[MERGE #5918 @boingoing] instanceof with bound function should call [Symbol.hasInstance] accessor

Merge pull request #5918 from boingoing:fix_5883

Fixes #5883

Author: boingoing

lib/Runtime/Language/JavascriptOperators.cpp

@@ -7600,6 +7600,16 @@ using namespace Js;
         RecyclableObject* constructor = VarTo<RecyclableObject>(aClass);
         if (scriptContext->GetConfig()->IsES6HasInstanceEnabled())
         {
+            if (VarIs<JavascriptFunction>(constructor))
+            {
+                JavascriptFunction* func = VarTo<JavascriptFunction>(constructor);
+                if (func->IsBoundFunction())
+                {
+                    BoundFunction* boundFunc = (BoundFunction*)func;
+                    constructor = boundFunc->GetTargetFunction();
+                }
+            }
+
             Var instOfHandler = JavascriptOperators::GetPropertyNoCache(constructor,
               PropertyIds::_symbolHasInstance, scriptContext);
             if (JavascriptOperators::IsUndefinedObject(instOfHandler)

lib/Runtime/Runtime.h

@@ -429,6 +429,7 @@ enum tagDEBUG_EVENT_INFO_TYPE
 
 #include "Library/JavascriptNumber.h"
 #include "Library/JavascriptFunction.h"
+#include "Library/BoundFunction.h"
 #include "Library/RuntimeFunction.h"
 #include "Library/JavascriptExternalFunction.h"
 #include "Library/CustomExternalIterator.h"

test/Bugs/bug_5883.js

@@ -0,0 +1,26 @@
+//-------------------------------------------------------------------------------------------------------
+// Copyright (C) Microsoft. All rights reserved.
+// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.
+//-------------------------------------------------------------------------------------------------------
+
+WScript.LoadScriptFile("..\\UnitTestFramework\\UnitTestFramework.js");
+
+var tests = [
+    {
+        name: "#5883 - instanceof on a bound function fails to call [Symbol.hasInstance] accessor",
+        body: function () {
+            let called = false;
+            class A {
+                static [Symbol.hasInstance]() {
+                    called = true;
+                }
+            }
+            const B = A.bind();
+
+            ({} instanceof B);
+            assert.isTrue(called);
+        }
+    },
+];
+
+testRunner.runTests(tests, { verbose: WScript.Arguments[0] != "summary" });

test/Bugs/rlexe.xml

@@ -576,4 +576,10 @@
       <compile-flags>-force:deferparse</compile-flags>
     </default>
   </test>
+  <test>
+    <default>
+      <files>bug_5883.js</files>
+      <compile-flags>-args summary -endargs</compile-flags>
+    </default>
+  </test>
 </regress-exe>