New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 621 link

Starred by 17 users

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2013
Cc:
HW: ----
NextAction: ----
OS: ----
Priority: 3
Type: ----
ES5



Sign in to add a comment

JSON parse fooled by "__proto__" key

Reported by erights@google.com, Feb 23 2010

Issue description

V8 version 2.1.0.1 [console: dumb]
d8> var x = JSON.parse('{"__proto__":[]}');
d8> x instanceof Array
true

Both the latest WebKit nightly and the latest TraceMonkey correctly create an 
object that inherits directly from Object.prototype and that has a non-
magical property named "__proto__" whose value is an empty array. So in this 
case, compatibility and spec conformance both say this should be fixed.
 
Labels: Priority-Low
Status: Accepted
This is indeed a difference from WebKit (and TraceMonkey).

Comment 2 by erights@google.com, May 22 2010

This issue should be marked with the ES5 label.
Labels: ES5

Comment 4 by erights@google.com, Jun 23 2011

Related to  issue 1310 
Owner: mstarzinger@chromium.org
I'll handle this one.
Cc: rossberg@chromium.org
Status: Fixed
Fixed on bleeding edge in r13728.
 Issue 2532  has been merged into this issue.
 Issue 2532  has been merged into this issue.
Labels: Priority-3

Sign in to add a comment