[d8] Fix PrepareTransfer call w/ non-ArrayBuffer

Make sure to fail PrepareTransfer when the transferables array contains
a non-ArrayBuffer, otherwise the function leaks a scheduled_exception.

Bug: chromium:736565
Change-Id: I64c2e09eb92720519c7bda2dca41749ff5ac9c8d
Reviewed-on: https://chromium-review.googlesource.com/599357
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47141}

src/d8.cc

@@ -2942,7 +2942,7 @@ class Serializer : public ValueSerializer::Delegate {
         if (transfer_array->Get(context, i).ToLocal(&element)) {
           if (!element->IsArrayBuffer()) {
             Throw(isolate_, "Transfer array elements must be an ArrayBuffer");
-            break;
+            return Nothing<bool>();
           }
 
           Local<ArrayBuffer> array_buffer = Local<ArrayBuffer>::Cast(element);

test/mjsunit/d8-worker.js

@@ -121,6 +121,15 @@ if (this.Worker) {
     w.postMessage([], transferList);
   });
 
+  // Test console.log in transfer list.
+  (function() {
+    var val = [undefined];
+    Object.defineProperty(val, '0', {get: () => console.log()});
+    assertThrows(function() {
+      w.postMessage(val, [val]);
+    });
+  })();
+
   // Clone ArrayBuffer
   var ab1 = createArrayBuffer(16);
   w.postMessage(ab1);