Rails CGI params processing bug

I just submitted this ticket:

http://dev.rubyonrails.org/ticket/9341

And now I am trying to find the bug so I can fix it, but I am having trouble tracking down the code that transforms incoming "checkbox Hashes" to Arrays. Could someone point me in the right direction?

Thanks, John