JSON.stringify throws circular-structure TypeError for URL nested inside an object/array (runtime walker ignores URL toJSON)

[proggeramlug]

Summary

JSON.stringify of an object/array containing a URL instance throws TypeError: Converting circular structure to JSON. Node serializes the URL via its toJSON() (the href string).

Repro

const u = new URL("http://x/en", "http://x/");
console.log(JSON.stringify({ u }));        // perry: TypeError circular   node: {"u":"http://x/en"}
console.log(JSON.stringify([u]));          // same failure mode
console.log(JSON.stringify({ u }, null, 2));

Root cause area

The runtime tree-walk stringifier (js_json_stringify_full / crates/perry-runtime/src/json/) doesn't honor toJSON on opaque runtime objects like URL. It walks the URL's internal ObjectHeader fields and hits the searchParams back-reference, tripping the circular-structure detector.

Top-level URL arguments are handled by an HIR-time interception (crates/perry-hir/src/lower/expr_call/module_static.rs, arg_is_url → UrlInstanceToJSON wrap), extended to the replacer/spacer forms in PR #6516 (#6488). That interception can only see the call's direct argument — a URL nested inside another value needs the runtime walker to detect the URL object (or generic toJSON support on opaque runtime objects) and emit its href instead of walking its fields.

Notes

• Found while addressing CodeRabbit feedback on PR fix(hir): JSON.stringify(url.toString()) inlined argument returned undefined #6516.
• Same class as the top-level JSON.stringify(u, null, 2) circular throw fixed in that PR, but not reachable from HIR.