[SharedArrayBuffer] Prevent SharedArrayBuffer being used in Web APIs

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

Index: third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index 514c3cb1d162769484baba16c9488dcc0624f467..9888df1b42c0ef336dfdfd9e3860938bfb7f40fb 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -5952,13 +5952,14 @@ void WebGLRenderingContextBase::uniform4iv(const WebGLUniformLocation* location,
 void WebGLRenderingContextBase::uniformMatrix2fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* v) {
+    const MaybeShared<DOMFloat32Array>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix2fv", location, transpose,
                                        v, 4, 0, v->length()))
     return;
-  contextGL()->UniformMatrix2fv(location->location(), v->length() >> 2,
-                                transpose, v->data());
+  contextGL()->UniformMatrix2fv(location->location(),
+                                v.viewNotShared()->length() >> 2, transpose,
+                                v.viewNotShared()->data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix2fv(
@@ -5976,13 +5977,14 @@ void WebGLRenderingContextBase::uniformMatrix2fv(
 void WebGLRenderingContextBase::uniformMatrix3fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* v) {
+    const MaybeShared<DOMFloat32Array>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix3fv", location, transpose,
                                        v, 9, 0, v->length()))
     return;
-  contextGL()->UniformMatrix3fv(location->location(), v->length() / 9,
-                                transpose, v->data());
+  contextGL()->UniformMatrix3fv(location->location(),
+                                v.viewNotShared()->length() / 9, transpose,
+                                v.viewNotShared()->data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix3fv(
@@ -6000,13 +6002,14 @@ void WebGLRenderingContextBase::uniformMatrix3fv(
 void WebGLRenderingContextBase::uniformMatrix4fv(
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* v) {
+    const MaybeShared<DOMFloat32Array>& v) {
   if (isContextLost() ||
       !validateUniformMatrixParameters("uniformMatrix4fv", location, transpose,
                                        v, 16, 0, v->length()))
     return;
-  contextGL()->UniformMatrix4fv(location->location(), v->length() >> 4,
-                                transpose, v->data());
+  contextGL()->UniformMatrix4fv(location->location(),
+                                v.viewNotShared()->length() >> 4, transpose,
+                                v.viewNotShared()->data());
 }
 
 void WebGLRenderingContextBase::uniformMatrix4fv(
@@ -6062,15 +6065,16 @@ void WebGLRenderingContextBase::vertexAttrib1f(GLuint index, GLfloat v0) {
   setVertexAttribType(index, Float32ArrayType);
 }
 
-void WebGLRenderingContextBase::vertexAttrib1fv(GLuint index,
-                                                const DOMFloat32Array* v) {
-  if (isContextLost())
+void WebGLRenderingContextBase::vertexAttrib1fv(
+    GLuint index,
+    const MaybeShared<const DOMFloat32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttrib1fv", v))
     return;
-  if (!v || v->length() < 1) {
+  if (!v || v.viewNotShared()->length() < 1) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib1fv", "invalid array");
     return;
   }
-  contextGL()->VertexAttrib1fv(index, v->data());
+  contextGL()->VertexAttrib1fv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
@@ -6095,15 +6099,16 @@ void WebGLRenderingContextBase::vertexAttrib2f(GLuint index,
   setVertexAttribType(index, Float32ArrayType);
 }
 
-void WebGLRenderingContextBase::vertexAttrib2fv(GLuint index,
-                                                const DOMFloat32Array* v) {
-  if (isContextLost())
+void WebGLRenderingContextBase::vertexAttrib2fv(
+    GLuint index,
+    const MaybeShared<const DOMFloat32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttrib2fv", v))
     return;
-  if (!v || v->length() < 2) {
+  if (!v || v.viewNotShared()->length() < 2) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib2fv", "invalid array");
     return;
   }
-  contextGL()->VertexAttrib2fv(index, v->data());
+  contextGL()->VertexAttrib2fv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
@@ -6129,15 +6134,16 @@ void WebGLRenderingContextBase::vertexAttrib3f(GLuint index,
   setVertexAttribType(index, Float32ArrayType);
 }
 
-void WebGLRenderingContextBase::vertexAttrib3fv(GLuint index,
-                                                const DOMFloat32Array* v) {
-  if (isContextLost())
+void WebGLRenderingContextBase::vertexAttrib3fv(
+    GLuint index,
+    const MaybeShared<const DOMFloat32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttrib3fv", v))
     return;
-  if (!v || v->length() < 3) {
+  if (!v || v.viewNotShared()->length() < 3) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib3fv", "invalid array");
     return;
   }
-  contextGL()->VertexAttrib3fv(index, v->data());
+  contextGL()->VertexAttrib3fv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
@@ -6164,15 +6170,16 @@ void WebGLRenderingContextBase::vertexAttrib4f(GLuint index,
   setVertexAttribType(index, Float32ArrayType);
 }
 
-void WebGLRenderingContextBase::vertexAttrib4fv(GLuint index,
-                                                const DOMFloat32Array* v) {
-  if (isContextLost())
+void WebGLRenderingContextBase::vertexAttrib4fv(
+    GLuint index,
+    const MaybeShared<const DOMFloat32Array>& v) {
+  if (isContextLost() || !validateNotSharedArrayBuffer("vertexAttrib4fv", v))
     return;
-  if (!v || v->length() < 4) {
+  if (!v || v.viewNotShared()->length() < 4) {
     synthesizeGLError(GL_INVALID_VALUE, "vertexAttrib4fv", "invalid array");
     return;
   }
-  contextGL()->VertexAttrib4fv(index, v->data());
+  contextGL()->VertexAttrib4fv(index, v.viewNotShared()->data());
   setVertexAttribType(index, Float32ArrayType);
 }
 
@@ -7213,7 +7220,7 @@ bool WebGLRenderingContextBase::validateUniformMatrixParameters(
     const char* functionName,
     const WebGLUniformLocation* location,
     GLboolean transpose,
-    DOMFloat32Array* v,
+    const MaybeShared<DOMFloat32Array>& v,
     GLsizei requiredMinSize,
     GLuint srcOffset,
     GLuint srcLength) {
@@ -7221,8 +7228,10 @@ bool WebGLRenderingContextBase::validateUniformMatrixParameters(
     synthesizeGLError(GL_INVALID_VALUE, functionName, "no array");
     return false;
   }
-  return validateUniformMatrixParameters(functionName, location, transpose,
-                                         v->data(), v->length(),
+  return validateNotSharedArrayBuffer(functionName, v) &&
+         validateUniformMatrixParameters(functionName, location, transpose,
+                                         v.viewNotShared()->data(),
+                                         v.viewNotShared()->length(),
                                          requiredMinSize, srcOffset, srcLength);
 }