Bug 49606 - instanceof should only get the prototype property if the RHS operand implements HasInstance
Summary: instanceof should only get the prototype property if the RHS operand implemen...
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Gavin Barraclough
Depends on:
Reported: 2010-11-16 11:14 PST by Gavin Barraclough
Modified: 2010-11-16 13:12 PST (History)
0 users

See Also:

the patch (47.75 KB, patch)
2010-11-16 12:18 PST, Gavin Barraclough
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Gavin Barraclough 2010-11-16 11:14:09 PST
test case: javascript: ({} instanceof { get prototype(){ alert("Error!"); } })

The bug here is that we read the prototype from the RHS argument using a regular op_get_by_id before op_instanceof has checked that this is an object implementing HasInstance.  This incorrect behaviour gives rise to further unnecessary complexity in the code base, since we have additional logic (implemented using the GetByIdExceptionInfo data structures on CodeBlock) to convert not an object errors from the get_by_id into invalid parameter errors.  Having fixed this bug this code is all redundant, since in these cases the get_by_id will never have been reached.  (op_construct had a similar error, but this is fixed since we moved this object creation to inside the constructor function.)
Comment 1 Gavin Barraclough 2010-11-16 12:18:17 PST
Created attachment 74020 [details]
the patch
Comment 2 Gavin Barraclough 2010-11-16 13:12:02 PST
fixed in r72127