diff options
Diffstat (limited to 'chromium/v8/src/builtins/builtins-constructor-gen.cc')
| -rw-r--r-- | chromium/v8/src/builtins/builtins-constructor-gen.cc | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/chromium/v8/src/builtins/builtins-constructor-gen.cc b/chromium/v8/src/builtins/builtins-constructor-gen.cc index 767e626432e..56dc23e233e 100644 --- a/chromium/v8/src/builtins/builtins-constructor-gen.cc +++ b/chromium/v8/src/builtins/builtins-constructor-gen.cc @@ -182,15 +182,14 @@ compiler::TNode<JSObject> ConstructorBuiltinsAssembler::EmitFastNewObject( SloppyTNode<Context> context, SloppyTNode<JSFunction> target, SloppyTNode<JSReceiver> new_target, Label* call_runtime) { // Verify that the new target is a JSFunction. - Label fast(this), end(this); - GotoIf(HasInstanceType(new_target, JS_FUNCTION_TYPE), &fast); - Goto(call_runtime); - - BIND(&fast); + Label end(this); + TNode<JSFunction> new_target_func = + HeapObjectToJSFunctionWithPrototypeSlot(new_target, call_runtime); + // Fast path. // Load the initial map and verify that it's in fact a map. Node* initial_map = - LoadObjectField(new_target, JSFunction::kPrototypeOrInitialMapOffset); + LoadJSFunctionPrototypeOrInitialMap(new_target_func); GotoIf(TaggedIsSmi(initial_map), call_runtime); GotoIf(DoesntHaveInstanceType(initial_map, MAP_TYPE), call_runtime); |