Diff
Modified: trunk/LayoutTests/fast/canvas/webgl/arraybuffer-transfer-of-control.html (280475 => 280476)
--- trunk/LayoutTests/fast/canvas/webgl/arraybuffer-transfer-of-control.html 2021-07-30 15:25:52 UTC (rev 280475)
+++ trunk/LayoutTests/fast/canvas/webgl/arraybuffer-transfer-of-control.html 2021-07-30 15:47:54 UTC (rev 280476)
@@ -333,17 +333,8 @@
name: "transfer list multiple",
send: function(name) {
var buffer = createBuffer(arraySize);
- wrapSend(name, { buffer : buffer }, [buffer,buffer]);
- assertBufferClosed(name, buffer);
- wrapFailSend(name, [buffer], [buffer]);
- wrapFailSend(name, [], [buffer]);
- var buffer2 = createBuffer(arraySize);
- wrapFailSend(name, [], [buffer2, buffer]);
- checkBuffer(name, buffer2, arraySize);
- wrapFailSend(name, [], [buffer, buffer2]);
- checkBuffer(name, buffer2, arraySize);
- wrapFailSend(name, [buffer2], [buffer2, buffer]);
- checkBuffer(name, buffer2, arraySize);
+ wrapFailSend(name, { buffer : buffer }, [buffer,buffer]);
+ wrapSend(name, { buffer : buffer }, [buffer]);
},
test: function (name, e) {
return checkBuffer(name, e.data.buffer, arraySize);
Modified: trunk/LayoutTests/fast/events/message-port-multi-expected.txt (280475 => 280476)
--- trunk/LayoutTests/fast/events/message-port-multi-expected.txt 2021-07-30 15:25:52 UTC (rev 280475)
+++ trunk/LayoutTests/fast/events/message-port-multi-expected.txt 2021-07-30 15:47:54 UTC (rev 280476)
@@ -7,7 +7,7 @@
PASS channel.port1.postMessage("entangled port", [channel.port2]) threw exception DataCloneError: The object can not be cloned..
PASS channel.port1.postMessage("null port", [channel3.port1, null, channel3.port2]) threw exception TypeError: Type error.
PASS channel.port1.postMessage("notAPort", [channel3.port1, {}, channel3.port2]) threw exception DataCloneError: The object can not be cloned..
-PASS channel.port1.postMessage("duplicate port", [channel3.port1, channel3.port1]) threw exception DataCloneError: The object can not be cloned..
+PASS channel.port1.postMessage("duplicate port", [channel3.port1, channel3.port1]) threw exception DataCloneError: Duplicate transferable for structured clone.
PASS channel.port1.postMessage("notAnArray", "foo") threw exception TypeError: Type error.
PASS channel.port1.postMessage("notASequence", [{length: 3}]) threw exception DataCloneError: The object can not be cloned..
PASS channel.port1.postMessage("largeSequence", largePortArray) threw exception TypeError: Type error.
Modified: trunk/LayoutTests/imported/w3c/ChangeLog (280475 => 280476)
--- trunk/LayoutTests/imported/w3c/ChangeLog 2021-07-30 15:25:52 UTC (rev 280475)
+++ trunk/LayoutTests/imported/w3c/ChangeLog 2021-07-30 15:47:54 UTC (rev 280476)
@@ -1,3 +1,14 @@
+2021-07-30 Chris Dumez <[email protected]>
+
+ postMessage() should throw if any duplicate transferable is found in transferList
+ https://bugs.webkit.org/show_bug.cgi?id=228608
+
+ Reviewed by Youenn Fablet.
+
+ Rebaseline WPT test now that more checks are passing.
