Parents: #473, #493 Related: #666, #669
Problem
The owned JSON pipeline still sends physical StringCell bytes into canonical semantic consumers at five StringData boundaries:
- primitive String entries in a stringify replacer PropertyList use item.asStr() before encodeStringKey;
- boxed String replacer entries use toStringV before the same canonical key encoding;
- boxed String space values use toStringV and then feed those bytes to Value.strAlloc;
- JSON.rawJSON input uses toStringV before validation/tokenization and canonical String construction;
- validated rawJSON payloads append rawJSON.asStr() to canonical stringify output.
These paths are byte-identical while flat Latin-1 storage is disabled. With the owned flat-string representation active, non-ASCII Latin-1 bytes can address the wrong replacer property, violate canonical StringCell construction, reject valid raw JSON, or emit invalid JSON output.
Scope
- Route primitive replacer String Values through Value.asWtf8.
- Route boxed replacer and boxed gap coercion through the canonical ToString helper.
- Validate JSON.rawJSON over representation-aware canonical input.
- Append raw JSON StringData through representation-aware WTF-8 egress.
- Preserve exact Get/ToString ordering, replacer de-duplication and property order, UTF-16 gap truncation, raw validation, output allocation ownership, thrown exceptions, and OOM propagation.
- Keep ASCII and canonical StringData borrowed with no extra conversion.
- Cover primitive and boxed non-ASCII replacers, boxed non-ASCII gap, and non-ASCII raw JSON input/output under canonical and physical flat-Latin-1 storage.
No-workaround rules
- No flat-storage disablement, eager global canonicalization, replacement characters, altered raw validation, duplicate property retry, hidden second stringify pass, Test262 exclusion, or third-party JSON path.
- No stack, queue, job, Promise, Worker, or Map/Set iterator changes.
Acceptance
- Every affected JSON reader consumes canonical semantic bytes.
- Primitive/boxed replacer lists select and order the exact non-ASCII property once.
- Boxed non-ASCII gap truncates and emits by UTF-16 code units.
- JSON.rawJSON validates and preserves exact non-ASCII text.
- The witness passes with canonical storage and with flat_storage_active enabled, then the switch is restored and not landed.
- Relevant nonzero Test262 accounting, focused Debug/TSan, and full units pass with exact flips reported.