fix: isolate extension names from Object.prototype - #4177

Marked version: 18.1.2 / 8babc79

Markdown flavor: n/a (extension API)

Description

Custom extension names such as constructor, toString, and __proto__ collide with inherited properties in the renderer and child-token registries. With walkTokens enabled, parsing an otherwise valid custom token throws this.defaults.extensions.childTokens[genericToken.type].forEach is not a function. A renderer returning false can also call an inherited Object function, producing [object Object] or throwing instead of using registered renderer behavior.

Initialize both registries with Object.create(null), as already done for link definitions. This changes registry initialization only and adds no checks to the parsing or token-walking loops. Existing extension chaining stays intact.

Expectation

This extension should render example and visit its token:

import { Marked } from 'marked';

const marked = new Marked({
  extensions: [{
    name: 'constructor',
    level: 'block',
    tokenizer(src) {
      return { type: 'constructor', raw: src, text: src };
    },
    renderer(token) {
      return token.text;
    },
  }],
  walkTokens() {},
});

console.log(marked.parse('example')); // example

Result

On the current master, this throws during token walking. The online demo filters out extension and walkTokens callbacks, so the runnable JavaScript above reproduces the API issue. Input preview shows the ordinary Markdown input without the custom extension.

Validation

• New public-API regression tests: 12 fail and 3 controls pass before the fix; all 15 pass after. Covers block/inline extensions, nested token traversal, false-return behavior, ordinary names, and fallback to a previously registered renderer.
• Full npm test passes on Node 26.12.1: 1,947 spec tests and 228 unit tests, including builds, module checks, type checks, and ESLint.
• git diff --check passes.
• Small local before/after parse benchmark, seven alternating rounds of 1,000 parses: medians were 80.57/81.77 ms without extensions and 80.02/78.79 ms with an ordinary renderer extension and token walker. This is a local sample, not a general performance guarantee.

Contributor

• Test(s) exist to ensure functionality and minimize regression.
• No tests required for this PR.
• If submitting a new feature, it has been documented in the appropriate places. (Not applicable: bug fix.)

Committer

• CI is green (no forced merge required).
• Squash and Merge PR following conventional commit guidelines.

AI disclosure: Codex (GPT-6) discovered and reproduced the issue, prepared the code, tests, and this description, and ran the checks above. No human review is claimed.