Ask each bound target for its own Symbol.hasInstance in instanceof

[lahma]

Defect

instanceof with a bound function on the right skipped OrdinaryHasInstance step 2, which is ? InstanceofOperator(O, BC) for the bound function's [[BoundTargetFunction]] BC. InstanceofOperator does GetMethod(BC, @@hasInstance) and calls whatever it finds; only when nothing is found does it check IsCallable and run OrdinaryHasInstance(BC, O). BindFunction.OrdinaryHasInstance walked straight to the innermost non-bound target and ran OrdinaryHasInstance on it instead, so:

• a bound target's own @@hasInstance was never called. That covers a class with a static [Symbol.hasInstance], bound once, and a link in the middle of a chain given one with defineProperty. ({}) instanceof b1.bind(null) where b1 answers true gave false;
• a proxy target was refused. ({}) instanceof new Proxy(function(){}, {}).bind(null) threw TypeError: Right-hand side of 'instanceof' is not callable where the spec gives false;
• no link's @@hasInstance lookup could be observed, whether through a getter or a proxy get trap.

test262 has one bound-function case, built-ins/Function/prototype/Symbol.hasInstance/this-val-bound-target.js. It binds a plain function once and never gives the target a method of its own. That is the one shape where the shortcut and the spec agree, which is why the conformance suite never caught this.

Fix

The chain is still walked in a loop, not recursed over. That is what #4165 did for IsConstructor and GetFunctionRealm, and it keeps a 200,000-link chain from ending the process. At each link the loop now does InstanceofOperator step by step:

• GetMethod(BC, @@hasInstance) runs for every link, in the spec's order.
• If that finds %Function.prototype[@@hasInstance]% (any realm's), the loop takes the next step itself instead of calling it. That intrinsic only does OrdinaryHasInstance(this, V). FunctionPrototype.IsHasInstanceFunction spots it by identity. It reads the property once and caches it, and the property is non-writable and non-configurable, so the cached value can never go stale.
• Any other method is called with BC as this, and its result goes through ToBoolean. A native stack probe sits in front of that call, because this is where script can re-enter. On the MaxExecutionStackCount lane, script functions do not probe for themselves, and with the probe removed the new lane test ends the test host with Stack overflow. in BindFunction.OrdinaryHasInstance → JsValue.InstanceofOperator → BindFunction.OrdinaryHasInstance.
• If nothing is found, IsCallable is checked, and then the loop goes on to the next link, or ends with OrdinaryHasInstance once the target is no longer bound.

The ordinary (non-bound) instanceof path is unchanged: JsValue.InstanceofOperator, FunctionPrototype.HasInstance and JsValue.OrdinaryHasInstance are untouched. Only instanceof against a bound function does more work than before: one GetMethod and one identity check per link, which the spec requires.

A bound CLR TypeReference now answers through its own @@hasInstance, like the unbound one already did. Before, it used the narrower TypeReference.OrdinaryHasInstance.

Tests

Jint.Tests/Runtime/FunctionTests.cs: four new tests. All four fail on unfixed main:

Test	Unfixed	Fixed
InstanceofThroughABoundFunctionAsksItsTargetForItsOwnHasInstance	false,false,false,false,not called	true,true,false,true,true,true,1
InstanceofThroughABoundProxyAsksTheProxy	JavaScriptException: Right-hand side of 'instanceof' is not callable	false,true,true,Symbol.hasInstance|prototype,TypeError
InstanceofThroughABoundChainReadsEveryLinksHasInstanceInOrder	2:true	2,1,0:true
InstanceofWalksADeepBoundChainOverAnotherRealmsFunctionToAMethodAtTheBottom (200,000 links, 1 MB thread)	true,false,true	true,true,false

The expected strings match Node 24. The cross-realm deep test also covers the intrinsic check. With the check disabled, it fails with RangeError: Maximum call stack size exceeded.

Jint.Tests.PublicInterface/BoundFunctionChainWalkTests.cs covers depth:

• InstanceofOverADeepChainOfLinksWithTheirOwnHasInstanceRaisesACatchableError, on the default lane and on the MaxExecutionStackCount lane. Unfixed, both return "false" and fail. Fixed, both raise a catchable RangeError: Maximum call stack size exceeded and the engine still evaluates afterwards.
• InstanceofOverADeepBoundChainAnswers, with the guard on and off. This is a no-regression pin, so it also passes unfixed: 200,000 links answer true,false without recursing.

RunRoutes now takes an Action<Options>, so the lane can be configured.

Verification

Base: upstream/main at b630bf4.

All in Release, on this exact tree:

Suite	Total	Passed	Skipped	Failed
Jint.Tests, net10.0	12,708	12,703	5	0
Jint.Tests, net472	8,756	8,750	6	0
Jint.Tests.PublicInterface, net10.0	3,802	3,781	21	0
Jint.Tests.PublicInterface, net472	3,009	2,988	21	0
Jint.Tests.Test262 (full), net10.0	102,740	102,637	103	0

No benchmark was run. The change only reaches instanceof whose right-hand side is a bound function.

🤖 Generated with Claude Code