Issue #2197 - Part 1b: Transferables should be arrays of objects

Based on https://bugzilla.mozilla.org/show_bug.cgi?id=1336020

24 files changed, 118 insertions, 129 deletions

diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 990e1bc589..2b19630f60 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -9991,3 +9991,33 @@ nsContentUtils::GetClosestNonNativeAnonymousAncestor(Element* aElement)
   }
   return e;
 }
+
+/* static */ nsresult
+nsContentUtils::CreateJSValueFromSequenceOfObject(JSContext* aCx,
+                                                  const Sequence<JSObject*>& aTransfer,
+                                                  JS::MutableHandle<JS::Value> aValue)
+{
+  if (aTransfer.IsEmpty()) {
+    return NS_OK;
+  }
+
+  JS::Rooted<JSObject*> array(aCx, JS_NewArrayObject(aCx, aTransfer.Length()));
+  if (!array) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  for (uint32_t i = 0; i < aTransfer.Length(); ++i) {
+    JS::Rooted<JSObject*> object(aCx, aTransfer[i]);
+    if (!object) {
+      continue;
+    }
+
+    if (NS_WARN_IF(!JS_DefineElement(aCx, array, i, object,
+                                     JSPROP_ENUMERATE))) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+  }
+
+  aValue.setObject(*array);
+  return NS_OK;
+}
diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index a0c602f61a..abacf041df 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -2812,6 +2812,11 @@ public:
   static bool
   IsCustomElementsEnabled() { return sIsCustomElementsEnabled; }
 
+  static nsresult
+  CreateJSValueFromSequenceOfObject(JSContext* aCx,
+                                    const mozilla::dom::Sequence<JSObject*>& aTransfer,
+                                    JS::MutableHandle<JS::Value> aValue);
+
 private:
   static bool InitializeEventTable();
 
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 590ed823d3..ec33d0aef0 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -8880,29 +8880,22 @@ nsGlobalWindow::PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
 }
 
 void
-nsGlobalWindow::PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
+nsGlobalWindow::PostMessageMoz(JSContext* aCx,
+                               JS::Handle<JS::Value> aMessage,
                                const nsAString& aTargetOrigin,
-                               const Sequence<JS::Value>& aTransfer,
+                               const Sequence<JSObject*>& aTransfer,
                                nsIPrincipal& aSubjectPrincipal,
-                               ErrorResult& aError)
+                               ErrorResult& aRv)
 {
   JS::Rooted<JS::Value> transferArray(aCx, JS::UndefinedValue());
-  if (!aTransfer.IsEmpty()) {
-    // The input sequence only comes from the generated bindings code, which
-    // ensures it is rooted.
-    JS::HandleValueArray elements =
-      JS::HandleValueArray::fromMarkedLocation(aTransfer.Length(),
-                                               aTransfer.Elements());
-
-    transferArray = JS::ObjectOrNullValue(JS_NewArrayObject(aCx, elements));
-    if (transferArray.isNull()) {
-      aError.Throw(NS_ERROR_OUT_OF_MEMORY);
-      return;
-    }
+  aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx, aTransfer,
+                                                          &transferArray);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return;
   }
 
   PostMessageMoz(aCx, aMessage, aTargetOrigin, transferArray,
-                 aSubjectPrincipal, aError);
+                 aSubjectPrincipal, aRv);
 }
 
