System.Text.Json with [JsonExtensionData] on JsonObject serializes a malformed json

[fawques]

Description

When using [JsonExtensionData], I expect roundtrip serialization to work, but when the property is typed as JsonObject, the serialized output is malformed.

I expect JsonObject to be a possible type because the exception thrown when using a different type is:

System.InvalidOperationException: The extension data property 'System.Object.Extensions' is invalid.
It must implement 'IDictionary<string, JsonElement>' or 'IDictionary<string, object>', or be 'JsonObject'.

Reproduction Steps

Executing the following code produces the malformed output: {"a":2,{"b":true,"c":"something"}}

public class MyClass
{
    public int a {get;set;}
    [JsonExtensionData]
    public JsonObject? Extensions { get; set; }
}

var json = @"
{
    ""a"":2,
    ""b"":true,
    ""c"":""something""
}";

var value = JsonSerializer.Deserialize<MyClass>(json);
Console.WriteLine(JsonSerializer.Serialize(value));

https://dotnetfiddle.net/DbSzlH

Expected behavior

The serialized value should be the same as the original:
{"a":2,"b":true,"c":"something"}

Actual behavior

The serialized value is malformed:
{"a":2,{"b":true,"c":"something"}}

Regression?

No response

Known Workarounds

Using 'Dictionary<string, JsonElement>' or 'Dictionary<string, object>' works, only JsonObject fails.

Configuration

.NET 8 and .NET 9
Reproduced in my windows computer, in a linux environment and in dotnetfiddle.

Other information

This ticket #60560 is the same, talking about a custom converter, but there's no custom converter involved here.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-text-json, @gregsdennis
See info in area-owners.md if you want to be subscribed.

[elgonzo]

FYI: Duplicate #97225