Prevent SharedArrayBuffer views from being used in bindings

third_party/WebKit/Source/bindings/templates/methods.cpp.tmpl

 {% from 'utilities.cpp.tmpl' import declare_enum_validation_variable, v8_value_to_local_cpp_value %}
 
 {##############################################################################}
 {% macro generate_method(method, world_suffix) %}
 static void {{method.name}}{{method.overload_index}}Method{{world_suffix}}(const v8::FunctionCallbackInfo<v8::Value>& info) {
   {% filter format_remove_duplicates([
       'ExceptionState exceptionState',
       'ScriptState* scriptState = ']) %}
   {% set define_exception_state -%}
   ExceptionState exceptionState(info.GetIsolate(), ExceptionState::ExecutionContext, "{{interface_name}}", "{{method.name}}");
@@ skipping 215 matching lines @@
   return;
 }
 {% elif argument.idl_type == 'Promise' %}
 {# We require this for our implementation of promises, though not in spec:
 http://heycam.github.io/webidl/#es-promise #}
 if (!{{argument.name}}.isUndefinedOrNull() && !{{argument.name}}.isObject()) {
   {{throw_argument_error(method, argument, "parameter %(index)d ('%(name)s') is not an object.")}}
   return;
 }
 {% endif %}
+{% if argument.is_array_buffer_view %}
+if ({{argument.name}}{% if argument.is_flexible_array_buffer_view %}.{% else %}->{% endif %}isShared()) {
+    {{throw_type_error(method,
+        '"parameter %s is a view of a SharedArrayBuffer."' %
+            (argument.index + 1)) | indent}}
+    return;
+}
+{% elif argument.is_union_with_array_buffer_view %}
+if ({{argument.name}}.isArrayBufferView() && {{argument.name}}.getAsArrayBufferView()->isShared()) {
+    {{throw_type_error(method,
+        '"parameter %s is a view of a SharedArrayBuffer."' %
+            (argument.index + 1)) | indent}}
+    return;
+}
+{% elif argument.is_sequence_of_union_with_array_buffer_view %}
+for (size_t i= 0; i < {{argument.name}}.size(); ++i) {
+    if ({{argument.name}}[i].isArrayBufferView() && {{argument.name}}[i].getAsArrayBufferView()->isShared()) {
+        {{throw_type_error(method,
+            '"sequence parameter %s contains a view of a SharedArrayBuffer."' %
+                (argument.index + 1)) | indent(8)}}
+        return;
+    }
+}
+{% endif %}
 {% endmacro %}
 
 
 {######################################}
 {% macro cpp_method_call(method, v8_set_return_value, cpp_value) %}
 {% if method.is_custom_call_prologue %}
 {{v8_class}}::{{method.name}}MethodPrologueCustom(info, impl);
 {% endif %}
 {# Local variables #}
 {% if method.is_call_with_execution_context %}
@@ skipping 391 matching lines @@
                           if method.overloads else
                           method.runtime_enabled_feature_name) %}
 const V8DOMConfiguration::MethodConfiguration {{method.name}}MethodConfiguration = {{method_configuration(method)}};
 V8DOMConfiguration::installMethod(isolate, world, v8::Local<v8::Object>(), prototypeObject, interfaceObject, signature, {{method.name}}MethodConfiguration);
 {% endfilter %}{# runtime_enabled() #}
 {% endfilter %}{# exposed() #}
 {% endfilter %}{# secure_context() #}
 {% endfor %}
 {% endif %}
 {%- endmacro %}