 class nsCloseEvent : public Runnable {
diff --git a/dom/base/nsGlobalWindow.h b/dom/base/nsGlobalWindow.h
index f4829ccac8..8c961e2014 100644
--- a/dom/base/nsGlobalWindow.h
+++ b/dom/base/nsGlobalWindow.h
@@ -933,9 +933,9 @@ public:
   void Print(mozilla::ErrorResult& aError);
   void PostMessageMoz(JSContext* aCx, JS::Handle<JS::Value> aMessage,
                       const nsAString& aTargetOrigin,
-                      const mozilla::dom::Sequence<JS::Value>& aTransfer,
+                      const mozilla::dom::Sequence<JSObject*>& aTransfer,
                       nsIPrincipal& aSubjectPrincipal,
-                      mozilla::ErrorResult& aError);
+                      mozilla::ErrorResult& aRv);
   int32_t SetTimeout(JSContext* aCx, mozilla::dom::Function& aFunction,
                      int32_t aTimeout,
                      const mozilla::dom::Sequence<JS::Value>& aArguments,
diff --git a/dom/messagechannel/MessagePort.cpp b/dom/messagechannel/MessagePort.cpp
index 515a0f3ef1..a63c84b2b0 100644
--- a/dom/messagechannel/MessagePort.cpp
+++ b/dom/messagechannel/MessagePort.cpp
@@ -396,49 +396,37 @@ MessagePort::WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto)
 void
 MessagePort::PostMessage(JSContext* aCx,
                          JS::Handle<JS::Value> aMessage,
-                         const Sequence<JS::Value>& aTransferable,
+                         const Sequence<JSObject*>& aTransferable,
                          ErrorResult& aRv)
 {
   // We *must* clone the data here, or the JS::Value could be modified
   // by script
 
-  JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
-  if (!aTransferable.IsEmpty()) {
-    // Here we want to check if the transerable object list contains
-    // this port. No other checks are done.
-    for (const JS::Value& value : aTransferable) {
-      if (!value.isObject()) {
-        continue;
-      }
-
-      JS::Rooted<JSObject*> object(aCx, &value.toObject());
-
-      MessagePort* port = nullptr;
-      nsresult rv = UNWRAP_OBJECT(MessagePort, &object, port);
-      if (NS_FAILED(rv)) {
-        continue;
-      }
-
-      if (port == this) {
-        aRv.Throw(NS_ERROR_DOM_DATA_CLONE_ERR);
-        return;
-      }
+  // Here we want to check if the transferable object list contains
+  // this port.
+  for (uint32_t i = 0; i < aTransferable.Length(); ++i) {
+    JSObject* rawObject = aTransferable[i];
+    if (!rawObject) {
+      continue;
     }
 
-    // The input sequence only comes from the generated bindings code, which
-    // ensures it is rooted.
-    JS::HandleValueArray elements =
-      JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
-                                               aTransferable.Elements());
+    JS::Rooted<JSObject*> object(aCx, rawObject);
 
-    JSObject* array =
-      JS_NewArrayObject(aCx, elements);
-    if (!array) {
-      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    MessagePort* port = nullptr;
+    nsresult rv = UNWRAP_OBJECT(MessagePort, &object, port);
+    if (NS_SUCCEEDED(rv) && port == this) {
+      aRv.Throw(NS_ERROR_DOM_DATA_CLONE_ERR);
       return;
     }
+  }
+
+  JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
 
-    transferable.setObject(*array);
+  aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx,
+                                                          aTransferable,
+                                                          &transferable);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return;
   }
 
   RefPtr<SharedMessagePortMessage> data = new SharedMessagePortMessage();
diff --git a/dom/messagechannel/MessagePort.h b/dom/messagechannel/MessagePort.h
index 2c012925a4..e635c532a3 100644
--- a/dom/messagechannel/MessagePort.h
+++ b/dom/messagechannel/MessagePort.h
@@ -62,7 +62,7 @@ public:
 
   void
   PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-              const Sequence<JS::Value>& aTransferable,
+              const Sequence<JSObject*>& aTransferable,
               ErrorResult& aRv);
 
   void Start();
diff --git a/dom/webidl/Client.webidl b/dom/webidl/Client.webidl
index df73a79d79..7abb65ab12 100644
--- a/dom/webidl/Client.webidl
+++ b/dom/webidl/Client.webidl
@@ -15,7 +15,7 @@ interface Client {
   readonly attribute DOMString id;
 
   [Throws]
-  void postMessage(any message, optional sequence<Transferable> transfer = []);
+  void postMessage(any message, optional sequence<object> transfer = []);
 };
 
