Make DOMArrayBuffer::Transfer neuter v8::ArrayBuffers

third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/DOMArrayBuffer.h"
 
 #include "bindings/core/v8/DOMDataStore.h"
+#include "bindings/core/v8/DOMWrapperWorld.h"
 #include "platform/wtf/RefPtr.h"
+#include "platform/wtf/Vector.h"
 
 namespace blink {
 
+static void AccumulateArrayBuffersForAllWorlds(

[haraken, 2017/04/20 20:07:01]

I forgot the context but would you help me understand why we need to check
wrappers of all worlds? It seems like we're doing something strange here.

[binji, 2017/04/21 00:00:23]

I have to admit, I don't understand what a "world" is, and why it would have its
own copy of an ArrayBuffer. But if it shares the same backing store as the
DOMArrayBuffer, it should be neutered on transfer.

I went digging for where this code was originally added, and I was able to trace
the basic idea back to the initial implementation of ArrayBuffer transfer:
https://chromium.googlesource.com/chromium/src/+/bd67e9585f4acaad1c468eb28633...

[haraken, 2017/04/21 12:03:39]

Makes sense. Yes, those ArrayBuffer objects are sharing the same backing store.
If you need the semantics that all ArrayBuffers using the backing store must be
neutered, we need that logic.

+    v8::Isolate* isolate,
+    DOMArrayBuffer* object,
+    Vector<v8::Local<v8::ArrayBuffer>, 4>& buffers) {
+  Vector<RefPtr<DOMWrapperWorld>> worlds;
+  DOMWrapperWorld::AllWorldsInCurrentThread(worlds);
+  for (const auto& world : worlds) {
+    v8::Local<v8::Object> wrapper = world->DomDataStore().Get(object, isolate);
+    if (!wrapper.IsEmpty())
+      buffers.push_back(v8::Local<v8::ArrayBuffer>::Cast(wrapper));
+  }
+}
+
+bool DOMArrayBuffer::IsNeuterable(v8::Isolate* isolate) {
+  Vector<v8::Local<v8::ArrayBuffer>, 4> buffer_handles;
+  v8::HandleScope handle_scope(isolate);
+  AccumulateArrayBuffersForAllWorlds(isolate, this, buffer_handles);
+
+  bool is_neuterable = true;
+  for (const auto& buffer_handle : buffer_handles)
+    is_neuterable &= buffer_handle->IsNeuterable();
+
+  return is_neuterable;
+}
+
+bool DOMArrayBuffer::Transfer(v8::Isolate* isolate,
+                              WTF::ArrayBufferContents& result) {
+  DCHECK(!IsShared());
+  bool is_neuterable = IsNeuterable(isolate);
+  if (!is_neuterable)
+    return false;
+
+  if (!Buffer()->Transfer(result))
+    return false;
+
+  NeuterArrayBuffersInAllWorlds(isolate);
+  return true;
+}
+
+void DOMArrayBuffer::NeuterArrayBuffersInAllWorlds(v8::Isolate* isolate) {
+  Vector<v8::Local<v8::ArrayBuffer>, 4> buffer_handles;
+  v8::HandleScope handle_scope(isolate);
+  AccumulateArrayBuffersForAllWorlds(isolate, this, buffer_handles);
+
+  for (const auto& buffer_handle : buffer_handles)
+    buffer_handle->Neuter();
+}
+
 DOMArrayBuffer* DOMArrayBuffer::CreateUninitializedOrNull(
     unsigned num_elements,
     unsigned element_byte_size) {
   RefPtr<ArrayBuffer> buffer = WTF::ArrayBuffer::CreateUninitializedOrNull(
       num_elements, element_byte_size);
   if (!buffer)
     return nullptr;
   return Create(std::move(buffer));
 }
 
 v8::Local<v8::Object> DOMArrayBuffer::Wrap(
     v8::Isolate* isolate,
     v8::Local<v8::Object> creation_context) {
   DCHECK(!DOMDataStore::ContainsWrapper(this, isolate));
 
   const WrapperTypeInfo* wrapper_type_info = this->GetWrapperTypeInfo();
   v8::Local<v8::Object> wrapper =
       v8::ArrayBuffer::New(isolate, Data(), ByteLength());
 
   return AssociateWithWrapper(isolate, wrapper_type_info, wrapper);
 }
 
 }  // namespace blink