Function.prototype[@@hasInstance] is currently writable+configurable, re-defining Function.prototype[@@hasInstance] thus makes it possible to reveal the [[BoundTarget]] internal data property of bound functions.
Simple example using `Intl.Collator.prototype.compare` which returns a bound function, the internal "compare" function should not be revealed to the user.
> js> oldHasInstance = Function.prototype[getSym("@@hasInstance")]
> function @@hasInstance() { /* native code */ }
> js> Function.prototype[getSym("@@hasInstance")] = function(v){ print("@@hasInstance: "+this); return oldHasInstance.call(this, v) }
> function(v){ print("@@hasInstance: "+this); return oldHasInstance.call(this, v) }
> js> [] instanceof Intl.Collator.prototype.compare
> @@hasInstance: function BoundFunction() { /* native code */ }
> @@hasInstance: function compare() { /* native code */ }
Ok, I'll make Function.prototype[@@hasInstance]] non-writable and non-configurable.
fixed in rev 15 editor's draft
resolved in rev 15, May 14, 2013 draft