<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[285458] branches/safari-612-branch</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/285458">285458</a></dd>
<dt>Author</dt> <dd>kocsen_chung@apple.com</dd>
<dt>Date</dt> <dd>2021-11-08 17:08:53 -0800 (Mon, 08 Nov 2021)</dd>
</dl>

<h3>Log Message</h3>
<pre>Cherry-pick <a href="http://trac.webkit.org/projects/webkit/changeset/283332">r283332</a>. rdar://problem/85173157

    The DFG/FTL need to be aware that Proxy's can produce "function" for typeof and might be callable
    https://bugs.webkit.org/show_bug.cgi?id=230804
    <rdar://problem/83543951>

    Reviewed by Yusuke Suzuki.

    JSTests:

    * stress/ai-typeof-needs-to-be-aware-of-proxy-2.js: Added.
    (assert):
    (builtin.vm.createBuiltin):
    (builtin2.vm.createBuiltin):
    (let.p.new.Proxy):
    * stress/ai-typeof-needs-to-be-aware-of-proxy.js: Added.
    (assert):
    (builtin.vm.createBuiltin):
    (let.p.new.Proxy):
    * stress/is-callable-in-ftl-needs-to-be-aware-of-proxy.js: Added.
    (main):

    Source/JavaScriptCore:

    This patch fixes a couple bugs:
    - We were constant folding typeof on ProxyObject to "object"
      even when ProxyObject might produce a callable Proxy, and hence,
      should produce "function". This was a bug in AI.
    - This also fixes a similar bug in IsCallable's implementation in
      the FTL where we assumed that ProxyObject's type can't be callable.

    * bytecode/SpeculatedType.h:
    * dfg/DFGAbstractInterpreterInlines.h:
    (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
    * ftl/FTLLowerDFGToB3.cpp:
    (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):

