Commit f78bfaa8 authored by yangguo@chromium.org's avatar yangguo@chromium.org

Fix spec violations in JSON.stringify wrt replacer array.

R=verwaest@chromium.org
BUG=v8:3135
LOG=Y

Review URL: https://codereview.chromium.org/146623009

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19266 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
parent d74fd20f
......@@ -210,6 +210,21 @@ function JSONStringify(value, replacer, space) {
} else {
gap = "";
}
if (IS_ARRAY(replacer)) {
// Deduplicate replacer array items.
var property_list = new InternalArray();
var seen_properties = {};
var length = replacer.length;
for (var i = 0; i < length; i++) {
var item = replacer[i];
if (IS_NUMBER(item)) item = %_NumberToString(item);
if (IS_STRING(item) && !(item in seen_properties)) {
property_list.push(item);
seen_properties[item] = true;
}
}
replacer = property_list;
}
return JSONSerialize('', {'': value}, replacer, new InternalArray(), "", gap);
}
......
// Copyright 2014 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Properties are serialized once.
assertEquals('{"x":1}', JSON.stringify({ x : 1 }, ["x", 1, "x", 1]));
assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, ["x", 1, "x", 1]));
assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, ["1", 1, "1", 1]));
assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, [1, "1", 1, "1"]));
// Properties are visited at most once.
var fired = 0;
var getter_obj = { get x() { fired++; return 2; } };
assertEquals('{"x":2}', JSON.stringify(getter_obj, ["x", "y", "x"]));
assertEquals(1, fired);
// Order of the replacer array is followed.
assertEquals('{"y":4,"x":3}', JSON.stringify({ x : 3, y : 4}, ["y", "x"]));
assertEquals('{"y":4,"1":2,"x":3}',
JSON.stringify({ x : 3, y : 4, 1 : 2 }, ["y", 1, "x"]));
// __proto__ is ignored and doesn't break anything.
var a = { x : 8 };
a.__proto__ = { x : 7 };
assertEquals('{"x":8}', JSON.stringify(a, ["__proto__", "x", "__proto__"]));
// Arrays are not affected by the replacer array.
assertEquals("[9,8,7]", JSON.stringify([9, 8, 7], [1, 1]));
var mixed_arr = [11,12,13];
mixed_arr.x = 10;
assertEquals('[11,12,13]', JSON.stringify(mixed_arr, [1, 0, 1]));
// Array elements of objects are affected.
var mixed_obj = { x : 3 };
mixed_obj[0] = 6;
mixed_obj[1] = 5;
assertEquals('{"1":5,"0":6}', JSON.stringify(mixed_obj, [1, 0, 1]));
// Nested object.
assertEquals('{"z":{"x":3},"x":1}',
JSON.stringify({ x: 1, y:2, z: {x:3, b:4}}, ["z","x"]));
// Objects in the replacer array are ignored.
assertEquals('{}',
JSON.stringify({ x : 1, "1": 1 }, [{}]));
assertEquals('{}',
JSON.stringify({ x : 1, "1": 1 }, [true, undefined, null]));
assertEquals('{}',
JSON.stringify({ x : 1, "1": 1 },
[{ toString: function() { return "x";} }]));
assertEquals('{}',
JSON.stringify({ x : 1, "1": 1 },
[{ valueOf: function() { return 1;} }]));
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment