7635 - small tweak to instanceof behavior

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Mike McCabe]

Filing a bug so this doesn't get lost.

In the process of getting 'instanceof' approved as part of ECMA, we accepted a
small change from Microsoft to the semantics, the effect of which is that for a
given js object, 'o instanceof o' is no longer true.  (the instanceof loop
starts with the prototype instead of the current object.)

Rhino and the Monkey both need to be fixed to reflect this behavior.

Comment 1

[cbegle]

hey, phillip, i hope you don't mind, i'm taking this one. let me know if you
were thinking of doing something with it.

Comment 2

[rogerl (gone)]

Hey Christine, did you want to be the assignee for this one?

Comment 3

[cbegle]

no, i was just moving the qa contact. you can still have it, roger. :)

Comment 4

[rogerl (gone)]

Hmmm. Mike, currently both Rhino and Monkey return false for :
o = {}
o instanceof o

What am I missing?

Comment 5

[Mike McCabe]

Hadn't thought about this for a little while...

instanceof should always return false if the right had side isn't a function (or
maybe a host object that responds to instanceof.

And (this was the recent change) the prototype object of the function shouldn't
return true to 'instanceof'.  instanceof returns true if the prototype object is
in the __proto__ chain of the object on the left hand side, but not when it's
the object itself.

Here's the text from the latest ecma (the ordering was changed slightly to give
the above yes-but-not-the-prototype-property-itself behavior.)

15.3.5.4  [[HasInstance]] (V)
Assume F is a function object.
When the [[HasInstance]] method of F is called with value V, the following steps
are taken:
1. If V is not an object, return false.
2. Call the [[Get]] method of F with property name "prototype".
3. Let O be Result(2).
4. If O is not an object, generate a runtime error.
5. Let V be the value of the [[Prototype]] property of V.
6. If V is null, return false.
7. If O and V refer to the same object, return true.
8. Go to step 5.


... where [[HasInstance]] is the internal method that gets called on the rhs by
the execution of 'instanceof' - ecma only defines [[HasInstance]] for function
objects.

Comment 6

[Mike McCabe]

Forgot to add this -

js> function Foo() {}
js> theproto = {};
[object Object]
js> Foo.prototype = theproto
[object Object]
js> theproto instanceof Foo
true

I think this should be 'false'

Comment 7

[rogerl (gone)]

Fixed. Rhino was already ok, Monkey now starts with the prototype object.

Comment 8

[cbegle]

test case is mozilla/js/tests/ecma_2/instanceof/regress-7635.js