The JScript Type System, Part Two: Prototypes and constructors

The JScript Type System, Part Two: Prototypes and constructors

Rate This
  • Comments 16

A number of readers made some good comments on my article on JScript typing that deserve to be called out in more detail.


First, I was being a little sloppy in my terminology -- I casually conflated static typing with strong typing, and dynamic typing with weak typing.  Thanks for calling me on that.  Under the definitions proposed by the reader, JScript would be a dynamically typed language (because every variable can take a value of any type) and a strongly typed language (because every object knows what type it is.)  By contrast, C++ is a statically typed language (because every variable must have a type, which the compiler enforces) but also a weakly typed language (because the reinterpret cast allows one to turn pointers into integers, and so on.)


Second, a reader notes that one of the shortcomings of JScript is that though it is a strongly typed language (in our new sense) that it is a royal pain to actually determine the runtime type an object.  The typeof operator has a number of problems:


* null is listed as being of the object type, though technically it is a member of the Null type.

* primitives (strings, numbers, Booleans) wrapped in objects are listed as being of the object type rather than their underlying type.

* JScript, unlike VBScript, does not interrogate COM objects to determine the class name.

* If JScript is passed a variant from the outside world that it cannot make sense of then typeof returns "unknown".


Perhaps there is some other way.  Prototype inheritance affords a kind of type checking, for example.


Prototype inheritance works like this.  Every JScript object has an object (or possibly null) called its prototype object.  So suppose an object foo has prototype object bar, and bar has prototype object baz, and baz has prototype object null.  If you call a method on foo then JScript will search foo, bar and baz for that method, and call the first one it finds.  The idea is that one object is a prototypical object, and then other objects specialize it.  This allows for code re-use without losing the ability to dynamically customize behaviour of individual objects.


Prototypes are usually done something like this:


var Animal = new Object();

// omitted: set up Animal object

function Giraffe(){

// omitted: initialize giraffe object.


Giraffe.prototype = Animal;

var Jerry = new Giraffe();


Now Jerry has all the properties and methods of an individual Giraffe object AND all the properties and methods of Animal.  You can use IsPrototypeOf to see if a given object has Animal on its prototype chain.  Since prototype chains are immutable once created, this gives you a pretty reliable sort of type checking. 


Note that Giraffe is not a prototype of Jerry.  Note also that Animal is not the prototype of Giraffe!  The object which is assigned to the prototype property of the constructor is the prototype of the instance.


Now, you guys are not the first people to point out to me that determining types is tricky.  A few years ago someone asked me what the differences are amongst


if (func.prototype.IsPrototypeOf(instance))




if (instance.constructor == func)




if (instance instanceof func)


The obvious difference is that the first one looks at the whole prototype chain, whereas the second two look at the constructor, right? Or is that true?  Is there a semantic difference between the last two?  Actually, there is. Let's look at some examples, starting with one that seems to show that there is no difference:


function Car(){}

var honda = new Car();

print(honda instanceof Car); // true

print(honda.constructor == Car);  // true


It appears that instance instanceof func and instance.constructor == func have the same semantics.   They do not.  Here's a more complicated example that demonstrates the difference:


var Animal = new Object();

function Reptile(){ }

Reptile.prototype = Animal;

var lizard = new Reptile();

print(lizard instanceof Reptile); // true

print(lizard.constructor == Reptile); // false


In fact lizard.constructor is equal to Object, not Reptile.


Let me repeat what I said above, because no one understands this the first time -- I didn't, and I've found plenty of Javascript books that get it wrong.  When we say


Reptile.prototype = Animal;


this does NOT mean "the prototype of Reptile is Animal".  It cannot mean that because (obviously!) the prototype of Reptile, a function object, is Function.prototype.  No, this means "the prototype of any instance of Reptile is Animal".  There is no way to directly manipulate or read the prototype chain of an existing object.


Now that we've got that out of the way, the simple one first:


instance instanceof func means "is the prototype property of func equal to any object on instance's prototype chain?"  So in our second example, the prototype property of Reptile is Animal and Animal is on lizard's prototype chain. 


But what about our first example where there was no explicit assignment to the Car prototype?


