Bug 2058626: Check for mutually exclusive flags when deserializing cloned...

function forge(pattern, srcFlags, flagsByte) {

  var cb = serialize(new RegExp(pattern, srcFlags), undefined, { scope: "DifferentProcess" });

  var u8 = new Uint8Array(cb.arraybuffer);

  for (var i = 0; i + 8 <= u8.length; i += 4) {

    var tag = u8[i+4] | (u8[i+5] << 8) | (u8[i+6] << 16) | (u8[i+7] << 24);

    if ((tag >>> 0) === 0xFFFF0006) { u8[i] = flagsByte; break; }

  }

  cb.clonebuffer = u8.buffer;

  return deserialize(cb, { scope: "DifferentProcess" });

}

try {

  var forged = forge("[\\q{abc|de}]", "v", 0x90);

  var bad = new RegExp(forged, "u");

  try { bad.exec("abc"); } catch {}

  var good = new RegExp("[\\q{abc|de}]", "u");

} catch {}

    }

    case SCTAG_REGEXP_OBJECT: {

      if ((data & RegExpFlag::AllFlags) != data) {

      // Reject invalid flags. /u and /v are mutually exclusive.

      if ((data & RegExpFlag::AllFlags) != data ||

          ((data & RegExpFlag::Unicode) && (data & RegExpFlag::UnicodeSets))) {

        JS_ReportErrorNumberASCII(context(), GetErrorMessage, nullptr,

                                  JSMSG_SC_BAD_SERIALIZED_DATA, "regexp");

        return false;