feat(ext/web): use ArrayBuffer.was_detached() (#16307)

This PR adds a way to reliably check if an ArrayBuffer was detached

2 files changed, 19 insertions, 21 deletions

diff --git a/ext/web/06_streams.js b/ext/web/06_streams.js
index 52488efb6..6dbf69951 100644
--- a/ext/web/06_streams.js
+++ b/ext/web/06_streams.js
@@ -193,7 +193,13 @@
    * @returns {boolean}
    */
   function isDetachedBuffer(O) {
-    return ReflectHas(O, isFakeDetached);
+    if (O.byteLength !== 0) {
+      return false;
+    }
+    // TODO(marcosc90) remove isFakeDetached once transferArrayBuffer
+    // actually detaches the buffer
+    return ReflectHas(O, isFakeDetached) ||
+      core.ops.op_arraybuffer_was_detached(O);
   }
 
   /**
diff --git a/ext/web/13_message_port.js b/ext/web/13_message_port.js
index 253ed7ecd..7343fbe58 100644
--- a/ext/web/13_message_port.js
+++ b/ext/web/13_message_port.js
@@ -26,9 +26,6 @@
     SymbolFor,
     SymbolIterator,
     TypeError,
-    WeakSet,
-    WeakSetPrototypeAdd,
-    WeakSetPrototypeHas,
   } = window.__bootstrap.primordials;
 
   class MessageChannel {
@@ -239,30 +236,25 @@
     return [data, transferables];
   }
 
-  const detachedArrayBuffers = new WeakSet();
-
   /**
    * @param {any} data
    * @param {object[]} transferables
    * @returns {globalThis.__bootstrap.messagePort.MessageData}
    */
   function serializeJsMessageData(data, transferables) {
-    const transferredArrayBuffers = ArrayPrototypeFilter(
-      transferables,
-      (a) => ObjectPrototypeIsPrototypeOf(ArrayBufferPrototype, a),
-    );
-
-    for (const arrayBuffer of transferredArrayBuffers) {
-      // This is hacky with both false positives and false negatives for
-      // detecting detached array buffers. V8  needs to add a way to tell if a
-      // buffer is detached or not.
-      if (WeakSetPrototypeHas(detachedArrayBuffers, arrayBuffer)) {
-        throw new DOMException(
-          "Can not transfer detached ArrayBuffer",
-          "DataCloneError",
-        );
+    const transferredArrayBuffers = [];
+    for (let i = 0, j = 0; i < transferables.length; i++) {
+      const ab = transferables[i];
+      if (ObjectPrototypeIsPrototypeOf(ArrayBufferPrototype, ab)) {
+        if (ab.byteLength === 0 && core.ops.op_arraybuffer_was_detached(ab)) {
+          throw new DOMException(
+            `ArrayBuffer at index ${j} is already detached`,
+            "DataCloneError",
+          );
+        }
+        j++;
+        transferredArrayBuffers.push(ab);
       }
-      WeakSetPrototypeAdd(detachedArrayBuffers, arrayBuffer);
     }
 
     const serializedData = core.serialize(data, {