Reviewers: Sven Panne,
Description:
Fix the reviver function in JSON.parse
Fixes the reviver function in JSON.parse to update the length
to delete elements. If the Revive function argument val is
Array we should delete the property if it's undefined.
BUG=V8:3136
[email protected]
LOG=N
Please review this at https://codereview.chromium.org/1220603002/
Base URL: https://chromium.googlesource.com/v8/v8.git@master
Affected files (+12, -9 lines):
M src/json.js
A + test/mjsunit/regress/regress-3136.js
Index: src/json.js
diff --git a/src/json.js b/src/json.js
index
e405f87bab6b39a6905304adbc66ebd8f421d00d..1901b07a3985e4a75e123336a8c36aeaee11f5f3
100644
--- a/src/json.js
+++ b/src/json.js
@@ -35,7 +35,11 @@ function Revive(holder, name, reviver) {
var length = val.length;
for (var i = 0; i < length; i++) {
var newElement = Revive(val, %_NumberToString(i), reviver);
- val[i] = newElement;
+ if (IS_UNDEFINED(newElement)) {
+ delete val[i];
+ } else {
+ val[i] = newElement;
+ }
}
} else {
for (var p in val) {
Index: test/mjsunit/regress/regress-3136.js
diff --git a/test/mjsunit/context-variable-assignments.js
b/test/mjsunit/regress/regress-3136.js
similarity index 88%
copy from test/mjsunit/context-variable-assignments.js
copy to test/mjsunit/regress/regress-3136.js
index
930b969609b5974f2c2ed46ab79610f575a171fd..41ed1c8056b24aad0675597e9b3d08fcfdf63e48
100644
--- a/test/mjsunit/context-variable-assignments.js
+++ b/test/mjsunit/regress/regress-3136.js
@@ -1,4 +1,4 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,13 +25,12 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-function foo() {
- var a, b;
- var bar = function() {
- a = b = "hello world";
+function reviver(p, v) {
+ if (p == 0) {
+ this.length = 0;
}
- bar();
- return a;
+ return v;
}
-assertEquals("hello world", foo());
+var len = JSON.parse("[1,2,3]", reviver).length
+assertEquals(1, len);
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
