Bug 459161 - Process first argument to JSON stringify and parse methods as specified by ES3.1. r=shaver
authorRobert Sayre <sayrer@gmail.com>
Fri, 13 Feb 2009 15:34:39 -0500
changeset 25106 b4ececb1c146198c415f30331febf05e04d6c6da
parent 25105 bcfbf7958b6529ed5195926bcc40bf83b73cf967
child 25107 ac35c12230fa3a662d3d13df2b16898819d4b0ea
push idunknown
push userunknown
push dateunknown
reviewersshaver
bugs459161
milestone1.9.2a1pre
Bug 459161 - Process first argument to JSON stringify and parse methods as specified by ES3.1. r=shaver
dom/src/json/test/fail1.json
dom/src/json/test/json2.js
dom/src/json/test/unit/test_decode_primitives.js
dom/src/json/test/unit/test_encode.js
dom/src/json/test/unit/test_encode_primitives.js
dom/src/json/test/unit/test_wrappers.js
js/src/json.cpp
--- a/dom/src/json/test/fail1.json
+++ b/dom/src/json/test/fail1.json
@@ -1,1 +1,1 @@
-"A JSON payload should be an object or array, not a string."
\ No newline at end of file
+"Unterminated string literal
\ No newline at end of file
--- a/dom/src/json/test/json2.js
+++ b/dom/src/json/test/json2.js
@@ -1,250 +1,478 @@
 /*
-    json2.js
-    2007-11-06
+    http://www.JSON.org/json2.js
+    2008-11-19
 
-    Public Domain
+    Public Domain.
+
+    NO WARRANTY EXPRESSED OR IMPLIED. USE AT YOUR OWN RISK.
 
     See http://www.JSON.org/js.html
 
-    This file creates a global JSON object containing two methods:
+    This file creates a global JSON object containing two methods: stringify
+    and parse.
 
-        JSON.stringify(value, whitelist)
+        JSON.stringify(value, replacer, space)
             value       any JavaScript value, usually an object or array.
 
-            whitelist   an optional that determines how object values are
-                        stringified.
+            replacer    an optional parameter that determines how object
+                        values are stringified for objects. It can be a
+                        function or an array of strings.
+
+            space       an optional parameter that specifies the indentation
+                        of nested structures. If it is omitted, the text will
+                        be packed without extra whitespace. If it is a number,
+                        it will specify the number of spaces to indent at each
+                        level. If it is a string (such as '\t' or '&nbsp;'),
+                        it contains the characters used to indent at each level.
 
             This method produces a JSON text from a JavaScript value.
-            There are three possible ways to stringify an object, depending
-            on the optional whitelist parameter.
+
+            When an object value is found, if the object contains a toJSON
+            method, its toJSON method will be called and the result will be
+            stringified. A toJSON method does not serialize: it returns the
+            value represented by the name/value pair that should be serialized,
+            or undefined if nothing should be serialized. The toJSON method
+            will be passed the key associated with the value, and this will be
+            bound to the object holding the key.
+
+            For example, this would serialize Dates as ISO strings.
+
+                Date.prototype.toJSON = function (key) {
+                    function f(n) {
+                        // Format integers to have at least two digits.
+                        return n < 10 ? '0' + n : n;
+                    }
 
-            If an object has a toJSON method, then the toJSON() method will be
-            called. The value returned from the toJSON method will be
+                    return this.getUTCFullYear()   + '-' +
+                         f(this.getUTCMonth() + 1) + '-' +
+                         f(this.getUTCDate())      + 'T' +
+                         f(this.getUTCHours())     + ':' +
+                         f(this.getUTCMinutes())   + ':' +
+                         f(this.getUTCSeconds())   + 'Z';
+                };
+
+            You can provide an optional replacer method. It will be passed the
+            key and value of each member, with this bound to the containing
+            object. The value that is returned from your method will be
+            serialized. If your method returns undefined, then the member will
+            be excluded from the serialization.
+
+            If the replacer parameter is an array of strings, then it will be
+            used to select the members to be serialized. It filters the results
+            such that only members with keys listed in the replacer array are
             stringified.
 
-            Otherwise, if the optional whitelist parameter is an array, then
-            the elements of the array will be used to select members of the
-            object for stringification.
+            Values that do not have JSON representations, such as undefined or
+            functions, will not be serialized. Such values in objects will be
+            dropped; in arrays they will be replaced with null. You can use
+            a replacer function to replace those with JSON values.
+            JSON.stringify(undefined) returns undefined.
 
-            Otherwise, if there is no whitelist parameter, then all of the
-            members of the object will be stringified.
+            The optional space parameter produces a stringification of the
+            value that is filled with line breaks and indentation to make it
+            easier to read.
 
-            Values that do not have JSON representaions, such as undefined or
-            functions, will not be serialized. Such values in objects will be
-            dropped, in arrays will be replaced with null. JSON.stringify()
-            returns undefined. Dates will be stringified as quoted ISO dates.
+            If the space parameter is a non-empty string, then that string will
+            be used for indentation. If the space parameter is a number, then
+            the indentation will be that many spaces.
 
             Example:
 
-            var text = JSON.stringify(['e', {pluribus: 'unum'}]);
+            text = JSON.stringify(['e', {pluribus: 'unum'}]);
             // text is '["e",{"pluribus":"unum"}]'
 
-        JSON.parse(text, filter)
-            This method parses a JSON text to produce an object or
-            array. It can throw a SyntaxError exception.
+
+            text = JSON.stringify(['e', {pluribus: 'unum'}], null, '\t');
+            // text is '[\n\t"e",\n\t{\n\t\t"pluribus": "unum"\n\t}\n]'
+
+            text = JSON.stringify([new Date()], function (key, value) {
+                return this[key] instanceof Date ?
+                    'Date(' + this[key] + ')' : value;
+            });
+            // text is '["Date(---current time---)"]'
 
-            The optional filter parameter is a function that can filter and
-            transform the results. It receives each of the keys and values, and
-            its return value is used instead of the original value. If it
-            returns what it received, then structure is not modified. If it
-            returns undefined then the member is deleted.
+
+        JSON.parse(text, reviver)
+            This method parses a JSON text to produce an object or array.
+            It can throw a SyntaxError exception.
+
+            The optional reviver parameter is a function that can filter and
+            transform the results. It receives each of the keys and values,
+            and its return value is used instead of the original value.
+            If it returns what it received, then the structure is not modified.
+            If it returns undefined then the member is deleted.
 
