From ecb8ae6aba40290bb1adb12991e5515f91f00b80 Mon Sep 17 00:00:00 2001 From: Basilisk-Dev Date: Mon, 30 Oct 2023 15:36:44 -0400 Subject: No issue - Structured clone algorithm doesn't serialize Array Length contrary to HTML spec, resulting in truncation of trailing sparse arrays like [1,2,3,,] Backport of https://bugzilla.mozilla.org/show_bug.cgi?id=1476955 --- js/src/vm/StructuredClone.cpp | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) (limited to 'js/src') diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp index e99cfe8f71..f7b7c75965 100644 --- a/js/src/vm/StructuredClone.cpp +++ b/js/src/vm/StructuredClone.cpp @@ -1240,7 +1240,16 @@ JSStructuredCloneWriter::traverseObject(HandleObject obj) ESClass cls; if (!GetBuiltinClass(context(), obj, &cls)) return false; - return out.writePair(cls == ESClass::Array ? SCTAG_ARRAY_OBJECT : SCTAG_OBJECT_OBJECT, 0); + + if (cls == ESClass::Array) { + uint32_t length = 0; + if (!JS_GetArrayLength(context(), obj, &length)) + return false; + + return out.writePair(SCTAG_ARRAY_OBJECT, NativeEndian::swapToLittleEndian(length)); + } + + return out.writePair(SCTAG_OBJECT_OBJECT, 0); } bool @@ -2143,7 +2152,7 @@ JSStructuredCloneReader::startRead(MutableHandleValue vp) case SCTAG_ARRAY_OBJECT: case SCTAG_OBJECT_OBJECT: { JSObject* obj = (tag == SCTAG_ARRAY_OBJECT) - ? (JSObject*) NewDenseEmptyArray(context()) + ? (JSObject*) NewDenseUnallocatedArray(context(), NativeEndian::swapFromLittleEndian(data)) : (JSObject*) NewBuiltinClassInstance(context()); if (!obj || !objs.append(ObjectValue(*obj))) return false; -- cgit v1.2.3