642174 - JM: jsop_instanceof only tests isFunction if !rhs->isTypeKnown

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brian Hackett [Laid off!]]

JM fast paths the .prototype access when testing x instanceof y and y is a function.  It does this if the rhs is a known object, even if the rhs is not actually a function (and is instead StopIteration or some other value with a hasInstance hook).  This is the relevant code:

    if (!rhs->isTypeKnown()) {
        Jump j = frame.testObject(Assembler::NotEqual, rhs);
        stubcc.linkExit(j, Uses(2));
        RegisterID reg = frame.tempRegForData(rhs);
        j = masm.testFunction(Assembler::NotEqual, reg);
        stubcc.linkExit(j, Uses(2));
    }

The function test should always occur.

Comment 1

[Brian Hackett [Laid off!]]

Attachment: patch

No testcase for stock JM (hard to get it to know something is an object), but this breaks some jstests in the TI branch.

Comment 2

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 519701 [details] [diff] [review]
patch

Nice. You should be able to get a test case for this, JM will track entries as known-objects for object/array literals, |this| in constructors, and regexes.

Comment 3

[Brian Hackett [Laid off!]]

http://hg.mozilla.org/tracemonkey/rev/6e3e86e4533e

Comment 4

[Chris Leary [:cdleary] (not checking bugmail)]

http://hg.mozilla.org/mozilla-central/rev/6e3e86e4533e