Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(735)

Unified Diff: third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp

Issue 1414553002: Fix out-of-memory crashes related to ArrayBuffer allocation Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: rebase+more tweaks Created 5 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
index 1a41d80a393e63a7ad5781cc2092424115d7dc9e..5e5713c36c4ae18f2393c9281defcebb8feeaebb 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
@@ -434,7 +434,12 @@ ScriptPromise MediaKeySession::generateRequest(ScriptState* scriptState, const S
}
// 6. Let init data be a copy of the contents of the initData parameter.
- RefPtr<DOMArrayBuffer> initDataBuffer = DOMArrayBuffer::create(initData.data(), initData.byteLength());
+ // TODO(junov): crbug.com/536816
+ // Use createOrNull instead of deprecatedCreateOrCrash. It would probably
+ // be appropriate to reject the promise with a RangeError exception when
+ // array buffer allocation fails, but that behavior probably needs
+ // clarification in the spec.
+ RefPtr<DOMArrayBuffer> initDataBuffer = DOMArrayBuffer::deprecatedCreateOrCrash(initData.data(), initData.byteLength());
// 7. Let session type be this object's session type.
// (Done in constructor.)
@@ -529,7 +534,12 @@ ScriptPromise MediaKeySession::update(ScriptState* scriptState, const DOMArrayPi
}
// 3. Let response copy be a copy of the contents of the response parameter.
- RefPtr<DOMArrayBuffer> responseCopy = DOMArrayBuffer::create(response.data(), response.byteLength());
+ // TODO(junov): crbug.com/536816
+ // Use createOrNull instead of deprecatedCreateOrCrash. It would probably
+ // be appropriate to reject the promise with a RangeError exception when
+ // array buffer allocation fails, but that behavior probably needs
+ // clarification in the spec.
+ RefPtr<DOMArrayBuffer> responseCopy = DOMArrayBuffer::deprecatedCreateOrCrash(response.data(), response.byteLength());
// 4. Let promise be a new promise.
SimpleContentDecryptionModuleResultPromise* result = new SimpleContentDecryptionModuleResultPromise(scriptState);
@@ -800,7 +810,7 @@ void MediaKeySession::message(MessageType messageType, const unsigned char* mess
init.setMessageType("license-release");
break;
}
- init.setMessage(DOMArrayBuffer::create(static_cast<const void*>(message), messageLength));
+ init.setMessage(DOMArrayBuffer::deprecatedCreateOrCrash(static_cast<const void*>(message), messageLength));
RefPtrWillBeRawPtr<MediaKeyMessageEvent> event = MediaKeyMessageEvent::create(EventTypeNames::message, init);
event->setTarget(this);

Powered by Google App Engine
This is Rietveld 408576698