Opera's localStorage bug

http://0mg.github.com/etc/oprlsbu2.html

✓javascript: ({}) + localStorage + ({}): [object Object][object Storage][object Object]

✓javascript: [] + localStorage + []: [object Storage]

✖javascript: (function(){}) + localStorage + (function(){}): TypeError: when converting to primitive: result is not a primitive

✓javascript: 0 + localStorage + 0: 0[object Storage]0

✓javascript: "" + localStorage + "": [object Storage]

✓javascript: true + localStorage + true: true[object Storage]true

✓javascript: null + localStorage + null: null[object Storage]null

✓javascript: undefined + localStorage + undefined: undefined[object Storage]undefined

✖javascript: /./ + localStorage + /./: TypeError: when converting to primitive: result is not a primitive

✖javascript: Object + localStorage + Object: TypeError: when converting to primitive: result is not a primitive

✖javascript: Array + localStorage + Array: TypeError: when converting to primitive: result is not a primitive

✖javascript: Function + localStorage + Function: TypeError: when converting to primitive: result is not a primitive

✖javascript: Number + localStorage + Number: TypeError: when converting to primitive: result is not a primitive

✖javascript: String + localStorage + String: TypeError: when converting to primitive: result is not a primitive

✖javascript: Boolean + localStorage + Boolean: TypeError: when converting to primitive: result is not a primitive

✖javascript: RegExp + localStorage + RegExp: TypeError: when converting to primitive: result is not a primitive

✓javascript: Math + localStorage + Math: [object Math][object Storage][object Math]

✖javascript: Date + localStorage + Date: TypeError: when converting to primitive: result is not a primitive

✖javascript: parseInt + localStorage + parseInt: TypeError: when converting to primitive: result is not a primitive

✖javascript: escape + localStorage + escape: TypeError: when converting to primitive: result is not a primitive

✖javascript: encodeURI + localStorage + encodeURI: TypeError: when converting to primitive: result is not a primitive

✓javascript: localStorage + localStorage + localStorage: [object Storage][object Storage][object Storage]

✓javascript: sessionStorage + localStorage + sessionStorage: [object Storage][object Storage][object Storage]

✓javascript: Object.prototype + localStorage + Object.prototype: [object Object][object Storage][object Object]

✓javascript: ({}).__proto__ + localStorage + ({}).__proto__: [object Object][object Storage][object Object]

✖javascript: Array.prototype + localStorage + Array.prototype: TypeError: when converting to primitive: result is not a primitive

✖javascript: [].__proto__ + localStorage + [].__proto__: TypeError: when converting to primitive: result is not a primitive

✖javascript: Function.prototype + localStorage + Function.prototype: TypeError: when converting to primitive: result is not a primitive

✖javascript: (function(){}).__proto__ + localStorage + (function(){}).__proto__: TypeError: when converting to primitive: result is not a primitive

✓javascript: Number.prototype + localStorage + Number.prototype: 0[object Storage]0

✓javascript: (1).__proto__ + localStorage + (1).__proto__: 0[object Storage]0

✓javascript: String.prototype + localStorage + String.prototype: [object Storage]

✓javascript: ("").__proto__ + localStorage + ("").__proto__: [object Storage]

✓javascript: Boolean.prototype + localStorage + Boolean.prototype: false[object Storage]false

✓javascript: (true).__proto__ + localStorage + (true).__proto__: false[object Storage]false

✖javascript: RegExp.prototype + localStorage + RegExp.prototype: TypeError: when converting to primitive: result is not a primitive

✖javascript: /./.__proto__ + localStorage + /./.__proto__: TypeError: when converting to primitive: result is not a primitive

Opera's localStorage bug

f = function(){}, l = window.localStorage;
[1, 2].forEach(function);

Success

function() { f + l + []; }
function() { f + l + /./; }
function() { f + l + {}; }
function() { f + l + Object; }
function() { f + l + Array; }
function() { f + l + String; }
function() { f + l + Number; }
function() { f + l + Boolean; }
function() { f + l + Function; }
function() { f + l + RegExp; }
function() { f + l + Date; }
function() { f + l + parseInt; }
function() { f + l + parseFloat; }
function() { f + l + String([]); }
function() { f + l + String({}); }
function() { f + l + (+[]); }
function() { f + l + (+{}); }
function() { f + l + ([]).valueOf(); }
function() { f + l + ({}).valueOf(); }
function() { f && l; }
function() { f || l; }
function() { f ? l : l; }
function() { f, l; }
function() { !f + !l; }

Error

function() { f + l; }
function() { f + l + ""; }
function() { f + l + 1; }
function() { f + l + 0; }
function() { f + l + NaN; }
function() { f + l + Infinity; }
function() { f + l + null; }
function() { f + l + undefined; }
function() { f + l + true; }
function() { f + l + false; }
function() { f + l + function(){}; }
function() { f + l + String(""); }
function() { f + l + String(1); }
function() { f + l + ([]).toString(); }
function() { f + l + ("").toString(); }
function() { f + l + (1).toString(); }
function() { f + l + ({}).toString(); }
function() { f + l + (+""); }
function() { f + l + (+1); }
function() { f + l + ("").valueOf(); }
function() { f + l + (1).valueOf(); }
function() { f * l; }
function() { f / l; }
function() { f - l; }
function() { f % l; }
function() { f << l; }
function() { f >> l; }
function() { f >>> l; }
function() { f < l; }
function() { f > l; }
function() { f & l; }
function() { f | l; }
function() { +f + +l; }
function() { ~f + ~l; }

0mg/oprlsbu2.md

Opera's localStorage bug

Opera's localStorage bug

Success

Error