Reviewers: Toon Verwaest,

Description:
Fix handling arrays with holes in JSON.stringify.


[email protected]
BUG=


Please review this at https://chromiumcodereview.appspot.com/11273112/

SVN Base: https://v8.googlecode.com/svn/branches/bleeding_edge

Affected files:
  M src/json-stringifier.h
  M src/json.js
  M src/runtime.cc
  A + test/mjsunit/json2.js


Index: src/json-stringifier.h
diff --git a/src/json-stringifier.h b/src/json-stringifier.h
index 070a3ddd538523c1693ec7d43d4ff6b36ecb86d0..2235ed5e8a8c563ba9a57644e44cd86cc7f64a9c 100644
--- a/src/json-stringifier.h
+++ b/src/json-stringifier.h
@@ -413,20 +413,6 @@ BasicJsonStringifier::Result BasicJsonStringifier::SerializeArray(
       }
       break;
     }
-    case FAST_HOLEY_SMI_ELEMENTS: {
-      Handle<FixedArray> elements = Handle<FixedArray>(
-          FixedArray::cast(object->elements()));
-      for (int i = 0; i < length; i++) {
-        if (i > 0) Append(',');
-        if (elements->is_the_hole(i)) {
-          Append("null");
-        } else {
-          SerializeSmi(Smi::cast(elements->get(i)));
-        }
-      }
-      break;
-    }
-    case FAST_HOLEY_DOUBLE_ELEMENTS:
     case FAST_DOUBLE_ELEMENTS: {
       Handle<FixedDoubleArray> elements = Handle<FixedDoubleArray>(
           FixedDoubleArray::cast(object->elements()));
@@ -436,7 +422,6 @@ BasicJsonStringifier::Result BasicJsonStringifier::SerializeArray(
       }
       break;
     }
-    case FAST_HOLEY_ELEMENTS:
     case FAST_ELEMENTS: {
       Handle<FixedArray> elements = Handle<FixedArray>(
           FixedArray::cast(object->elements()));
Index: src/json.js
diff --git a/src/json.js b/src/json.js
index 608cb7109d972f5981be6f51fefa17aab6ebc2ab..16cf45bcf426dee8733fef1a8985014b177155c9 100644
--- a/src/json.js
+++ b/src/json.js
@@ -307,8 +307,6 @@ function BasicJSONSerialize(key, value, stack, builder) {

 function JSONStringify(value, replacer, space) {
   if (%_ArgumentsLength() == 1) {
-    var result = %BasicJSONStringify(value);
-    if (result != 0) return result;
     var builder = new InternalArray();
     BasicJSONSerialize('', value, new InternalArray(), builder);
     if (builder.length == 0) return;
Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index b0a6b5e81427e1588a89f1c269a2b1e90c78f98b..e90e3a9b7ec75bfec2f86edd955a3f433d55ec31 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -9188,7 +9188,7 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_AllocateInNewSpace) {
 RUNTIME_FUNCTION(MaybeObject*, Runtime_PushIfAbsent) {
   ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(JSArray, array, 0);
-  CONVERT_ARG_CHECKED(JSObject, element, 1);
+  CONVERT_ARG_CHECKED(JSReceiver, element, 1);
   RUNTIME_ASSERT(array->HasFastSmiOrObjectElements());
   int length = Smi::cast(array->length())->value();
   FixedArray* elements = FixedArray::cast(array->elements());
Index: test/mjsunit/json2.js
diff --git a/test/mjsunit/regress/regress-2110.js b/test/mjsunit/json2.js
similarity index 74%
copy from test/mjsunit/regress/regress-2110.js
copy to test/mjsunit/json2.js
index d7f78d26a7b4d16c4217d2b0ac136e52e4542eb1..c4392401ce74cfe501666182de515313b2771896 100644
--- a/test/mjsunit/regress/regress-2110.js
+++ b/test/mjsunit/json2.js
@@ -27,27 +27,22 @@

 // Flags: --allow-natives-syntax

-var uint8 = new Uint8Array(1);
+var fast_smi = [1, 2, 3, 4];
+fast_smi.__proto__ = [7, 7, 7, 7];
+delete fast_smi[2];
+assertTrue(%HasFastSmiElements(fast_smi));
+assertEquals("[1,2,7,4]", JSON.stringify(fast_smi));

-function test() {
-  uint8[0] = 0x800000aa;
-  assertEquals(0xaa, uint8[0]);
-}
+var fast_double = [1.1, 2, 3, 4];
+fast_double.__proto__ = [7, 7, 7, 7];

-test();
-test();
-test();
-%OptimizeFunctionOnNextCall(test);
-test();
+delete fast_double[2];
+assertTrue(%HasFastDoubleElements(fast_double));
+assertEquals("[1.1,2,7,4]", JSON.stringify(fast_double));

-var uint32 = new Uint32Array(1);
+var fast_obj = [1, 2, {}, {}];
+fast_obj.__proto__ = [7, 7, 7, 7];

-function test2() {
-  uint32[0] = 0x80123456789abcde;
-  assertEquals(0x789ac000, uint32[0]);
-}
-
-test2();
-test2();
-%OptimizeFunctionOnNextCall(test2);
-test2();
+delete fast_obj[2];
+assertTrue(%HasFastObjectElements(fast_obj));
+assertEquals("[1,2,7,{}]", JSON.stringify(fast_obj));


--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev

Reply via email to