Throw exceptions for errors in v8::ValueSerializer.

src/value-serializer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/value-serializer.h"
 
 #include <type_traits>
 
 #include "src/base/logging.h"
 #include "src/conversions.h"
@@ skipping 106 matching lines @@
   kUint16Array = 'W',
   kInt32Array = 'd',
   kUint32Array = 'D',
   kFloat32Array = 'f',
   kFloat64Array = 'F',
   kDataView = '?',
 };
 
 }  // namespace
 
-ValueSerializer::ValueSerializer(Isolate* isolate)
+ValueSerializer::ValueSerializer(Isolate* isolate,
+                                 v8::ValueSerializer::Delegate* delegate)
     : isolate_(isolate),
+      delegate_(delegate),
       zone_(isolate->allocator()),
       id_map_(isolate->heap(), &zone_),
       array_buffer_transfer_map_(isolate->heap(), &zone_) {}
 
 ValueSerializer::~ValueSerializer() {}
 
 void ValueSerializer::WriteHeader() {
   WriteTag(SerializationTag::kVersion);
   WriteVarint(kLatestVersion);
 }
@@ skipping 101 matching lines @@
         if (!WriteJSReceiver(buffer).FromMaybe(false)) return Nothing<bool>();
       }
       return WriteJSReceiver(view);
     }
     default:
       if (object->IsString()) {
         WriteString(Handle<String>::cast(object));
         return Just(true);
       } else if (object->IsJSReceiver()) {
         return WriteJSReceiver(Handle<JSReceiver>::cast(object));
+      } else {
+        ThrowDataCloneError(MessageTemplate::kDataCloneError, object);

[Jakob Kummerow, 2016/09/02 10:20:28]

I'm not sure about this case. UNIMPLEMENTED() crashes even in Release mode. If
hitting this case can happen during normal operation and must be handled by
embedders, then throwing an error is of course appropriate. On the other hand,
if you'd say that hitting this case would be a V8/Chrome bug and we should learn
about it in the form of a crash report, then you should keep the
UNIMPLEMENTED().

[jbroman, 2016/09/02 14:51:08]

At the moment, this is the case that handles Symbol, SIMD, and other objects,
which a caller might pass to postMessage. While it might be possible to
eventually enumerate all of those, I think it's reasonable to just throw an
error here.

+        return Nothing<bool>();
       }
-      UNIMPLEMENTED();
-      return Nothing<bool>();
   }
 }
 
 void ValueSerializer::WriteOddball(Oddball* oddball) {
   SerializationTag tag = SerializationTag::kUndefined;
   switch (oddball->kind()) {
     case Oddball::kUndefined:
       tag = SerializationTag::kUndefined;
       break;
     case Oddball::kFalse:
@@ skipping 67 matching lines @@
     return Just(true);
   }
 
   // Otherwise, allocate an ID for it.
   uint32_t id = next_id_++;
   *id_map_entry = id + 1;
 
   // Eliminate callable and exotic objects, which should not be serialized.
   InstanceType instance_type = receiver->map()->instance_type();
   if (receiver->IsCallable() || instance_type <= LAST_SPECIAL_RECEIVER_TYPE) {
+    ThrowDataCloneError(MessageTemplate::kDataCloneError, receiver);
     return Nothing<bool>();
   }
 
   // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return Nothing<bool>();
+  STACK_CHECK(isolate_, Nothing<bool>());
 
   HandleScope scope(isolate_);
   switch (instance_type) {
     case JS_ARRAY_TYPE:
       return WriteJSArray(Handle<JSArray>::cast(receiver));
     case JS_OBJECT_TYPE:
     case JS_API_OBJECT_TYPE:
       return WriteJSObject(Handle<JSObject>::cast(receiver));
     case JS_DATE_TYPE:
       WriteJSDate(JSDate::cast(*receiver));
       return Just(true);
     case JS_VALUE_TYPE:
       return WriteJSValue(Handle<JSValue>::cast(receiver));
     case JS_REGEXP_TYPE:
       WriteJSRegExp(JSRegExp::cast(*receiver));
       return Just(true);
     case JS_MAP_TYPE:
       return WriteJSMap(Handle<JSMap>::cast(receiver));
     case JS_SET_TYPE:
       return WriteJSSet(Handle<JSSet>::cast(receiver));
     case JS_ARRAY_BUFFER_TYPE:
       return WriteJSArrayBuffer(JSArrayBuffer::cast(*receiver));
     case JS_TYPED_ARRAY_TYPE:
     case JS_DATA_VIEW_TYPE:
       return WriteJSArrayBufferView(JSArrayBufferView::cast(*receiver));
     default:
-      UNIMPLEMENTED();
-      break;
+      ThrowDataCloneError(MessageTemplate::kDataCloneError, receiver);

[Jakob Kummerow, 2016/09/02 10:20:28]

same here

[jbroman, 2016/09/02 14:51:08]

Similarly, there are a number of kinds of receiver that should throw an error
when you try to clone them, like Promise, WeakMap, the various collection
iterators, etc. Because these values come from JavaScript, it's not a bug in
Chrome if someone attempts to clone one of them.

