245113 - instanceof operator returns true for class prototype

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Erik Fabert]

User-Agent:       Opera/7.23 (Windows NT 5.1; U)  [de]
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040514

If I add a method to a class via prototype, then call that method direct via 
"class.prototype.method()", "this instanceof class" is true. In Opera and IE it 
is false. 

Here is the testcase:

var res="";
Date.prototype.test = function() {
	res += (this instanceof Date)+" ";
}
String.prototype.test = function() {
	res += (this instanceof String)+" ";
}
res += (Date.prototype.test instanceof Date)+" ";
Date.prototype.test();
String.prototype.test();
(new Date()).test();
(new String()).test();

alert(res);


Reproducible: Always
Steps to Reproduce:
1. Run the testcase

Actual Results:  
Alert box displaying "false true true true true"

Expected Results:  
Alert box displaying "false false false true true"

Comment 1

[Brendan Eich [:brendan]]

ECMA-262 Edition 3 agrees with comment 0.

/be

Comment 2

[Brendan Eich [:brendan]]

Attachment: proposed fix

Easy patch, the bug here is specific to the brutal-sharing hack in
fun_hasInstance, whereby /hi/ instanceof RegExp is true even if /hi/ was
precompiled using a different RegExp object from the one used at runtime.

/be

Comment 3

[Brendan Eich [:brendan]]

Fixed on trunk and 1.7 branch.

/be

Comment 4

[Erik Fabert]

Works for me with rv:1.8a2 Gecko/20040603. Can I mark the bug as verified myself 
or should a QA person do that?

Comment 5

[Brendan Eich [:brendan]]

Erik: go for it, thanks!

/be

Comment 6

[Bob Clary [:bc] (inactive)]

Attachment: js1_5/Regress/regress-245113.js

Erik, with your permission this will be included in the javascript test suite.

Comment 7

[Erik Fabert]

You have my permission for this test and the tests in bug 274035 and bug 244470.

Comment 8

[Bob Clary [:bc] (inactive)]

js1_5/Regress/regress-245113.js checked in.