repro. code for JavaScriptSerializer bug in Mono 3.0

gistfile1.txt

result in an exception below:

$ mono --debug TestsForMono.exe
performing test: key=case1, val={"key":{"subkey":"subval"}}
performing test: key=case2, val={"key":[{"subkey":"subval"}]}

Unhandled Exception:
System.NullReferenceException: Object reference not set to an instance of an object
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToObject (IDictionary`2 dict, System.Type type) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToType (System.Object obj, System.Type targetType) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToList (System.Collections.ArrayList col, System.Type type) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToType (System.Object obj, System.Type targetType) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToObject (IDictionary`2 dict, System.Type type) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToType (System.Object obj, System.Type targetType) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToType[Dictionary`2] (System.Object obj) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.Deserialize[Dictionary`2] (System.String input) [0x00000] in <filename unknown>:0 
  at TestsForMono.MainClass.Main (System.String[] args) [0x0007f] in /Users/nakazawa-k/Documents/workspace/playground_toboggan/Tools/KLBToolFramework/KLBToolHost/TestsForMono/Main.cs:21 
[ERROR] FATAL UNHANDLED EXCEPTION: System.NullReferenceException: Object reference not set to an instance of an object
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToObject (IDictionary`2 dict, System.Type type) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToType (System.Object obj, System.Type targetType) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToList (System.Collections.ArrayList col, System.Type type) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToType (System.Object obj, System.Type targetType) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToObject (IDictionary`2 dict, System.Type type) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToType (System.Object obj, System.Type targetType) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.ConvertToType[Dictionary`2] (System.Object obj) [0x00000] in <filename unknown>:0 
  at System.Web.Script.Serialization.JavaScriptSerializer.Deserialize[Dictionary`2] (System.String input) [0x00000] in <filename unknown>:0 
  at TestsForMono.MainClass.Main (System.String[] args) [0x0007f] in /Users/nakazawa-k/Documents/workspace/playground_toboggan/Tools/KLBToolFramework/KLBToolHost/TestsForMono/Main.cs:21

Main.cs

using System;
using System.Collections.Generic;
using System.Web.Script.Serialization;

namespace TestsForMono
{
	class MainClass
	{
		public static void Main (string[] args)
		{
			Dictionary<string, string> testcases = new Dictionary<string, string> ();
			testcases ["case1"] = "{\"key\":{\"subkey\":\"subval\"}}";
			testcases ["case2"] = "{\"key\":[{\"subkey\":\"subval\"}]}";
			var jsSerializer = new JavaScriptSerializer
			{
				MaxJsonLength = Int32.MaxValue,
				RecursionLimit = Int32.MaxValue,
			};
			foreach (var key in testcases.Keys) {
				Console.WriteLine("performing test: key={0}, val={1}", new object[] { key, testcases[key] });
				jsSerializer.Deserialize<Dictionary<string, object>>(testcases[key]);
			}
		}
	}
}