Revert "Revert "ImageData: Fix serialization of detached buffers""

This reverts commit dd424da8.

Reason for revert: The original revert was because this was landed
before its dependencies (a rebase does not trigger a new try job).
This reverts the revert now that the dependencies have been landed.

Change-Id: I7e548abdc127d06ed9c23afc72f7ad3dee50d001
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2608767Reviewed-by: ccameron <ccameron@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: ccameron <ccameron@chromium.org>
Cr-Commit-Position: refs/heads/master@{#840363}

third_party/blink/renderer/bindings/core/v8/serialization/v8_script_value_serializer.cc

@@ -345,10 +345,14 @@ bool V8ScriptValueSerializer::WriteDOMObject(ScriptWrappable* wrappable,
     WriteUint32Enum(ImageSerializationTag::kEndTag);
     WriteUint32(image_data->width());
     WriteUint32(image_data->height());
-    SkPixmap image_data_pixmap = image_data->GetSkPixmap();
-    size_t pixel_buffer_length = image_data_pixmap.computeByteSize();
-    WriteUint64(base::strict_cast<uint64_t>(pixel_buffer_length));
-    WriteRawBytes(image_data_pixmap.addr(), pixel_buffer_length);
+    if (image_data->IsBufferBaseDetached()) {
+      WriteUint64(0u);
+    } else {
+      SkPixmap image_data_pixmap = image_data->GetSkPixmap();
+      size_t pixel_buffer_length = image_data_pixmap.computeByteSize();
+      WriteUint64(base::strict_cast<uint64_t>(pixel_buffer_length));
+      WriteRawBytes(image_data_pixmap.addr(), pixel_buffer_length);
+    }
     return true;
   }
   if (wrapper_type_info == V8DOMPoint::GetWrapperTypeInfo()) {

third_party/blink/renderer/bindings/core/v8/serialization/v8_script_value_serializer_test.cc

@@ -776,6 +776,22 @@ TEST(V8ScriptValueSerializerTest, RoundTripImageData) {
   EXPECT_EQ(100u, new_pm.addr32(1, 0)[0]);
 }
 
+TEST(V8ScriptValueSerializerTest, RoundTripDetachedImageData) {
+  // If an ImageData is detached, it can be serialized, but will fail when being
+  // deserialized.
+  V8TestingScope scope;
+  ImageData* image_data = ImageData::ValidateAndCreate(
+      2, 1, base::nullopt, nullptr, ASSERT_NO_EXCEPTION);
+  SkPixmap pm = image_data->GetSkPixmap();
+  pm.writable_addr32(0, 0)[0] = 200u;
+  image_data->data().GetAsUint8ClampedArray()->BufferBase()->Detach();
+
+  v8::Local<v8::Value> wrapper =
+      ToV8(image_data, scope.GetContext()->Global(), scope.GetIsolate());
+  v8::Local<v8::Value> result = RoundTrip(wrapper, scope);
+  EXPECT_FALSE(V8ImageData::HasInstance(result, scope.GetIsolate()));
+}
+
 TEST(V8ScriptValueSerializerTest, RoundTripImageDataWithColorSpaceInfo) {
   // ImageData objects with color space information should serialize and
   // deserialize correctly.

third_party/blink/renderer/core/html/canvas/image_data.cc

@@ -365,6 +365,7 @@ bool ImageData::IsBufferBaseDetached() const {
 }
 
 SkPixmap ImageData::GetSkPixmap() const {
+  CHECK(!IsBufferBaseDetached());
   SkColorType color_type = kRGBA_8888_SkColorType;
   const void* data = nullptr;
   if (data_.IsUint8ClampedArray()) {