Maybe related to issue 666308 ?
function foo() {};
foo.__defineGetter__(undefined, function() {});
function bar() {}
function baz(x) { return x instanceof bar };
%OptimizeFunctionOnNextCall(baz);
baz();
Object.setPrototypeOf(bar, null);
bar[Symbol.hasInstance] = function() { return true };
print(baz());
# Compared fullcode with ignition_turbo
# Flags of fullcode:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed -176087470 --nocrankshaft --turbo-filter=~
# Flags of ignition_turbo:
--abort_on_stack_overflow --expose-gc --allow-natives-syntax --invoke-weak-callbacks --omit-quit --es-staging --random-seed -176087470 --ignition-staging --turbo
Difference:
- true
+ false
### Start of configuration fullcode:
true
### End of configuration fullcode
### Start of configuration ignition_turbo:
false
### End of configuration ignition_turbo
Comment 1 by hablich@chromium.org
, Nov 22 2016Owner: bmeu...@chromium.org
Status: Assigned (was: Untriaged)