[SharedArrayBuffer] Prevent SharedArrayBuffer being used in Web APIs

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 5934 matching lines @@
       !validateUniformParameters("uniform4iv", location, v.data(), v.size(), 4,
                                  0, v.size()))
     return;
 
   contextGL()->Uniform4iv(location->location(), v.size() >> 2, v.data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix2fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* v) {
+    const MaybeShared<DOMFloat32Array>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix2fv", location, transpose,
                                        v, 4, 0, v->length()))
     return;
-  contextGL()->UniformMatrix2fv(location->location(), v->length() >> 2,
-                                transpose, v->data());
+  contextGL()->UniformMatrix2fv(location->location(),
+                                v.viewNotShared()->length() >> 2, transpose,
+                                v.viewNotShared()->data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix2fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix2fv", location, transpose,
                                        v.data(), v.size(), 4, 0, v.size()))
     return;
   contextGL()->UniformMatrix2fv(location->location(), v.size() >> 2, transpose,
                                 v.data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix3fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* v) {
+    const MaybeShared<DOMFloat32Array>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix3fv", location, transpose,
                                        v, 9, 0, v->length()))
     return;
-  contextGL()->UniformMatrix3fv(location->location(), v->length() / 9,
-                                transpose, v->data());
+  contextGL()->UniformMatrix3fv(location->location(),
+                                v.viewNotShared()->length() / 9, transpose,
+                                v.viewNotShared()->data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix3fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix3fv", location, transpose,
                                        v.data(), v.size(), 9, 0, v.size()))
     return;
   contextGL()->UniformMatrix3fv(location->location(), v.size() / 9, transpose,
                                 v.data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix4fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* v) {
+    const MaybeShared<DOMFloat32Array>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix4fv", location, transpose,
                                        v, 16, 0, v->length()))
     return;
-  contextGL()->UniformMatrix4fv(location->location(), v->length() >> 4,
-                                transpose, v->data());
+  contextGL()->UniformMatrix4fv(location->location(),
+                                v.viewNotShared()->length() >> 4, transpose,
+                                v.viewNotShared()->data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix4fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
     Vector<GLfloat>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix4fv", location, transpose,
                                        v.data(), v.size(), 16, 0, v.size()))
     return;
@@ skipping 35 matching lines @@
     m_vertexAttribType[index] = type;
 }
 
 void WebGLRenderingContextBase::vertexAttrib1f(GLuint index, GLfloat v0) {
   if (isContextLost())
     return;
   contextGL()->VertexAttrib1f(index, v0);
   setVertexAttribType(index, Float32ArrayType);
 }
 
-void WebGLRenderingContextBase::vertexAttrib1fv(GLuint index,
-                                                const DOMFloat32Array* v) {
-  if (isContextLost())
+void WebGLRenderingContextBase::vertexAttrib1fv(
+    GLuint index,
+    const MaybeShared<const DOMFloat32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttrib1fv", v))
     return;
-  if (!v || v->length() < 1) {
+  if (!v || v.viewNotShared()->length() < 1) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib1fv", "invalid array");
     return;
   }
-  contextGL()->VertexAttrib1fv(index, v->data());
+  contextGL()->VertexAttrib1fv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
 void WebGLRenderingContextBase::vertexAttrib1fv(GLuint index,
                                                 const Vector<GLfloat>& v) {
   if (isContextLost())
     return;
   if (v.size() < 1) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib1fv", "invalid array");
     return;
   }
   contextGL()->VertexAttrib1fv(index, v.data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
 void WebGLRenderingContextBase::vertexAttrib2f(GLuint index,
                                                GLfloat v0,
                                                GLfloat v1) {
   if (isContextLost())
     return;
   contextGL()->VertexAttrib2f(index, v0, v1);
   setVertexAttribType(index, Float32ArrayType);
 }
 