             Example:
 
-            // Parse the text. If a key contains the string 'date' then
-            // convert the value to a date.
+            // Parse the text. Values that look like ISO date strings will
+            // be converted to Date objects.
 
             myData = JSON.parse(text, function (key, value) {
-                return key.indexOf('date') >= 0 ? new Date(value) : value;
+                var a;
+                if (typeof value === 'string') {
+                    a =
+/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2}(?:\.\d*)?)Z$/.exec(value);
+                    if (a) {
+                        return new Date(Date.UTC(+a[1], +a[2] - 1, +a[3], +a[4],
+                            +a[5], +a[6]));
+                    }
+                }
+                return value;
             });
 
+            myData = JSON.parse('["Date(09/09/2001)"]', function (key, value) {
+                var d;
+                if (typeof value === 'string' &&
+                        value.slice(0, 5) === 'Date(' &&
+                        value.slice(-1) === ')') {
+                    d = new Date(value.slice(5, -1));
+                    if (d) {
+                        return d;
+                    }
+                }
+                return value;
+            });
+
+
     This is a reference implementation. You are free to copy, modify, or
     redistribute.
 
-    Use your own copy. It is extremely unwise to load third party
-    code into your pages.
+    This code should be minified before deployment.
+    See http://javascript.crockford.com/jsmin.html
+
+    USE YOUR OWN COPY. IT IS EXTREMELY UNWISE TO LOAD CODE FROM SERVERS YOU DO
+    NOT CONTROL.
 */
 
 /*jslint evil: true */
-/*extern JSON */
+
+/*global JSON */
+
+/*members "", "\b", "\t", "\n", "\f", "\r", "\"", JSON, "\\", apply,
+    call, charCodeAt, getUTCDate, getUTCFullYear, getUTCHours,
+    getUTCMinutes, getUTCMonth, getUTCSeconds, hasOwnProperty, join,
+    lastIndex, length, parse, prototype, push, replace, slice, stringify,
+    test, toJSON, toString, valueOf
+*/
+
+// Create a JSON object only if one does not already exist. We create the
+// methods in a closure to avoid creating global variables.
 
 if (!this.crockfordJSON) {
+    crockfordJSON = {};
+}
+(function () {
 
-    crockfordJSON = function () {
+    function f(n) {
+        // Format integers to have at least two digits.
+        return n < 10 ? '0' + n : n;
+    }
+
+    if (typeof Date.prototype.toJSON !== 'function') {
+
+        Date.prototype.toJSON = function (key) {
 
-        function f(n) {    // Format integers to have at least two digits.
-            return n < 10 ? '0' + n : n;
-        }
+            return this.getUTCFullYear()   + '-' +
+                 f(this.getUTCMonth() + 1) + '-' +
+                 f(this.getUTCDate())      + 'T' +
+                 f(this.getUTCHours())     + ':' +
+                 f(this.getUTCMinutes())   + ':' +
+                 f(this.getUTCSeconds())   + 'Z';
+        };
 
-        var m = {    // table of character substitutions
+        String.prototype.toJSON =
+        Number.prototype.toJSON =
+        Boolean.prototype.toJSON = function (key) {
+            return this.valueOf();
+        };
+    }
+
+    var cx = /[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,
+        escapable = /[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,
+        gap,
+        indent,
+        meta = {    // table of character substitutions
             '\b': '\\b',
             '\t': '\\t',
             '\n': '\\n',
             '\f': '\\f',
             '\r': '\\r',
             '"' : '\\"',
             '\\': '\\\\'
-        };
+        },
+        rep;
 
-        function stringify(value, whitelist) {
-            var a,          // The array holding the partial texts.
-                i,          // The loop counter.
-                k,          // The member key.
-                l,          // Length.
-                r = /["\\\x00-\x1f\x7f-\x9f]/g,
-                v;          // The member value.
 
-            switch (typeof value) {
-            case 'string':
+    function quote(string) {
 
 // If the string contains no control characters, no quote characters, and no
 // backslash characters, then we can safely slap some quotes around it.
-// Otherwise we must also replace the offending characters with safe sequences.
+// Otherwise we must also replace the offending characters with safe escape
+// sequences.
+
+        escapable.lastIndex = 0;
+        return escapable.test(string) ?
+            '"' + string.replace(escapable, function (a) {
+                var c = meta[a];
+                return typeof c === 'string' ? c :
+                    '\\u' + ('0000' + a.charCodeAt(0).toString(16)).slice(-4);
+            }) + '"' :
+            '"' + string + '"';
+    }
+
+
+    function str(key, holder) {
+
+// Produce a string from holder[key].
 
