diff --git a/index.bs b/index.bs
index 1ec25f51..b68344a8 100644
--- a/index.bs
+++ b/index.bs
@@ -146,6 +146,7 @@ urlPrefix: https://tc39.github.io/ecma262/; spec: ECMA-262
         text: @@unscopables; url: sec-well-known-symbols
         text: NewTarget; url: sec-built-in-function-objects
         text: Number Type; url: sec-ecmascript-language-types-number-type
+        text: JSON.stringify; url: sec-json.stringify
 </pre>
 
 <style>
@@ -553,7 +554,6 @@ underscore.
         "namespace"
         "partial"
         "required"
-        "serializer"
         "setlike"
         "setter"
         "static"
@@ -576,6 +576,11 @@ IDL constructs must not be “constructor”,
 or begin with a <span class="char">U+005F LOW LINE ("_")</span> character.  These
 are known as <dfn id="dfn-reserved-identifier" export>reserved identifiers</dfn>.
 
+Although the “toJSON” [=identifier=] is not a [=reserved identifier=],
+it must only be used for [=regular operations=]
+that convert objects to [=JSON types=],
+as described in [[#idl-tojson-operation]].
+
 Note: Further restrictions on identifier names for particular constructs may be made
 in later sections.
 
@@ -1011,7 +1016,6 @@ The following extended attributes are applicable to interfaces:
     InterfaceMember :
         Const
         Operation
-        Serializer
         Stringifier
         StaticMember
         Iterable
@@ -1361,6 +1365,14 @@ If an attribute has no <emu-t>static</emu-t> keyword, then it declares a
 it declares a [=static attribute=]. Note that in addition to being [=interface members=],
 [=read only=] [=regular attributes=] can be [=namespace members=] as well.
 
+
+<div algorithm>
+    To <dfn export>get the underlying value</dfn> of an attribute |attr| given a value |target|,
+    return the result of performing the actions listed in the description of |attr| that occur on getting,
+    or those listed in the description of the inherited attribute,
+    if |attr| is declared to inherit its getter, on |target| if |target| is not null.
+</div>
+
 The [=identifier=] of an
 [=attribute=]
 must not be the same as the identifier
@@ -1547,7 +1559,6 @@ are applicable only to regular attributes:
 An <dfn id="dfn-operation" export>operation</dfn> is an [=interface member=]
 (matching <emu-t>static</emu-t> <emu-nt><a href="#prod-OperationRest">OperationRest</a></emu-nt>,
 <emu-t>stringifier</emu-t> <emu-nt><a href="#prod-OperationRest">OperationRest</a></emu-nt>,
-<emu-t>serializer</emu-t> <emu-nt><a href="#prod-OperationRest">OperationRest</a></emu-nt>,
 <emu-nt><a href="#prod-ReturnType">ReturnType</a></emu-nt> <emu-nt><a href="#prod-OperationRest">OperationRest</a></emu-nt> or
 <emu-nt><a href="#prod-SpecialOperation">SpecialOperation</a></emu-nt>)
 that defines a behavior that can be invoked on objects implementing the interface.
@@ -1889,6 +1900,7 @@ that has a [=sequence type=] in its [=flattened member types=].
 </p>
 
 The following extended attributes are applicable to operations:
+[{{Default}}],
 [{{Exposed}}],
 [{{NewObject}}],
 [{{SecureContext}}],
@@ -1975,6 +1987,107 @@ The following extended attributes are applicable to operations:
         "void"
 </pre>
 
