Check for duplicate ArrayBuffer transferables.

Source/bindings/v8/V8Utilities.cpp

Index: Source/bindings/v8/V8Utilities.cpp
diff --git a/Source/bindings/v8/V8Utilities.cpp b/Source/bindings/v8/V8Utilities.cpp
index dc3d794853aa359278d874012e8efb4efbc12e02..59057b73cb59c76f712d716cc7dada52bbfd321f 100644
--- a/Source/bindings/v8/V8Utilities.cpp
+++ b/Source/bindings/v8/V8Utilities.cpp
@@ -100,9 +100,14 @@ bool extractTransferables(v8::Local<v8::Value> value, int argumentIndex, Message
                 return false;
             }
             ports.append(port.release());
-        } else if (V8ArrayBuffer::hasInstance(transferrable, isolate, worldType(isolate)))
-            arrayBuffers.append(V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(transferrable)));
-        else {
+        } else if (V8ArrayBuffer::hasInstance(transferrable, isolate, worldType(isolate))) {
+            RefPtr<ArrayBuffer> arrayBuffer = V8ArrayBuffer::toNative(v8::Handle<v8::Object>::Cast(transferrable));
+            if (arrayBuffers.contains(arrayBuffer)) {
+                exceptionState.throwDOMException(DataCloneError, "ArrayBuffer at index " + String::number(i) + " is a duplicate of an earlier ArrayBuffer.");
+                return false;
+            }
+            arrayBuffers.append(arrayBuffer.release());
+        } else {
             exceptionState.throwDOMException(DataCloneError, "Value at index " + String::number(i) + " does not have a transferable type.");
             return false;
         }