-                return r.test(value) ?
-                    '"' + value.replace(r, function (a) {
-                        var c = m[a];
-                        if (c) {
-                            return c;
-                        }
-                        c = a.charCodeAt();
-                        return '\\u00' + Math.floor(c / 16).toString(16) +
-                                                   (c % 16).toString(16);
-                    }) + '"' :
-                    '"' + value + '"';
+        var i,          // The loop counter.
+            k,          // The member key.
+            v,          // The member value.
+            length,
+            mind = gap,
+            partial,
+            value = holder[key];
+
+// If the value has a toJSON method, call it to obtain a replacement value.
+
+        if (value && typeof value === 'object' &&
+                typeof value.toJSON === 'function') {
+            value = value.toJSON(key);
+        }
 
-            case 'number':
+// If we were called with a replacer function, then call the replacer to
+// obtain a replacement value.
+
+        if (typeof rep === 'function') {
+            value = rep.call(holder, key, value);
+        }
+
+// What happens next depends on the value's type.
+
+        switch (typeof value) {
+        case 'string':
+            return quote(value);
+
+        case 'number':
 
 // JSON numbers must be finite. Encode non-finite numbers as null.
 
-                return isFinite(value) ? String(value) : 'null';
+            return isFinite(value) ? String(value) : 'null';
+
+        case 'boolean':
+        case 'null':
+
+// If the value is a boolean or null, convert it to a string. Note:
+// typeof null does not produce 'null'. The case is included here in
+// the remote chance that this gets fixed someday.
 
-            case 'boolean':
-            case 'null':
-                return String(value);
+            return String(value);
+
+// If the type is 'object', we might be dealing with an object or an array or
+// null.
+
+        case 'object':
+
+// Due to a specification blunder in ECMAScript, typeof null is 'object',
+// so watch out for that case.
 
-            case 'object':
+            if (!value) {
+                return 'null';
+            }
+
+// Make an array to hold the partial results of stringifying this object value.
+
+            gap += indent;
+            partial = [];
 
-// Due to a specification blunder in ECMAScript,
-// typeof null is 'object', so watch out for that case.
+// Is the value an array?
+
+            if (Object.prototype.toString.apply(value) === '[object Array]') {
 
-                if (!value) {
-                    return 'null';
+// The value is an array. Stringify every element. Use null as a placeholder
+// for non-JSON values.
+
+                length = value.length;
+                for (i = 0; i < length; i += 1) {
+                    partial[i] = str(i, value) || 'null';
                 }
 
-// If the object has a toJSON method, call it, and stringify the result.
-
-                if (typeof value.toJSON === 'function') {
-                    return stringify(value.toJSON());
-                }
-                a = [];
-                if (typeof value.length === 'number' &&
-                        !(value.propertyIsEnumerable('length'))) {
-
-// The object is an array. Stringify every element. Use null as a placeholder
-// for non-JSON values.
-
-                    l = value.length;
-                    for (i = 0; i < l; i += 1) {
-                        a.push(stringify(value[i], whitelist) || 'null');
-                    }
+// Join all of the elements together, separated with commas, and wrap them in
+// brackets.
 
-// Join all of the elements together and wrap them in brackets.
-
-                    return '[' + a.join(',') + ']';
-                }
-                if (whitelist) {
-
-// If a whitelist (array of keys) is provided, use it to select the components
-// of the object.
+                v = partial.length === 0 ? '[]' :
+                    gap ? '[\n' + gap +
+                            partial.join(',\n' + gap) + '\n' +
+                                mind + ']' :
+                          '[' + partial.join(',') + ']';
+                gap = mind;
+                return v;
+            }
 
-                    l = whitelist.length;
-                    for (i = 0; i < l; i += 1) {
-                        k = whitelist[i];
-                        if (typeof k === 'string') {
-                            v = stringify(value[k], whitelist);
-                            if (v) {
-                                a.push(stringify(k) + ':' + v);
-                            }
+// If the replacer is an array, use it to select the members to be stringified.
+
+            if (rep && typeof rep === 'object') {
+                length = rep.length;
+                for (i = 0; i < length; i += 1) {
+                    k = rep[i];
+                    if (typeof k === 'string') {
+                        v = str(k, value);
+                        if (v) {
+                            partial.push(quote(k) + (gap ? ': ' : ':') + v);
                         }
                     }
-                } else {
+                }
+            } else {
 
 // Otherwise, iterate through all of the keys in the object.
 
+                for (k in value) {
+                    if (Object.hasOwnProperty.call(value, k)) {
+                        v = str(k, value);
+                        if (v) {
+                            partial.push(quote(k) + (gap ? ': ' : ':') + v);
+                        }
+                    }
+                }
+            }
+
+// Join all of the member texts together, separated with commas,
+// and wrap them in braces.
+
+            v = partial.length === 0 ? '{}' :
+                gap ? '{\n' + gap + partial.join(',\n' + gap) + '\n' +
+                        mind + '}' : '{' + partial.join(',') + '}';
+            gap = mind;
+            return v;
+        }
+    }
+
+// If the JSON object does not yet have a stringify method, give it one.
+
+    if (typeof crockfordJSON.stringify !== 'function') {
+        crockfordJSON.stringify = function (value, replacer, space) {
+
+// The stringify method takes a value and an optional replacer, and an optional
+// space parameter, and returns a JSON text. The replacer can be a function
+// that can replace values, or an array of strings that will select the keys.
+// A default replacer method can be provided. Use of the space parameter can
+// produce text that is more easily readable.
+
+            var i;
+            gap = '';
+            indent = '';
+
+// If the space parameter is a number, make an indent string containing that
+// many spaces.
+
+            if (typeof space === 'number') {
+                for (i = 0; i < space; i += 1) {
+                    indent += ' ';
+                }
+
+// If the space parameter is a string, it will be used as the indent string.
+
+            } else if (typeof space === 'string') {
+                indent = space;
+            }
+
+// If there is a replacer, it must be a function or an array.
+// Otherwise, throw an error.
+
+            rep = replacer;
+            if (replacer && typeof replacer !== 'function' &&
+                    (typeof replacer !== 'object' ||
+                     typeof replacer.length !== 'number')) {
+                throw new Error('JSON.stringify');
+            }
+
+// Make a fake root object containing our value under the key of ''.
+// Return the result of stringifying the value.
+
+            return str('', {'': value});
+        };
+    }
+
+
+// If the JSON object does not yet have a parse method, give it one.
+
+    if (typeof crockfordJSON.parse !== 'function') {
+        crockfordJSON.parse = function (text, reviver) {
+
+// The parse method takes a text and an optional reviver function, and returns
+// a JavaScript value if the text is a valid JSON text.
+
+            var j;
+
+            function walk(holder, key) {
+
+// The walk method is used to recursively walk the resulting structure so
+// that modifications can be made.
+
+                var k, v, value = holder[key];
+                if (value && typeof value === 'object') {
                     for (k in value) {
-                        if (typeof k === 'string') {
-                            v = stringify(value[k], whitelist);
-                            if (v) {
-                                a.push(stringify(k) + ':' + v);
+                        if (Object.hasOwnProperty.call(value, k)) {
+                            v = walk(value, k);
+                            if (v !== undefined) {
+                                value[k] = v;
+                            } else {
+                                delete value[k];
                             }
                         }
                     }
                 }
-
-// Join all of the member texts together and wrap them in braces.
-
-                return '{' + a.join(',') + '}';
+                return reviver.call(holder, key, value);
             }
-						return undefined;
-        }
-
-        return {
-            stringify: stringify,
-            parse: function (text, filter) {
-                var j;
-
-                function walk(k, v) {
-                    var i, n;
-                    if (v && typeof v === 'object') {
-                        for (i in v) {
-                            if (Object.prototype.hasOwnProperty.apply(v, [i])) {
-                                n = walk(i, v[i]);
-                                if (n !== undefined) {
-                                    v[i] = n;
-                                }
-                            }
-                        }
-                    }
-                    return filter(k, v);
-                }
 
