Bug 143511 - JSON.stringify hanging WebKit on a cyclic structure
Summary: JSON.stringify hanging WebKit on a cyclic structure
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Macintosh Intel OS X 10.10
: P2 Major
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2015-04-07 21:16 PDT by Chris J. Shull
Modified: 2015-04-09 16:38 PDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Chris J. Shull 2015-04-07 21:16:02 PDT
The following line of code will hang WebKit. 
Don't even get a "Maximum call stack size exceeded" error.

JSON.stringify({ toJSON: function () { return { foo: this }; } });

Reproduces in Safari Version 8.0.5 (10600.5.9), as well as nightly build r182472.

Expected: a "TypeError: JSON.stringify cannot serialize cyclic structures." should be thrown.
Comment 1 Geoffrey Garen 2015-04-09 16:36:05 PDT
Two problems here:

(1) The stringifier checks for recursion, but not inside appendNextProperty.

(2) The recursion check walks the whole stack, so it is worst case O(N^2). We should use a hash instead.
Comment 2 Radar WebKit Bug Importer 2015-04-09 16:38:57 PDT
<rdar://problem/20491535>