Note: There are a few cases of duplicates in user autocompletion which are being worked on.

instanceof fails on unwrapped objects

RESOLVED DUPLICATE of bug 620486

Status

()

Core
JavaScript Engine
RESOLVED DUPLICATE of bug 620486
7 years ago
7 years ago

People

(Reporter: sroussey, Assigned: gal)

Tracking

({regression})

Trunk
regression
Points:
---

Firefox Tracking Flags

(blocking2.0 betaN+, status2.0 wanted)

Details

(Whiteboard: [softblocker])

Attachments

(5 attachments)

(Reporter)

Description

7 years ago
User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.7 (KHTML, like Gecko) Chrome/7.0.517.8 Safari/534.7
Build Identifier: 

Say in an extension I have window variable. To get the user's view of 
it: 

var win = window.wrappedJSObject; 

Now why does this not work most* of the time: 

var a = win.Object; 
var b = new a(); 
var c = b instanceof a; 

Instead of working, it is throwing "invalid 'instanceof' operand"? 


http://groups.google.com/group/mozilla.dev.platform/browse_thread/thread/dc708c6387431221/0f0fee45103c341f

Reproducible: Always

Updated

7 years ago
blocking2.0: --- → ?
Is this a regression? Did this work in Firefox 3.6 etc?
(Reporter)

Comment 2

7 years ago
Does not work on Firefox 3.6
Ok, thanks for testing! Not blocking 2.0 on this issue then, but would most certainly consider a fix if one shows up.
blocking2.0: ? → -
status2.0: --- → wanted

Updated

7 years ago
Blocks: 599940
(In reply to comment #3)
> Ok, thanks for testing! Not blocking 2.0 on this issue then, but would most
> certainly consider a fix if one shows up.

This doesn't work in 3.6 because .wrappedJSObject is non-existent. Confirming bug and resetting blocking flag.

Using the following in the Error Console demonstrates the bug:

var win = top.opener.gBrowser.selectedBrowser.contentWindow;
var a = win.Object;
var b = new a();
b instanceof a;

3.6 returns true.

2.0 throws:

Error: a is not a constructor
Source File: javascript:%20var%20win%20=%20top.opener.gBrowser.selectedBrowser.contentWindow;%20var%20a%20=%20win.Object;%20var%20b%20=%20new%20a();%20b%20instanceof%20a;
Line: 1

If you use .wrappedJSObject on 2.0 it throws the error in comment 0.
Assignee: nobody → general
Status: UNCONFIRMED → NEW
blocking2.0: - → ?
Component: DOM → JavaScript Engine
Ever confirmed: true
OS: Windows 7 → All
QA Contact: general → general
Hardware: x86 → All
Version: unspecified → Trunk
(Reporter)

Comment 5

7 years ago
Just a note: I don't know what environment the Error Console provides, so I can't speak to that. But within an extension, wrappedJSObject exists and is necessary. I am certainly all for having the issue fixed though!

Updated

7 years ago
blocking2.0: ? → betaN+

Updated

7 years ago
No longer blocks: 599940

Updated

7 years ago
Keywords: regression
QA Contact: general → mrbkap

Updated

7 years ago
Assignee: general → mrbkap
QA Contact: mrbkap → general

Updated

7 years ago
Duplicate of this bug: 618827
Whiteboard: softblocker

Updated

7 years ago
Whiteboard: softblocker → [softblocker]

Updated

7 years ago
Assignee: mrbkap → gal
(Assignee)

Comment 7

7 years ago
var win = top.opener.gBrowser.selectedBrowser.contentWindow; var a = win.Object; alert(a) => undefined, so comment 4 is testing something else.
(Assignee)

Comment 8

7 years ago
I tried this in the web console and it seems to work as expected. Without a test case I will wfm this.
(Reporter)

Comment 9

7 years ago
OK, just curious though... what "web console" are you using to test?
(Assignee)

Comment 10

7 years ago
pcwalton showed me how to get hold of a contentWindow through a web console opened for about:blank (which should be chrome). Any better way to try this?
(Reporter)

Comment 11

7 years ago
Just that it needs to be from chrome priv code. Do you have Chromebug installed?
(Assignee)

Comment 12

7 years ago
No, but about:blank is chrome so the web console is chrome. I used Components.interfaces and .classes, so I am pretty sure I was running with chrome privileges.
(Reporter)

Comment 13

7 years ago
Umm, OK. But I have no idea what context that is bound to, so I don't trust it. It likely is bound to about:blank which is inside <xul:browser> which negates the problem. You are already inside the context, not reaching in from outside.

Anyhow, in Chromebug, with the browser.xul context:

win = window.document.querySelector("browser").contentWindow.wrappedJSObject;
var a = win.Object; 
var b = new a(); 
var c = b instanceof a;
c

>>> false
(Assignee)

Comment 14

7 years ago
I will try that.
(Reporter)

Comment 15

7 years ago
If:

win = window.document.querySelector("browser").contentWindow.wrappedJSObject

doesn't work, then that trick to get to chrome won't be much help.

Perhaps this and https://bugzilla.mozilla.org/show_bug.cgi?id=620486 are related?

Thanks for taking a look at it. :)

UCI Alumni here, BTW ;)
(Assignee)

Comment 16

7 years ago
Hey Steve, sorry, I will need some additional instructions here. I can't even get chromebug to open properly with beta8. Its window is all out of whack. I have the extension installed. What exactly do I do and where exactly do I have to try the test case? First time chromebug user here, so pardon my slowness.

