X-Git-Url: https://git.saurik.com/apple/javascriptcore.git/blobdiff_plain/ba379fdc102753d6be2c4d937058fe40257329fe..6fe7ccc865dc7d7541b93c5bcaf6368d2c98a174:/runtime/JSONObject.cpp

diff --git a/runtime/JSONObject.cpp b/runtime/JSONObject.cpp
index 4a89c55..436e783 100644
--- a/runtime/JSONObject.cpp
+++ b/runtime/JSONObject.cpp
@@ -30,16 +30,23 @@
 #include "Error.h"
 #include "ExceptionHelpers.h"
 #include "JSArray.h"
+#include "JSGlobalObject.h"
 #include "LiteralParser.h"
+#include "Local.h"
+#include "LocalScope.h"
+#include "Lookup.h"
 #include "PropertyNameArray.h"
+#include "UStringBuilder.h"
+#include "UStringConcatenate.h"
 #include <wtf/MathExtras.h>
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSONObject);
+ASSERT_HAS_TRIVIAL_DESTRUCTOR(JSONObject);
 
-static JSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState*, JSObject*, JSValue, const ArgList&);
-static JSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState*, JSObject*, JSValue, const ArgList&);
+static EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState*);
+static EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState*);
 
 }
 
@@ -47,6 +54,17 @@ static JSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState*, JSObject*, JSVal
 
 namespace JSC {
 
+JSONObject::JSONObject(JSGlobalObject* globalObject, Structure* structure)
+    : JSNonFinalObject(globalObject->globalData(), structure)
+{
+}
+
+void JSONObject::finishCreation(JSGlobalObject* globalObject)
+{
+    Base::finishCreation(globalObject->globalData());
+    ASSERT(inherits(&s_info));
+}
+
 // PropertyNameForFunctionCall objects must be on the stack, since the JSValue that they create is not marked.
 class PropertyNameForFunctionCall {
 public:
@@ -61,27 +79,25 @@ private:
     mutable JSValue m_value;
 };
 
-class Stringifier : Noncopyable {
+class Stringifier {
+    WTF_MAKE_NONCOPYABLE(Stringifier);
 public:
-    Stringifier(ExecState*, JSValue replacer, JSValue space);
-    ~Stringifier();
-    JSValue stringify(JSValue);
+    Stringifier(ExecState*, const Local<Unknown>& replacer, const Local<Unknown>& space);
+    Local<Unknown> stringify(Handle<Unknown>);
 
-    void mark();
+    void visitAggregate(SlotVisitor&);
 
 private:
-    typedef UString StringBuilder;
-
     class Holder {
     public:
-        Holder(JSObject*);
+        Holder(JSGlobalData&, JSObject*);
 
-        JSObject* object() const { return m_object; }
+        JSObject* object() const { return m_object.get(); }
 
-        bool appendNextProperty(Stringifier&, StringBuilder&);
+        bool appendNextProperty(Stringifier&, UStringBuilder&);
 
     private:
-        JSObject* const m_object;
+        Local<JSObject> m_object;
         const bool m_isArray;
         bool m_isJSArray;
         unsigned m_index;
@@ -91,28 +107,26 @@ private:
 
     friend class Holder;
 
-    static void appendQuotedString(StringBuilder&, const UString&);
+    static void appendQuotedString(UStringBuilder&, const UString&);
 
     JSValue toJSON(JSValue, const PropertyNameForFunctionCall&);
 
     enum StringifyResult { StringifyFailed, StringifySucceeded, StringifyFailedDueToUndefinedValue };
-    StringifyResult appendStringifiedValue(StringBuilder&, JSValue, JSObject* holder, const PropertyNameForFunctionCall&);
+    StringifyResult appendStringifiedValue(UStringBuilder&, JSValue, JSObject* holder, const PropertyNameForFunctionCall&);
 
     bool willIndent() const;
     void indent();
     void unindent();
-    void startNewLine(StringBuilder&) const;
+    void startNewLine(UStringBuilder&) const;
 
-    Stringifier* const m_nextStringifierToMark;
     ExecState* const m_exec;
-    const JSValue m_replacer;
+    const Local<Unknown> m_replacer;
     bool m_usingArrayReplacer;
     PropertyNameArray m_arrayReplacerPropertyNames;
     CallType m_replacerCallType;
     CallData m_replacerCallData;
     const UString m_gap;
 
-    HashSet<JSObject*> m_holderCycleDetector;
     Vector<Holder, 16> m_holderStack;
     UString m_repeatedGap;
     UString m_indent;
@@ -120,38 +134,47 @@ private:
 
 // ------------------------------ helper functions --------------------------------
 
