Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/webgl/WebGL2RenderingContextBase.h"
 
 #include "bindings/modules/v8/WebGLAny.h"
 #include "core/html/HTMLCanvasElement.h"
 #include "core/html/HTMLImageElement.h"
@@ skipping 315 matching lines @@
     case GL_RG16I:
     case GL_RG32UI:
     case GL_RG32I:
     case GL_RGBA8UI:
     case GL_RGBA8I:
     case GL_RGB10_A2UI:
     case GL_RGBA16UI:
     case GL_RGBA16I:
     case GL_RGBA32UI:
     case GL_RGBA32I:
-        return WebGLAny(scriptState, DOMInt32Array::create(0));
+        return WebGLAny(scriptState, DOMInt32Array::deprecatedCreateOrCrash(nullptr, 0));
     case GL_R8:
     case GL_RG8:
     case GL_RGB8:
     case GL_RGB565:
     case GL_RGBA8:
     case GL_SRGB8_ALPHA8:
     case GL_RGB5_A1:
     case GL_RGBA4:
     case GL_RGB10_A2:
     case GL_DEPTH_COMPONENT16:
     case GL_DEPTH_COMPONENT24:
     case GL_DEPTH_COMPONENT32F:
     case GL_DEPTH24_STENCIL8:
     case GL_DEPTH32F_STENCIL8:
     case GL_STENCIL_INDEX8:
         break;
     default:
         synthesizeGLError(GL_INVALID_ENUM, "getInternalformatParameter", "invalid internalformat");
         return ScriptValue::createNull(scriptState);
     }
 
     switch (pname) {
     case GL_SAMPLES:
         {
             GLint length = -1;
             webContext()->getInternalformativ(target, internalformat, GL_NUM_SAMPLE_COUNTS, 1, &length);
             if (length <= 0)
-                return WebGLAny(scriptState, DOMInt32Array::create(0));
+                return WebGLAny(scriptState, DOMInt32Array::deprecatedCreateOrCrash(nullptr, 0));
 
             OwnPtr<GLint[]> values = adoptArrayPtr(new GLint[length]);
             for (GLint ii = 0; ii < length; ++ii)
                 values[ii] = 0;
             webContext()->getInternalformativ(target, internalformat, GL_SAMPLES, length, values.get());
-            return WebGLAny(scriptState, DOMInt32Array::create(values.get(), length));
+            RefPtr<DOMInt32Array> valueArray = DOMInt32Array::deprecatedCreateOrCrash(values.get(), length);
+            return WebGLAny(scriptState, valueArray.release());
         }
     default:
         synthesizeGLError(GL_INVALID_ENUM, "getInternalformatParameter", "invalid parameter name");
         return ScriptValue::createNull(scriptState);
     }
 }
 
 void WebGL2RenderingContextBase::invalidateFramebuffer(GLenum target, Vector<GLenum>& attachments)
 {
     if (isContextLost())
@@ skipping 1741 matching lines @@
             webContext()->getActiveUniformBlockiv(objectOrZero(program), uniformBlockIndex, pname, &intValue);
             return WebGLAny(scriptState, static_cast<unsigned>(intValue));
         }
     case GL_UNIFORM_BLOCK_ACTIVE_UNIFORM_INDICES:
         {
             GLint uniformCount = 0;
             webContext()->getActiveUniformBlockiv(objectOrZero(program), uniformBlockIndex, GL_UNIFORM_BLOCK_ACTIVE_UNIFORMS, &uniformCount);
 
             Vector<GLint> indices(uniformCount);
             webContext()->getActiveUniformBlockiv(objectOrZero(program), uniformBlockIndex, pname, indices.data());
-            return WebGLAny(scriptState, DOMUint32Array::create(reinterpret_cast<GLuint*>(indices.data()), indices.size()));
+            // TODO(junov): crbug.com/536816
+            // We should consider throwing a RangeError exception instead
+            // of crashing when array allocation fails. Doing so may require
+            // amending the WebGL specification.
+            return WebGLAny(scriptState, DOMUint32Array::deprecatedCreateOrCrash(reinterpret_cast<GLuint*>(indices.data()), indices.size()));
         }
     case GL_UNIFORM_BLOCK_REFERENCED_BY_VERTEX_SHADER:
     case GL_UNIFORM_BLOCK_REFERENCED_BY_FRAGMENT_SHADER:
         {
             GLint boolValue = 0;
             webContext()->getActiveUniformBlockiv(objectOrZero(program), uniformBlockIndex, pname, &boolValue);
             return WebGLAny(scriptState, static_cast<bool>(boolValue));
         }
     default:
         synthesizeGLError(GL_INVALID_ENUM, "getActiveUniformBlockParameter", "invalid parameter name");
@@ skipping 928 matching lines @@
 GLenum WebGL2RenderingContextBase::boundFramebufferColorFormat()
 {
     if (m_readFramebufferBinding && m_readFramebufferBinding->object())
         return m_readFramebufferBinding->colorBufferFormat();
     if (m_requestedAttributes.alpha())
         return GL_RGBA;
     return GL_RGB;
 }
 
 } // namespace blink