dlls/jscript/json.c

   1 /*
   2  * Copyright 2016 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <math.h>
  20 #include <assert.h>
  21
  22 #include "jscript.h"
  23 #include "parser.h"
  24
  25 #include "wine/debug.h"
  26
  27 WINE_DEFAULT_DEBUG_CHANNEL(jscript);
  28
  29 typedef struct {
  30     const WCHAR *ptr;
  31     const WCHAR *end;
  32     script_ctx_t *ctx;
  33 } json_parse_ctx_t;
  34
  35 static BOOL is_json_space(WCHAR c)
  36 {
  37     return c == ' ' || c == '\t' || c == '\n' || c == '\r';
  38 }
  39
  40 static WCHAR skip_spaces(json_parse_ctx_t *ctx)
  41 {
  42     while(is_json_space(*ctx->ptr))
  43         ctx->ptr++;
  44     return *ctx->ptr;
  45 }
  46
  47 static BOOL is_keyword(json_parse_ctx_t *ctx, const WCHAR *keyword)
  48 {
  49     unsigned i;
  50     for(i=0; keyword[i]; i++) {
  51         if(!ctx->ptr[i] || keyword[i] != ctx->ptr[i])
  52             return FALSE;
  53     }
  54     if(is_identifier_char(ctx->ptr[i]))
  55         return FALSE;
  56     ctx->ptr += i;
  57     return TRUE;
  58 }
  59
  60 /* ECMA-262 5.1 Edition    15.12.1.1 */
  61 static HRESULT parse_json_string(json_parse_ctx_t *ctx, WCHAR **r)
  62 {
  63     const WCHAR *ptr = ++ctx->ptr;
  64     size_t len;
  65     WCHAR *buf;
  66
  67     while(*ctx->ptr && *ctx->ptr != '"') {
  68         if(*ctx->ptr++ == '\\')
  69             ctx->ptr++;
  70     }
  71     if(!*ctx->ptr) {
  72         FIXME("unterminated string\n");
  73         return E_FAIL;
  74     }
  75
  76     len = ctx->ptr-ptr;
  77     buf = malloc((len+1)*sizeof(WCHAR));
  78     if(!buf)
  79         return E_OUTOFMEMORY;
  80     if(len)
  81         memcpy(buf, ptr, len*sizeof(WCHAR));
  82
  83     if(!unescape(buf, &len)) {
  84         FIXME("unescape failed\n");
  85         free(buf);
  86         return E_FAIL;
  87     }
  88
  89     buf[len] = 0;
  90     ctx->ptr++;
  91     *r = buf;
  92     return S_OK;
  93 }
  94
  95 /* ECMA-262 5.1 Edition    15.12.1.2 */
  96 static HRESULT parse_json_value(json_parse_ctx_t *ctx, jsval_t *r)
  97 {
  98     HRESULT hres;
  99
 100     switch(skip_spaces(ctx)) {
 101
 102     /* JSONNullLiteral */
 103     case 'n':
 104         if(!is_keyword(ctx, L"null"))
 105             break;
 106         *r = jsval_null();
 107         return S_OK;
 108
 109     /* JSONBooleanLiteral */
 110     case 't':
 111         if(!is_keyword(ctx, L"true"))
 112             break;
 113         *r = jsval_bool(TRUE);
 114         return S_OK;
 115     case 'f':
 116         if(!is_keyword(ctx, L"false"))
 117             break;
 118         *r = jsval_bool(FALSE);
 119         return S_OK;
 120
 121     /* JSONObject */
 122     case '{': {
 123         WCHAR *prop_name;
 124         jsdisp_t *obj;
 125         jsval_t val;
 126
 127         hres = create_object(ctx->ctx, NULL, &obj);
 128         if(FAILED(hres))
 129             return hres;
 130
 131         ctx->ptr++;
 132         if(skip_spaces(ctx) == '}') {
 133             ctx->ptr++;
 134             *r = jsval_obj(obj);
 135             return S_OK;
 136         }
 137
 138         while(1) {
 139             if(*ctx->ptr != '"')
 140                 break;
 141             hres = parse_json_string(ctx, &prop_name);
 142             if(FAILED(hres))
 143                 break;
 144
 145             if(skip_spaces(ctx) != ':') {
 146                 FIXME("missing ':'\n");
 147                 free(prop_name);
 148                 break;
 149             }
 150
 151             ctx->ptr++;
 152             hres = parse_json_value(ctx, &val);
 153             if(SUCCEEDED(hres)) {
 154                 hres = jsdisp_propput_name(obj, prop_name, val);