+<h5 id="idl-tojson-operation">toJSON</h5>
+
+By declaring a <code>toJSON</code> [=regular operation=],
+an [=interface=] specifies how to convert the objects that implement it to [=JSON types=].
+
+The <code>toJSON</code> [=regular operation=] is reserved for this usage.
+It must take zero arguments and return a [=JSON type=].
+
+The <dfn id="dfn-json-types" export lt="JSON type">JSON types</dfn> are:
+
+*   [=numeric types=],
+*   {{boolean}},
+*   [=string types=],
+*   [=nullable types=] whose [=nullable types/inner type=] is a [=JSON type=],
+*   [=annotated types=] whose [=annotated types/inner type=] is a [=JSON type=],
+*   [=union types=] whose [=member types=] are [=JSON types=],
+*   [=sequence types=] whose parameterized type is a [=JSON type=],
+*   [=dictionaries=] where all of their [=dictionary members|members=] are [=JSON types=],
+*   [=records=] where all of their [=map/values=] are [=JSON types=],
+*   {{object}},
+*   [=interface types=] that have a <code>toJSON</code> operation declared on themselves or
+    one of their [=inherited interface|inherited=] or
+    [=consequential interface|consequential=] interfaces.
+
+How the <code>toJSON</code> [=regular operation=]
+is made available on an object in a language binding,
+and how exactly the [=JSON types=] are converted into a JSON string,
+is language binding specific.
+
+Note: In the ECMAScript language binding,
+this is done by exposing a <code>toJSON</code> method
+which returns the [=JSON type=]
+converted into an ECMAScript value
+that can be turned into a JSON string
+by the <code>[=JSON.stringify=]</code> function.
+Additionaly, in the ECMAScript language binding,
+the <code>toJSON</code> operation can take a [{{Default}}] [=extended attribute=],
+in which case the [=default toJSON operation=] is exposed instead.
+
+<div class="example" id="tojson-example">
+
+    The following [=IDL fragment=] defines an interface <code class="idl">Transaction</code>
+    that has a <code>toJSON</code> method defined in prose:
+
+    <pre highlight="webidl">
+        interface Transaction {
+          readonly attribute DOMString from;
+          readonly attribute DOMString to;
+          readonly attribute double amount;
+          readonly attribute DOMString description;
+          readonly attribute unsigned long number;
+          TransactionJSON toJSON();
+        };
+
+        dictionary TransactionJSON {
+          Account from;
+          Account to;
+          double amount;
+          DOMString description;
+        };
+    </pre>
+
+    The <code>toJSON</code> [=regular operation=] of <code class="idl">Transaction</code> [=interface=]
+    could be defined as follows:
+
+
+    <div algorithm="example tojson">
+
+        To invoke the <code>toJSON()</code> operation of the <code class="idl">Transaction</code>
+        interface, run the following steps:
+
+        1.  Let |json| be a new <code class="idl">TransactionJSON</code> dictionary.
+        1.  [=list/For each=] attribute [=identifier=] |attr| in « "from", "to", "amount", "description" »:
+            1.  Let |value| be result of [=get the underlying value|getting the underlying value=]
+                of the [=attribute=] identified by |attr|, given |target|.
+            1.  Set |json|[|attr|] to |value|.
+        1.  Return |json|.
+    </div>
+
+    In the ECMAScript language binding, there would exist a <code>toJSON()</code> method on
+    <code class="idl">Transaction</code> objects:
+
+    <pre highlight="js">
+        // Get an instance of Transaction.
+        var txn = getTransaction();
+
+        // Evaluates to an object like this:
+        // {
+        //   from: "Bob",
+        //   to: "Alice",
+        //   amount: 50,
+        //   description: "books"
+        // }
+        txn.toJSON();
+
+        // Evaluates to a string like this:
+        // '{"from":"Bob","to":"Alice","amount":50,"description":"books"}'
+        JSON.stringify(txn);
+    </pre>
+</div>
+
 
 <h4 id="idl-special-operations">Special operations</h4>
 
@@ -1985,7 +2098,7 @@ Special operations are declared by using one or more
 <dfn id="dfn-special-keyword" export>special keywords</dfn>
 in an operation declaration.
 
-There are six kinds of special operations. The table below indicates
+There are five kinds of special operations. The table below indicates
 for a given kind of special operation what special keyword
 is used to declare it and what the purpose of the special operation is:
 
@@ -2021,14 +2134,9 @@ is used to declare it and what the purpose of the special operation is:
         <td><emu-t>stringifier</emu-t></td>
         <td>Defines how an object is converted into a {{DOMString}}.</td>
     </tr>
-    <tr>
-        <td><dfn id="dfn-serializer" export lt="serializer">Serializers</dfn></td>
-        <td><emu-t>serializer</emu-t></td>
-        <td>Defines how an object is converted into a serialized form.</td>
-    </tr>
 </table>
 
-Not all language bindings support all of the six kinds of special
+Not all language bindings support all of the five kinds of special
 object behavior.  When special operations are declared using
 operations with no identifier, then in language bindings that do
 not support the particular kind of special operations there simply
@@ -2103,7 +2211,7 @@ for details.
 
 On a given [=interface=],
 there must exist at most one
-stringifier, at most one serializer, at most one
+stringifier, at most one
 [=named property deleter=],
 and at most one of each variety of getter and setter.
 Multiple legacy callers can exist on an interface
@@ -2348,419 +2456,6 @@ a [=static attribute=].
 </div>
 
