Blobs: Catching browser-process created Blobs in extension code.

extensions/renderer/blob_native_handler.cc

Index: extensions/renderer/blob_native_handler.cc
diff --git a/extensions/renderer/blob_native_handler.cc b/extensions/renderer/blob_native_handler.cc
index c887af63f67aa23d73089ac876e0db794f9ec451..9713c51cf9ad051c10559f9ffb29077e1c7d4141 100644
--- a/extensions/renderer/blob_native_handler.cc
+++ b/extensions/renderer/blob_native_handler.cc
@@ -19,6 +19,23 @@ void GetBlobUuid(const v8::FunctionCallbackInfo<v8::Value>& args) {
       v8::String::NewFromUtf8(args.GetIsolate(), blob.uuid().utf8().data()));
 }
 
+// Take ownership of a Blob created on the browser process. Expects the Blob's
+// UUID, type, and size as arguments. Returns the Blob we just took to
+// Javascript. The Blob reference in the browser process is dropped through
+// a separate flow to avoid leaking Blobs if the script context is destroyed.
+void TakeBrowserProcessBlob(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  DCHECK_EQ(3, args.Length());
+  DCHECK(args[0]->IsString());
+  DCHECK(args[1]->IsString());
+  DCHECK(args[2]->IsInt32());
+  std::string uuid(*v8::String::Utf8Value(args[0]->ToString()));
+  std::string type(*v8::String::Utf8Value(args[1]->ToString()));
+  blink::WebBlob blob = blink::WebBlob::createFromUUID(
+      blink::WebString::fromUTF8(uuid), blink::WebString::fromUTF8(type),
+      args[2]->Int32Value());
+  args.GetReturnValue().Set(blob.toV8Value());
+}
+
 }  // namespace
 
 namespace extensions {
@@ -26,6 +43,7 @@ namespace extensions {
 BlobNativeHandler::BlobNativeHandler(ScriptContext* context)
     : ObjectBackedNativeHandler(context) {
   RouteFunction("GetBlobUuid", base::Bind(&GetBlobUuid));
+  RouteFunction("TakeBrowserProcessBlob", base::Bind(&TakeBrowserProcessBlob));
 }
 
 }  // namespace extensions