 
-// Parsing happens in three stages. In the first stage, we run the text against
-// regular expressions that look for non-JSON patterns. We are especially
-// concerned with '()' and 'new' because they can cause invocation, and '='
-// because it can cause mutation. But just to be safe, we want to reject all
-// unexpected forms.
+// Parsing happens in four stages. In the first stage, we replace certain
+// Unicode characters with escape sequences. JavaScript handles many characters
+// incorrectly, either silently deleting them, or treating them as line endings.
 
-// We split the first stage into 4 regexp operations in order to work around
+            cx.lastIndex = 0;
+            if (cx.test(text)) {
+                text = text.replace(cx, function (a) {
+                    return '\\u' +
+                        ('0000' + a.charCodeAt(0).toString(16)).slice(-4);
+                });
+            }
+
+// In the second stage, we run the text against regular expressions that look
+// for non-JSON patterns. We are especially concerned with '()' and 'new'
+// because they can cause invocation, and '=' because it can cause mutation.
+// But just to be safe, we want to reject all unexpected forms.
+
+// We split the second stage into 4 regexp operations in order to work around
 // crippling inefficiencies in IE's and Safari's regexp engines. First we
-// replace all backslash pairs with '@' (a non-JSON character). Second, we
+// replace the JSON backslash pairs with '@' (a non-JSON character). Second, we
 // replace all simple value tokens with ']' characters. Third, we delete all
 // open brackets that follow a colon or comma or that begin the text. Finally,
 // we look to see that the remaining characters are only whitespace or ']' or
 // ',' or ':' or '{' or '}'. If that is so, then the text is safe for eval.
 
-                if (/^[\],:{}\s]*$/.test(text.replace(/\\./g, '@').
-replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(:?[eE][+\-]?\d+)?/g, ']').
+            if (/^[\],:{}\s]*$/.
+test(text.replace(/\\(?:["\\\/bfnrt]|u[0-9a-fA-F]{4})/g, '@').
+replace(/"[^"\\\n\r]*"|true|false|null|-?\d+(?:\.\d*)?(?:[eE][+\-]?\d+)?/g, ']').
 replace(/(?:^|:|,)(?:\s*\[)+/g, ''))) {
 
-// In the second stage we use the eval function to compile the text into a
+// In the third stage we use the eval function to compile the text into a
 // JavaScript structure. The '{' operator is subject to a syntactic ambiguity
 // in JavaScript: it can begin a block or an object literal. We wrap the text
 // in parens to eliminate the ambiguity.
 
-                    j = eval('(' + text + ')');
+                j = eval('(' + text + ')');
 
-// In the optional third stage, we recursively walk the new structure, passing
-// each name/value pair to a filter function for possible transformation.
+// In the optional fourth stage, we recursively walk the new structure, passing
+// each name/value pair to a reviver function for possible transformation.
 
-                    return typeof filter === 'function' ? walk('', j) : j;
-                }
+                return typeof reviver === 'function' ?
+                    walk({'': j}, '') : j;
+            }
 
 // If the text is not JSON parseable, then a SyntaxError is thrown.
 
