Support ImageBitmap transfer with V8-based structured clone.

third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp

Index: third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp b/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp
index 94e2e0df8fbb44ac5f534c4f86e2078149cee712..29ab92b1a292867027d19017d55ee5c33b329f90 100644
--- a/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp
@@ -81,6 +81,13 @@ void V8ScriptValueDeserializer::transfer()
             }
         }
     }
+
+    // Transfer image bitmaps.
+    if (auto* imageBitmapContents = m_serializedScriptValue->getImageBitmapContentsArray()) {
+        m_transferredImageBitmaps.reserveInitialCapacity(imageBitmapContents->size());
+        for (const auto& image : *imageBitmapContents)
+            m_transferredImageBitmaps.append(ImageBitmap::create(image));
+    }
 }
 
 bool V8ScriptValueDeserializer::readUTF8String(String* string)
@@ -113,6 +120,12 @@ ScriptWrappable* V8ScriptValueDeserializer::readDOMObject(SerializationTag tag)
             return nullptr;
         return ImageBitmap::create(pixels, width, height, isPremultiplied, originClean);
     }
+    case ImageBitmapTransferTag: {
+        uint32_t index = 0;
+        if (!readUint32(&index) || index >= m_transferredImageBitmaps.size())
+            return nullptr;
+        return m_transferredImageBitmaps[index].get();
+    }
     case ImageDataTag: {
         uint32_t width = 0, height = 0, pixelLength = 0;
         const void* pixels = nullptr;