 
-<h5 id="idl-serializers">Serializers</h5>
-
-When an [=interface=] has a
-[=serializer=], it indicates that objects provide
-a way for them to be converted into a serialized form.  Serializers can be declared
-using the <emu-t>serializer</emu-t> keyword:
-
-<pre highlight="webidl" class="syntax">
-    interface interface_identifier {
-      serializer;
-    };
-</pre>
-
-Prose accompanying an interface that declares a serializer in this
-way must define the
-<dfn id="dfn-serialization-behavior" export>serialization behavior</dfn>
-of the interface.  Serialization behavior is defined as returning
-a <dfn id="dfn-serialized-value" export>serialized value</dfn> of one of the following types:
-
-*   a <em>map</em> of key–value pairs, where the keys are
-    {{DOMString}} values (unique in the map) and the
-    values are [=serialized values=]
-*   a <em>list</em> of [=serialized values=]
-*   a {{DOMString}} value
-*   an {{unrestricted double}} value
-*   a {{boolean}} value
-*   the <emu-val>null</emu-val> value
-
-How the [=serialization behavior=]
-is made available on an object in a language binding, and how exactly the abstract
-[=serialized value=] is converted into
-an appropriate concrete value, is language binding specific.
-
-Note: In the ECMAScript language binding,
-[=serialization behavior=]
-is exposed as a <code>toJSON</code> method which returns the
-[=serialized value=] converted
-into an ECMAScript value that can be serialized to JSON by the
-<code>JSON.stringify</code> function.  See [[#es-serializer]] for details.
-
-[=Serialization behavior=]
-can also be specified directly in IDL, rather than separately as prose.
-This is done by following the <emu-t>serializer</emu-t> keyword with
-a <span class="char">U+003D EQUALS SIGN ("=")</span> character and
-a <dfn id="dfn-serialization-pattern" export>serialization pattern</dfn>,
-which can take one of the following six forms:
-
-*   A map with entries corresponding to zero or more attributes from the interface, and optionally
-    attributes from an inherited interface:
-
-    <pre highlight="webidl" class="syntax">
-        interface interface_identifier {
-          serializer = { attribute_identifier, attribute_identifier /* , ... */ };
-          serializer = { inherit, attribute_identifier, attribute_identifier /* , ... */ };
-        };
-    </pre>
-
-    Each identifier must be the identifier of an attribute declared
-    on the interface.  The identified attributes all must have a
-    [=serializable type=].
-
-    The <emu-t>inherit</emu-t> keyword must not be used unless
-    the interface inherits from another that defines a serializer, and the closest such interface
-    defines its serializer using this [=serialization pattern=]
-    form or the following form (i.e. <code>{ attribute }</code>).
-
-    <div algorithm="to serialize to a map corresponding to 0-n interface attributes">
-
-        The [=serialization behavior=] for this form of serialization pattern is as follows:
-
-        1.  Let |map| be an empty map.
-        1.  If the <emu-t>inherit</emu-t> keyword was used, then set |map| to be the result of
-            the [=serialization behavior=] of the
-            closest inherited interface that declares a serializer.
-        1.  For each attribute identifier |i| in the serialization pattern, in order:
-            1.  Remove any entry in |map| with key name |i|.
-            1.  Let |V| be the value of the attribute with identifier |i|.
-            1.  Add an entry to |map| whose key name is |i| and whose
-                value is result of [=converted to a serialized value|converting=]
-                |V| to a serialized value.
-        1.  Return |map|.
-    </div>
-*   A map with entries corresponding to all attributes from the interface that have
-    a [=serializable type=], and optionally
-    attributes from an inherited interface:
-
-    <pre highlight="webidl" class="syntax">
-        interface interface_identifier {
-          serializer = { attribute };
-          serializer = { inherit, attribute };
-        };
-    </pre>
-
-    The <emu-t>inherit</emu-t> keyword must not be used unless
-    the interface inherits from another that defines a serializer, and the closest such interface
-    defines its serializer using this [=serialization pattern=]
-    form or the previous form.
-
-    <div algorithm="to serialize to a map corresponding to all interface attributes">
-
-        The [=serialization behavior=] for this form of serialization pattern is as follows:
-
-        1.  Let |map| be an empty map.
-        1.  If the <emu-t>inherit</emu-t> keyword was used, then set |map| to be the result of
-            the [=serialization behavior=] of the
-            closest inherited interface that declares a serializer.
-        1.  For each identifier |i| of an attribute on the interface whose type is
-            a [=serializable type=], in the order they appear
-            on the interface:
-            1.  Remove any entry in |map| with key name |i|.
-            1.  Let |V| be the value of the attribute with identifier |i|.
-            1.  Add an entry to |map| whose key name is |i| and whose
-                value is result of [=converted to a serialized value|converting=]
-                |V| to a serialized value.
-        1.  Return |map|.
-    </div>
-*   A map with entries corresponding to the named properties:
-
-    <pre highlight="webidl" class="syntax">
-        interface interface_identifier {
-          serializer = { getter };
-        };
-    </pre>
-
-    This form must not be used unless the interface or one it