    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283332 268f45cc-cd09-0410-ab3c-d52691b4dbfc</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari612branchJSTestsChangeLog">branches/safari-612-branch/JSTests/ChangeLog</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCoreChangeLog">branches/safari-612-branch/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCorebytecodeSpeculatedTypeh">branches/safari-612-branch/Source/JavaScriptCore/bytecode/SpeculatedType.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh">branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h</a></li>
<li><a href="#branchessafari612branchSourceJavaScriptCoreftlFTLLowerDFGToB3cpp">branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari612branchJSTestsstressaitypeofneedstobeawareofproxy2js">branches/safari-612-branch/JSTests/stress/ai-typeof-needs-to-be-aware-of-proxy-2.js</a></li>
<li><a href="#branchessafari612branchJSTestsstressaitypeofneedstobeawareofproxyjs">branches/safari-612-branch/JSTests/stress/ai-typeof-needs-to-be-aware-of-proxy.js</a></li>
<li><a href="#branchessafari612branchJSTestsstressiscallableinftlneedstobeawareofproxyjs">branches/safari-612-branch/JSTests/stress/is-callable-in-ftl-needs-to-be-aware-of-proxy.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari612branchJSTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/JSTests/ChangeLog (285457 => 285458)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/JSTests/ChangeLog     2021-11-09 01:08:50 UTC (rev 285457)
+++ branches/safari-612-branch/JSTests/ChangeLog        2021-11-09 01:08:53 UTC (rev 285458)
</span><span class="lines">@@ -1,5 +1,67 @@
</span><span class="cx"> 2021-11-08  Kocsen Chung  <kocsen_chung@apple.com>
</span><span class="cx"> 
</span><ins>+        Cherry-pick r283332. rdar://problem/85173157
+
+    The DFG/FTL need to be aware that Proxy's can produce "function" for typeof and might be callable
+    https://bugs.webkit.org/show_bug.cgi?id=230804
+    <rdar://problem/83543951>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/ai-typeof-needs-to-be-aware-of-proxy-2.js: Added.
+    (assert):
+    (builtin.vm.createBuiltin):
+    (builtin2.vm.createBuiltin):
+    (let.p.new.Proxy):
+    * stress/ai-typeof-needs-to-be-aware-of-proxy.js: Added.
+    (assert):
+    (builtin.vm.createBuiltin):
+    (let.p.new.Proxy):
+    * stress/is-callable-in-ftl-needs-to-be-aware-of-proxy.js: Added.
+    (main):
+    
+    Source/JavaScriptCore:
+    
+    This patch fixes a couple bugs:
+    - We were constant folding typeof on ProxyObject to "object"
+      even when ProxyObject might produce a callable Proxy, and hence,
+      should produce "function". This was a bug in AI.
+    - This also fixes a similar bug in IsCallable's implementation in
+      the FTL where we assumed that ProxyObject's type can't be callable.
+    
+    * bytecode/SpeculatedType.h:
+    * dfg/DFGAbstractInterpreterInlines.h:
+    (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+    * ftl/FTLLowerDFGToB3.cpp:
+    (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283332 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-09-30  Saam Barati  <sbarati@apple.com>
+
+            The DFG/FTL need to be aware that Proxy's can produce "function" for typeof and might be callable
+            https://bugs.webkit.org/show_bug.cgi?id=230804
+            <rdar://problem/83543951>
+
+            Reviewed by Yusuke Suzuki.
+
+            * stress/ai-typeof-needs-to-be-aware-of-proxy-2.js: Added.
+            (assert):
+            (builtin.vm.createBuiltin):
+            (builtin2.vm.createBuiltin):
+            (let.p.new.Proxy):
+            * stress/ai-typeof-needs-to-be-aware-of-proxy.js: Added.
+            (assert):
+            (builtin.vm.createBuiltin):
+            (let.p.new.Proxy):
+            * stress/is-callable-in-ftl-needs-to-be-aware-of-proxy.js: Added.
+            (main):
+
+2021-11-08  Kocsen Chung  <kocsen_chung@apple.com>
+
</ins><span class="cx">         Cherry-pick r283232. rdar://problem/85166097
</span><span class="cx"> 
</span><span class="cx">     Code inside strength reduction can incorrectly prove that we know what lastIndex is
</span></span></pre></div>
<a id="branchessafari612branchJSTestsstressaitypeofneedstobeawareofproxy2js"></a>
<div class="addfile"><h4>Added: branches/safari-612-branch/JSTests/stress/ai-typeof-needs-to-be-aware-of-proxy-2.js (0 => 285458)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/JSTests/stress/ai-typeof-needs-to-be-aware-of-proxy-2.js                              (rev 0)
+++ branches/safari-612-branch/JSTests/stress/ai-typeof-needs-to-be-aware-of-proxy-2.js 2021-11-09 01:08:53 UTC (rev 285458)
</span><span class="lines">@@ -0,0 +1,29 @@
</span><ins>+function assert(b) {
+    if (!b)
+        throw new Error;
+}
+
+var builtin = $vm.createBuiltin(`(function (a) {
+    if (@isProxyObject(a)) {
+        if (typeof a === "object")
+            return false;
+    }
+    return true;
+})`);
+
+noInline(builtin);
+
+var builtin2 = $vm.createBuiltin(`(function (a) {
+    if (@isProxyObject(a)) {
+        if (typeof a === "function")
+            return true;
+    }
+    return false;
+})`);
+noInline(builtin2);
+
+let p = new Proxy(function(){}, {});
+for (let i = 0; i < 10000; ++i) {
