From bbfb599be244c46affa4333b97a5018d76ad5401 Mon Sep 17 00:00:00 2001
From: Sebastian McKenzie <sebmck@gmail.com>
Date: Sun, 8 Nov 2015 05:34:11 -0800
Subject: [PATCH] fix __proto__ clashes in parser in old v8

---
 src/parser/lval.js | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/parser/lval.js b/src/parser/lval.js
index c534f90915..d655805f5d 100644
--- a/src/parser/lval.js
+++ b/src/parser/lval.js
@@ -199,10 +199,23 @@ pp.checkLVal = function (expr, isBinding, checkClashes) {
       }
 
       if (checkClashes) {
-        if (checkClashes[expr.name]) {
+        // we need to prefix this with an underscore for the cases where we have a key of
+        // `__proto__`. there's a bug in old V8 where the following wouldn't work:
+        //
+        //   > var obj = Object.create(null);
+        //   undefined
+        //   > obj.__proto__
+        //   null
+        //   > obj.__proto__ = true;
+        //   true
+        //   > obj.__proto__
+        //   null
+        let key = `_${expr.name}`;
+
+        if (checkClashes[key]) {
           this.raise(expr.start, "Argument name clash in strict mode");
         } else {
-          checkClashes[expr.name] = true;
+          checkClashes[key] = true;
         }
       }
       break;