+      return Nothing<bool>();
   }
   return Nothing<bool>();
 }
 
 Maybe<bool> ValueSerializer::WriteJSObject(Handle<JSObject> object) {
   WriteTag(SerializationTag::kBeginJSObject);
   Handle<FixedArray> keys;
   uint32_t properties_written;
   if (!KeyAccumulator::GetKeys(object, KeyCollectionMode::kOwnOnly,
                                ENUMERABLE_STRINGS)
@@ skipping 89 matching lines @@
     WriteTag(SerializationTag::kStringObject);
     v8::Local<v8::String> api_string =
         Utils::ToLocal(handle(String::cast(inner_value), isolate_));
     uint32_t utf8_length = api_string->Utf8Length();
     WriteVarint(utf8_length);
     api_string->WriteUtf8(reinterpret_cast<char*>(ReserveRawBytes(utf8_length)),
                           utf8_length, nullptr,
                           v8::String::NO_NULL_TERMINATION);
   } else {
     DCHECK(inner_value->IsSymbol());
+    ThrowDataCloneError(MessageTemplate::kDataCloneError, value);
     return Nothing<bool>();
   }
   return Just(true);
 }
 
 void ValueSerializer::WriteJSRegExp(JSRegExp* regexp) {
   WriteTag(SerializationTag::kRegExp);
   v8::Local<v8::String> api_string =
       Utils::ToLocal(handle(regexp->Pattern(), isolate_));
   uint32_t utf8_length = api_string->Utf8Length();
@@ skipping 68 matching lines @@
   uint32_t* transfer_entry = array_buffer_transfer_map_.Find(array_buffer);
   if (transfer_entry) {
     DCHECK(array_buffer->was_neutered() || array_buffer->is_shared());
     WriteTag(array_buffer->is_shared()
                  ? SerializationTag::kSharedArrayBufferTransfer
                  : SerializationTag::kArrayBufferTransfer);
     WriteVarint(*transfer_entry);
     return Just(true);
   }
 
-  if (array_buffer->is_shared()) return Nothing<bool>();
-  if (array_buffer->was_neutered()) return Nothing<bool>();
+  if (array_buffer->is_shared()) {
+    ThrowDataCloneError(
+        MessageTemplate::kDataCloneErrorSharedArrayBufferNotTransferred);
+    return Nothing<bool>();
+  }
+  if (array_buffer->was_neutered()) {
+    ThrowDataCloneError(MessageTemplate::kDataCloneErrorNeuteredArrayBuffer);
+    return Nothing<bool>();
+  }
   double byte_length = array_buffer->byte_length()->Number();
   if (byte_length > std::numeric_limits<uint32_t>::max()) {
+    ThrowDataCloneError(MessageTemplate::kDataCloneError, handle(array_buffer));
     return Nothing<bool>();
   }
   WriteTag(SerializationTag::kArrayBuffer);
   WriteVarint<uint32_t>(byte_length);
   WriteRawBytes(array_buffer->backing_store(), byte_length);
   return Just(true);
 }
 
 Maybe<bool> ValueSerializer::WriteJSArrayBufferView(JSArrayBufferView* view) {
   WriteTag(SerializationTag::kArrayBufferView);
@@ skipping 38 matching lines @@
     if (!WriteObject(key).FromMaybe(false) ||
         !WriteObject(value).FromMaybe(false)) {
       return Nothing<uint32_t>();
     }
 
     properties_written++;
   }
   return Just(properties_written);
 }
 
+void ValueSerializer::ThrowDataCloneError(
+    MessageTemplate::Template template_index) {
+  return ThrowDataCloneError(template_index,
+                             isolate_->factory()->empty_string());
+}
+
+void ValueSerializer::ThrowDataCloneError(
+    MessageTemplate::Template template_index, Handle<Object> arg0) {
+  Handle<String> message =
+      MessageTemplate::FormatMessage(isolate_, template_index, arg0);
+  if (delegate_) {
+    delegate_->ThrowDataCloneError(Utils::ToLocal(message));
+  } else {
+    isolate_->Throw(
+        *isolate_->factory()->NewError(isolate_->error_function(), message));
+  }
+}
+
 ValueDeserializer::ValueDeserializer(Isolate* isolate,
                                      Vector<const uint8_t> data)
     : isolate_(isolate),
       position_(data.start()),
       end_(data.start() + data.length()),
       id_map_(Handle<SeededNumberDictionary>::cast(
           isolate->global_handles()->Create(
               *SeededNumberDictionary::New(isolate, 0)))) {}
 
 ValueDeserializer::~ValueDeserializer() {
@@ skipping 238 matching lines @@
     return MaybeHandle<String>();
 
