diff --git a/third_party/blink/renderer/bindings/core/v8/native_value_traits_buffer_sources.cc b/third_party/blink/renderer/bindings/core/v8/native_value_traits_buffer_sources.cc index b8bc3865f0eb43..4a4d5687b989a0 100644 --- a/third_party/blink/renderer/bindings/core/v8/native_value_traits_buffer_sources.cc +++ b/third_party/blink/renderer/bindings/core/v8/native_value_traits_buffer_sources.cc @@ -350,6 +350,13 @@ DOMViewType* ToDOMViewType(v8::Isolate* isolate, v8::Local value) { v8::Local v8_view = value.As(); if (auto* blink_view = ToScriptWrappable(isolate, v8_view)) { + if constexpr (!allow_shared) { + // The cached Blink wrapper may have been created via an [AllowShared] + // path; re-check sharedness so the NotShared recipe still rejects it. + if (blink_view->IsShared()) [[unlikely]] { + return nullptr; + } + } return blink_view; } @@ -385,6 +392,13 @@ DOMArrayBufferView* ToDOMArrayBufferView(v8::Isolate* isolate, v8::Local v8_view = value.As(); if (auto* blink_view = ToScriptWrappable(isolate, v8_view)) { + if constexpr (!allow_shared) { + // The cached Blink wrapper may have been created via an [AllowShared] + // path; re-check sharedness so the NotShared recipe still rejects it. + if (blink_view->IsShared()) [[unlikely]] { + return nullptr; + } + } return blink_view; }