[SharedArrayBuffer] Prevent SharedArrayBuffer being used in Web APIs

third_party/WebKit/Source/core/dom/NotShared.h

Index: third_party/WebKit/Source/core/dom/NotShared.h
diff --git a/third_party/WebKit/Source/core/dom/NotShared.h b/third_party/WebKit/Source/core/dom/NotShared.h
new file mode 100644
index 0000000000000000000000000000000000000000..d92db00ab986dcddccf2f324616feb8fe007a213
--- /dev/null
+++ b/third_party/WebKit/Source/core/dom/NotShared.h
@@ -0,0 +1,65 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef NotShared_h
+#define NotShared_h
+
+// A wrapper template type that is used to ensure that a TypedArray is not
+// backed by a SharedArrayBuffer.
+//
+// Typically this is used as an annotation on C++ functions that are called by
+// the bindings layer, e.g.:
+//
+//   void Foo(NotShared<DOMUint32Array> param) {
+//     DOMUint32Array* array = param.View();
+//     ...
+//   }
+
+#include "platform/heap/Handle.h"
+
+namespace blink {
+
+template <typename T>
+class NotShared {
+  STACK_ALLOCATED();
+
+ public:
+  using TypedArrayType = T;
+
+  NotShared() {}
+
+  explicit NotShared(T* typedArray) : typed_array_(typedArray) {
+    DCHECK(!(typedArray && typedArray->View()->IsShared()));
+  }
+  NotShared(const NotShared& other) = default;
+  template <typename U>
+  NotShared(const NotShared<U>& other) : typed_array_(other.View()) {}
+  template <typename U>
+  NotShared(const Member<U>& other) {
+    DCHECK(!other->View()->IsShared());
+    typed_array_ = other.Get();
+  }
+
+  NotShared& operator=(const NotShared& other) = default;
+  template <typename U>
+  NotShared& operator=(const NotShared<U>& other) {
+    typed_array_ = other.View();
+    return *this;
+  }
+
+  T* View() const { return typed_array_.Get(); }
+
+  bool operator!() const { return !typed_array_; }
+  explicit operator bool() const { return !!typed_array_; }
+
+ private:
+  // Must use an untraced member here since this object may be constructed on a
+  // thread without a ThreadState (e.g. an Audio worklet). This is safe because
+  // this object is only stack allocated.

[haraken, 2017/04/11 01:01:03]

Update this comment. This is safe not because the object is stack allocated but
because the call site guarantees that the pointed-to array buffer is kept alive
in another way (i.e., CrossThreadPersistent).

If the number of the call sites on the audio thread is limited, I'd prefer not
using NotShared on the audio thread and instead use the typed array directly.
Then we can use Member here.

Either way, I don't think we should block this giant CL on it. Feel free to land
this :)

[binji, 2017/04/11 01:17:33]

Done, and added TODO w/ bug as well.
Yeah, it's just this one case AFAIK. I'll see if I can improve it in the next
CL. :-)

+  UntracedMember<T> typed_array_;
+};
+
+}  // namespace blink
+
+#endif  // NotShared_h