Disallow cross-thread Persistent<> read access.

third_party/WebKit/Source/web/WebEmbeddedWorkerImpl.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 245 matching lines @@
                              message.columnNumber, nullptr)));
 }
 
 void WebEmbeddedWorkerImpl::postMessageToPageInspector(const String& message) {
   m_workerInspectorProxy->dispatchMessageFromWorker(message);
 }
 
 void WebEmbeddedWorkerImpl::postTaskToLoader(
     const WebTraceLocation& location,
     std::unique_ptr<ExecutionContextTask> task) {
+  // This cross-thread operation is brittle wrt per-thread heaps,
+  // posting a task to main-thread owned objects.
   m_mainThreadTaskRunners->get(TaskType::Networking)
       ->postTask(
           BLINK_FROM_HERE,
           crossThreadBind(
               &ExecutionContextTask::performTaskIfContextIsValid,
               WTF::passed(std::move(task)),
               wrapCrossThreadWeakPersistent(m_mainFrame->frame()->document())));
 }
 
 void WebEmbeddedWorkerImpl::postTaskToWorkerGlobalScope(
@@ skipping 199 matching lines @@
       *this, *document, *m_workerContextClient);
   m_loaderProxy = WorkerLoaderProxy::create(this);
   m_workerThread = ServiceWorkerThread::create(
       m_loaderProxy, *m_workerGlobalScopeProxy, m_mainThreadTaskRunners.get());
   m_workerThread->start(std::move(startupData));
   m_workerInspectorProxy->workerThreadCreated(document, m_workerThread.get(),
                                               scriptURL);
 }
 
 }  // namespace blink