-static inline JSValue unwrapBoxedPrimitive(JSValue value)
+static inline JSValue unwrapBoxedPrimitive(ExecState* exec, JSValue value)
 {
     if (!value.isObject())
         return value;
-    if (!asObject(value)->inherits(&NumberObject::info) && !asObject(value)->inherits(&StringObject::info) && !asObject(value)->inherits(&BooleanObject::info))
-        return value;
-    return static_cast<JSWrapperObject*>(asObject(value))->internalValue();
+    JSObject* object = asObject(value);
+    if (object->inherits(&NumberObject::s_info))
+        return jsNumber(object->toNumber(exec));
+    if (object->inherits(&StringObject::s_info))
+        return object->toString(exec);
+    if (object->inherits(&BooleanObject::s_info))
+        return object->toPrimitive(exec);
+    return value;
 }
 
-static inline UString gap(JSValue space)
+static inline UString gap(ExecState* exec, JSValue space)
 {
-    space = unwrapBoxedPrimitive(space);
+    const unsigned maxGapLength = 10;
+    space = unwrapBoxedPrimitive(exec, space);
 
     // If the space value is a number, create a gap string with that number of spaces.
-    double spaceCount;
-    if (space.getNumber(spaceCount)) {
-        const int maxSpaceCount = 100;
+    if (space.isNumber()) {
+        double spaceCount = space.asNumber();
         int count;
-        if (spaceCount > maxSpaceCount)
-            count = maxSpaceCount;
+        if (spaceCount > maxGapLength)
+            count = maxGapLength;
         else if (!(spaceCount > 0))
             count = 0;
         else
             count = static_cast<int>(spaceCount);
-        UChar spaces[maxSpaceCount];
+        UChar spaces[maxGapLength];
         for (int i = 0; i < count; ++i)
             spaces[i] = ' ';
         return UString(spaces, count);
     }
 
     // If the space value is a string, use it as the gap string, otherwise use no gap string.
-    return space.getString();
+    UString spaces = space.getString(exec);
+    if (spaces.length() > maxGapLength) {
+        spaces = spaces.substringSharingImpl(0, maxGapLength);
+    }
+    return spaces;
 }
 
 // ------------------------------ PropertyNameForFunctionCall --------------------------------
@@ -173,94 +196,67 @@ JSValue PropertyNameForFunctionCall::value(ExecState* exec) const
         if (m_identifier)
             m_value = jsString(exec, m_identifier->ustring());
         else
-            m_value = jsNumber(exec, m_number);
+            m_value = jsNumber(m_number);
     }
     return m_value;
 }
 
 // ------------------------------ Stringifier --------------------------------
 
-Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
-    : m_nextStringifierToMark(exec->globalData().firstStringifierToMark)
-    , m_exec(exec)
+Stringifier::Stringifier(ExecState* exec, const Local<Unknown>& replacer, const Local<Unknown>& space)
+    : m_exec(exec)
     , m_replacer(replacer)
     , m_usingArrayReplacer(false)
     , m_arrayReplacerPropertyNames(exec)
     , m_replacerCallType(CallTypeNone)
-    , m_gap(gap(space))
+    , m_gap(gap(exec, space.get()))
 {
-    exec->globalData().firstStringifierToMark = this;
-
     if (!m_replacer.isObject())
         return;
 
-    if (asObject(m_replacer)->inherits(&JSArray::info)) {
+    if (m_replacer.asObject()->inherits(&JSArray::s_info)) {
         m_usingArrayReplacer = true;
-        JSObject* array = asObject(m_replacer);
+        Handle<JSObject> array = m_replacer.asObject();
         unsigned length = array->get(exec, exec->globalData().propertyNames->length).toUInt32(exec);
         for (unsigned i = 0; i < length; ++i) {
             JSValue name = array->get(exec, i);
             if (exec->hadException())
                 break;
-            UString propertyName;
-            if (!name.getString(propertyName))
-                continue;
-            if (exec->hadException())
-                return;
-            m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
-        }
-        return;
-    }
 
-    m_replacerCallType = asObject(m_replacer)->getCallData(m_replacerCallData);
-}
-
-Stringifier::~Stringifier()
-{
-    ASSERT(m_exec->globalData().firstStringifierToMark == this);
-    m_exec->globalData().firstStringifierToMark = m_nextStringifierToMark;
-}
+            if (name.isObject()) {
+                if (!asObject(name)->inherits(&NumberObject::s_info) && !asObject(name)->inherits(&StringObject::s_info))
+                    continue;
+            }
 
-void Stringifier::mark()
-{
-    for (Stringifier* stringifier = this; stringifier; stringifier = stringifier->m_nextStringifierToMark) {
-        size_t size = m_holderStack.size();
-        for (size_t i = 0; i < size; ++i) {
-            JSObject* object = m_holderStack[i].object();
-            if (!object->marked())
-                object->mark();
+            m_arrayReplacerPropertyNames.add(Identifier(exec, name.toString(exec)->value(exec)));
         }
+        return;
     }
+
+    m_replacerCallType = m_replacer.asObject()->methodTable()->getCallData(m_replacer.asObject().get(), m_replacerCallData);
 }
 
