Bug 1528784 - Pass BigInt as receiver when retrieving "toJSON" property r=anba

Differential Revision: https://phabricator.services.mozilla.com/D20304

--HG--
extra : moz-landing-system : lando

js/src/builtin/JSON.cpp

@@ -288,7 +288,8 @@ static bool PreprocessValue(JSContext* cx, HandleObject holder, KeyType key,
   RootedString keyStr(cx);
 
   // Step 2. Modified by BigInt spec 6.1 to check for a toJSON method on the
-  // BigInt prototype when the value is a BigInt.
+  // BigInt prototype when the value is a BigInt, and to pass the BigInt
+  // primitive value as receiver.
   if (vp.isObject() || vp.isBigInt()) {
     RootedValue toJSON(cx);
     RootedObject obj(cx, JS::ToObject(cx, vp));
@@ -296,7 +297,7 @@ static bool PreprocessValue(JSContext* cx, HandleObject holder, KeyType key,
       return false;
     }
 
-    if (!GetProperty(cx, obj, obj, cx->names().toJSON, &toJSON)) {
+    if (!GetProperty(cx, obj, vp, cx->names().toJSON, &toJSON)) {
       return false;
     }
 

js/src/tests/test262/built-ins/JSON/stringify/bigint-tojson-receiver.js

@@ -0,0 +1,28 @@
+// |reftest| skip-if(!this.hasOwnProperty('BigInt')) -- BigInt is not enabled unconditionally
+// Copyright 2019 Igalia, S.L. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+// Test case written by André Bargull.
+
+/*---
+esid: sec-serializejsonproperty
+description: toJSON method called with BigInt as receiver
+features: [BigInt]
+---*/
+
+assert.throws(TypeError, () => JSON.stringify(1n),
+              "toString throws for BigInt object");
+
+// The BigInt proposal changes the SerializeJSONProperty algorithm to
+// specifically allow passing BigInt objects as receivers for the toJSON
+// method.
+Object.defineProperty(BigInt.prototype, "toJSON", {
+    get() {
+       "use strict";
+        return () => typeof this;
+    }
+});
+
+assert.sameValue(JSON.stringify(1n), "\"bigint\"",
+                 "BigInt toJSON method called with value as receiver");
+
+reportCompare(0, 0);