+    assert(builtin(p) === true);
+    assert(builtin2(p) === true);
+}
</ins></span></pre></div>
<a id="branchessafari612branchJSTestsstressaitypeofneedstobeawareofproxyjs"></a>
<div class="addfile"><h4>Added: branches/safari-612-branch/JSTests/stress/ai-typeof-needs-to-be-aware-of-proxy.js (0 => 285458)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/JSTests/stress/ai-typeof-needs-to-be-aware-of-proxy.js                                (rev 0)
+++ branches/safari-612-branch/JSTests/stress/ai-typeof-needs-to-be-aware-of-proxy.js   2021-11-09 01:08:53 UTC (rev 285458)
</span><span class="lines">@@ -0,0 +1,15 @@
</span><ins>+function assert(b) {
+    if (!b)
+        throw new Error;
+}
+
+var builtin = $vm.createBuiltin(`(function (a) {
+    if (@isProxyObject(a))
+        return typeof a;
+})`);
+
+noInline(builtin);
+
+let p = new Proxy(function(){}, {});
+for (let i = 0; i < 10000; ++i)
+    assert(builtin(p) === "function");
</ins></span></pre></div>
<a id="branchessafari612branchJSTestsstressiscallableinftlneedstobeawareofproxyjs"></a>
<div class="addfile"><h4>Added: branches/safari-612-branch/JSTests/stress/is-callable-in-ftl-needs-to-be-aware-of-proxy.js (0 => 285458)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/JSTests/stress/is-callable-in-ftl-needs-to-be-aware-of-proxy.js                               (rev 0)
+++ branches/safari-612-branch/JSTests/stress/is-callable-in-ftl-needs-to-be-aware-of-proxy.js  2021-11-09 01:08:53 UTC (rev 285458)
</span><span class="lines">@@ -0,0 +1,16 @@
</span><ins>+//@ runDefault("--validateOptions=true --useConcurrentJIT=false", "--useConcurrentGC=false", "--thresholdForJITSoon=10", "--thresholdForJITAfterWarmUp=10", "--thresholdForOptimizeAfterWarmUp=100", "--thresholdForOptimizeAfterLongWarmUp=100", "--thresholdForOptimizeSoon=100", "--thresholdForFTLOptimizeAfterWarmUp=1000", "--thresholdForFTLOptimizeSoon=1000", "--validateBCE=true", "--useFTLJIT=true")
+
+function main() {
+    let v162;
+    const v25 = {__proto__:"name"};
+    
+    for (let v113 = 0; v113 < 255; v113++) {
+        const v141 = new Proxy(Object,v25);
+        const v145 = v141["bind"]();
+        // when running with FTL, the previous line raises a JS exception:
+        // TypeError: |this| is not a function inside Function.prototype.bind
+        // without FTL or in v8 this doesn't throw.
+
+    }   
+}
+main();
</ins></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/ChangeLog (285457 => 285458)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/ChangeLog       2021-11-09 01:08:50 UTC (rev 285457)
+++ branches/safari-612-branch/Source/JavaScriptCore/ChangeLog  2021-11-09 01:08:53 UTC (rev 285458)
</span><span class="lines">@@ -1,5 +1,68 @@
</span><span class="cx"> 2021-11-08  Kocsen Chung  <kocsen_chung@apple.com>
</span><span class="cx"> 
</span><ins>+        Cherry-pick r283332. rdar://problem/85173157
+
+    The DFG/FTL need to be aware that Proxy's can produce "function" for typeof and might be callable
+    https://bugs.webkit.org/show_bug.cgi?id=230804
+    <rdar://problem/83543951>
+    
+    Reviewed by Yusuke Suzuki.
+    
+    JSTests:
+    
+    * stress/ai-typeof-needs-to-be-aware-of-proxy-2.js: Added.
+    (assert):
+    (builtin.vm.createBuiltin):
+    (builtin2.vm.createBuiltin):
+    (let.p.new.Proxy):
+    * stress/ai-typeof-needs-to-be-aware-of-proxy.js: Added.
+    (assert):
+    (builtin.vm.createBuiltin):
+    (let.p.new.Proxy):
+    * stress/is-callable-in-ftl-needs-to-be-aware-of-proxy.js: Added.
+    (main):
+    
+    Source/JavaScriptCore:
+    
+    This patch fixes a couple bugs:
+    - We were constant folding typeof on ProxyObject to "object"
+      even when ProxyObject might produce a callable Proxy, and hence,
+      should produce "function". This was a bug in AI.
+    - This also fixes a similar bug in IsCallable's implementation in
+      the FTL where we assumed that ProxyObject's type can't be callable.
+    
+    * bytecode/SpeculatedType.h:
+    * dfg/DFGAbstractInterpreterInlines.h:
+    (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+    * ftl/FTLLowerDFGToB3.cpp:
+    (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+    
+    
+    git-svn-id: https://svn.webkit.org/repository/webkit/trunk@283332 268f45cc-cd09-0410-ab3c-d52691b4dbfc
+
+    2021-09-30  Saam Barati  <sbarati@apple.com>
+
+            The DFG/FTL need to be aware that Proxy's can produce "function" for typeof and might be callable
+            https://bugs.webkit.org/show_bug.cgi?id=230804
+            <rdar://problem/83543951>
+
+            Reviewed by Yusuke Suzuki.
+
+            This patch fixes a couple bugs:
+            - We were constant folding typeof on ProxyObject to "object"
+              even when ProxyObject might produce a callable Proxy, and hence,
+              should produce "function". This was a bug in AI.
+            - This also fixes a similar bug in IsCallable's implementation in
+              the FTL where we assumed that ProxyObject's type can't be callable.
+
+            * bytecode/SpeculatedType.h:
+            * dfg/DFGAbstractInterpreterInlines.h:
+            (JSC::DFG::AbstractInterpreter<AbstractStateType>::executeEffects):
+            * ftl/FTLLowerDFGToB3.cpp:
+            (JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):
