Last Comment Bug 597872 - instanceof fails on unwrapped objects
: instanceof fails on unwrapped objects
Status: RESOLVED DUPLICATE of bug 620486
: regression
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- normal (vote)
: ---
Assigned To: Andreas Gal :gal
: Jason Orendorff [:jorendorff]
Depends on:
  Show dependency treegraph
Reported: 2010-09-19 10:34 PDT by Steve Roussey (:sroussey)
Modified: 2011-01-13 13:06 PST (History)
11 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

Chromebug for FF4 (621.17 KB, application/octet-stream)
2011-01-12 18:40 PST, Steve Roussey (:sroussey)
no flags Details
Firebug for FF4 (1.18 MB, application/octet-stream)
2011-01-12 18:42 PST, Steve Roussey (:sroussey)
no flags Details
Capture (62.21 KB, image/png)
2011-01-12 18:54 PST, Steve Roussey (:sroussey)
no flags Details
Capture 2 (109.07 KB, image/png)
2011-01-12 18:58 PST, Steve Roussey (:sroussey)
no flags Details
capture (98.03 KB, image/tiff)
2011-01-12 19:09 PST, Andreas Gal :gal
no flags Details

Description Steve Roussey (:sroussey) 2010-09-19 10:34:12 PDT
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.8 Safari/534.7
Build Identifier: 

Say in an extension I have window variable. To get the user's view of 

var win = window.wrappedJSObject; 

Now why does this not work most* of the time: 

var a = win.Object; 
var b = new a(); 
var c = b instanceof a; 

Instead of working, it is throwing "invalid 'instanceof' operand"?

Reproducible: Always
Comment 1 Johnny Stenback (:jst, 2010-09-20 08:45:09 PDT
Is this a regression? Did this work in Firefox 3.6 etc?
Comment 2 Steve Roussey (:sroussey) 2010-09-20 10:59:03 PDT
Does not work on Firefox 3.6
Comment 3 Johnny Stenback (:jst, 2010-09-20 18:05:34 PDT
Ok, thanks for testing! Not blocking 2.0 on this issue then, but would most certainly consider a fix if one shows up.
Comment 4 Nochum Sossonko [:Natch] 2010-10-12 13:24:19 PDT
(In reply to comment #3)
> Ok, thanks for testing! Not blocking 2.0 on this issue then, but would most
> certainly consider a fix if one shows up.

This doesn't work in 3.6 because .wrappedJSObject is non-existent. Confirming bug and resetting blocking flag.

Using the following in the Error Console demonstrates the bug:

var win = top.opener.gBrowser.selectedBrowser.contentWindow;
var a = win.Object;
var b = new a();
b instanceof a;

3.6 returns true.

2.0 throws:

Error: a is not a constructor
Source File: javascript:%20var%20win%20=%20top.opener.gBrowser.selectedBrowser.contentWindow;%20var%20a%20=%20win.Object;%20var%20b%20=%20new%20a();%20b%20instanceof%20a;
Line: 1

If you use .wrappedJSObject on 2.0 it throws the error in comment 0.
Comment 5 Steve Roussey (:sroussey) 2010-10-13 11:20:35 PDT
Just a note: I don't know what environment the Error Console provides, so I can't speak to that. But within an extension, wrappedJSObject exists and is necessary. I am certainly all for having the issue fixed though!
Comment 6 Johnny Stenback (:jst, 2010-12-21 16:18:33 PST
*** Bug 618827 has been marked as a duplicate of this bug. ***
Comment 7 Andreas Gal :gal 2011-01-12 16:45:50 PST
var win = top.opener.gBrowser.selectedBrowser.contentWindow; var a = win.Object; alert(a) => undefined, so comment 4 is testing something else.
Comment 8 Andreas Gal :gal 2011-01-12 17:06:51 PST
I tried this in the web console and it seems to work as expected. Without a test case I will wfm this.
Comment 9 Steve Roussey (:sroussey) 2011-01-12 17:57:12 PST
OK, just curious though... what "web console" are you using to test?
Comment 10 Andreas Gal :gal 2011-01-12 17:59:43 PST
pcwalton showed me how to get hold of a contentWindow through a web console opened for about:blank (which should be chrome). Any better way to try this?
Comment 11 Steve Roussey (:sroussey) 2011-01-12 18:01:59 PST
Just that it needs to be from chrome priv code. Do you have Chromebug installed?
Comment 12 Andreas Gal :gal 2011-01-12 18:04:41 PST
No, but about:blank is chrome so the web console is chrome. I used Components.interfaces and .classes, so I am pretty sure I was running with chrome privileges.
Comment 13 Steve Roussey (:sroussey) 2011-01-12 18:12:50 PST
Umm, OK. But I have no idea what context that is bound to, so I don't trust it. It likely is bound to about:blank which is inside <xul:browser> which negates the problem. You are already inside the context, not reaching in from outside.

