Parents: #473, #493 Related: #460, #461, #516, #518, #519, #556, #558
Problem
writeJsonString appends every ordinary byte separately. Large already-safe strings therefore execute one grow/capacity check and list-length mutation per byte even though their output is a contiguous copy. Property names and string values both take this path, so attacker-controlled string width can turn serialization into avoidable dispatch and allocator bookkeeping.
Scope
- Land benchmark-first rows for large plain ASCII strings at multiple widths, valid multibyte Unicode, sparse mixed escapes including quotes/backslashes/control bytes, lone-surrogate WTF-8, and a short-string control.
- Scan once for JSON escape boundaries and append maximal ordinary byte runs in bulk.
- Preserve exact escaping, lowercase hexadecimal spelling, WTF-8 lone-surrogate behavior, property-name/value output, and all replacer/toJSON/property-order semantics.
- Keep temporary/output ownership and OOM propagation exact; do not introduce persistent caches or alternate string representations.
No-workaround rules
- No input recognition, output precomputation, skipped escaping validation, ASCII-only shortcut, replacement of lone surrogates, changed JSON spelling, system JSON library, or hidden lower input cap.
- Do not touch stacks, queues, jobs, Promise/microtask, or Worker lifecycle code.
Acceptance
- Benchmark source, widths, escape distribution, Unicode/WTF-8 controls, checksums, jobs, warmup, and timed boundary land before the runtime change.
- Ordinary byte runs are appended in bulk with O(n) scanning and bounded transient storage; no-escape strings do not perform per-byte output appends.
- Quotes, reverse solidus, named controls, other U+0000–U+001F controls, valid Unicode, lone high/low surrogates, property keys, and string values preserve exact output.
- Focused OOM, deep/wide, precise-GC, TSan, forced execution modes where eligible, JSON.stringify test262, and full units pass without regressions.
- Seven-pair exact-parent evidence publishes wall, CPU, peak RSS, instructions/cycles/energy availability, thermal state, and dispersion with no discarded samples; the short-string control has no regression.
Security boundary
String width, escape density, byte distribution, surrogate shape, callback behavior, and allocation pressure are attacker-controlled. The optimization reduces ordinary-output work without weakening JSON escaping or turning partial allocation failure into observable partial output.
Resolution
- Benchmark foundation:
98972688 - Runtime:
a7da43f4 - Evidence:
6dbe188f - Exact-parent overview