Merge 95689 - [Chromium] Protect message ports from being deleted in V8MessageEvent::portsAccesso...

Source/WebCore/bindings/v8/custom/V8MessageEventCustom.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 70 matching lines @@
 }
 
 v8::Handle<v8::Value> V8MessageEvent::portsAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
 {
     INC_STATS("DOM.MessageEvent.ports");
     MessageEvent* event = V8MessageEvent::toNative(info.Holder());
 
     MessagePortArray* ports = event->ports();
     if (!ports)
         return v8::Array::New(0);
+    
+    MessagePortArray portsCopy(*ports);
 
-    v8::Local<v8::Array> portArray = v8::Array::New(ports->size());
-    for (size_t i = 0; i < ports->size(); ++i)
-        portArray->Set(v8::Integer::New(i), toV8((*ports)[i].get()));
+    v8::Local<v8::Array> portArray = v8::Array::New(portsCopy.size());
+    for (size_t i = 0; i < portsCopy.size(); ++i)
+        portArray->Set(v8::Integer::New(i), toV8(portsCopy[i].get()));
 
     return portArray;
 }
 
 v8::Handle<v8::Value> V8MessageEvent::initMessageEventCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.MessageEvent.initMessageEvent");
     MessageEvent* event = V8MessageEvent::toNative(args.Holder());
     String typeArg = v8ValueToWebCoreString(args[0]);
     bool canBubbleArg = args[1]->BooleanValue();
@@ skipping 16 matching lines @@
         if (!getMessagePortArray(args[7], *portArray))
             return v8::Undefined();
     }
     event->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg.release(), originArg, lastEventIdArg, sourceArg, portArray.release());
     v8::PropertyAttribute dataAttr = static_cast<v8::PropertyAttribute>(v8::DontDelete | v8::ReadOnly);
     SerializedScriptValue::deserializeAndSetProperty(args.Holder(), "data", dataAttr, event->dataAsSerializedScriptValue());
     return v8::Undefined();
   }
 
 } // namespace WebCore