Check for duplicate ArrayBuffer transferables.

Source/bindings/v8/V8Utilities.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 82 matching lines @@
         }
         // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
         if (V8MessagePort::hasInstance(transferrable, isolate, worldType(isolate))) {
             RefPtr<MessagePort> port = V8MessagePort::toNative(v8::Handle<v8::Object>::Cast(transferrable));
             // Check for duplicate MessagePorts.
             if (ports.contains(port)) {
                 exceptionState.throwDOMException(DataCloneError, "Message port at index " + String::number(i) + " is a duplicate of an earlier port.");
                 return false;
             }
             ports.append(port.release());
-        } else if (V8ArrayBuffer::hasInstance(transferrable, isolate, worldType(isolate)))
-            arrayBuffers.append(V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(transferrable)));
-        else {
+        } else if (V8ArrayBuffer::hasInstance(transferrable, isolate, worldType(isolate))) {
+            RefPtr<ArrayBuffer> arrayBuffer = V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(transferrable));
+            if (arrayBuffers.contains(arrayBuffer)) {
+                exceptionState.throwDOMException(DataCloneError, "ArrayBuffer at index " + String::number(i) + " is a duplicate of an earlier ArrayBuffer.");
+                return false;
+            }
+            arrayBuffers.append(arrayBuffer.release());
+        } else {
             exceptionState.throwDOMException(DataCloneError, "Value at index " + String::number(i) + " does not have a transferable type.");
             return false;
         }
     }
     return true;
 }
 
 bool getMessagePortArray(v8::Local<v8::Value> value, const String& propertyName, MessagePortArray& ports, v8::Isolate* isolate)
 {
     if (isUndefinedOrNull(value)) {
@@ skipping 56 matching lines @@
 
 ExecutionContext* getExecutionContext()
 {
     if (WorkerScriptController* controller = WorkerScriptController::controllerForContext())
         return &controller->workerGlobalScope();
 
     return currentDocument();
 }
 
 } // namespace WebCore