normalize() throws when a getter throws a Symbol or a null-prototype object #25920

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Not applicable. The reproduction calls normalize from @sentry/core directly, without a DSN.

Which SDK are you using?

@sentry/core (the normalize utility that every SDK uses)

SDK Version

11.10.0

Steps to Reproduce

Node.js 24.21.0:

const { normalize } = require('@sentry/core')

const throwsError = { get x() { throw new Error('getter failed') } }
const throwsSymbol = { get x() { throw Symbol('s') } }
const throwsNullProto = { get x() { throw Object.create(null) } }

normalize({ bad: throwsError }, 3)
normalize({ bad: throwsSymbol }, 3)
normalize({ bad: throwsNullProto }, 3)

Expected Result

normalize returns the **non-serializable** marker for all three, as its JSDoc states: "returns A normalized version of the object, or "**non-serializable**" if any errors are thrown during normalization."

Actual Result

{ ERROR: '**non-serializable** (Error: getter failed)' }
TypeError: Cannot convert a Symbol value to a string
TypeError: Cannot convert object to primitive value

The second and third calls throw out of normalize.

Additional Context

Both catch blocks in packages/core/src/utils/normalize.ts (in normalize and in stringifyValue) build the marker with a template literal, `**non-serializable** (${err})`. The template literal converts the caught value to a string. That conversion throws for a Symbol and for an object without a usable toString or Symbol.toPrimitive. The current develop branch has the same code. A conversion that cannot throw, with a fixed fallback text, would keep normalize total.