-JSValue Stringifier::stringify(JSValue value)
+Local<Unknown> Stringifier::stringify(Handle<Unknown> value)
 {
     JSObject* object = constructEmptyObject(m_exec);
     if (m_exec->hadException())
-        return jsNull();
+        return Local<Unknown>(m_exec->globalData(), jsNull());
 
     PropertyNameForFunctionCall emptyPropertyName(m_exec->globalData().propertyNames->emptyIdentifier);
-    object->putDirect(m_exec->globalData().propertyNames->emptyIdentifier, value);
+    object->putDirect(m_exec->globalData(), m_exec->globalData().propertyNames->emptyIdentifier, value.get());
 
-    StringBuilder result;
-    if (appendStringifiedValue(result, value, object, emptyPropertyName) != StringifySucceeded)
-        return jsUndefined();
+    UStringBuilder result;
+    if (appendStringifiedValue(result, value.get(), object, emptyPropertyName) != StringifySucceeded)
+        return Local<Unknown>(m_exec->globalData(), jsUndefined());
     if (m_exec->hadException())
-        return jsNull();
+        return Local<Unknown>(m_exec->globalData(), jsNull());
 
-    return jsString(m_exec, result);
+    return Local<Unknown>(m_exec->globalData(), jsString(m_exec, result.toUString()));
 }
 
-void Stringifier::appendQuotedString(StringBuilder& builder, const UString& value)
+template <typename CharType>
+static void appendStringToUStringBuilder(UStringBuilder& builder, const CharType* data, int length)
 {
-    int length = value.size();
-
-    // String length plus 2 for quote marks plus 8 so we can accomodate a few escaped characters.
-    builder.reserveCapacity(builder.size() + length + 2 + 8);
-
-    builder.append('"');
-
-    const UChar* data = value.data();
     for (int i = 0; i < length; ++i) {
         int start = i;
         while (i < length && (data[i] > 0x1F && data[i] != '"' && data[i] != '\\'))
@@ -269,42 +265,54 @@ void Stringifier::appendQuotedString(StringBuilder& builder, const UString& valu
         if (i >= length)
             break;
         switch (data[i]) {
-            case '\t':
-                builder.append('\\');
-                builder.append('t');
-                break;
-            case '\r':
-                builder.append('\\');
-                builder.append('r');
-                break;
-            case '\n':
-                builder.append('\\');
-                builder.append('n');
-                break;
-            case '\f':
-                builder.append('\\');
-                builder.append('f');
-                break;
-            case '\b':
-                builder.append('\\');
-                builder.append('b');
-                break;
-            case '"':
-                builder.append('\\');
-                builder.append('"');
-                break;
-            case '\\':
-                builder.append('\\');
-                builder.append('\\');
-                break;
-            default:
-                static const char hexDigits[] = "0123456789abcdef";
-                UChar ch = data[i];
-                UChar hex[] = { '\\', 'u', hexDigits[(ch >> 12) & 0xF], hexDigits[(ch >> 8) & 0xF], hexDigits[(ch >> 4) & 0xF], hexDigits[ch & 0xF] };
-                builder.append(hex, sizeof(hex) / sizeof(UChar));
-                break;
+        case '\t':
+            builder.append('\\');
+            builder.append('t');
+            break;
+        case '\r':
+            builder.append('\\');
+            builder.append('r');
+            break;
+        case '\n':
+            builder.append('\\');
+            builder.append('n');
+            break;
+        case '\f':
+            builder.append('\\');
+            builder.append('f');
+            break;
+        case '\b':
+            builder.append('\\');
+            builder.append('b');
+            break;
+        case '"':
+            builder.append('\\');
+            builder.append('"');
+            break;
+        case '\\':
+            builder.append('\\');
+            builder.append('\\');
+            break;
+        default:
+            static const char hexDigits[] = "0123456789abcdef";
+            UChar ch = data[i];
+            LChar hex[] = { '\\', 'u', hexDigits[(ch >> 12) & 0xF], hexDigits[(ch >> 8) & 0xF], hexDigits[(ch >> 4) & 0xF], hexDigits[ch & 0xF] };
+            builder.append(hex, WTF_ARRAY_LENGTH(hex));
+            break;
         }
     }
+}
+    
+void Stringifier::appendQuotedString(UStringBuilder& builder, const UString& value)
+{
+    int length = value.length();
+
+    builder.append('"');
+
+    if (value.is8Bit())
+        appendStringToUStringBuilder<LChar>(builder, value.characters8(), length);
+    else
+        appendStringToUStringBuilder<UChar>(builder, value.characters16(), length);
 
     builder.append('"');
 }
@@ -324,57 +332,62 @@ inline JSValue Stringifier::toJSON(JSValue value, const PropertyNameForFunctionC
 
