Calling the Array constructor in IE

Back to articles

hackvertor

Author:

Gareth Heyes

@hackvertor

Published: Thu, 08 Jan 2009 20:53:32 GMT

Updated: Sat, 22 Mar 2025 15:38:12 GMT

I had a conversation a while ago on email with Billy Hoffman about how in IE the Array constructor wasn't called when using [] to create arrays. The question is, was he right? Technically yes but actually no :)

You see Arrays in JScript are actually objects and not arrays, so trying to overwrite the Array constructor will have no effect. However using the Object constructor does. I found this while hacking away in JSON to create my Twitter POC.

The is a strange quirk which although it technically is the same code it results in different behaviour. Take the following example:-

<pre lang="javascript"> function Object() { alert(arguments[0]); } ([1,2,3]); </pre>

That doesn't work but...look at this example:-

<pre lang="javascript"> var Object = function() { alert(arguments[0]); } ([1,2,3]); </pre>

It works! Yay! Strange but true. Don't ask how I found this but it was either by fuzzing, playing around in Hackvertor or pure luck :)

Back to articles