[d8] Fix DCHECK when transferring ArrayBuffer twice

Bug: chromium:883492
Change-Id: I69e76eb51c635d092918a3cb9a8fa94a86f58f2a
Reviewed-on: https://chromium-review.googlesource.com/1226410Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55923}

src/d8.cc

@@ -3200,6 +3200,14 @@ class Serializer : public ValueSerializer::Delegate {
           }
 
           Local<ArrayBuffer> array_buffer = Local<ArrayBuffer>::Cast(element);
+
+          if (std::find(array_buffers_.begin(), array_buffers_.end(),
+                        array_buffer) != array_buffers_.end()) {
+            Throw(isolate_,
+                  "ArrayBuffer occurs in the transfer array more than once");
+            return Nothing<bool>();
+          }
+
           serializer_.TransferArrayBuffer(
               static_cast<uint32_t>(array_buffers_.size()), array_buffer);
           array_buffers_.emplace_back(isolate_, array_buffer);

test/mjsunit/d8/d8-worker.js

@@ -140,6 +140,12 @@ if (this.Worker) {
   w.postMessage(ab2, [ab2]);
   assertEquals(0, ab2.byteLength);  // ArrayBuffer should be neutered.
 
+  // Attempting to transfer the same ArrayBuffer twice should throw.
+  assertThrows(function() {
+    var ab3 = createArrayBuffer(4);
+    w.postMessage(ab3, [ab3, ab3]);
+  });
+
   assertEquals("undefined", typeof foo);
 
   // Read a message from the worker.