JavaScript’s DNA

How Objects, Prototypes, and Constructors Form the Engine Behind Everything

1: What Is an Object?

You already know this:

const obj = { name: "Anandhu" }

An object is just:

A box that stores key → value pairs.

Like:

obj
 ├─ name → "Anandhu"

That’s it.

2: What Is a Function?

“when we open brackets and write something inside, they call function”

Yes. Correct.

function sayHi() {
  console.log("Hi")
}

A function is:

A reusable block of code.

But here’s the IMPORTANT part:

In JavaScript, Functions are also objects.

Yes. This is where things start getting interesting.

Example:

function test() {}
console.log(typeof test) // "function"

But:

console.log(test instanceof Object) // true

So a function is:

• A function
• AND an object

3: What Is a Constructor?

Now we go one level deeper.

You know this:

function Person(name) {
  this.name = name
}

const p1 = new Person("Anandhu")

Here:

• Person is a function
• new Person() creates an object

That function is called a constructor function.

So:

A constructor is just a function used to create objects.

4: Everything Comes From Something

Now comes the core idea you were confused about.

When you create:

const obj = {}

JavaScript secretly does:

const obj = new Object()

That means:

There is a built-in function called:

Object

And it creates objects.

So:

Object  → constructor function

5: What Is Prototype?

Now the most important concept.

Every object in JavaScript has a hidden link to another object.

That hidden link is called:

[[Prototype]]

You can see it as:

obj.__proto__

Example:

const obj = {}
console.log(obj.__proto__)

It shows:

Object.prototype

So the real structure is:

obj
   ↓
Object.prototype
   ↓
null

If obj doesn't have something, JavaScript checks Object.prototype.

That’s called the prototype chain.

6: Why Does obj.toString() Work?

You never defined toString.

But it works:

obj.toString()

Why?

Because:

Object.prototype.toString exists

JavaScript checks:

1. obj has toString? → No
2. Go to prototype
3. Found it → use it

That’s inheritance.

7: What Is Object.prototype?

There is a global constructor:

Object

It has something called:

Object.prototype

This is:

The parent of almost all objects.

So when you do:

Object.prototype.hacked = "yes"

Now:

const a = {}
console.log(a.hacked) // "yes"

Because:

a → Object.prototype → hacked

You changed the parent.

So all children inherit it.

8: What Is constructor?

Now we reach the big concept.

Every object has a property called:

constructor

Example:

const arr = []
console.log(arr.constructor)

It prints:

Array

Why?

Because arr was created by Array.

Same:

const obj = {}
console.log(obj.constructor)

It prints:

Object

So:

obj.constructor === Object

That means:

constructor tells you which function created the object.

9: The Crazy Part

Remember:

Functions are objects.

And constructors are functions.

So:

console.log(Object.constructor)

It prints:

Function

Why?

Because:

The Object function was created by the Function constructor.

Yes.

Let that sink in.

Now try:

console.log(Function.constructor)

It prints:

Function

Function created itself.

Mind-blowing but true.

10: What Is Function() ?

There is a built-in constructor called:

Function

You can create a function dynamically:

const f = new Function("return 5")
console.log(f()) // 5

So:

Function("console.log('hello')")()

Executes code.

That’s why it’s powerful. That’s why it’s dangerous.

11: Why constructor.constructor Works

Now we combine everything.

If:

obj.constructor === Object

And:

Object.constructor === Function

Then:

obj.constructor.constructor === Function

So:

obj.constructor.constructor("console.log('Hacked')")()

Executes code.

That’s the exploit path.

Final Mental Model

Everything in JavaScript is connected like this:

obj
  ↓
Object.prototype
  ↓
Object (constructor)
  ↓
Function (constructor of Object)

And Function() can execute strings as code.

So if someone controls:

• prototype
• constructor
• constructor.constructor

They can reach Function().

Next we look how React2shell Works!