[SharedArrayBuffer] Throw DataClone error if SharedArrayBuffer can't be sent

third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl

 {% from 'utilities.cpp.tmpl' import declare_enum_validation_variable, v8_value_to_local_cpp_value %}
 
 {##############################################################################}
 {% macro generate_method(method, world_suffix) %}
 static void {{method.name}}{{method.overload_index}}Method{{world_suffix}}(const v8::FunctionCallbackInfo<v8::Value>& info) {
   {% filter format_remove_duplicates([
       'ExceptionState exceptionState',
       'ScriptState* scriptState = ']) %}
   {% set define_exception_state -%}
   ExceptionState exceptionState(info.GetIsolate(), ExceptionState::kExecutionContext, "{{interface_name}}", "{{method.name}}");
@@ skipping 429 matching lines @@
       return;
   } else {
     // This instance doesn't support sending array buffers and image bitmaps
     // by move semantics. Emulate it by copy-and-neuter semantics that sends
     // array buffers and image bitmaps via structured clone and then neuters
     // the original objects
 
     // Clear references to array buffers and image bitmaps from transferables
     // so that the serializer can consider the array buffers as
     // non-transferable and serialize them into the message.
-    ArrayBufferArray transferableArrayBuffers = transferables.array_buffers;
-    transferables.array_buffers.Clear();
+    ArrayBufferArray transferableArrayBuffers = SerializedScriptValue::ExtractNonSharedArrayBuffers(transferables);
     ImageBitmapArray transferableImageBitmaps = transferables.image_bitmaps;
     transferables.image_bitmaps.Clear();
     SerializedScriptValue::SerializeOptions options;
     options.transferables = &transferables;
     message = SerializedScriptValue::Serialize(info.GetIsolate(), info[0], options, exceptionState);
     if (exceptionState.HadException())
       return;
 
+    // If the transferable array_buffer list is empty, then it must have been populated with SharedArrayBuffers. They can't be transfered, so throw.
+    if (!message->GetArrayBufferContentsArray()->IsEmpty()) {
+      exceptionState.ThrowDOMException(kDataCloneError, "SharedArrayBuffer can not be sent in this context.");
+      return;
+    }
+
     // Neuter the original array buffers on the sender context.
     SerializedScriptValue::TransferArrayBufferContents(info.GetIsolate(), transferableArrayBuffers, exceptionState);
     if (exceptionState.HadException())
       return;
     // Neuter the original image bitmaps on the sender context.
     SerializedScriptValue::TransferImageBitmapContents(info.GetIsolate(), transferableImageBitmaps, exceptionState);
     if (exceptionState.HadException())
       return;
   }
 
@@ skipping 180 matching lines @@
   {{method_configuration(method) | indent(2)}}
 };
 for (const auto& methodConfig : {{method.name}}MethodConfiguration)
   V8DOMConfiguration::InstallMethod(isolate, world, v8::Local<v8::Object>(), prototypeObject, interfaceObject, signature, methodConfig);
 {% endfilter %}{# runtime_enabled() #}
 {% endfilter %}{# exposed() #}
 {% endfilter %}{# secure_context() #}
 {% endfor %}
 {% endif %}
 {%- endmacro %}