wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-09 01:08:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

No issue - Structured clone algorithm doesn't serialize Array Length contrary to HTML spec, resulting in truncation of trailing sparse arrays like [1,2,3,,]

Browse source 
Backport of https://bugzilla.mozilla.org/show_bug.cgi?id=1476955
This commit is contained in:
Basilisk-Dev 2023-10-30 15:36:44 -04:00 • committed by roytam1
commit 727a24d78e
1 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
js/src/vm/StructuredClone.cpp
View file

@ -1240,7 +1240,16 @@ JSStructuredCloneWriter::traverseObject(HandleObject obj)
ESClass cls;
if (!GetBuiltinClass(context(), obj, &cls))
return false;
return out.writePair(cls == ESClass::Array ? SCTAG_ARRAY_OBJECT : SCTAG_OBJECT_OBJECT, 0);
if (cls == ESClass::Array) {
uint32_t length = 0;
if (!JS_GetArrayLength(context(), obj, &length))
return false;
return out.writePair(SCTAG_ARRAY_OBJECT, NativeEndian::swapToLittleEndian(length));
}
return out.writePair(SCTAG_OBJECT_OBJECT, 0);
}
bool
@ -2143,7 +2152,7 @@ JSStructuredCloneReader::startRead(MutableHandleValue vp)
case SCTAG_ARRAY_OBJECT:
case SCTAG_OBJECT_OBJECT: {
JSObject* obj = (tag == SCTAG_ARRAY_OBJECT)
? (JSObject*) NewDenseEmptyArray(context())
? (JSObject*) NewDenseUnallocatedArray(context(), NativeEndian::swapFromLittleEndian(data))
: (JSObject*) NewBuiltinClassInstance<PlainObject>(context());
if (!obj || !objs.append(ObjectValue(*obj)))
return false;