 155                 jsval_release(val);
 156             }
 157             free(prop_name);
 158             if(FAILED(hres))
 159                 break;
 160
 161             if(skip_spaces(ctx) == '}') {
 162                 ctx->ptr++;
 163                 *r = jsval_obj(obj);
 164                 return S_OK;
 165             }
 166
 167             if(*ctx->ptr++ != ',') {
 168                 FIXME("expected ','\n");
 169                 break;
 170             }
 171             skip_spaces(ctx);
 172         }
 173
 174         jsdisp_release(obj);
 175         break;
 176     }
 177
 178     /* JSONString */
 179     case '"': {
 180         WCHAR *string;
 181         jsstr_t *str;
 182
 183         hres = parse_json_string(ctx, &string);
 184         if(FAILED(hres))
 185             return hres;
 186
 187         /* FIXME: avoid reallocation */
 188         str = jsstr_alloc(string);
 189         free(string);
 190         if(!str)
 191             return E_OUTOFMEMORY;
 192
 193         *r = jsval_string(str);
 194         return S_OK;
 195     }
 196
 197     /* JSONArray */
 198     case '[': {
 199         jsdisp_t *array;
 200         unsigned i = 0;
 201         jsval_t val;
 202
 203         hres = create_array(ctx->ctx, 0, &array);
 204         if(FAILED(hres))
 205             return hres;
 206
 207         ctx->ptr++;
 208         if(skip_spaces(ctx) == ']') {
 209             ctx->ptr++;
 210             *r = jsval_obj(array);
 211             return S_OK;
 212         }
 213
 214         while(1) {
 215             hres = parse_json_value(ctx, &val);
 216             if(FAILED(hres))
 217                 break;
 218
 219             hres = jsdisp_propput_idx(array, i, val);
 220             jsval_release(val);
 221             if(FAILED(hres))
 222                 break;
 223
 224             if(skip_spaces(ctx) == ']') {
 225                 ctx->ptr++;
 226                 *r = jsval_obj(array);
 227                 return S_OK;
 228             }
 229
 230             if(*ctx->ptr != ',') {
 231                 FIXME("expected ','\n");
 232                 break;
 233             }
 234
 235             ctx->ptr++;
 236             i++;
 237         }
 238
 239         jsdisp_release(array);
 240         break;
 241     }
 242
 243     /* JSONNumber */
 244     default: {
 245         int sign = 1;
 246         double n;
 247
 248         if(*ctx->ptr == '-') {
 249             sign = -1;
 250             ctx->ptr++;
 251             skip_spaces(ctx);
 252         }
 253
 254         if(*ctx->ptr == '0' && ctx->ptr + 1 < ctx->end && is_digit(ctx->ptr[1]))
 255             break;
 256
 257         hres = parse_decimal(&ctx->ptr, ctx->end, &n);
 258         if(FAILED(hres))
 259             break;
 260
 261         *r = jsval_number(sign*n);
 262         return S_OK;
 263     }
 264     }
 265
 266     FIXME("Syntax error at %s\n", debugstr_w(ctx->ptr));
 267     return E_FAIL;
 268 }
 269
 270 struct transform_json_object_ctx
 271 {
 272     script_ctx_t *ctx;
 273     IDispatch *reviver;
 274     HRESULT hres;
 275 };
 276
 277 static jsval_t transform_json_object(struct transform_json_object_ctx *proc_ctx, jsdisp_t *holder, jsstr_t *name)
 278 {
 279     jsval_t res, args[2];
 280     const WCHAR *str;
 281
 282     if(!(str = jsstr_flatten(name)))
 283         proc_ctx->hres = E_OUTOFMEMORY;
 284     else
 285         proc_ctx->hres = jsdisp_propget_name(holder, str, &args[1]);
 286     if(FAILED(proc_ctx->hres))
 287         return jsval_undefined();
 288
 289     if(is_object_instance(args[1])) {
 290         jsdisp_t *obj = to_jsdisp(get_object(args[1]));
