[SharedArrayBuffer] Prevent SharedArrayBuffer being used in Web APIs

third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/webgl/WebGL2RenderingContextBase.h"
 
 #include "bindings/modules/v8/WebGLAny.h"
 #include "core/frame/ImageBitmap.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLImageElement.h"
@@ skipping 2858 matching lines @@
     return;
   contextGL()->UniformMatrix4fv(
       location->location(),
       (srcLength ? srcLength : (v.size() - srcOffset)) >> 4, transpose,
       v.data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix2x3fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* value,
+    const MaybeShared<DOMFloat32Array>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix2x3fv", location,
                                        transpose, value, 6, srcOffset,
                                        srcLength))
     return;
   contextGL()->UniformMatrix2x3fv(
       location->location(),
-      (srcLength ? srcLength : (value->length() - srcOffset)) / 6, transpose,
-      value->data() + srcOffset);
+      (srcLength ? srcLength : (value.viewNotShared()->length() - srcOffset)) /
+          6,
+      transpose, value.viewNotShared()->data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix2x3fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix2x3fv", location,
                                        transpose, value.data(), value.size(), 6,
                                        srcOffset, srcLength))
     return;
   contextGL()->UniformMatrix2x3fv(
       location->location(),
       (srcLength ? srcLength : (value.size() - srcOffset)) / 6, transpose,
       value.data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix3x2fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* value,
+    const MaybeShared<DOMFloat32Array>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix3x2fv", location,
                                        transpose, value, 6, srcOffset,
                                        srcLength))
     return;
   contextGL()->UniformMatrix3x2fv(
       location->location(),
-      (srcLength ? srcLength : (value->length() - srcOffset)) / 6, transpose,
-      value->data() + srcOffset);
+      (srcLength ? srcLength : (value.viewNotShared()->length() - srcOffset)) /
+          6,
+      transpose, value.viewNotShared()->data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix3x2fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix3x2fv", location,
                                        transpose, value.data(), value.size(), 6,
                                        srcOffset, srcLength))
     return;
   contextGL()->UniformMatrix3x2fv(
       location->location(),
       (srcLength ? srcLength : (value.size() - srcOffset)) / 6, transpose,
       value.data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix2x4fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* value,
+    const MaybeShared<DOMFloat32Array>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix2x4fv", location,
                                        transpose, value, 8, srcOffset,
                                        srcLength))
     return;
   contextGL()->UniformMatrix2x4fv(
       location->location(),
-      (srcLength ? srcLength : (value->length() - srcOffset)) >> 3, transpose,
-      value->data() + srcOffset);
+      (srcLength ? srcLength : (value.viewNotShared()->length() - srcOffset)) >>
+          3,
+      transpose, value.viewNotShared()->data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix2x4fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix2x4fv", location,
                                        transpose, value.data(), value.size(), 8,
                                        srcOffset, srcLength))
     return;
   contextGL()->UniformMatrix2x4fv(
       location->location(),
       (srcLength ? srcLength : (value.size() - srcOffset)) >> 3, transpose,
       value.data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix4x2fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* value,
+    const MaybeShared<DOMFloat32Array>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix4x2fv", location,
                                        transpose, value, 8, srcOffset,
                                        srcLength))
     return;
   contextGL()->UniformMatrix4x2fv(
       location->location(),
-      (srcLength ? srcLength : (value->length() - srcOffset)) >> 3, transpose,
-      value->data() + srcOffset);
+      (srcLength ? srcLength : (value.viewNotShared()->length() - srcOffset)) >>
+          3,
+      transpose, value.viewNotShared()->data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix4x2fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix4x2fv", location,
                                        transpose, value.data(), value.size(), 8,
                                        srcOffset, srcLength))
     return;
   contextGL()->UniformMatrix4x2fv(
       location->location(),
       (srcLength ? srcLength : (value.size() - srcOffset)) >> 3, transpose,
       value.data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix3x4fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* value,
+    const MaybeShared<DOMFloat32Array>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix3x4fv", location,
                                        transpose, value, 12, srcOffset,
                                        srcLength))
     return;
   contextGL()->UniformMatrix3x4fv(
       location->location(),
-      (srcLength ? srcLength : (value->length() - srcOffset)) / 12, transpose,
-      value->data() + srcOffset);
+      (srcLength ? srcLength : (value.viewNotShared()->length() - srcOffset)) /
+          12,
+      transpose, value.viewNotShared()->data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix3x4fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix3x4fv", location,
                                        transpose, value.data(), value.size(),
                                        12, srcOffset, srcLength))
     return;
   contextGL()->UniformMatrix3x4fv(
       location->location(),
       (srcLength ? srcLength : (value.size() - srcOffset)) / 12, transpose,
       value.data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix4x3fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* value,
+    const MaybeShared<DOMFloat32Array>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix4x3fv", location,
                                        transpose, value, 12, srcOffset,
                                        srcLength))
     return;
   contextGL()->UniformMatrix4x3fv(
       location->location(),
-      (srcLength ? srcLength : (value->length() - srcOffset)) / 12, transpose,
-      value->data() + srcOffset);
+      (srcLength ? srcLength : (value.viewNotShared()->length() - srcOffset)) /
+          12,
+      transpose, value.viewNotShared()->data() + srcOffset);
 }
 
