Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/presentation/PresentationConnection.h"
 
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/dom/DOMArrayBufferView.h"
@@ skipping 185 matching lines @@
     ASSERT(arrayBuffer && arrayBuffer->buffer());
     if (!canSendMessage(exceptionState))
         return;
 
     m_messages.append(adoptPtr(new Message(arrayBuffer)));
     handleMessageQueue();
 }
 
 void PresentationConnection::send(PassRefPtr<DOMArrayBufferView> arrayBufferView, ExceptionState& exceptionState)
 {
-    ASSERT(arrayBufferView);
+    ASSERT(arrayBufferView && arrayBufferView->bufferOrNull());
     if (!canSendMessage(exceptionState))
         return;
 
-    m_messages.append(adoptPtr(new Message(arrayBufferView->buffer())));
+    m_messages.append(adoptPtr(new Message(arrayBufferView->bufferOrNull())));
     handleMessageQueue();
 }
 
 void PresentationConnection::send(Blob* data, ExceptionState& exceptionState)
 {
     ASSERT(data);
     if (!canSendMessage(exceptionState))
         return;
 
     m_messages.append(adoptPtr(new Message(data->blobDataHandle())));
@@ skipping 76 matching lines @@
 
     switch (m_binaryType) {
     case BinaryTypeBlob: {
         OwnPtr<BlobData> blobData = BlobData::create();
         blobData->appendBytes(data, length);
         Blob* blob = Blob::create(BlobDataHandle::create(blobData.release(), length));
         dispatchEvent(MessageEvent::create(blob));
         return;
     }
     case BinaryTypeArrayBuffer:
-        RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::create(data, length);
-        dispatchEvent(MessageEvent::create(buffer.release()));
-        return;
+        RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::createOrNull(data, length);
+        // Can't throw a RangeError exception from here, so being out
+        // of memory will fail silently by dropping the message.
+        if (buffer)
+            dispatchEvent(MessageEvent::create(buffer.release()));
     }
     ASSERT_NOT_REACHED();
 }
 
 void PresentationConnection::close()
 {
     if (m_state != WebPresentationConnectionState::Connected)
         return;
     WebPresentationClient* client = presentationClient(executionContext());
     if (client)
@@ skipping 42 matching lines @@
 {
     ASSERT(!m_messages.isEmpty() && m_messages.first()->type == MessageTypeBlob);
     // FIXME: generate error message?
     // Ignore the current failed blob item and continue with next items.
     m_messages.removeFirst();
     m_blobLoader.clear();
     handleMessageQueue();
 }
 
 } // namespace blink