[SharedArrayBuffer] Prevent SharedArrayBuffer being used in Web APIs

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.h

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef WebGLRenderingContextBase_h
 #define WebGLRenderingContextBase_h
 
+#include <memory>
+#include <set>
 #include "bindings/core/v8/Nullable.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/ScriptValue.h"
 #include "bindings/core/v8/ScriptWrappable.h"
 #include "bindings/core/v8/ScriptWrappableVisitor.h"
 #include "core/CoreExport.h"
 #include "core/dom/DOMTypedArray.h"
+#include "core/dom/MaybeShared.h"
 #include "core/dom/TypedFlexibleArrayBufferView.h"
 #include "core/html/canvas/CanvasContextCreationAttributes.h"
 #include "core/html/canvas/CanvasRenderingContext.h"
 #include "core/layout/ContentChangeType.h"
 #include "modules/webgl/WebGLContextAttributes.h"
 #include "modules/webgl/WebGLExtensionName.h"
 #include "modules/webgl/WebGLTexture.h"
 #include "modules/webgl/WebGLVertexArrayObjectBase.h"
 #include "platform/Timer.h"
 #include "platform/graphics/ImageBuffer.h"
 #include "platform/graphics/gpu/DrawingBuffer.h"
 #include "platform/graphics/gpu/Extensions3DUtil.h"
 #include "platform/graphics/gpu/WebGLImageConversion.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebGraphicsContext3DProvider.h"
 #include "third_party/khronos/GLES2/gl2.h"
 #include "wtf/CheckedNumeric.h"
 #include "wtf/text/WTFString.h"
-#include <memory>
-#include <set>
 
 namespace blink {
 class WebLayer;
 }
 
 namespace gpu {
 namespace gles2 {
 class GLES2Interface;
 }
 }
@@ skipping 394 matching lines @@
   void uniform4fv(const WebGLUniformLocation*, Vector<GLfloat>&);
   void uniform4i(const WebGLUniformLocation*,
                  GLint x,
                  GLint y,
                  GLint z,
                  GLint w);
   void uniform4iv(const WebGLUniformLocation*, const FlexibleInt32ArrayView&);
   void uniform4iv(const WebGLUniformLocation*, Vector<GLint>&);
   void uniformMatrix2fv(const WebGLUniformLocation*,
                         GLboolean transpose,
-                        DOMFloat32Array* value);
+                        const MaybeShared<DOMFloat32Array>& value);
   void uniformMatrix2fv(const WebGLUniformLocation*,
                         GLboolean transpose,
                         Vector<GLfloat>& value);
   void uniformMatrix3fv(const WebGLUniformLocation*,
                         GLboolean transpose,
-                        DOMFloat32Array* value);
+                        const MaybeShared<DOMFloat32Array>& value);
   void uniformMatrix3fv(const WebGLUniformLocation*,
                         GLboolean transpose,
                         Vector<GLfloat>& value);
   void uniformMatrix4fv(const WebGLUniformLocation*,
                         GLboolean transpose,
-                        DOMFloat32Array* value);
+                        const MaybeShared<DOMFloat32Array>& value);
   void uniformMatrix4fv(const WebGLUniformLocation*,
                         GLboolean transpose,
                         Vector<GLfloat>& value);
 
   void useProgram(WebGLProgram*);
   void validateProgram(WebGLProgram*);
 
