504443 - javascript: A replacer passed to JSON.stringify() should be able to change the object type

Status: RESOLVED WORKSFORME

(Core :: JavaScript Engine, defect)

Description

[Offir Bakshitz]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)

Invoking the ffbug() function below. The alert() should not be called.
Actual result: the alert() is called.
Workaround: see in the code comments

    <script type="text/javascript" language="javascript">
        function dateReviver(key, value) {
            if ((value !== null) && (value !== undefined)) {
                var dt = value['$date'];
                if ((dt !== null) && (dt !== undefined)) {
                    return new Date(dt);
                }
            }
            return value;
        }

        function dateReplacer(key, value) {
            var v = this[key];
            if ((value !== v) && (value !== v)) {
                if (v instanceof Date) {
                    var obj = {};
                    obj['$date'] = (v).getTime();
                    //this[key] = obj; // work around the bug by modifying the serialized object
                    return obj;
                }
            }
            return value;
        }

        function ffbug() {
            var dob = new Date();
            var o = {
                "name": "John",
                "dob": dob
            };
            var s = JSON.stringify(o, dateReplacer);
            var o2 = JSON.parse(s, dateReviver);
            if ( (!(o2.dob instanceof Date)) || o2.dob.getTime() !== dob.getTime()) {
                alert('bug');                
            }
        }       
    </script>

Reproducible: Always

Steps to Reproduce:
1. define a replacer(key, value) function that replaces instances of a Date with an object (see dateReplacer() in the details section) when used in a call to JSON.stringify()
2. invoke JSON.parse() with a reviver(key, value) that detects the replaced object and generates back the date [see details section]

Actual Results:  
The instance of Date that is replaced by an instance of an object by the replacer is not actually replaced.

Expected Results:  
The Date instance will be replaced with an object instance correctly.

The workaround (see in the Details section) is that the replacer can change the original object being stringified (by accessing the 'this' reference).
This is unacceptable since code that calls JSON.stringify() do not expect the serialized object to change.

Note that IE8 and JSON.org implementations work correctly.

Comment 1

[Offir Bakshitz]

There is a minor typo in the details section above (in the dateReplacer function). Here is a fix for the typo - but the bug occurs regardless of the typo:

if ((value !== v) && (value !== v))

should have been

if ((null !== v) && (undefined !== v))

[The bug reproduces regardless]

Comment 2

[Evan Shaw]

I cannot reproduce this bug in Firefox 25. I think it was fixed at some point.