Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8b9071b24ead48bdb7c31d33afdb5ee6534e6823
https://github.com/WebKit/WebKit/commit/8b9071b24ead48bdb7c31d33afdb5ee6534e6823
Author: Alistair Smith <[email protected]>
Date: 2026-07-10 (Fri, 10 Jul 2026)
Changed paths:
A JSTests/stress/json-stringify-array-prototype-to-json.js
A JSTests/stress/json-stringify-non-enumerable-to-json.js
M Source/JavaScriptCore/runtime/JSONObject.cpp
Log Message:
-----------
[JSC] JSON.stringify's fast path skips a non-enumerable own toJSON and a
replaced array prototype
https://bugs.webkit.org/show_bug.cgi?id=318507
Reviewed by Yusuke Suzuki.
FastStringifier decides for itself whether a value can have a toJSON, and
misses three cases. All three silently produce wrong JSON, or in the last
case skip a TypeError.
The object property loop skips DontEnum entries, but SerializeJSONProperty
looks toJSON up with GetV, so an own toJSON applies even when it is not
enumerable. Check for the toJSON key before skipping DontEnum entries.
For arrays only the global Array.prototype is checked, while
Object.setPrototypeOf, Array subclasses and other realms all keep
ArrayType, so an array can reach the fast path with a prototype nobody
looked at. Bail out when a non-original array structure has a stored
prototype other than Array.prototype, mirroring the object case.
An object with a non-reified static property table can have a toJSON that
is not in the property table yet, so the loop above cannot see it. Bail
out on those, like objectAssignFast does. JSON.stringify(Date.prototype)
returned "{}" instead of throwing.
All three bail out to the general stringifier, which is correct in these
cases. Plain objects and plain arrays are unaffected.
* JSTests/stress/json-stringify-array-prototype-to-json.js: Added.
* JSTests/stress/json-stringify-non-enumerable-to-json.js: Added.
* Source/JavaScriptCore/runtime/JSONObject.cpp:
(JSC::FastStringifier<CharType, bufferMode>::append):
Canonical link: https://commits.webkit.org/316941@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