-                throw new SyntaxError('parseJSON');
-            }
+            throw new SyntaxError('JSON.parse');
         };
-    }();
-}
+    }
+})();
new file mode 100644
--- /dev/null
+++ b/dom/src/json/test/unit/test_decode_primitives.js
@@ -0,0 +1,88 @@
+function parse_primitives() {
+
+  print("parse object");
+  // check an empty object, just for sanity
+  var emptyObject = "{}";
+  var x = nativeJSON.decode(emptyObject);
+  do_check_eq(typeof x, "object");
+  print("parse object 2");
+  
+  x = JSON.parse(emptyObject);
+  do_check_eq(typeof x, "object");
+  
+  print("parse object 3");
+  x = crockfordJSON.parse(emptyObject);
+  do_check_eq(typeof x, "object");
+
+  // booleans and null
+  print("parse bool");
+  x = JSON.parse("true");
+  do_check_eq(typeof x, "boolean");
+  do_check_eq(x, true);
+  
+  print("parse bool with space")
+  x = JSON.parse("true          ");
+  do_check_eq(typeof x, "boolean");
+  do_check_eq(x, true);
+  
+  print("parse false");
+  x = JSON.parse("false");
+  do_check_eq(typeof x, "boolean");
+  do_check_eq(x, false);
+  
+  print("parse null");
+  x = JSON.parse("           null           ");
+  do_check_eq(typeof x, "object");
+  do_check_eq(x, null);
+  
+  // numbers
+  print("parse numbers")
+  x = JSON.parse("1234567890");
+  do_check_eq(typeof x, "number");
+  do_check_eq(x, 1234567890);
+  
+  x = JSON.parse("-9876.543210");
+  do_check_eq(typeof x, "number");
+  do_check_eq(x, -9876.543210);
+  
+  x = JSON.parse("0.123456789e-12");
+  do_check_eq(typeof x, "number");
+  do_check_eq(x, 0.123456789e-12);
+  
+  x = JSON.parse("1.234567890E+34");
+  do_check_eq(typeof x, "number");
+  do_check_eq(x, 1.234567890E+34);
+
+  x = JSON.parse("      23456789012E66          \r\r\r\r      \n\n\n\n ");
+  do_check_eq(typeof x, "number");
+  do_check_eq(x, 23456789012E66);
+ 
+  // strings
+  x = crockfordJSON.parse('"foo"');
+  do_check_eq(typeof x, "string");
+  do_check_eq(x, "foo");
+  x = JSON.parse('"foo"');
+  do_check_eq(typeof x, "string");
+  do_check_eq(x, "foo");
+  
+  x = JSON.parse('"\\r\\n"');
+  do_check_eq(typeof x, "string");
+  do_check_eq(x, "\r\n");
+  
+  x = JSON.parse('"\\uabcd\uef4A"');
+  do_check_eq(typeof x, "string");
+  do_check_eq(x, "\uabcd\uef4A");
+
+  x = JSON.parse('"\\uabcd"');
+  do_check_eq(typeof x, "string");
+  do_check_eq(x, "\uabcd");
+
+  x = JSON.parse('"\\f"');
+  do_check_eq(typeof x, "string");
+  do_check_eq(x, "\f");
+
+}
+
+function run_test() {
+  parse_primitives();
+}
--- a/dom/src/json/test/unit/test_encode.js
+++ b/dom/src/json/test/unit/test_encode.js
@@ -78,20 +78,20 @@ function getTestPairs() {
 
   // array with named prop
   var x= new Array();
   x[0] = 1;
   x.foo = "bar";
   //testPairs.push(['[1]', x]);
 
   // prototype
-  var X = function() { this.a = "b" }
+  var X = function() { this.foo = "b" }
   X.prototype = {c:"d"}
   var y = new X();
-  testPairs.push(['{"a":"b","c":"d"}', y]);
+  testPairs.push(['{"foo":"b"}', y]);
 
   // useless roots will be dropped
   testPairs.push([null, null]);
   testPairs.push([null, ""]);
   testPairs.push([null, undefined]);
   testPairs.push([null, 5]);
 
   // custom iterator: JS 1.7+
new file mode 100644
--- /dev/null
+++ b/dom/src/json/test/unit/test_encode_primitives.js
@@ -0,0 +1,34 @@
+function stringify_primitives() {
+  // sanity
+  var x = JSON.stringify({});
+  do_check_eq(x, "{}");
+
+  // booleans and null
+  x = JSON.stringify(true);
+  do_check_eq(x, "true");
+
+  x = JSON.stringify(false);
+  do_check_eq(x, "false");
+
+  x = JSON.stringify(new Boolean(false));
+  do_check_eq(x, "false");
+
+  x = JSON.stringify(null);
+  do_check_eq(x, "null");
+
+  x = JSON.stringify(1234);
+  do_check_eq(x, "1234");
+
+  x = JSON.stringify(new Number(1234));
+  do_check_eq(x, "1234");
+
+  x = JSON.stringify("asdf");
+  do_check_eq(x, '"asdf"');
+
+  x = JSON.stringify(new String("asdf"));
+  do_check_eq(x, '"asdf"');
+}
+
+function run_test() {
+  stringify_primitives();
+}
--- a/dom/src/json/test/unit/test_wrappers.js
+++ b/dom/src/json/test/unit/test_wrappers.js
@@ -53,16 +53,17 @@ function getTestPairs() {
   var hmm = {
     toJSON: function() { return {"foo":"bar"}}
   }
   testPairs.push(['{"hmm":{"foo":"bar"}}', {"hmm":hmm}]);
   testPairs.push(['{"foo":"bar"}', hmm]); // on the root
 
   // toJSON on prototype
   var Y = function() {
+    this.not = "there?";
     this.d = "e";
   }
   Y.prototype = {
     not:"there?",
     toJSON: function() { return {"foo":"bar"}}
   };
   var y = new Y();
   testPairs.push(['{"foo":"bar"}', y.toJSON()]);
@@ -79,17 +80,17 @@ function getTestPairs() {
   x[0] = 1;
   x.foo = "bar";
   testPairs.push(['[1]', x]);
 
   // prototype
   var X = function() { this.a = "b" }
   X.prototype = {c:"d"}
   var y = new X();
-  testPairs.push(['{"a":"b","c":"d"}', y]);
+  testPairs.push(['{"a":"b"}', y]);
 
   // custom iterator: JS 1.7+
   var x = {
    "a": "foo",
    b: "not included",
    c: "bar",
    "4": "qux",
    __iterator__: function() { return (function() { yield "a"; yield "c"; yield 4; })() }
@@ -101,21 +102,17 @@ function getTestPairs() {
 
 function testStringEncode() {
   var pairs = getTestPairs();
   for each(pair in pairs) {
     print(pair)
     var nativeResult = JSON.stringify(pair[1]);
     var crockfordResult = crockfordJSON.stringify(pair[1]);
     do_check_eq(pair[0], nativeResult);
-    
-    // Don't follow json2.js handling of non-objects
-    if (pair[1] && (typeof pair[1] == "object")) {
-      do_check_eq(crockfordResult, nativeResult);
-    }
+    do_check_eq(crockfordResult, nativeResult);
   }
 }
 
 function decode_strings() {
   // empty object
   var x = JSON.parse("{}");
   do_check_eq(typeof x, "object");
 
