Spawn reads env from prototype

lib/child_process.js

@@ -214,9 +214,7 @@ ChildProcess.prototype.spawn = function(path, args, options, customFds) {
   }
 
   var envPairs = [];
-  var keys = Object.keys(env);
-  for (var index = 0, keysLength = keys.length; index < keysLength; index++) {
-    var key = keys[index];
+  for (var key in env) {
     envPairs.push(key + '=' + env[key]);
   }
 

test/simple/test-child-process-env.js

@@ -2,7 +2,15 @@ var common = require('../common');
 var assert = require('assert');
 
 var spawn = require('child_process').spawn;
-var child = spawn('/usr/bin/env', [], {env: {'HELLO': 'WORLD'}});
+
+var env = {
+  'HELLO': 'WORLD'
+};
+env.__proto__ = {
+  'FOO': 'BAR'
+}
+
+var child = spawn('/usr/bin/env', [], {env: env});
 
 var response = '';
 
@@ -15,4 +23,5 @@ child.stdout.addListener('data', function(chunk) {
 
 process.addListener('exit', function() {
   assert.ok(response.indexOf('HELLO=WORLD') >= 0);
+  assert.ok(response.indexOf('FOO=BAR') >= 0);
 });