Blink-compatible deserialization of "version 0" sparse arrays.

src/value-serializer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/value-serializer.h"
 
 #include <type_traits>
 
 #include "src/base/logging.h"
 #include "src/factory.h"
@@ skipping 699 matching lines @@
                                           used_as_prototype);
 
   // If the dictionary was reallocated, update the global handle.
   if (!new_dictionary.is_identical_to(id_map_)) {
     GlobalHandles::Destroy(Handle<Object>::cast(id_map_).location());
     id_map_ = Handle<SeededNumberDictionary>::cast(
         isolate_->global_handles()->Create(*new_dictionary));
   }
 }
 
-static MaybeHandle<JSObject> CreateJSObjectFromKeyValuePairs(
-    Isolate* isolate, Handle<Object>* data, uint32_t num_properties) {
-  Handle<JSObject> object =
-      isolate->factory()->NewJSObject(isolate->object_function());
+static Maybe<bool> SetPropertiesFromKeyValuePairs(Isolate* isolate,
+                                                  Handle<JSObject> object,
+                                                  Handle<Object>* data,
+                                                  uint32_t num_properties) {
   for (unsigned i = 0; i < 2 * num_properties; i += 2) {
     Handle<Object> key = data[i];
     Handle<Object> value = data[i + 1];
     bool success;
     LookupIterator it = LookupIterator::PropertyOrElement(
         isolate, object, key, &success, LookupIterator::OWN);
     if (!success ||
         JSObject::DefineOwnPropertyIgnoreAttributes(&it, value, NONE)
             .is_null()) {
-      return MaybeHandle<JSObject>();
+      return Nothing<bool>();
     }
   }
-  return object;
+  return Just(true);
 }
 
 MaybeHandle<Object>
 ValueDeserializer::ReadObjectUsingEntireBufferForLegacyFormat() {
   if (version_ > 0) return MaybeHandle<Object>();
 
   HandleScope scope(isolate_);
   std::vector<Handle<Object>> stack;
   while (position_ < end_) {
     SerializationTag tag;
     if (!PeekTag().To(&tag)) break;
 
     Handle<Object> new_object;
     switch (tag) {
       case SerializationTag::kEndJSObject: {
         ConsumeTag(SerializationTag::kEndJSObject);
 
         // JS Object: Read the last 2*n values from the stack and use them as
         // key-value pairs.
         uint32_t num_properties;
         if (!ReadVarint<uint32_t>().To(&num_properties) ||
             stack.size() / 2 < num_properties) {
           return MaybeHandle<Object>();
         }
 
-        size_t begin_properties = stack.size() - 2 * num_properties;
-        Handle<Object>* data =
-            num_properties ? &stack[begin_properties] : nullptr;
-        if (!CreateJSObjectFromKeyValuePairs(isolate_, data, num_properties)
-                 .ToHandle(&new_object)) {
+        size_t begin_properties =
+            stack.size() - 2 * static_cast<size_t>(num_properties);
+        Handle<JSObject> js_object =
+            isolate_->factory()->NewJSObject(isolate_->object_function());
+        if (num_properties &&
+            !SetPropertiesFromKeyValuePairs(
+                 isolate_, js_object, &stack[begin_properties], num_properties)
+                 .FromMaybe(false)) {
           return MaybeHandle<Object>();
         }
 
         stack.resize(begin_properties);
+        new_object = js_object;
         break;
       }
+      case SerializationTag::kEndSparseJSArray: {
+        ConsumeTag(SerializationTag::kEndSparseJSArray);
+
+        // Sparse JS Array: Read the last 2*|num_properties| from the stack.
+        uint32_t num_properties;
+        uint32_t length;
+        if (!ReadVarint<uint32_t>().To(&num_properties) ||
+            !ReadVarint<uint32_t>().To(&length) ||
+            stack.size() / 2 < num_properties) {
+          return MaybeHandle<Object>();
+        }
+
+        Handle<JSArray> js_array = isolate_->factory()->NewJSArray(0);
+        JSArray::SetLength(js_array, length);
+        size_t begin_properties =
+            stack.size() - 2 * static_cast<size_t>(num_properties);
+        if (num_properties &&
+            !SetPropertiesFromKeyValuePairs(
+                 isolate_, js_array, &stack[begin_properties], num_properties)
+                 .FromMaybe(false)) {
+          return MaybeHandle<Object>();
+        }
+
+        stack.resize(begin_properties);
+        new_object = js_array;
+        break;
+      }
+      case SerializationTag::kEndDenseJSArray:
+        // This was already broken in Chromium, and apparently wasn't missed.
+        return MaybeHandle<Object>();
       default:
         if (!ReadObject().ToHandle(&new_object)) return MaybeHandle<Object>();
         break;
     }
     stack.push_back(new_object);
   }
 
 // Nothing remains but padding.
 #ifdef DEBUG
   while (position_ < end_) {
     DCHECK(*position_++ == static_cast<uint8_t>(SerializationTag::kPadding));
   }
 #endif
   position_ = end_;
 
   if (stack.size() != 1) return MaybeHandle<Object>();
   return scope.CloseAndEscape(stack[0]);
 }
 
 }  // namespace internal
 }  // namespace v8