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -64,24 +64,22 @@ JSClass js_JSONClass = {
 };
 
 JSBool
 js_json_parse(JSContext *cx, uintN argc, jsval *vp)
 {
     JSString *s = NULL;
     jsval *argv = vp + 2;
 
-    // Must throw an Error if there isn't a first arg
-    if (!JS_ConvertArguments(cx, argc, argv, "S", &s))
+    if (!JS_ConvertArguments(cx, argc, argv, "S", &s)) {
         return JS_FALSE;
-
+    }
 
     JSONParser *jp = js_BeginJSONParse(cx, vp);
     JSBool ok = jp != NULL;
-
     if (ok) {
         ok = js_ConsumeJSONText(cx, jp, JS_GetStringChars(s), JS_GetStringLength(s));
         ok &= js_FinishJSONParse(cx, jp);
     }
 
     if (!ok)
         JS_ReportError(cx, "Error parsing JSON");
 
@@ -119,36 +117,32 @@ WriteCallback(const jschar *buf, uint32 
     sc->s[1] = JSVAL_VOID;
 
     return JS_TRUE;
 }
 
 JSBool
 js_json_stringify(JSContext *cx, uintN argc, jsval *vp)
 {
-    JSObject *obj;
     jsval *argv = vp + 2;
-    
+    JSBool ok = JS_TRUE;
+
     // Must throw an Error if there isn't a first arg
-    if (!JS_ConvertArguments(cx, argc, argv, "o", &obj))
+    if (!JS_ConvertArguments(cx, argc, argv, "v", vp))
         return JS_FALSE;
 
-    // Only use objects and arrays as the root for now
-    *vp = OBJECT_TO_JSVAL(obj);
-    
-    JSBool ok = js_TryJSON(cx, vp);
+    ok = js_TryJSON(cx, vp);
+
     JSType type;
-    if (!ok ||
-        JSVAL_IS_PRIMITIVE(*vp) ||
-        ((type = JS_TypeOfValue(cx, *vp)) == JSTYPE_FUNCTION ||
-        type == JSTYPE_XML)) {
+    if (!ok || *vp == JSVAL_VOID || 
+        ((type = JS_TypeOfValue(cx, *vp)) == JSTYPE_FUNCTION || type == JSTYPE_XML)) {
         JS_ReportError(cx, "Invalid argument");
         return JS_FALSE;
     }
-    
+
     JSString *s = JS_NewStringCopyN(cx, "", 0);
     if (!s)
         ok = JS_FALSE;
 
     if (ok) {
         jsval vec[2] = {STRING_TO_JSVAL(s), JSVAL_VOID};
         StringifyClosure sc(cx, 2, vec);
         JSAutoTempValueRooter resultTvr(cx, 1, sc.s);
@@ -213,19 +207,57 @@ write_string(JSContext *cx, JSONWriteCal
         return JS_FALSE;
 
     if (!callback(&quote, 1, data))
         return JS_FALSE;
 
     return JS_TRUE;
 }
 
-JSBool
-js_Stringify(JSContext *cx, jsval *vp, JSObject *replacer,
-             JSONWriteCallback callback, void *data, uint32 depth)
+static JSBool
+stringify_primitive(JSContext *cx, jsval *vp, 
+                    JSONWriteCallback callback, void *data, JSType type) {
+
+    JSString *outputString;
+    JSString *s = js_ValueToString(cx, *vp);
+
+    if (!s)
+        return JS_FALSE;
+
+    if (type == JSTYPE_STRING)
+        return write_string(cx, callback, data, JS_GetStringChars(s), JS_GetStringLength(s));
+
+    if (type == JSTYPE_NUMBER) {
+        if (JSVAL_IS_DOUBLE(*vp)) {
+            jsdouble d = *JSVAL_TO_DOUBLE(*vp);
+            if (!JSDOUBLE_IS_FINITE(d))
+                outputString = JS_NewStringCopyN(cx, "null", 4);
+            else
+                outputString = s;
+        } else {
+            outputString = s;
+        }
+    } else if (type == JSTYPE_BOOLEAN) {
+        outputString = s;
+    } else if (JSVAL_IS_NULL(*vp)) {
+        outputString = JS_NewStringCopyN(cx, "null", 4);
+    } else {
+        JS_NOT_REACHED("A type we don't know about");
+        return JS_FALSE; // encoding error
+    }
+
+    if (!outputString)
+        return JS_FALSE;
+
+    return callback(JS_GetStringChars(outputString), JS_GetStringLength(outputString), data);
+}
+
+static JSBool
+stringify(JSContext *cx, jsval *vp, JSObject *replacer,
+          JSONWriteCallback callback, void *data, uint32 depth)
 {
     if (depth > JSON_MAX_DEPTH)
         return JS_FALSE; /* encoding error */
 
     JSBool ok = JS_TRUE;
     JSObject *obj = JSVAL_TO_OBJECT(*vp);
     JSBool isArray = JS_IsArrayObject(cx, obj);
     jschar output = jschar(isArray ? '[' : '{');
@@ -271,18 +303,30 @@ js_Stringify(JSContext *cx, jsval *vp, J
             } else {
                 ks = js_ValueToString(cx, key);
                 if (!ks) {
                     ok = JS_FALSE;
                     break;
                 }
             }
 
