Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/wtf/ArrayBufferBuilder.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 21 matching lines @@
 #define ArrayBufferBuilder_h
 
 #include "wtf/ArrayBuffer.h"
 #include "wtf/Noncopyable.h"
 #include "wtf/RefPtr.h"
 #include "wtf/text/WTFString.h"
 
 namespace WTF {
 
 // A utility class to build an ArrayBuffer instance. Validity must be checked
 // by isValid() before using an instance.

[binji, 2015/10/16 22:12:39]

hm, seems like a potentially dangerous interface. Where is this used?

[Justin Novosad, 2015/10/19 16:42:52]

Potentially, but did you notice the 'isValid()' method below? This class was
designed with the possibility of an alloc failure in mind. I see isValid being
called in many places. I am going to add some asserts to make sure we never
access m_buffer when !isValid.

 class WTF_EXPORT ArrayBufferBuilder {
     // Disallow copying since it's expensive and we don't want code to do it by
     // accident.
     WTF_MAKE_NONCOPYABLE(ArrayBufferBuilder);
 
 public:
     // Creates an ArrayBufferBuilder using the default capacity.
     ArrayBufferBuilder();
 
     ArrayBufferBuilder(unsigned capacity)
         : m_bytesUsed(0)
         , m_variableCapacity(true)
     {
-        m_buffer = ArrayBuffer::create(capacity, 1);
+        m_buffer = ArrayBuffer::createOrNull(capacity, 1);
     }
 
     bool isValid() const
     {
         return m_buffer;
     }
 
     // Appending empty data is not allowed.
     unsigned append(const char* data, unsigned length);
 
@@ skipping 41 matching lines @@
     unsigned m_bytesUsed;
     bool m_variableCapacity;
     RefPtr<ArrayBuffer> m_buffer;
 };
 
 } // namespace WTF
 
 using WTF::ArrayBufferBuilder;
 
 #endif // ArrayBufferBuilder_h