Support ImageBitmap transfer with V8-based structured clone.

third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.h

Index: third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.h
diff --git a/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.h b/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.h
index d6e1d41b88e35ca8638d510a19672d8e02494d41..17929171a72ddc6e65e3960ebd442ce9d660d013 100644
--- a/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.h
+++ b/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.h
@@ -64,6 +64,9 @@ private:
     // Message ports which were transferred in.
     const MessagePortArray* m_transferredMessagePorts = nullptr;
 
+    // ImageBitmaps which were transferred in.
+    HeapVector<Member<ImageBitmap>> m_transferredImageBitmaps;
+
     // Set during deserialize after the header is read.
     uint32_t m_version = 0;
 #if DCHECK_IS_ON()