-            ok = JS_GetUCProperty(cx, obj, JS_GetStringChars(ks),
-                                  JS_GetStringLength(ks), &outputValue);
+            // Don't include prototype properties, since this operation is
+            // supposed to be implemented as if by ES3.1 Object.keys()
+            jsid id;
+            jsval v = JS_FALSE;
+            if (!js_ValueToStringId(cx, STRING_TO_JSVAL(ks), &id) ||
+                !js_HasOwnProperty(cx, obj->map->ops->lookupProperty, obj, id, &v)) {
+                ok = JS_FALSE;
+                break;
+            } else if (v == JSVAL_TRUE) {
+                ok = JS_GetUCProperty(cx, obj, JS_GetStringChars(ks),
+                                      JS_GetStringLength(ks), &outputValue);
+            } else {
+                continue;
+            }
         }
 
         if (!ok)
             break;
 
         // if this is an array, holes are transmitted as null
         if (isArray && outputValue == JSVAL_VOID) {
             outputValue = JSVAL_NULL;
@@ -296,17 +340,17 @@ js_Stringify(JSContext *cx, jsval *vp, J
         if (outputValue == JSVAL_VOID)
             continue;
 
         // output a comma unless this is the first member to write
         if (memberWritten) {
             output = jschar(',');
             ok = callback(&output, 1, data);
         if (!ok)
-                break;
+            break;
         }
         memberWritten = JS_TRUE;
 
         JSType type = JS_TypeOfValue(cx, outputValue);
 
         // Can't encode these types, so drop them
         if (type == JSTYPE_FUNCTION || type == JSTYPE_XML)
             break;
@@ -329,84 +373,64 @@ js_Stringify(JSContext *cx, jsval *vp, J
             output = jschar(':');
             ok = callback(&output, 1, data);
             if (!ok)
                 break;
         }
 
         if (!JSVAL_IS_PRIMITIVE(outputValue)) {
             // recurse
-            ok = js_Stringify(cx, &outputValue, replacer, callback, data, depth + 1);
+            ok = stringify(cx, &outputValue, replacer, callback, data, depth + 1);
         } else {
-            JSString *outputString;
-            s = js_ValueToString(cx, outputValue);
-            if (!s) {
-                ok = JS_FALSE;
-                break;
-            }
-
-            if (type == JSTYPE_STRING) {
-                ok = write_string(cx, callback, data, JS_GetStringChars(s), JS_GetStringLength(s));
-                if (!ok)
-                    break;
-
-                continue;
-            }
-
-            if (type == JSTYPE_NUMBER) {
-                if (JSVAL_IS_DOUBLE(outputValue)) {
-                    jsdouble d = *JSVAL_TO_DOUBLE(outputValue);
-                    if (!JSDOUBLE_IS_FINITE(d))
-                        outputString = JS_NewStringCopyN(cx, "null", 4);
-                    else
-                        outputString = s;
-                } else {
-                    outputString = s;
-                }
-            } else if (type == JSTYPE_BOOLEAN) {
-                outputString = s;
-            } else if (JSVAL_IS_NULL(outputValue)) {
-                outputString = JS_NewStringCopyN(cx, "null", 4);
-            } else {
-                ok = JS_FALSE; // encoding error
-                break;
-            }
-
-            if (!outputString) {
-                ok = JS_FALSE;
-                break;
-            }
-
-            ok = callback(JS_GetStringChars(outputString), JS_GetStringLength(outputString), data);
+            ok = stringify_primitive(cx, &outputValue, callback, data, type);
         }
     } while (ok);
 
     if (iterObj) {
         // Always close the iterator, but make sure not to stomp on OK
         ok &= js_CloseIterator(cx, *vp);
         // encoding error or propagate? FIXME: Bug 408838.
     }
 
-    if (!ok) {
-        JS_ReportError(cx, "Error during JSON encoding");
+    if (!ok)
         return JS_FALSE;
-    }
 
     output = jschar(isArray ? ']' : '}');
     ok = callback(&output, 1, data);
 
+    return ok;                      
+}
+
+JSBool
+js_Stringify(JSContext *cx, jsval *vp, JSObject *replacer,
+             JSONWriteCallback callback, void *data, uint32 depth)
+{
+    JSBool ok = JS_TRUE;
+
+    if (JSVAL_IS_PRIMITIVE(*vp)) {
+        ok = stringify_primitive(cx, vp, callback, data, JS_TypeOfValue(cx, *vp));
+    } else {
+        ok = stringify(cx, vp, replacer, callback, data, depth);
+    }
+
+    if (!ok)
+        JS_ReportError(cx, "Error during JSON encoding");
+
     return ok;
 }
 
 // helper to determine whether a character could be part of a number
 static JSBool IsNumChar(jschar c)
 {
     return ((c <= '9' && c >= '0') || c == '.' || c == '-' || c == '+' || c == 'e' || c == 'E');
 }
 
+static JSBool HandleData(JSContext *cx, JSONParser *jp, JSONDataType type);
+static JSBool PopState(JSONParser *jp);
+
 JSONParser *
 js_BeginJSONParse(JSContext *cx, jsval *rootVal)
 {
     if (!cx)
         return NULL;
 
     JSObject *arr = js_NewArrayObject(cx, 0, NULL);
     if (!arr)
@@ -445,24 +469,38 @@ bad:
 }
 
 JSBool
 js_FinishJSONParse(JSContext *cx, JSONParser *jp)
 {
     if (!jp)
         return JS_TRUE;
 
