1f1b86e02814276941293678042d5d6ba 100644
--- a/src/api.cc
+++ b/src/api.cc
@@ -6541,6 +6541,34 @@ MaybeLocal<v8::Object> FunctionTemplate::NewRemoteInstance() {
   return Utils::ToLocal(scope.CloseAndEscape(object));
 }
 
+static bool HasInstanceInGlobalProxy(
+    i::JSGlobalProxy* global_proxy,
+    i::FunctionTemplateInfo* target_template) {
+  auto* constructor_object = global_proxy->map()->GetConstructor();
+  if (!constructor_object->IsJSFunction()) return false;
+
+  auto* constructor = i::JSFunction::cast(constructor_object);
+  if (!constructor->shared()->function_data()->IsFunctionTemplateInfo())
+    return false;
+
+  auto* proxy_constructor_template =
+      i::FunctionTemplateInfo::cast(constructor->shared()->function_data());
+  if (!proxy_constructor_template->prototype_template()->IsObjectTemplateInfo())
+    return false;
+
+  auto* global_template = i::ObjectTemplateInfo::cast(
+      proxy_constructor_template->prototype_template());
+  // Iterate through the chain of inheriting function templates to
+  // see if the required one occurs.
+  for (i::Object* type = global_template->constructor();
+       type->IsFunctionTemplateInfo();
+       type = i::FunctionTemplateInfo::cast(type)->parent_template()) {
+    if (type == target_template) return true;
+  }
+  // Didn't find the required type in the inheritance chain.
+  return false;
+}
+
 bool FunctionTemplate::HasInstance(v8::Local<v8::Value> value) {
   auto self = Utils::OpenHandle(this);
   auto obj = Utils::OpenHandle(*value);
@@ -6548,10 +6576,12 @@ bool FunctionTemplate::HasInstance(v8::Local<v8::Value> value) {
     return true;
   }
   if (obj->IsJSGlobalProxy()) {
-    // If it's a global proxy object, then test with the global object.
-    i::PrototypeIterator iter(i::JSObject::cast(*obj)->map());
-    if (iter.IsAtEnd()) return false;
-    return self->IsTemplateFor(iter.GetCurrent<i::JSGlobalObject>());

[dcheng, 2017/02/16 08:00:12]

I was forgetting to walk the parent templates; after fixing this, I don't need
to inspect the global object at all.

+    auto* global_proxy = i::JSGlobalProxy::cast(*obj);
+    // For global proxies, check the constructor's prototype instead. Remote
+    // global proxies have no global object to perform instance checks on, but
+    // the constructor's prototype's constructor corresponds to the original
+    // template used to create the context.
+    return HasInstanceInGlobalProxy(global_proxy, *self);
   }
   return false;
 }