-    inherits from supports named properties and the return type of the named property getter
-    is a serializable type.
-
-    <div algorithm="to serialize to a map corresponding to the named properties">
-
-        The [=serialization behavior=] for this form of serialization pattern is as follows:
-
-        1.  Let |map| be an empty map.
-        1.  For each supported property name |n| on the object, in order:
-            1.  Let |V| be the value of the named property with name |n|.
-            1.  Add an entry to |map| whose key name is |n| and whose
-                value is result of [=converted to a serialized value|converting=]
-                |V| to a serialized value.
-        1.  Return |map|.
-    </div>
-*   A list of value of zero or more attributes on the interface:
-
-    <pre highlight="webidl" class="syntax">
-        interface interface_identifier {
-          serializer = [ attribute_identifier, attribute_identifier /* , ... */ ];
-        };
-    </pre>
-
-    Each identifier must be the identifier of an attribute declared
-    on the interface.  The identified attributes all must have a
-    [=serializable type=].
-
-    <div algorithm="to serialize to a list of 0-n interface attributes">
-
-        The [=serialization behavior=] for this form of serialization pattern is as follows:
-
-        1.  Let |list| be an empty list.
-        1.  For each attribute identifier |i| in the serialization pattern:
-            1.  Let |V| be the value of the attribute with identifier |i|.
-            1.  Append to |list| the value that is the result of
-                [=converted to a serialized value|converting=]
-                |V| to a serialized value.
-        1.  Return |list|.
-    </div>
-*   A list with entries corresponding to the indexed properties:
-
-    <pre highlight="webidl" class="syntax">
-        interface interface_identifier {
-          serializer = [ getter ];
-        };
-    </pre>
-
-    This form must not be used unless the interface or one it
-    inherits from supports indexed properties and the return type of the indexed property getter
-    is a serializable type.
-
-    <div algorithm="to serialize to a list corresponding to indexed properties">
-
-        The [=serialization behavior=] for this form of serialization pattern is as follows:
-
-        1.  Let |list| be an empty list.
-        1.  Let |i| be 0.
-        1.  While |i| is less than or equal to the greatest supported property index on the object:
-            1.  Let |V| be the value of the indexed property with index |i|
-                if |i| is a supported property index, or <emu-val>null</emu-val> otherwise.
-            1.  Append to |list| the value that is the result of
-                [=converted to a serialized value|converting=]
-                |V| to a serialized value.
-            1.  Set |i| to |i| + 1.
-        1.  Return |list|.
-    </div>
-*   A single attribute:
-
-    <pre highlight="webidl" class="syntax">
-        interface interface_identifier {
-          serializer = attribute_identifier;
-        };
-    </pre>
-
-    The identifier must be the identifier of an attribute declared
-    on the interface, and this attribute must have a
-    [=serializable type=].
-
-    <div algorithm="to serialize to a single attribute">
-
-        The [=serialization behavior=] for this form of serialization pattern is as follows:
-
-        1.  Let |V| be the value of the attribute with the specified identifier.
-        1.  Return the result of [=converted to a serialized value|converting=]
-            |V| to a serialized value.
-    </div>
-
-Note: Entries are added to maps in a particular order so that in the ECMAScript language binding
-it is defined what order properties are added to objects.  This is because this order
-can influence the serialization that <code>JSON.stringify</code> can produce.
-
-The list of <dfn id="dfn-serializable-type" export lt="serializable type">serializable types</dfn> and how they are
-<dfn id="dfn-convert-to-serialized-value" export lt="converted to a serialized value|converted to serialized values">converted to serialized values</dfn> is as follows:
-
-<dl class="switch">
-     :  {{long long}}
-     :: converted by choosing the closest equivalent {{double}} value
-        (as when <a href="#es-long-long">converting a <code class="idl">long long</code> to an ECMAScript <emu-val>Number</emu-val> value</a>)
-     :  {{unsigned long long}}
-     :: converted by choosing the closest equivalent {{double}} value
-        (as when <a href="#es-unsigned-long-long">converting a <code class="idl">unsigned long long</code> to an ECMAScript <emu-val>Number</emu-val> value</a>)
-     :  any other [=integer type=]
-     :  {{float}}
-     :: converted by choosing the equivalent {{double}} value
-     :  {{double}}
-     :  {{boolean}}
-     :  {{DOMString}}
-     :: the same value of the respective type
-     :  an [=enumeration|enumeration type=]
-     :: the equivalent {{DOMString}} value
-     :  a {{USVString}}
-     :: the {{DOMString}} produced by
-        encoding the given sequence of [=Unicode scalar values=] in
-        UTF-16
-     :  a {{ByteString}}
-     :: the equivalent {{DOMString}} value where each code unit has the same value as the corresponding byte value
-     :  a [=nullable type|nullable=] serializable type
-     :: converted to <emu-val>null</emu-val> if that is its value,
-        otherwise converted as per its [=nullable types/inner type=]
-     :  a [=union type=] where all of its [=member types=] are serializable types
-     :: converted as per its [=specific type=]
-     :  a [=sequence type=] that has a serializable type as its element type
