1530413 - Inconsistent error reporting for non-function object RHS to instanceof

Status: RESOLVED FIXED

(Core :: JavaScript Engine, enhancement, P2)

Description

[Boris Zbarsky [:bzbarsky]]

({} instanceof {})
TypeError: ({}) is not a function

({} instanceof document)
TypeError: invalid 'instanceof' operand document

({} instanceof new Proxy(document, {}))
TypeError: (new Proxy(...)) is not a function

What's going on here is that there are two ways we can report an error here. We can end up with JSMSG_BAD_INSTANCEOF_RHS. That can happen due to reaching BaseProxyHandler::hasInstance (the "document" case) or either the interpreter or JIT having a non-object as RHS.

Or we can land in JS::InstanceofOperator, determine that !obj->isCallable() and js::ReportIsNotFunction.

Arguably the BaseProxyHandler behavior is just broken: it's ignoring whether the proxy has an @@hasInstance! Evaluating this in the web console:

  document[Symbol.hasInstance] = function() { return true; }; ({} instanceof document)

throws whereas in other browsers it evaluates to true. I can fix this in the DOM proxy code, but it really feels like BaseProxyHandler should handle this better.

Comment 1

[Boris Zbarsky [:bzbarsky]]

I guess here's the fundamental question: why does BaseProxyHandler::hasInstance not just call JS::InstanceofOperator? That seems like a much better default fallback for proxies that choose to not override hasInstance than throwing...

Comment 2

[Anny Gakhokidze [:annyG]]

Attachment: Bug 1530413 - Inconsistent error reporting for non-function object RHS to instanceof,

Additionally, this fixes test dom/tests/mochitest/bugs/test_bug1530292.html
which fails if fission is enabled.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4c4f1cd4e616
Inconsistent error reporting for non-function object RHS to instanceof, r=bzbarsky,tcampbell

Comment 4

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/4c4f1cd4e616