Verify that ExtendableMessageEvent's message ports reside on the same heap

third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp

Index: third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp
diff --git a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp
index fadbc471e203e25bc645516cea96134289f9200d..9c31574df7e857df236530ba1d6b903ade6344e4 100644
--- a/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp
+++ b/third_party/WebKit/Source/modules/serviceworkers/ExtendableMessageEvent.cpp
@@ -117,8 +117,17 @@ ExtendableMessageEvent::ExtendableMessageEvent(
     else if (initializer.source().isMessagePort())
       m_sourceAsMessagePort = initializer.source().getAsMessagePort();
   }
-  if (initializer.hasPorts())
-    m_ports = new MessagePortArray(initializer.ports());
+  if (initializer.hasPorts()) {
+    // TODO(sof): remove the extra same-heap checks once crbug.com/655926
+    // has been resolved.
+    const MessagePortArray& ports = initializer.ports();
+    m_ports = new MessagePortArray;
+    m_ports->reserveInitialCapacity(ports.size());
+    for (const auto& port : ports) {
+      CHECK(ThreadState::current()->isOnThreadHeap(port.get()));
+      m_ports->append(port);
+    }
+  }
 }
 
 ExtendableMessageEvent::ExtendableMessageEvent(
@@ -135,6 +144,14 @@ ExtendableMessageEvent::ExtendableMessageEvent(
       m_ports(ports) {
   if (m_serializedData)
     m_serializedData->registerMemoryAllocatedWithCurrentScriptContext();
+
+  // TODO(sof): remove the same-heap verification once crbug.com/655926 has
+  // been resolved.
+  if (m_ports) {
+    for (const auto& port : *m_ports) {
+      CHECK(ThreadState::current()->isOnThreadHeap(port.get()));
+    }
+  }
 }
 
 }  // namespace blink