From 962d549be6fa58f41d580456ee7dcac37b25857f Mon Sep 17 00:00:00 2001
From: Robert Fancsik <frobert@inf.u-szeged.hu>
Date: Wed, 24 Apr 2019 14:39:04 +0200
Subject: [PATCH] Non-object values should give early false result for
 instanceof operator (#2830)

This patch fixes #2823.

JerryScript-DCO-1.0-Signed-off-by: Robert Fancsik frobert@inf.u-szeged.hu
---
 .../ecma/operations/ecma-function-object.c       | 10 +++++-----
 tests/jerry/es2015/regression-test-issue-2823.js | 16 ++++++++++++++++
 2 files changed, 21 insertions(+), 5 deletions(-)
 create mode 100644 tests/jerry/es2015/regression-test-issue-2823.js

diff --git a/jerry-core/ecma/operations/ecma-function-object.c b/jerry-core/ecma/operations/ecma-function-object.c
index 18fa17560..5f903eda1 100644
--- a/jerry-core/ecma/operations/ecma-function-object.c
+++ b/jerry-core/ecma/operations/ecma-function-object.c
@@ -402,6 +402,11 @@ ecma_op_function_has_instance (ecma_object_t *func_obj_p, /**< Function object *
   JERRY_ASSERT (func_obj_p != NULL
                 && !ecma_is_lexical_environment (func_obj_p));
 
+  if (!ecma_is_value_object (value))
+  {
+    return ECMA_VALUE_FALSE;
+  }
+
   while (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_BOUND_FUNCTION)
   {
     JERRY_ASSERT (ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_BOUND_FUNCTION);
@@ -423,11 +428,6 @@ ecma_op_function_has_instance (ecma_object_t *func_obj_p, /**< Function object *
   JERRY_ASSERT (ecma_is_normal_or_arrow_function (ecma_get_object_type (func_obj_p))
                 || ecma_get_object_type (func_obj_p) == ECMA_OBJECT_TYPE_EXTERNAL_FUNCTION);
 
-  if (!ecma_is_value_object (value))
-  {
-    return ECMA_VALUE_FALSE;
-  }
-
   ecma_object_t *v_obj_p = ecma_get_object_from_value (value);
 
   ecma_value_t prototype_obj_value = ecma_op_object_get_by_magic_id (func_obj_p,
diff --git a/tests/jerry/es2015/regression-test-issue-2823.js b/tests/jerry/es2015/regression-test-issue-2823.js
new file mode 100644
index 000000000..4cd3c9372
--- /dev/null
+++ b/tests/jerry/es2015/regression-test-issue-2823.js
@@ -0,0 +1,16 @@
+// Copyright JS Foundation and other contributors, http://js.foundation
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+class myArray extends Array {}
+assert (!(undefined instanceof myArray));