Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/push_messaging/PushMessageData.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "bindings/modules/v8/UnionTypesModules.h"
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/fileapi/Blob.h"
 #include "platform/blob/BlobData.h"
 #include "wtf/text/TextEncoding.h"
 #include <v8.h>
 
 namespace blink {
 
-PushMessageData* PushMessageData::create(const String& messageString)
+PushMessageData* PushMessageData::create(const String& messageString, ExceptionState& exceptionState)
 {
-    return PushMessageData::create(ArrayBufferOrArrayBufferViewOrUSVString::fromUSVString(messageString));
+    return PushMessageData::create(ArrayBufferOrArrayBufferViewOrUSVString::fromUSVString(messageString), exceptionState);
 }
 
-PushMessageData* PushMessageData::create(const ArrayBufferOrArrayBufferViewOrUSVString& messageData)
+PushMessageData* PushMessageData::create(const ArrayBufferOrArrayBufferViewOrUSVString& messageData, ExceptionState& exceptionState)
 {
     if (messageData.isArrayBuffer() || messageData.isArrayBufferView()) {
         RefPtr<DOMArrayBuffer> buffer = messageData.isArrayBufferView()
-            ? messageData.getAsArrayBufferView()->buffer()
+            ? messageData.getAsArrayBufferView()->bufferOrNull()
             : messageData.getAsArrayBuffer();
 
+        if (!buffer) {
+            exceptionState.throwRangeError("Out of memory. Failed to allocate array buffer for push message data.");
+            return nullptr;
+        }
         return new PushMessageData(static_cast<const char*>(buffer->data()), buffer->byteLength());
     }
 
     if (messageData.isUSVString()) {
         CString encodedString = UTF8Encoding().normalizeAndEncode(messageData.getAsUSVString(), WTF::EntitiesForUnencodables);
         return new PushMessageData(encodedString.data(), encodedString.length());
     }
 
     ASSERT(messageData.isNull());
     return new PushMessageData();
 }
 
 PushMessageData::PushMessageData()
 {
 }
 
 PushMessageData::PushMessageData(const char* data, unsigned bytesSize)
 {
     m_data.append(data, bytesSize);
 }
 
 PushMessageData::~PushMessageData()
 {
 }
 
-PassRefPtr<DOMArrayBuffer> PushMessageData::arrayBuffer() const
+PassRefPtr<DOMArrayBuffer> PushMessageData::arrayBuffer(ExceptionState& exceptionState) const
 {
-    return DOMArrayBuffer::create(m_data.data(), m_data.size());
+    RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::createOrNull(m_data.data(), m_data.size());
+    if (!buffer)
+        exceptionState.throwRangeError("Out of memory. Failed to allocate array buffer.");
+    return buffer.release();
 }
 
 Blob* PushMessageData::blob() const
 {
     OwnPtr<BlobData> blobData = BlobData::create();
     blobData->appendBytes(m_data.data(), m_data.size());
 
     // Note that the content type of the Blob object is deliberately not being
     // provided, following the specification.
 
@@ skipping 21 matching lines @@
 String PushMessageData::text() const
 {
     return UTF8Encoding().decode(m_data.data(), m_data.size());
 }
 
 DEFINE_TRACE(PushMessageData)
 {
 }
 
 } // namespace blink