311252 - instanceof operator evaluates differently in rhino than in spidermonkey (firefox 1.0.7, that is)

Status: RESOLVED INVALID

(Rhino Graveyard :: Core, defect)

Description

[Daniel Krieg]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7

The following script evaluates differently in rhino 1.6r1 than in firefox 1.0.7

//  firefox 1.0.7
function A() {}
function B() {}
B.prototype={};
B.prototype instanceof A; // false
B.prototype.constructor = A;
B.prototype instanceof A; // true

// rhino 1.6r1
function A() {}
function B() {}
B.prototype={};
B.prototype instanceof A; // false
B.prototype.constructor = A;
B.prototype instanceof A; // false

Reproducible: Always

Steps to Reproduce:
1.evaluate the script output in rhino 1.6r1
2.evaluate the script output in firefox 1.0.7
3.compare the results

Actual Results:  
firefox correctly evaluated the 'instanceof' operator, rhino 1.6r1 does not

Expected Results:  
expected same behavior from the instanceof operator

Comment 1

[Igor Bukanov]

This is a bug in SpiderMonkey (JS engine that FireFox uses), not Rhino. You
example should give the same results for instanceof if you replaces B.prototype
by someVariable like in:

function A() {}
X={};
X instanceof A; // false
X.constructor = A;
X instanceof A; // still false even in SM.

For references ECMAScript defines instanceof in terms of the internal
[[HasInstance]] method and "B.prototype instanceof A" is equivalent in this case to

A.[[HasInstance]](B.prototype) or A.[[HasInstance]]({constructor: A}). That
should be false according to EcmaScript v3 which defines:

15.3.5.3 [[HasInstance]] (V)
         Assume F is a Function object.
         When the [[HasInstance]] method of F is called with value V, the
following steps are taken:
            If V is not an object, return false.
         1.
         2. Call the [[Get]] method of F with property name "prototype".
         3. Let O be Result(2).
            If O is not an object, throw a TypeError exception.
         4.
         5. Let V be the value of the [[Prototype]] property of V.
            If V is null, return false.
         6.
         7. If O and V refer to the same object or if they refer to objects
joined to each other (13.1.2), return
            true.
         8. Go to step 5.


Please file the bug against JS engine.