Function.prototype[Symbol.hasInstance] fix

Fix Function.prototype[Symbol.hasInstance] so that it properly checks if the property is an object in all cases.

Co-authored-by: andrea.bergia <andrea.bergia@servicenow.com>

Author: balajirrao

rhino/src/main/java/org/mozilla/javascript/BaseFunction.java

@@ -405,8 +405,7 @@ public Object execIdCall(
                                 ((NativeFunction) ((BoundFunction) thisObj).getTargetFunction())
                                         .getPrototypeProperty();
                     else protoProp = ScriptableObject.getProperty(thisObj, "prototype");
-                    if (protoProp instanceof NativeObject
-                            || protoProp instanceof IdScriptableObject) {
+                    if (ScriptRuntime.isObject(protoProp)) {
                         return ScriptRuntime.jsDelegatesTo(obj, (Scriptable) protoProp);
                     }
                     throw ScriptRuntime.typeErrorById(

rhino/src/main/resources/org/mozilla/javascript/resources/Messages.properties

@@ -684,7 +684,7 @@ msg.instanceof.not.object = \
     Can''t use ''instanceof'' on a non-object.
 
 msg.instanceof.bad.prototype = \
-    ''prototype'' property of {0} is not an object.
+    ''prototype'' property of ''{0}'' is not an object.
 
 msg.in.not.object = \
     Can''t use ''in'' on a non-object.

rhino/src/test/java/org/mozilla/javascript/FunctionPrototypeSymbolHasInstanceTest.java

@@ -1,6 +1,5 @@
 package org.mozilla.javascript;
 
-import org.junit.Ignore;
 import org.junit.Test;
 import org.mozilla.javascript.testutils.Utils;
 
@@ -58,7 +57,6 @@ public void testFunctionPrototypeSymbolHasInstanceHasAttributesStrictMode() {
     }
 
     @Test
-    @Ignore("name-length-params-prototype-set-incorrectly")
     public void testFunctionPrototypeSymbolHasInstanceHasProperties() {
         String script =
                 "var a = Object.getOwnPropertyDescriptor(Function.prototype[Symbol.hasInstance], 'length');\n"
@@ -147,6 +145,56 @@ public void testThrowTypeErrorOnNonObjectIncludingSymbol() {
                         + "f.prototype = Symbol(); \n"
                         + "f[Symbol.hasInstance]({})";
         Utils.assertEcmaErrorES6(
-                "TypeError: 'prototype' property of  is not an object. (test#3)", script);
+                "TypeError: 'prototype' property of '' is not an object. (test#3)", script);
+    }
+
+    @Test
+    public void testFunctionPrototypeSymbolHasInstanceStringProto() {
+        String script =
+                "var f = function() {}; \n"
+                        + "f.prototype = new String(); \n"
+                        + "f[Symbol.hasInstance]({})";
+
+        Utils.assertWithAllModes(false, script);
+    }
+
+    @Test
+    public void testFunctionPrototypeSymbolHasInstanceBooleanProto() {
+        String script =
+                "var f = function() {}; \n"
+                        + "f.prototype = new Boolean(); \n"
+                        + "f[Symbol.hasInstance]({})";
+
+        Utils.assertWithAllModes(false, script);
+    }
+
+    @Test
+    public void testFunctionPrototypeSymbolHasInstanceArrayProto() {
+        String script =
+                "var f = function() {}; \n"
+                        + "f.prototype = new Array(); \n"
+                        + "f[Symbol.hasInstance]({})";
+
+        Utils.assertWithAllModes(false, script);
+    }
+
+    @Test
+    public void testFunctionPrototypeSymbolHasInstanceNumberProto() {
+        String script =
+                "var f = function() {}; \n"
+                        + "f.prototype = new Number(); \n"
+                        + "f[Symbol.hasInstance]({})";
+
+        Utils.assertWithAllModes(false, script);
+    }
+
+    @Test
+    public void testFunctionPrototypeSymbolHasInstanceFunctionProto() {
+        String script =
+                "var f = function() {}; \n"
+                        + "f.prototype = function() {}\n"
+                        + "f[Symbol.hasInstance]({})";
+
+        Utils.assertWithAllModes(false, script);
     }
 }