Use of toString() instead of constructor in JavaScript

Question

This is probably a stupid question, so please stick with me.

Why do I see so many examples testing whether an object is a Function by comparing its toString() to "[object Function]"?

For example:

function isFunction(obj) {
    return Object.prototype.toString.call(obj) == "[object Function]";
}

Can't we use instanceof Function or obj.constructor === Function? Are those not cross-browser compatible?

This seems inefficient, but is it? Why?

Answer 1

Short answer is because typeof /foo/ is a function in Webkit browsers. CMS has the long drawn explanation @ jQuery's isFunction and InternetExplorer

And instanceOf isn't reliable because as Zuriy points out:

The problems arise when it comes to scripting in multi-frame DOM environments. In a nutshell, Array objects created within one iframe do not share [[Prototype]]’s with arrays created within another iframe. Their constructors are different objects and so both instanceof and constructor checks fail:

Great article @ http://perfectionkills.com/instanceof-considered-harmful-or-how-to-write-a-robust-isarray/ by Zuriy on the subject.

Example taken from the article:

var iframe = document.createElement('iframe'); 
document.body.appendChild(iframe); 
xArray = window.frames[window.frames.length-1].Array;
var arr = new xArray(1,2,3); // [1,2,3]  

// Boom! 
arr instanceof Array; // false  

// Boom! 
arr.constructor === Array; // false

Answer 2

They are not testing its toString method, they are calling Object's prototype's toString method on obj to cast it to a string. A function casts as '[object Function]' to a string.

instanceof is not reliable and neither is the constructor way. The constructor requires a check to see if obj is null or not before attempting to access its constructor property - I'm also guessing it's a tad slower than the toString method.