The compiler creates a function object called "Car".  It also creates a default prototype object and assigns it to Car.prototype.  So again, when we way


print(honda instanceof Car);


the instanceof operator gets the prototype property (Car.prototype) and compares it to the prototype chain of honda.  Since honda was constructed by Car it gets Car.prototype on its prototype chain.


To sum up the story so far,  instance instanceof func is actually a syntactic sugar for func.prototype.IsPrototypeOf(instance) This explains why lizard instanceof Reptile returns true -- Reptile.prototype is a prototype of lizard.


So what the heck is going on with the constructor property then?  How is it possible that we can say lizard = new Reptile(); and at the same time lizard.constructor == Reptile is false???


Well, let’s go back to our simple first example.  I said above that since Car has no prototype assigned to it, we create a default prototype.  During the creation of the default prototype, the interpreter assigns Car to Car.prototype.constructor.  That might be a little confusing, so let's look at some pseudocode.  This:


function Car(){}


logically does the same thing as


var Car = new Function();

Car.prototype = new Object();

Car.prototype.constructor = Car;


Now we say


var honda = new Car();

print(honda.constructor == Car );


and what happens?  honda has no constructor property, so it looks on the prototype chain for any object with a constructor property.  In this case Car.prototype is on the prototype chain and it has a constructor property equal to Car, so the comparison is true.  Remember, any property of an object's prototype object is treated as a property of the object itself – that's what "prototype" means.


But now let's look at our second example:


var Animal = new Object();

function Reptile(){ }

Reptile.prototype = Animal;


Logically this does the same thing as


var Animal = new Object();

var Reptile = new Function();

Reptile.prototype = new Object();

Reptile.prototype.constructor = Reptile;

Reptile.prototype = Animal;


Whoops.  The default prototype has been thrown away.  Now when we say


print(lizard.constructor == Reptile );


what happens?  lizard does not have a constructor property, so we look at the prototype chain and find Animal.  But Animal also does not have a constructor property either!  So we look on Animal's prototype chain.  Animal was constructed via "new Object" so therefore it has Object.prototype on its prototype chain, and Object.prototype has a constructor property.  As you might expect from our previous discussion of how the constructor property is initialized, Object.prototype.constructor is set to Object.


Therefore lizard.constructor is equal to Object, not Reptile, even though lizard is an instance of Reptile and was constructed by the Reptile function object!


You would think that the script engine would automatically assign the constructor property to the object when it was constructed, but it does not. It assigns the property to the prototype and relies on prototype inheritance.  I was not a member of the ECMAScript committee when this decision was made, so I don't know why we standardized this rather bizarre behaviour, but we're stuck with it now!


  • Just a side note. The prototype object is usually called __proto__ ( [[Protoype]] in the spec) and almost all ECMAScript engines (except the Microsoft ones) allows read write of this private property.
  • Can you explain the logic behind the following madness (in JScript Classic), which appears to mean that a string is not always a String but a regexp is always a RegExp? Conversly, what is the recommended way of determining if a value is a string? slit instanceof String => false sobj instanceof String => true slit instanceof Object => false sobj instanceof Object => true typeof( slit ) => string typeof( sobj ) => object typeof( slit ) == typeof( sobj ) => false relit instanceof RegExp => true reobj instanceof RegExp => true relit instanceof Object => true reobj instanceof Object => true typeof( relit ) => object typeof( reobj ) => object typeof( relit ) == typeof( reobj ) => true As generated by: function println(s) { WScript.echo(s) /*System.Console.Out.WriteLine(s)*/ } function evalprintln( s ) { if( !s ) { println(""); return } var out = s + " => "; try{ out += eval(s) } catch( e ) { out += "Error: " + e.description } println(out); } var slit = "Literal String"; var sobj = new String( "String object" ); var relit = /literal regexp/i var reobj = new RegExp( "RegExp object" ); var tests = [ "slit instanceof String", "sobj instanceof String", "slit instanceof Object", "sobj instanceof Object", "typeof( slit )", "typeof( sobj )", "typeof( slit ) == typeof( sobj )", null, "relit instanceof RegExp", "reobj instanceof RegExp", "relit instanceof Object", "reobj instanceof Object", "typeof( relit )", "typeof( reobj )", "typeof( relit ) == typeof( reobj )" ]; for( var ix in tests ) { evalprintln( tests[ix] ) }
  • Erik -- IIRC, Netscape removed the support for __proto__ from their engine some years ago because it was a bad idea to let people mess with the prototype chain this way. The ECMA standard does not require the property to be exposed, and it is dangerous to do so.
  • Jay, if you read the ECMA spec you will see that there are string primitives and string objects, just as there are number/boolean primitives and number/boolean objects. Basically you should never use "new String(...)" because it is a waste of time and energy. var nlit = 42 var nobj = new Number(42) print(nlit instanceof Number) print(nlit instanceof Object) print(nobj instanceof Number) print(nobj instanceof Object)
  • >JScript, unlike VBScript, does not interrogate COM objects to determine >the class name. This gets the award for the most unrelated error message: TypeName(myObject) throws, when the type information is unavailable: Out Of string space: 'TypeName'
  • Can I see a repro for that? If the type name is unavailable, it should return "Unknown" or, if it is an IDispatch, "Object". TypeName does return "Out of string space", but only when the attempt to allocate the string for the type name fails.
  • Peter: I know both the Mozilla engines (C and Java) and the Macromedia engine has support for this. I was pretty sure that Opera supported this as well but I just verifed that they do not. I can understand why it is considered dangerous but usage of __proto__ can be very useful. For example it allows you to skip creating an instance that is used as the prototype. fucntion SubClass( args ) { args ); } SubClass.prototype.__proto__ = SuperClass.prototype; Well, well... now that we have ECMAScript v4 around the corner there is no real need for this.
  • > Well, well... now that we have ECMAScript v4 around the corner there is no real need for this. That's news to me. Could you more precisely define "around the corner"?
  • > conflated static typing with strong typing "static typing" unhelpfully confuses when checks are made with the kind of checks that are made. Simpler to understand that C++ is a statically-checked weakly-typed language (and also that some things are dynamically checked in C++). Simpler to understand that JScript is a dynamically-checked untyped (safe?) language. I think you demonstrated that it's pretty hard to figure out what the type of a value is in JScript - so why insist on calling it a typed language?
  • [quote]Can I see a repro for that? If the type name is unavailable, it should return "Unknown" or, if it is an IDispatch, "Object". [/quote] I got this when trying it on a COM object that uses run-time generated type info (ie. CreateDispTypeInfo). This only provides a minimal implementation of ITypeInfo. This is not common(or recommended) so I wouldn't worry too much. If it helps the COM object is out of process. Also see this:
  • OK, then I have a guess as to what is happening. This is a TERRIBLE way to wait for an out-of-proc object (OOPO) to shut down. I'll bet that there is a race condition here where the stub is returning a pointer to memory that becomes bad when the OOPO shuts down. So the TypeName method essentially gets passed a pointer to bad memory. Now suppose that the bad memory happens to be in a readable committed page, but contains garbage. We assume that the thing is a BSTR, so we look at the value stashed preceding the string body to determine the length. That could be any old number; the odds that the number happens to be larger than the largest remaining heap block are actually very good. So what we've got here is a memory corruption bug that is not crashing, but returning a bogus error instead.
  • The link I posted was just something I found while searching on the error. My situation relates to using run time type info. Have you tested TypeName with run time type info? It is obsolete and I only use it for testing so this discussion is essentially accademic. My guess is that something similar is happening, ITypeInfo must be returning bogus data. Assuming that you check all error results this could even be a bug in the implementation of ITypeInfo for CreateDispTypeInfo. As mentioned, this is obsolete and probably hasn't been looked at for a long time. I think my object was based on the code found here, so if you want to copy and paste:
  • "That's news to me. Could you more precisely define "around the corner"?"

    I guess I was wrong :'( This has been in the works for way too long...

    Known implemantions of ECMAScript v4:

    JScript 7

    One possible reason for JS2 taking so long might be that ECMA moved all their resources to C# instead?
  • A more likely reason is that Waldemar Horwat, who was the primary driving force behind the E4 spec, no longer works for AOL-Time-Warner-Netscape and hence is no longer being paid to drive the spec process forward. (Rumour has it that he's at google now.)

    Microsoft is still involved in the E4 process, but it is slow going.
Page 1 of 2 (16 items) 12