[SharedArrayBuffer] Prevent SharedArrayBuffer being used in Web APIs

third_party/WebKit/Source/bindings/scripts/v8_types.py

 # Copyright (C) 2013 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
 # met:
 #
 #     * Redistributions of source code must retain the above copyright
 # notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above
 # copyright notice, this list of conditions and the following disclaimer
@@ skipping 56 matching lines @@
     'Float32Array',
     'Float64Array',
     'Int8Array',
     'Int16Array',
     'Int32Array',
     'Uint8Array',
     'Uint8ClampedArray',
     'Uint16Array',
     'Uint32Array',
 ])
+ARRAY_BUFFER_VIEW_AND_TYPED_ARRAY_TYPES = TYPED_ARRAY_TYPES.union(frozenset([
+    'ArrayBufferView'
+]))
 ARRAY_BUFFER_AND_VIEW_TYPES = TYPED_ARRAY_TYPES.union(frozenset([
     'ArrayBuffer',
     'ArrayBufferView',
     'DataView',
     'SharedArrayBuffer',
 ]))
 
 
 IdlType.is_array_buffer_or_view = property(
     lambda self: self.base_type in ARRAY_BUFFER_AND_VIEW_TYPES)
 
+IdlType.is_array_buffer_view_or_typed_array = property(
+    lambda self: self.base_type in ARRAY_BUFFER_VIEW_AND_TYPED_ARRAY_TYPES)
+
 IdlType.is_typed_array = property(
     lambda self: self.base_type in TYPED_ARRAY_TYPES)
 
 IdlType.is_wrapper_type = property(
     lambda self: (self.is_interface_type and
                   not self.is_callback_interface and
                   self.base_type not in NON_WRAPPER_TYPES))
 
 
 ################################################################################
@@ skipping 97 matching lines @@
         return ('PassRefPtr<%s>' if used_as_rvalue_type else 'RefPtr<%s>') % base_idl_type
     if idl_type.is_string_type:
         if not raw_type:
             return 'String'
         return 'V8StringResource<%s>' % string_mode()
 
     if base_idl_type == 'ArrayBufferView' and 'FlexibleArrayBufferView' in extended_attributes:
         return 'FlexibleArrayBufferView'
     if base_idl_type in TYPED_ARRAY_TYPES and 'FlexibleArrayBufferView' in extended_attributes:
         return 'Flexible' + base_idl_type + 'View'
+    if base_idl_type in ARRAY_BUFFER_VIEW_AND_TYPED_ARRAY_TYPES:
+        if not used_in_cpp_sequence:
+            return cpp_template_type('NotShared', idl_type.implemented_as)
     if idl_type.is_interface_type:
         implemented_as_class = idl_type.implemented_as
         if raw_type or (used_as_rvalue_type and idl_type.is_garbage_collected) or not used_in_cpp_sequence:
             return implemented_as_class + '*'
         if not used_in_cpp_sequence:
             return implemented_as_class + '*'
         return cpp_template_type('Member', implemented_as_class)
     if idl_type.is_dictionary:
         if used_as_rvalue_type:
             return 'const %s&' % base_idl_type
@@ skipping 121 matching lines @@
     lambda self: self.value_type.is_traceable)
 
 
 ################################################################################
 # Includes
 ################################################################################
 
 INCLUDES_FOR_TYPE = {
     'object': set(),
     'ArrayBufferView': set(['bindings/core/v8/V8ArrayBufferView.h',
+                            'core/dom/NotShared.h',
                             'core/dom/FlexibleArrayBufferView.h']),
     'Dictionary': set(['bindings/core/v8/Dictionary.h']),
     'EventHandler': set(['bindings/core/v8/V8AbstractEventListener.h',
                          'bindings/core/v8/V8EventListenerHelper.h']),
     'EventListener': set(['bindings/core/v8/BindingSecurity.h',
                           'bindings/core/v8/V8EventListenerHelper.h',
                           'core/frame/LocalDOMWindow.h']),
     'HTMLCollection': set(['bindings/core/v8/V8HTMLCollection.h',
                            'core/dom/ClassCollection.h',
                            'core/dom/TagCollection.h',
@@ skipping 15 matching lines @@
 
 def includes_for_type(idl_type, extended_attributes=None):
     idl_type = idl_type.preprocessed_type
     extended_attributes = extended_attributes or {}
 
     # Simple types
     base_idl_type = idl_type.base_type
     if base_idl_type in INCLUDES_FOR_TYPE:
         return INCLUDES_FOR_TYPE[base_idl_type]
     if base_idl_type in TYPED_ARRAY_TYPES:
-        return INCLUDES_FOR_TYPE['ArrayBufferView'].union(
-            set(['bindings/%s/v8/V8%s.h' % (component_dir[base_idl_type], base_idl_type)])
-        )
+        ta_includes = set()

[haraken, 2017/04/06 08:43:54]

ta => typed_array

Blink prefers a fully qualified name.

