Bug 28752

Summary: this in JSON.parse reviver is the global object
Product: WebKit Reporter: Luke Smith <lsmith>
Component: JavaScriptCoreAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: oliver
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: OS X 10.5   
URL: http://lucassmith.name/pub/browser_bugs/wk/reviver_this.html
Attachments:
Description Flags
Patch v1
none
Patch v1 barraclough: review+

Luke Smith
Reported 2009-08-26 15:40:38 PDT
ES 5 spec states that the Walk abstract function calls the reviver function's [[Call]] "passing holder as the this value" Currently WebKit's JSON.parse implementation passes the global object as this. Aside from the spec violation, this also prevents the reviver from creating additional properties on the object or referencing other properties of the current object for value determination during parse. Any new properties created are added to the global object. I noted this while reviewing my YUI examples for the JSON Utility (which defers to native implementations if present). http://developer.yahoo.com/yui/examples/json/json_convert_values.html Note: The page behaves correctly because it is either (if viewed before 9/2/09) using version 2.7.0 which is not leveraging native behavior , or it is (if viewed after 9/2/09) using version 2.8.0 and is configured NOT to use native behavior specifically because of this bug.
Attachments
Patch v1 (18.37 KB, patch)
2009-08-26 23:33 PDT, Oliver Hunt 		no flags
DetailsFormatted DiffDiff
Patch v1 (24.36 KB, patch)
2009-08-27 00:59 PDT, Oliver Hunt 		barraclough: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Oliver Hunt
Comment 1 2009-08-26 23:33:35 PDT
Created attachment 38658 [details] Patch v1
Oliver Hunt
Comment 2 2009-08-26 23:48:54 PDT
Comment on attachment 38658 [details] Patch v1 Sam mentioned some issues, and i realised there's an entire class of bug i had failed to notice.
Oliver Hunt
Comment 3 2009-08-27 00:59:24 PDT
Created attachment 38661 [details] Patch v1
Gavin Barraclough
Comment 4 2009-08-27 01:37:00 PDT
Comment on attachment 38661 [details] Patch v1 R+ with exception throw change from IRC.
Oliver Hunt
Comment 5 2009-08-27 01:39:58 PDT
Committed r47812
Mark Rowe (bdash)
Comment 6 2009-08-27 15:54:49 PDT
Should this now be closed?
Note You need to log in before you can comment on or make changes to this bug.