为什么instanceof在这里评估为true？

Question

In this snippet, the statement f instanceof PipeWritable returns true (Node v8.4.0):

const stream = require('stream');
const fs = require('fs');

class PipeWritable extends stream.Writable {
    constructor () {
        super();
    }
}

const s = new PipeWritable();
const f = fs.createWriteStream('/tmp/test');

console.log(f instanceof PipeWritable); // true ... ???

Object s :

• Object.getPrototypeOf(s) is PipeWritable {}
• s.constructor is [Function: PipeWritable]
• PipeWritable.prototype is PipeWritable {}

Object f :

• Object.getPrototypeOf(f) is WriteStream { ... }
• f.constructor is [Function: WriteStream] ...
• stream.WriteStream.prototype is Writable { ... }

Prototype chains :

Object f                    Object s
---------------------       --------------------
  Writable                    PipeWritable
    Stream                      Writable
      EventEmitter                Stream
        Object                      EventEmitter
                                      Object

Following the definition of instanceof :

The instanceof operator tests whether an object in its prototype chain has the prototype property of a constructor.

I would expect that (f instanceof PipeWritable) === false , because PipeWritable is not in the prototype chain of f (the chain above is verified by calls of Object.getPrototypeOf(...) ).
But it returns true , therefore something is wrong in my analysis.

What's the correct answer?

Answer 1

This is due to a certain part of code in the Node.js source, in _stream_writable.js :

var realHasInstance;
if (typeof Symbol === 'function' && Symbol.hasInstance) {
  realHasInstance = Function.prototype[Symbol.hasInstance];
  Object.defineProperty(Writable, Symbol.hasInstance, {
    value: function(object) {
      if (realHasInstance.call(this, object))
        return true;

      return object && object._writableState instanceof WritableState;
    }
  });
} else {
  realHasInstance = function(object) {
    return object instanceof this;
  };
}

By language specification , the instanceof operator uses the well-known symbol @@hasInstance to check if an object O is an instance of constructor C :

12.9.4 Runtime Semantics: InstanceofOperator(O, C)

The abstract operation InstanceofOperator(O, C) implements the generic algorithm for determining if an object O inherits from the inheritance path defined by constructor C . This abstract operation performs the following steps:

1. If Type ( C ) is not Object, throw a TypeError exception.
2. Let instOfHandler be GetMethod ( C ,@@hasInstance).
3. ReturnIfAbrupt ( instOfHandler ).
4. If instOfHandler is not undefined , then
   a. Return ToBoolean ( Call ( instOfHandler , C , «O» )).
5. If IsCallable ( C ) is false , throw a TypeError exception.
6. Return OrdinaryHasInstance ( C , O ).

Now let me break down the code above for you, section by section:

var realHasInstance;
if (typeof Symbol === 'function' && Symbol.hasInstance) {
  …
} else {
  …
}

The above snippet defines realHasInstance , checks if Symbol is defined and if the well-known symbol hasInstance exists. In your case, it does, so we'll ignore the else branch. Next:

realHasInstance = Function.prototype[Symbol.hasInstance];

Here, realHasInstance is assigned to Function.prototype[@@hasInstance] :

19.2.3.6 Function.prototype[@@hasInstance] ( V )

When the @@hasInstance method of an object F is called with value V , the following steps are taken:

1. Let F be the this value.
2. Return OrdinaryHasInstance ( F , V ).

The @@hasInstance method of Function just calls OrdinaryHasInstance. Next:

Object.defineProperty(Writable, Symbol.hasInstance, {
  value: function(object) {
    if (realHasInstance.call(this, object))
      return true;

    return object && object._writableState instanceof WritableState;
  }
});

This defines a new property on the Writable constructor, the well-known symbol hasInstance -- essentially implementing its own custom version of hasInstance . The value of hasInstance is a function that takes one argument, the object that is being tested by instanceof , in this case f .

The next line, the if statement, checks if realHasInstance.call(this, object) is truthy. Mentioned earlier, realHasInstance is assigned to Function.prototype[@@hasInstance] which is actually calling the internal operation OrdinaryHasInstance(C, O) . The operation OrdinaryHasInstance just checks if O is an instance of C as you and MDN described, by looking for the constructor in the prototype chain.

In this case, a Writable f is not an instance of a subclass of Writable ( PipeWritable ) thus realHasInstance.call(this, object) is false. Since that is false, it goes to the next line:

return object && object._writableState instanceof WritableState;

Since object , or f in this case, is truthy, and since f is a Writable with a _writableState property that is an instance of WritableState , f instanceof PipeWritable is true .

---

The reason for this implementation is in the comments :

// Test _writableState for inheritance to account for Duplex streams,
// whose prototype chain only points to Readable.

Because Duplex streams are technically Writables, but their prototype chains only point to Readable, an extra check to see if _writableState is an instance of WritableState allows duplexInstance instanceof Writable to be true. This has a side effect that you discovered -- a Writable being 'an instance of a child class'. This is a bug and should be reported.

This is actually even reported in the documentation :

Note: The stream.Duplex class prototypically inherits from stream.Readable and parasitically from stream.Writable , but instanceof will work properly for both base classes due to overriding Symbol.hasInstance on stream.Writable .

There are consequences to inheriting parasitcally from Writable as shown here.

---

I submitted an issue on GitHub and it looks like it'll be fixed. As Bergi mentioned , adding a check to see if this === Writable , making sure only Duplex streams were instances of Writable when using instanceof . There's a pull request .