-     :: converted to a list where each element is the result of converting its
-        corresponding sequence element to a serialized value
-     :  a [=dictionary=] where all of its [=dictionary members|members=] have serializable types
-     :: converted to a map consisting of an entry for each dictionary member
-        that is present, where the entry’s key is the identifier of the dictionary
-        member and its value is the result of converting the dictionary member’s
-        value to a serializable type
-     :  an [=interface type=] that has a [=serializer=]
-     :: converted by invoking the object’s serializer
-</dl>
-
-Serializers can also be specified using an [=operation=]
-with the <emu-t>serializer</emu-t> keyword:
-
-<pre highlight="webidl" class="syntax">
-    interface interface_identifier {
-      serializer identifier();
-    };
-</pre>
-
-Serializers declared with operations must
-be declared to take zero arguments and return a [=serializable type=].
-
-The [=serialization behavior=]
-of the interface with a serializer declared with an operation is the result of
-[=converted to a serialized value|converting=]
-the value returned from invoking the operation to a serialized value.
-
-<pre class="grammar" id="prod-Serializer">
-    Serializer :
-        "serializer" SerializerRest
-</pre>
-
-<pre class="grammar" id="prod-SerializerRest">
-    SerializerRest :
-        OperationRest
-        "=" SerializationPattern ";"
-        ";"
-</pre>
-
-<pre class="grammar" id="prod-SerializationPattern">
-    SerializationPattern :
-        "{" SerializationPatternMap "}"
-        "[" SerializationPatternList "]"
-        identifier
-</pre>
-
-<pre class="grammar" id="prod-SerializationPatternMap">
-    SerializationPatternMap :
-        "getter"
-        "inherit" Identifiers
-        identifier Identifiers
-        ε
-</pre>
-
-<pre class="grammar" id="prod-SerializationPatternList">
-    SerializationPatternList :
-        "getter"
-        identifier Identifiers
-        ε
-</pre>
-
-<pre class="grammar" id="prod-Identifiers">
-    Identifiers :
-        "," identifier Identifiers
-        ε
-</pre>
-
-<div class="example">
-
-    The following [=IDL fragment=] defines
-    an interface <code class="idl">Transaction</code> that has a
-    [=serializer=] defines in prose:
-
-    <pre highlight="webidl">
-        interface Transaction {
-          readonly attribute Account from;
-          readonly attribute Account to;
-          readonly attribute double amount;
-          readonly attribute DOMString description;
-          readonly attribute unsigned long number;
-
-          serializer;
-        };
-
-        interface Account {
-          attribute DOMString name;
-          attribute unsigned long number;
-        };
-    </pre>
-
-    The serializer could be defined as follows:
-
-    <blockquote>
-
-        <div algorithm="example serializer">
-
-            The [=serialization behavior=] of the <code class="idl">Transaction</code> interface is
-            to run the following algorithm, where |O| is the object
-            that implements <code class="idl">Transaction</code>:
-
-            1.  Let |map| be an empty map.
-            1.  Add an entry to |map| whose key is “from” and whose value is
-                the [=serialized value=] of
-                the <code>number</code> attribute on the <code class="idl">Account</code>
-                object referenced by the <code>from</code> attribute on |O|.
-            1.  Add an entry to |map| whose key is “to” and whose value is
-                the [=serialized value=] of
-                the <code>number</code> attribute on the <code class="idl">Account</code>
-                object referenced by the <code>to</code> attribute on |O|.
-            1.  For both of the attributes <code>amount</code> and <code>description</code>,
-                add an entry to |map| whose key is the
-                [=identifier=] of the attribute
-                and whose value is the [=serialized value=]
-                of the value of the attribute on |O|.
-            1.  Return |map|.
-        </div>
-    </blockquote>
-
-    If it was acceptable for <code class="idl">Account</code> objects to be serializable
-    on their own, then [=serialization patterns=]
-    could be used to avoid having to define the [=serialization behavior=]
-    in prose:
-
-    <pre highlight="webidl">
-        interface Transaction {
-          readonly attribute Account from;
-          readonly attribute Account to;
-          readonly attribute double amount;
-          readonly attribute DOMString description;
-          readonly attribute unsigned long number;
-
-          serializer = { from, to, amount, description };
-        };
-
-        interface Account {
-          attribute DOMString name;
-          attribute unsigned long number;
-
-          serializer = number;
-        };
-    </pre>
-
-    In the ECMAScript language binding, there would exist a <code>toJSON</code> method on
-    <code class="idl">Transaction</code> objects:
-
-    <pre highlight="js">
-        // Get an instance of Transaction.
-        var txn = getTransaction();
-
-        // Evaluates to an object like this:
-        // {
-        //   from: 1234
-        //   to: 5678
-        //   amount: 110.75
-        //   description: "dinner"
-        // }
-        txn.toJSON();
-
-        // Evaluates to a string like this:
-        // '{"from":1234,"to":5678,"amount":110.75,"description":"dinner"}'
-        JSON.stringify(txn);
-    </pre>
-</div>
-
-
 <h5 id="idl-indexed-properties" dfn export>Indexed properties</h5>
 
