When we can't neuter ArrayBuffers, we can't transfer them

third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 159 matching lines @@
         } else {
             Vector<v8::Local<v8::ArrayBuffer>, 4> bufferHandles;
             v8::HandleScope handleScope(isolate);
             acculumateArrayBuffersForAllWorlds(isolate, static_cast<DOMArrayBuffer*>(arrayBuffers[i].get()), bufferHandles);
             bool isNeuterable = true;
             for (size_t j = 0; j < bufferHandles.size(); ++j)
                 isNeuterable &= bufferHandles[j]->IsNeuterable();
 
             DOMArrayBufferBase* toTransfer = arrayBuffers[i];
             if (!isNeuterable)
-                toTransfer = DOMArrayBuffer::create(arrayBuffers[i]->buffer());
+                toTransfer = DOMArrayBuffer::create(arrayBuffers[i]->buffer()->data(), arrayBuffers[i]->buffer()->byteLength());
             bool result = toTransfer->transfer(contents->at(i));
             if (!result) {
                 exceptionState.throwDOMException(DataCloneError, "ArrayBuffer at index " + String::number(i) + " could not be transferred.");
                 return;
             }
 
             if (isNeuterable)
                 for (size_t j = 0; j < bufferHandles.size(); ++j)
                     bufferHandles[j]->Neuter();
         }
@@ skipping 90 matching lines @@
     m_externallyAllocatedMemory = static_cast<intptr_t>(m_data.length());
     v8::Isolate::GetCurrent()->AdjustAmountOfExternalAllocatedMemory(m_externallyAllocatedMemory);
 }
 
 bool SerializedScriptValue::containsTransferableArrayBuffer() const
 {
     return m_arrayBufferContentsArray && !m_arrayBufferContentsArray->isEmpty();
 }
 
 } // namespace blink