[POC] crossOriginIsolated = true [POC] [control / unprimed] enqueue(view-on-SAB): TypeError: Failed to execute 'enqueue' on 'ReadableByteStreamController': The provided ArrayBufferView value must not be shared. [POC] [prime] EncodedAudioChunk constructed with SAB-backed Uint8Array [POC] [bypass / primed] enqueue(view-on-SAB): TypeError: Failed to execute 'enqueue' on 'ReadableByteStreamController': Could not transfer ArrayBuffer [POC] [POC] *** BYPASS CONFIRMED *** [POC] Unprimed SAB view was rejected at the IDL boundary. [POC] Primed SAB view passed the NotShared conversion and reached [POC] ReadableByteStreamController::enqueue C++ with IsShared()==true, [POC] which performed DOMSharedArrayBuffer*->DOMArrayBuffer* sibling cast [POC] and an Oilpan OOB read of has_non_main_world_wrappers_.