 291         jsstr_t *jsstr;
 292         DISPID id;
 293         BOOL b;
 294
 295         if(!obj) {
 296             FIXME("non-JS obj in JSON object: %p\n", get_object(args[1]));
 297             proc_ctx->hres = E_NOTIMPL;
 298             goto ret;
 299         }else if(is_class(obj, JSCLASS_ARRAY)) {
 300             unsigned i, length = array_get_length(obj);
 301             WCHAR buf[14], *buf_end;
 302
 303             buf_end = buf + ARRAY_SIZE(buf) - 1;
 304             *buf_end-- = 0;
 305             for(i = 0; i < length; i++) {
 306                 str = idx_to_str(i, buf_end);
 307                 if(!(jsstr = jsstr_alloc(str))) {
 308                     proc_ctx->hres = E_OUTOFMEMORY;
 309                     goto ret;
 310                 }
 311                 res = transform_json_object(proc_ctx, obj, jsstr);
 312                 jsstr_release(jsstr);
 313                 if(is_undefined(res)) {
 314                     if(FAILED(proc_ctx->hres))
 315                         goto ret;
 316                     if(FAILED(jsdisp_get_id(obj, str, 0, &id)))
 317                         continue;
 318                     proc_ctx->hres = disp_delete((IDispatch*)&obj->IDispatchEx_iface, id, &b);
 319                 }else {
 320                     proc_ctx->hres = jsdisp_define_data_property(obj, str, PROPF_WRITABLE | PROPF_ENUMERABLE | PROPF_CONFIGURABLE, res);
 321                     jsval_release(res);
 322                 }
 323                 if(FAILED(proc_ctx->hres))
 324                     goto ret;
 325             }
 326         }else {
 327             id = DISPID_STARTENUM;
 328             for(;;) {
 329                 proc_ctx->hres = jsdisp_next_prop(obj, id, JSDISP_ENUM_OWN_ENUMERABLE, &id);
 330                 if(proc_ctx->hres == S_FALSE)
 331                     break;
 332                 if(FAILED(proc_ctx->hres) || FAILED(proc_ctx->hres = jsdisp_get_prop_name(obj, id, &jsstr)))
 333                     goto ret;
 334                 res = transform_json_object(proc_ctx, obj, jsstr);
 335                 if(is_undefined(res)) {
 336                     if(SUCCEEDED(proc_ctx->hres))
 337                         proc_ctx->hres = disp_delete((IDispatch*)&obj->IDispatchEx_iface, id, &b);
 338                 }else {
 339                     if(!(str = jsstr_flatten(jsstr)))
 340                         proc_ctx->hres = E_OUTOFMEMORY;
 341                     else
 342                         proc_ctx->hres = jsdisp_define_data_property(obj, str, PROPF_WRITABLE | PROPF_ENUMERABLE | PROPF_CONFIGURABLE, res);
 343                     jsval_release(res);
 344                 }
 345                 jsstr_release(jsstr);
 346                 if(FAILED(proc_ctx->hres))
 347                     goto ret;
 348             }
 349         }
 350     }
 351
 352     args[0] = jsval_string(name);
 353     proc_ctx->hres = disp_call_value(proc_ctx->ctx, proc_ctx->reviver, jsval_obj(holder),
 354                                      DISPATCH_METHOD, ARRAY_SIZE(args), args, &res);
 355 ret:
 356     jsval_release(args[1]);
 357     return FAILED(proc_ctx->hres) ? jsval_undefined() : res;
 358 }
 359
 360 /* ECMA-262 5.1 Edition    15.12.2 */
 361 static HRESULT JSON_parse(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsigned argc, jsval_t *argv, jsval_t *r)
 362 {
 363     json_parse_ctx_t parse_ctx;
 364     const WCHAR *buf;
 365     jsdisp_t *root;
 366     jsstr_t *str;
 367     jsval_t ret;
 368     HRESULT hres;
 369
 370     hres = to_flat_string(ctx, argv[0], &str, &buf);
 371     if(FAILED(hres))
 372         return hres;
 373
 374     TRACE("%s\n", debugstr_w(buf));
 375
