[SharedArrayBuffer] Throw DataClone error if SharedArrayBuffer can't be sent

third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl

Index: third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
diff --git a/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl b/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
index 71453338eb3ac3b3df37f5f86a9ec2ebd69954a9..08b032fff1788f53f512eb96a50cc6c622bd39bb 100644
--- a/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
+++ b/third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl
@@ -447,8 +447,7 @@ static void postMessageImpl(const char* interfaceName, {{cpp_class}}* instance,
     // Clear references to array buffers and image bitmaps from transferables
     // so that the serializer can consider the array buffers as
     // non-transferable and serialize them into the message.
-    ArrayBufferArray transferableArrayBuffers = transferables.array_buffers;
-    transferables.array_buffers.Clear();
+    ArrayBufferArray transferableArrayBuffers = SerializedScriptValue::ExtractNonSharedArrayBuffers(transferables);
     ImageBitmapArray transferableImageBitmaps = transferables.image_bitmaps;
     transferables.image_bitmaps.Clear();
     SerializedScriptValue::SerializeOptions options;
@@ -457,6 +456,12 @@ static void postMessageImpl(const char* interfaceName, {{cpp_class}}* instance,
     if (exceptionState.HadException())
       return;
 
+    // If the transferable array_buffer list is empty, then it must have been populated with SharedArrayBuffers. They can't be transfered, so throw.
+    if (!message->GetArrayBufferContentsArray()->IsEmpty()) {
+      exceptionState.ThrowDOMException(kDataCloneError, "SharedArrayBuffer can not be sent in this context.");
+      return;
+    }
+
     // Neuter the original array buffers on the sender context.
     SerializedScriptValue::TransferArrayBufferContents(info.GetIsolate(), transferableArrayBuffers, exceptionState);
     if (exceptionState.HadException())