Throw a deserialization error internally in ValueDeserializer (previously-missed cases).

src/value-serializer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/value-serializer.h"
 
 #include <type_traits>
 
 #include "src/base/logging.h"
 #include "src/conversions.h"
@@ skipping 1628 matching lines @@
     Handle<Object> new_object;
     switch (tag) {
       case SerializationTag::kEndJSObject: {
         ConsumeTag(SerializationTag::kEndJSObject);
 
         // JS Object: Read the last 2*n values from the stack and use them as
         // key-value pairs.
         uint32_t num_properties;
         if (!ReadVarint<uint32_t>().To(&num_properties) ||
             stack.size() / 2 < num_properties) {
+          isolate_->Throw(*isolate_->factory()->NewError(
+              MessageTemplate::kDataCloneDeserializationError));
           return MaybeHandle<Object>();
         }
 
         size_t begin_properties =
             stack.size() - 2 * static_cast<size_t>(num_properties);
         Handle<JSObject> js_object = isolate_->factory()->NewJSObject(
             isolate_->object_function(), pretenure_);
         if (num_properties &&
             !SetPropertiesFromKeyValuePairs(
                  isolate_, js_object, &stack[begin_properties], num_properties)
                  .FromMaybe(false)) {
+          isolate_->Throw(*isolate_->factory()->NewError(
+              MessageTemplate::kDataCloneDeserializationError));
           return MaybeHandle<Object>();
         }
 
         stack.resize(begin_properties);
         new_object = js_object;
         break;
       }
       case SerializationTag::kEndSparseJSArray: {
         ConsumeTag(SerializationTag::kEndSparseJSArray);
 
         // Sparse JS Array: Read the last 2*|num_properties| from the stack.
         uint32_t num_properties;
         uint32_t length;
         if (!ReadVarint<uint32_t>().To(&num_properties) ||
             !ReadVarint<uint32_t>().To(&length) ||
             stack.size() / 2 < num_properties) {
+          isolate_->Throw(*isolate_->factory()->NewError(
+              MessageTemplate::kDataCloneDeserializationError));
           return MaybeHandle<Object>();
         }
 
         Handle<JSArray> js_array = isolate_->factory()->NewJSArray(
             0, TERMINAL_FAST_ELEMENTS_KIND, pretenure_);
         JSArray::SetLength(js_array, length);
         size_t begin_properties =
             stack.size() - 2 * static_cast<size_t>(num_properties);
         if (num_properties &&
             !SetPropertiesFromKeyValuePairs(
                  isolate_, js_array, &stack[begin_properties], num_properties)
                  .FromMaybe(false)) {
+          isolate_->Throw(*isolate_->factory()->NewError(
+              MessageTemplate::kDataCloneDeserializationError));
           return MaybeHandle<Object>();
         }
 
         stack.resize(begin_properties);
         new_object = js_array;
         break;
       }
       case SerializationTag::kEndDenseJSArray: {
         // This was already broken in Chromium, and apparently wasn't missed.
         isolate_->Throw(*isolate_->factory()->NewError(
@@ skipping 18 matching lines @@
   if (stack.size() != 1) {
     isolate_->Throw(*isolate_->factory()->NewError(
         MessageTemplate::kDataCloneDeserializationError));
     return MaybeHandle<Object>();
   }
   return scope.CloseAndEscape(stack[0]);
 }
 
 }  // namespace internal
 }  // namespace v8