Skip to content

Honor toJSON in JSON.stringify's fast path for non-enumerable own properties and swapped array prototypes - #267

Closed
robobun wants to merge 2 commits into
mainfrom
farm/d6770536/json-stringify-non-enumerable-tojson
Closed

Honor toJSON in JSON.stringify's fast path for non-enumerable own properties and swapped array prototypes#267
robobun wants to merge 2 commits into
mainfrom
farm/d6770536/json-stringify-non-enumerable-tojson

Honor an own non-enumerable toJSON in JSON.stringify's fast path

453aa2e
Select commit
Loading
Failed to load commit list.
Claude / Claude Code Review completed Jul 2, 2026 in 25m 17s

Code review found 1 potential issue

Found 2 candidates, confirmed 1. See review comments for details.

Details

Severity Count
🔴 Important 0
🟡 Nit 0
🟣 Pre-existing 1
Severity File:Line Issue
🟣 Pre-existing Source/JavaScriptCore/runtime/JSONObject.cpp:1427-1432 Pre-existing: ArrayType fast path misses toJSON on a custom array prototype

Annotations

Check notice on line 1432 in Source/JavaScriptCore/runtime/JSONObject.cpp

See this annotation in the file changed.

@claude claude / Claude Code Review

Pre-existing: ArrayType fast path misses toJSON on a custom array prototype 

Not from this PR, but since the description cites the `ArrayType` case as the model for this fix: that path has an analogous gap for *inherited* `toJSON`. It calls `mayHaveToJSON` on `m_globalObject.arrayPrototype()` and scans the array's own properties, but never checks the array's actual `storedPrototype()` — so an array whose prototype was swapped via `Object.setPrototypeOf` to one carrying `toJSON` still fast-paths and serializes as `[1,2,3]`. The object case is safe because of the `storedPr
View more details on Claude