StructuredClone of prototype objects

[ADKaster]

The spec steps for structured serialize internal https://html.spec.whatwg.org/multipage/structured-data.html#structuredserializeinternal don't seem to preclude serializing object prototypes:

In step 21, the algorithm precludes any objects with funky internal slots

21. Otherwise, if value has any internal slot other than [[Prototype]] or [[Extensible]], then throw a "DataCloneError" DOMException.

If we look at the ES spec for RegExp Prototype: https://tc39.es/ecma262/#sec-properties-of-the-regexp-prototype-object

It says that that object:

• is %RegExp.prototype%.
• is an ordinary object.
• is not a RegExp instance and does not have a [[RegExpMatcher]] internal slot or any of the other internal slots of RegExp instance objects.
• has a [[Prototype]] internal slot whose value is %Object.prototype%.

Which suggests to me that it should fall through to the next step, step 23, which says:

23. Otherwise, if value is an exotic object and value is not the %Object.prototype% intrinsic object associated with any realm, then throw a "DataCloneError" DOMException.

Since %RegExp.prototype% is an ordinary object, it's not exotic, and so it should be cloneable as any other object.

However, only chromium lets me structuredClone this object, both Firefox and Safari reject it.

Is the intention of the spec to disallow cloning intrinsic prototype objects, or is this a bug against Gecko/Webkit?

[domenic]

This is a bug against Gecko/WebKit :)

[bathos]

@ADKaster If you open FF/WebKit issues for this, you may wish to note that (at least in FF) this doesn’t appear to be unique to %RegExp.prototype%. Firefox is rejecting every intrinsic prototype despite the absence of own enumerable properties that would cause failure for other reasons — %Date.prototype%, %Error.prototype%, %WeakMap.prototype%, etc.

Since this amounts to a hidden branding mechanism for non-callable intrinsic objects that should be possible to reimplement/virtualize in the ES layer, pinging @mhofman & @erights.

[ADKaster]

@bathos ah, I created bugs for both of those earlier today

https://bugzilla.mozilla.org/show_bug.cgi?id=1853050
https://bugs.webkit.org/show_bug.cgi?id=261528

[erights]

Thanks!

Pinging also @ljharb , who is interested in such branding abilities.

[bathos]

@erights I left additional FF-specific findings on @ADKaster’s Bugzilla issue, including that some exceptions exist and that (most) intrinsic namespace objects (%Math%, etc) are affected, too. The specific hidden cross-realm brand object set is likely different in WebKit, but I’m not able to test there presently.