[binji, 2017/04/09 00:40:02]

Done.

+        ta_includes.update(INCLUDES_FOR_TYPE['ArrayBufferView'])
+        ta_includes.update(['core/dom/NotShared.h'])

[haraken, 2017/04/06 08:43:54]

This is not needed since INCLUDES_FOR_TYPE['ArrayBufferView'] includes
NotShared.h, right?

[binji, 2017/04/09 00:40:02]

Done.

+        ta_includes.update(set(['bindings/%s/v8/V8%s.h' % (component_dir[base_idl_type], base_idl_type)]))
+        return ta_includes
     if idl_type.is_basic_type:
         return set(['bindings/core/v8/IDLTypes.h',
                     'bindings/core/v8/NativeValueTraitsImpl.h'])
     if base_idl_type.endswith('ConstructorConstructor'):
         # FIXME: rename to NamedConstructor
         # FIXME: replace with a [NamedConstructorAttribute] extended attribute
         # Ending with 'ConstructorConstructor' indicates a named constructor,
         # and these do not have header files, as they are part of the generated
         # bindings for the interface
         return set()
@@ skipping 58 matching lines @@
         includes_for_type.add('wtf/Vector.h')
 
     base_idl_type = idl_type.base_type
     if idl_type.is_string_type:
         includes_for_type.add('wtf/text/WTFString.h')
     if base_idl_type in interfaces_info:
         interface_info = interfaces_info[base_idl_type]
         includes_for_type.add(interface_info['include_path'])
     if base_idl_type in INCLUDES_FOR_TYPE:
         includes_for_type.update(INCLUDES_FOR_TYPE[base_idl_type])
-    if idl_type.is_typed_array:
-        return set(['core/dom/DOMTypedArray.h'])
+    if idl_type.is_array_buffer_view_or_typed_array:
+        return set(['core/dom/DOMTypedArray.h', 'core/dom/NotShared.h'])
     return includes_for_type
 
 
 def impl_includes_for_type_union(idl_type, interfaces_info):
     includes_for_type = set()
     for member_type in idl_type.member_types:
         includes_for_type.update(member_type.impl_includes_for_type(interfaces_info))
     return includes_for_type
 
 IdlTypeBase.impl_includes_for_type = impl_includes_for_type
@@ skipping 38 matching lines @@
     'ScriptValue': 'ScriptValue(ScriptState::current({isolate}), {v8_value})',
     'Window': 'toDOMWindow({isolate}, {v8_value})',
     'XPathNSResolver': 'toXPathNSResolver(ScriptState::current({isolate}), {v8_value})',
 }
 
 
 def v8_conversion_needs_exception_state(idl_type):
     return (idl_type.is_numeric_type or
             idl_type.is_enum or
             idl_type.is_dictionary or
+            idl_type.is_array_buffer_view_or_typed_array or
             idl_type.name in ('Boolean', 'ByteString', 'Date', 'Dictionary', 'USVString', 'SerializedScriptValue'))
 
 IdlType.v8_conversion_needs_exception_state = property(v8_conversion_needs_exception_state)
 IdlArrayOrSequenceType.v8_conversion_needs_exception_state = True
 IdlRecordType.v8_conversion_needs_exception_state = True
 IdlUnionType.v8_conversion_needs_exception_state = True
 
 
 TRIVIAL_CONVERSIONS = frozenset([
     'any',
@@ skipping 40 matching lines @@
     # Array or sequence types
     native_array_element_type = idl_type.native_array_element_type
     if native_array_element_type:
         return v8_value_to_cpp_value_array_or_sequence(native_array_element_type, v8_value, index, isolate)
 
     # Simple types
     idl_type = idl_type.preprocessed_type
     base_idl_type = idl_type.as_union_type.name if idl_type.is_union_type else idl_type.base_type
 
     if 'FlexibleArrayBufferView' in extended_attributes:
-        if base_idl_type not in TYPED_ARRAY_TYPES.union(set(['ArrayBufferView'])):
+        if base_idl_type not in ARRAY_BUFFER_VIEW_AND_TYPED_ARRAY_TYPES:
             raise ValueError("Unrecognized base type for extended attribute 'FlexibleArrayBufferView': %s" % (idl_type.base_type))
         base_idl_type = 'FlexibleArrayBufferView'
 
     if idl_type.is_integer_type:
         configuration = 'NormalConversion'
         if 'EnforceRange' in extended_attributes:
             configuration = 'EnforceRange'
         elif 'Clamp' in extended_attributes:
             configuration = 'Clamp'
         arguments = ', '.join([v8_value, 'exceptionState', configuration])
     elif idl_type.v8_conversion_needs_exception_state:
         arguments = ', '.join([v8_value, 'exceptionState'])
     else:
         arguments = v8_value
 
