36 lines
1.1 KiB
JavaScript
36 lines
1.1 KiB
JavaScript
|
// Copyright 2023 the V8 project authors. All rights reserved.
|
||
|
|
// Use of this source code is governed by a BSD-style license that can be
|
||
|
|
// found in the LICENSE file.
|
||
|
|
//
|
||
|
|
// Flags: --maglev --allow-natives-syntax
|
||
|
|
|
||
|
|
function Foo() {}
|
||
|
|
Object.defineProperty(Foo, Symbol.hasInstance, { value: Math.round });
|
||
|
|
|
||
|
|
let foo = new Foo();
|
||
|
|
|
||
|
|
function bar(f) {
|
||
|
|
// `f instanceof Foo` runs `%ToBoolean(Foo[Symbol.hasInstance](f))`, where
|
||
|
|
// `Foo[Symbol.hasInstance]` is `Math.round`.
|
||
|
|
//
|
||
|
|
// So with sufficient builtin inlining, this will call
|
||
|
|
// `%ToBoolean(round(%ToNumber(f)))`, which will call `f.valueOf`. If this
|
||
|
|
// deopts (which in this test it will), we need to make sure to both round it,
|
||
|
|
// and then convert that rounded value to a boolean.
|
||
|
|
return f instanceof Foo;
|
||
|
|
}
|
||
|
|
|
||
|
|
foo.valueOf = () => {
|
||
|
|
%DeoptimizeFunction(bar);
|
||
|
|
// Return a value which, when rounded, has ToBoolean false, and when not
|
||
|
|
// rounded, has ToBoolean true.
|
||
|
|
return 0.2;
|
||
|
|
}
|
||
|
|
|
||
|
|
%PrepareFunctionForOptimization(bar);
|
||
|
|
assertFalse(bar(foo));
|
||
|
|
assertFalse(bar(foo));
|
||
|
|
|
||
|
|
%OptimizeMaglevOnNextCall(bar);
|
||
|
|
assertFalse(bar(foo));
|