Correctly handle proxies in JSON.stringify.

src/json-stringifier.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 30 matching lines @@
 
   MaybeObject* Stringify(Handle<Object> object);
 
  private:
   static const int kInitialPartLength = 32;
   static const int kMaxPartLength = 16 * 1024;
   static const int kPartLengthGrowthFactor = 2;
 
   enum Result { UNCHANGED, SUCCESS, EXCEPTION, CIRCULAR, STACK_OVERFLOW };
 
-  template <bool is_ascii> void Extend();
+  void Extend();
 
   void ChangeEncoding();
 
   void ShrinkCurrentPart();
 
   template <bool is_ascii, typename Char>
   INLINE(void Append_(Char c));
 
   template <bool is_ascii, typename Char>
   INLINE(void Append_(const Char* chars));
@@ skipping 13 matching lines @@
       Append_<false>(chars);
     }
   }
 
   Handle<Object> GetProperty(Handle<JSObject> object,
                              Handle<String> key);
 
   Handle<Object> ApplyToJsonFunction(Handle<Object> object,
                                      Handle<Object> key);
 
+  Result SerializeGeneric(Handle<Object> object,
+                          Handle<Object> key,
+                          bool deferred_comma,
+                          bool deferred_key);
+
   // Entry point to serialize the object.
   INLINE(Result SerializeObject(Handle<Object> obj)) {
     return Serialize_<false>(obj, false, isolate_->factory()->empty_string());
   }
 
   // Serialize an array element.
   // The index may serve as argument for the toJSON function.
   INLINE(Result SerializeElement(Handle<Object> object, int i)) {
     return Serialize_<false>(object, false, Handle<Object>(Smi::FromInt(i)));
   }
@@ skipping 144 matching lines @@
 
 template <bool is_ascii, typename Char>
 void BasicJsonStringifier::Append_(Char c) {
   if (is_ascii) {
     SeqAsciiString::cast(*current_part_)->SeqAsciiStringSet(
         current_index_++, c);
   } else {
     SeqTwoByteString::cast(*current_part_)->SeqTwoByteStringSet(
         current_index_++, c);
   }
-  if (current_index_ == part_length_) Extend<is_ascii>();
+  if (current_index_ == part_length_) Extend();
 }
 
 
 template <bool is_ascii, typename Char>
 void BasicJsonStringifier::Append_(const Char* chars) {
   for ( ; *chars != '\0'; chars++) Append_<is_ascii, Char>(*chars);
 }
 
 
 Handle<Object> BasicJsonStringifier::GetProperty(Handle<JSObject> object,
@@ skipping 71 matching lines @@
 
 
 template <bool deferred_string_key>
 BasicJsonStringifier::Result BasicJsonStringifier::Serialize_(
     Handle<Object> object, bool comma, Handle<Object> key) {
   if (object->IsJSObject()) {
     object = ApplyToJsonFunction(object, key);
     if (object.is_null()) return EXCEPTION;
   }
 
-  if (object->IsJSObject()) {
-    if (object->IsJSFunction()) return UNCHANGED;
+  if (object->IsSmi()) {
     if (deferred_string_key) SerializeDeferredKey(comma, key);
-    if (object->IsJSArray()) {
-      return SerializeJSArray(Handle<JSArray>::cast(object));
-    } else if (object->IsJSValue()) {
-      return SerializeJSValue(Handle<JSValue>::cast(object));
-    } else {
-      return SerializeJSObject(Handle<JSObject>::cast(object));
-    }
+    return SerializeSmi(Smi::cast(*object));
   }
 
