Bug 170442 – Safari 10.1 JSON.parse returns incorrect object for numeric keys with decimal values

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Martin Wiesinger]

Additional invalid key/value pairs are added if the object contains numeric keys with a decimal number for the first two keys whose 1st decimal place isn't 0.

JSON.parse('{"0":97.1,"1000":96.5,"2000":96.1,"3000":97.4,"4000":90.4}')
> {0: 97.1, 1: NaN, 2: NaN, 1000: 96.5, 2000: 96.1, 3000: 97.4, 4000: 90.4}
If these are parseable to integers, this doesn't happen.
JSON.parse('{"0":97.0,"1000":96.0,"2000":96.1,"3000":97.4,"4000":90.4}')
> {0: 97, 1000: 96, 2000: 96.1, 3000: 97.4, 4000: 90.4}
Nor does the problem occur if we replace the numeric values with strings.
JSON.parse('{"0":"97.1","1000":"96.5","2000":"96.1","3000":"97.4","4000":"90.4"}')
> {0: "97.1", 1000: "96.5", 2000: "96.1", 3000: "97.4", 4000: "90.4"}

[Alexey Proskuryakov]

<rdar://problems/31442949>

[GSkachkov]

I can't reproduce this issue on current version of JSC, and it looks like duplicate of the fixed https://bugs.webkit.org/show_bug.cgi?id=164412

[Saam Barati]

(In reply to GSkachkov from comment #2)
> I can't reproduce this issue on current version of JSC, and it looks like
> duplicate of the fixed https://bugs.webkit.org/show_bug.cgi?id=164412

Could you add a test for this to make sure we don't regress it in the future?

[GSkachkov]

Created attachment 307100 [details]
Patch

Added additional tests

[Yusuke Suzuki]

Comment on attachment 307100 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 307100 [details]
Patch

Clearing flags on attachment: 307100

Committed r215360: <http://trac.webkit.org/changeset/215360>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[PiwEL]

It's the same problem even when the first key isn't 0, for JSON.parse and JSON.stringify.

JSON.stringify({ 8: 13.2, 111544: 132})
> "{\"0\":null,\"1\":null,\"2\":null,\"3\":null,\"4\":null,\"5\":null,\"6\":null,\"7\":null,\"8\":13.2,\"111544\":132}"

If these are parseable to integers, this doesn't happen either.
JSON.stringify({ 8: 132, 111544: 132})
> "{\"8\":132,\"111544\":132}"


And in the other way :
JSON.parse("{\"8\":13.2,\"111544\":132}");
> {0: NaN, 1: NaN, 2: NaN, 3: NaN, 4: NaN, 5: NaN, 6: NaN, 7: NaN, 8: 13.2, 111544: 132}

I guess tests for theses cases should also be added, but I'm sorry, I'm new here and I don't know how to do it.

[Saam Barati]

(In reply to PiwEL from comment #8)
> It's the same problem even when the first key isn't 0, for JSON.parse and
> JSON.stringify.
> 
> JSON.stringify({ 8: 13.2, 111544: 132})
> > "{\"0\":null,\"1\":null,\"2\":null,\"3\":null,\"4\":null,\"5\":null,\"6\":null,\"7\":null,\"8\":13.2,\"111544\":132}"
> 
> If these are parseable to integers, this doesn't happen either.
> JSON.stringify({ 8: 132, 111544: 132})
> > "{\"8\":132,\"111544\":132}"
> 
> 
> And in the other way :
> JSON.parse("{\"8\":13.2,\"111544\":132}");
> > {0: NaN, 1: NaN, 2: NaN, 3: NaN, 4: NaN, 5: NaN, 6: NaN, 7: NaN, 8: 13.2, 111544: 132}
> 
> I guess tests for theses cases should also be added, but I'm sorry, I'm new
> here and I don't know how to do it.
Thanks for giving us this test case. We already added a test similar to this.