Make ImageBitmap Transferable

third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.h

 /*
  * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 30 matching lines @@
 
 class ArrayBufferContents;
 
 }
 
 namespace blink {
 
 class BlobDataHandle;
 class DOMArrayBufferBase;
 class ExceptionState;
+class ImageBitmap;
 class MessagePort;
 class WebBlobInfo;
 
 typedef HeapVector<Member<MessagePort>, 1> MessagePortArray;
 typedef Vector<RefPtr<DOMArrayBufferBase>, 1> ArrayBufferArray;
 typedef HashMap<String, RefPtr<BlobDataHandle>> BlobDataHandleMap;
 typedef Vector<WebBlobInfo> WebBlobInfoArray;
+typedef WillBeHeapVector<RefPtrWillBeMember<ImageBitmap>, 1> ImageBitmapArray;
 
 class CORE_EXPORT SerializedScriptValue : public ThreadSafeRefCounted<SerializedScriptValue> {
 public:
     // Increment this for each incompatible change to the wire format.
     // Version 2: Added StringUCharTag for UChar v8 strings.
     // Version 3: Switched to using uuids as blob data identifiers.
     // Version 4: Extended File serialization to be complete.
     // Version 5: Added CryptoKeyTag for Key objects.
     // Version 6: Added indexed serialization for File, Blob, and FileList.
     // Version 7: Extended File serialization with user visibility.
@@ skipping 14 matching lines @@
 
     // Deserializes the value (in the current context). Returns a null value in
     // case of failure.
     v8::Local<v8::Value> deserialize(MessagePortArray* = 0);
     v8::Local<v8::Value> deserialize(v8::Isolate*, MessagePortArray* = 0, const WebBlobInfoArray* = 0);
 
     // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
     // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3
     // of the HTML5 spec and generates exceptions as appropriate.
     // Returns true if the array was filled, or false if the passed value was not of an appropriate type.
-    static bool extractTransferables(v8::Isolate*, v8::Local<v8::Value>, int, MessagePortArray&, ArrayBufferArray&, ExceptionState&);
+    static bool extractTransferables(v8::Isolate*, v8::Local<v8::Value>, int, MessagePortArray&, ArrayBufferArray&, ImageBitmapArray&, ExceptionState&);
 
     // Informs the V8 about external memory allocated and owned by this object. Large values should contribute
     // to GC counters to eventually trigger a GC, otherwise flood of postMessage() can cause OOM.
     // Ok to invoke multiple times (only adds memory once).
     // The memory registration is revoked automatically in destructor.
     void registerMemoryAllocatedWithCurrentScriptContext();
 
     // Returns true if the value contains a transferable ArrayBuffer.
     bool containsTransferableArrayBuffer() const;
 
 private:
     // The followings are private, but used by SerializedScriptValueFactory.
     enum StringDataMode {
         StringValue,
         WireData
     };
     typedef Vector<WTF::ArrayBufferContents, 1> ArrayBufferContentsArray;
 
     SerializedScriptValue();
     explicit SerializedScriptValue(const String& wireData);
 
     BlobDataHandleMap& blobDataHandles() { return m_blobDataHandles; }
     String& data() { return m_data; }
     void setData(const String& data) { m_data = data; }
     void transferArrayBuffers(v8::Isolate*, ArrayBufferArray&, ExceptionState&);
+    void transferImageBitmaps(v8::Isolate*, ImageBitmapArray&, ExceptionState&);
     ArrayBufferContentsArray* arrayBufferContentsArray() { return m_arrayBufferContentsArray.get(); }
+    ImageBitmapArray* imageBitmapArray() { return m_imageBitmapsArray.get(); }
 
     static PassOwnPtr<ArrayBufferContentsArray> createArrayBuffers(v8::Isolate*, ArrayBufferArray&, ExceptionState&);
+    static PassOwnPtrWillBeRawPtr<ImageBitmapArray> createImageBitmaps(v8::Isolate*, ImageBitmapArray&, ExceptionState&);
 
 private:
     String m_data;
     OwnPtr<ArrayBufferContentsArray> m_arrayBufferContentsArray;
+    OwnPtrWillBePersistent<ImageBitmapArray> m_imageBitmapsArray;

[sof, 2015/10/28 21:44:13]

How is intended to work? The transfer happens on one thread, but the
receiver/consumer of this SerializedScriptValue is on another thread, in the
general case. Which means it will destruct the value..and the Persistent<>.

Persistent<> have a same-thread restriction on use (thread that creates ==
thread that destructs); CrossThreadPersistent<> loosens the restriction on who
gets to destruct the persistent reference. But.. is it safe to assume that the
thread that created the ImageBitmapArray remains alive until the
SerializedScriptValue has been fully consumed & finalized? If not, then you risk
that thread's heap from disappearing & any ImageBitmapArray accesses to touch
freed memory. Which isn't so good.

     BlobDataHandleMap m_blobDataHandles;
     intptr_t m_externallyAllocatedMemory;
 
     friend class SerializedScriptValueFactory;
 };
 
 } // namespace blink
 
 #endif // SerializedScriptValue_h