 376     parse_ctx.ptr = buf;
 377     parse_ctx.end = buf + jsstr_length(str);
 378     parse_ctx.ctx = ctx;
 379     hres = parse_json_value(&parse_ctx, &ret);
 380     if(SUCCEEDED(hres) && skip_spaces(&parse_ctx)) {
 381         FIXME("syntax error\n");
 382         jsval_release(ret);
 383         hres = E_FAIL;
 384     }
 385     jsstr_release(str);
 386     if(FAILED(hres))
 387         return hres;
 388
 389     /* FIXME: check IsCallable */
 390     if(argc > 1 && is_object_instance(argv[1])) {
 391         hres = create_object(ctx, NULL, &root);
 392         if(FAILED(hres)) {
 393             jsval_release(ret);
 394             return hres;
 395         }
 396         hres = jsdisp_define_data_property(root, L"", PROPF_WRITABLE | PROPF_ENUMERABLE | PROPF_CONFIGURABLE, ret);
 397         jsval_release(ret);
 398
 399         if(SUCCEEDED(hres)) {
 400             struct transform_json_object_ctx proc_ctx = { ctx, get_object(argv[1]), S_OK };
 401
 402             str = jsstr_empty();
 403             ret = transform_json_object(&proc_ctx, root, str);
 404             jsstr_release(str);
 405             hres = proc_ctx.hres;
 406         }
 407         jsdisp_release(root);
 408         if(FAILED(hres))
 409             return hres;
 410     }
 411
 412     if(r)
 413         *r = ret;
 414     else
 415         jsval_release(ret);
 416     return S_OK;
 417 }
 418
 419 typedef struct {
 420     script_ctx_t *ctx;
 421
 422     WCHAR *buf;
 423     size_t buf_size;
 424     size_t buf_len;
 425
 426     jsdisp_t **stack;
 427     size_t stack_top;
 428     size_t stack_size;
 429
 430     WCHAR gap[11]; /* according to the spec, it's no longer than 10 chars */
 431
 432     jsdisp_t *replacer;
 433 } stringify_ctx_t;
 434
 435 static BOOL stringify_push_obj(stringify_ctx_t *ctx, jsdisp_t *obj)
 436 {
 437     if(!ctx->stack_size) {
 438         ctx->stack = malloc(4*sizeof(*ctx->stack));
 439         if(!ctx->stack)
 440             return FALSE;
 441         ctx->stack_size = 4;
 442     }else if(ctx->stack_top == ctx->stack_size) {
 443         jsdisp_t **new_stack;
 444
 445         new_stack = realloc(ctx->stack, ctx->stack_size*2*sizeof(*ctx->stack));
 446         if(!new_stack)
 447             return FALSE;
 448         ctx->stack = new_stack;
 449         ctx->stack_size *= 2;
 450     }
 451
 452     ctx->stack[ctx->stack_top++] = obj;
 453     return TRUE;
 454 }
 455
 456 static void stringify_pop_obj(stringify_ctx_t *ctx)
 457 {
 458     ctx->stack_top--;
 459 }
 460
 461 static BOOL is_on_stack(stringify_ctx_t *ctx, jsdisp_t *obj)
 462 {
 463     size_t i = ctx->stack_top;
 464     while(i--) {
 465         if(ctx->stack[i] == obj)
 466             return TRUE;
 467     }
 468     return FALSE;
 469 }
 470
 471 static BOOL append_string_len(stringify_ctx_t *ctx, const WCHAR *str, size_t len)
 472 {
 473     if(!ctx->buf_size) {
 474         ctx->buf = malloc(len*2*sizeof(WCHAR));
 475         if(!ctx->buf)
 476             return FALSE;
 477         ctx->buf_size = len*2;
 478     }else if(ctx->buf_len + len > ctx->buf_size) {
 479         WCHAR *new_buf;
 480         size_t new_size;
 481
 482         new_size = ctx->buf_size * 2 + len;
 483         new_buf = realloc(ctx->buf, new_size*sizeof(WCHAR));
 484         if(!new_buf)
 485             return FALSE;
 486         ctx->buf = new_buf;
 487         ctx->buf_size = new_size;
 488     }
 489
 490     if(len)
 491         memcpy(ctx->buf + ctx->buf_len, str, len*sizeof(WCHAR));
 492     ctx->buf_len += len;
 493     return TRUE;
 494 }
 495
 496 static inline BOOL append_string(stringify_ctx_t *ctx, const WCHAR *str)
 497 {