 void WebGL2RenderingContextBase::uniformMatrix4x3fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& value,
     GLuint srcOffset,
     GLuint srcLength) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix4x3fv", location,
@@ skipping 148 matching lines @@
                                                  GLint x,
                                                  GLint y,
                                                  GLint z,
                                                  GLint w) {
   if (isContextLost())
     return;
   contextGL()->VertexAttribI4i(index, x, y, z, w);
   setVertexAttribType(index, Int32ArrayType);
 }
 
-void WebGL2RenderingContextBase::vertexAttribI4iv(GLuint index,
-                                                  const DOMInt32Array* v) {
-  if (isContextLost())
+void WebGL2RenderingContextBase::vertexAttribI4iv(
+    GLuint index,
+    const MaybeShared<const DOMInt32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttribI4iv", v))
     return;
-  if (!v || v->length() < 4) {
+  if (!v || v.viewNotShared()->length() < 4) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttribI4iv", "invalid array");
     return;
   }
-  contextGL()->VertexAttribI4iv(index, v->data());
+  contextGL()->VertexAttribI4iv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Int32ArrayType);
 }
 
 void WebGL2RenderingContextBase::vertexAttribI4iv(GLuint index,
                                                   const Vector<GLint>& v) {
   if (isContextLost())
     return;
   if (v.size() < 4) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttribI4iv", "invalid array");
     return;
   }
   contextGL()->VertexAttribI4iv(index, v.data());
   setVertexAttribType(index, Int32ArrayType);
 }
 
 void WebGL2RenderingContextBase::vertexAttribI4ui(GLuint index,
                                                   GLuint x,
                                                   GLuint y,
                                                   GLuint z,
                                                   GLuint w) {
   if (isContextLost())
     return;
   contextGL()->VertexAttribI4ui(index, x, y, z, w);
   setVertexAttribType(index, Uint32ArrayType);
 }
 
-void WebGL2RenderingContextBase::vertexAttribI4uiv(GLuint index,
-                                                   const DOMUint32Array* v) {
-  if (isContextLost())
+void WebGL2RenderingContextBase::vertexAttribI4uiv(
+    GLuint index,
+    const MaybeShared<const DOMUint32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttribI4uiv", v))
     return;
-  if (!v || v->length() < 4) {
+  if (!v || v.viewNotShared()->length() < 4) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttribI4uiv", "invalid array");
     return;
   }
-  contextGL()->VertexAttribI4uiv(index, v->data());
+  contextGL()->VertexAttribI4uiv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Uint32ArrayType);
 }
 
 void WebGL2RenderingContextBase::vertexAttribI4uiv(GLuint index,
                                                    const Vector<GLuint>& v) {
   if (isContextLost())
     return;
   if (v.size() < 4) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttribI4uiv", "invalid array");
     return;
@@ skipping 192 matching lines @@
 
 WebGLTexture* WebGL2RenderingContextBase::validateTexImageBinding(
     const char* funcName,
     TexImageFunctionID functionID,
     GLenum target) {
   if (functionID == TexImage3D || functionID == TexSubImage3D)
     return validateTexture3DBinding(funcName, target);
   return validateTexture2DBinding(funcName, target);
 }
 
