-
Notifications
You must be signed in to change notification settings - Fork 846
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
An issue about JSON.stringify #725
Comments
By the way -- I appreciate all the tricky but important bugs you are finding. (I also appreciate @rbri for fixing them!) Who or what is "NWU NISL?" Are you a professional, a student, a research project... I'm just curious what methodology you are using to find these. |
We are a Chinese research group, and we use fuzz testing to find bugs of JS engines. |
I found a similar problem with the replacer argument but with slightly different output. I'm using Rhino with ES6 (language version 200) but also tested with lower version 160. I experienced a bug in Rhino with https://js.do/code/rhino-issue-object-keys-stringnumber-keys Summary: var obj1 = {"2":"b","3":"c","1":"a"};
JSON.stringify(obj1, ["1","2","3"]); // returns {} in Rhino but works in JS returning {"1":"a","2":"b","3":"c"}
JSON.stringify(obj1, [1,2,3]) // returns {"1.0":"a","2":"b","3":"c"} in Rhino but works in JS returning {"1":"a","2":"b","3":"c"} It seems like Rhino treats object property names that are stringified numbers as float types instead of strings and as a result the comparison against an array of strings fails. In addition, a comparison against an array of integer numbers succeeds... at least almost because the result is an object having property names of type "stringified floats". |
Just figured out that the trick using an array of integers instead of an array of strings also has a bug for object property name This doesn't happen for stringified numbers other than one: But anyway this trick is a no-go... |
- per spec, Numbers in an array replacer should be converted to strings prior to adding to the property list - Changed some List objects to Collections because that's is sufficient for how they are being used - This allowed the property list to be changed to a LinkedHashSet, which satisfies the requirements for not adding duplicate items to the list and retains insert order - Uses the proper index when getting properties with integer keys
- Per spec, Numbers in an array replacer should be converted to strings prior to adding to the property list - Duplicates should be removed during construction of the property list - Changed some variables declared as List to Collection instead because that is sufficient for how they are being used - Moved List to array conversion from happening in every iteration of the jo method to being called once in the stringify method - Convert strings items representing integers to their Integer value for correct property lookup
- Per spec, Numbers in an array replacer should be converted to strings prior to adding to the property list - Duplicates should be removed during construction of the property list - Changed some variables declared as List to Collection instead because that is sufficient for how they are being used - Moved List to array conversion from happening in every iteration of the jo method to being called once in the stringify method - Convert strings items representing integers to their Integer value for correct property lookup
- Per spec, Numbers in an array replacer should be converted to strings prior to adding to the property list - Duplicates should be removed during construction of the property list - Changed some variables declared as List to Collection instead because that is sufficient for how they are being used - Moved List to array conversion from happening in every iteration of the jo method to being called once in the stringify method - Convert strings items representing integers to their Integer value for correct property lookup
Version
rhino-1.7.12
Test case
Execution steps
java -jar rhino/rhino-1.7.12.jar -debug -version 200 testcase.js
Output
Expected behavior
Description
The
JSON.stringify(value[, replacer[, space]])
method converts a JavaScript object or value to a JSON string, optionally including only the specified properties if a replacer array is specified, and the ES standard specifies that the output attributes should not contain duplicate attributes. When executing this test case, rhino has two problems: the first is that the attribute named by numeric characters cannot be output, and the second is to repeatedly output the same attribute.contributor: @Wen Yi
The text was updated successfully, but these errors were encountered: