avm1: More accurate semantics for instanceof and CastOp
#22433
Merged
+368
−130
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
moulins
added
A-avm1
moulins
force-pushed
the
avm1-instanceof-and-cast
branch
from
e3f53be to
fba415d
Compare
moulins
force-pushed
the
avm1-instanceof-and-cast
branch
from
fba415d to
5c1d88e
Compare
Lord-McSweeney
approved these changes
Dec 7, 2025
For some extra clarity.
- only coerce RHS when the LHS is object-like
- `prototype` access should ignore __proto__, properties, and version attributes
This exposes some Flash weirdness; in FP, the following code traces `false` if
placed on frame 1, but hangs if placed on any other frame.
```
a = {};
b = {};
a.__proto__ = b;
b.__proto__ = a;
trace(a instanceof b);
```
Prior to this PR, Ruffle raised an `Error::PrototypeRecursionLimit`, for slightly
wrong reasons (we tried to crawl b's `__proto__` chain to find a `prototype`
property); now it returns `false`.
This affects Gnash's `Inheritance-*` tests, as they run the above code on frame 2,
and so hang in FP.
moulins
force-pushed
the
avm1-instanceof-and-cast
branch
from
5c1d88e to
01c60bd
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
prototypeaccess should ignore__proto__, properties, and version attributesThis exposes some Flash weirdness; see the second commit message for details.