 498     return append_string_len(ctx, str, lstrlenW(str));
 499 }
 500
 501 static inline BOOL append_char(stringify_ctx_t *ctx, WCHAR c)
 502 {
 503     return append_string_len(ctx, &c, 1);
 504 }
 505
 506 static inline BOOL append_simple_quote(stringify_ctx_t *ctx, WCHAR c)
 507 {
 508     WCHAR str[] = {'\\',c};
 509     return append_string_len(ctx, str, 2);
 510 }
 511
 512 static HRESULT maybe_to_primitive(script_ctx_t *ctx, jsval_t val, jsval_t *r)
 513 {
 514     jsdisp_t *obj;
 515     HRESULT hres;
 516
 517     if(!is_object_instance(val) || !(obj = iface_to_jsdisp(get_object(val))))
 518         return jsval_copy(val, r);
 519
 520     if(is_class(obj, JSCLASS_NUMBER)) {
 521         double n;
 522         hres = to_number(ctx, val, &n);
 523         jsdisp_release(obj);
 524         if(SUCCEEDED(hres))
 525             *r = jsval_number(n);
 526         return hres;
 527     }
 528
 529     if(is_class(obj, JSCLASS_STRING)) {
 530         jsstr_t *str;
 531         hres = to_string(ctx, val, &str);
 532         jsdisp_release(obj);
 533         if(SUCCEEDED(hres))
 534             *r = jsval_string(str);
 535         return hres;
 536     }
 537
 538     if(is_class(obj, JSCLASS_BOOLEAN)) {
 539         *r = jsval_bool(bool_obj_value(obj));
 540         jsdisp_release(obj);
 541         return S_OK;
 542     }
 543
 544     *r = jsval_obj(obj);
 545     return S_OK;
 546 }
 547
 548 /* ECMA-262 5.1 Edition    15.12.3 (abstract operation Quote) */
 549 static HRESULT json_quote(stringify_ctx_t *ctx, const WCHAR *ptr, size_t len)
 550 {
 551     if(!ptr || !append_char(ctx, '"'))
 552         return E_OUTOFMEMORY;
 553
 554     while(len--) {
 555         switch(*ptr) {
 556         case '"':
 557         case '\\':
 558             if(!append_simple_quote(ctx, *ptr))
 559                 return E_OUTOFMEMORY;
 560             break;
 561         case '\b':
 562             if(!append_simple_quote(ctx, 'b'))
 563                 return E_OUTOFMEMORY;
 564             break;
 565         case '\f':
 566             if(!append_simple_quote(ctx, 'f'))
 567                 return E_OUTOFMEMORY;
 568             break;
 569         case '\n':
 570             if(!append_simple_quote(ctx, 'n'))
 571                 return E_OUTOFMEMORY;
 572             break;
 573         case '\r':
 574             if(!append_simple_quote(ctx, 'r'))
 575                 return E_OUTOFMEMORY;
 576             break;
 577         case '\t':
 578             if(!append_simple_quote(ctx, 't'))
 579                 return E_OUTOFMEMORY;
 580             break;
 581         default:
 582             if(*ptr < ' ') {
 583                 WCHAR buf[7];
 584                 swprintf(buf, ARRAY_SIZE(buf), L"\\u%04x", *ptr);
 585                 if(!append_string(ctx, buf))
 586                     return E_OUTOFMEMORY;
 587             }else {
 588                 if(!append_char(ctx, *ptr))
 589                     return E_OUTOFMEMORY;
 590             }
 591         }
 592         ptr++;
 593     }
 594
 595     return append_char(ctx, '"') ? S_OK : E_OUTOFMEMORY;
 596 }
 597
 598 static inline BOOL is_callable(jsdisp_t *obj)
 599 {
 600     return is_class(obj, JSCLASS_FUNCTION);
 601 }
 602
 603 static HRESULT stringify(stringify_ctx_t *ctx, jsdisp_t *object, const WCHAR *name);
 604
 605 /* ECMA-262 5.1 Edition    15.12.3 (abstract operation JA) */
 606 static HRESULT stringify_array(stringify_ctx_t *ctx, jsdisp_t *obj)
 607 {
 608     unsigned length, i, j;
 609     WCHAR name[16];
 610     HRESULT hres;
 611
 612     if(is_on_stack(ctx, obj)) {
 613         FIXME("Found a cycle\n");
 614         return E_FAIL;
 615     }
 616
 617     if(!stringify_push_obj(ctx, obj))
