1 files changed, 35 insertions, 6 deletions

diff --git a/deps/v8/src/json/json-stringifier.cc b/deps/v8/src/json/json-stringifier.cc
index 98ff273a2e..f718bcd9cf 100644
--- a/deps/v8/src/json/json-stringifier.cc
+++ b/deps/v8/src/json/json-stringifier.cc
@@ -225,14 +225,19 @@ JsonStringifier::JsonStringifier(Isolate* isolate)
 MaybeHandle<Object> JsonStringifier::Stringify(Handle<Object> object,
                                                Handle<Object> replacer,
                                                Handle<Object> gap) {
-  if (!InitializeReplacer(replacer)) return MaybeHandle<Object>();
+  if (!InitializeReplacer(replacer)) {
+    CHECK(isolate_->has_pending_exception());
+    return MaybeHandle<Object>();
+  }
   if (!gap->IsUndefined(isolate_) && !InitializeGap(gap)) {
+    CHECK(isolate_->has_pending_exception());
     return MaybeHandle<Object>();
   }
   Result result = SerializeObject(object);
   if (result == UNCHANGED) return factory()->undefined_value();
   if (result == SUCCESS) return builder_.Finish();
   DCHECK(result == EXCEPTION);
+  CHECK(isolate_->has_pending_exception());
   return MaybeHandle<Object>();
 }
 
@@ -274,6 +279,7 @@ bool JsonStringifier::InitializeReplacer(Handle<Object> replacer) {
       MaybeHandle<OrderedHashSet> set_candidate =
           OrderedHashSet::Add(isolate_, set, key);
       if (!set_candidate.ToHandle(&set)) {
+        CHECK(isolate_->has_pending_exception());
         return false;
       }
     }
@@ -586,11 +592,34 @@ JsonStringifier::Result JsonStringifier::Serialize_(Handle<Object> object,
     case JS_RAW_JSON_TYPE:
       DCHECK(v8_flags.harmony_json_parse_with_source);
       if (deferred_string_key) SerializeDeferredKey(comma, key);
-      builder_.AppendString(Handle<String>::cast(
-          handle(Handle<JSRawJson>::cast(object)->InObjectPropertyAt(
-                     JSRawJson::kRawJsonIndex),
-                 isolate_)));
+      {
+        Handle<JSRawJson> raw_json_obj = Handle<JSRawJson>::cast(object);
+        Handle<String> raw_json;
+        if (raw_json_obj->HasInitialLayout(isolate_)) {
+          // Fast path: the object returned by JSON.rawJSON has its initial map
+          // intact.
+          raw_json = Handle<String>::cast(handle(
+              raw_json_obj->InObjectPropertyAt(JSRawJson::kRawJsonInitialIndex),
+              isolate_));
+        } else {
+          // Slow path: perform a property get for "rawJSON". Because raw JSON
+          // objects are created frozen, it is still guaranteed that there will
+          // be a property named "rawJSON" that is a String. Their initial maps
+          // only change due to VM-internal operations like being optimized for
+          // being used as a prototype.
+          raw_json = Handle<String>::cast(
+              JSObject::GetProperty(isolate_, raw_json_obj,
+                                    isolate_->factory()->raw_json_string())
+                  .ToHandleChecked());
+        }
+        builder_.AppendString(raw_json);
+      }
       return SUCCESS;
+#if V8_ENABLE_WEBASSEMBLY
+    case WASM_STRUCT_TYPE:
+    case WASM_ARRAY_TYPE:
+      return UNCHANGED;
+#endif
     default:
       if (InstanceTypeChecker::IsString(instance_type)) {
         if (deferred_string_key) SerializeDeferredKey(comma, key);
@@ -852,7 +881,7 @@ JsonStringifier::Result JsonStringifier::SerializeJSObject(
     if (details.location() == PropertyLocation::kField &&
         *map == object->map(cage_base)) {
       DCHECK_EQ(PropertyKind::kData, details.kind());
-      FieldIndex field_index = FieldIndex::ForDescriptor(*map, i);
+      FieldIndex field_index = FieldIndex::ForDetails(*map, details);
       property = JSObject::FastPropertyAt(
           isolate_, object, details.representation(), field_index);
     } else {