Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 133 matching lines @@
 AudioBuffer::AudioBuffer(unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
     : m_sampleRate(sampleRate)
     , m_length(numberOfFrames)
 {
     m_channels.reserveCapacity(numberOfChannels);
 
     for (unsigned i = 0; i < numberOfChannels; ++i) {
         RefPtr<DOMFloat32Array> channelDataArray = createFloat32ArrayOrNull(m_length);
         // If the channel data array could not be created, just return. The caller will need to
         // check that the desired number of channels were created.
+
+        // FIXME(crbug.com/536816): According to ECMAScript spec, failure to allocate should result in a
+        // RangeError exception being thrown: http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+        // The spec for createBuffer does not specify whether such an exception should be
+        // re-thrown.
         if (!channelDataArray) {
             return;
         }
 
         channelDataArray->setNeuterable(false);
         m_channels.append(channelDataArray);
     }
 }
 
 AudioBuffer::AudioBuffer(AudioBus* bus)
     : m_sampleRate(bus->sampleRate())
     , m_length(bus->length())
 {
     // Copy audio data from the bus to the Float32Arrays we manage.
     unsigned numberOfChannels = bus->numberOfChannels();
     m_channels.reserveCapacity(numberOfChannels);
     for (unsigned i = 0; i < numberOfChannels; ++i) {
         RefPtr<DOMFloat32Array> channelDataArray = createFloat32ArrayOrNull(m_length);
         // If the channel data array could not be created, just return. The caller will need to
         // check that the desired number of channels were created.
+
+        // FIXME(crbug.com/536816): According to ECMAScript spec, failure to allocate should result in a
+        // RangeError exception being thrown: http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
         if (!channelDataArray)
             return;
 
         channelDataArray->setNeuterable(false);
         const float* src = bus->channel(i)->data();
         float* dst = channelDataArray->data();
         memmove(dst, src, m_length * sizeof(*dst));
         m_channels.append(channelDataArray);
     }
 }
 
 PassRefPtr<DOMFloat32Array> AudioBuffer::getChannelData(unsigned channelIndex, ExceptionState& exceptionState)
 {
     if (channelIndex >= m_channels.size()) {
         exceptionState.throwDOMException(IndexSizeError, "channel index (" + String::number(channelIndex) + ") exceeds number of channels (" + String::number(m_channels.size()) + ")");
         return nullptr;
     }
 
     DOMFloat32Array* channelData = m_channels[channelIndex].get();
-    return DOMFloat32Array::create(channelData->buffer(), channelData->byteOffset(), channelData->length());
+    RefPtr<DOMArrayBuffer> buffer = channelData->bufferOrNull();
+    RELEASE_ASSERT(buffer); // crbug.com/536816
+    return DOMFloat32Array::create(buffer.release(), channelData->byteOffset(), channelData->length());
 }
 
 DOMFloat32Array* AudioBuffer::getChannelData(unsigned channelIndex)
 {
     if (channelIndex >= m_channels.size())
         return nullptr;
 
     return m_channels[channelIndex].get();
 }
 
@@ skipping 117 matching lines @@
         if (DOMFloat32Array* array = getChannelData(i)) {
             float* data = array->data();
             memset(data, 0, length() * sizeof(*data));
         }
     }
 }
 
 } // namespace blink
 
 #endif // ENABLE(WEB_AUDIO)