     JSObject* object = asObject(toJSONFunction);
     CallData callData;
-    CallType callType = object->getCallData(callData);
+    CallType callType = object->methodTable()->getCallData(object, callData);
     if (callType == CallTypeNone)
         return value;
 
-    JSValue list[] = { propertyName.value(m_exec) };
-    ArgList args(list, sizeof(list) / sizeof(JSValue));
+    MarkedArgumentBuffer args;
+    args.append(propertyName.value(m_exec));
     return call(m_exec, object, callType, callData, value, args);
 }
 
-Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyName)
+Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyName)
 {
     // Call the toJSON function.
     value = toJSON(value, propertyName);
     if (m_exec->hadException())
         return StringifyFailed;
-    if (value.isUndefined() && !holder->inherits(&JSArray::info))
-        return StringifyFailedDueToUndefinedValue;
 
     // Call the replacer function.
     if (m_replacerCallType != CallTypeNone) {
-        JSValue list[] = { propertyName.value(m_exec), value };
-        ArgList args(list, sizeof(list) / sizeof(JSValue));
-        value = call(m_exec, m_replacer, m_replacerCallType, m_replacerCallData, holder, args);
+        MarkedArgumentBuffer args;
+        args.append(propertyName.value(m_exec));
+        args.append(value);
+        value = call(m_exec, m_replacer.get(), m_replacerCallType, m_replacerCallData, holder, args);
         if (m_exec->hadException())
             return StringifyFailed;
     }
 
+    if (value.isUndefined() && !holder->inherits(&JSArray::s_info))
+        return StringifyFailedDueToUndefinedValue;
+
     if (value.isNull()) {
         builder.append("null");
         return StringifySucceeded;
     }
 
-    value = unwrapBoxedPrimitive(value);
+    value = unwrapBoxedPrimitive(m_exec, value);
+
+    if (m_exec->hadException())
+        return StringifyFailed;
 
     if (value.isBoolean()) {
-        builder.append(value.getBoolean() ? "true" : "false");
+        builder.append(value.isTrue() ? "true" : "false");
         return StringifySucceeded;
     }
 
     UString stringValue;
-    if (value.getString(stringValue)) {
+    if (value.getString(m_exec, stringValue)) {
         appendQuotedString(builder, stringValue);
         return StringifySucceeded;
     }
 
-    double numericValue;
-    if (value.getNumber(numericValue)) {
-        if (!isfinite(numericValue))
+    if (value.isNumber()) {
+        double number = value.asNumber();
+        if (!isfinite(number))
             builder.append("null");
         else
-            builder.append(UString::from(numericValue));
+            builder.append(UString::number(number));
         return StringifySucceeded;
     }
 
@@ -383,13 +396,24 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
 
     JSObject* object = asObject(value);
 
+    CallData callData;
+    if (object->methodTable()->getCallData(object, callData) != CallTypeNone) {
+        if (holder->inherits(&JSArray::s_info)) {
+            builder.append("null");
+            return StringifySucceeded;
+        }
+        return StringifyFailedDueToUndefinedValue;
+    }
+
     // Handle cycle detection, and put the holder on the stack.
-    if (!m_holderCycleDetector.add(object).second) {
-        throwError(m_exec, TypeError);
-        return StringifyFailed;
+    for (unsigned i = 0; i < m_holderStack.size(); i++) {
+        if (m_holderStack[i].object() == object) {
+            throwError(m_exec, createTypeError(m_exec, "JSON.stringify cannot serialize cyclic structures."));
+            return StringifyFailed;
+        }
     }
     bool holderStackWasEmpty = m_holderStack.isEmpty();
-    m_holderStack.append(object);
+    m_holderStack.append(Holder(m_exec->globalData(), object));
     if (!holderStackWasEmpty)
         return StringifySucceeded;
 
@@ -403,13 +427,12 @@ Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder&
                 return StringifyFailed;
             if (!--tickCount) {
                 if (localTimeoutChecker.didTimeOut(m_exec)) {
-                    m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+                    throwError(m_exec, createInterruptedExecutionException(&m_exec->globalData()));
                     return StringifyFailed;
                 }
                 tickCount = localTimeoutChecker.ticksUntilNextCheck();
             }
         }
-        m_holderCycleDetector.remove(m_holderStack.last().object());
         m_holderStack.removeLast();
     } while (!m_holderStack.isEmpty());
     return StringifySucceeded;
@@ -423,20 +446,20 @@ inline bool Stringifier::willIndent() const
 inline void Stringifier::indent()
 {
     // Use a single shared string, m_repeatedGap, so we don't keep allocating new ones as we indent and unindent.
-    int newSize = m_indent.size() + m_gap.size();
-    if (newSize > m_repeatedGap.size())
-        m_repeatedGap.append(m_gap);
-    ASSERT(newSize <= m_repeatedGap.size());
-    m_indent = m_repeatedGap.substr(0, newSize);
+    unsigned newSize = m_indent.length() + m_gap.length();
+    if (newSize > m_repeatedGap.length())
+        m_repeatedGap = makeUString(m_repeatedGap, m_gap);
+    ASSERT(newSize <= m_repeatedGap.length());
+    m_indent = m_repeatedGap.substringSharingImpl(0, newSize);
 }
 
