Handle edge cases in basic JSON.stringify.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 28 matching lines @@
  public:
   explicit BasicJsonStringifier(Isolate* isolate);
 
   MaybeObject* Stringify(Handle<Object> object);
 
  private:
   static const int kInitialPartLength = 32;
   static const int kMaxPartLength = 16 * 1024;
   static const int kPartLengthGrowthFactor = 2;
 
-  enum Result { UNCHANGED, SUCCESS, BAILOUT, CIRCULAR, STACK_OVERFLOW };
+  enum Result { UNCHANGED, SUCCESS, EXCEPTION, CIRCULAR, STACK_OVERFLOW };
 
   template <bool is_ascii> void Extend();
 
   void ChangeEncoding();
 
   void ShrinkCurrentPart();
 
   template <bool is_ascii, typename Char>
   INLINE(void Append_(Char c));
 
@@ skipping 12 matching lines @@
     if (is_ascii_) {
       Append_<true>(chars);
     } else {
       Append_<false>(chars);
     }
   }
 
   Handle<Object> GetProperty(Handle<JSObject> object,
                              Handle<String> key);
 
-  bool MayHaveToJsonFunction(Handle<JSObject> object);
+  Handle<Object> ApplyToJsonFunction(Handle<Object> object,
+                                     Handle<Object> key);
 
-  INLINE(Result Serialize(Handle<Object> object)) {
-    return Serialize_<false>(object);
+  // Entry point to serialize the object.
+  INLINE(Result SerializeObject(Handle<Object> obj)) {
+    return Serialize_<false>(obj, false, isolate_->factory()->empty_string());
   }
 
-  INLINE(Result SerializeDeferred(Handle<Object> object,
-                           bool deferred_comma,
-                           Handle<String> deferred_key)) {
+  // Serialize an array element.
+  // The index may serve as argument for the toJSON function.
+  INLINE(Result SerializeElement(Handle<Object> object, int i)) {
+    return Serialize_<false>(object, false, Handle<Object>(Smi::FromInt(i)));
+  }
+
+  // Serialize a object property.
+  // The key may or may not be serialized depending on the property.
+  // The key may also serve as argument for the toJSON function.
+  INLINE(Result SerializeProperty(Handle<Object> object,
+                                  bool deferred_comma,
+                                  Handle<String> deferred_key)) {
     ASSERT(!deferred_key.is_null());
     return Serialize_<true>(object, deferred_comma, deferred_key);
   }
 
-  template <bool deferred_key>
-  Result Serialize_(Handle<Object> object,
-                    bool comma = false,
-                    Handle<String> key = Handle<String>::null());
+  template <bool deferred_string_key>
+  Result Serialize_(Handle<Object> object, bool comma, Handle<Object> key);
 
-  void SerializeDeferredKey(bool deferred_comma, Handle<String> deferred_key) {
+  void SerializeDeferredKey(bool deferred_comma, Handle<Object> deferred_key) {
     if (deferred_comma) Append(',');
-    SerializeString(deferred_key);
+    SerializeString(Handle<String>::cast(deferred_key));
     Append(':');
   }
 
   Result SerializeSmi(Smi* object);
 
   Result SerializeDouble(double number);
   INLINE(Result SerializeHeapNumber(Handle<HeapNumber> object)) {
     return SerializeDouble(object->value());
   }
 
