Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp

 /*
  * Copyright (C) 2011 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 413 matching lines @@
         setInvalidStateErrorForSendMethod(exceptionState);
         return;
     }
     if (m_state == CLOSING || m_state == CLOSED) {
         updateBufferedAmountAfterClose(arrayBufferView->byteLength());
         return;
     }
     Platform::current()->histogramEnumeration("WebCore.WebSocket.SendType", WebSocketSendTypeArrayBufferView, WebSocketSendTypeMax);
     ASSERT(m_channel);
     m_bufferedAmount += arrayBufferView->byteLength();
-    m_channel->send(*arrayBufferView->buffer(), arrayBufferView->byteOffset(), arrayBufferView->byteLength());
+    RefPtr<DOMArrayBuffer> buffer = arrayBufferView->bufferOrNull();
+    RELEASE_ASSERT(buffer); // crbug.com/536816
+    m_channel->send(*buffer, arrayBufferView->byteOffset(), arrayBufferView->byteLength());
 }
 
 void DOMWebSocket::send(Blob* binaryData, ExceptionState& exceptionState)
 {
     WTF_LOG(Network, "WebSocket %p send() Sending Blob '%s'", this, binaryData->uuid().utf8().data());
     ASSERT(binaryData);
     if (m_state == CONNECTING) {
         setInvalidStateErrorForSendMethod(exceptionState);
         return;
     }
@@ skipping 186 matching lines @@
         binaryData->swap(*rawData->mutableData());
         OwnPtr<BlobData> blobData = BlobData::create();
         blobData->appendData(rawData.release(), 0, BlobDataItem::toEndOfFile);
         Blob* blob = Blob::create(BlobDataHandle::create(blobData.release(), size));
         Platform::current()->histogramEnumeration("WebCore.WebSocket.ReceiveType", WebSocketReceiveTypeBlob, WebSocketReceiveTypeMax);
         m_eventQueue->dispatch(MessageEvent::create(blob, SecurityOrigin::create(m_url)->toString()));
         break;
     }
 
     case BinaryTypeArrayBuffer:
-        RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::create(binaryData->data(), binaryData->size());
+        // TODO(junov): crbug.com/536816
+        // Avoid crashing when out of memory by using createOrNull(). Requires
+        // determining appropriate alternate behavior for dealing with allocation
+        // failures. Should the event be droped? Should we dispatch an event

[haraken, 2015/10/29 18:58:37]

dropped

[Justin Novosad, 2015/11/05 00:17:52]

Done.

+        // with null data? Should we dispatch some kind of failure code?
+        RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::deprecatedCreateOrCrash(binaryData->data(), binaryData->size());
         Platform::current()->histogramEnumeration("WebCore.WebSocket.ReceiveType", WebSocketReceiveTypeArrayBuffer, WebSocketReceiveTypeMax);
         m_eventQueue->dispatch(MessageEvent::create(arrayBuffer.release(), SecurityOrigin::create(m_url)->toString()));
         break;
     }
 }
 
 void DOMWebSocket::didError()
 {
     WTF_LOG(Network, "WebSocket %p didError()", this);
     m_state = CLOSED;
@@ skipping 35 matching lines @@
 DEFINE_TRACE(DOMWebSocket)
 {
     visitor->trace(m_channel);
     visitor->trace(m_eventQueue);
     WebSocketChannelClient::trace(visitor);
     RefCountedGarbageCollectedEventTargetWithInlineData<DOMWebSocket>::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink