[SharedArrayBuffer] Prevent SharedArrayBuffer being used in Web APIs

third_party/WebKit/Source/modules/webgl/WebGLGetBufferSubDataAsync.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/webgl/WebGLGetBufferSubDataAsync.h"
 
 #include "core/dom/DOMException.h"
 #include "gpu/GLES2/gl2extchromium.h"
 #include "gpu/command_buffer/client/gles2_interface.h"
 #include "modules/webgl/WebGL2RenderingContextBase.h"
@@ skipping 18 matching lines @@
 }
 
 const char* WebGLGetBufferSubDataAsync::extensionName() {
   return "WEBGL_get_buffer_sub_data_async";
 }
 
 ScriptPromise WebGLGetBufferSubDataAsync::getBufferSubDataAsync(
     ScriptState* scriptState,
     GLenum target,
     GLintptr srcByteOffset,
-    DOMArrayBufferView* dstData,
+    const NotShared<DOMArrayBufferView>& dstData,
     GLuint dstOffset,
     GLuint length) {
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
   ScriptPromise promise = resolver->promise();
 
   WebGLExtensionScopedContext scoped(this);
   if (scoped.isLost()) {
     DOMException* exception =
         DOMException::create(InvalidStateError, "context lost");
     resolver->reject(exception);
     return promise;
   }
 
   WebGL2RenderingContextBase* context = nullptr;
   {
     WebGLRenderingContextBase* contextBase = scoped.context();
     DCHECK_GE(contextBase->version(), 2u);
     context = static_cast<WebGL2RenderingContextBase*>(contextBase);
   }
 
   WebGLBuffer* sourceBuffer = nullptr;
   void* destinationDataPtr = nullptr;
   long long destinationByteLength = 0;
   const char* message = context->validateGetBufferSubData(
-      __FUNCTION__, target, srcByteOffset, dstData, dstOffset, length,
+      __FUNCTION__, target, srcByteOffset, dstData.view(), dstOffset, length,
       &sourceBuffer, &destinationDataPtr, &destinationByteLength);
   if (message) {
     // If there was a GL error, it was already synthesized in
     // validateGetBufferSubData, so it's not done here.
     DOMException* exception = DOMException::create(InvalidStateError, message);
     resolver->reject(exception);
     return promise;
   }
 
   message = context->validateGetBufferSubDataBounds(
       __FUNCTION__, sourceBuffer, srcByteOffset, destinationByteLength);
   if (message) {
     // If there was a GL error, it was already synthesized in
     // validateGetBufferSubDataBounds, so it's not done here.
     DOMException* exception = DOMException::create(InvalidStateError, message);
     resolver->reject(exception);
     return promise;
   }
 
   // If the length of the copy is zero, this is a no-op.
   if (!destinationByteLength) {
-    resolver->resolve(dstData);
+    resolver->resolve(dstData.view());
     return promise;
   }
 
   GLuint queryID;
   context->contextGL()->GenQueriesEXT(1, &queryID);
   context->contextGL()->BeginQueryEXT(GL_COMMANDS_ISSUED_CHROMIUM, queryID);
   void* mappedData = context->contextGL()->GetBufferSubDataAsyncCHROMIUM(
       target, srcByteOffset, destinationByteLength);
   context->contextGL()->EndQueryEXT(GL_COMMANDS_ISSUED_CHROMIUM);
   if (!mappedData) {
     DOMException* exception =
         DOMException::create(InvalidStateError, "Out of memory");
     resolver->reject(exception);
     return promise;
   }
 
   auto callbackObject = new WebGLGetBufferSubDataAsyncCallback(
-      context, resolver, mappedData, queryID, dstData, destinationDataPtr,
-      destinationByteLength);
+      context, resolver, mappedData, queryID, dstData.view(),
+      destinationDataPtr, destinationByteLength);
   context->registerGetBufferSubDataAsyncCallback(callbackObject);
   auto callback = WTF::bind(&WebGLGetBufferSubDataAsyncCallback::resolve,
                             wrapPersistent(callbackObject));
   context->drawingBuffer()->contextProvider()->signalQuery(
       queryID, convertToBaseCallback(std::move(callback)));
 
   return promise;
 }
 
 WebGLGetBufferSubDataAsyncCallback::WebGLGetBufferSubDataAsyncCallback(
@@ skipping 49 matching lines @@
   m_context->unregisterGetBufferSubDataAsyncCallback(this);
 }
 
 DEFINE_TRACE(WebGLGetBufferSubDataAsyncCallback) {
   visitor->trace(m_context);
   visitor->trace(m_promiseResolver);
   visitor->trace(m_destinationArrayBufferView);
 }
 
 }  // namespace blink