-  INLINE(Result SerializeArray(Handle<JSArray> object));
-  INLINE(Result SerializeObject(Handle<JSObject> object));
+  Result SerializeJSValue(Handle<JSValue> object);
+
+  INLINE(Result SerializeJSArray(Handle<JSArray> object));
+  INLINE(Result SerializeJSObject(Handle<JSObject> object));
+
+  Result SerializeJSArraySlow(Handle<JSArray> object, int length);
 
   void SerializeString(Handle<String> object);
 
   template <typename SrcChar, typename DestChar>
   INLINE(void SerializeStringUnchecked_(const SrcChar* src,
                                         DestChar* dest,
                                         int length));
 
   template <bool is_ascii, typename Char>
   INLINE(void SerializeString_(Vector<const Char> vector,
@@ skipping 75 matching lines @@
       isolate_->factory()->ToObject(isolate_->factory()->empty_string()));
   part_length_ = kInitialPartLength;
   current_part_ =
       isolate_->factory()->NewRawAsciiString(kInitialPartLength);
   tojson_symbol_ = isolate_->factory()->LookupAsciiSymbol("toJSON");
   stack_ = isolate_->factory()->NewJSArray(8);
 }
 
 
 MaybeObject* BasicJsonStringifier::Stringify(Handle<Object> object) {
-  switch (Serialize(object)) {
+  switch (SerializeObject(object)) {
+    case UNCHANGED:
+      return isolate_->heap()->undefined_value();
     case SUCCESS:
       ShrinkCurrentPart();
       return *isolate_->factory()->NewConsString(accumulator(), current_part_);
-    case UNCHANGED:
-      return isolate_->heap()->undefined_value();
     case CIRCULAR:
       return isolate_->Throw(*isolate_->factory()->NewTypeError(
                  "circular_structure", HandleVector<Object>(NULL, 0)));
     case STACK_OVERFLOW:
       return isolate_->StackOverflow();
     default:
-      return Smi::FromInt(0);
+      return Failure::Exception();
   }
 }
 
 
 template <bool is_ascii, typename Char>
 void BasicJsonStringifier::Append_(Char c) {
   if (is_ascii) {
     SeqAsciiString::cast(*current_part_)->SeqAsciiStringSet(
         current_index_++, c);
   } else {
@@ skipping 21 matching lines @@
       ASSERT(!value->IsTheHole());
       return Handle<Object>(value);
     }
     case FIELD: {
       Object* value = lookup.holder()->FastPropertyAt(lookup.GetFieldIndex());
       ASSERT(!value->IsTheHole());
       return Handle<Object>(value);
     }
     case CONSTANT_FUNCTION:
       return Handle<Object>(lookup.GetConstantFunction());
-    case CALLBACKS:
-    case HANDLER:
-    case INTERCEPTOR:
-      return Handle<Object>::null();
-    case TRANSITION:
-    case NONEXISTENT:
-      UNREACHABLE();
-      break;
+    default: {
+      PropertyAttributes attr;
+      return Object::GetProperty(object, object, &lookup, key, &attr);
+    }
   }
   return Handle<Object>::null();
 }
 
 
-bool BasicJsonStringifier::MayHaveToJsonFunction(Handle<JSObject> object) {
+Handle<Object> BasicJsonStringifier::ApplyToJsonFunction(
+    Handle<Object> object, Handle<Object> key) {
   LookupResult lookup(isolate_);
-  object->LookupRealNamedProperty(*tojson_symbol_, &lookup);
-  if (!lookup.IsProperty()) return false;
-  Object* value;
-  switch (lookup.type()) {
-    case NORMAL:
-      value = lookup.holder()->GetNormalizedProperty(&lookup);
-      break;
-    case FIELD:
-      value = lookup.holder()->FastPropertyAt(lookup.GetFieldIndex());
-      break;
-    default:
-      return true;
-  }
-  ASSERT(!value->IsTheHole());
-  return value->IsSpecFunction();
+  JSObject::cast(*object)->LookupRealNamedProperty(*tojson_symbol_, &lookup);
+  if (!lookup.IsProperty()) return object;
+  PropertyAttributes attr;
+  Handle<Object> fun =
+      Object::GetProperty(object, object, &lookup, tojson_symbol_, &attr);
+  if (!fun->IsJSFunction()) return object;
+
+  // Call toJSON function.
+  if (key->IsSmi()) key = isolate_->factory()->NumberToString(key);
+  Handle<Object> argv[] = { key };
+  bool has_exception = false;
+  HandleScope scope(isolate_);
+  object = Execution::Call(fun, object, 1, argv, &has_exception);
+  // Return empty handle to signal an exception.
+  if (has_exception) return Handle<Object>::null();
+  return scope.CloseAndEscape(object);
 }
 
