Some comments to start with.
http://codereview.chromium.org/2877018/diff/1/2 File src/arm/codegen-arm.cc (right): http://codereview.chromium.org/2877018/diff/1/2#newcode4776 src/arm/codegen-arm.cc:4776: true_target()->Branch(eq); This should be false_target, right? http://codereview.chromium.org/2877018/diff/1/2#newcode4780 src/arm/codegen-arm.cc:4780: // If this is an undetectable object return true immediately. Check for undetectable seems wrong, since it would accept undetectable strings. Why do we even check this property at all? http://codereview.chromium.org/2877018/diff/1/2#newcode4788 src/arm/codegen-arm.cc:4788: __ cmp(possible_object, Operand(JS_FUNCTION_TYPE)); We assume that JS_FUNCTION_TYPE is the last type throughout the code generator, so this check can be omitted. http://codereview.chromium.org/2877018/diff/1/12 File src/v8natives.js (left): http://codereview.chromium.org/2877018/diff/1/12#oldcode228 src/v8natives.js:228: if (!IS_SPEC_OBJECT_OR_NULL(V) && !IS_UNDETECTABLE(V)) return false; Is the original line correct? Why could an undetectable non-object by a prototype? http://codereview.chromium.org/2877018/diff/1/12#oldcode236 src/v8natives.js:236: if (!IS_SPEC_OBJECT_OR_NULL(this)) return false; This is all messed up. http://codereview.chromium.org/2877018/show -- v8-dev mailing list [email protected] http://groups.google.com/group/v8-dev