 inline void Stringifier::unindent()
 {
-    ASSERT(m_indent.size() >= m_gap.size());
-    m_indent = m_repeatedGap.substr(0, m_indent.size() - m_gap.size());
+    ASSERT(m_indent.length() >= m_gap.length());
+    m_indent = m_repeatedGap.substringSharingImpl(0, m_indent.length() - m_gap.length());
 }
 
-inline void Stringifier::startNewLine(StringBuilder& builder) const
+inline void Stringifier::startNewLine(UStringBuilder& builder) const
 {
     if (m_gap.isEmpty())
         return;
@@ -444,14 +467,14 @@ inline void Stringifier::startNewLine(StringBuilder& builder) const
     builder.append(m_indent);
 }
 
-inline Stringifier::Holder::Holder(JSObject* object)
-    : m_object(object)
-    , m_isArray(object->inherits(&JSArray::info))
+inline Stringifier::Holder::Holder(JSGlobalData& globalData, JSObject* object)
+    : m_object(globalData, object)
+    , m_isArray(object->inherits(&JSArray::s_info))
     , m_index(0)
 {
 }
 
-bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBuilder& builder)
+bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBuilder& builder)
 {
     ASSERT(m_index <= m_size);
 
@@ -460,7 +483,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
     // First time through, initialize.
     if (!m_index) {
         if (m_isArray) {
-            m_isJSArray = isJSArray(&exec->globalData(), m_object);
+            m_isJSArray = isJSArray(m_object.get());
             m_size = m_object->get(exec, exec->globalData().propertyNames->length).toUInt32(exec);
             builder.append('[');
         } else {
@@ -468,7 +491,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
                 m_propertyNames = stringifier.m_arrayReplacerPropertyNames.data();
             else {
                 PropertyNameArray objectPropertyNames(exec);
-                m_object->getPropertyNames(exec, objectPropertyNames);
+                m_object->methodTable()->getOwnPropertyNames(m_object.get(), exec, objectPropertyNames, ExcludeDontEnumProperties);
                 m_propertyNames = objectPropertyNames.releaseData();
             }
             m_size = m_propertyNames->propertyNameVector().size();
@@ -480,7 +503,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
     // Last time through, finish up and return false.
     if (m_index == m_size) {
         stringifier.unindent();
-        if (m_size && builder[builder.size() - 1] != '{')
+        if (m_size && builder[builder.length() - 1] != '{')
             stringifier.startNewLine(builder);
         builder.append(m_isArray ? ']' : '}');
         return false;
@@ -493,11 +516,11 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
     if (m_isArray) {
         // Get the value.
         JSValue value;
-        if (m_isJSArray && asArray(m_object)->canGetIndex(index))
-            value = asArray(m_object)->getIndex(index);
+        if (m_isJSArray && asArray(m_object.get())->canGetIndex(index))
+            value = asArray(m_object.get())->getIndex(index);
         else {
-            PropertySlot slot(m_object);
-            if (!m_object->getOwnPropertySlot(exec, index, slot))
+            PropertySlot slot(m_object.get());
+            if (!m_object->methodTable()->getOwnPropertySlotByIndex(m_object.get(), exec, index, slot))
                 slot.setUndefined();
             if (exec->hadException())
                 return false;
@@ -510,18 +533,18 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
         stringifier.startNewLine(builder);
 
         // Append the stringified value.
-        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object, index);
+        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object.get(), index);
     } else {
         // Get the value.
-        PropertySlot slot(m_object);
+        PropertySlot slot(m_object.get());
         Identifier& propertyName = m_propertyNames->propertyNameVector()[index];
-        if (!m_object->getOwnPropertySlot(exec, propertyName, slot))
+        if (!m_object->methodTable()->getOwnPropertySlot(m_object.get(), exec, propertyName, slot))
             return true;
         JSValue value = slot.getValue(exec, propertyName);
         if (exec->hadException())
             return false;
 
-        rollBackPoint = builder.size();
+        rollBackPoint = builder.length();
 
         // Append the separator string.
         if (builder[rollBackPoint - 1] != '{')
@@ -535,7 +558,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
             builder.append(' ');
 
         // Append the stringified value.
-        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object, propertyName);
+        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object.get(), propertyName);
     }
 
     // From this point on, no access to the this pointer or to any members, because the
@@ -552,7 +575,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
             // This only occurs when get an undefined value for an object property.
             // In this case we don't want the separator and property name that we
             // already appended, so roll back.
-            builder = builder.substr(0, rollBackPoint);
+            builder.resize(rollBackPoint);
             break;
     }
 