 [Exposed=ServiceWorker]
diff --git a/dom/webidl/DedicatedWorkerGlobalScope.webidl b/dom/webidl/DedicatedWorkerGlobalScope.webidl
index 75a4032676..ad3125fa31 100644
--- a/dom/webidl/DedicatedWorkerGlobalScope.webidl
+++ b/dom/webidl/DedicatedWorkerGlobalScope.webidl
@@ -16,7 +16,7 @@
  Exposed=DedicatedWorker]
 interface DedicatedWorkerGlobalScope : WorkerGlobalScope {
   [Throws]
-  void postMessage(any message, optional sequence<any> transfer = []);
+  void postMessage(any message, optional sequence<object> transfer = []);
 
   attribute EventHandler onmessage;
 };
diff --git a/dom/webidl/MessagePort.webidl b/dom/webidl/MessagePort.webidl
index aef7e4bd11..6495b5616d 100644
--- a/dom/webidl/MessagePort.webidl
+++ b/dom/webidl/MessagePort.webidl
@@ -10,7 +10,7 @@
 [Exposed=(Window,Worker,System)]
 interface MessagePort : EventTarget {
   [Throws]
-  void postMessage(any message, optional sequence<Transferable> transferable = []);
+  void postMessage(any message, optional sequence<object> transferable = []);
 
   void start();
   void close();
diff --git a/dom/webidl/ServiceWorker.webidl b/dom/webidl/ServiceWorker.webidl
index 17fc903dcb..6dab46a16b 100644
--- a/dom/webidl/ServiceWorker.webidl
+++ b/dom/webidl/ServiceWorker.webidl
@@ -19,9 +19,8 @@ interface ServiceWorker : EventTarget {
 
   attribute EventHandler onstatechange;
 
-  // FIXME(catalinb): Should inherit this from Worker.
   [Throws]
-  void postMessage(any message, optional sequence<Transferable> transferable = []);
+  void postMessage(any message, optional sequence<object> transferable = []);
 };
 
 ServiceWorker implements AbstractWorker;
diff --git a/dom/webidl/Window.webidl b/dom/webidl/Window.webidl
index 199a846bd1..73d5843a16 100644
--- a/dom/webidl/Window.webidl
+++ b/dom/webidl/Window.webidl
@@ -22,7 +22,6 @@ interface IID;
 interface nsIBrowserDOMWindow;
 interface nsIMessageBroadcaster;
 interface nsIDOMCrypto;
-typedef any Transferable;
 
 // http://www.whatwg.org/specs/web-apps/current-work/
 [PrimaryGlobal, LegacyUnenumerableNamedProperties, NeedResolve]
@@ -80,7 +79,7 @@ typedef any Transferable;
   [Throws, UnsafeInPrerendering] void print();
 
   [Throws, CrossOriginCallable, NeedsSubjectPrincipal]
-  void postMessage(any message, DOMString targetOrigin, optional sequence<Transferable> transfer = []);
+  void postMessage(any message, DOMString targetOrigin, optional sequence<object> transfer = []);
 
   // also has obsolete members
 };
diff --git a/dom/webidl/Worker.webidl b/dom/webidl/Worker.webidl
index 4bc79e9e15..44f406d8ce 100644
--- a/dom/webidl/Worker.webidl
+++ b/dom/webidl/Worker.webidl
@@ -19,7 +19,7 @@ interface Worker : EventTarget {
   void terminate();
 
   [Throws]
-  void postMessage(any message, optional sequence<any> transfer = []);
+  void postMessage(any message, optional sequence<object> transfer = []);
 
   attribute EventHandler onmessage;
 };
diff --git a/dom/workers/ServiceWorker.cpp b/dom/workers/ServiceWorker.cpp
index 257c2ba007..87b86c4805 100644
--- a/dom/workers/ServiceWorker.cpp
+++ b/dom/workers/ServiceWorker.cpp
@@ -77,7 +77,7 @@ ServiceWorker::GetScriptURL(nsString& aURL) const
 
 void
 ServiceWorker::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-                           const Sequence<JS::Value>& aTransferable,
+                           const Sequence<JSObject*>& aTransferable,
                            ErrorResult& aRv)
 {
   if (State() == ServiceWorkerState::Redundant) {
diff --git a/dom/workers/ServiceWorker.h b/dom/workers/ServiceWorker.h
index ac3c2abe1d..d85d055aab 100644
--- a/dom/workers/ServiceWorker.h
+++ b/dom/workers/ServiceWorker.h
@@ -63,7 +63,7 @@ public:
 
