Treat leading zeros in JSON.parse correctly.

R=verwaest@chromium.org
BUG=158185

Review URL: https://chromiumcodereview.appspot.com/11273075

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12830 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/json-parser.h

@@ -304,45 +304,56 @@ Handle<Object> JsonParser<seq_ascii>::ParseJsonObject() {
       Advance();
 
       uint32_t index = 0;
-      while (c0_ >= '0' && c0_ <= '9') {
-        int d = c0_ - '0';
-        if (index > 429496729U - ((d > 5) ? 1 : 0)) break;
-        index = (index * 10) + d;
-        Advance();
-      }
+      if (c0_ >= '0' && c0_ <= '9') {
+        // Maybe an array index, try to parse it.
+        if (c0_ == '0') {
+          // With a leading zero, the string has to be "0" only to be an index.
+          Advance();
+        } else {
+          do {
+            int d = c0_ - '0';
+            if (index > 429496729U - ((d > 5) ? 1 : 0)) break;
+            index = (index * 10) + d;
+            Advance();
+          } while (c0_ >= '0' && c0_ <= '9');
+        }
 
-      if (position_ != start_position + 1 && c0_ == '"') {
-        AdvanceSkipWhitespace();
+        if (c0_ == '"') {
+          // Successfully parsed index, parse and store element.
+          AdvanceSkipWhitespace();
 
-        if (c0_ != ':') return ReportUnexpectedCharacter();
-        AdvanceSkipWhitespace();
-        Handle<Object> value = ParseJsonValue();
-        if (value.is_null()) return ReportUnexpectedCharacter();
+          if (c0_ != ':') return ReportUnexpectedCharacter();
+          AdvanceSkipWhitespace();
+          Handle<Object> value = ParseJsonValue();
+          if (value.is_null()) return ReportUnexpectedCharacter();
 
-        JSObject::SetOwnElement(json_object, index, value, kNonStrictMode);
-      } else {
-        position_ = start_position;
+          JSObject::SetOwnElement(json_object, index, value, kNonStrictMode);
+          continue;
+        }
+        // Not an index, fallback to the slow path.
+      }
+
+      position_ = start_position;
 #ifdef DEBUG
-        c0_ = '"';
+      c0_ = '"';
 #endif
 
-        Handle<String> key = ParseJsonSymbol();
-        if (key.is_null() || c0_ != ':') return ReportUnexpectedCharacter();
+      Handle<String> key = ParseJsonSymbol();
+      if (key.is_null() || c0_ != ':') return ReportUnexpectedCharacter();
 
-        AdvanceSkipWhitespace();
-        Handle<Object> value = ParseJsonValue();
-        if (value.is_null()) return ReportUnexpectedCharacter();
+      AdvanceSkipWhitespace();
+      Handle<Object> value = ParseJsonValue();
+      if (value.is_null()) return ReportUnexpectedCharacter();
 
-        if (key->Equals(isolate()->heap()->Proto_symbol())) {
-          prototype = value;
+      if (key->Equals(isolate()->heap()->Proto_symbol())) {
+        prototype = value;
+      } else {
+        if (JSObject::TryTransitionToField(json_object, key)) {
+          int index = json_object->LastAddedFieldIndex();
+          json_object->FastPropertyAtPut(index, *value);
         } else {
-          if (JSObject::TryTransitionToField(json_object, key)) {
-            int index = json_object->LastAddedFieldIndex();
-            json_object->FastPropertyAtPut(index, *value);
-          } else {
-            JSObject::SetLocalPropertyIgnoreAttributes(
-                json_object, key, value, NONE);
-          }
+          JSObject::SetLocalPropertyIgnoreAttributes(
+              json_object, key, value, NONE);
         }
       }
     } while (MatchSkipWhiteSpace(','));

test/mjsunit/regress/regress-crbug-158185.js

+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals("0023456",
+             Object.keys(JSON.parse('{"0023456": 1}'))[0]);
+assertEquals("1234567890123",
+             Object.keys(JSON.parse('{"1234567890123": 1}'))[0]);
+assertEquals("123456789ABCD",
+             Object.keys(JSON.parse('{"123456789ABCD": 1}'))[0]);
+assertEquals("12A",
+             Object.keys(JSON.parse('{"12A": 1}'))[0]);
+
+assertEquals(1, JSON.parse('{"0":1}')[0]);
+assertEquals(undefined, JSON.parse('{"00":1}')[0]);
+