@@ -561,94 +584,114 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
 
 // ------------------------------ JSONObject --------------------------------
 
-const ClassInfo JSONObject::info = { "JSON", 0, 0, ExecState::jsonTable };
+const ClassInfo JSONObject::s_info = { "JSON", &JSNonFinalObject::s_info, 0, ExecState::jsonTable, CREATE_METHOD_TABLE(JSONObject) };
 
 /* Source for JSONObject.lut.h
 @begin jsonTable
-  parse         JSONProtoFuncParse             DontEnum|Function 1
-  stringify     JSONProtoFuncStringify         DontEnum|Function 1
+  parse         JSONProtoFuncParse             DontEnum|Function 2
+  stringify     JSONProtoFuncStringify         DontEnum|Function 3
 @end
 */
 
 // ECMA 15.8
 
-bool JSONObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSONObject::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    const HashEntry* entry = ExecState::jsonTable(exec)->entry(exec, propertyName);
-    if (!entry)
-        return JSObject::getOwnPropertySlot(exec, propertyName, slot);
-
-    ASSERT(entry->attributes() & Function);
-    setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-    return true;
+    return getStaticFunctionSlot<JSObject>(exec, ExecState::jsonTable(exec), jsCast<JSONObject*>(cell), propertyName, slot);
 }
 
-void JSONObject::markStringifiers(Stringifier* stringifier)
+bool JSONObject::getOwnPropertyDescriptor(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
 {
-    stringifier->mark();
+    return getStaticFunctionDescriptor<JSObject>(exec, ExecState::jsonTable(exec), jsCast<JSONObject*>(object), propertyName, descriptor);
 }
 
 class Walker {
 public:
-    Walker(ExecState* exec, JSObject* function, CallType callType, CallData callData)
+    Walker(ExecState* exec, Handle<JSObject> function, CallType callType, CallData callData)
         : m_exec(exec)
-        , m_function(function)
+        , m_function(exec->globalData(), function)
         , m_callType(callType)
         , m_callData(callData)
     {
     }
     JSValue walk(JSValue unfiltered);
 private:
-    JSValue callReviver(JSValue property, JSValue unfiltered)
+    JSValue callReviver(JSObject* thisObj, JSValue property, JSValue unfiltered)
     {
-        JSValue args[] = { property, unfiltered };
-        ArgList argList(args, 2);
-        return call(m_exec, m_function, m_callType, m_callData, jsNull(), argList);
+        MarkedArgumentBuffer args;
+        args.append(property);
+        args.append(unfiltered);
+        return call(m_exec, m_function.get(), m_callType, m_callData, thisObj, args);
     }
 
     friend class Holder;
 
     ExecState* m_exec;
-    JSObject* m_function;
+    Local<JSObject> m_function;
     CallType m_callType;
     CallData m_callData;
 };
-    
+
+// We clamp recursion well beyond anything reasonable, but we also have a timeout check
+// to guard against "infinite" execution by inserting arbitrarily large objects.
+static const unsigned maximumFilterRecursion = 40000;
 enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember, 
                                  ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
 NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
 {
     Vector<PropertyNameArray, 16> propertyStack;
     Vector<uint32_t, 16> indexStack;
-    Vector<JSObject*, 16> objectStack;
-    Vector<JSArray*, 16> arrayStack;
+    LocalStack<JSObject, 16> objectStack(m_exec->globalData());
+    LocalStack<JSArray, 16> arrayStack(m_exec->globalData());
     
