Status: New
Owner: ----
New issue 621 by [email protected]: JSON parse fooled by "__proto__" key
http://code.google.com/p/v8/issues/detail?id=621
V8 version 2.1.0.1 [console: dumb]
d8> var x = JSON.parse('{"__proto__":[]}');
d8> x instanceof Array
true
Both the latest WebKit nightly and the latest TraceMonkey correctly create
an
object that inherits directly from Object.prototype and that has a non-
magical property named "__proto__" whose value is an empty array. So in this
case, compatibility and spec conformance both say this should be fixed.
--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
