[Webkit-unassigned] [Bug 27169] typing "document.__proto__" in inspector throws exception

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=27169


Keishi Hattori <casey.hattori at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |casey.hattori at gmail.com




--- Comment #3 from Keishi Hattori <casey.hattori at gmail.com>  2009-07-23 04:54:27 PDT ---
(In reply to comment #2)
> This would be the javascript workaround.  I looked into what Firefox does and
> they don't report document.__proto__ as an instanceof Node!  So maybe that
> would be the better route.

Opera returns false too.

But I can't figure out why.

>From my understanding, the implementation of
    FOO instanceof BAR
should be something like this
function instanceof(FOO, BAR) {
    var o = FOO;
    while (o = o.__proto__) {
        if (o === BAR.prototype)
            return true;
    }
    return false;
}
And I think this is written in JSObject::hasInstance which implements
[[hasInstance]] from the spec.

WebCore's prototype chain looks like this
document.__proto__ = HTMLDocumentPrototype
document.__proto__. __proto__ = DocumentPrototype
document.__proto__. __proto__. __proto__ = NodePrototype
document.__proto__. __proto__. __proto__.__proto__ = Object

And 
(Node.prototype === document.__proto__. __proto__. __proto__) is true

So (document.__proto__ instanceof window.Node) returns true.

In Firefox (Node.prototype === document.__proto__. __proto__. __proto__) is
also true so I don't understand why Firefox is returning false for
(document.__proto__ instanceof window.Node).

Which is correct?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.