Bug 261528 - structuredClone rejects intrinsic prototype objects
Summary: structuredClone rejects intrinsic prototype objects
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: Safari 17
Hardware: Mac (Apple Silicon) macOS 13
: P2 Normal
Assignee: Nobody
URL:
Keywords: BrowserCompat, InRadar
Depends on:
Blocks:
 
Reported: 2023-09-13 14:17 PDT by Andrew Kaster
Modified: 2023-09-20 14:18 PDT (History)
9 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew Kaster 2023-09-13 14:17:41 PDT
Steps to reproduce:

Open JS console:

```
let a = { "a": 12 }
structuredClone(a.proto)
let b = new RegExp(".", "")
structuredClone(b.proto)
```

Actual results:

The prototype of the ordinary object a is cloned and printed to the console.

A DOM Exception is thrown when trying to clone the RegExp.prototype object from b.

Expected results:

The spec steps for structured serialize internal (html.spec.whatwg.org/multipage/structured-data.html#structuredserializeinternal) don't seem to preclude serializing intrinsic object prototypes:

In step 21, the algorithm precludes any objects with funky internal slots

    Otherwise, if value has any internal slot other than [[Prototype]] or [[Extensible]], then throw a "DataCloneError" DOMException.

If we look at the ES spec for RegExp Prototype: tc39.es/ecma262/#sec-properties-of-the-regexp-prototype-object

It says that that object:

    is %RegExp.prototype%.
    is an ordinary object.
    is not a RegExp instance and does not have a [[RegExpMatcher]] internal slot or any of the other internal slots of RegExp instance objects.
    has a [[Prototype]] internal slot whose value is %Object.prototype%.

Which suggests to me that it should fall through to the next step, step 23, which says:

    Otherwise, if value is an exotic object and value is not the %Object.prototype% intrinsic object associated with any realm, then throw a "DataCloneError" DOMException.

Since %RegExp.prototype% is an ordinary object, it's not exotic, and so it should be cloneable as any other object.

Chromium does this per the spec, and Gecko does not.

Gecko bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1853050
Comment 1 Radar WebKit Bug Importer 2023-09-20 14:18:24 PDT
<rdar://problem/115803873>