Repository navigation
fix(ext/web): make URL and URLSearchParams non-serializable - #35423
Merged
Merged
Conversation
Per the WHATWG/HTML spec, URL is not [Serializable], so cloning it via structuredClone() or postMessage() must throw a DataCloneError, which is what browsers and Node both do. Deno instead silently produced an empty object because URL is a plain JS class whose state lives in symbol-keyed slots that V8's ValueSerializer drops. Deno already has machinery for this: markNotSerializable() in 13_message_port.js, used by Headers, Request, Response and the stream types. URL and URLSearchParams simply never registered. Mark both prototypes so they take the same DataCloneError path.
bartlomieju
enabled auto-merge (squash)
June 22, 2026 11:01
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per the WHATWG/HTML spec,
URLis not [Serializable], so cloning it viastructuredClone()or sending it throughpostMessage()must throw aDataCloneError, which is what browsers and Node both do. Deno insteadsilently produced an empty object (
instanceof URLis false, stringifiesto
[object Object]) becauseURLis a plain JS class whose state livesin symbol-keyed slots that V8's
ValueSerializerdrops.Deno already has the machinery for this:
markNotSerializable()in13_message_port.js, backed by akNotSerializablesymbol, with theclone/
postMessagepaths checking it and throwing the expectedDataCloneError. The platform types that already behave correctly(
Headers,Request,Response, and the stream types) all call it ontheir prototype;
URLandURLSearchParamssimply never registered.This marks both prototypes so they take the same path.
This covers the top-level case. A non-serializable value nested inside
another object still serializes to
{}, which is a pre-existing,separately-documented limitation that needs a custom V8 serializer
delegate to fully resolve.