 618         return E_OUTOFMEMORY;
 619
 620     if(!append_char(ctx, '['))
 621         return E_OUTOFMEMORY;
 622
 623     length = array_get_length(obj);
 624
 625     for(i=0; i < length; i++) {
 626         if(i && !append_char(ctx, ','))
 627             return E_OUTOFMEMORY;
 628
 629         if(*ctx->gap) {
 630             if(!append_char(ctx, '\n'))
 631                 return E_OUTOFMEMORY;
 632
 633             for(j=0; j < ctx->stack_top; j++) {
 634                 if(!append_string(ctx, ctx->gap))
 635                     return E_OUTOFMEMORY;
 636             }
 637         }
 638
 639         _itow(i, name, ARRAY_SIZE(name));
 640         hres = stringify(ctx, obj, name);
 641         if(FAILED(hres))
 642             return hres;
 643         if(hres == S_FALSE && !append_string(ctx, L"null"))
 644             return E_OUTOFMEMORY;
 645     }
 646
 647     if((length && *ctx->gap && !append_char(ctx, '\n')) || !append_char(ctx, ']'))
 648         return E_OUTOFMEMORY;
 649
 650     stringify_pop_obj(ctx);
 651     return S_OK;
 652 }
 653
 654 /* ECMA-262 5.1 Edition    15.12.3 (abstract operation JO) */
 655 static HRESULT stringify_object(stringify_ctx_t *ctx, jsdisp_t *obj)
 656 {
 657     DISPID dispid = DISPID_STARTENUM;
 658     unsigned prop_cnt = 0, i;
 659     size_t stepback;
 660     BSTR prop_name;
 661     HRESULT hres;
 662
 663     if(is_on_stack(ctx, obj)) {
 664         FIXME("Found a cycle\n");
 665         return E_FAIL;
 666     }
 667
 668     if(!stringify_push_obj(ctx, obj))
 669         return E_OUTOFMEMORY;
 670
 671     if(!append_char(ctx, '{'))
 672         return E_OUTOFMEMORY;
 673
 674     while((hres = IDispatchEx_GetNextDispID(&obj->IDispatchEx_iface, fdexEnumDefault, dispid, &dispid)) == S_OK) {
 675         stepback = ctx->buf_len;
 676
 677         if(prop_cnt && !append_char(ctx, ',')) {
 678             hres = E_OUTOFMEMORY;
 679             break;
 680         }
 681
 682         if(*ctx->gap) {
 683             if(!append_char(ctx, '\n')) {
 684                 hres = E_OUTOFMEMORY;
 685                 break;
 686             }
 687
 688             for(i=0; i < ctx->stack_top; i++) {
 689                 if(!append_string(ctx, ctx->gap)) {
 690                     hres = E_OUTOFMEMORY;
 691                     break;
 692                 }
 693             }
 694         }
 695
 696         hres = IDispatchEx_GetMemberName(&obj->IDispatchEx_iface, dispid, &prop_name);
 697         if(FAILED(hres))
 698             return hres;
 699
 700         hres = json_quote(ctx, prop_name, SysStringLen(prop_name));
 701         if(FAILED(hres)) {
 702             SysFreeString(prop_name);
 703             return hres;
 704         }
 705
 706         if(!append_char(ctx, ':') || (*ctx->gap && !append_char(ctx, ' '))) {
 707             SysFreeString(prop_name);
 708             return E_OUTOFMEMORY;
 709         }
 710
 711         hres = stringify(ctx, obj, prop_name);
 712         SysFreeString(prop_name);
 713         if(FAILED(hres))
 714             return hres;
 715
 716         if(hres == S_FALSE) {
 717             ctx->buf_len = stepback;
 718             continue;
 719         }
 720
 721         prop_cnt++;
 722     }
 723
 724     if(prop_cnt && *ctx->gap) {
 725         if(!append_char(ctx, '\n'))
 726             return E_OUTOFMEMORY;
 727
 728         for(i=1; i < ctx->stack_top; i++) {
 729             if(!append_string(ctx, ctx->gap)) {
 730                 hres = E_OUTOFMEMORY;
 731                 break;
 732             }
 733         }
 734     }
 735
 736     if(!append_char(ctx, '}'))
 737         return E_OUTOFMEMORY;
 738