   // Copy the bytes directly into the new string.
   // Warning: this uses host endianness.
   memcpy(string->GetChars(), bytes.begin(), bytes.length());
   return string;
 }
 
 MaybeHandle<JSObject> ValueDeserializer::ReadJSObject() {
   // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSObject>();
+  STACK_CHECK(isolate_, MaybeHandle<JSObject>());
 
   uint32_t id = next_id_++;
   HandleScope scope(isolate_);
   Handle<JSObject> object =
       isolate_->factory()->NewJSObject(isolate_->object_function());
   AddObjectWithID(id, object);
 
   uint32_t num_properties;
   uint32_t expected_num_properties;
   if (!ReadJSObjectProperties(object, SerializationTag::kEndJSObject)
            .To(&num_properties) ||
       !ReadVarint<uint32_t>().To(&expected_num_properties) ||
       num_properties != expected_num_properties) {
     return MaybeHandle<JSObject>();
   }
 
   DCHECK(HasObjectWithID(id));
   return scope.CloseAndEscape(object);
 }
 
 MaybeHandle<JSArray> ValueDeserializer::ReadSparseJSArray() {
   // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSArray>();
+  STACK_CHECK(isolate_, MaybeHandle<JSArray>());
 
   uint32_t length;
   if (!ReadVarint<uint32_t>().To(&length)) return MaybeHandle<JSArray>();
 
   uint32_t id = next_id_++;
   HandleScope scope(isolate_);
   Handle<JSArray> array = isolate_->factory()->NewJSArray(0);
   JSArray::SetLength(array, length);
   AddObjectWithID(id, array);
 
   uint32_t num_properties;
   uint32_t expected_num_properties;
   uint32_t expected_length;
   if (!ReadJSObjectProperties(array, SerializationTag::kEndSparseJSArray)
            .To(&num_properties) ||
       !ReadVarint<uint32_t>().To(&expected_num_properties) ||
       !ReadVarint<uint32_t>().To(&expected_length) ||
       num_properties != expected_num_properties || length != expected_length) {
     return MaybeHandle<JSArray>();
   }
 
   DCHECK(HasObjectWithID(id));
   return scope.CloseAndEscape(array);
 }
 
 MaybeHandle<JSArray> ValueDeserializer::ReadDenseJSArray() {
   // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSArray>();
+  STACK_CHECK(isolate_, MaybeHandle<JSArray>());
 
   uint32_t length;
   if (!ReadVarint<uint32_t>().To(&length)) return MaybeHandle<JSArray>();
 
   uint32_t id = next_id_++;
   HandleScope scope(isolate_);
   Handle<JSArray> array = isolate_->factory()->NewJSArray(
       FAST_HOLEY_ELEMENTS, length, length, INITIALIZE_ARRAY_ELEMENTS_WITH_HOLE);
   AddObjectWithID(id, array);
 
@@ skipping 83 matching lines @@
       !JSRegExp::New(pattern, static_cast<JSRegExp::Flags>(raw_flags))
            .ToHandle(&regexp)) {
     return MaybeHandle<JSRegExp>();
   }
   AddObjectWithID(id, regexp);
   return regexp;
 }
 
 MaybeHandle<JSMap> ValueDeserializer::ReadJSMap() {
   // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSMap>();
+  STACK_CHECK(isolate_, MaybeHandle<JSMap>());
 
   HandleScope scope(isolate_);
   uint32_t id = next_id_++;
   Handle<JSMap> map = isolate_->factory()->NewJSMap();
   AddObjectWithID(id, map);
 
   Handle<JSFunction> map_set = isolate_->map_set();
   uint32_t length = 0;
   while (true) {
     SerializationTag tag;
@@ skipping 16 matching lines @@
   if (!ReadVarint<uint32_t>().To(&expected_length) ||
       length != expected_length) {
     return MaybeHandle<JSMap>();
   }
   DCHECK(HasObjectWithID(id));
   return scope.CloseAndEscape(map);
 }
 
 MaybeHandle<JSSet> ValueDeserializer::ReadJSSet() {
   // If we are at the end of the stack, abort. This function may recurse.
-  if (StackLimitCheck(isolate_).HasOverflowed()) return MaybeHandle<JSSet>();
+  STACK_CHECK(isolate_, MaybeHandle<JSSet>());
 
   HandleScope scope(isolate_);
   uint32_t id = next_id_++;
   Handle<JSSet> set = isolate_->factory()->NewJSSet();
   AddObjectWithID(id, set);
   Handle<JSFunction> set_add = isolate_->set_add();
   uint32_t length = 0;
   while (true) {
     SerializationTag tag;
     if (!PeekTag().To(&tag)) return MaybeHandle<JSSet>();
@@ skipping 255 matching lines @@
   }
 #endif
   position_ = end_;
 
   if (stack.size() != 1) return MaybeHandle<Object>();
   return scope.CloseAndEscape(stack[0]);
 }
 
 }  // namespace internal
 }  // namespace v8