     Vector<WalkerState, 16> stateStack;
     WalkerState state = StateUnknown;
     JSValue inValue = unfiltered;
     JSValue outValue = jsNull();
+    
+    TimeoutChecker localTimeoutChecker(m_exec->globalData().timeoutChecker);
+    localTimeoutChecker.reset();
+    unsigned tickCount = localTimeoutChecker.ticksUntilNextCheck();
     while (1) {
         switch (state) {
             arrayStartState:
             case ArrayStartState: {
                 ASSERT(inValue.isObject());
-                ASSERT(isJSArray(&m_exec->globalData(), asObject(inValue)));
+                ASSERT(isJSArray(asObject(inValue)) || asObject(inValue)->inherits(&JSArray::s_info));
+                if (objectStack.size() + arrayStack.size() > maximumFilterRecursion)
+                    return throwError(m_exec, createStackOverflowError(m_exec));
+
                 JSArray* array = asArray(inValue);
-                arrayStack.append(array);
+                arrayStack.push(array);
                 indexStack.append(0);
                 // fallthrough
             }
             arrayStartVisitMember:
             case ArrayStartVisitMember: {
-                JSArray* array = arrayStack.last();
+                if (!--tickCount) {
+                    if (localTimeoutChecker.didTimeOut(m_exec))
+                        return throwError(m_exec, createInterruptedExecutionException(&m_exec->globalData()));
+                    tickCount = localTimeoutChecker.ticksUntilNextCheck();
+                }
+
+                JSArray* array = arrayStack.peek();
                 uint32_t index = indexStack.last();
                 if (index == array->length()) {
                     outValue = array;
-                    arrayStack.removeLast();
+                    arrayStack.pop();
                     indexStack.removeLast();
                     break;
                 }
-                inValue = array->getIndex(index);
+                if (isJSArray(array) && array->canGetIndex(index))
+                    inValue = array->getIndex(index);
+                else {
+                    PropertySlot slot;
+                    if (array->methodTable()->getOwnPropertySlotByIndex(array, m_exec, index, slot))
+                        inValue = slot.getValue(m_exec, index);
+                    else
+                        inValue = jsUndefined();
+                }
+                    
                 if (inValue.isObject()) {
                     stateStack.append(ArrayEndVisitMember);
                     goto stateUnknown;
@@ -657,8 +700,12 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 // fallthrough
             }
             case ArrayEndVisitMember: {
-                JSArray* array = arrayStack.last();
-                array->setIndex(indexStack.last(), callReviver(jsString(m_exec, UString::from(indexStack.last())), outValue));
+                JSArray* array = arrayStack.peek();
+                JSValue filteredValue = callReviver(array, jsString(m_exec, UString::number(indexStack.last())), outValue);
+                if (filteredValue.isUndefined())
+                    array->methodTable()->deletePropertyByIndex(array, m_exec, indexStack.last());
+                else
+                    array->putDirectIndex(m_exec, indexStack.last(), filteredValue, false);
                 if (m_exec->hadException())
                     return jsNull();
                 indexStack.last()++;
@@ -667,30 +714,45 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
             objectStartState:
             case ObjectStartState: {
                 ASSERT(inValue.isObject());
-                ASSERT(!isJSArray(&m_exec->globalData(), asObject(inValue)));
+                ASSERT(!isJSArray(asObject(inValue)) && !asObject(inValue)->inherits(&JSArray::s_info));
+                if (objectStack.size() + arrayStack.size() > maximumFilterRecursion)
+                    return throwError(m_exec, createStackOverflowError(m_exec));
+
                 JSObject* object = asObject(inValue);
-                objectStack.append(object);
+                objectStack.push(object);
                 indexStack.append(0);
                 propertyStack.append(PropertyNameArray(m_exec));
-                object->getPropertyNames(m_exec, propertyStack.last());
+                object->methodTable()->getOwnPropertyNames(object, m_exec, propertyStack.last(), ExcludeDontEnumProperties);
                 // fallthrough
             }
             objectStartVisitMember:
             case ObjectStartVisitMember: {
-                JSObject* object = objectStack.last();
+                if (!--tickCount) {
+                    if (localTimeoutChecker.didTimeOut(m_exec))
+                        return throwError(m_exec, createInterruptedExecutionException(&m_exec->globalData()));
+                    tickCount = localTimeoutChecker.ticksUntilNextCheck();
+                }
+
+                JSObject* object = objectStack.peek();
                 uint32_t index = indexStack.last();
                 PropertyNameArray& properties = propertyStack.last();
                 if (index == properties.size()) {
                     outValue = object;
-                    objectStack.removeLast();
+                    objectStack.pop();
                     indexStack.removeLast();
                     propertyStack.removeLast();
                     break;
                 }
                 PropertySlot slot;
-                object->getOwnPropertySlot(m_exec, properties[index], slot);
-                inValue = slot.getValue(m_exec, properties[index]);
-                ASSERT(!m_exec->hadException());
+                if (object->methodTable()->getOwnPropertySlot(object, m_exec, properties[index], slot))
+                    inValue = slot.getValue(m_exec, properties[index]);
+                else
+                    inValue = jsUndefined();
+
+                // The holder may be modified by the reviver function so any lookup may throw
+                if (m_exec->hadException())
+                    return jsNull();
+
                 if (inValue.isObject()) {
                     stateStack.append(ObjectEndVisitMember);
                     goto stateUnknown;
@@ -699,10 +761,14 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                 // fallthrough
             }
             case ObjectEndVisitMember: {
-                JSObject* object = objectStack.last();
+                JSObject* object = objectStack.peek();
                 Identifier prop = propertyStack.last()[indexStack.last()];
                 PutPropertySlot slot;
-                object->put(m_exec, prop, callReviver(jsString(m_exec, prop.ustring()), outValue), slot);
+                JSValue filteredValue = callReviver(object, jsString(m_exec, prop.ustring()), outValue);
+                if (filteredValue.isUndefined())
+                    object->methodTable()->deleteProperty(object, m_exec, prop);
+                else
+                    object->methodTable()->put(object, m_exec, prop, filteredValue, slot);
                 if (m_exec->hadException())
                     return jsNull();
                 indexStack.last()++;
@@ -714,53 +780,82 @@ NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
                     outValue = inValue;
                     break;
                 }
-                if (isJSArray(&m_exec->globalData(), asObject(inValue)))
+                JSObject* object = asObject(inValue);
+                if (isJSArray(object) || object->inherits(&JSArray::s_info))
                     goto arrayStartState;
                 goto objectStartState;
         }
         if (stateStack.isEmpty())
             break;
+
         state = stateStack.last();
         stateStack.removeLast();
+
+        if (!--tickCount) {
+            if (localTimeoutChecker.didTimeOut(m_exec))
+                return throwError(m_exec, createInterruptedExecutionException(&m_exec->globalData()));
+            tickCount = localTimeoutChecker.ticksUntilNextCheck();
+        }
     }
-    return callReviver(jsEmptyString(m_exec), outValue);
+    JSObject* finalHolder = constructEmptyObject(m_exec);
+    PutPropertySlot slot;
+    finalHolder->methodTable()->put(finalHolder, m_exec, m_exec->globalData().propertyNames->emptyIdentifier, outValue, slot);
+    return callReviver(finalHolder, jsEmptyString(m_exec), outValue);
 }
 
