Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4f3ecec97431e17f44f275c201a8ba068500c9e5
https://github.com/WebKit/WebKit/commit/4f3ecec97431e17f44f275c201a8ba068500c9e5
Author: Sosuke Suzuki <[email protected]>
Date: 2026-08-06 (Thu, 06 Aug 2026)
Changed paths:
A JSTests/microbenchmarks/json-stringify-class-instances.js
A JSTests/stress/json-stringify-fast-path-custom-prototype-edge-cases.js
A JSTests/stress/json-stringify-fast-path-custom-prototype.js
M Source/JavaScriptCore/runtime/JSONObject.cpp
M Source/JavaScriptCore/runtime/JSObjectInlines.h
Log Message:
-----------
[JSC] `JSON.stringify` fast path should accept final objects with non
`Object` prototypes
https://bugs.webkit.org/show_bug.cgi?id=321151
Reviewed by Yusuke Suzuki.
FastStringifier bails out for any object whose prototype is not
Object.prototype,
so a single class instance in the payload reruns the whole serialization on the
slow path. Since the prototype only matters for the toJSON lookup, allow
FinalObjectType cells with other prototypes when mayHaveToJSON() says the chain
has no toJSON.
This also fixes noSideEffectMayHaveNonIndexProperty() checking
hasNonReifiedStaticProperties() on `this` instead of the current chain entry,
which missed a non-reified static toJSON (e.g. Date.prototype) in the middle of
the chain.
base patched
json-stringify-class-instances 252.0789+-4.5854 ^
71.6873+-0.8488 ^ definitely 3.5164x faster
Tests: JSTests/microbenchmarks/json-stringify-class-instances.js
JSTests/stress/json-stringify-fast-path-custom-prototype-edge-cases.js
JSTests/stress/json-stringify-fast-path-custom-prototype.js
* JSTests/microbenchmarks/json-stringify-class-instances.js: Added.
(Address):
(User):
(User.prototype.get displayName):
(User.prototype.greet):
(Admin):
* JSTests/stress/json-stringify-fast-path-custom-prototype-edge-cases.js: Added.
(shouldBe):
(shouldThrow):
(warm):
(shouldBe.C):
(shouldBe.C.prototype.toJSON):
(shouldBe.D):
(shouldBe.get let):
(shouldBe.get shouldBe):
(get shouldBe):
(get shouldBe.D):
(shouldBe.prototype.let.expected.string_appeared_here.classes.map):
(shouldBe.classes.17.prototype.toJSON):
(C.prototype.toJSON):
(shouldBe.JSON.stringify.C):
(shouldBe.JSON.stringify):
(shouldBe.let.handler.get traps):
(C):
(let.num2.Object.setPrototypeOf.new.Number):
(let.str.Object.setPrototypeOf.new.String):
(shouldBe.JSON.stringify.let.args):
(shouldBe.undefinedAndFunctionValues.fn):
(shouldBe.):
* JSTests/stress/json-stringify-fast-path-custom-prototype.js: Added.
(shouldBe):
(shouldThrow):
(throw.new.Error):
(shouldBe.X):
(prototype.method):
(prototype.get accessor):
(AA):
(i.shouldBe.JSON.stringify):
(shouldBe.JSON.stringify.C):
(shouldBe.JSON.stringify.C.prototype.toJSON):
(shouldBe.JSON.stringify):
(shouldBe.D0):
(shouldBe.D1):
(shouldBe.E):
(shouldBe.get for):
(shouldBe.get let):
(shouldBe.G):
(Object.prototype.toJSON):
* Source/JavaScriptCore/runtime/JSONObject.cpp:
(JSC::bufferMode>::append):
* Source/JavaScriptCore/runtime/JSObjectInlines.h:
(JSC::JSObject::noSideEffectMayHaveNonIndexProperty):
Canonical link: https://commits.webkit.org/318697@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
