How Lodash isNative Detects Built-in Functions

Lodash provides the _.isNative utility to determine whether a given function is a built-in environment method or a user-defined JavaScript function. It achieves this by safely inspecting the string representation of the target function, comparing it against a dynamically assembled regular expression designed to match the runtime engine's native code signature, and guarding against property-spoofing techniques.

1. Guarding Against Type and Prototype Tampering

Before evaluating the function's internal structure, Lodash validates that the input is an object or function and not null or a primitive.

To prevent functions from faking their native status via an overridden .toString() method, _.isNative does not call fn.toString() directly. Instead, it extracts the uncorrupted serializer directly from the prototype:

Function.prototype.toString.call(fn);

Borrowing Function.prototype.toString ensures that the method's actual underlying bytecode representation is serialized, bypassing any custom toString properties attached to the target object.

2. The Native Function Regex Pattern

JavaScript engines represent native functions in string form using a specific conventions, typically matching the template function () { [native code] }. However, syntax can vary across host environments (such as V8, SpiderMonkey, or JavaScriptCore) and different types of host objects.

Lodash generates a regular expression by capturing the string representation of a known native method, such as Object.prototype.hasOwnProperty, and transforming it into an engine-agnostic pattern:

1. Escaping RegExp Special Characters: Lodash takes the serialized string of a known native function and escapes all regex syntax characters (^, $, \, . etc.).
2. Abstracting the Identifier: It replaces the specific method name (e.g., hasOwnProperty) with a wildcard pattern that permits any valid identifier name.
3. Accounting for Environment Variations: The regex includes edge-case matching for environments that prepend or append implementation details, such as compilation notes or host object headers (e.g., [object FunctionConstructor]).

The resulting regular expression specifically looks for the [native code] substring enclosed in standard function declaration syntax.

3. Masking and Polyfill Detection

Modern polyfills (such as core-js) often modify native prototypes and patch their serialization methods to mimic native behavior by returning [native code].

To guard against disguised polyfills, Lodash checks for internal metadata flags that libraries like core-js attach to altered methods (such as __core-js_shared__ or symbols like Symbol.for('core-js')). If metadata exists indicating that a function has been wrapped or polyfilled, _.isNative returns false.

Summary of Execution Flow

When _.isNative(value) is executed, the resolution process follows these distinct steps:

• Verifies that the input is a non-null function or host object.
• Extracts the string representation using Function.prototype.toString.call(value).
• Evaluates the string against the internal native-code regular expression.
• Verifies that the method does not contain polyfill-masking flags.

If the string matches the native signature pattern and passes the masking checks, Lodash confirms the function is a genuine built-in method.