Merged: [json] Need stack run if can not perform fast property enumer…

…ation Fixed: chromium:1478556 (cherry picked from commit 8c8de41) Change-Id: Iff8ab405cbffabf0618dc3871b1d7d5584c7c201 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4856799 Commit-Queue: Matthias Liedtke <[email protected]> Reviewed-by: Matthias Liedtke <[email protected]> Auto-Submit: Jakob Kummerow <[email protected]> Cr-Commit-Position: refs/branch-heads/11.8@{v8#4} Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1} Cr-Branched-From: b82a911-refs/heads/main@{#89779}
hexagon-geo-surv · Sep 12, 2023 · 1783814 · 1783814
1 parent c3f3122
commit 1783814
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/src/json/json-stringifier.cc b/src/json/json-stringifier.cc
@@ -1140,6 +1140,10 @@ JsonStringifier::Result JsonStringifier::SerializeJSObject(
       property = JSObject::FastPropertyAt(
           isolate_, object, details.representation(), field_index);
     } else {
+      if (!need_stack_) {
+        need_stack_ = true;
+        return NEED_STACK;
+      }
       ASSIGN_RETURN_ON_EXCEPTION_VALUE(
           isolate_, property,
           Object::GetPropertyOrElement(isolate_, object, key_name), EXCEPTION);

diff --git a/test/mjsunit/json.js b/test/mjsunit/json.js
@@ -531,3 +531,23 @@ assertEquals(`[
           1,
           2
 ]`, JSON.stringify([1,2], undefined, 1000000000000000));
+
+let obj = { x: 0, y: 1 };
+let other = {};
+let called = false;
+let count = 0;
+
+obj.__defineGetter__(undefined, function() {
+  count++;
+  if (called) {
+    obj["__proto__"] = other["__lookupSetter__"];
+  } else {
+    obj["toLocaleString"] = other["__lookupSetter__"];
+    called = true;
+  }
+});
+
+assertEquals('{"x":0,"y":1}', JSON.stringify(obj));
+assertEquals(1, count);
+assertEquals('{"x":0,"y":1}', JSON.stringify(obj));
+assertEquals(2, count);