   void vertexAttrib1f(GLuint index, GLfloat x);
-  void vertexAttrib1fv(GLuint index, const DOMFloat32Array* values);
+  void vertexAttrib1fv(GLuint index,
+                       const MaybeShared<const DOMFloat32Array>& values);
   void vertexAttrib1fv(GLuint index, const Vector<GLfloat>& values);
   void vertexAttrib2f(GLuint index, GLfloat x, GLfloat y);
-  void vertexAttrib2fv(GLuint index, const DOMFloat32Array* values);
+  void vertexAttrib2fv(GLuint index,
+                       const MaybeShared<const DOMFloat32Array>& values);
   void vertexAttrib2fv(GLuint index, const Vector<GLfloat>& values);
   void vertexAttrib3f(GLuint index, GLfloat x, GLfloat y, GLfloat z);
-  void vertexAttrib3fv(GLuint index, const DOMFloat32Array* values);
+  void vertexAttrib3fv(GLuint index,
+                       const MaybeShared<const DOMFloat32Array>& values);
   void vertexAttrib3fv(GLuint index, const Vector<GLfloat>& values);
   void vertexAttrib4f(GLuint index, GLfloat x, GLfloat y, GLfloat z, GLfloat w);
-  void vertexAttrib4fv(GLuint index, const DOMFloat32Array* values);
+  void vertexAttrib4fv(GLuint index,
+                       const MaybeShared<const DOMFloat32Array>& values);
   void vertexAttrib4fv(GLuint index, const Vector<GLfloat>& values);
   void vertexAttribPointer(GLuint index,
                            GLint size,
                            GLenum type,
                            GLboolean normalized,
                            GLsizei stride,
                            long long offset);
 
   void vertexAttribDivisorANGLE(GLuint index, GLuint divisor);
 
@@ skipping 840 matching lines @@
   bool validateUniformParameters(const char* functionName,
                                  const WebGLUniformLocation*,
                                  void*,
                                  GLsizei,
                                  GLsizei mod,
                                  GLuint srcOffset,
                                  GLuint srcLength);
   bool validateUniformMatrixParameters(const char* functionName,
                                        const WebGLUniformLocation*,
                                        GLboolean transpose,
-                                       DOMFloat32Array*,
+                                       const MaybeShared<DOMFloat32Array>&,
                                        GLsizei mod,
                                        GLuint srcOffset,
                                        GLuint srcLength);
   bool validateUniformMatrixParameters(const char* functionName,
                                        const WebGLUniformLocation*,
                                        GLboolean transpose,
                                        void*,
                                        GLsizei,
                                        GLsizei mod,
                                        GLuint srcOffset,
                                        GLuint srcLength);
 
   template <typename WTFTypedArray>
   bool validateUniformParameters(
       const char* functionName,
       const WebGLUniformLocation* location,
       const TypedFlexibleArrayBufferView<WTFTypedArray>& v,
       GLsizei requiredMinSize,
       GLuint srcOffset,
       GLuint srcLength) {
     if (!v.dataMaybeOnStack()) {
       synthesizeGLError(GL_INVALID_VALUE, functionName, "no array");
       return false;
     }
     return validateUniformMatrixParameters(
         functionName, location, false, v.dataMaybeOnStack(), v.length(),
         requiredMinSize, srcOffset, srcLength);
   }
 
+  template <typename TypedArray>
+  bool validateNotSharedArrayBuffer(const char* functionName,
+                                    const MaybeShared<TypedArray>& v) {
+    // TODO(binji): Disallow for now.
+    if (v.isShared()) {
+      synthesizeGLError(GL_INVALID_VALUE, functionName,
+                        "array is backed by SharedArrayBuffer.");
+      return false;
+    }
+    return true;
+  }
+
   // Helper function to validate the target for bufferData and
   // getBufferParameter.
   virtual bool validateBufferTarget(const char* functionName, GLenum target);
 
   // Helper function to validate the target for bufferData.
   // Return the current bound buffer to target, or 0 if the target is invalid.
   virtual WebGLBuffer* validateBufferDataTarget(const char* functionName,
                                                 GLenum target);
   // Helper function to validate the usage for bufferData.
   virtual bool validateBufferDataUsage(const char* functionName, GLenum usage);
@@ skipping 260 matching lines @@
                   context,
                   context->is3d(),
                   context.is3d());
 
 }  // namespace blink
 
 WTF_ALLOW_MOVE_INIT_AND_COMPARE_WITH_MEM_FUNCTIONS(
     blink::WebGLRenderingContextBase::TextureUnitState);
 
 #endif  // WebGLRenderingContextBase_h