ARM64: fix Instanceof stub.

src/arm64/code-stubs-arm64.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #if V8_TARGET_ARCH_ARM64
 
 #include "src/bootstrapper.h"
 #include "src/code-stubs.h"
@@ skipping 1748 matching lines @@
   }
 
   // Check that the left hand side is a JS object and load its map as a side
   // effect.
   Register map = x12;
   __ JumpIfSmi(object, &not_js_object);
   __ IsObjectJSObjectType(object, map, scratch2, &not_js_object);
 
   // If there is a call site cache, don't look in the global cache, but do the
   // real lookup and update the call site cache.
-  if (!HasCallSiteInlineCheck()) {
+  if (!HasCallSiteInlineCheck() && !ReturnTrueFalseObject()) {
     Label miss;
     __ JumpIfNotRoot(function, Heap::kInstanceofCacheFunctionRootIndex, &miss);
     __ JumpIfNotRoot(map, Heap::kInstanceofCacheMapRootIndex, &miss);
     __ LoadRoot(result, Heap::kInstanceofCacheAnswerRootIndex);
     __ Ret();
     __ Bind(&miss);
   }
 
   // Get the prototype of the function.
   Register prototype = x13;
@@ skipping 11 matching lines @@
     __ GetRelocatedValueLocation(map_check_site, scratch1);
     // We have a cell, so need another level of dereferencing.
     __ Ldr(scratch1, MemOperand(scratch1));
     __ Str(map, FieldMemOperand(scratch1, Cell::kValueOffset));
   } else {
     __ StoreRoot(function, Heap::kInstanceofCacheFunctionRootIndex);
     __ StoreRoot(map, Heap::kInstanceofCacheMapRootIndex);
   }
 
   Label return_true, return_result;
+  Register smi_value = scratch1;
   {
     // Loop through the prototype chain looking for the function prototype.
     Register chain_map = x1;
     Register chain_prototype = x14;
     Register null_value = x15;
     Label loop;
     __ Ldr(chain_prototype, FieldMemOperand(map, Map::kPrototypeOffset));
     __ LoadRoot(null_value, Heap::kNullValueRootIndex);
     // Speculatively set a result.
     __ Mov(result, res_false);
+    if (!HasCallSiteInlineCheck() && ReturnTrueFalseObject()) {
+      // Value to store in the cache cannot be an object.
+      __ Mov(smi_value, Smi::FromInt(1));
+    }
 
     __ Bind(&loop);
 
     // If the chain prototype is the object prototype, return true.
     __ Cmp(chain_prototype, prototype);
     __ B(eq, &return_true);
 
     // If the chain prototype is null, we've reached the end of the chain, so
     // return false.
     __ Cmp(chain_prototype, null_value);
     __ B(eq, &return_result);
 
     // Otherwise, load the next prototype in the chain, and loop.
     __ Ldr(chain_map, FieldMemOperand(chain_prototype, HeapObject::kMapOffset));
     __ Ldr(chain_prototype, FieldMemOperand(chain_map, Map::kPrototypeOffset));
     __ B(&loop);
   }
 
   // Return sequence when no arguments are on the stack.
   // We cannot fall through to here.
   __ Bind(&return_true);
   __ Mov(result, res_true);
+  if (!HasCallSiteInlineCheck() && ReturnTrueFalseObject()) {
+    // Value to store in the cache cannot be an object.
+    __ Mov(smi_value, Smi::FromInt(0));
+  }
   __ Bind(&return_result);
   if (HasCallSiteInlineCheck()) {
     DCHECK(ReturnTrueFalseObject());
     __ Add(map_check_site, map_check_site, kDeltaToLoadBoolResult);
     __ GetRelocatedValueLocation(map_check_site, scratch2);
     __ Str(result, MemOperand(scratch2));
   } else {
-    __ StoreRoot(result, Heap::kInstanceofCacheAnswerRootIndex);
+    Register cached_value = ReturnTrueFalseObject() ? smi_value : result;
+    __ StoreRoot(cached_value, Heap::kInstanceofCacheAnswerRootIndex);
   }
   __ Ret();
 
   Label object_not_null, object_not_null_or_smi;
 
   __ Bind(&not_js_object);
   Register object_type = x14;
   //   x0   result        result return register (uninit)
   //   x10  function      pointer to function
   //   x11  object        pointer to object
@@ skipping 3558 matching lines @@
                               MemOperand(fp, 6 * kPointerSize),
                               NULL);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_ARM64