Anyhow, in Chromebug, with the browser.xul context:

win = window.document.querySelector("browser").contentWindow.wrappedJSObject;
var a = win.Object; 
var b = new a(); 
var c = b instanceof a;

>>> false
Comment 14 Andreas Gal :gal 2011-01-12 18:14:16 PST
I will try that.
Comment 15 Steve Roussey (:sroussey) 2011-01-12 18:18:30 PST

win = window.document.querySelector("browser").contentWindow.wrappedJSObject

doesn't work, then that trick to get to chrome won't be much help.

Perhaps this and are related?

Thanks for taking a look at it. :)

UCI Alumni here, BTW ;)
Comment 16 Andreas Gal :gal 2011-01-12 18:20:54 PST
Hey Steve, sorry, I will need some additional instructions here. I can't even get chromebug to open properly with beta8. Its window is all out of whack. I have the extension installed. What exactly do I do and where exactly do I have to try the test case? First time chromebug user here, so pardon my slowness.
Comment 17 Boris Zbarsky [:bz] (still a bit busy) 2011-01-12 18:28:02 PST
about:blank may or may not be chrome, depending on the exact way it's loaded and a few other things....
Comment 18 Steve Roussey (:sroussey) 2011-01-12 18:33:13 PST
No problem. You need to start Firefox with -chromebug and have firebug installed. I'm guessing you are using FF4, which means you should use SVN and not a downloaded copy of either. Sorry about that, but FF/JSD has changed a bit in the last few weeks and FB to match.

svn checkout <mypath>\firebug-repo

Then create two text files in your <profile>/extensions folder:


In put:

In put:

At least that way you can always have a profile to play with those tools should the need arise. Otherwise I need to figure out how to build them.
Comment 19 Steve Roussey (:sroussey) 2011-01-12 18:40:56 PST
Created attachment 503383 [details]
Chromebug for FF4
Comment 20 Steve Roussey (:sroussey) 2011-01-12 18:42:05 PST
Created attachment 503384 [details]
Firebug for FF4
Comment 21 Steve Roussey (:sroussey) 2011-01-12 18:46:14 PST
OK, ignore the a7 version #s of both, but those two files should work. They *might* even update correctly when a8 does come out.

Assuming you got them installed either via SVN checkout or via the attachments, then open Firefox with -chomebug. For me I do this:

"C:\Program Files (x86)\Minefield\firefox.exe" -chromebug -purgecaches

Then in Chromebug I think there is a first run text you should get rid of, then click on the Console tab panel. browser.xul I think is selected by default.
Comment 22 Andreas Gal :gal 2011-01-12 18:48:42 PST
I tried it. Same here. win.Object is undefined, thats why instanceof fails. Can you confirm that?
Comment 23 Steve Roussey (:sroussey) 2011-01-12 18:50:17 PST
>>> win.Object

No failure for me.
Comment 24 Andreas Gal :gal 2011-01-12 18:52:40 PST
Ok then I am still doing something wrong. I installed chromebug, started it, and selected one of the browser.xul contexts. What is different for my setup? And how did you get win exactly?

win = window.document.querySelector("browser").contentWindow.wrappedJSObject;

Comment 25 Steve Roussey (:sroussey) 2011-01-12 18:54:33 PST
Created attachment 503390 [details]
Comment 26 Steve Roussey (:sroussey) 2011-01-12 18:58:26 PST
Created attachment 503392 [details]
Capture 2
Comment 27 Steve Roussey (:sroussey) 2011-01-12 19:07:04 PST
Right. Should grab the first browser object it finds. Oh. tabbrowser is the better bet.

win = window.document.querySelector("tabbrowser").contentWindow.wrappedJSObject
Comment 28 Steve Roussey (:sroussey) 2011-01-12 19:09:25 PST
It should show the URL of the content page...