 
 BasicJsonStringifier::Result BasicJsonStringifier::StackPush(
     Handle<Object> object) {
   StackLimitCheck check(isolate_);
   if (check.HasOverflowed()) return STACK_OVERFLOW;
 
   int length = Smi::cast(stack_->length())->value();
   FixedArray* elements = FixedArray::cast(stack_->elements());
   for (int i = 0; i < length; i++) {
     if (elements->get(i) == *object) {
       return CIRCULAR;
     }
   }
   stack_->EnsureSize(length + 1);
   FixedArray::cast(stack_->elements())->set(length, *object);
   stack_->set_length(Smi::FromInt(length + 1));
   return SUCCESS;
 }
 
 
 void BasicJsonStringifier::StackPop() {
   int length = Smi::cast(stack_->length())->value();
   stack_->set_length(Smi::FromInt(length - 1));
 }
 
 
-template <bool deferred_key>
+template <bool deferred_string_key>
 BasicJsonStringifier::Result BasicJsonStringifier::Serialize_(
-    Handle<Object> object, bool comma, Handle<String> key) {
+    Handle<Object> object, bool comma, Handle<Object> key) {
   if (object->IsJSObject()) {
-    // We don't deal with custom toJSON functions.
-    if (MayHaveToJsonFunction(Handle<JSObject>::cast(object))) return BAILOUT;
+    object = ApplyToJsonFunction(object, key);
+    if (object.is_null()) return EXCEPTION;
+  }
 
-    if (object->IsJSFunction()) {
-      return UNCHANGED;
-    } else if (object->IsJSArray()) {
-      if (deferred_key) SerializeDeferredKey(comma, key);
-      return SerializeArray(Handle<JSArray>::cast(object));
+  if (object->IsJSObject()) {
+    if (object->IsJSFunction()) return UNCHANGED;
+    if (deferred_string_key) SerializeDeferredKey(comma, key);
+    if (object->IsJSArray()) {
+      return SerializeJSArray(Handle<JSArray>::cast(object));
     } else if (object->IsJSValue()) {
-      // JSValue with a custom prototype.
-      if (object->GetPrototype()->IsJSReceiver()) return BAILOUT;
-      // Unpack value wrapper and fall through.
-      object = Handle<Object>(JSValue::cast(*object)->value());
+      return SerializeJSValue(Handle<JSValue>::cast(object));
     } else {
-      if (deferred_key) SerializeDeferredKey(comma, key);
-      return SerializeObject(Handle<JSObject>::cast(object));
+      return SerializeJSObject(Handle<JSObject>::cast(object));
     }
   }
 
+  // Handle non-JSObject.
   if (object->IsString()) {
-    if (deferred_key) SerializeDeferredKey(comma, key);
+    if (deferred_string_key) SerializeDeferredKey(comma, key);
     SerializeString(Handle<String>::cast(object));
     return SUCCESS;
   } else if (object->IsSmi()) {
-    if (deferred_key) SerializeDeferredKey(comma, key);
+    if (deferred_string_key) SerializeDeferredKey(comma, key);
     return SerializeSmi(Smi::cast(*object));
   } else if (object->IsHeapNumber()) {
-    if (deferred_key) SerializeDeferredKey(comma, key);
+    if (deferred_string_key) SerializeDeferredKey(comma, key);
     return SerializeHeapNumber(Handle<HeapNumber>::cast(object));
   } else if (object->IsOddball()) {
     switch (Oddball::cast(*object)->kind()) {
       case Oddball::kFalse:
-        if (deferred_key) SerializeDeferredKey(comma, key);
+        if (deferred_string_key) SerializeDeferredKey(comma, key);
         Append("false");
         return SUCCESS;
       case Oddball::kTrue:
-        if (deferred_key) SerializeDeferredKey(comma, key);
+        if (deferred_string_key) SerializeDeferredKey(comma, key);
         Append("true");
         return SUCCESS;
       case Oddball::kNull:
-        if (deferred_key) SerializeDeferredKey(comma, key);
+        if (deferred_string_key) SerializeDeferredKey(comma, key);
         Append("null");
         return SUCCESS;
     }
   }
 
