[SharedArrayBuffer] Prevent SharedArrayBuffer being used in Web APIs

third_party/WebKit/Source/modules/webgl/WebGLGetBufferSubDataAsync.cpp

Index: third_party/WebKit/Source/modules/webgl/WebGLGetBufferSubDataAsync.cpp
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLGetBufferSubDataAsync.cpp b/third_party/WebKit/Source/modules/webgl/WebGLGetBufferSubDataAsync.cpp
index cd3e21da419656a66613a4a983e2edf4d5aa3f9d..08a7e6f320192129064406e77a65f36eaa16123b 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLGetBufferSubDataAsync.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLGetBufferSubDataAsync.cpp
@@ -36,7 +36,7 @@ ScriptPromise WebGLGetBufferSubDataAsync::getBufferSubDataAsync(
     ScriptState* scriptState,
     GLenum target,
     GLintptr srcByteOffset,
-    DOMArrayBufferView* dstData,
+    const NotShared<DOMArrayBufferView>& dstData,
     GLuint dstOffset,
     GLuint length) {
   ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
@@ -61,7 +61,7 @@ ScriptPromise WebGLGetBufferSubDataAsync::getBufferSubDataAsync(
   void* destinationDataPtr = nullptr;
   long long destinationByteLength = 0;
   const char* message = context->validateGetBufferSubData(
-      __FUNCTION__, target, srcByteOffset, dstData, dstOffset, length,
+      __FUNCTION__, target, srcByteOffset, dstData.view(), dstOffset, length,
       &sourceBuffer, &destinationDataPtr, &destinationByteLength);
   if (message) {
     // If there was a GL error, it was already synthesized in
@@ -83,7 +83,7 @@ ScriptPromise WebGLGetBufferSubDataAsync::getBufferSubDataAsync(
 
   // If the length of the copy is zero, this is a no-op.
   if (!destinationByteLength) {
-    resolver->resolve(dstData);
+    resolver->resolve(dstData.view());
     return promise;
   }
 
@@ -101,8 +101,8 @@ ScriptPromise WebGLGetBufferSubDataAsync::getBufferSubDataAsync(
   }
 
   auto callbackObject = new WebGLGetBufferSubDataAsyncCallback(
-      context, resolver, mappedData, queryID, dstData, destinationDataPtr,
-      destinationByteLength);
+      context, resolver, mappedData, queryID, dstData.view(),
+      destinationDataPtr, destinationByteLength);
   context->registerGetBufferSubDataAsyncCallback(callbackObject);
   auto callback = WTF::bind(&WebGLGetBufferSubDataAsyncCallback::resolve,
                             wrapPersistent(callbackObject));