From 0f97f4ce20b7b02371e7b4c349f96b382a55fd3e Mon Sep 17 00:00:00 2001
From: Andrew Dupont <prototype@andrewdupont.net>
Date: Thu, 24 Jan 2008 02:24:33 +0000
Subject: [PATCH] Properly serialize form fields with names that collide with
 built-in JS properties (like "length" or "toString"). Closes #9609. [gryn,
 kangax]

---
 CHANGELOG           |  2 ++
 src/form.js         |  2 +-
 test/unit/form.html | 10 ++++++++++
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index ce3d9bf..3944a7a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,7 @@
 *SVN*
 
+* Properly serialize form fields with names that collide with built-in JS properties (like "length" or "toString"). Closes #9609. [gryn, kangax]
+
 * Make Object.isArray correctly identify arrays created in another frame. Closes #10374. [pointy, Dean Edwards, Andrew Dupont, Tobie Langel]
 
 * Fixed issue where Element#match failed on attribute selectors with single or double quotes. Closes #10067. [Cezary Okupski, Andrew Dupont]
diff --git a/src/form.js b/src/form.js
index 0fd2ef3..78c03ff 100644
--- a/src/form.js
+++ b/src/form.js
@@ -14,7 +14,7 @@ var Form = {
         key = element.name; value = $(element).getValue();
         if (value != null && (element.type != 'submit' || (!submitted &&
             submit !== false && (!submit || key == submit) && (submitted = true)))) { 
-          if (key in result) {
+          if (key in result && !Object.isFunction(result[key])) {
             // a key is already present; construct an array of values
             if (!Object.isArray(result[key])) result[key] = [result[key]];
             result[key].push(value);
diff --git a/test/unit/form.html b/test/unit/form.html
index f5dad10..14a3fbb 100644
--- a/test/unit/form.html
+++ b/test/unit/form.html
@@ -124,6 +124,12 @@
       <input type="checkbox" id="ffe_ti2_checkbox" tabindex="0" />
       <input type="submit" id="ffe_ti2_submit" tabindex="1" />
     </form>
+    
+    <form id="trouble_form">
+    	<input type="text" name="length" value="foo" />
+    	<input type="text" name="toString" value="55" />
+    	<input type="text" name="valueOf" value="bar" />
+    </form>
   </div>
 
   <!-- Tests follow -->
@@ -400,6 +406,10 @@
                       $('form').serialize({ submit: false }));
       assertHashEqual({ val1:4, action:'blah' },
                       $('form').serialize({ submit: 'inexistent' }));
+                      
+      // try to serialize form containing toString, valueOf and length -named elements
+      assertHashEqual({ length: 'foo', toString: 55, valueOf: 'bar' },
+                      $('trouble_form').serialize(true));
     }},
     
     testFormMethodsOnExtendedElements: function() {with(this) {