Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 24 matching lines @@
 #include <limits>
 
 namespace WTF {
 
 static const int defaultBufferCapacity = 32768;
 
 ArrayBufferBuilder::ArrayBufferBuilder()
     : m_bytesUsed(0)
     , m_variableCapacity(true)
 {
-    m_buffer = ArrayBuffer::create(defaultBufferCapacity, 1);
+    m_buffer = ArrayBuffer::createOrNull(defaultBufferCapacity, 1);
 }
 
 bool ArrayBufferBuilder::expandCapacity(unsigned sizeToIncrease)
 {
+    ASSERT(isValid());
     unsigned currentBufferSize = m_buffer->byteLength();
 
     // If the size of the buffer exceeds max of unsigned, it can't be grown any
     // more.
     if (sizeToIncrease > std::numeric_limits<unsigned>::max() - m_bytesUsed)
         return false;
 
     unsigned newBufferSize = m_bytesUsed + sizeToIncrease;
 
     // Grow exponentially if possible.
     unsigned exponentialGrowthNewBufferSize = std::numeric_limits<unsigned>::max();
     if (currentBufferSize <= std::numeric_limits<unsigned>::max() / 2)
         exponentialGrowthNewBufferSize = currentBufferSize * 2;
     if (exponentialGrowthNewBufferSize > newBufferSize)
         newBufferSize = exponentialGrowthNewBufferSize;
 
     // Copy existing data in current buffer to new buffer.
-    RefPtr<ArrayBuffer> newBuffer = ArrayBuffer::create(newBufferSize, 1);
+    RefPtr<ArrayBuffer> newBuffer = ArrayBuffer::createOrNull(newBufferSize, 1);
     if (!newBuffer)
         return false;
 
     memcpy(newBuffer->data(), m_buffer->data(), m_bytesUsed);
     m_buffer = newBuffer;
     return true;
 }
 
 unsigned ArrayBufferBuilder::append(const char* data, unsigned length)
 {
+    ASSERT(isValid());
     ASSERT(length > 0);
 
     unsigned currentBufferSize = m_buffer->byteLength();
 
     ASSERT(m_bytesUsed <= currentBufferSize);
 
     unsigned remainingBufferSpace = currentBufferSize - m_bytesUsed;
 
     unsigned bytesToSave = length;
 
     if (length > remainingBufferSpace) {
         if (m_variableCapacity) {
             if (!expandCapacity(length))
                 return 0;
         } else {
             bytesToSave = remainingBufferSpace;
         }
     }
 
     memcpy(static_cast<char*>(m_buffer->data()) + m_bytesUsed, data, bytesToSave);
     m_bytesUsed += bytesToSave;
 
     return bytesToSave;
 }
 
 PassRefPtr<ArrayBuffer> ArrayBufferBuilder::toArrayBuffer()
 {
+    ASSERT(isValid());
     // Fully used. Return m_buffer as-is.
     if (m_buffer->byteLength() == m_bytesUsed)
         return m_buffer;
 
-    return m_buffer->slice(0, m_bytesUsed);
+    RefPtr<ArrayBuffer> tmp = m_buffer->sliceOrNull(0, m_bytesUsed);
+    if (tmp)
+        return tmp;
+    return m_buffer;
 }
 
 String ArrayBufferBuilder::toString()
 {
+    ASSERT(isValid());
     return String(static_cast<const char*>(m_buffer->data()), m_bytesUsed);
 }
 
 void ArrayBufferBuilder::shrinkToFit()
 {
+    ASSERT(isValid());
     ASSERT(m_bytesUsed <= m_buffer->byteLength());
 
-    if (m_buffer->byteLength() > m_bytesUsed)
-        m_buffer = m_buffer->slice(0, m_bytesUsed);
+    if (m_buffer->byteLength() > m_bytesUsed) {
+        RefPtr<ArrayBuffer> tmp = m_buffer->sliceOrNull(0, m_bytesUsed);
+        if (tmp)
+            m_buffer = tmp;
+    }
 }
 
 } // namespace WTF