   return UNCHANGED;
 }
 
 
+BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSValue(
+    Handle<JSValue> object) {
+  bool has_exception = false;
+  String* class_name = object->class_name();
+  if (class_name == isolate_->heap()->String_symbol()) {
+    Handle<Object> value = Execution::ToString(object, &has_exception);
+    if (has_exception) return EXCEPTION;
+    SerializeString(Handle<String>::cast(value));
+  } else if (class_name == isolate_->heap()->Number_symbol()) {
+    Handle<Object> value = Execution::ToNumber(object, &has_exception);
+    if (has_exception) return EXCEPTION;
+    if (value->IsSmi()) return SerializeSmi(Smi::cast(*value));
+    SerializeHeapNumber(Handle<HeapNumber>::cast(value));
+  } else {
+    ASSERT(class_name == isolate_->heap()->Boolean_symbol());
+    Object* value = JSValue::cast(*object)->value();
+    ASSERT(value->IsBoolean());
+    Append(value->IsTrue() ? "true" : "false");
+  }
+  return SUCCESS;
+}
+
+
 BasicJsonStringifier::Result BasicJsonStringifier::SerializeSmi(Smi* object) {
   static const int kBufferSize = 100;
   char chars[kBufferSize];
   Vector<char> buffer(chars, kBufferSize);
   Append(IntToCString(object->value(), buffer));
   return SUCCESS;
 }
 
 
 BasicJsonStringifier::Result BasicJsonStringifier::SerializeDouble(
     double number) {
   if (isinf(number) || isnan(number)) {
     Append("null");
     return SUCCESS;
   }
   static const int kBufferSize = 100;
   char chars[kBufferSize];
   Vector<char> buffer(chars, kBufferSize);
   Append(DoubleToCString(number, buffer));
   return SUCCESS;
 }
 
 
-BasicJsonStringifier::Result BasicJsonStringifier::SerializeArray(
+BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSArray(
     Handle<JSArray> object) {
   HandleScope handle_scope(isolate_);
   Result stack_push = StackPush(object);
   if (stack_push != SUCCESS) return stack_push;
   int length = Smi::cast(object->length())->value();
   Append('[');
   switch (object->GetElementsKind()) {
     case FAST_SMI_ELEMENTS: {
-      Handle<FixedArray> elements = Handle<FixedArray>(
-          FixedArray::cast(object->elements()));
+      Handle<FixedArray> elements(FixedArray::cast(object->elements()));
       for (int i = 0; i < length; i++) {
         if (i > 0) Append(',');
         SerializeSmi(Smi::cast(elements->get(i)));
       }
       break;
     }
     case FAST_DOUBLE_ELEMENTS: {
-      Handle<FixedDoubleArray> elements = Handle<FixedDoubleArray>(
+      Handle<FixedDoubleArray> elements(
           FixedDoubleArray::cast(object->elements()));
       for (int i = 0; i < length; i++) {
         if (i > 0) Append(',');
         SerializeDouble(elements->get_scalar(i));
       }
       break;
     }
     case FAST_ELEMENTS: {
-      Handle<FixedArray> elements = Handle<FixedArray>(
-          FixedArray::cast(object->elements()));
+      Handle<FixedArray> elements(FixedArray::cast(object->elements()));
       for (int i = 0; i < length; i++) {
         if (i > 0) Append(',');
-        Result result = Serialize(Handle<Object>(elements->get(i)));
+        Result result = SerializeElement(Handle<Object>(elements->get(i)), i);
         if (result == SUCCESS) continue;
         if (result == UNCHANGED) {
           Append("null");
         } else {
           return result;
         }
       }
       break;
     }
-    default:
-      return BAILOUT;
+    // TODO(yangguo):  The FAST_HOLEY_* cases could be handled in a faster way.
+    // They resemble the non-holey cases except that a prototype chain lookup
+    // is necessary for holes.
+    default: {
+      Result result = SerializeJSArraySlow(object, length);
+      if (result != SUCCESS) return result;
+      break;
+    }
   }
   Append(']');
   StackPop();
   current_part_ = handle_scope.CloseAndEscape(current_part_);
   return SUCCESS;
 }
 
