primitive boxing in instanceof due to Symbol.hasInstance

Bradley Meck bradley.meck at
Tue Jun 16 04:21:20 UTC 2015

On the surface `O instanceof C` boxes `C`, but when using `GetMethod` O
turns O into an Object. This means `instanceof` is temporarily turning O
into an Object.

For primitives, all the operators in JS have been unable to be altered
until this was pointed out. `1 instanceof C` is able to be changed by
mutating %NumberPrototype% , `"" instanceof C` by mutating
%StringPrototype% , etc.

Compared to other operators this is new and a bit surprising that primitive
behaviors are mutable.

I would expect this behavior by boxing primitives via `Object(primitive)
instanceof C` but not for primitives.

On Mon, Jun 15, 2015 at 8:43 PM, Allen Wirfs-Brock <allen at>

> On Jun 15, 2015, at 10:06 AM, Bradley Meck wrote:
> Kyle Simpson caused the discovery of this oddity :
> calls GetMethod on C without checking if it is an Object, this means `1
> instanceof Foo` could be affected by mutating
> `Number.prototype[Symbol.hasInstance]`.
> I am assuming this is unintended?
> No, it is exactly as intended:
> GetMethod users GetV
> which
> handles accessing properties for primitives. For primitive values, it uses
> the built-in wrapper prototype to lookup properties, but it does not
> actually create a boxed primitive value.
> `this` object boxing is a characteristic of the callee, not the caller.
> Non-srict functions box primitive `this values` that are passed to them,
> strict mode functions do not.
> This is all the standard method invocation behavior, and the `instanceof`
> operator just does a normal method invocation if it finds a
>  `Symbol.hasInstance` method.  Because Function.prototype implements
> `Symbol.hasInstacce` all function haves the default legacy behavior when
> appearing right-side operand of `instanceof`
> But `instanceof` does not depend upon the existence of a  a
>  `Symbol.hasInstance` method.  It falls back to performing the default
>  (legacy) instanceof check if a callable `hasInstance` property value is
> not found.
> But, back to the original question:  Exactly what do you expect to be
>  boxed for `1 instance of Foo`?  The `C` that GetMethod is applied to is
> `Foo` which would normally be a constructor or some other "type-like"
> object implements.  It could be a primitive numeric value (eg, `5
> instanceof 4`) which will cause the fallback to be taken using
> Number.prototype has a `Symbol.hasInstance` callable property.  But, even
> if it does why would you expect anything to box?
> Allen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the es-discuss mailing list