554902 - overriding valueOf method to return an object messes up functionality of Object() called as a function

Status: RESOLVED DUPLICATE of bug 554550

(Core :: JavaScript Engine, defect)

Description

[David Foley]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.1.249.1036 Safari/532.5
Build Identifier: 

Examine and run the following JavaScript code in FF 3.6 on Windows:

function NotAFunction ()
{

};
NotAFunction.prototype.valueOf = function ()
{
    return new Function;
};

new NotAFunction instanceof Function; // false
Object(new NotAFunction) instanceof Function; // should be false, but FF 3.6 on MS returns true.

If a custom implementation of valueOf returns a primitive value, Object casting works correctly. The bug only occurs when a custom implementation of valueOf returns an Object value.

			var o= new Object;
			o.valueOf= function ()
			{
				return new Function;
			};
			
			alert(Object(o) instanceof Function) // Win FF alerts true, should be false
			
			o.valueOf= function ()
			{
				return -1;
			}
			
			alert(Object(o) instanceof Function) // Win FF alerts false as expected

Reproducible: Always

Steps to Reproduce:
Implement the above code and test it in FF 3.6, then compare against FF for Mac, or any other browser. Only FF 3.6 for windows exhibits the bug.
Actual Results:  
Object(new NotAFunction) instanceof Function returns true

Expected Results:  
Object(new NotAFunction) instanceof Function should have returned false

Comment 1

[Martin Honnen]

Attachment: JavaScript test case to be run in shell

Comment 2

[Martin Honnen]

Attachment: HTML test case to be run in browser

Comment 3

[Martin Honnen]

Confirming bug. Occurs with current trunk Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.3a4pre) Gecko/20100328 Minefield/3.7a4pre.
Occurs also with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.18) Gecko/2010020220 Firefox/3.0.18.

I will attach a test case that shows that overriding the valueOf method to return an object messes up the functionality of Object() called as a function when an object is passed in. In this case Object(someObject) should just return that someObject but with Spidermonkey it returns the result of calling valueOf() on someObject.

Comment 4

[Jeff Walden [:Waldo]]

Easy fix, coming after I finish cleanup in aisle 548702...

Comment 5

[Brendan Eich [:brendan]]

Dup of bug 554550 -- reopen if I'm mistaken.

/be