Skip to content

Commit

Permalink
deps: backport 6df9a1d from upstream v8
Browse files Browse the repository at this point in the history
PR-URL: nodejs-private/node-private#6
Reviewed-By: Fedor Indutny <[email protected]>
  • Loading branch information
bnoordhuis authored and rvagg committed Dec 3, 2015
1 parent 12e70fa commit 76a552c
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 48 deletions.
50 changes: 2 additions & 48 deletions deps/v8/src/json-stringifier.h
Original file line number Diff line number Diff line change
Expand Up @@ -434,54 +434,8 @@ BasicJsonStringifier::Result BasicJsonStringifier::SerializeJSArray(
uint32_t length = 0;
CHECK(object->length()->ToArrayLength(&length));
builder_.AppendCharacter('[');
switch (object->GetElementsKind()) {
case FAST_SMI_ELEMENTS: {
Handle<FixedArray> elements(
FixedArray::cast(object->elements()), isolate_);
for (uint32_t i = 0; i < length; i++) {
if (i > 0) builder_.AppendCharacter(',');
SerializeSmi(Smi::cast(elements->get(i)));
}
break;
}
case FAST_DOUBLE_ELEMENTS: {
// Empty array is FixedArray but not FixedDoubleArray.
if (length == 0) break;
Handle<FixedDoubleArray> elements(
FixedDoubleArray::cast(object->elements()), isolate_);
for (uint32_t i = 0; i < length; i++) {
if (i > 0) builder_.AppendCharacter(',');
SerializeDouble(elements->get_scalar(i));
}
break;
}
case FAST_ELEMENTS: {
Handle<FixedArray> elements(
FixedArray::cast(object->elements()), isolate_);
for (uint32_t i = 0; i < length; i++) {
if (i > 0) builder_.AppendCharacter(',');
Result result =
SerializeElement(isolate_,
Handle<Object>(elements->get(i), isolate_),
i);
if (result == SUCCESS) continue;
if (result == UNCHANGED) {
builder_.AppendCString("null");
} else {
return result;
}
}
break;
}
// TODO(yangguo): The FAST_HOLEY_* cases could be handled in a faster way.
// They resemble the non-holey cases except that a prototype chain lookup
// is necessary for holes.
default: {
Result result = SerializeJSArraySlow(object, length);
if (result != SUCCESS) return result;
break;
}
}
Result result = SerializeJSArraySlow(object, length);
if (result != SUCCESS) return result;
builder_.AppendCharacter(']');
StackPop();
return SUCCESS;
Expand Down
12 changes: 12 additions & 0 deletions deps/v8/test/mjsunit/regress/regress-crbug-554946.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

var array = [];
var funky = {
toJSON: function() { array.length = 1; return "funky"; }
};
for (var i = 0; i < 10; i++) array[i] = i;
array[0] = funky;
assertEquals('["funky",null,null,null,null,null,null,null,null,null]',
JSON.stringify(array));

0 comments on commit 76a552c

Please sign in to comment.