wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-08 16:58:38 +09:00
Code Issues Projects Releases Packages Wiki Activity

ported from mozilla: Bug 1476955 - Structured clone algorithm doesn't serialize Array Length contrary to HTML spec, resulting in truncation of trailing sparse arrays like [1,2,3,,] (length=4) to [1,2,3] (length=3); r=sfink (958b3cdb98)

Browse source
This commit is contained in:
roytam1 2023-10-22 22:44:55 +08:00
commit a553551082
1 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

13
js/src/vm/StructuredClone.cpp
View file

@ -1240,7 +1240,16 @@ JSStructuredCloneWriter::traverseObject(HandleObject obj)
ESClass cls;
if (!GetBuiltinClass(context(), obj, &cls))
return false;
return out.writePair(cls == ESClass::Array ? SCTAG_ARRAY_OBJECT : SCTAG_OBJECT_OBJECT, 0);
if (cls == ESClass::Array) {
uint32_t length = 0;
if (!JS_GetArrayLength(context(), obj, &length))
return false;
return out.writePair(SCTAG_ARRAY_OBJECT, NativeEndian::swapToLittleEndian(length));
}
return out.writePair(SCTAG_OBJECT_OBJECT, 0);
}
bool
@ -2143,7 +2152,7 @@ JSStructuredCloneReader::startRead(MutableHandleValue vp)
case SCTAG_ARRAY_OBJECT:
case SCTAG_OBJECT_OBJECT: {
JSObject* obj = (tag == SCTAG_ARRAY_OBJECT)
? (JSObject*) NewDenseEmptyArray(context())
? (JSObject*) NewDenseUnallocatedArray(context(), NativeEndian::swapFromLittleEndian(data))
: (JSObject*) NewBuiltinClassInstance<PlainObject>(context());
if (!obj || !objs.append(ObjectValue(*obj)))
return false;