New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 621 link

Starred by 17 users

Issue metadata

Status: Fixed
Closed: Feb 2013
HW: ----
NextAction: ----
OS: ----
Priority: 3
Type: ----

Sign in to add a comment

JSON parse fooled by "__proto__" key

Reported by, Feb 23 2010

Issue description

V8 version [console: dumb]
d8> var x = JSON.parse('{"__proto__":[]}');
d8> x instanceof Array

Both the latest WebKit nightly and the latest TraceMonkey correctly create an 
object that inherits directly from Object.prototype and that has a non-
magical property named "__proto__" whose value is an empty array. So in this 
case, compatibility and spec conformance both say this should be fixed.
Labels: Priority-Low
Status: Accepted
This is indeed a difference from WebKit (and TraceMonkey).

Comment 2 by, May 22 2010

This issue should be marked with the ES5 label.
Labels: ES5

Comment 4 by, Jun 23 2011

Related to  issue 1310 
I'll handle this one.
Status: Fixed
Fixed on bleeding edge in r13728.
 Issue 2532  has been merged into this issue.
 Issue 2532  has been merged into this issue.
Labels: Priority-3

Sign in to add a comment