From ea8a6b43f7b0a4766a610276e84bf1be302e7b1e Mon Sep 17 00:00:00 2001
From: Aliaksandr Kalenik <kalenik.aliaksandr@gmail.com>
Date: Sun, 13 Apr 2025 19:50:49 +0200
Subject: [PATCH] LibWeb: Reserve zero for not supported transfer type

Previously we were using 0 for both unsupported type and MessagePort,
which led to crashing on attempt to decode unsupported transfer type as
MessagePort.

Fixes crashing on
https://docs.mapbox.com/mapbox-gl-js/clip-layer-building-demo.html
---
 Libraries/LibWeb/HTML/ImageBitmap.cpp         | 2 +-
 Libraries/LibWeb/HTML/StructuredSerialize.cpp | 6 +++++-
 Libraries/LibWeb/HTML/StructuredSerialize.h   | 7 ++++---
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/Libraries/LibWeb/HTML/ImageBitmap.cpp b/Libraries/LibWeb/HTML/ImageBitmap.cpp
index aedf8c2f6f2..182eea31929 100644
--- a/Libraries/LibWeb/HTML/ImageBitmap.cpp
+++ b/Libraries/LibWeb/HTML/ImageBitmap.cpp
@@ -65,7 +65,7 @@ HTML::TransferType ImageBitmap::primary_interface() const
 {
     // FIXME: Implement this
     dbgln("(STUBBED) ImageBitmap::primary_interface()");
-    return {};
+    return TransferType::Unknown;
 }
 
 // https://html.spec.whatwg.org/multipage/imagebitmap-and-animations.html#dom-imagebitmap-width
diff --git a/Libraries/LibWeb/HTML/StructuredSerialize.cpp b/Libraries/LibWeb/HTML/StructuredSerialize.cpp
index d9c26e23333..736257d3be5 100644
--- a/Libraries/LibWeb/HTML/StructuredSerialize.cpp
+++ b/Libraries/LibWeb/HTML/StructuredSerialize.cpp
@@ -1291,9 +1291,11 @@ static bool is_interface_exposed_on_target_realm(TransferType name, JS::Realm& r
     case TransferType::MessagePort:
         return intrinsics.is_exposed("MessagePort"sv);
         break;
-    default:
+    case TransferType::Unknown:
         dbgln("Unknown interface type for transfer: {}", to_underlying(name));
         break;
+    default:
+        VERIFY_NOT_REACHED();
     }
     return false;
 }
@@ -1310,6 +1312,8 @@ static WebIDL::ExceptionOr<GC::Ref<Bindings::PlatformObject>> create_transferred
     case TransferType::ResizableArrayBuffer:
         dbgln("ArrayBuffer ({}) is not a platform object.", to_underlying(name));
         break;
+    case TransferType::Unknown:
+        break;
     }
     VERIFY_NOT_REACHED();
 }
diff --git a/Libraries/LibWeb/HTML/StructuredSerialize.h b/Libraries/LibWeb/HTML/StructuredSerialize.h
index 0719ab4743e..1e35a3085f2 100644
--- a/Libraries/LibWeb/HTML/StructuredSerialize.h
+++ b/Libraries/LibWeb/HTML/StructuredSerialize.h
@@ -45,9 +45,10 @@ struct DeserializedRecord {
 };
 
 enum class TransferType : u8 {
-    MessagePort,
-    ArrayBuffer,
-    ResizableArrayBuffer,
+    Unknown = 0,
+    MessagePort = 1,
+    ArrayBuffer = 2,
+    ResizableArrayBuffer = 3,
 };
 
 WebIDL::ExceptionOr<SerializationRecord> structured_serialize(JS::VM& vm, JS::Value);