 An [=interface=] that defines an [=indexed property getter=]
@@ -6401,7 +6096,11 @@ five forms are allowed.
         identifier Identifiers
 </pre>
 
-<div data-fill-with="grammar-Identifiers"></div>
+<pre class="grammar" id="prod-Identifiers">
+    Identifiers :
+        "," identifier Identifiers
+        ε
+</pre>
 
 <pre class="grammar" id="prod-ExtendedAttributeNoArgs">
     ExtendedAttributeNoArgs :
@@ -6555,7 +6254,6 @@ and comprise the following:
 *   [=attribute setters=]
 *   <a href="#es-operations">the <emu-val>Function</emu-val> objects that correspond to operations</a>
 *   <a href="#es-stringifier">the <emu-val>Function</emu-val> objects that correspond to stringifiers</a>
-*   <a href="#es-serializer">the <emu-val>Function</emu-val> objects that correspond to serializers</a>
 *   <a href="#es-iterators">the <emu-val>Function</emu-val> objects that correspond to iterators</a>
 *   [=map size getters=]
 *   [=DOMException constructor objects=]
@@ -8186,6 +7884,76 @@ for an interface is to be implemented.
 </div>
 
 
+<h4 id="Default" extended-attribute lt="Default">[Default]</h4>
+
+If the [{{Default}}] [=extended attribute=] appears on a [=regular operation=],
+then it indicates that steps described in the [=corresponding default operation=]
+must be carried out when the operation is invoked.
+
+The [{{Default}}] extended attribute must
+[=takes no arguments|take no arguments=].
+
+The [{{Default}}] extended attribute must not
+be used on anything other than a [=regular operation=]
+for which a [=corresponding default operation=] has been defined.
+
+<div class="example" id="example-tojson-default">
+
+    As an example, the [{{Default}}] extended attribute is suitable
+    for use on <code>toJSON</code> [=regular operations=]:
+
+    <pre highlight="webidl">
+        interface Animal {
+          attribute DOMString name;
+          attribute unsigned short age;
+          [Default] object toJSON();
+        };
+
+        interface Human : Animal {
+          attribute Dog? pet;
+          [Default] object toJSON();
+        };
+
+        interface Dog : Animal {
+          attribute DOMString? breed;
+        };
+
+    </pre>
+
+    In the ECMAScript language binding, there would exist a <code>toJSON()</code> method on
+    <code class="idl">Animal</code>, <code class="idl">Human</code>,
+    and (via inheritance) <code class="idl">Dog</code> objects:
+
+    <pre highlight="js">
+        // Get an instance of Human.
+        var alice = getHuman();
+
+        // Evaluates to an object like this (notice how "pet" still holds
+        // an instance of Dog at this point):
+        //
+        // {
+        //   name: "Alice",
+        //   age: 59,
+        //   pet: Dog
+        // }
+        alice.toJSON();
+
+        // Evaluates to an object like this (notice how "breed" is absent,
+        // as the Dog interface doesn't declare a default toJSON operation):
+        //
+        // {
+        //   name: "Tramp",
+        //   age: 6
+        // }
+        alice.pet.toJSON();
+
+        // Evaluates to a string like this:
+        // '{"name":"Alice","age":59,"pet":{"name":"Tramp","age":6}}'
+        JSON.stringify(alice);
+    </pre>
+</div>
+
+
 <h4 id="EnforceRange" extended-attribute lt="EnforceRange">[EnforceRange]</h4>
 
 If the [{{EnforceRange}}] [=extended attribute=] appears on one of the [=integer types=], it creates
@@ -8522,8 +8290,7 @@ there must not be more than one
 the interface and its [=consequential interfaces=]
 with the same [=identifier=].
 There also must not be more than
-one [=stringifier=],
-more than one [=serializer=],
+one [=stringifier=]
 or more than one [=iterable declaration=],
 [=maplike declaration=] or
 [=setlike declaration=]
@@ -10584,10 +10351,8 @@ The characteristics of this property are as follows:
                     1.  If |attribute| was specified with the [{{LenientThis}}]
                         [=extended attribute=], then return <emu-val>undefined</emu-val>.
                     1. Otherwise, [=ECMAScript/throw=] a <emu-val>TypeError</emu-val>.
-            1.  Let |R| be the result of performing the actions listed in the
-                description of |attribute| that occur on getting (or those listed in the description
-                of the inherited attribute, if this attribute is declared to
-                [=inherit its getter=]), on |O| if |O| is not <emu-val>null</emu-val>.
+            1.  Let |R| be the result of [=get the underlying value|getting the underlying value=]
+                of |attribute| given |O|.
             1.  Return the result of [=converted to an ECMAScript value|converting=] |R| to an
                 ECMAScript value of the type |attribute| is declared as.
 
@@ -10765,11 +10530,18 @@ property-installation style as namespaces.)
                 [=identifier=] |id| on |target| and with argument count |n|.
             1.  Let &lt;|operation|, |values|&gt; be the result of passing
                 |S| and |arg|<sub>0..|n|−1</sub> to the [=overload resolution algorithm=].
-            1.  Let |R| be the result of performing the actions listed in the
-                description of |operation|, on |O| if |O| is not <emu-val>null</emu-val>, with |values|
-                as the argument values.
-            1.  Return the result of [=converted to an ECMAScript value|converting=] |R| to
-                an ECMAScript value of the type |op| is declared to return.
+            1.  Let |R| be <emu-val>null</emu-val>.
+            1.  If |operation| is declared with a [{{Default}}] [=extended attribute=],
+                then:
+                1.  Set |R| be the result of performing the actions listed in
+                    |operation|'s [=corresponding default operation=] on |O|,
+                    with |values| as the argument values.
+            1.  Otherwise:
+                1.  Set |R| be the result of performing the actions listed in the
+                    description of |operation|, on |O| if |O| is not <emu-val>null</emu-val>, with |values|
+                    as the argument values.
+                1.  Return the result of [=converted to an ECMAScript value|converting=] |R| to
+                    an ECMAScript value of the type |op| is declared to return.
 
