stream: reject duplicate nested transferables

Signed-off-by: Daeyeon Jeong <daeyeon.dev@gmail.com>
PR-URL: #62831
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: Mattias Buelens <mattias@buelens.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

Author: daeyeon

src/node_messaging.cc

@@ -415,10 +415,15 @@ class SerializerDelegate : public ValueSerializer::Delegate {
       if (!host_objects_[i]->NestedTransferables().To(&nested_transferables))
         return Nothing<bool>();
       for (auto& nested_transferable : nested_transferables) {
-        if (std::ranges::find(host_objects_, nested_transferable) ==
+        if (std::ranges::find(host_objects_, nested_transferable) !=
             host_objects_.end()) {
-          AddHostObject(nested_transferable);
+          ThrowDataCloneException(
+              context_,
+              FIXED_ONE_BYTE_STRING(env_->isolate(),
+                                    "The transfer list is invalid."));
+          return Nothing<bool>();
         }
+        AddHostObject(nested_transferable);
       }
     }
     return Just(true);

test/parallel/test-whatwg-webstreams-transform-stream-members.js

@@ -0,0 +1,19 @@
+'use strict';
+
+require('../common');
+const assert = require('node:assert');
+
+const combinations = [
+  ((t) => [t, t.readable])(new TransformStream()),
+  ((t) => [t.readable, t])(new TransformStream()),
+  ((t) => [t, t.writable])(new TransformStream()),
+  ((t) => [t.writable, t])(new TransformStream()),
+];
+
+for (const combination of combinations) {
+  assert.throws(() => structuredClone(combination, { transfer: combination }), {
+    constructor: DOMException,
+    name: 'DataCloneError',
+    code: 25,
+  });
+}

test/wpt/status/streams.json

@@ -41,14 +41,6 @@
   "transferable/transfer-with-messageport.window.js": {
     "skip": "Browser-specific test"
   },
-  "transferable/transform-stream-members.any.js": {
-    "fail": {
-      "expected": [
-        "Transferring [object TransformStream],[object ReadableStream] should fail",
-        "Transferring [object TransformStream],[object WritableStream] should fail"
-      ]
-    }
-  },
   "transform-streams/invalid-realm.tentative.window.js": {
     "skip": "Browser-specific test"
   }