instanceof within a sandbox

[Jan Honza Odvarko]

I am facing a problem when using instanceof operator within a sandbox,
see the following example:

var Cu = Components.utils;
var script = "function(obj) { return obj instanceof Window; }";
var sandbox = new Cu.Sandbox(window, {sandboxPrototype: window});
var func = Cu.evalInSandbox(script, sandbox, "1.8", "Test", 1);
var res = func({});
res;

The code should return false, but I am seeing true. Why?

(you can directly execute the snippet in ConsoleError)

Honza

[Jan Honza Odvarko]

I made some further testing of this issue.

First here is a better example that uses both operands for
'instanceof' from the same context.

var Cu = Components.utils;
var sandbox = new Cu.Sandbox(window);
var script = "function (obj, type) { return obj instanceof type; }";
var instanceOf = Cu.evalInSandbox(script, sandbox, "1.8", "Test", 1);
instanceOf({}, Window);

I have evaluated this code in Error Console (Tools -> Error Console)
command line.
(just to note that changing wantXrays doesn't make any difference)

Firefox 3.6 returns false
Firefox 4.0 returns true
Firefox 5.0 (Aurora) returns true

So, only Firefox 3.6 works as expected.

I believe this is a bug introduced in Firefox 4.

Could anybody please confirm that this is bug and not a feature?

Honza

[Jan Honza Odvarko]

Reported here:
https://bugzilla.mozilla.org/show_bug.cgi?id=654370

Honza