   void
   PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-              const Sequence<JS::Value>& aTransferable,
+              const Sequence<JSObject*>& aTransferable,
               ErrorResult& aRv);
 
 private:
diff --git a/dom/workers/ServiceWorkerClient.cpp b/dom/workers/ServiceWorkerClient.cpp
index 9b9e43b2b6..eb4e676ffa 100644
--- a/dom/workers/ServiceWorkerClient.cpp
+++ b/dom/workers/ServiceWorkerClient.cpp
@@ -190,7 +190,7 @@ private:
 
 void
 ServiceWorkerClient::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-                                 const Sequence<JS::Value>& aTransferable,
+                                 const Sequence<JSObject*>& aTransferable,
                                  ErrorResult& aRv)
 {
   WorkerPrivate* workerPrivate = GetCurrentThreadWorkerPrivate();
@@ -198,18 +198,11 @@ ServiceWorkerClient::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
   workerPrivate->AssertIsOnWorkerThread();
 
   JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
-  if (!aTransferable.IsEmpty()) {
-    JS::HandleValueArray elements =
-      JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
-                                               aTransferable.Elements());
-
-    JSObject* array = JS_NewArrayObject(aCx, elements);
-    if (!array) {
-      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
-      return;
-    }
-
-    transferable.setObject(*array);
+  aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx,
+                                                          aTransferable,
+                                                          &transferable);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return;
   }
 
   RefPtr<ServiceWorkerClientPostMessageRunnable> runnable =
diff --git a/dom/workers/ServiceWorkerClient.h b/dom/workers/ServiceWorkerClient.h
index bbf7ddf489..4d8759c408 100644
--- a/dom/workers/ServiceWorkerClient.h
+++ b/dom/workers/ServiceWorkerClient.h
@@ -91,7 +91,7 @@ public:
 
   void
   PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-              const Sequence<JS::Value>& aTransferable,
+              const Sequence<JSObject*>& aTransferable,
               ErrorResult& aRv);
 
   JSObject* WrapObject(JSContext* aCx, JS::Handle<JSObject*> aGivenProto) override;
diff --git a/dom/workers/ServiceWorkerPrivate.cpp b/dom/workers/ServiceWorkerPrivate.cpp
index acb666415d..fe6ec138b7 100644
--- a/dom/workers/ServiceWorkerPrivate.cpp
+++ b/dom/workers/ServiceWorkerPrivate.cpp
@@ -141,7 +141,7 @@ NS_IMPL_ISUPPORTS0(MessageWaitUntilHandler)
 nsresult
 ServiceWorkerPrivate::SendMessageEvent(JSContext* aCx,
                                        JS::Handle<JS::Value> aMessage,
-                                       const Sequence<JS::Value>& aTransferable,
+                                       const Sequence<JSObject*>& aTransferable,
                                        UniquePtr<ServiceWorkerClientInfo>&& aClientInfo)
 {
   ErrorResult rv(SpawnWorkerIfNeeded(MessageEvent, nullptr));
diff --git a/dom/workers/ServiceWorkerPrivate.h b/dom/workers/ServiceWorkerPrivate.h
index bd55749277..c2d5abfd6c 100644
--- a/dom/workers/ServiceWorkerPrivate.h
+++ b/dom/workers/ServiceWorkerPrivate.h
@@ -74,7 +74,7 @@ public:
 
   nsresult
   SendMessageEvent(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-                   const Sequence<JS::Value>& aTransferable,
+                   const Sequence<JSObject*>& aTransferable,
                    UniquePtr<ServiceWorkerClientInfo>&& aClientInfo);
 
   // This is used to validate the worker script and continue the installation
diff --git a/dom/workers/SharedWorker.cpp b/dom/workers/SharedWorker.cpp
index 7ef96c281e..03c45c96a1 100644
--- a/dom/workers/SharedWorker.cpp
+++ b/dom/workers/SharedWorker.cpp
@@ -142,7 +142,7 @@ SharedWorker::Close()
 
 void
 SharedWorker::PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-                          const Sequence<JS::Value>& aTransferable,
+                          const Sequence<JSObject*>& aTransferable,
                           ErrorResult& aRv)
 {
   AssertIsOnMainThread();
diff --git a/dom/workers/SharedWorker.h b/dom/workers/SharedWorker.h
index 2b4862f9db..6b328811d5 100644
--- a/dom/workers/SharedWorker.h
+++ b/dom/workers/SharedWorker.h
@@ -94,8 +94,9 @@ private:
 
