Fix crash when using style expressions with prototype-derived

GitOrigin-RevId: 3578c6e0678dc9b7935925d95671fb1ccab804fe

Author: ibesora

src/style-spec/expression/scope.ts

@@ -6,12 +6,10 @@ import type {Expression} from './expression';
  */
 class Scope {
     parent: Scope | null | undefined;
-    bindings: {
-        [_: string]: Expression;
-    };
+    bindings: Record<string, Expression>;
     constructor(parent?: Scope, bindings: Array<[string, Expression]> = []) {
         this.parent = parent;
-        this.bindings = {};
+        this.bindings = Object.create(null) as Record<string, Expression>;
         for (const [name, expression] of bindings) {
             this.bindings[name] = expression;
         }

test/unit/style-spec/expression.test.ts

@@ -54,6 +54,16 @@ describe('createExpression treats inherited Object.prototype member names as unk
     });
 });
 
+describe('createExpression treats inherited Object.prototype member names as unbound "var" names', () => {
+    test.each(['__proto__', 'constructor', 'toString', 'hasOwnProperty', 'valueOf'])('%s', (name) => {
+        expect(() => createExpression(['var', name])).not.toThrow();
+        const {result, value} = createExpression(['var', name]);
+        expect(result).toEqual('error');
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+        expect(value[0].message).toMatch(`Unknown variable "${name}"`);
+    });
+});
+
 describe('validateExpression', () => {
     //see https://github.com/mapbox/mapbox-gl-js/issues/11457
     test('ensure lack of valueSpec does not cause uncaught error', () => {