The Tor Browser / file revision

 // Any copyright is dedicated to the Public Domain.

 // http://creativecommons.org/licenses/publicdomain/

 var gTestfile = 'stringify-replacer-array-hijinks.js';

 //-----------------------------------------------------------------------------

 var BUGNUMBER = 648471;

 var summary =

   "Better/more correct handling for replacer arrays with getter array index " +

   "properties";

 print(BUGNUMBER + ": " + summary);

 /**************

  * BEGIN TEST *

  **************/

 var replacer = [0, 1, 2, 3];

 Object.prototype[3] = 3;

 Object.defineProperty(replacer, 1, {

   get: function()

   {

     Object.defineProperty(replacer, 4, { value: 4 });

     delete replacer[2];

     delete replacer[3];

     replacer[5] = 5;

     return 1;

   }

 });

 var s =

   JSON.stringify({0: { 1: { 3: { 4: { 5: { 2: "omitted" } } } } } }, replacer);

 // The replacer array's length is as seen on first query, so property names are

 // accumulated for indexes i ∈ {0, 1, 2, 3}, but index 1 deletes 2 and 3, so 2

 // isn't seen but 3 is seen as Object.prototype[3].

 assertEq('{"0":{"1":{"3":{"3":3}},"3":3},"3":3}', s);

 var replacer = [0, 1, 2, 3];

 Object.defineProperty(replacer, 0, {

   get: function()

   {

     replacer.length = 0;

     return {};

   }

 });

 // The replacer.length truncation means only properties on the prototype chain

 // shine through, but it doesn't affect the original bounds of the iteration

 // used to determine property names which will be included in the final string.

 assertEq(JSON.stringify({ 0: 0, 1: 1, 2: 2, 3: 3 }, replacer),

          '{"3":3}');

 /******************************************************************************/

 if (typeof reportCompare === "function")

   reportCompare(true, true);

 print("Tests complete");