-void WebGLRenderingContextBase::vertexAttrib2fv(GLuint index,
-                                                const DOMFloat32Array* v) {
-  if (isContextLost())
+void WebGLRenderingContextBase::vertexAttrib2fv(
+    GLuint index,
+    const MaybeShared<const DOMFloat32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttrib2fv", v))
     return;
-  if (!v || v->length() < 2) {
+  if (!v || v.viewNotShared()->length() < 2) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib2fv", "invalid array");
     return;
   }
-  contextGL()->VertexAttrib2fv(index, v->data());
+  contextGL()->VertexAttrib2fv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
 void WebGLRenderingContextBase::vertexAttrib2fv(GLuint index,
                                                 const Vector<GLfloat>& v) {
   if (isContextLost())
     return;
   if (v.size() < 2) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib2fv", "invalid array");
     return;
   }
   contextGL()->VertexAttrib2fv(index, v.data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
 void WebGLRenderingContextBase::vertexAttrib3f(GLuint index,
                                                GLfloat v0,
                                                GLfloat v1,
                                                GLfloat v2) {
   if (isContextLost())
     return;
   contextGL()->VertexAttrib3f(index, v0, v1, v2);
   setVertexAttribType(index, Float32ArrayType);
 }
 
-void WebGLRenderingContextBase::vertexAttrib3fv(GLuint index,
-                                                const DOMFloat32Array* v) {
-  if (isContextLost())
+void WebGLRenderingContextBase::vertexAttrib3fv(
+    GLuint index,
+    const MaybeShared<const DOMFloat32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttrib3fv", v))
     return;
-  if (!v || v->length() < 3) {
+  if (!v || v.viewNotShared()->length() < 3) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib3fv", "invalid array");
     return;
   }
-  contextGL()->VertexAttrib3fv(index, v->data());
+  contextGL()->VertexAttrib3fv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
 void WebGLRenderingContextBase::vertexAttrib3fv(GLuint index,
                                                 const Vector<GLfloat>& v) {
   if (isContextLost())
     return;
   if (v.size() < 3) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib3fv", "invalid array");
     return;
   }
   contextGL()->VertexAttrib3fv(index, v.data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
 void WebGLRenderingContextBase::vertexAttrib4f(GLuint index,
                                                GLfloat v0,
                                                GLfloat v1,
                                                GLfloat v2,
                                                GLfloat v3) {
   if (isContextLost())
     return;
   contextGL()->VertexAttrib4f(index, v0, v1, v2, v3);
   setVertexAttribType(index, Float32ArrayType);
 }
 
-void WebGLRenderingContextBase::vertexAttrib4fv(GLuint index,
-                                                const DOMFloat32Array* v) {
-  if (isContextLost())
+void WebGLRenderingContextBase::vertexAttrib4fv(
+    GLuint index,
+    const MaybeShared<const DOMFloat32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttrib4fv", v))
     return;
-  if (!v || v->length() < 4) {
+  if (!v || v.viewNotShared()->length() < 4) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib4fv", "invalid array");
     return;
   }
-  contextGL()->VertexAttrib4fv(index, v->data());
+  contextGL()->VertexAttrib4fv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
 void WebGLRenderingContextBase::vertexAttrib4fv(GLuint index,
                                                 const Vector<GLfloat>& v) {
   if (isContextLost())
     return;
   if (v.size() < 4) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib4fv", "invalid array");
     return;
@@ skipping 1020 matching lines @@
     GLuint srcOffset,
     GLuint srcLength) {
   return validateUniformMatrixParameters(functionName, location, false, v, size,
                                          requiredMinSize, srcOffset, srcLength);
 }
 
 bool WebGLRenderingContextBase::validateUniformMatrixParameters(
     const char* functionName,
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* v,
+    const MaybeShared<DOMFloat32Array>& v,
     GLsizei requiredMinSize,
     GLuint srcOffset,
     GLuint srcLength) {
   if (!v) {
     synthesizeGLError(GL_INVALID_VALUE, functionName, "no array");
     return false;
   }
-  return validateUniformMatrixParameters(functionName, location, transpose,
-                                         v->data(), v->length(),
+  return validateNotSharedArrayBuffer(functionName, v) &&
+         validateUniformMatrixParameters(functionName, location, transpose,
+                                         v.viewNotShared()->data(),
+                                         v.viewNotShared()->length(),
                                          requiredMinSize, srcOffset, srcLength);
 }
 
 bool WebGLRenderingContextBase::validateUniformMatrixParameters(
     const char* functionName,
     const WebGLUniformLocation* location,
     GLboolean transpose,
     void* v,
     GLsizei size,
     GLsizei requiredMinSize,
@@ skipping 600 matching lines @@
 
 void WebGLRenderingContextBase::getHTMLOrOffscreenCanvas(
     HTMLCanvasElementOrOffscreenCanvas& result) const {
   if (canvas())
     result.setHTMLCanvasElement(canvas());
   else
     result.setOffscreenCanvas(offscreenCanvas());
 }
 
 }  // namespace blink