Merge pull request #3673 from lightpanda-io/type-error-response-shared-buffer

webapi: typeerror on XHR send SharedArrayBuffer

src/browser/js/Local.zig

@@ -772,6 +772,15 @@ fn jsValueToStruct(self: *const Local, comptime T: type, js_val: js.Value) !?T {
             return .{ .values = arr };
         },
         js.BufferSource => {
+            if (v8.v8__Value__IsSharedArrayBuffer(js_val.handle)) {
+                return error.TypeError;
+            }
+            if (js_val.isArrayBufferView()) {
+                const view: *const v8.ArrayBufferView = @ptrCast(js_val.handle);
+                if (js.arrayBufferIsShared(v8.v8__ArrayBufferView__Buffer(view).?)) {
+                    return error.TypeError;
+                }
+            }
             const bytes = (try jsValueToArrayBufferSlice(u8, true, js_val)) orelse return null;
             return .{ .bytes = bytes };
         },

src/browser/js/js.zig

@@ -172,7 +172,8 @@ pub const ArrayBuffer = struct {
     }
 };
 
-// An ArrayBuffer or any typed array kind or a, exposed as its raw bytes.
+// An ArrayBuffer or any typed array kind or a DataView, exposed as its raw bytes.
+// But not from an underying SharedBuffer
 pub const BufferSource = struct {
     bytes: []const u8,
 };
@@ -291,6 +292,13 @@ pub fn arrayBufferData(array_buffer: *const v8.ArrayBuffer) ?*anyopaque {
     return v8.v8__BackingStore__Data(backing_store);
 }
 
+pub fn arrayBufferIsShared(array_buffer: *const v8.ArrayBuffer) bool {
+    var backing_store_ptr = v8.v8__ArrayBuffer__GetBackingStore(array_buffer);
+    defer v8.std__shared_ptr__v8__BackingStore__reset(&backing_store_ptr);
+    const backing_store = v8.std__shared_ptr__v8__BackingStore__get(&backing_store_ptr) orelse return false;
+    return v8.v8__BackingStore__IsShared(backing_store);
+}
+
 // If a WebAPI takes a []const u8, then we'll coerce any JS value to that string
 // so null -> "null". But if a WebAPI takes an optional string, ?[]const u8,
 // how should we handle null? If the parameter _isn't_ passed, then it's obvious

src/browser/tests/net/response.html

@@ -452,3 +452,16 @@
   }
   testing.expectEqual(204, new Response(undefined, { status: 204 }).status);
 </script>
+
+<script id=shared_array_buffer_body>
+  const sab = new SharedArrayBuffer(4);
+  testing.expectError('TypeError', () => new Response(sab));
+  testing.expectError('TypeError', () => new Response(new Uint8Array(sab)));
+  testing.expectError('TypeError', () => new Response(new DataView(sab)));
+
+  // the same types over a regular ArrayBuffer are fine
+  const ab = new ArrayBuffer(4);
+  for (const body of [ab, new Uint8Array(ab), new DataView(ab)]) {
+    testing.expectTrue(new Response(body).body !== null);
+  }
+</script>