ES 5 spec states that the Walk abstract function calls the reviver function's [[Call]] "passing holder as the this value" Currently WebKit's JSON.parse implementation passes the global object as this. Aside from the spec violation, this also prevents the reviver from creating additional properties on the object or referencing other properties of the current object for value determination during parse. Any new properties created are added to the global object. I noted this while reviewing my YUI examples for the JSON Utility (which defers to native implementations if present). http://developer.yahoo.com/yui/examples/json/json_convert_values.html Note: The page behaves correctly because it is either (if viewed before 9/2/09) using version 2.7.0 which is not leveraging native behavior , or it is (if viewed after 9/2/09) using version 2.8.0 and is configured NOT to use native behavior specifically because of this bug.
Created attachment 38658 [details] Patch v1
Comment on attachment 38658 [details] Patch v1 Sam mentioned some issues, and i realised there's an entire class of bug i had failed to notice.
Created attachment 38661 [details] Patch v1
Comment on attachment 38661 [details] Patch v1 R+ with exception throw change from IRC.
Committed r47812
Should this now be closed?