Verify that ExtendableMessageEvent's message ports reside on the same heap

third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/serviceworkers/ExtendableMessageEvent.h"
 
 namespace blink {
 
 ExtendableMessageEvent* ExtendableMessageEvent::create(
     const AtomicString& type,
@@ skipping 99 matching lines @@
   if (initializer.hasLastEventId())
     m_lastEventId = initializer.lastEventId();
   if (initializer.hasSource()) {
     if (initializer.source().isClient())
       m_sourceAsClient = initializer.source().getAsClient();
     else if (initializer.source().isServiceWorker())
       m_sourceAsServiceWorker = initializer.source().getAsServiceWorker();
     else if (initializer.source().isMessagePort())
       m_sourceAsMessagePort = initializer.source().getAsMessagePort();
   }
-  if (initializer.hasPorts())
-    m_ports = new MessagePortArray(initializer.ports());
+  if (initializer.hasPorts()) {
+    // TODO(sof): remove the extra same-heap checks once crbug.com/655926
+    // has been resolved.
+    const MessagePortArray& ports = initializer.ports();
+    m_ports = new MessagePortArray;
+    m_ports->reserveInitialCapacity(ports.size());
+    for (const auto& port : ports) {
+      CHECK(ThreadState::current()->isOnThreadHeap(port.get()));
+      m_ports->append(port);
+    }
+  }
 }
 
 ExtendableMessageEvent::ExtendableMessageEvent(
     PassRefPtr<SerializedScriptValue> data,
     const String& origin,
     MessagePortArray* ports,
     WaitUntilObserver* observer)
     : ExtendableEvent(EventTypeNames::message,
                       ExtendableMessageEventInit(),
                       observer),
       m_serializedData(data),
       m_origin(origin),
       m_lastEventId(String()),
       m_ports(ports) {
   if (m_serializedData)
     m_serializedData->registerMemoryAllocatedWithCurrentScriptContext();
+
+  // TODO(sof): remove the same-heap verification once crbug.com/655926 has
+  // been resolved.
+  if (m_ports) {
+    for (const auto& port : *m_ports) {
+      CHECK(ThreadState::current()->isOnThreadHeap(port.get()));
+    }
+  }
 }
 
 }  // namespace blink