[JSON] call replacer function with correct holder in JSON.stringify

BUG=v8:5363
R=adamk@chromium.org, littledan@chromium.org, cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2328523002
Cr-Commit-Position: refs/heads/master@{#39291}

src/json-stringifier.cc

@@ -212,23 +212,25 @@ MaybeHandle<Object> JsonStringifier::ApplyToJsonFunction(Handle<Object> object,
 }
 
 MaybeHandle<Object> JsonStringifier::ApplyReplacerFunction(
-    Handle<Object> object, Handle<Object> key) {
+    Handle<Object> value, Handle<Object> key, Handle<Object> initial_holder) {
   HandleScope scope(isolate_);
   if (key->IsSmi()) key = factory()->NumberToString(key);
-  Handle<Object> argv[] = {key, object};
-  Handle<JSReceiver> holder = CurrentHolder(object);
+  Handle<Object> argv[] = {key, value};
+  Handle<JSReceiver> holder = CurrentHolder(value, initial_holder);
   ASSIGN_RETURN_ON_EXCEPTION(
-      isolate_, object,
+      isolate_, value,
       Execution::Call(isolate_, replacer_function_, holder, 2, argv), Object);
-  return scope.CloseAndEscape(object);
+  return scope.CloseAndEscape(value);
 }
 
-Handle<JSReceiver> JsonStringifier::CurrentHolder(Handle<Object> value) {
+Handle<JSReceiver> JsonStringifier::CurrentHolder(
+    Handle<Object> value, Handle<Object> initial_holder) {
   int length = Smi::cast(stack_->length())->value();
   if (length == 0) {
     Handle<JSObject> holder =
         factory()->NewJSObject(isolate_->object_function());
-    JSObject::AddProperty(holder, factory()->empty_string(), value, NONE);
+    JSObject::AddProperty(holder, factory()->empty_string(), initial_holder,
+                          NONE);
     return holder;
   } else {
     FixedArray* elements = FixedArray::cast(stack_->elements());
@@ -273,6 +275,7 @@ JsonStringifier::Result JsonStringifier::Serialize_(Handle<Object> object,
                                                     bool comma,
                                                     Handle<Object> key) {
   StackLimitCheck interrupt_check(isolate_);
+  Handle<Object> initial_value = object;
   if (interrupt_check.InterruptRequested() &&
       isolate_->stack_guard()->HandleInterrupts()->IsException(isolate_)) {
     return EXCEPTION;
@@ -283,7 +286,8 @@ JsonStringifier::Result JsonStringifier::Serialize_(Handle<Object> object,
   }
   if (!replacer_function_.is_null()) {
     ASSIGN_RETURN_ON_EXCEPTION_VALUE(
-        isolate_, object, ApplyReplacerFunction(object, key), EXCEPTION);
+        isolate_, object, ApplyReplacerFunction(object, key, initial_value),
+        EXCEPTION);
   }
 
   if (object->IsSmi()) {

src/json-stringifier.h

@@ -31,7 +31,7 @@ class JsonStringifier BASE_EMBEDDED {
       Handle<Object> object,
       Handle<Object> key);
   MUST_USE_RESULT MaybeHandle<Object> ApplyReplacerFunction(
-      Handle<Object> object, Handle<Object> key);
+      Handle<Object> value, Handle<Object> key, Handle<Object> initial_holder);
 
   // Entry point to serialize the object.
   INLINE(Result SerializeObject(Handle<Object> obj)) {
@@ -99,7 +99,8 @@ class JsonStringifier BASE_EMBEDDED {
   INLINE(void Unindent() { indent_--; });
   INLINE(void Separator(bool first));
 
-  Handle<JSReceiver> CurrentHolder(Handle<Object> value);
+  Handle<JSReceiver> CurrentHolder(Handle<Object> value,
+                                   Handle<Object> inital_holder);
 
   Result StackPush(Handle<Object> object);
   void StackPop();

test/mjsunit/json-stringify-holder.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testBasic() {
+  var stack = [];
+  var object = {a: false};
+  var replaced = {a: false, replaced: true};
+
+  function replacer(key, value) {
+    stack.push({ holder: this, key, value });
+    if (stack.length === 1) return replaced;
+    if (key === "a") return true;
+    return value;
+  }
+
+  assertEquals(`{"a":true,"replaced":true}`, JSON.stringify(object, replacer));
+
+  assertEquals([
+    {
+      holder: { "": { a: false } },
+      key: "",
+      value: { a: false }
+    },
+    {
+      holder: { a: false, replaced: true },
+      key: "a",
+      value: false
+    },
+    {
+      holder: { a: false, replaced: true },
+      key: "replaced",
+      value: true
+    }
+  ], stack);
+
+  assertSame(stack[0].holder[""], object);
+  assertSame(stack[0].value, object);
+  assertSame(stack[1].holder, replaced);
+  assertSame(stack[2].holder, replaced);
+})();
+
+(function testToJSON() {
+  var stack = [];
+  var object = {a: false, toJSON };
+  var nested = { toJSON: nestedToJSON };
+  var replaced = {a: false, replaced: true, nested };
+  var toJSONd = {a: false, toJSONd: true }
+  var nestedToJSONd = { nestedToJSONd: true };
+
+  function toJSON(key, value) {
+    return toJSONd;
+  }
+
+  function nestedToJSON(key, value) {
+    return nestedToJSONd;
+  }
+
+  function replacer(key, value) {
+    stack.push({ holder: this, key, value });
+    if (stack.length === 1) return replaced;
+    if (key === "a") return true;
+    return value;
+  }
+
+  assertEquals(`{"a":true,"replaced":true,"nested":{"nestedToJSONd":true}}`,
+               JSON.stringify(object, replacer));
+
+  assertEquals([
+    {
+      holder: { "": { a: false, toJSON: toJSON } },
+      key: "",
+      value: { a: false, toJSONd: true }
+    },
+    {
+      holder: { a: false, replaced: true, nested: { toJSON: nestedToJSON } },
+      key: "a",
+      value: false
+    },
+    {
+      holder: { a: false, replaced: true, nested: { toJSON: nestedToJSON } },
+      key: "replaced",
+      value: true
+    },
+    {
+      holder: { a: false, replaced: true, nested: { toJSON: nestedToJSON } },
+      key: "nested",
+      value: { nestedToJSONd: true }
+    },
+    {
+      holder: { nestedToJSONd: true },
+      key: "nestedToJSONd",
+      value: true
+    }
+  ], stack);
+
+  assertSame(stack[0].holder[""], object);
+  assertSame(stack[0].value, toJSONd);
+  assertSame(stack[1].holder, replaced);
+  assertSame(stack[2].holder, replaced);
+  assertSame(stack[3].holder, replaced);
+  assertSame(stack[3].value, nestedToJSONd);
+  assertSame(stack[4].holder, nestedToJSONd);
+})();