>>> window.document.querySelector("tabbrowser").contentWindow
Window prerelease.html

What do you see for that?
Comment 29 Andreas Gal :gal 2011-01-12 19:09:39 PST
Created attachment 503394 [details]

Sorry, its just not behaving the same way for me. Any chance you can turn this into some test case I can run without firebug/chromebug? Some standalone xpi? Anything, really.
Comment 30 Andreas Gal :gal 2011-01-12 19:10:42 PST
Ok, tabbrowser might have worked. Trying with that.
Comment 31 Andreas Gal :gal 2011-01-12 19:12:54 PST
Ok I think I can reproduce this now.
Comment 32 Steve Roussey (:sroussey) 2011-01-12 19:13:27 PST
win = window.document.querySelector("tabbrowser").contentWindow.wrappedJSObject;
var a = win.Object; 
var b = new a(); 
var c = b instanceof a;
console.log(c); // this bug
console.log(win.Object == win.Object); // other bug
Comment 33 Steve Roussey (:sroussey) 2011-01-12 19:14:08 PST
Comment 34 John J. Barton 2011-01-12 21:32:26 PST
I think you might like to look at Bug 620486, since I guess it is possible that instanceof does some checks through wrappers and expects the equality tests to be accurate.
Comment 35 John J. Barton 2011-01-12 21:35:40 PST
(In reply to comment #16)
> Hey Steve, sorry, I will need some additional instructions here. I can't even
> get chromebug to open properly with beta8. Its window is all out of whack. I
> have the extension installed. What exactly do I do and where exactly do I have
> to try the test case? First time chromebug user here, so pardon my slowness.

It's not you: none of FF4.0b7 or b8 will work. b9pre tracemonkey is the first one that behaves, trunk perhaps if some of tracemonkey has been merged (we don't know).
Comment 36 Andreas Gal :gal 2011-01-12 21:44:16 PST
I am using TM trunk. Thanks for helping out with hunting this down. We will do our best to get this fixed asap.
Comment 37 Andreas Gal :gal 2011-01-12 22:51:06 PST
jjb, you were right. This is a dup of the win.Object != win.Object bug. We walk the proto chain and compare whether any of the objects along the chain matches the left hand side of the instanceof, but since we don't properly maintain identity, that match doesn't succeed. So back to fixing the other bug, and with that this one should go away. I will dup as soon we have proof for my theory.
Comment 38 Steve Roussey (:sroussey) 2011-01-12 22:52:47 PST
Hopefully that is true... which is why I put:

console.log(win.Object == win.Object); // other bug

in comment #32.

However.... this bug is also in Firefox 3.6, while the other is not.
Comment 39 Steve Roussey (:sroussey) 2011-01-12 23:00:43 PST
BTW: I added my own instanceof to Firebug that does the proto chain walking itself rather than rely on the one in the language itself. That worked for 3.6. But because of the other bug, it does not work for 4.0. And that was the backup plan until this got fixed. 

I think the other one is more important though. And maybe this one will fix itself once the other is fixed. But I would not close it as a duplicate just yet, considering the problem is also in 3.6, and there is no test that passes yet.

If you want to test Fx3.6, you can install Firebug and Chromebug in another profile as described in comment #18, but change the paths in the text files to end in 1.6 instead of 1.7.
Comment 40 Andreas Gal :gal 2011-01-13 13:06:51 PST
We fixed this in the patch for bug 620486.

*** This bug has been marked as a duplicate of bug 620486 ***

Note You need to log in before you can comment on or make changes to this bug.