     if base_idl_type in V8_VALUE_TO_CPP_VALUE:
         cpp_expression_format = V8_VALUE_TO_CPP_VALUE[base_idl_type]
-    elif idl_type.is_array_buffer_or_view:
+    elif idl_type.name == 'ArrayBuffer':
         cpp_expression_format = (
             '{v8_value}->Is{idl_type}() ? '
             'V8{idl_type}::toImpl(v8::Local<v8::{idl_type}>::Cast({v8_value})) : 0')
+    elif idl_type.is_array_buffer_view_or_typed_array:
+        this_cpp_type = idl_type.cpp_type
+        cpp_expression_format = ('toNotShared<%s>({isolate}, {v8_value}, exceptionState)' % this_cpp_type)
     elif idl_type.is_union_type:
         nullable = 'UnionTypeConversionMode::Nullable' if idl_type.includes_nullable_type else 'UnionTypeConversionMode::NotNullable'
         cpp_expression_format = 'V8{idl_type}::toImpl({isolate}, {v8_value}, {variable_name}, %s, exceptionState)' % nullable
     elif idl_type.use_output_parameter_for_result:
         cpp_expression_format = 'V8{idl_type}::toImpl({isolate}, {v8_value}, {variable_name}, exceptionState)'
     elif idl_type.is_callback_function:
         cpp_expression_format = (
             '{idl_type}::create(ScriptState::current({isolate}), {v8_value})')
     elif idl_type.v8_conversion_needs_exception_state:
         # Effectively, this if branch means everything with v8_conversion_needs_exception_state == True
@@ skipping 44 matching lines @@
     # Optional expression that returns a value to be assigned to the local variable.
     assign_expression = None
     # Optional void expression executed unconditionally.
     set_expression = None
     # Optional expression that returns true if the conversion fails.
     check_expression = None
     # Optional expression used as the return value when returning. Only
     # meaningful if 'check_expression' is not None.
     return_expression = bailout_return_value
 
-    if idl_type.is_string_type or idl_type.v8_conversion_needs_exception_state:
+    if 'FlexibleArrayBufferView' in extended_attributes:
+        if idl_type.base_type not in ARRAY_BUFFER_VIEW_AND_TYPED_ARRAY_TYPES:
+            raise ValueError("Unrecognized base type for extended attribute 'FlexibleArrayBufferView': %s" % (idl_type.base_type))
+        set_expression = cpp_value
+    elif idl_type.is_string_type or idl_type.v8_conversion_needs_exception_state:
         # Types for which conversion can fail and that need error handling.
 
         check_expression = 'exceptionState.hadException()'
 
         if idl_type.is_dictionary or idl_type.is_union_type:
             set_expression = cpp_value
         else:
             assign_expression = cpp_value
             # Note: 'not idl_type.v8_conversion_needs_exception_state' implies
             # 'idl_type.is_string_type', but there are types for which both are
             # true (ByteString and USVString), so using idl_type.is_string_type
             # as the condition here would be wrong.
             if not idl_type.v8_conversion_needs_exception_state:
                 if use_exception_state:
                     check_expression = '!%s.prepare(exceptionState)' % variable_name
                 else:
                     check_expression = '!%s.prepare()' % variable_name
     elif not idl_type.v8_conversion_is_trivial and not idl_type.is_callback_function:
         return {
             'error_message': 'no V8 -> C++ conversion for IDL type: %s' % idl_type.name
         }
-    elif 'FlexibleArrayBufferView' in extended_attributes:
-        if idl_type.base_type not in TYPED_ARRAY_TYPES.union(set(['ArrayBufferView'])):
-            raise ValueError("Unrecognized base type for extended attribute 'FlexibleArrayBufferView': %s" % (idl_type.base_type))
-        set_expression = cpp_value
     else:
         assign_expression = cpp_value
 
     # Types that don't need error handling, and simply assign a value to the
     # local variable.
 
     return {
         'assign_expression': assign_expression,
         'check_expression': check_expression,
         'cpp_type': this_cpp_type,
@@ skipping 355 matching lines @@
 IdlTypeBase.is_explicit_nullable = property(is_explicit_nullable)
 
 
 def includes_nullable_type_union(idl_type):
     # http://heycam.github.io/webidl/#dfn-includes-a-nullable-type
     return idl_type.number_of_nullable_member_types == 1
 
 IdlTypeBase.includes_nullable_type = False
 IdlNullableType.includes_nullable_type = True
 IdlUnionType.includes_nullable_type = property(includes_nullable_type_union)