SharedArrayBuffer throws serializing to indexeddb

third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueSerializer.cpp

Index: third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueSerializer.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueSerializer.cpp b/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueSerializer.cpp
index bc0cf537a4dc95ecaf9d688e8606827c6bc92aa8..dee9be55b981dc544ed993e2d6af79250b6d3903 100644
--- a/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueSerializer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueSerializer.cpp
@@ -51,7 +51,8 @@ V8ScriptValueSerializer::V8ScriptValueSerializer(
       serializer_(script_state_->GetIsolate(), this),
       transferables_(options.transferables),
       blob_info_array_(options.blob_info),
-      inline_wasm_(options.write_wasm_to_stream) {}
+      inline_wasm_(options.write_wasm_to_stream),
+      for_storage_(options.for_storage) {}
 
 RefPtr<SerializedScriptValue> V8ScriptValueSerializer::Serialize(
     v8::Local<v8::Value> value,
@@ -117,32 +118,37 @@ void V8ScriptValueSerializer::PrepareTransfer(ExceptionState& exception_state) {
 
 void V8ScriptValueSerializer::FinalizeTransfer(
     ExceptionState& exception_state) {
-  if (!transferables_ && shared_array_buffers_.IsEmpty())
-    return;
-
   // TODO(jbroman): Strictly speaking, this is not correct; transfer should
   // occur in the order of the transfer list.
   // https://html.spec.whatwg.org/multipage/infrastructure.html#structuredclonewithtransfer
 
+  v8::Isolate* isolate = script_state_->GetIsolate();
+
+  // The order of ArrayBuffers and SharedArrayBuffers matters; we use the index
+  // into this array for deserialization.
   ArrayBufferArray array_buffers;
-  array_buffers.AppendVector(transferables_->array_buffers);
+  if (transferables_)
+    array_buffers.AppendVector(transferables_->array_buffers);
   array_buffers.AppendVector(shared_array_buffers_);
 
-  v8::Isolate* isolate = script_state_->GetIsolate();
-  serialized_script_value_->TransferArrayBuffers(isolate, array_buffers,
-                                                 exception_state);
-  if (exception_state.HadException())
-    return;
+  if (!array_buffers.IsEmpty()) {
+    serialized_script_value_->TransferArrayBuffers(isolate, array_buffers,
+                                                   exception_state);
+    if (exception_state.HadException())
+      return;
+  }
 
-  serialized_script_value_->TransferImageBitmaps(
-      isolate, transferables_->image_bitmaps, exception_state);
-  if (exception_state.HadException())
-    return;
+  if (transferables_) {
+    serialized_script_value_->TransferImageBitmaps(
+        isolate, transferables_->image_bitmaps, exception_state);
+    if (exception_state.HadException())
+      return;
 
-  serialized_script_value_->TransferOffscreenCanvas(
-      isolate, transferables_->offscreen_canvases, exception_state);
-  if (exception_state.HadException())
-    return;
+    serialized_script_value_->TransferOffscreenCanvas(
+        isolate, transferables_->offscreen_canvases, exception_state);
+    if (exception_state.HadException())
+      return;
+  }
 }
 
 void V8ScriptValueSerializer::WriteUTF8String(const String& string) {
@@ -399,6 +405,18 @@ v8::Maybe<bool> V8ScriptValueSerializer::WriteHostObject(
 v8::Maybe<uint32_t> V8ScriptValueSerializer::GetSharedArrayBufferId(
     v8::Isolate* isolate,
     v8::Local<v8::SharedArrayBuffer> v8_shared_array_buffer) {
+  if (for_storage_) {
+    DCHECK(exception_state_);
+    DCHECK_EQ(isolate, script_state_->GetIsolate());
+    ExceptionState exception_state(isolate, exception_state_->Context(),
+                                   exception_state_->InterfaceName(),
+                                   exception_state_->PropertyName());
+    exception_state.ThrowDOMException(
+        kDataCloneError,
+        "A SharedArrayBuffer can not be serialized for storage.");
+    return v8::Nothing<uint32_t>();
+  }
+
   DOMSharedArrayBuffer* shared_array_buffer =
       V8SharedArrayBuffer::toImpl(v8_shared_array_buffer);