597872 - instanceof fails on unwrapped objects

Status: RESOLVED DUPLICATE of bug 620486

(Core :: JavaScript Engine, defect)

Description

[Steve Roussey (:sroussey)]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.8 Safari/534.7
Build Identifier: 

Say in an extension I have window variable. To get the user's view of 
it: 

var win = window.wrappedJSObject; 

Now why does this not work most* of the time: 

var a = win.Object; 
var b = new a(); 
var c = b instanceof a; 

Instead of working, it is throwing "invalid 'instanceof' operand"? 


http://groups.google.com/group/mozilla.dev.platform/browse_thread/thread/dc708c6387431221/0f0fee45103c341f

Reproducible: Always

Comment 1

[Johnny Stenback (:jst)]

Is this a regression? Did this work in Firefox 3.6 etc?

Comment 2

[Steve Roussey (:sroussey)]

Does not work on Firefox 3.6

Comment 3

[Johnny Stenback (:jst)]

Ok, thanks for testing! Not blocking 2.0 on this issue then, but would most certainly consider a fix if one shows up.

Comment 4

[Nochum Sossonko [:Natch]]

(In reply to comment #3)
> Ok, thanks for testing! Not blocking 2.0 on this issue then, but would most
> certainly consider a fix if one shows up.

This doesn't work in 3.6 because .wrappedJSObject is non-existent. Confirming bug and resetting blocking flag.

Using the following in the Error Console demonstrates the bug:

var win = top.opener.gBrowser.selectedBrowser.contentWindow;
var a = win.Object;
var b = new a();
b instanceof a;

3.6 returns true.

2.0 throws:

Error: a is not a constructor
Source File: javascript:%20var%20win%20=%20top.opener.gBrowser.selectedBrowser.contentWindow;%20var%20a%20=%20win.Object;%20var%20b%20=%20new%20a();%20b%20instanceof%20a;
Line: 1

If you use .wrappedJSObject on 2.0 it throws the error in comment 0.

Comment 5

[Steve Roussey (:sroussey)]

Just a note: I don't know what environment the Error Console provides, so I can't speak to that. But within an extension, wrappedJSObject exists and is necessary. I am certainly all for having the issue fixed though!

Comment 7

[Andreas Gal :gal]

var win = top.opener.gBrowser.selectedBrowser.contentWindow; var a = win.Object; alert(a) => undefined, so comment 4 is testing something else.

Comment 8

[Andreas Gal :gal]

I tried this in the web console and it seems to work as expected. Without a test case I will wfm this.

Comment 9

[Steve Roussey (:sroussey)]

OK, just curious though... what "web console" are you using to test?

Comment 10

[Andreas Gal :gal]

pcwalton showed me how to get hold of a contentWindow through a web console opened for about:blank (which should be chrome). Any better way to try this?

Comment 11

[Steve Roussey (:sroussey)]

Just that it needs to be from chrome priv code. Do you have Chromebug installed?

Comment 12

[Andreas Gal :gal]

No, but about:blank is chrome so the web console is chrome. I used Components.interfaces and .classes, so I am pretty sure I was running with chrome privileges.

Comment 13

[Steve Roussey (:sroussey)]

Umm, OK. But I have no idea what context that is bound to, so I don't trust it. It likely is bound to about:blank which is inside <xul:browser> which negates the problem. You are already inside the context, not reaching in from outside.

Anyhow, in Chromebug, with the browser.xul context:

win = window.document.querySelector("browser").contentWindow.wrappedJSObject;
var a = win.Object; 
var b = new a(); 
var c = b instanceof a;
c

>>> false

Comment 14

[Andreas Gal :gal]

I will try that.

Comment 15

[Steve Roussey (:sroussey)]

If:

win = window.document.querySelector("browser").contentWindow.wrappedJSObject

doesn't work, then that trick to get to chrome won't be much help.

Perhaps this and https://bugzilla.mozilla.org/show_bug.cgi?id=620486 are related?

Thanks for taking a look at it. :)

UCI Alumni here, BTW ;)

Comment 16

[Andreas Gal :gal]

Hey Steve, sorry, I will need some additional instructions here. I can't even get chromebug to open properly with beta8. Its window is all out of whack. I have the extension installed. What exactly do I do and where exactly do I have to try the test case? First time chromebug user here, so pardon my slowness.

Comment 17

[Boris Zbarsky [:bzbarsky]]

about:blank may or may not be chrome, depending on the exact way it's loaded and a few other things....

Comment 18

[Steve Roussey (:sroussey)]

No problem. You need to start Firefox with -chromebug and have firebug installed. I'm guessing you are using FF4, which means you should use SVN and not a downloaded copy of either. Sorry about that, but FF/JSD has changed a bit in the last few weeks and FB to match.

svn checkout http://fbug.googlecode.com/svn/ <mypath>\firebug-repo

Then create two text files in your <profile>/extensions folder:

[e-mail]

and 

[e-mail]

In [e-mail] put:
<mypath>\firebug-repo\branches\firebug1.7

In [e-mail] put:
<mypath>\firebug-repo\chromebug\branches\chromebug1.7

At least that way you can always have a profile to play with those tools should the need arise. Otherwise I need to figure out how to build them.

