diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h index 16a93f1b708edb..e0027b224ea79a 100644 --- a/deps/v8/include/v8-version.h +++ b/deps/v8/include/v8-version.h @@ -11,7 +11,7 @@ #define V8_MAJOR_VERSION 5 #define V8_MINOR_VERSION 0 #define V8_BUILD_NUMBER 71 -#define V8_PATCH_LEVEL 56 +#define V8_PATCH_LEVEL 57 // Use 1 for candidates and 0 otherwise. // (Boolean macro values are not supported by all preprocessors.) diff --git a/deps/v8/src/arm/code-stubs-arm.cc b/deps/v8/src/arm/code-stubs-arm.cc index 82fb51d2f192da..adcd5872958aa1 100644 --- a/deps/v8/src/arm/code-stubs-arm.cc +++ b/deps/v8/src/arm/code-stubs-arm.cc @@ -1358,8 +1358,12 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { __ CompareObjectType(function, function_map, scratch, JS_FUNCTION_TYPE); __ b(ne, &slow_case); - // Ensure that {function} has an instance prototype. + // Go to the runtime if the function is not a constructor. __ ldrb(scratch, FieldMemOperand(function_map, Map::kBitFieldOffset)); + __ tst(scratch, Operand(1 << Map::kIsConstructor)); + __ b(eq, &slow_case); + + // Ensure that {function} has an instance prototype. __ tst(scratch, Operand(1 << Map::kHasNonInstancePrototype)); __ b(ne, &slow_case); diff --git a/deps/v8/src/arm64/code-stubs-arm64.cc b/deps/v8/src/arm64/code-stubs-arm64.cc index ad566e68fc2073..f8d7e23709a28d 100644 --- a/deps/v8/src/arm64/code-stubs-arm64.cc +++ b/deps/v8/src/arm64/code-stubs-arm64.cc @@ -1544,8 +1544,11 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { __ JumpIfNotObjectType(function, function_map, scratch, JS_FUNCTION_TYPE, &slow_case); - // Ensure that {function} has an instance prototype. + // Go to the runtime if the function is not a constructor. __ Ldrb(scratch, FieldMemOperand(function_map, Map::kBitFieldOffset)); + __ Tbz(scratch, Map::kIsConstructor, &slow_case); + + // Ensure that {function} has an instance prototype. __ Tbnz(scratch, Map::kHasNonInstancePrototype, &slow_case); // Get the "prototype" (or initial map) of the {function}. diff --git a/deps/v8/src/ia32/code-stubs-ia32.cc b/deps/v8/src/ia32/code-stubs-ia32.cc index 510b58e723506d..ba7140d20afa03 100644 --- a/deps/v8/src/ia32/code-stubs-ia32.cc +++ b/deps/v8/src/ia32/code-stubs-ia32.cc @@ -2110,6 +2110,11 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { __ CmpObjectType(function, JS_FUNCTION_TYPE, function_map); __ j(not_equal, &slow_case); + // Go to the runtime if the function is not a constructor. + __ test_b(FieldOperand(function_map, Map::kBitFieldOffset), + static_cast(1 << Map::kIsConstructor)); + __ j(zero, &slow_case); + // Ensure that {function} has an instance prototype. __ test_b(FieldOperand(function_map, Map::kBitFieldOffset), static_cast(1 << Map::kHasNonInstancePrototype)); diff --git a/deps/v8/src/mips/code-stubs-mips.cc b/deps/v8/src/mips/code-stubs-mips.cc index 541e73e2fa407e..441d3d050c8ee6 100644 --- a/deps/v8/src/mips/code-stubs-mips.cc +++ b/deps/v8/src/mips/code-stubs-mips.cc @@ -1492,8 +1492,12 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { __ GetObjectType(function, function_map, scratch); __ Branch(&slow_case, ne, scratch, Operand(JS_FUNCTION_TYPE)); - // Ensure that {function} has an instance prototype. + // Go to the runtime if the function is not a constructor. __ lbu(scratch, FieldMemOperand(function_map, Map::kBitFieldOffset)); + __ And(at, scratch, Operand(1 << Map::kIsConstructor)); + __ Branch(&slow_case, eq, at, Operand(zero_reg)); + + // Ensure that {function} has an instance prototype. __ And(at, scratch, Operand(1 << Map::kHasNonInstancePrototype)); __ Branch(&slow_case, ne, at, Operand(zero_reg)); diff --git a/deps/v8/src/mips64/code-stubs-mips64.cc b/deps/v8/src/mips64/code-stubs-mips64.cc index 28812ad9973219..b1d2bfe74cbea2 100644 --- a/deps/v8/src/mips64/code-stubs-mips64.cc +++ b/deps/v8/src/mips64/code-stubs-mips64.cc @@ -1488,8 +1488,12 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { __ GetObjectType(function, function_map, scratch); __ Branch(&slow_case, ne, scratch, Operand(JS_FUNCTION_TYPE)); - // Ensure that {function} has an instance prototype. + // Go to the runtime if the function is not a constructor. __ lbu(scratch, FieldMemOperand(function_map, Map::kBitFieldOffset)); + __ And(at, scratch, Operand(1 << Map::kIsConstructor)); + __ Branch(&slow_case, eq, at, Operand(zero_reg)); + + // Ensure that {function} has an instance prototype. __ And(at, scratch, Operand(1 << Map::kHasNonInstancePrototype)); __ Branch(&slow_case, ne, at, Operand(zero_reg)); diff --git a/deps/v8/src/ppc/code-stubs-ppc.cc b/deps/v8/src/ppc/code-stubs-ppc.cc index 03c73af50357fb..579109b7316732 100644 --- a/deps/v8/src/ppc/code-stubs-ppc.cc +++ b/deps/v8/src/ppc/code-stubs-ppc.cc @@ -1409,8 +1409,12 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { __ CompareObjectType(function, function_map, scratch, JS_FUNCTION_TYPE); __ bne(&slow_case); - // Ensure that {function} has an instance prototype. + // Go to the runtime if the function is not a constructor. __ lbz(scratch, FieldMemOperand(function_map, Map::kBitFieldOffset)); + __ TestBit(scratch, Map::kIsConstructor, r0); + __ beq(&slow_case, cr0); + + // Ensure that {function} has an instance prototype. __ TestBit(scratch, Map::kHasNonInstancePrototype, r0); __ bne(&slow_case, cr0); diff --git a/deps/v8/src/x64/code-stubs-x64.cc b/deps/v8/src/x64/code-stubs-x64.cc index f314b9cfcb6ece..be534afdb262b0 100644 --- a/deps/v8/src/x64/code-stubs-x64.cc +++ b/deps/v8/src/x64/code-stubs-x64.cc @@ -2069,6 +2069,11 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { __ CmpObjectType(function, JS_FUNCTION_TYPE, function_map); __ j(not_equal, &slow_case); + // Go to the runtime if the function is not a constructor. + __ testb(FieldOperand(function_map, Map::kBitFieldOffset), + Immediate(1 << Map::kIsConstructor)); + __ j(zero, &slow_case); + // Ensure that {function} has an instance prototype. __ testb(FieldOperand(function_map, Map::kBitFieldOffset), Immediate(1 << Map::kHasNonInstancePrototype)); diff --git a/deps/v8/src/x87/code-stubs-x87.cc b/deps/v8/src/x87/code-stubs-x87.cc index ff6c8d29e51e50..787ff2d71c26ee 100644 --- a/deps/v8/src/x87/code-stubs-x87.cc +++ b/deps/v8/src/x87/code-stubs-x87.cc @@ -1835,6 +1835,11 @@ void InstanceOfStub::Generate(MacroAssembler* masm) { __ CmpObjectType(function, JS_FUNCTION_TYPE, function_map); __ j(not_equal, &slow_case); + // Go to the runtime if the function is not a constructor. + __ test_b(FieldOperand(function_map, Map::kBitFieldOffset), + static_cast(1 << Map::kIsConstructor)); + __ j(zero, &slow_case); + // Ensure that {function} has an instance prototype. __ test_b(FieldOperand(function_map, Map::kBitFieldOffset), static_cast(1 << Map::kHasNonInstancePrototype)); diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-573858.js b/deps/v8/test/mjsunit/regress/regress-crbug-573858.js index 37a9eb84e5060c..270df5a64aa9db 100644 --- a/deps/v8/test/mjsunit/regress/regress-crbug-573858.js +++ b/deps/v8/test/mjsunit/regress/regress-crbug-573858.js @@ -9,7 +9,7 @@ var throw_type_error = Object.getOwnPropertyDescriptor( function create_initial_map() { this instanceof throw_type_error } %OptimizeFunctionOnNextCall(create_initial_map); -create_initial_map(); +assertThrows(create_initial_map); function test() { new throw_type_error } %OptimizeFunctionOnNextCall(test); diff --git a/test/parallel/test-instanceof.js b/test/parallel/test-instanceof.js new file mode 100644 index 00000000000000..498962ef86c5b7 --- /dev/null +++ b/test/parallel/test-instanceof.js @@ -0,0 +1,7 @@ +'use strict'; +require('../common'); +const assert = require('assert'); + +const F = () => {}; +F.prototype = {}; +assert(Object.create(F.prototype) instanceof F);