Code:     StateBase* writeFileList(v8::Handle<v8::Value> value, StateBase* next)
    {
        FileList* fileList = V8FileList::toNative(value.As<v8::Object>());
        if (!fileList)
            return 0;
        unsigned length = fileList->length();
        Vector<int> blobIndices;
        for (unsigned i = 0; i < length; ++i) {
            int blobIndex = -1;
             const File* file = fileList->item(i);
             if (file->hasBeenClosed())
                 return handleError(DataCloneError, "A File object has been closed, and could therefore not be cloned.", next);
            m_blobDataHandles.add(file->uuid(), file->blobDataHandle());
             if (appendFileInfo(file, &blobIndex)) {
                 ASSERT(!i || blobIndex > 0);
                 ASSERT(blobIndex >= 0);
                blobIndices.append(blobIndex);
            }
        }
        if (!blobIndices.isEmpty())
            m_writer.writeFileListIndex(blobIndices);
        else
            m_writer.writeFileList(*fileList);
        return 0;
    }

Vulnerability Type: DoS 
CWE ID: 
Summary: Use-after-free vulnerability in the V8 bindings in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper use of HashMap add operations instead of HashMap set operations, related to bindings/core/v8/DOMWrapperMap.h and bindings/core/v8/SerializedScriptValue.cpp.
Commit Message: Replace further questionable HashMap::add usages in bindings

BUG=390928
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/411273002

git-svn-id: svn://svn.chromium.org/blink/trunk@178823 bbb929c8-8fbe-4397-9dbb-9b2b20218538