 
-BasicJsonStringifier::Result BasicJsonStringifier::SerializeObject(
+BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSArraySlow(
+    Handle<JSArray> object, int length) {
+  for (int i = 0; i < length; i++) {
+    if (i > 0) Append(',');
+    Handle<Object> element = Object::GetElement(object, i);
+    if (element->IsUndefined()) {
+      Append("null");
+    } else {
+      Result result = SerializeElement(element, i);
+      if (result == SUCCESS) continue;
+      if (result == UNCHANGED) {
+        Append("null");
+      } else {
+        return result;
+      }
+    }
+  }
+  return SUCCESS;
+}
+
+
+BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSObject(
     Handle<JSObject> object) {
   HandleScope handle_scope(isolate_);
   Result stack_push = StackPush(object);
   if (stack_push != SUCCESS) return stack_push;
-  if (object->IsJSGlobalProxy()) return BAILOUT;
-  bool threw = false;
+  if (object->IsJSGlobalProxy()) {
+    object = Handle<JSObject>(JSObject::cast(object->GetPrototype()));
+    ASSERT(object->IsGlobalObject());
+  }
+  bool has_exception = false;
   Handle<FixedArray> contents =
-      GetKeysInFixedArrayFor(object, LOCAL_ONLY, &threw);
-  if (threw) return BAILOUT;
+      GetKeysInFixedArrayFor(object, LOCAL_ONLY, &has_exception);
+  if (has_exception) return EXCEPTION;
   Append('{');
   bool comma = false;
   for (int i = 0; i < contents->length(); i++) {
     Object* key = contents->get(i);
     Handle<String> key_handle;
     Handle<Object> property;
     if (key->IsString()) {
       key_handle = Handle<String>(String::cast(key));
       property = GetProperty(object, key_handle);
     } else {
       ASSERT(key->IsNumber());
       key_handle = isolate_->factory()->NumberToString(Handle<Object>(key));
       uint32_t index;
       if (key->IsSmi()) {
         property = Object::GetElement(object, Smi::cast(key)->value());
       } else if (key_handle->AsArrayIndex(&index)) {
         property = Object::GetElement(object, index);
       } else {
         property = GetProperty(object, key_handle);
       }
     }
-    if (property.is_null()) return BAILOUT;
-    Result result = SerializeDeferred(property, comma, key_handle);
+    if (property.is_null()) return EXCEPTION;
+    Result result = SerializeProperty(property, comma, key_handle);
     if (!comma && result == SUCCESS) comma = true;
-    if (result >= BAILOUT) return result;
+    if (result >= EXCEPTION) return result;
   }
   Append('}');
   StackPop();
   current_part_ = handle_scope.CloseAndEscape(current_part_);
   return SUCCESS;
 }
 
 
 void BasicJsonStringifier::ShrinkCurrentPart() {
   ASSERT(current_index_ < part_length_);
@@ skipping 167 matching lines @@
       SerializeString_<false, char>(flat.ToAsciiVector(), object);
     } else {
       SerializeString_<false, uc16>(flat.ToUC16Vector(), object);
     }
   }
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_STRINGIFIER_H_