[Webkit-unassigned] [Bug 33053] JSON.stringify and JSON.parse implementations needlessly process properties in the prototype chain

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Mon Jan 4 03:29:19 PST 2010


https://bugs.webkit.org/show_bug.cgi?id=33053





--- Comment #9 from Kent Hansen <kent.hansen at nokia.com>  2010-01-04 03:29:19 PST ---
(In reply to comment #8)
> Looks like a bug in the for..in implementation.
> 
> ES5 section 12.6.4 states that "if new properties are added to the object being
> enumerated during enumeration, the newly added properties are guaranteed not to
> be visited in the active enumeration."

Ugh, I was looking at a previous draft of the spec. In the final draft, the
order of "guaranteed" and "not" has been swapped again, back to how it was in
ES3 (makes a big difference, huh!):

http://www.mail-archive.com/es-discuss@mozilla.org/msg03118.html

So arguably json2.js is buggy because it relies on non-standard behavior.
Ideally building the property list and stringifying the values should be
decoupled, like it is in the ES5 algorithm. It'd be nice to have a test that
sanctions this for-in behavior in JSC, though.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list