-void WebGL2RenderingContextBase::clearBufferiv(GLenum buffer,
-                                               GLint drawbuffer,
-                                               DOMInt32Array* value) {
+void WebGL2RenderingContextBase::clearBufferiv(
+    GLenum buffer,
+    GLint drawbuffer,
+    const MaybeShared<DOMInt32Array>& value) {
   if (isContextLost() ||
-      !validateClearBuffer("clearBufferiv", buffer, value->length()))
+      !validateNotSharedArrayBuffer("clearBufferiv", value) ||
+      !validateClearBuffer("clearBufferiv", buffer,
+                           value.viewNotShared()->length()))
     return;
 
-  contextGL()->ClearBufferiv(buffer, drawbuffer, value->data());
+  contextGL()->ClearBufferiv(buffer, drawbuffer, value.viewNotShared()->data());
 }
 
 void WebGL2RenderingContextBase::clearBufferiv(GLenum buffer,
                                                GLint drawbuffer,
                                                const Vector<GLint>& value) {
   if (isContextLost() ||
       !validateClearBuffer("clearBufferiv", buffer, value.size()))
     return;
 
   contextGL()->ClearBufferiv(buffer, drawbuffer, value.data());
 }
 
-void WebGL2RenderingContextBase::clearBufferuiv(GLenum buffer,
-                                                GLint drawbuffer,
-                                                DOMUint32Array* value) {
+void WebGL2RenderingContextBase::clearBufferuiv(
+    GLenum buffer,
+    GLint drawbuffer,
+    const MaybeShared<DOMUint32Array>& value) {
   if (isContextLost() ||
-      !validateClearBuffer("clearBufferuiv", buffer, value->length()))
+      !validateNotSharedArrayBuffer("clearBufferuiv", value) ||
+      !validateClearBuffer("clearBufferuiv", buffer,
+                           value.viewNotShared()->length()))
     return;
 
-  contextGL()->ClearBufferuiv(buffer, drawbuffer, value->data());
+  contextGL()->ClearBufferuiv(buffer, drawbuffer,
+                              value.viewNotShared()->data());
 }
 
 void WebGL2RenderingContextBase::clearBufferuiv(GLenum buffer,
                                                 GLint drawbuffer,
                                                 const Vector<GLuint>& value) {
   if (isContextLost() ||
       !validateClearBuffer("clearBufferuiv", buffer, value.size()))
     return;
 
   contextGL()->ClearBufferuiv(buffer, drawbuffer, value.data());
 }
 
-void WebGL2RenderingContextBase::clearBufferfv(GLenum buffer,
-                                               GLint drawbuffer,
-                                               DOMFloat32Array* value) {
+void WebGL2RenderingContextBase::clearBufferfv(
+    GLenum buffer,
+    GLint drawbuffer,
+    const MaybeShared<DOMFloat32Array>& value) {
   if (isContextLost() ||
-      !validateClearBuffer("clearBufferfv", buffer, value->length()))
+      !validateNotSharedArrayBuffer("clearBufferfv", value) ||
+      !validateClearBuffer("clearBufferfv", buffer,
+                           value.viewNotShared()->length()))
     return;
 
-  contextGL()->ClearBufferfv(buffer, drawbuffer, value->data());
+  contextGL()->ClearBufferfv(buffer, drawbuffer, value.viewNotShared()->data());
 }
 
 void WebGL2RenderingContextBase::clearBufferfv(GLenum buffer,
                                                GLint drawbuffer,
                                                const Vector<GLfloat>& value) {
   if (isContextLost() ||
       !validateClearBuffer("clearBufferfv", buffer, value.size()))
     return;
 
   contextGL()->ClearBufferfv(buffer, drawbuffer, value.data());
@@ skipping 2124 matching lines @@
 
 void WebGL2RenderingContextBase::
     DrawingBufferClientRestorePixelUnpackBufferBinding() {
   if (!contextGL())
     return;
   contextGL()->BindBuffer(GL_PIXEL_UNPACK_BUFFER,
                           objectOrZero(m_boundPixelUnpackBuffer.get()));
 }
 
 }  // namespace blink