Fix spec violations in JSON.stringify wrt replacer array.

Fix spec violations in JSON.stringify wrt replacer array.


R=verwaest@chromium.org
BUG=v8:3135
LOG=Y

Committed: https://code.google.com/p/v8/source/detail?r=19266

[Toon Verwaest, 2014-02-11 10:14:10]

https://codereview.chromium.org/146623009/diff/60001/src/json.js
File src/json.js (right):

https://codereview.chromium.org/146623009/diff/60001/src/json.js#newcode218
src/json.js:218: // Replace with something better if this becomes a bottleneck.
Just use an object to check properties; eg:
properties = {}; properties[key] = 1; replacer = Object.keys(properties);

Use an array to keep the order if necessary.

[Toon Verwaest, 2014-02-11 10:44:30]

lgtm

[Yang, 2014-02-11 10:45:46]

Committed patchset #3 manually as r19266 (presubmit successful).

[arv (Not doing code reviews), 2014-03-04 19:54:54]

https://codereview.chromium.org/146623009/diff/110001/src/json.js
File src/json.js (right):

https://codereview.chromium.org/146623009/diff/110001/src/json.js#newcode221
src/json.js:221: if (IS_STRING(item) && !(item in seen_properties)) {
Is this correct? What about the overlapping properties from Object.prototype?
Like toString, __proto__ and others.

[arv (Not doing code reviews), 2014-03-04 20:04:23]

We still have a failure in the JSC inherited layout test. I've identified the
failing case and I'll create a patch for it.

https://codereview.chromium.org/146623009/diff/110001/src/json.js
File src/json.js (right):

https://codereview.chromium.org/146623009/diff/110001/src/json.js#newcode221
src/json.js:221: if (IS_STRING(item) && !(item in seen_properties)) {
We are not handling IS_OBJECT correctly here.

http://people.mozilla.org/~jorendorff/es6-draft.html#sec-json.stringify

4. Else if Type(v) is Object then,
  a. If v has a [[StringData]] or [[NumberData]] internal slot, then let item be
ToString(v).

[arv (Not doing code reviews), 2014-03-04 22:42:17]

On 2014/03/04 20:04:23, arv wrote:
> We still have a failure in the JSC inherited layout test. I've identified the
> failing case and I'll create a patch for it.
> 
> https://codereview.chromium.org/146623009/diff/110001/src/json.js
> File src/json.js (right):
> 
> https://codereview.chromium.org/146623009/diff/110001/src/json.js#newcode221
> src/json.js:221: if (IS_STRING(item) && !(item in seen_properties)) {
> We are not handling IS_OBJECT correctly here.
> 
> http://people.mozilla.org/%7Ejorendorff/es6-draft.html#sec-json.stringify
> 
> 4. Else if Type(v) is Object then,
>   a. If v has a [[StringData]] or [[NumberData]] internal slot, then let item
be
> ToString(v).

I took care of this in https://codereview.chromium.org/187053003/