1 files changed, 73 insertions, 15 deletions
diff --git a/deps/v8/test/mjsunit/compiler/regress-9041.js b/deps/v8/test/mjsunit/compiler/regress-9041.js
index d7a8e6d625..ddbf3e4928 100644
--- a/deps/v8/test/mjsunit/compiler/regress-9041.js
+++ b/deps/v8/test/mjsunit/compiler/regress-9041.js
@@ -5,19 +5,77 @@
 // Flags: --allow-natives-syntax
 
 (function() {
-class A {}
-
-function foo(a, fn) {
-  const C = a.constructor;
-  fn(a);
-  return a instanceof C;
-};
-%PrepareFunctionForOptimization(foo);
-assertTrue(foo(new A(), a => {}));
-assertTrue(foo(new A(), a => {}));
-%OptimizeFunctionOnNextCall(foo);
-assertTrue(foo(new A(), a => {}));
-assertFalse(foo(new A(), a => {
-  a.__proto__ = {};
-}));
+  class A {};
+
+  function foo(a, fn) {
+    const C = a.constructor;
+    fn(a);
+    return a instanceof C;
+  };
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo(new A(), a => {}));
+  assertTrue(foo(new A(), a => {}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo(new A(), a => {}));
+  assertFalse(foo(new A(), a => { a.__proto__ = {}; }));
+})();
+
+(function() {
+  class A {};
+  A.__proto__ = {};
+  A.prototype = {};
+
+  function foo() {
+    var x = Object.create(Object.create(Object.create(A.prototype)));
+    return x instanceof A;
+  };
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+(function() {
+  class A {};
+  A.prototype = {};
+  A.__proto__ = {};
+  var a = {__proto__: new A, gaga: 42};
+
+  function foo() {
+    A.bla;  // Make A.__proto__ fast again.
+    a.gaga;
+    return a instanceof A;
+  };
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
+})();
+
+(function() {
+  class A {};
+  A.prototype = {};
+  A.__proto__ = {};
+  const boundA = Function.prototype.bind.call(A, {});
+  boundA.prototype = {};
+  boundA.__proto__ = {};
+  var a = {__proto__: new boundA, gaga: 42};
+
+  function foo() {
+    A.bla;  // Make A.__proto__ fast again.
+    boundA.bla;  // Make boundA.__proto__ fast again.
+    a.gaga;
+    return a instanceof boundA;
+  };
+
+  %PrepareFunctionForOptimization(foo);
+  assertTrue(foo());
+  assertTrue(foo());
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo());
 })();