Index: src/value-serializer.cc |
diff --git a/src/value-serializer.cc b/src/value-serializer.cc |
index a41c182e328432f563c7b683deab1c8639ed31ae..c20711d8a24fbd82169759077c259fd296bb6d9b 100644 |
--- a/src/value-serializer.cc |
+++ b/src/value-serializer.cc |
@@ -682,8 +682,11 @@ Maybe<bool> ValueDeserializer::ReadHeader() { |
if (position_ < end_ && |
*position_ == static_cast<uint8_t>(SerializationTag::kVersion)) { |
ReadTag().ToChecked(); |
- if (!ReadVarint<uint32_t>().To(&version_)) return Nothing<bool>(); |
- if (version_ > kLatestVersion) return Nothing<bool>(); |
+ if (!ReadVarint<uint32_t>().To(&version_) || version_ > kLatestVersion) { |
+ isolate_->Throw(*isolate_->factory()->NewError( |
+ MessageTemplate::kDataCloneDeserializationVersionError)); |
+ return Nothing<bool>(); |
+ } |
} |
return Just(true); |
} |
@@ -804,6 +807,11 @@ MaybeHandle<Object> ValueDeserializer::ReadObject() { |
result = ReadJSArrayBufferView(Handle<JSArrayBuffer>::cast(object)); |
} |
+ if (result.is_null() && !isolate_->has_pending_exception()) { |
+ isolate_->Throw(*isolate_->factory()->NewError( |
+ MessageTemplate::kDataCloneDeserializationError)); |
+ } |
+ |
return result; |
} |
@@ -1299,8 +1307,7 @@ static Maybe<bool> SetPropertiesFromKeyValuePairs(Isolate* isolate, |
MaybeHandle<Object> |
ValueDeserializer::ReadObjectUsingEntireBufferForLegacyFormat() { |
- if (version_ > 0) return MaybeHandle<Object>(); |
- |
+ DCHECK_EQ(version_, 0); |
HandleScope scope(isolate_); |
std::vector<Handle<Object>> stack; |
while (position_ < end_) { |
@@ -1362,9 +1369,12 @@ ValueDeserializer::ReadObjectUsingEntireBufferForLegacyFormat() { |
new_object = js_array; |
break; |
} |
- case SerializationTag::kEndDenseJSArray: |
+ case SerializationTag::kEndDenseJSArray: { |
// This was already broken in Chromium, and apparently wasn't missed. |
+ isolate_->Throw(*isolate_->factory()->NewError( |
+ MessageTemplate::kDataCloneDeserializationError)); |
return MaybeHandle<Object>(); |
+ } |
default: |
if (!ReadObject().ToHandle(&new_object)) return MaybeHandle<Object>(); |
break; |
@@ -1380,7 +1390,11 @@ ValueDeserializer::ReadObjectUsingEntireBufferForLegacyFormat() { |
#endif |
position_ = end_; |
- if (stack.size() != 1) return MaybeHandle<Object>(); |
+ if (stack.size() != 1) { |
+ isolate_->Throw(*isolate_->factory()->NewError( |
+ MessageTemplate::kDataCloneDeserializationError)); |
+ return MaybeHandle<Object>(); |
+ } |
return scope.CloseAndEscape(stack[0]); |
} |