Comment 19

[Steve Roussey (:sroussey)]

Attachment: Chromebug for FF4

Comment 20

[Steve Roussey (:sroussey)]

Attachment: Firebug for FF4

Comment 21

[Steve Roussey (:sroussey)]

OK, ignore the a7 version #s of both, but those two files should work. They *might* even update correctly when a8 does come out.

Assuming you got them installed either via SVN checkout or via the attachments, then open Firefox with -chomebug. For me I do this:

"C:\Program Files (x86)\Minefield\firefox.exe" -chromebug -purgecaches

Then in Chromebug I think there is a first run text you should get rid of, then click on the Console tab panel. browser.xul I think is selected by default.

Comment 22

[Andreas Gal :gal]

I tried it. Same here. win.Object is undefined, thats why instanceof fails. Can you confirm that?

Comment 23

[Steve Roussey (:sroussey)]

>>> win.Object
Object()

No failure for me.

Comment 24

[Andreas Gal :gal]

Ok then I am still doing something wrong. I installed chromebug, started it, and selected one of the browser.xul contexts. What is different for my setup? And how did you get win exactly?

win = window.document.querySelector("browser").contentWindow.wrappedJSObject;

right?

Comment 25

[Steve Roussey (:sroussey)]

Attachment: Capture

Comment 26

[Steve Roussey (:sroussey)]

Attachment: Capture 2

Comment 27

[Steve Roussey (:sroussey)]

Right. Should grab the first browser object it finds. Oh. tabbrowser is the better bet.

win = window.document.querySelector("tabbrowser").contentWindow.wrappedJSObject

Comment 28

[Steve Roussey (:sroussey)]

It should show the URL of the content page...

>>> window.document.querySelector("tabbrowser").contentWindow
Window prerelease.html

What do you see for that?

Comment 29

[Andreas Gal :gal]

Attachment: capture

Sorry, its just not behaving the same way for me. Any chance you can turn this into some test case I can run without firebug/chromebug? Some standalone xpi? Anything, really.

Comment 30

[Andreas Gal :gal]

Ok, tabbrowser might have worked. Trying with that.

Comment 31

[Andreas Gal :gal]

Ok I think I can reproduce this now.

Comment 32

[Steve Roussey (:sroussey)]

win = window.document.querySelector("tabbrowser").contentWindow.wrappedJSObject;
var a = win.Object; 
var b = new a(); 
var c = b instanceof a;
console.log(c); // this bug
console.log(win.Object == win.Object); // other bug

Comment 33

[Steve Roussey (:sroussey)]

Awesome!

Comment 34

[John J. Barton]

I think you might like to look at Bug 620486, since I guess it is possible that instanceof does some checks through wrappers and expects the equality tests to be accurate.

Comment 35

[John J. Barton]

(In reply to comment #16)
> Hey Steve, sorry, I will need some additional instructions here. I can't even
> get chromebug to open properly with beta8. Its window is all out of whack. I
> have the extension installed. What exactly do I do and where exactly do I have
> to try the test case? First time chromebug user here, so pardon my slowness.

It's not you: none of FF4.0b7 or b8 will work. b9pre tracemonkey is the first one that behaves, trunk perhaps if some of tracemonkey has been merged (we don't know).

Comment 36

[Andreas Gal :gal]

I am using TM trunk. Thanks for helping out with hunting this down. We will do our best to get this fixed asap.

Comment 37

[Andreas Gal :gal]

jjb, you were right. This is a dup of the win.Object != win.Object bug. We walk the proto chain and compare whether any of the objects along the chain matches the left hand side of the instanceof, but since we don't properly maintain identity, that match doesn't succeed. So back to fixing the other bug, and with that this one should go away. I will dup as soon we have proof for my theory.

Comment 38

[Steve Roussey (:sroussey)]

Hopefully that is true... which is why I put:

console.log(win.Object == win.Object); // other bug

in comment #32.

However.... this bug is also in Firefox 3.6, while the other is not.

Comment 39

[Steve Roussey (:sroussey)]

BTW: I added my own instanceof to Firebug that does the proto chain walking itself rather than rely on the one in the language itself. That worked for 3.6. But because of the other bug, it does not work for 4.0. And that was the backup plan until this got fixed. 

I think the other one is more important though. And maybe this one will fix itself once the other is fixed. But I would not close it as a duplicate just yet, considering the problem is also in 3.6, and there is no test that passes yet.

If you want to test Fx3.6, you can install Firebug and Chromebug in another profile as described in comment #18, but change the paths in the text files to end in 1.6 instead of 1.7.

Comment 40

[Andreas Gal :gal]

We fixed this in the patch for bug 620486.