         And then, if an exception was thrown:
 
@@ -10791,6 +10563,171 @@ property-installation style as namespaces.)
     1.  Return |F|.
 </div>
 
+
+<h5 id="es-default-operations">Default operations</h5>
+
+Only [=regular operations=] which have a <dfn>corresponding default operation</dfn> defined below
+may be declared with a [{{Default}}] [=extended attribute=].
+
+
+<h6 id="es-default-tojson">Default toJSON operation</h5>
+
+The [=corresponding default operation=] of the <code>toJSON</code> operation is the [=default toJSON operation=].
+
+The [=return type=] of the [=default toJSON operation=] must be {{object}}.
+
+<div algorithm>
+
+    To invoke the <dfn export>default toJSON operation</dfn> of [=interface=] |I| on |O|,
+    run the the following steps:
+
+    1.  Let |map| be a new [=ordered map=].
+    1.  Let |stack| be the result of [=create an inheritance stack|creating an inheritance stack=]
+        for [=interface=] |I|.
+    1.  Invoke [=collect attribute values=] on |O|,
+        passing it |stack| and |map| as arguments.
+    1.  Let |result| be [=!=] [=ObjectCreate=]([=%ObjectPrototype%=]).
+    1.  [=map/For each=] |key| → |value| of |map|,
+        1.  Let |k| be |key| [=converted to an ECMAScript value=].
+        1.  Let |v| be |value| [=converted to an ECMAScript value=].
+        1.  Perform [=!=] [=CreateDataProperty=](|result|, |k|, |v|).
+    1.  Return |result|.
+</div>
+
+<div algorithm>
+
+    To invoke the <dfn>collect attribute values</dfn> abstract operation on |O|
+    with [=stack=] |stack| and [=ordered map=] |map| as arguments,
+    run the the following steps:
+
+    1.  Let |I| be the result of [=stack/pop|popping=] from |stack|.
+    1.  If a <code>toJSON</code> operation with a [{{Default}}] [=extended attribute=] is declared on |I|, then
+        [=list|for each=] [=exposed=] [=regular attribute=] |attr|
+        that is an [=interface member=] of |I|, in order:
+        1.  Let |id| be the [=identifier=] of |attr|.
+        1.  Let |value| be the result of [=get the underlying value|getting the underlying value=]
+            of |attr| given |O|.
+        1.  If |value| is a [=JSON type=], then [=map/set=] |map|[|id|] to |value|.
+    1.  [=list|For each=] [=implements statements=] where the left-hand side [=identifier=] references |I|:
+        1.  Let |rhs| be the [=interface=] represented by the right-hand side [=identifier=].
+        1.  Let |interfaces| be the result of [=create an inheritance stack|creating an inheritance stack=]
+            for [=interface=] |rhs|.
+        1.  Invoke [=collect attribute values=] on |O|,
+            passing it |interfaces| and |map| as arguments.
+    1.  If |stack| [=stack/is not empty=],
+        then invoke [=collect attribute values=] on |O|,
+        passing it |stack| and |map| as arguments.
+</div>
+
+<div algorithm>
+
+    To <dfn>create an inheritance stack</dfn> for [=interface=] |I|,
+    run the the following steps:
+
+    1.  Let |stack| be a new [=stack=].
+    1.  [=stack/Push=] |I| onto |stack|.
+    1.  [=iteration/While=] |I| [=interface/inherits=] from an [=interface=],
+        1.  Let |I| be that [=interface=].
+        1.  [=stack/Push=] |I| onto |stack|.
+    1.  Return |stack|.
+</div>
+
+<div class=example id=example-tojson-default-inheritance-and-mixins>
+
+    The following [=IDL fragment=] defines a number of [=interfaces=]
+    which are [=inherited interface|inherited=] or [=consequential interfaces=] of <code class="idl">A</code>,
+    as show in the below inheritance tree.
+
+    <pre>
+                  F*
+                  |
+             C    E - I*
+             |    |
+             B* - D*
+             |
+        G* - A - H*
+    </pre>
+
+    Interfaces markes with an asterisk ("*")
+    declare a <code>toJSON</code> [=operation=]
+    with a [{{Default}}] [=extended attribute=].
+
+    <pre highlight=webidl>
+        interface A : B {
+          attribute DOMString a;
+        };
+
+        interface B : C {
+          [Default] object toJSON();
+          attribute DOMString b;
+        };
+
+        interface C {
+          attribute DOMString c;
+        };
+
+        interface D : E {
+          [Default] object toJSON();
+          attribute DOMString d;
+        };
+
+        interface E : F {
+          attribute DOMString e;
+        };
+
+        interface F {
+          [Default] object toJSON();
+          attribute DOMString f;
+        };
+
+        interface G {
+          [Default] object toJSON();
+          attribute DOMString g;
+        };
+
+        interface H {
+          [Default] object toJSON();
+          attribute DOMString h;
+        };
+
+        interface I {
+          [Default] object toJSON();
+          attribute DOMString i;
+        };
+
+        A implements G;
+        A implements H;
+        B implements D;
+        E implements I;
+    </pre>
+
+    Calling the <code>toJSON()</code> method of an object
+    implementing interface <code class="idl">A</code> defined above
+    would return the following JSON object:
+
+    <pre highlight=json>
+    {
+        "b": "...",
+        "f": "...",
+        "i": "...",
+        "d": "...",
+        "g": "...",
+        "h": "..."
+    }
+    </pre>
+
+    An object implementing interface <code class="idl">B</code> would return:
+
+    <pre highlight=json>
+    {
+        "b": "...",
+        "f": "...",
+        "i": "...",
+        "d": "..."
+    }
+    </pre>
+</div>
+
 <h5 id="es-stringifier">Stringifiers</h5>
 
 If the [=interface=] has an [=exposed=] [=stringifier=],
@@ -10841,89 +10778,6 @@ then there must exist a property with the following characteristics:
     property is the <emu-val>String</emu-val> value “toString”.
 
