Issue #2308 - Fix JSON BigInt regressions.

https://bugzilla.mozilla.org/show_bug.cgi?id=1522433

1 files changed, 8 insertions, 3 deletions

diff --git a/js/src/json.cpp b/js/src/json.cpp
index d426fc721a..193fed1e0d 100644
--- a/js/src/json.cpp
+++ b/js/src/json.cpp
@@ -277,10 +277,15 @@ PreprocessValue(JSContext* cx, HandleObject holder, KeyType key, MutableHandleVa
 
     RootedString keyStr(cx);
 
-    /* Step 2. */
-    if (vp.isObject()) {
+  // Step 2. Modified by BigInt spec 6.1 to check for a toJSON method on the
+  // BigInt prototype when the value is a BigInt.
+  if (vp.isObject() || vp.isBigInt()) {
         RootedValue toJSON(cx);
-        RootedObject obj(cx, &vp.toObject());
+        RootedObject obj(cx, JS::ToObject(cx, vp));
+        if (!obj) {
+          return false;
+        }
+
         if (!GetProperty(cx, obj, obj, cx->names().toJSON, &toJSON))
             return false;