Unable to deserialize nested objects

[JSCU-CNI]

Thank you for creating this library, it is very useful and concise. I think I stumbled upon a small bug when deserializing object references inside an object. See the example below.

When serializing the following object:

v8.serialize({
  "string_primitive": "hello primitive",
  "string_object": new String("hello object"),
  "bool_primitive_true": true,
}).toString("base64")

And then decoding it:

v8serialize.loads(base64.b64decode(...))

Will result in the following serializer error:

v8serialize._errors.DecodeV8SerializeError: JSObject has a key encoded with
tag kTrue that is not a number or string tag. Valid JavaScript Object Keys: 
kDouble, kInt32, kNumberObject, kOneByteString, kStringObject, kTwoByteString,
kUint32, kUtf8String: position=90, 
data=b'\xff\x0fo"\x10string_primitive"\x0fhello primitive"\rstring_objects"\x0chello object"\x13bool_primitive_trueT{\x03'

00000000  ff 0f 6f 22 10 73 74 72  69 6e 67 5f 70 72 69 6d   ..o".string_prim
00000010  69 74 69 76 65 22 0f 68  65 6c 6c 6f 20 70 72 69   itive".hello pri
00000020  6d 69 74 69 76 65 22 0d  73 74 72 69 6e 67 5f 6f   mitive".string_o
00000030  62 6a 65 63 74 73 22 0c  68 65 6c 6c 6f 20 6f 62   bjects".hello ob
00000040  6a 65 63 74 22 13 62 6f  6f 6c 5f 70 72 69 6d 69   ject".bool_primi
00000050  74 69 76 65 5f 74 72 75  65 54 7b 03               tive_trueT{.

It seems that "string_object": new String("hello object") (parsing in read_js_primitive_object) causes read_js_object and _read_js_object_properties to read further than it should as the String object has already finished.

[h4l]

Thank you for this report and details. It does look like a bug, I'll look into it.

[h4l]

The problem is that v8serialize is encoding and decoding primitive-object-wrapped strings (v8serialize.jstypes.JSPrimitiveObject) according to an older version of the V8 serialization format (pre 12). This was a mistake in the implementation, as the earliest version we support is >= 13.

It wasn't detected in the automated tests because the integration tests that randomly generate objects to round-trip with a real V8 implementation were mistakenly not generating v8serialize.jstypes.JSPrimitiveObject values, so no primitive wrappers were being round-tripped.

I'll get this fixed and release a new version soon, should be later today or tomorrow.

[JSCU-CNI]

Thank you for triaging this issue, looking forward to the patch!

[h4l]

@JSCU-CNI This is now fixed and released in version 0.3.0! Thanks again for reporting this.

And thanks also for using v8serialize! I guess it may not be public, but I'd be interested to hear about what you use it for.

[JSCU-CNI]

Thank you @h4l for the quick fix and new release! We do contribute to open source projects from time to time, when we publish work using this project I'll let you know.

[h4l]

You're welcome! I look forward to seeing what you make.

[JSCU-CNI]

Although it is still in review, we have open sourced an extension (LevelDB and IndexedDB) for the forensic Dissect framework that uses v8serialize. You can see the PR here. Perhaps of most interest to you, we have added a small extension to parse Chromium Blink host objects. The implementation is incomplete but works for now.

[h4l]

Thanks for sharing, that's really cool to see! I had a look through and it's interesting to see something of how IndexedDB's data is stored. It's a nice coincidence, as I originally wrote v8serialize for a similar purpose, I was writing a Python client for Deno KV, which (like IndexedDB) is a database designed to store native JavaScript values that uses the V8 serialization format.

I'm glad to see you could build your own HostObject deserializer for Blink's extensions, I'm pleased I didn't just hard code the Node.js HostObject handler I needed! I hope they like your contribution.