+
+ * web-platform-tests/html/infrastructure/safe-passing-of-structured-data/transfer-errors.window-expected.txt:
+
2021-07-28 Sihui Liu <[email protected]>
Implement IDBTransaction.durability
Modified: trunk/LayoutTests/imported/w3c/web-platform-tests/html/infrastructure/safe-passing-of-structured-data/transfer-errors.window-expected.txt (280475 => 280476)
--- trunk/LayoutTests/imported/w3c/web-platform-tests/html/infrastructure/safe-passing-of-structured-data/transfer-errors.window-expected.txt 2021-07-30 15:25:52 UTC (rev 280475)
+++ trunk/LayoutTests/imported/w3c/web-platform-tests/html/infrastructure/safe-passing-of-structured-data/transfer-errors.window-expected.txt 2021-07-30 15:47:54 UTC (rev 280476)
@@ -1,10 +1,10 @@
PASS Cannot transfer all objects
-FAIL Cannot transfer the same ArrayBuffer twice assert_throws_dom: function "() => self.postMessage({ get whatever() { throw new Error("You should not have gotten to this point") } }, "*", transferList)" threw object "Error: You should not have gotten to this point" that is not a DOMException DataCloneError: property "code" is equal to undefined, expected 25
+PASS Cannot transfer the same ArrayBuffer twice
PASS Serialize should make the ArrayBuffer detached, so it cannot be transferred again
FAIL Serialize should throw before a detached ArrayBuffer is found assert_throws_exactly: function "() => self.postMessage({ get whatever() { throw customError } }, "*", [transferable])" threw object "DataCloneError: The object can not be cloned." but we expected it to throw object "Error: hi"
FAIL Cannot transfer ArrayBuffer detached while the message was serialized assert_throws_dom: function "() => self.postMessage(message, "*", [transferable])" threw object "TypeError: Type error" that is not a DOMException DataCloneError: property "code" is equal to undefined, expected 25
-FAIL Cannot transfer the same MessagePort twice assert_throws_dom: function "() => self.postMessage({ get whatever() { throw new Error("You should not have gotten to this point") } }, "*", transferList)" threw object "Error: You should not have gotten to this point" that is not a DOMException DataCloneError: property "code" is equal to undefined, expected 25
+PASS Cannot transfer the same MessagePort twice
PASS Serialize should make the MessagePort detached, so it cannot be transferred again
PASS Serialize should throw before a detached MessagePort is found
PASS Cannot transfer MessagePort detached while the message was serialized
Modified: trunk/Source/WebCore/ChangeLog (280475 => 280476)
--- trunk/Source/WebCore/ChangeLog 2021-07-30 15:25:52 UTC (rev 280475)
+++ trunk/Source/WebCore/ChangeLog 2021-07-30 15:47:54 UTC (rev 280476)
@@ -1,3 +1,18 @@
+2021-07-30 Chris Dumez <[email protected]>
+
+ postMessage() should throw if any duplicate transferable is found in transferList
+ https://bugs.webkit.org/show_bug.cgi?id=228608
+
+ Reviewed by Youenn Fablet.
+
+ postMessage() should throw if any duplicate transferable is found in transferList:
+ - https://html.spec.whatwg.org/multipage/structured-data.html#structuredserializewithtransfer (Step 2.3)
+
+ No new tests, rebaselined existing test.
+
+ * bindings/js/SerializedScriptValue.cpp:
+ (WebCore::SerializedScriptValue::create):
+
2021-07-30 Rob Buis <[email protected]>
[AspectRatio] Fix replaced-element-034.html
Modified: trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp (280475 => 280476)
--- trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp 2021-07-30 15:25:52 UTC (rev 280475)
+++ trunk/Source/WebCore/bindings/js/SerializedScriptValue.cpp 2021-07-30 15:47:54 UTC (rev 280476)
@@ -4162,7 +4162,11 @@
#if ENABLE(WEB_RTC)
Vector<Ref<RTCDataChannel>> dataChannels;
#endif
+ HashSet<JSC::JSObject*> uniqueTransferables;
for (auto& transferable : transferList) {
+ if (!uniqueTransferables.add(transferable.get()).isNewEntry)
+ return Exception { DataCloneError, "Duplicate transferable for structured clone"_s };
+
if (auto arrayBuffer = toPossiblySharedArrayBuffer(vm, transferable.get())) {
if (arrayBuffer->isDetached() || arrayBuffer->isShared())
return Exception { DataCloneError };