+
+2021-11-08  Kocsen Chung  <kocsen_chung@apple.com>
+
</ins><span class="cx">         Cherry-pick r283232. rdar://problem/85166097
</span><span class="cx"> 
</span><span class="cx">     Code inside strength reduction can incorrectly prove that we know what lastIndex is
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCorebytecodeSpeculatedTypeh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/bytecode/SpeculatedType.h (285457 => 285458)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/bytecode/SpeculatedType.h       2021-11-09 01:08:50 UTC (rev 285457)
+++ branches/safari-612-branch/Source/JavaScriptCore/bytecode/SpeculatedType.h  2021-11-09 01:08:53 UTC (rev 285458)
</span><span class="lines">@@ -116,6 +116,8 @@
</span><span class="cx"> static constexpr SpeculatedType SpecBytecodeTop                       = SpecHeapTop | SpecEmpty; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN. Corresponds to what could be found in a bytecode local.
</span><span class="cx"> static constexpr SpeculatedType SpecFullTop                           = SpecBytecodeTop | SpecFullNumber; // It can be anything that bytecode could see plus exotic encodings of numbers.
</span><span class="cx"> 
</span><ins>+static constexpr SpeculatedType SpecTypeofMightBeFunction             = SpecFunction | SpecObjectOther | SpecProxyObject; // If you don't see these types, you can't be callable, and you can't have typeof produce "function". Inverse is not true, however. If you only see these types, you may produce more things than "function" in typeof, and you might not be callable.
+
</ins><span class="cx"> // SpecCellCheck is the type set representing the values that can flow through a cell check.
</span><span class="cx"> // On 64-bit platforms, the empty value passes a cell check. Also, ~SpecCellCheck is the type
</span><span class="cx"> // set that representing the values that flow through when testing that something is not a cell.
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCoredfgDFGAbstractInterpreterInlinesh"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h (285457 => 285458)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h     2021-11-09 01:08:50 UTC (rev 285457)
+++ branches/safari-612-branch/Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h        2021-11-09 01:08:53 UTC (rev 285458)
</span><span class="lines">@@ -1619,7 +1619,7 @@
</span><span class="cx">             // Is the child's type an object that isn't an other-object (i.e. object that could
</span><span class="cx">             // have masquaredes-as-undefined traps) and isn't a function? Then: we should fold
</span><span class="cx">             // this to true.
</span><del>-            if (!(child.m_type & ~(SpecObject - SpecObjectOther - SpecFunction))) {
</del><ins>+            if (!(child.m_type & ~(SpecObject - SpecTypeofMightBeFunction))) {
</ins><span class="cx">                 setConstant(node, jsBoolean(true));
</span><span class="cx">                 constantWasSet = true;
</span><span class="cx">                 break;
</span><span class="lines">@@ -1732,7 +1732,7 @@
</span><span class="cx">                 break;
</span><span class="cx">             }
</span><span class="cx">             
</span><del>-            if (!(child.m_type & (SpecFunction | SpecObjectOther | SpecProxyObject))) {
</del><ins>+            if (!(child.m_type & SpecTypeofMightBeFunction)) {
</ins><span class="cx">                 setConstant(node, jsBoolean(false));
</span><span class="cx">                 constantWasSet = true;
</span><span class="cx">                 break;
</span><span class="lines">@@ -1811,7 +1811,7 @@
</span><span class="cx"> 
</span><span class="cx">         // FIXME: We could use the masquerades-as-undefined watchpoint here.
</span><span class="cx">         // https://bugs.webkit.org/show_bug.cgi?id=144456
</span><del>-        if (!(abstractChild.m_type & ~(SpecObject - SpecObjectOther - SpecFunction))) {
</del><ins>+        if (!(abstractChild.m_type & ~(SpecObject - SpecTypeofMightBeFunction))) {
</ins><span class="cx">             setConstant(node, *m_graph.freeze(m_vm.smallStrings.objectString()));
</span><span class="cx">             break;
</span><span class="cx">         }
</span></span></pre></div>
<a id="branchessafari612branchSourceJavaScriptCoreftlFTLLowerDFGToB3cpp"></a>
<div class="modfile"><h4>Modified: branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp (285457 => 285458)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp 2021-11-09 01:08:50 UTC (rev 285457)
+++ branches/safari-612-branch/Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp    2021-11-09 01:08:53 UTC (rev 285458)
</span><span class="lines">@@ -19511,7 +19511,7 @@
</span><span class="cx">             
</span><span class="cx">     LValue isExoticForTypeof(LValue cell, SpeculatedType type = SpecFullTop)
</span><span class="cx">     {
</span><del>-        if (!(type & SpecObjectOther))
</del><ins>+        if (!(type & (SpecObjectOther | SpecProxyObject)))
</ins><span class="cx">             return m_out.booleanFalse;
</span><span class="cx">         return m_out.testNonZero32(
</span><span class="cx">             m_out.load8ZeroExt32(cell, m_heaps.JSCell_typeInfoFlags),
</span></span></pre>
</div>
</div>

</body>
</html>