Bugzilla

/*

 * Any copyright is dedicated to the Public Domain.

 * http://creativecommons.org/licenses/publicdomain/

 */

// bug 1426783

let data = new Uint8Array([

    ,,,,7,,255,255,34,,,128,5,1,255,255,

    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

    ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,1

]);

let cloneBuffer = serialize(null);

cloneBuffer.clonebuffer = data.buffer;

let expected = "InternalError: bad serialized structured data (invalid typed array size)";

let actual = "deserialization did not throw";

try {

    deserialize(cloneBuffer);

} catch (exc) {

    actual = exc.toString();

}

reportCompare(expected, actual);

    mozilla::CheckedInt<size_t> nbytes =

        mozilla::CheckedInt<size_t>(nelems) *

        TypedArrayElemSize(static_cast<Scalar::Type>(arrayType));

    if (!nbytes.isValid() || nbytes.value() > UINT32_MAX) {

        JS_ReportErrorNumberASCII(context(), GetErrorMessage, nullptr,

                                  JSMSG_SC_BAD_SERIALIZED_DATA,

                                  "invalid typed array size");

        return false;

    }

    JSObject* obj = ArrayBufferObject::create(context(), nbytes.value());