1337564 - { "__proto__": null } in an eval'ed string fails to create an object without prototype in some situations

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P3)

Description

[Claude Pache]

Testcase

    var x = eval('   ({ "__proto__" : null })');
    Object.getPrototypeOf(x) === null; // true
    ({}).hasOwnProperty.call(x, '__proto__'); // false

    var y = eval('({ "__proto__" : null })');
    Object.getPrototypeOf(y) === Object.prototype; // true
    ({}).hasOwnProperty.call(y, '__proto__'); // true


This is a interesting side-effect of Bug 578216.

Comment 1

[André Bargull [:anba]]

And a related parser issue:
---
js> eval('({ "__proto__" : null, "__proto__" : null })');
({__proto__:null})
js> eval('  ({ "__proto__" : null, "__proto__" : null })');
typein:1:25 SyntaxError: property name __proto__ appears more than once in object literal:
typein:1:25   ({ "__proto__" : null, "__proto__" : null })
typein:1:25 .........................^
Stack:
  @typein:2:1
---

Comment 2

[Tom S [:evilpie]]

Attachment: Potential Fix

Huhu what a curious bug! I wonder if there are any other differences lurking somewhere. We need to test the performance objects with a lot of properties before landing this.

Comment 3

[Tom S [:evilpie]]

Attachment: Bug 1337564 - Don't use JSON behavior for __proto__ with eval. r?jwalden

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f64d18fe9b93
Don't use JSON behavior for __proto__ with eval. r=jwalden

Comment 5

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f64d18fe9b93