Merge V8 5.2.361.47 DO NOT MERGE
https://chromium.googlesource.com/v8/v8/+/5.2.361.47
FPIIM-449
Change-Id: Ibec421b85a9b88cb3a432ada642e469fe7e78346
(cherry picked from commit bcf72ee8e3b26f1d0726869c7ddb3921c68b09a8)
diff --git a/test/mjsunit/harmony/instanceof-es6.js b/test/mjsunit/harmony/instanceof-es6.js
index 60e7ee2..4971c9c 100644
--- a/test/mjsunit/harmony/instanceof-es6.js
+++ b/test/mjsunit/harmony/instanceof-es6.js
@@ -48,3 +48,22 @@
// OrdinaryHasInstance passed a non-object argument returns false.
assertEquals(Function.prototype[Symbol.hasInstance].call(Array, 0), false);
+
+// Cannot assign to @@hasInstance with %FunctionPrototype%.
+(function() {
+ "use strict";
+ function F() {}
+ assertThrows(function() { F[Symbol.hasInstance] = (v) => v }, TypeError);
+})();
+
+// Check correct invocation of @@hasInstance handler on function instance.
+(function() {
+ function F() {}
+ var counter = 0;
+ var proto = Object.getPrototypeOf(F);
+ Object.setPrototypeOf(F, null);
+ F[Symbol.hasInstance] = function(v) { ++counter; return true };
+ Object.setPrototypeOf(F, proto);
+ assertTrue(1 instanceof F);
+ assertEquals(1, counter);
+})();