 // ECMA-262 v5 15.12.2
-JSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+EncodedJSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec)
 {
-    if (args.isEmpty())
-        return throwError(exec, GeneralError, "JSON.parse requires at least one parameter");
-    JSValue value = args.at(0);
-    UString source = value.toString(exec);
+    if (!exec->argumentCount())
+        return throwVMError(exec, createError(exec, "JSON.parse requires at least one parameter"));
+    UString source = exec->argument(0).toString(exec)->value(exec);
     if (exec->hadException())
-        return jsNull();
-    
-    LiteralParser jsonParser(exec, source, LiteralParser::StrictJSON);
-    JSValue unfiltered = jsonParser.tryLiteralParse();
-    if (!unfiltered)
-        return throwError(exec, SyntaxError, "Unable to parse JSON string");
+        return JSValue::encode(jsNull());
+
+    JSValue unfiltered;
+    LocalScope scope(exec->globalData());
+    if (source.is8Bit()) {
+        LiteralParser<LChar> jsonParser(exec, source.characters8(), source.length(), StrictJSON);
+        unfiltered = jsonParser.tryLiteralParse();
+        if (!unfiltered)
+            return throwVMError(exec, createSyntaxError(exec, jsonParser.getErrorMessage()));
+    } else {
+        LiteralParser<UChar> jsonParser(exec, source.characters16(), source.length(), StrictJSON);
+        unfiltered = jsonParser.tryLiteralParse();
+        if (!unfiltered)
+            return throwVMError(exec, createSyntaxError(exec, jsonParser.getErrorMessage()));        
+    }
     
-    if (args.size() < 2)
-        return unfiltered;
+    if (exec->argumentCount() < 2)
+        return JSValue::encode(unfiltered);
     
-    JSValue function = args.at(1);
+    JSValue function = exec->argument(1);
     CallData callData;
-    CallType callType = function.getCallData(callData);
+    CallType callType = getCallData(function, callData);
     if (callType == CallTypeNone)
-        return unfiltered;
-    return Walker(exec, asObject(function), callType, callData).walk(unfiltered);
+        return JSValue::encode(unfiltered);
+    return JSValue::encode(Walker(exec, Local<JSObject>(exec->globalData(), asObject(function)), callType, callData).walk(unfiltered));
 }
 
 // ECMA-262 v5 15.12.3
-JSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+EncodedJSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec)
+{
+    if (!exec->argumentCount())
+        return throwVMError(exec, createError(exec, "No input to stringify"));
+    LocalScope scope(exec->globalData());
+    Local<Unknown> value(exec->globalData(), exec->argument(0));
+    Local<Unknown> replacer(exec->globalData(), exec->argument(1));
+    Local<Unknown> space(exec->globalData(), exec->argument(2));
+    return JSValue::encode(Stringifier(exec, replacer, space).stringify(value).get());
+}
+
+UString JSONStringify(ExecState* exec, JSValue value, unsigned indent)
 {
-    if (args.isEmpty())
-        return throwError(exec, GeneralError, "No input to stringify");
-    JSValue value = args.at(0);
-    JSValue replacer = args.at(1);
-    JSValue space = args.at(2);
-    return Stringifier(exec, replacer, space).stringify(value);
+    LocalScope scope(exec->globalData());
+    Local<Unknown> result = Stringifier(exec, Local<Unknown>(exec->globalData(), jsNull()), Local<Unknown>(exec->globalData(), jsNumber(indent))).stringify(Local<Unknown>(exec->globalData(), value));
+    if (result.isUndefinedOrNull())
+        return UString();
+    return result.getString(exec);
 }
 
 } // namespace JSC