253634 2023-03-09 00:19:31 -0800 [JSC] Bound function optimization is observable with instanceof 2023-03-13 10:22:09 -0700 1 1 1 Unclassified WebKit JavaScriptCore Safari Technology Preview Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 jdemooij ysuzuki mark.lam webkit-bug-importer ysuzuki oldest_to_newest 1939995 0 465371 jdemooij 2023-03-09 00:19:31 -0800 Created attachment 465371 Test When binding an already-bound function, JSC tries to flatten this chain. This optimization is observable with `instanceof` because it gets the bound function's immediate target and does a `Symbol.hasInstance` lookup on it. See the attached testcase. It should alert 10000 but I get 0 with Safari Technology Preview 165. 1940047 1 webkit-bug-importer 2023-03-09 06:37:30 -0800 <rdar://problem/106498460> 1940522 2 ysuzuki 2023-03-10 14:57:22 -0800 Pull request: https://github.com/WebKit/WebKit/pull/11385 1940940 3 ysuzuki 2023-03-13 10:22:09 -0700 https://github.com/WebKit/WebKit/commit/d1911bf073cc55fc8ca76bcee8b4783539e43c2e 465371 2023-03-09 00:19:31 -0800 2023-03-09 00:19:31 -0800 Test test.htm text/html 339 jdemooij PHNjcmlwdD4KZnVuY3Rpb24gZihhLCBiKSB7IHJldHVybiBhICsgYjsgfTsKbGV0IGNvdW50ID0g MDsKb25sb2FkID0gZnVuY3Rpb24oKSB7CiAgICBmb3IgKHZhciBpID0gMDsgaSA8IDEwXzAwMDsg aSsrKSB7CiAgICAgICAgdmFyIGcgPSBmLmJpbmQobnVsbCk7CiAgICAgICAgdmFyIGggPSBnLmJp bmQobnVsbCk7CiAgICAgICAgT2JqZWN0LmRlZmluZVByb3BlcnR5KGcsIFN5bWJvbC5oYXNJbnN0 YW5jZSwge2dldDogZnVuY3Rpb24oKSB7IGNvdW50Kys7IH19KTsKICAgICAgICB2YXIgcmVzID0g e30gaW5zdGFuY2VvZiBoOwogICAgfQogICAgYWxlcnQoY291bnQpOwp9Owo8L3NjcmlwdD4K