+    // Check for unprocessed primitives at the root. This doesn't happen for
+    // strings because a closing quote triggers value processing.
+    if ((jp->statep - jp->stateStack) == 1) {
+        if (*jp->statep == JSON_PARSE_STATE_KEYWORD) {
+            if (HandleData(cx, jp, JSON_DATA_KEYWORD)) {
+                PopState(jp);
+            }
+        } else if (*jp->statep == JSON_PARSE_STATE_NUMBER) {
+            if (HandleData(cx, jp, JSON_DATA_NUMBER)) {
+                PopState(jp);
+            }
+        }
+    }
+
     if (jp->objectKey)
         js_FinishStringBuffer(jp->objectKey);
     JS_free(cx, jp->objectKey);
 
     if (jp->buffer)
         js_FinishStringBuffer(jp->buffer);
     JS_free(cx, jp->buffer);
-    
+
     if (!js_RemoveRoot(cx->runtime, &jp->objectStack))
         return JS_FALSE;
     JSBool ok = *jp->statep == JSON_PARSE_STATE_FINISHED;
     JS_free(cx, jp);
 
     return ok;
 }
 
@@ -562,21 +600,24 @@ PushObject(JSContext *cx, JSONParser *jp
 }
 
 static JSObject *
 GetTopOfObjectStack(JSContext *cx, JSONParser *jp)
 {
     jsuint length;
     if (!js_GetLengthProperty(cx, jp->objectStack, &length))
         return NULL;
-    
+
+    if (length == 0)
+        return NULL;
+
     jsval o;
     if (!OBJ_GET_PROPERTY(cx, jp->objectStack, INT_TO_JSID(length - 1), &o))
         return NULL;
-    
+
     JS_ASSERT(!JSVAL_IS_PRIMITIVE(o));
     return JSVAL_TO_OBJECT(o);
 }
 
 static JSBool
 OpenObject(JSContext *cx, JSONParser *jp)
 {
     JSObject *obj = js_NewObject(cx, &js_ObjectClass, NULL, NULL, 0);
@@ -618,36 +659,44 @@ CloseArray(JSContext *cx, JSONParser *jp
 static JSBool
 HandleNumber(JSContext *cx, JSONParser *jp, const jschar *buf, uint32 len)
 {
     const jschar *ep;
     double val;
     if (!js_strtod(cx, buf, buf + len, &ep, &val) || ep != buf + len)
         return JS_FALSE;
 
-    JSBool ok;
     jsval numVal;
     JSObject *obj = GetTopOfObjectStack(cx, jp);
-    if (obj && JS_NewNumberValue(cx, val, &numVal))
-        ok = PushValue(cx, jp, obj, numVal);
-    else
-        ok = JS_FALSE; // decode error
+
+    if (!JS_NewNumberValue(cx, val, &numVal))
+        return JS_FALSE;
 
-    return ok;
+    if (obj)
+        return PushValue(cx, jp, obj, numVal);
+
+    // nothing on the object stack, so number value as root
+    *jp->rootVal = numVal;
+    return JS_TRUE;
 }
 
 static JSBool
 HandleString(JSContext *cx, JSONParser *jp, const jschar *buf, uint32 len)
 {
     JSObject *obj = GetTopOfObjectStack(cx, jp);
     JSString *str = js_NewStringCopyN(cx, buf, len);
-    if (!obj || !str)
+    if (!str)
         return JS_FALSE;
 
-    return PushValue(cx, jp, obj, STRING_TO_JSVAL(str));
+    if (obj)
+        return PushValue(cx, jp, obj, STRING_TO_JSVAL(str));
+
+    // root value must be primitive
+    *jp->rootVal = STRING_TO_JSVAL(str);
+    return JS_TRUE;
 }
 
 static JSBool
 HandleKeyword(JSContext *cx, JSONParser *jp, const jschar *buf, uint32 len)
 {
     jsval keyword;
     JSTokenType tt = js_CheckKeyword(buf, len);
     if (tt != TOK_PRIMARY)
@@ -658,20 +707,22 @@ HandleKeyword(JSContext *cx, JSONParser 
     else if (buf[0] == 't')
         keyword = JSVAL_TRUE;
     else if (buf[0] == 'f')
         keyword = JSVAL_FALSE;
     else
         return JS_FALSE;
 
     JSObject *obj = GetTopOfObjectStack(cx, jp);
-    if (!obj)
-        return JS_FALSE;
+    if (obj)
+        return PushValue(cx, jp, obj, keyword);
 
-    return PushValue(cx, jp, obj, keyword);
+    // root value must be primitive
+    *jp->rootVal = keyword;
+    return JS_TRUE;
 }
 
 static JSBool
 HandleData(JSContext *cx, JSONParser *jp, JSONDataType type)
 {
   JSBool ok = JS_FALSE;
 
   if (!STRING_BUFFER_OK(jp->buffer))
@@ -706,17 +757,17 @@ HandleData(JSContext *cx, JSONParser *jp
 }
 
 JSBool
 js_ConsumeJSONText(JSContext *cx, JSONParser *jp, const jschar *data, uint32 len)
 {
     uint32 i;
 
     if (*jp->statep == JSON_PARSE_STATE_INIT) {
-        PushState(jp, JSON_PARSE_STATE_OBJECT_VALUE);
+        PushState(jp, JSON_PARSE_STATE_VALUE);
     }
 
     for (i = 0; i < len; i++) {
         jschar c = data[i];
         switch (*jp->statep) {
             case JSON_PARSE_STATE_VALUE :
                 if (c == ']') {
                     // empty array
@@ -925,18 +976,18 @@ json_toSource(JSContext *cx, uintN argc,
     return JS_TRUE;
 }
 #endif
 
 static JSFunctionSpec json_static_methods[] = {
 #if JS_HAS_TOSOURCE
     JS_FN(js_toSource_str,  json_toSource,      0, 0),
 #endif
-    JS_FN("parse",          js_json_parse,      0, 0),
-    JS_FN("stringify",      js_json_stringify,  0, 0),
+    JS_FN("parse",          js_json_parse,      1, 0),
+    JS_FN("stringify",      js_json_stringify,  1, 0),
     JS_FS_END
 };
 
 JSObject *
 js_InitJSONClass(JSContext *cx, JSObject *obj)
 {
     JSObject *JSON;