fix(ext/web): throw DataCloneError when posting non-serializable values#35604
Merged
bartlomieju merged 1 commit intoJul 1, 2026
Merged
Conversation
denoland#35423 marked URL/URLSearchParams non-serializable via markNotSerializable, but that prototype marker was only consulted in structuredClone(). The postMessage paths check isUncloneable(), which only knew about the per-instance markAsUncloneable marker -- so posting a URL through a MessageChannel (incl. node:worker_threads), or through Worker.postMessage, silently serialized to {} instead of throwing, per denoland#35401. Fold the kNotSerializable check into isUncloneable() so the web MessagePort fast path, serializeJsMessageData(), and structuredClone() all reject non-serializable platform types consistently, and drop the now-redundant inline check in structuredClone(). Also guard the node Worker.postMessage fast path, which serialized directly via core.serialize() with no check at all.
bartlomieju
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per the WHATWG/HTML spec, types like
URLandURLSearchParamsare not[Serializable], so sending them through
postMessage()must throw aDataCloneError, which is what browsers and Node both do. #35423 alreadymade
structuredClone()reject them, butpostMessage()still silentlyserialized them to an empty object, both through a web
MessageChannel(including the
node:worker_threadsMessageChannel) and throughWorker.postMessage().The non-serializable marker that #35423 added on the prototypes was only
consulted inside
structuredClone(). ThepostMessagepaths gate on aseparate per-instance "uncloneable" check, so they never saw it. This folds
the prototype marker into that shared check so the MessagePort fast path,
serializeJsMessageData(), andstructuredClone()all reject these typesconsistently, and additionally guards the node
Worker.postMessage()fastpath, which previously serialized directly with no check at all.
Fixes #35401