Make DOMArrayBuffer::Transfer neuter v8::ArrayBuffers

third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp

Index: third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp
diff --git a/third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp b/third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp
index 3b7c5bc8891aecf24714cf09105eb483e4777da5..ac8ffbf54556569de8832f0a768735e2693337ef 100644
--- a/third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMArrayBuffer.cpp
@@ -5,10 +5,60 @@
 #include "core/dom/DOMArrayBuffer.h"
 
 #include "bindings/core/v8/DOMDataStore.h"
+#include "bindings/core/v8/DOMWrapperWorld.h"
 #include "platform/wtf/RefPtr.h"
+#include "platform/wtf/Vector.h"
 
 namespace blink {
 
+static void AccumulateArrayBuffersForAllWorlds(

[haraken, 2017/04/20 20:07:01]

I forgot the context but would you help me understand why we need to check
wrappers of all worlds? It seems like we're doing something strange here.

[binji, 2017/04/21 00:00:23]

I have to admit, I don't understand what a "world" is, and why it would have its
own copy of an ArrayBuffer. But if it shares the same backing store as the
DOMArrayBuffer, it should be neutered on transfer.

I went digging for where this code was originally added, and I was able to trace
the basic idea back to the initial implementation of ArrayBuffer transfer:
https://chromium.googlesource.com/chromium/src/+/bd67e9585f4acaad1c468eb28633...

[haraken, 2017/04/21 12:03:39]

Makes sense. Yes, those ArrayBuffer objects are sharing the same backing store.
If you need the semantics that all ArrayBuffers using the backing store must be
neutered, we need that logic.

+    v8::Isolate* isolate,
+    DOMArrayBuffer* object,
+    Vector<v8::Local<v8::ArrayBuffer>, 4>& buffers) {
+  Vector<RefPtr<DOMWrapperWorld>> worlds;
+  DOMWrapperWorld::AllWorldsInCurrentThread(worlds);
+  for (const auto& world : worlds) {
+    v8::Local<v8::Object> wrapper = world->DomDataStore().Get(object, isolate);
+    if (!wrapper.IsEmpty())
+      buffers.push_back(v8::Local<v8::ArrayBuffer>::Cast(wrapper));
+  }
+}
+
+bool DOMArrayBuffer::IsNeuterable(v8::Isolate* isolate) {
+  Vector<v8::Local<v8::ArrayBuffer>, 4> buffer_handles;
+  v8::HandleScope handle_scope(isolate);
+  AccumulateArrayBuffersForAllWorlds(isolate, this, buffer_handles);
+
+  bool is_neuterable = true;
+  for (const auto& buffer_handle : buffer_handles)
+    is_neuterable &= buffer_handle->IsNeuterable();
+
+  return is_neuterable;
+}
+
+bool DOMArrayBuffer::Transfer(v8::Isolate* isolate,
+                              WTF::ArrayBufferContents& result) {
+  DCHECK(!IsShared());
+  bool is_neuterable = IsNeuterable(isolate);
+  if (!is_neuterable)
+    return false;
+
+  if (!Buffer()->Transfer(result))
+    return false;
+
+  NeuterArrayBuffersInAllWorlds(isolate);
+  return true;
+}
+
+void DOMArrayBuffer::NeuterArrayBuffersInAllWorlds(v8::Isolate* isolate) {
+  Vector<v8::Local<v8::ArrayBuffer>, 4> buffer_handles;
+  v8::HandleScope handle_scope(isolate);
+  AccumulateArrayBuffersForAllWorlds(isolate, this, buffer_handles);
+
+  for (const auto& buffer_handle : buffer_handles)
+    buffer_handle->Neuter();
+}
+
 DOMArrayBuffer* DOMArrayBuffer::CreateUninitializedOrNull(
     unsigned num_elements,
     unsigned element_byte_size) {