1 files changed, 25 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/basic/eval-json-differences.js b/js/src/jit-test/tests/basic/eval-json-differences.js
new file mode 100644
index 0000000000..eb7ff3389b
--- /dev/null
+++ b/js/src/jit-test/tests/basic/eval-json-differences.js
@@ -0,0 +1,25 @@
+load(libdir + "asserts.js");
+
+// eval({__proto__}) changes [[Prototype]]
+var obj = eval('({"__proto__": null})');
+assertEq(Object.getPrototypeOf(obj), null);
+assertEq(Object.prototype.hasOwnProperty.call(obj, "__proto__"), false);
+
+// JSON.parse({__proto__}) creates new property __proto__
+obj = JSON.parse('{"__proto__": null}');
+assertEq(Object.getPrototypeOf(obj), Object.prototype);
+assertEq(Object.prototype.hasOwnProperty.call(obj, "__proto__"), true);
+
+// If __proto__ appears more than once as quoted or unquoted property name in an
+// object initializer expression, that's an error.
+//(No other property name has this restriction.)"
+assertThrowsInstanceOf(() =>
+    eval('({ "__proto__" : null, "__proto__" : null })'), SyntaxError);
+
+assertThrowsInstanceOf(() =>
+    eval('  ({ "__proto__" : null, "__proto__" : null })'), SyntaxError);
+
+// JSON.parse doesn't care about duplication, the last definition counts.
+obj = JSON.parse('{"__proto__": null, "__proto__": 5}');
+assertEq(Object.getPrototypeOf(obj), Object.prototype);
+assertEq(obj["__proto__"], 5);