Comment 17

7 years ago
about:blank may or may not be chrome, depending on the exact way it's loaded and a few other things....
(Reporter)

Comment 18

7 years ago
No problem. You need to start Firefox with -chromebug and have firebug installed. I'm guessing you are using FF4, which means you should use SVN and not a downloaded copy of either. Sorry about that, but FF/JSD has changed a bit in the last few weeks and FB to match.

svn checkout http://fbug.googlecode.com/svn/ <mypath>\firebug-repo

Then create two text files in your <profile>/extensions folder:

firebug@software.joehewitt.com

and 

chromebug@johnjbarton.com

In firebug@software.joehewitt.com put:
<mypath>\firebug-repo\branches\firebug1.7

In chromebug@johnjbarton.com put:
<mypath>\firebug-repo\chromebug\branches\chromebug1.7

At least that way you can always have a profile to play with those tools should the need arise. Otherwise I need to figure out how to build them.
(Reporter)

Comment 19

7 years ago
Created attachment 503383 [details]
Chromebug for FF4
(Reporter)

Comment 20

7 years ago
Created attachment 503384 [details]
Firebug for FF4
(Reporter)

Comment 21

7 years ago
OK, ignore the a7 version #s of both, but those two files should work. They *might* even update correctly when a8 does come out.

Assuming you got them installed either via SVN checkout or via the attachments, then open Firefox with -chomebug. For me I do this:

"C:\Program Files (x86)\Minefield\firefox.exe" -chromebug -purgecaches

Then in Chromebug I think there is a first run text you should get rid of, then click on the Console tab panel. browser.xul I think is selected by default.
(Assignee)

Comment 22

7 years ago
I tried it. Same here. win.Object is undefined, thats why instanceof fails. Can you confirm that?
(Reporter)

Comment 23

7 years ago
>>> win.Object
Object()

No failure for me.
(Assignee)

Comment 24

7 years ago
Ok then I am still doing something wrong. I installed chromebug, started it, and selected one of the browser.xul contexts. What is different for my setup? And how did you get win exactly?

win = window.document.querySelector("browser").contentWindow.wrappedJSObject;

right?
(Reporter)

Comment 25

7 years ago
Created attachment 503390 [details]
Capture
(Reporter)

Comment 26

7 years ago
Created attachment 503392 [details]
Capture 2
(Reporter)

Comment 27

7 years ago
Right. Should grab the first browser object it finds. Oh. tabbrowser is the better bet.

win = window.document.querySelector("tabbrowser").contentWindow.wrappedJSObject
(Reporter)

Comment 28

7 years ago
It should show the URL of the content page...

>>> window.document.querySelector("tabbrowser").contentWindow
Window prerelease.html

What do you see for that?
(Assignee)

Comment 29

7 years ago
Created attachment 503394 [details]
capture

Sorry, its just not behaving the same way for me. Any chance you can turn this into some test case I can run without firebug/chromebug? Some standalone xpi? Anything, really.
(Assignee)

Comment 30

7 years ago
Ok, tabbrowser might have worked. Trying with that.
(Assignee)

Comment 31

7 years ago
Ok I think I can reproduce this now.
(Reporter)

Comment 32

7 years ago
win = window.document.querySelector("tabbrowser").contentWindow.wrappedJSObject;
var a = win.Object; 
var b = new a(); 
var c = b instanceof a;
console.log(c); // this bug
console.log(win.Object == win.Object); // other bug
(Reporter)

Comment 33

7 years ago
Awesome!

Comment 34

7 years ago
I think you might like to look at Bug 620486, since I guess it is possible that instanceof does some checks through wrappers and expects the equality tests to be accurate.

Comment 35

7 years ago
(In reply to comment #16)
> Hey Steve, sorry, I will need some additional instructions here. I can't even
> get chromebug to open properly with beta8. Its window is all out of whack. I
> have the extension installed. What exactly do I do and where exactly do I have
> to try the test case? First time chromebug user here, so pardon my slowness.

It's not you: none of FF4.0b7 or b8 will work. b9pre tracemonkey is the first one that behaves, trunk perhaps if some of tracemonkey has been merged (we don't know).
(Assignee)

Comment 36

7 years ago
I am using TM trunk. Thanks for helping out with hunting this down. We will do our best to get this fixed asap.
(Assignee)

Comment 37

7 years ago
jjb, you were right. This is a dup of the win.Object != win.Object bug. We walk the proto chain and compare whether any of the objects along the chain matches the left hand side of the instanceof, but since we don't properly maintain identity, that match doesn't succeed. So back to fixing the other bug, and with that this one should go away. I will dup as soon we have proof for my theory.
(Reporter)

Comment 38

7 years ago
Hopefully that is true... which is why I put:

console.log(win.Object == win.Object); // other bug

in comment #32.

However.... this bug is also in Firefox 3.6, while the other is not.
(Reporter)

Comment 39

7 years ago
BTW: I added my own instanceof to Firebug that does the proto chain walking itself rather than rely on the one in the language itself. That worked for 3.6. But because of the other bug, it does not work for 4.0. And that was the backup plan until this got fixed. 

I think the other one is more important though. And maybe this one will fix itself once the other is fixed. But I would not close it as a duplicate just yet, considering the problem is also in 3.6, and there is no test that passes yet.

If you want to test Fx3.6, you can install Firebug and Chromebug in another profile as described in comment #18, but change the paths in the text files to end in 1.6 instead of 1.7.
(Assignee)

Comment 40

7 years ago
We fixed this in the patch for bug 620486.
Status: NEW → RESOLVED
Last Resolved: 7 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 620486
You need to log in before you can comment on or make changes to this bug.