Avoid triggering Object.prototype.__proto__ with keys (#2251)

This way, the diff algorithm works with untrusted keys.

render/render.js

@@ -521,7 +521,7 @@ module.exports = function($window) {
 		}
 	}
 	function getKeyMap(vnodes, start, end) {
-		var map = {}
+		var map = Object.create(null)
 		for (; start < end; start++) {
 			var vnode = vnodes[start]
 			if (vnode != null) {