test case: javascript: ({} instanceof { get prototype(){ alert("Error!"); } }) The bug here is that we read the prototype from the RHS argument using a regular op_get_by_id before op_instanceof has checked that this is an object implementing HasInstance. This incorrect behaviour gives rise to further unnecessary complexity in the code base, since we have additional logic (implemented using the GetByIdExceptionInfo data structures on CodeBlock) to convert not an object errors from the get_by_id into invalid parameter errors. Having fixed this bug this code is all redundant, since in these cases the get_by_id will never have been reached. (op_construct had a similar error, but this is fixed since we moved this object creation to inside the constructor function.)
Created attachment 74020 [details] the patch
fixed in r72127