Blobs: Catching browser-process created Blobs in extension code.

extensions/renderer/blob_native_handler.cc

Index: extensions/renderer/blob_native_handler.cc
diff --git a/extensions/renderer/blob_native_handler.cc b/extensions/renderer/blob_native_handler.cc
index c887af63f67aa23d73089ac876e0db794f9ec451..d4087bc80ab415064770eac40616737de2ab6727 100644
--- a/extensions/renderer/blob_native_handler.cc
+++ b/extensions/renderer/blob_native_handler.cc
@@ -19,6 +19,24 @@ void GetBlobUuid(const v8::FunctionCallbackInfo<v8::Value>& args) {
       v8::String::NewFromUtf8(args.GetIsolate(), blob.uuid().utf8().data()));
 }
 
+// Take ownership of a Blob created on the browser process. Expects the Blob's
+// UUID, type, and size as arguments. Returns the Blob we just took to
+// Javascript. The Blob reference in the browser process is dropped through
+// a separate flow to avoid leaking Blobs if the script context is destroyed.
+void TakeBrowserProcessBlob(const v8::FunctionCallbackInfo<v8::Value>& args) {
+  DCHECK_EQ(3, args.Length());
+  DCHECK(args[0]->IsString());
+  DCHECK(args[1]->IsString());
+  DCHECK(args[2]->IsInt32());
+  std::string uuid(*v8::String::Utf8Value(args[0]->ToString()));
+  std::string type(*v8::String::Utf8Value(args[1]->ToString()));
+  blink::WebBlob blob =
+      blink::WebBlob::createFromUUID(blink::WebString::fromUTF8(uuid),
+                                     blink::WebString::fromUTF8(type),
+                                     args[2]->Int32Value());
+  args.GetReturnValue().Set(blob.toV8Value());
+}
+
 }  // namespace
 
 namespace extensions {
@@ -26,6 +44,7 @@ namespace extensions {
 BlobNativeHandler::BlobNativeHandler(ScriptContext* context)
     : ObjectBackedNativeHandler(context) {
   RouteFunction("GetBlobUuid", base::Bind(&GetBlobUuid));
+  RouteFunction("TakeBrowserProcessBlob", base::Bind(&TakeBrowserProcessBlob));
 }
 
 }  // namespace extensions