prototype之疑惑

function Dog(){this.tail = true;}
  var benji = new Dog();
  var rusty = new Dog();
  Dog.prototype.say = function(){return 'Woof!';}
  alert(benji.say());  //?是否等同于benji.constructor.prototype.say()
  Dog.prototype = {paws: 4, hair: true};
  alert(benji.paws); //?那么这里呢？如果上面为Yes,这里又怎么理解？

无事翻了一下书，才发现一直以来我的理解是有问题的。
其实以上代码中，benji.say()的调用是等同于benji.constructor.prototype.say()的。
但这是却让我陷入了自己的坑，以为prototype对象的调用都是以constructor.prototype方式来的。
其实不然，真正的[[prototype]]对象都存在于new创建后的对象实例中，FF中该属性为__proto__,标准里为[[prototype]]
因为默认情况下new的调用，对象实例的[[prototype]]默认指向其构造函数的prototype对象的。
在上文中对应Dog.prototype,而后的Dog.prototype.say的赋值，都是在该对象上添加属性，对象引用却没发生改变。
所以就算针对prototype对象的属性添加在构造对象之后也能够获取到相应的属性。
但Dog.prototype = {paws: 4, hair: true};这一行代码却改变了prototype的对象引用，此改变不会改变之前创建对象实例的[[prototype]]属性的值，只能对后续新建对象产生影响(构造时对象实例指向新的Dog.prototype)。

网上有同样疑惑的人，提供链接以供参考。

http://stackoverflow.com/questions/650764/how-does-proto-differ-from-constructor-prototype

热心人士的解答：
constructor is a pre-defined [[DontEnum]] property of the object pointed to by the prototypeproperty of a function object and will initially point to the function object itself.

__proto__ is equivalent to the internal [[Prototype]] property of an object, ie it's actual prototype.

When you create an object via use of the new operator, it's internal [[Prototype]] property will be set to the object pointed to by the constructor function's prototype property.

This means that .constructor will evaluate to .__proto__.constructor, ie the constructor function used to create the object, and as we have leared, the protoype property of this function was used to set the object's [[Prototype]].

It follows that .constructor.prototype.constructor is identical to .constructor (as long as these properties haven't been overwritten); see here for a more detailed explanation.

If __proto__ is available, you can walk the actual prototype chain of the object. There's no way to do this in plain ECMAScript3 because JavaScript wasn't designed for deep inheritance hierarchies.