Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/wtf/ArrayBufferContents.h

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 31 matching lines @@
     enum InitializationPolicy {
         ZeroInitialize,
         DontInitialize
     };
 
     enum SharingType {
         NotShared,
         Shared,
     };
 
+    enum OutOfMemoryPolicy {
+        // CrashIfOutOfMemory_DEPRECATED should never be used inside the
+        // scope of a script execution context, and is deprecated for all other
+        // uses.
+        CrashIfOutOfMemory_DEPRECATED,
+        // When using the NullDataIfOutOfMemory policy in the scope of a
+        // script context, a RangeError DOM exception must be thrown
+        // if the ArrayBufferContents' data is null (allocation failed).
+        // Spec: http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+        // However, an exception must *not* be thrown if the requested buffer size
+        // was 0 bytes, which also results in a null data pointer.
+        NullDataIfOutOfMemory,
+    };
+
     ArrayBufferContents();
-    ArrayBufferContents(unsigned numElements, unsigned elementByteSize, SharingType isShared, ArrayBufferContents::InitializationPolicy);
+    ArrayBufferContents(unsigned numElements, unsigned elementByteSize, SharingType isShared, InitializationPolicy, OutOfMemoryPolicy);
 
     // Use with care. data must be allocated with allocateMemory.
     // ArrayBufferContents will take ownership of the data and free it (using freeMemory)
     // upon destruction.
     // This constructor will not call observer->StartObserving(), so it is a responsibility
     // of the caller to make sure JS knows about external memory.
-    ArrayBufferContents(void* data, unsigned sizeInBytes, SharingType isShared);
+    ArrayBufferContents(void* data, unsigned sizeInBytes, SharingType, OutOfMemoryPolicy);
 
     ~ArrayBufferContents();
 
     void neuter();
 
     void* data() const { return m_holder ? m_holder->data() : nullptr; }
     unsigned sizeInBytes() const { return m_holder ? m_holder->sizeInBytes() : 0; }
     bool isShared() const { return m_holder ? m_holder->isShared() : false; }
 
     void transfer(ArrayBufferContents& other);
     void shareWith(ArrayBufferContents& other);
-    void copyTo(ArrayBufferContents& other);
+    void copyTo(ArrayBufferContents& other, OutOfMemoryPolicy);
 
-    static void allocateMemory(size_t, InitializationPolicy, void*&);
+    static void deprecatedAllocateMemoryOrCrash(size_t, InitializationPolicy, void*& data);
+    static void allocateMemoryOrNull(size_t, InitializationPolicy, void*& data);
     static void freeMemory(void*, size_t);
     static void setAdjustAmoutOfExternalAllocatedMemoryFunction(AdjustAmountOfExternalAllocatedMemoryFunction function)
     {
         ASSERT(!s_adjustAmountOfExternalAllocatedMemoryFunction);
         s_adjustAmountOfExternalAllocatedMemoryFunction = function;
     }
+    static void fakeOutOfMemoryForNextArrayBufferAllocation()

[binji, 2015/10/16 22:12:39]

I don't really know the coding standard for Blink, but should this include
forTesting somewhere or is fake enough?

[Justin Novosad, 2015/10/19 16:42:52]

Acknowledged.

+    {
+        s_fakeAllocationFailureForTestingOneTime = true;
+    }
 
 private:
     class DataHolder : public ThreadSafeRefCounted<DataHolder> {
         WTF_MAKE_NONCOPYABLE(DataHolder);
     public:
         DataHolder();
         ~DataHolder();
 
-        void allocateNew(unsigned sizeInBytes, SharingType isShared, InitializationPolicy);
+        void allocateNew(unsigned sizeInBytes, SharingType, InitializationPolicy, OutOfMemoryPolicy);
         void adopt(void* data, unsigned sizeInBytes, SharingType isShared);
-        void copyMemoryTo(DataHolder& other);
+        void copyMemoryTo(DataHolder& other, OutOfMemoryPolicy);
 
         void* data() const { return m_data; }
         unsigned sizeInBytes() const { return m_sizeInBytes; }
         bool isShared() const { return m_isShared == Shared; }
 
     private:
         void* m_data;
         unsigned m_sizeInBytes;
         SharingType m_isShared;
     };
 
     RefPtr<DataHolder> m_holder;
     static AdjustAmountOfExternalAllocatedMemoryFunction s_adjustAmountOfExternalAllocatedMemoryFunction;
+    static bool s_fakeAllocationFailureForTestingOneTime;
 };
 
 } // namespace WTF
 
 #endif // ArrayBufferContents_h