Closed Bug 512447 Opened 12 years ago Closed 11 years ago

JSON.stringify does not correct handle replacer functions

Categories

(Core :: JavaScript Engine, defect)

defect
Not set
normal

Tracking

()

RESOLVED FIXED
Tracking Status
blocking2.0 --- beta1+

People

(Reporter: oliver, Assigned: wesongathedeveloper)

References

()

Details

Attachments

(1 file, 2 obsolete files)

User-Agent:       Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6; en-us) AppleWebKit/531.5 (KHTML, like Gecko) Version/4.0.3 Safari/531.7
Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6; en-us) AppleWebKit/531.5 (KHTML, like Gecko) Version/4.0.3 Safari/531.7 Build Identifier: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.3a1pre) Gecko/20090824 Minefield/3.7a1pre

The linked test case shows that spidermonkey's JSON object is not detecting the cyclic object being returned by the reviver function

Reproducible: Always

Steps to Reproduce:
1. Run the testcase at http://trac.webkit.org/export/47743/trunk/LayoutTests/fast/js/JSON-stringify-replacer.html
2.  Note the last 3 failures
Actual Results:  
The JSON object should be throwing an exception due to the infinite recursion, but is not.

Expected Results:  
All the tests should pass.
Status: UNCONFIRMED → NEW
Ever confirmed: true
Attached patch Patch v1 (obsolete) — Splinter Review
Am I correct in assuming that a test for this should be added to /dom/src/json/test/unit/test_replacer.js
Assignee: general → wesongathedeveloper
Status: NEW → ASSIGNED
Attachment #401365 - Flags: review?(sayrer)
Attached patch Patch (obsolete) — Splinter Review
Attachment #401365 - Attachment is obsolete: true
Attachment #405719 - Flags: review?(sayrer)
Attachment #401365 - Flags: review?(sayrer)
I'll get to these JSON patches soon. thanks for them!
Attached patch PatchSplinter Review
Applies cleanly
Attachment #405719 - Attachment is obsolete: true
Attachment #417298 - Flags: review?(sayrer)
Attachment #405719 - Flags: review?(sayrer)
Summary: JSON.stringify does not correct handle replacer functions that produce infinitely recursive objects → JSON.stringify does not correct handle replacer functions
Comment on attachment 417298 [details] [diff] [review]
Patch

Does this regress bug 493586?  My mind is still grappling a little with the streamingness of SpiderMonkey's implementation versus the spec's from-building-blocks method, but I think it does.
Requesting blocking as way of checking to see that this is on some one's todo list.
blocking2.0: --- → ?
blocking2.0: ? → beta1+
(In reply to comment #5)
> (From update of attachment 417298 [details] [diff] [review])
> Does this regress bug 493586?  My mind is still grappling a little with the
> streamingness of SpiderMonkey's implementation versus the spec's
> from-building-blocks method, but I think it does.

I just verified that all JSON xpcshell tests pass with this patch (including the one added in bug 493586). Not sure if there's something else I'm missing.
Sayre, can we just knock this one out?
Or push it off to beta2? Not sure what the consequence of this not being in b1 is ...
Attachment #417298 - Flags: review?(sayrer) → review+
http://hg.mozilla.org/mozilla-central/rev/42371f85bbfb
Status: ASSIGNED → RESOLVED
Closed: 11 years ago
Resolution: --- → FIXED
Depends on: 636079
You need to log in before you can comment on or make changes to this bug.