   // Only called by MessagePort.
   void
-  PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-              const Sequence<JS::Value>& aTransferable,
+  PostMessage(JSContext* aCx,
+              JS::Handle<JS::Value> aMessage,
+              const Sequence<JSObject*>& aTransferable,
               ErrorResult& aRv);
 };
 
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 6a95544704..2c3d439bd8 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -3006,13 +3006,12 @@ WorkerPrivateParent<Derived>::ForgetMainThreadObjects(
 
 template <class Derived>
 void
-WorkerPrivateParent<Derived>::PostMessageInternal(
-                                            JSContext* aCx,
-                                            JS::Handle<JS::Value> aMessage,
-                                            const Sequence<JS::Value>& aTransferable,
-                                            UniquePtr<ServiceWorkerClientInfo>&& aClientInfo,
-                                            PromiseNativeHandler* aHandler,
-                                            ErrorResult& aRv)
+WorkerPrivateParent<Derived>::PostMessageInternal(JSContext* aCx,
+                                                  JS::Handle<JS::Value> aMessage,
+                                                  const Sequence<JSObject*>& aTransferable,
+                                                  UniquePtr<ServiceWorkerClientInfo>&& aClientInfo,
+                                                  PromiseNativeHandler* aHandler,
+                                                  ErrorResult& aRv)
 {
   AssertIsOnParentThread();
 
@@ -3024,20 +3023,11 @@ WorkerPrivateParent<Derived>::PostMessageInternal(
   }
 
   JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
-  if (!aTransferable.IsEmpty()) {
-    // The input sequence only comes from the generated bindings code, which
-    // ensures it is rooted.
-    JS::HandleValueArray elements =
-      JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
-                                               aTransferable.Elements());
-
-    JSObject* array =
-      JS_NewArrayObject(aCx, elements);
-    if (!array) {
-      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
-      return;
-    }
-    transferable.setObject(*array);
+  aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx,
+                                                          aTransferable,
+                                                          &transferable);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return;
   }
 
   RefPtr<MessageEventRunnable> runnable =
@@ -3083,7 +3073,7 @@ void
 WorkerPrivateParent<Derived>::PostMessage(
                              JSContext* aCx,
                              JS::Handle<JS::Value> aMessage,
-                             const Sequence<JS::Value>& aTransferable,
+                             const Sequence<JSObject*>& aTransferable,
                              ErrorResult& aRv)
 {
   PostMessageInternal(aCx, aMessage, aTransferable, nullptr, nullptr, aRv);
@@ -3094,7 +3084,7 @@ void
 WorkerPrivateParent<Derived>::PostMessageToServiceWorker(
                              JSContext* aCx,
                              JS::Handle<JS::Value> aMessage,
-                             const Sequence<JS::Value>& aTransferable,
+                             const Sequence<JSObject*>& aTransferable,
                              UniquePtr<ServiceWorkerClientInfo>&& aClientInfo,
                              PromiseNativeHandler* aHandler,
                              ErrorResult& aRv)
@@ -5677,25 +5667,17 @@ void
 WorkerPrivate::PostMessageToParentInternal(
                             JSContext* aCx,
                             JS::Handle<JS::Value> aMessage,
-                            const Sequence<JS::Value>& aTransferable,
+                            const Sequence<JSObject*>& aTransferable,
                             ErrorResult& aRv)
 {
   AssertIsOnWorkerThread();
 
   JS::Rooted<JS::Value> transferable(aCx, JS::UndefinedValue());
-  if (!aTransferable.IsEmpty()) {
-    // The input sequence only comes from the generated bindings code, which
-    // ensures it is rooted.
-    JS::HandleValueArray elements =
-      JS::HandleValueArray::fromMarkedLocation(aTransferable.Length(),
-                                               aTransferable.Elements());
-
-    JSObject* array = JS_NewArrayObject(aCx, elements);
-    if (!array) {
-      aRv = NS_ERROR_OUT_OF_MEMORY;
-      return;
-    }
-    transferable.setObject(*array);
+  aRv = nsContentUtils::CreateJSValueFromSequenceOfObject(aCx,
+                                                          aTransferable,
+                                                          &transferable);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return;
   }
 
   RefPtr<MessageEventRunnable> runnable =
diff --git a/dom/workers/WorkerPrivate.h b/dom/workers/WorkerPrivate.h
index dd0f990ba8..cf1a3c22fc 100644
--- a/dom/workers/WorkerPrivate.h
+++ b/dom/workers/WorkerPrivate.h
@@ -287,7 +287,7 @@ private:
 
   void
   PostMessageInternal(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-                      const Sequence<JS::Value>& aTransferable,
+                      const Sequence<JSObject*>& aTransferable,
                       UniquePtr<ServiceWorkerClientInfo>&& aClientInfo,
                       PromiseNativeHandler* aHandler,
                       ErrorResult& aRv);
@@ -400,12 +400,12 @@ public:
 
   void
   PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-              const Sequence<JS::Value>& aTransferable,
+              const Sequence<JSObject*>& aTransferable,
               ErrorResult& aRv);
 
   void
   PostMessageToServiceWorker(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-                             const Sequence<JS::Value>& aTransferable,
+                             const Sequence<JSObject*>& aTransferable,
                              UniquePtr<ServiceWorkerClientInfo>&& aClientInfo,
                              PromiseNativeHandler* aHandler,
                              ErrorResult& aRv);
@@ -1161,18 +1161,17 @@ public:
   void
   PostMessageToParent(JSContext* aCx,
                       JS::Handle<JS::Value> aMessage,
-                      const Sequence<JS::Value>& aTransferable,
+                      const Sequence<JSObject*>& aTransferable,
                       ErrorResult& aRv)
   {
     PostMessageToParentInternal(aCx, aMessage, aTransferable, aRv);
   }
 
   void
-  PostMessageToParentMessagePort(
-                             JSContext* aCx,
-                             JS::Handle<JS::Value> aMessage,
-                             const Sequence<JS::Value>& aTransferable,
-                             ErrorResult& aRv);
+  PostMessageToParentMessagePort(JSContext* aCx,
+                                 JS::Handle<JS::Value> aMessage,
+                                 const Sequence<JSObject*>& aTransferable,
+                                 ErrorResult& aRv);
 
   void
   EnterDebuggerEventLoop();
@@ -1471,7 +1470,7 @@ private:
   void
   PostMessageToParentInternal(JSContext* aCx,
                               JS::Handle<JS::Value> aMessage,
-                              const Sequence<JS::Value>& aTransferable,
+                              const Sequence<JSObject*>& aTransferable,
                               ErrorResult& aRv);
 
   void
diff --git a/dom/workers/WorkerScope.cpp b/dom/workers/WorkerScope.cpp
index 3b9215a8e9..5469b876c7 100644
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -535,7 +535,7 @@ DedicatedWorkerGlobalScope::WrapGlobalObject(JSContext* aCx,
 void
 DedicatedWorkerGlobalScope::PostMessage(JSContext* aCx,
                                         JS::Handle<JS::Value> aMessage,
-                                        const Sequence<JS::Value>& aTransferable,
+                                        const Sequence<JSObject*>& aTransferable,
                                         ErrorResult& aRv)
 {
   mWorkerPrivate->AssertIsOnWorkerThread();
diff --git a/dom/workers/WorkerScope.h b/dom/workers/WorkerScope.h
index a8062298e9..8c41d5d279 100644
--- a/dom/workers/WorkerScope.h
+++ b/dom/workers/WorkerScope.h
@@ -215,7 +215,7 @@ public:
 
   void
   PostMessage(JSContext* aCx, JS::Handle<JS::Value> aMessage,
-              const Sequence<JS::Value>& aTransferable,
+              const Sequence<JSObject*>& aTransferable,
               ErrorResult& aRv);
 
   IMPL_EVENT_HANDLER(message)