 
-<h5 id="es-serializer">Serializers</h5>
-
-If the [=interface=] has an [=exposed=] [=serializer=], then
-a property must exist whose name is “toJSON”, with attributes
-{ \[[Writable]]: <emu-val>true</emu-val>, \[[Enumerable]]: <emu-val>true</emu-val>, \[[Configurable]]: <emu-val>true</emu-val> }
-and whose value is a <emu-val>Function</emu-val> object.
-
-The location of the property is determined as follows:
-
-*   If the interface was declared with the [{{Global}}] or [{{PrimaryGlobal}}] extended attribute,
-    then the property exists on the single object that implements the interface.
-*   Otherwise, if the interface is a [=consequential interface=]
-    of a [{{Global}}]- or [{{PrimaryGlobal}}]-annotated interface, then
-    the property exists on the single object that implements the [{{Global}}]- or
-    [{{PrimaryGlobal}}]-annotated interface as well as on
-    the consequential interface’s [=interface prototype object=].
-*   Otherwise, the property exists solely on the interface’s [=interface prototype object=].
-
-<div algorithm="to invoke the toJSON method of interfaces">
-
-    The property’s <emu-val>Function</emu-val> object, when invoked,
-    must behave as follows:
-
-    1.  Let |O| be the result of calling [=ToObject=] on the <emu-val>this</emu-val> value.
-    1.  If |O| is a [=platform object=],
-        then [=perform a security check=], passing:
-        *   the platform object |O|,
-        *   the [=identifier=] of the [=serializer=], and
-        *   the type “method”.
-    1.  If |O| is not an object that implements the [=interface=]
-        on which the serializer was declared, then [=ECMAScript/throw=] a <emu-val>TypeError</emu-val>.
-    1.  Depending on how <code>serializer</code> was specified:
-        <dl class="switch">
-             :  on an [=operation=] with an identifier
-             :: 1.  Return the result of performing the actions listed in the description of the operation,
-                    using |O| as the <emu-val>this</emu-val> value and passing no arguments.
-             :  as a keyword, either with or without a [=serialization pattern=]
-             :: 1.  Let |S| be the [=serialized value=] that is the result of invoking the [=serialization behavior=] of the
-                    [=interface=] for object |O|.
-                1.  Return the result of [=convert a serialized value to an ECMAScript value|converting=]
-                    |S| to an ECMAScript value.
-        </dl>
-</div>
-
-The value of the <emu-val>Function</emu-val> object’s “length”
-property is the <emu-val>Number</emu-val> value <emu-val>0</emu-val>.
-
-The value of the <emu-val>Function</emu-val> object’s “name”
-property is the <emu-val>String</emu-val> value “toJSON”.
-
-<div algorithm>
-
-    The following steps define how to
-    <dfn id="dfn-convert-serialized-value-to-ecmascript-value" export>convert a serialized value to an ECMAScript value</dfn>:
-
-    1.  Let |S| be the [=serialized value=].
-    1.  Depending on the type of |S|:
-        <dl class="switch">
-             :  a map
-             :: 1.  Let |O| be a new object created as if by the expression <code>({})</code>.
-                1.  For each entry in |S|, in the order they were added to the map:
-                    1.  Let |V| be the result of [=convert a serialized value to an ECMAScript value|converting=]
-                        the value of the entry to an ECMAScript value.
-                    1.  Let |P| be the entry’s key.
-                    1.  Call [=CreateDataProperty=](|O|, |P|, |V|).
-                1.  Return |O|.
-             :  a list
-             :: 1.  Let |A| be a new <emu-val>Array</emu-val> object created as if by the expression <code>[]</code>.
-                1.  Let |index| be 0.
-                1.  While |index| is less than the number of elements in |S|:
-                    1.  Let |V| be the result of [=convert a serialized value to an ECMAScript value|converting=]
-                        the value of the element in |S| at index |index| to an ECMAScript value.
-                    1.  Let |P| be [=ToString=](|index|).
-                    1.  Call [=CreateDataProperty=](|O|, |P|, |V|).
-                1.  Return |A|.
-             :  any other serialized value
-             :: 1.  Let |V| be the result of [=converted to an ECMAScript value|converting=]
-                    |S| to an ECMAScript value.
-                1.  Return |V|.
-        </dl>
-</div>
-
-
 <h4 id="es-iterators">Common iterator behavior</h4>