-  // Handle non-JSObject.
-  if (object->IsString()) {
-    if (deferred_string_key) SerializeDeferredKey(comma, key);
-    SerializeString(Handle<String>::cast(object));
-    return SUCCESS;
-  } else if (object->IsSmi()) {
-    if (deferred_string_key) SerializeDeferredKey(comma, key);
-    return SerializeSmi(Smi::cast(*object));
-  } else if (object->IsHeapNumber()) {
-    if (deferred_string_key) SerializeDeferredKey(comma, key);
-    return SerializeHeapNumber(Handle<HeapNumber>::cast(object));
-  } else if (object->IsOddball()) {
-    switch (Oddball::cast(*object)->kind()) {
-      case Oddball::kFalse:
+  switch (HeapObject::cast(*object)->map()->instance_type()) {
+    case HEAP_NUMBER_TYPE:
+      if (deferred_string_key) SerializeDeferredKey(comma, key);
+      return SerializeHeapNumber(Handle<HeapNumber>::cast(object));
+    case ODDBALL_TYPE:
+      switch (Oddball::cast(*object)->kind()) {
+        case Oddball::kFalse:
+          if (deferred_string_key) SerializeDeferredKey(comma, key);
+          Append("false");
+          return SUCCESS;
+        case Oddball::kTrue:
+          if (deferred_string_key) SerializeDeferredKey(comma, key);
+          Append("true");
+          return SUCCESS;
+        case Oddball::kNull:
+          if (deferred_string_key) SerializeDeferredKey(comma, key);
+          Append("null");
+          return SUCCESS;
+        default:
+          return UNCHANGED;
+      }
+    case JS_ARRAY_TYPE:
+      if (deferred_string_key) SerializeDeferredKey(comma, key);
+      return SerializeJSArray(Handle<JSArray>::cast(object));
+    case JS_VALUE_TYPE:
+      if (deferred_string_key) SerializeDeferredKey(comma, key);
+      return SerializeJSValue(Handle<JSValue>::cast(object));
+    case JS_FUNCTION_TYPE:
+      return UNCHANGED;
+    default:
+      if (object->IsString()) {
         if (deferred_string_key) SerializeDeferredKey(comma, key);
-        Append("false");
+        SerializeString(Handle<String>::cast(object));
         return SUCCESS;
-      case Oddball::kTrue:
+      } else if (object->IsJSObject()) {
         if (deferred_string_key) SerializeDeferredKey(comma, key);
-        Append("true");
-        return SUCCESS;
-      case Oddball::kNull:
-        if (deferred_string_key) SerializeDeferredKey(comma, key);
-        Append("null");
-        return SUCCESS;
-    }
+        return SerializeJSObject(Handle<JSObject>::cast(object));
+      } else {
+        return SerializeGeneric(object, key, comma, deferred_string_key);
+      }
   }
-
-  return UNCHANGED;
 }
 
 
+BasicJsonStringifier::Result BasicJsonStringifier::SerializeGeneric(
+    Handle<Object> object,
+    Handle<Object> key,
+    bool deferred_comma,
+    bool deferred_key) {
+  Handle<JSObject> builtins(isolate_->native_context()->builtins());
+  Handle<JSFunction> builtin = Handle<JSFunction>::cast(
+      v8::internal::GetProperty(builtins, "JSONSerializeAdapter"));
+
+  Handle<Object> argv[] = { key, object };
+  bool has_exception = false;
+  Handle<Object> result =
+      Execution::Call(builtin, object, 2, argv, &has_exception);
+  if (has_exception) return EXCEPTION;
+  if (result->IsUndefined()) return UNCHANGED;
+  if (deferred_key) {
+    if (key->IsSmi()) key = isolate_->factory()->NumberToString(key);
+    SerializeDeferredKey(deferred_comma, key);
+  }
+
+  Handle<String> result_string = Handle<String>::cast(result);
+  // Shrink current part, attach it to the accumulator, also attach the result
+  // string to the accumulator, and allocate a new part.
+  ShrinkCurrentPart();  // Shrink.
+  part_length_ = kInitialPartLength;  // Allocate conservatively.
+  Extend();             // Attach current part and allocate new part.
+  set_accumulator(      // Attach result string to the accumulator.
+      isolate_->factory()->NewConsString(accumulator(), result_string));
+  return SUCCESS;
+}
+
+
 BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSValue(
     Handle<JSValue> object) {
   bool has_exception = false;
   String* class_name = object->class_name();
   if (class_name == isolate_->heap()->String_symbol()) {
     Handle<Object> value = Execution::ToString(object, &has_exception);
     if (has_exception) return EXCEPTION;
     SerializeString(Handle<String>::cast(value));
   } else if (class_name == isolate_->heap()->Number_symbol()) {
     Handle<Object> value = Execution::ToNumber(object, &has_exception);
@@ skipping 178 matching lines @@
   // that are a multiple of pointer size.
   Address end_of_string = current_part_->address() + string_size;
   isolate_->heap()->CreateFillerObjectAt(end_of_string, delta);
   if (Marking::IsBlack(Marking::MarkBitFrom(*current_part_))) {
     MemoryChunk::IncrementLiveBytesFromMutator(
         current_part_->address(), -delta);
   }
 }
 
 
-template <bool is_ascii>
 void BasicJsonStringifier::Extend() {
   set_accumulator(
       isolate_->factory()->NewConsString(accumulator(), current_part_));
   if (part_length_ <= kMaxPartLength / kPartLengthGrowthFactor) {
     part_length_ *= kPartLengthGrowthFactor;
   }
-  if (is_ascii) {
+  if (is_ascii_) {
     current_part_ =
         isolate_->factory()->NewRawAsciiString(part_length_);
   } else {
     current_part_ =
         isolate_->factory()->NewRawTwoByteString(part_length_);
   }
   current_index_ = 0;
 }
 
 
@@ skipping 121 matching lines @@
       SerializeString_<false, char>(flat.ToAsciiVector(), object);
     } else {
       SerializeString_<false, uc16>(flat.ToUC16Vector(), object);
     }
   }
 }
 
 } }  // namespace v8::internal
 
 #endif  // V8_JSON_STRINGIFIER_H_