generateConditionsForInstanceOf needs to see if the object has a poly proto structure before assuming it has a constant prototype
https://bugs.webkit.org/show_bug.cgi?id=186363
Rubber-stamped by Filip Pizlo.
JSTests:
* stress/instance-of-on-poly-proto-opc-should-not-crash.js: Added.
Source/JavaScriptCore:
The code was assuming that the object it was creating an OPC for always
had a non-poly-proto structure. However, this assumption was wrong. For
example, an object in the prototype chain could be poly proto. That type
of object graph would cause a crash in this code. This patch makes it so
that we fail to generate an ObjectPropertyConditionSet if we see a poly proto
object as we traverse the prototype chain.
* bytecode/ObjectPropertyConditionSet.cpp:
(JSC::generateConditionsForInstanceOf):
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232562
268f45cc-cd09-0410-ab3c-
d52691b4dbfc