Bug 28752 – this in JSON.parse reviver is the global object

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Luke Smith]

ES 5 spec states that the Walk abstract function calls the reviver function's [[Call]] "passing holder as the this value"

Currently WebKit's JSON.parse implementation passes the global object as this.

Aside from the spec violation, this also prevents the reviver from creating additional properties on the object or referencing other properties of the current object for value determination during parse.  Any new properties created are added to the global object.

I noted this while reviewing my YUI examples for the JSON Utility (which defers to native implementations if present).
http://developer.yahoo.com/yui/examples/json/json_convert_values.html

Note: The page behaves correctly because it is either (if viewed before 9/2/09) using version 2.7.0 which is not leveraging native behavior , or it is (if viewed after 9/2/09) using version 2.8.0 and is configured NOT to use native behavior specifically because of this bug.

[Oliver Hunt]

Created attachment 38658 [details]
Patch v1

[Oliver Hunt]

Comment on attachment 38658 [details]
Patch v1

Sam mentioned some issues, and i realised there's an entire class of bug i had failed to notice.

[Oliver Hunt]

Created attachment 38661 [details]
Patch v1

[Gavin Barraclough]

Comment on attachment 38661 [details]
Patch v1

R+ with exception throw change from IRC.

[Oliver Hunt]

Committed r47812

[Mark Rowe (bdash)]

Should this now be closed?