Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/dom/DOMTypedArray.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef DOMTypedArray_h
 #define DOMTypedArray_h
 
 #include "bindings/core/v8/ScriptWrappable.h"
 #include "core/CoreExport.h"
 #include "core/dom/DOMArrayBufferView.h"
@@ skipping 11 matching lines @@
 
 namespace blink {
 
 template<typename WTFTypedArray, typename V8TypedArray>
 class CORE_TEMPLATE_CLASS_EXPORT DOMTypedArray final : public DOMArrayBufferView {
     typedef DOMTypedArray<WTFTypedArray, V8TypedArray> ThisType;
     DECLARE_WRAPPERTYPEINFO();
 public:
     typedef typename WTFTypedArray::ValueType ValueType;
 
+    static PassRefPtr<ThisType> createOrNull(PassRefPtr<WTFTypedArray> bufferView)
+    {
+        if (!bufferView)
+            return nullptr;
+        return adoptRef(new ThisType(bufferView));
+    }
     static PassRefPtr<ThisType> create(PassRefPtr<WTFTypedArray> bufferView)
     {
+        RELEASE_ASSERT(bufferView);
         return adoptRef(new ThisType(bufferView));
     }
-    static PassRefPtr<ThisType> create(unsigned length)
+    static PassRefPtr<ThisType> createOrNull(const ValueType* array, unsigned length)
     {
-        return create(WTFTypedArray::create(length));
+        return createOrNull(WTFTypedArray::createOrNull(array, length));
     }
-    static PassRefPtr<ThisType> create(const ValueType* array, unsigned length)
+    static PassRefPtr<ThisType> deprecatedCreateOrCrash(const ValueType* array, unsigned length)
     {
-        return create(WTFTypedArray::create(array, length));
+        return create(WTFTypedArray::deprecatedCreateOrCrash(array, length));
     }
     static PassRefPtr<ThisType> create(PassRefPtr<WTF::ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
     {
         return create(WTFTypedArray::create(buffer, byteOffset, length));
     }
     static PassRefPtr<ThisType> create(PassRefPtr<DOMArrayBufferBase> prpBuffer, unsigned byteOffset, unsigned length)
     {
         RefPtr<DOMArrayBufferBase> buffer = prpBuffer;
         RefPtr<WTFTypedArray> bufferView = WTFTypedArray::create(buffer->buffer(), byteOffset, length);
         return adoptRef(new ThisType(bufferView.release(), buffer.release()));
     }
 
     static PassRefPtr<ThisType> createOrNull(unsigned length)
     {
         RefPtr<WTF::ArrayBuffer> buffer = WTF::ArrayBuffer::createOrNull(length, 1);
         return buffer ? create(buffer.release(), 0, length) : nullptr;
     }
 
+    static PassRefPtr<ThisType> deprecatedCreateOrCrash(unsigned length)
+    {
+        RefPtr<WTF::ArrayBuffer> buffer = WTF::ArrayBuffer::deprecatedCreateOrCrash(length, 1);

[binji, 2015/10/16 22:12:39]

what is the 1 here? Ah, element size.

Seems weird that length is byteLength, not number of elements. Maybe the naming
is just unclear.

[Justin Novosad, 2015/10/19 16:42:52]

Acknowledged.

+        ASSERT(buffer);
+        return create(buffer.release(), 0, length);
+    }
+
     const WTFTypedArray* view() const { return static_cast<const WTFTypedArray*>(DOMArrayBufferView::view()); }
     WTFTypedArray* view() { return static_cast<WTFTypedArray*>(DOMArrayBufferView::view()); }
 
     ValueType* data() const { return view()->data(); }
     unsigned length() const { return view()->length(); }
     // Invoked by the indexed getter. Does not perform range checks; caller
     // is responsible for doing so and returning undefined as necessary.
     ValueType item(unsigned index) const { return view()->item(index); }
 
     v8::Local<v8::Object> wrap(v8::Isolate*, v8::Local<v8::Object> creationContext) override;
@@ skipping 21 matching lines @@
 typedef DOMTypedArray<WTF::Uint8Array, v8::Uint8Array> DOMUint8Array;
 typedef DOMTypedArray<WTF::Uint8ClampedArray, v8::Uint8ClampedArray> DOMUint8ClampedArray;
 typedef DOMTypedArray<WTF::Uint16Array, v8::Uint16Array> DOMUint16Array;
 typedef DOMTypedArray<WTF::Uint32Array, v8::Uint32Array> DOMUint32Array;
 typedef DOMTypedArray<WTF::Float32Array, v8::Float32Array> DOMFloat32Array;
 typedef DOMTypedArray<WTF::Float64Array, v8::Float64Array> DOMFloat64Array;
 
 } // namespace blink
 
 #endif // DOMTypedArray_h