 739     stringify_pop_obj(ctx);
 740     return S_OK;
 741 }
 742
 743 /* ECMA-262 5.1 Edition    15.12.3 (abstract operation Str) */
 744 static HRESULT stringify(stringify_ctx_t *ctx, jsdisp_t *object, const WCHAR *name)
 745 {
 746     jsval_t value, v;
 747     HRESULT hres;
 748
 749     hres = jsdisp_propget_name(object, name, &value);
 750     if(FAILED(hres))
 751         return hres == DISP_E_UNKNOWNNAME ? S_FALSE : hres;
 752
 753     if(is_object_instance(value)) {
 754         jsdisp_t *obj;
 755         DISPID id;
 756
 757         obj = to_jsdisp(get_object(value));
 758         if(!obj) {
 759             jsval_release(value);
 760             return S_FALSE;
 761         }
 762
 763         hres = jsdisp_get_id(obj, L"toJSON", 0, &id);
 764         if(hres == S_OK)
 765             FIXME("Use toJSON.\n");
 766     }
 767
 768     if(ctx->replacer) {
 769         jsstr_t *name_str;
 770         jsval_t args[2];
 771         if(!(name_str = jsstr_alloc(name))) {
 772             jsval_release(value);
 773             return E_OUTOFMEMORY;
 774         }
 775         args[0] = jsval_string(name_str);
 776         args[1] = value;
 777         hres = jsdisp_call_value(ctx->replacer, jsval_obj(object), DISPATCH_METHOD, ARRAY_SIZE(args), args, &v);
 778         jsstr_release(name_str);
 779         jsval_release(value);
 780         if(FAILED(hres))
 781             return hres;
 782         value = v;
 783     }
 784
 785     v = value;
 786     hres = maybe_to_primitive(ctx->ctx, v, &value);
 787     jsval_release(v);
 788     if(FAILED(hres))
 789         return hres;
 790
 791     switch(jsval_type(value)) {
 792     case JSV_NULL:
 793         if(is_null_disp(value))
 794             hres = S_FALSE;
 795         else if(!append_string(ctx, L"null"))
 796             hres = E_OUTOFMEMORY;
 797         break;
 798     case JSV_BOOL:
 799         if(!append_string(ctx, get_bool(value) ? L"true" : L"false"))
 800             hres = E_OUTOFMEMORY;
 801         break;
 802     case JSV_STRING: {
 803         jsstr_t *str = get_string(value);
 804         const WCHAR *ptr = jsstr_flatten(str);
 805         if(ptr)
 806             hres = json_quote(ctx, ptr, jsstr_length(str));
 807         else
 808             hres = E_OUTOFMEMORY;
 809         break;
 810     }
 811     case JSV_NUMBER: {
 812         double n = get_number(value);
 813         if(isfinite(n)) {
 814             const WCHAR *ptr;
 815             jsstr_t *str;
 816
 817             /* FIXME: Optimize. There is no need for jsstr_t here. */
 818             hres = double_to_string(n, &str);
 819             if(FAILED(hres))
 820                 break;
 821
 822             ptr = jsstr_flatten(str);
 823             assert(ptr != NULL);
 824             hres = ptr && !append_string_len(ctx, ptr, jsstr_length(str)) ? E_OUTOFMEMORY : S_OK;
 825             jsstr_release(str);
 826         }else {
 827             if(!append_string(ctx, L"null"))
 828                 hres = E_OUTOFMEMORY;
 829         }
 830         break;
 831     }
 832     case JSV_OBJECT: {
 833         jsdisp_t *obj;
 834
 835         obj = iface_to_jsdisp(get_object(value));
 836         if(!obj) {
 837             hres = S_FALSE;
 838             break;
 839         }
 840
 841         if(!is_callable(obj))
 842             hres = is_class(obj, JSCLASS_ARRAY) ? stringify_array(ctx, obj) : stringify_object(ctx, obj);
 843         else
 844             hres = S_FALSE;
 845
 846         jsdisp_release(obj);
 847         break;
 848     }
 849     case JSV_UNDEFINED:
 850         hres = S_FALSE;
 851         break;
 852     case JSV_VARIANT:
 853         FIXME("VARIANT\n");
