Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/bindings/core/v8/ScriptValueSerializer.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "bindings/core/v8/ScriptValueSerializer.h"
 
 #include "bindings/core/v8/V8ArrayBuffer.h"
 #include "bindings/core/v8/V8ArrayBufferView.h"
 #include "bindings/core/v8/V8Blob.h"
@@ skipping 233 matching lines @@
 void SerializedScriptValueWriter::writeArrayBuffer(const DOMArrayBuffer& arrayBuffer)
 {
     append(ArrayBufferTag);
     doWriteArrayBuffer(arrayBuffer);
 }
 
 void SerializedScriptValueWriter::writeArrayBufferView(const DOMArrayBufferView& arrayBufferView)
 {
     append(ArrayBufferViewTag);
 #if ENABLE(ASSERT)
-    ASSERT(static_cast<const uint8_t*>(arrayBufferView.bufferBase()->data()) + arrayBufferView.byteOffset() ==
-        static_cast<const uint8_t*>(arrayBufferView.baseAddress()));
+    {
+        ReftPtr<DOMArrayBuffer> buffer = arrayBufferView.bufferBaseOrNull();
+        ASSERT(buffer);
+        ASSERT(static_cast<const uint8_t*>(buffer->data()) + arrayBufferView.byteOffset() ==
+            static_cast<const uint8_t*>(arrayBufferView.baseAddress()));
+    }
 #endif
     DOMArrayBufferView::ViewType type = arrayBufferView.type();
 
     switch (type) {
     case DOMArrayBufferView::TypeInt8:
         append(ByteArrayTag);
         break;
     case DOMArrayBufferView::TypeUint8Clamped:
         append(UnsignedByteClampedArrayTag);
         break;
@@ skipping 703 matching lines @@
 {
     v8::Local<v8::RegExp> regExp = value.As<v8::RegExp>();
     m_writer.writeRegExp(regExp->GetSource(), regExp->GetFlags());
 }
 
 ScriptValueSerializer::StateBase* ScriptValueSerializer::writeAndGreyArrayBufferView(v8::Local<v8::Object> object, ScriptValueSerializer::StateBase* next)
 {
     ASSERT(!object.IsEmpty());
     DOMArrayBufferView* arrayBufferView = V8ArrayBufferView::toImpl(object);
     if (!arrayBufferView)
-        return 0;
+        return nullptr;
     if (!arrayBufferView->bufferBase())
         return handleError(DataCloneError, "An ArrayBuffer could not be cloned.", next);
     v8::Local<v8::Value> underlyingBuffer = toV8(arrayBufferView->bufferBase(), m_scriptState->context()->Global(), isolate());
     if (underlyingBuffer.IsEmpty())
         return handleError(DataCloneError, "An ArrayBuffer could not be cloned.", next);
     StateBase* stateOut = doSerializeArrayBuffer(underlyingBuffer, next);
     if (stateOut)
         return stateOut;
     m_writer.writeArrayBufferView(*arrayBufferView);
     // This should be safe: we serialize something that we know to be a wrapper (see
@@ skipping 535 matching lines @@
     uint32_t height;
     uint32_t pixelDataLength;
     if (!doReadUint32(&width))
         return false;
     if (!doReadUint32(&height))
         return false;
     if (!doReadUint32(&pixelDataLength))
         return false;
     if (m_position + pixelDataLength > m_length)
         return false;
-    ImageData* imageData = ImageData::create(IntSize(width, height));
+    // TODO(junov): crbug.com/536816
+    // Here we use a NonThorwableExceptionState in order to fail silently
+    // when ImageData allocation fails. It needs to be ascertained whether
+    // the call sites that depend on value deserialization agree with
+    // re-throwing a RangeError exception from here, which is what happens
+    // when the ArrayBuffer encapsulated in the ImageData fails to be
+    // allocated, as per the ECMAScript spec:
+    // http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+    // Before we decide to propagate the exception down to the script
+    // execution context, all the APIs that depend on this routine would
+    // need to have specifications stating that exceptions thrown by sub
+    // routines involved in the deserialization process are re-thrown.
+    NonThrowableExceptionState exceptionState;
+    ImageData* imageData = ImageData::create(IntSize(width, height), exceptionState);
+    if (exceptionState.hadException())
+        return false;
     DOMUint8ClampedArray* pixelArray = imageData->data();
     ASSERT(pixelArray);
     ASSERT(pixelArray->length() >= pixelDataLength);
     memcpy(pixelArray->data(), m_buffer + m_position, pixelDataLength);
     m_position += pixelDataLength;
     *value = toV8(imageData, m_scriptState->context()->Global(), isolate());
     return !value->IsEmpty();
 }
 
 bool SerializedScriptValueReader::readCompositorProxy(v8::Local<v8::Value>* value)
@@ skipping 12 matching lines @@
 
 PassRefPtr<DOMArrayBuffer> SerializedScriptValueReader::doReadArrayBuffer()
 {
     uint32_t byteLength;
     if (!doReadUint32(&byteLength))
         return nullptr;
     if (m_position + byteLength > m_length)
         return nullptr;
     const void* bufferStart = m_buffer + m_position;
     m_position += byteLength;
-    return DOMArrayBuffer::create(bufferStart, byteLength);
+    // TODO(junov): crbug.com/536816
+    // Should use createOrNull to avoid crashing.
+    // To do that, we need to make sure that call sites of readArrayBuffer
+    // would react correctly in this case, with 'value' not having been set.
+    return DOMArrayBuffer::deprecatedCreateOrCrash(bufferStart, byteLength);
 }
 
 bool SerializedScriptValueReader::readArrayBuffer(v8::Local<v8::Value>* value)
 {
     RefPtr<DOMArrayBuffer> arrayBuffer = doReadArrayBuffer();
-    if (!arrayBuffer)
-        return false;
     *value = toV8(arrayBuffer.release(), m_scriptState->context()->Global(), isolate());
     return !value->IsEmpty();
 }
 
 bool SerializedScriptValueReader::readArrayBufferView(v8::Local<v8::Value>* value, ScriptValueCompositeCreator& creator)
 {
     ArrayBufferViewSubTag subTag;
     uint32_t byteOffset;
     uint32_t byteLength;
     RefPtr<DOMArrayBufferBase> arrayBuffer;
@@ skipping 571 matching lines @@
         return false;
     uint32_t objectReference = m_openCompositeReferenceStack[m_openCompositeReferenceStack.size() - 1];
     m_openCompositeReferenceStack.shrink(m_openCompositeReferenceStack.size() - 1);
     if (objectReference >= m_objectPool.size())
         return false;
     *object = m_objectPool[objectReference];
     return true;
 }
 
 } // namespace blink