Keep materialized ArrayBuffer and ImageBitmap objects in SerializedScriptValue.

third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp

Index: third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp b/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp
index 4792bf41027b54fac07061241ce2125ea2324e29..850d5a02f93ce15f698b6bbfc0acb2bb1a9ac96a 100644
--- a/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/serialization/V8ScriptValueDeserializer.cpp
@@ -140,38 +140,25 @@ void V8ScriptValueDeserializer::Transfer() {
   v8::Local<v8::Context> context = script_state_->GetContext();
   v8::Local<v8::Object> creation_context = context->Global();
 
+  // Receive the transfer, making the received objects available.
+  serialized_script_value_->ReceiveTransfer();
+
   // Transfer array buffers.
-  if (auto* array_buffer_contents =
-          serialized_script_value_->GetArrayBufferContentsArray()) {
-    for (unsigned i = 0; i < array_buffer_contents->size(); i++) {
-      WTF::ArrayBufferContents& contents = array_buffer_contents->at(i);
-      if (contents.IsShared()) {
-        DOMSharedArrayBuffer* array_buffer =
-            DOMSharedArrayBuffer::Create(contents);
-        v8::Local<v8::Value> wrapper =
-            ToV8(array_buffer, creation_context, isolate);
-        DCHECK(wrapper->IsSharedArrayBuffer());
-        deserializer_.TransferSharedArrayBuffer(
-            i, v8::Local<v8::SharedArrayBuffer>::Cast(wrapper));
-      } else {
-        DOMArrayBuffer* array_buffer = DOMArrayBuffer::Create(contents);
-        v8::Local<v8::Value> wrapper =
-            ToV8(array_buffer, creation_context, isolate);
-        DCHECK(wrapper->IsArrayBuffer());
-        deserializer_.TransferArrayBuffer(
-            i, v8::Local<v8::ArrayBuffer>::Cast(wrapper));
-      }
+  const auto& array_buffers = serialized_script_value_->ReceivedArrayBuffers();
+  for (unsigned i = 0; i < array_buffers.size(); i++) {
+    DOMArrayBufferBase* array_buffer = array_buffers.at(i);
+    v8::Local<v8::Value> wrapper =
+        ToV8(array_buffer, creation_context, isolate);
+    if (array_buffer->IsShared()) {
+      DCHECK(wrapper->IsSharedArrayBuffer());
+      deserializer_.TransferSharedArrayBuffer(
+          i, v8::Local<v8::SharedArrayBuffer>::Cast(wrapper));
+    } else {
+      DCHECK(wrapper->IsArrayBuffer());
+      deserializer_.TransferArrayBuffer(
+          i, v8::Local<v8::ArrayBuffer>::Cast(wrapper));
     }
   }
-
-  // Transfer image bitmaps.

[haraken, 2017/05/15 17:13:33]

Why can we remove this code? (Maybe I'm failing at understanding the point of
this CL :-)

[haraken, 2017/05/15 17:18:44]

Ah, sorry. I now understand. transferred_image_bitmaps_ is no longer needed
after this CL.

[jbroman, 2017/05/15 17:19:26]

Because ReceiveTransfer exists to create these objects (but also to avoid trying
to create them a second time if the SSV is deserialized again in a second world
-- which notably failed for ArrayBuffer in the attached bug).

So both here and above, the work of creating the objects is factored out and
moved there. For ImageBitmap, that was all the work being done here.

-  if (auto* image_bitmap_contents =
-          serialized_script_value_->GetImageBitmapContentsArray()) {
-    transferred_image_bitmaps_.ReserveInitialCapacity(
-        image_bitmap_contents->size());
-    for (const auto& image : *image_bitmap_contents)
-      transferred_image_bitmaps_.push_back(ImageBitmap::Create(image));
-  }
 }
 
 bool V8ScriptValueDeserializer::ReadUTF8String(String* string) {
@@ -273,9 +260,11 @@ ScriptWrappable* V8ScriptValueDeserializer::ReadDOMObject(
     }
     case kImageBitmapTransferTag: {
       uint32_t index = 0;
-      if (!ReadUint32(&index) || index >= transferred_image_bitmaps_.size())
+      const auto& transferred_image_bitmaps =
+          serialized_script_value_->ReceivedImageBitmaps();
+      if (!ReadUint32(&index) || index >= transferred_image_bitmaps.size())
         return nullptr;
-      return transferred_image_bitmaps_[index].Get();
+      return transferred_image_bitmaps[index].Get();
     }
     case kImageDataTag: {
       uint32_t width = 0, height = 0, pixel_length = 0;