__proto__ in Annex B

[Mark S. Miller]

On Thu, Sep 29, 2011 at 11:46 AM, Brendan Eich <brendan at mozilla.com> wrote:

BTW, we do properly parse JSON that defines a key named "__proto__", and
> IIRC V8 does not. I suspect (haven't checked) that V8 and other engines that
> say __proto__ is not "in" and in particular not "own" for any object, but
> which implement it, do so as Rhino does, with special casing in [[Get]] and
> [[Set]] equivalents.
>

Yes, this is v8 bug <http://code.google.com/p/v8/issues/detail?id=621>. It
is tested by test262 test "S15.12.2_A1" and (currently) test 32 at <
http://es-lab.googlecode.com/svn/trunk/src/ses/explicit.html>, which also
repairs it safely on all platforms on which it is broken. By my testing, it
works fine on FF and Opera. And I expect it works fine on IE10, since it
doesn't special case "__proto__", but I'm on a Mac right now.

Strangely, this also works fine on the released Safari 5.0.6 but not the
latest WebKit Nightly r96318. For WebKit, it seems this is a new bug.

-- 
    Cheers,
    --MarkM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.mozilla.org/pipermail/es-discuss/attachments/20110929/72d6bb08/attachment.html>