Revision: 19685
Author: [email protected]
Date: Thu Mar 6 09:50:53 2014 UTC
Log: Fix issues with JSON stringify replacer array
If the replacer array contains a property key we should include the
property even if the property is non enumerable or if it is a non own
property.
String and Number wrappers in the replacer array should be treated as
string and number values.
[email protected]
BUG=v8:3200, v8:3201
LOG=Y
Review URL: https://codereview.chromium.org/187053003
http://code.google.com/p/v8/source/detail?r=19685
Modified:
/branches/bleeding_edge/src/json.js
/branches/bleeding_edge/test/mjsunit/regress/regress-3135.js
=======================================
--- /branches/bleeding_edge/src/json.js Tue Feb 11 10:45:39 2014 UTC
+++ /branches/bleeding_edge/src/json.js Thu Mar 6 09:50:53 2014 UTC
@@ -213,14 +213,21 @@
if (IS_ARRAY(replacer)) {
// Deduplicate replacer array items.
var property_list = new InternalArray();
- var seen_properties = {};
+ var seen_properties = { __proto__: null };
+ var seen_sentinel = {};
var length = replacer.length;
for (var i = 0; i < length; i++) {
var item = replacer[i];
- if (IS_NUMBER(item)) item = %_NumberToString(item);
- if (IS_STRING(item) && !(item in seen_properties)) {
+ if (IS_STRING_WRAPPER(item)) {
+ item = ToString(item);
+ } else {
+ if (IS_NUMBER_WRAPPER(item)) item = ToNumber(item);
+ if (IS_NUMBER(item)) item = %_NumberToString(item);
+ }
+ if (IS_STRING(item) && seen_properties[item] != seen_sentinel) {
property_list.push(item);
- seen_properties[item] = true;
+ // We cannot use true here because __proto__ needs to be an object.
+ seen_properties[item] = seen_sentinel;
}
}
replacer = property_list;
=======================================
--- /branches/bleeding_edge/test/mjsunit/regress/regress-3135.js Fri Feb 28
12:27:31 2014 UTC
+++ /branches/bleeding_edge/test/mjsunit/regress/regress-3135.js Thu Mar 6
09:50:53 2014 UTC
@@ -19,10 +19,21 @@
assertEquals('{"y":4,"1":2,"x":3}',
JSON.stringify({ x : 3, y : 4, 1 : 2 }, ["y", 1, "x"]));
-// __proto__ is ignored and doesn't break anything.
+// With a replacer array the value of the property is retrieved using
[[Get]]
+// ignoring own and enumerability.
var a = { x : 8 };
+assertEquals('{"__proto__":{"__proto__":null},"x":8}',
+ JSON.stringify(a, ["__proto__", "x", "__proto__"]));
a.__proto__ = { x : 7 };
-assertEquals('{"x":8}', JSON.stringify(a,
["__proto__", "x", "__proto__"]));
+assertEquals('{"__proto__":{"__proto__":{"__proto__":null},"x":7},"x":8}',
+ JSON.stringify(a, ["__proto__", "x"]));
+var b = { __proto__: { x: 9 } };
+assertEquals('{}', JSON.stringify(b));
+assertEquals('{"x":9}', JSON.stringify(b, ["x"]));
+var c = {x: 10};
+Object.defineProperty(c, 'x', { enumerable: false });
+assertEquals('{}', JSON.stringify(c));
+assertEquals('{"x":10}', JSON.stringify(c, ["x"]));
// Arrays are not affected by the replacer array.
assertEquals("[9,8,7]", JSON.stringify([9, 8, 7], [1, 1]));
@@ -51,3 +62,12 @@
assertEquals('{}',
JSON.stringify({ x : 1, "1": 1 },
[{ valueOf: function() { return 1;} }]));
+
+// Make sure that property names that clash with the names of
Object.prototype
+// still works.
+assertEquals('{"toString":42}', JSON.stringify({ toString: 42 },
["toString"]));
+
+// Number wrappers and String wrappers should be unwrapped.
+assertEquals('{"1":1,"s":"s"}',
+ JSON.stringify({ 1: 1, s: "s" },
+ [new Number(1), new String("s")]));
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