 854         hres = E_NOTIMPL;
 855         break;
 856     }
 857
 858     jsval_release(value);
 859     return hres;
 860 }
 861
 862 /* ECMA-262 5.1 Edition    15.12.3 */
 863 static HRESULT JSON_stringify(script_ctx_t *ctx, jsval_t vthis, WORD flags, unsigned argc, jsval_t *argv, jsval_t *r)
 864 {
 865     stringify_ctx_t stringify_ctx = { ctx };
 866     jsdisp_t *obj = NULL, *replacer;
 867     HRESULT hres;
 868
 869     TRACE("\n");
 870
 871     if(!argc) {
 872         if(r)
 873             *r = jsval_undefined();
 874         return S_OK;
 875     }
 876
 877     if(argc >= 2 && is_object_instance(argv[1]) && (replacer = to_jsdisp(get_object(argv[1])))) {
 878         if(is_callable(replacer)) {
 879             stringify_ctx.replacer = jsdisp_addref(replacer);
 880         }else if(is_class(replacer, JSCLASS_ARRAY)) {
 881             FIXME("Array replacer not yet supported\n");
 882             return E_NOTIMPL;
 883         }
 884     }
 885
 886     if(argc >= 3) {
 887         jsval_t space_val;
 888
 889         hres = maybe_to_primitive(ctx, argv[2], &space_val);
 890         if(FAILED(hres))
 891             goto fail;
 892
 893         if(is_number(space_val)) {
 894             double n = get_number(space_val);
 895             if(n >= 1) {
 896                 int i, len;
 897                 if(n > 10)
 898                     n = 10;
 899                 len = floor(n);
 900                 for(i=0; i < len; i++)
 901                     stringify_ctx.gap[i] = ' ';
 902                 stringify_ctx.gap[len] = 0;
 903             }
 904         }else if(is_string(space_val)) {
 905             jsstr_t *space_str = get_string(space_val);
 906             size_t len = jsstr_length(space_str);
 907             if(len > 10)
 908                 len = 10;
 909             jsstr_extract(space_str, 0, len, stringify_ctx.gap);
 910         }
 911
 912         jsval_release(space_val);
 913     }
 914
 915     if(FAILED(hres = create_object(ctx, NULL, &obj)))
 916         goto fail;
 917     if(FAILED(hres = jsdisp_propput_name(obj, L"", argv[0])))
 918         goto fail;
 919
 920     hres = stringify(&stringify_ctx, obj, L"");
 921     if(SUCCEEDED(hres) && r) {
 922         assert(!stringify_ctx.stack_top);
 923
 924         if(hres == S_OK) {
 925             jsstr_t *ret = jsstr_alloc_len(stringify_ctx.buf, stringify_ctx.buf_len);
 926             if(ret)
 927                 *r = jsval_string(ret);
 928             else
 929                 hres = E_OUTOFMEMORY;
 930         }else {
 931             *r = jsval_undefined();
 932         }
 933     }
 934
 935 fail:
 936     if(obj)
 937         jsdisp_release(obj);
 938     if(stringify_ctx.replacer)
 939         jsdisp_release(stringify_ctx.replacer);
 940     free(stringify_ctx.buf);
 941     free(stringify_ctx.stack);
 942     return hres;
 943 }
 944
 945 static const builtin_prop_t JSON_props[] = {
 946     {L"parse",     JSON_parse,     PROPF_METHOD|2},
 947     {L"stringify", JSON_stringify, PROPF_METHOD|3}
 948 };
 949
 950 static const builtin_info_t JSON_info = {
 951     JSCLASS_JSON,
 952     NULL,
 953     ARRAY_SIZE(JSON_props),
 954     JSON_props,
 955     NULL,
 956     NULL
 957 };
 958
 959 HRESULT create_json(script_ctx_t *ctx, jsdisp_t **ret)
 960 {
 961     jsdisp_t *json;
 962     HRESULT hres;
 963
 964     json = calloc(1, sizeof(*json));
 965     if(!json)
 966         return E_OUTOFMEMORY;
 967
 968     hres = init_dispex_from_constr(json, ctx, &JSON_info, ctx->object_constr);
 969     if(FAILED(hres)) {
 970         free(json);
 971         return hres;
 972     }
 973
 974     *ret = json;
 975     return S_OK;
 976 }