Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/wtf/ArrayBufferContents.h

Index: third_party/WebKit/Source/wtf/ArrayBufferContents.h
diff --git a/third_party/WebKit/Source/wtf/ArrayBufferContents.h b/third_party/WebKit/Source/wtf/ArrayBufferContents.h
index d5b4fc304c7beb60549620322c4e9517f9c22962..0f0b09147723037967d42a8c19653c94a2b50656 100644
--- a/third_party/WebKit/Source/wtf/ArrayBufferContents.h
+++ b/third_party/WebKit/Source/wtf/ArrayBufferContents.h
@@ -49,15 +49,29 @@ public:
         Shared,
     };
 
+    enum OutOfMemoryPolicy {
+        // CrashIfOutOfMemory_DEPRECATED should never be used inside the
+        // scope of a script execution context, and is deprecated for all other
+        // uses.
+        CrashIfOutOfMemory_DEPRECATED,
+        // When using the NullDataIfOutOfMemory policy in the scope of a
+        // script context, a RangeError DOM exception must be thrown
+        // if the ArrayBufferContents' data is null (allocation failed).
+        // Spec: http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+        // However, an exception must *not* be thrown if the requested buffer size
+        // was 0 bytes, which also results in a null data pointer.
+        NullDataIfOutOfMemory,
+    };
+
     ArrayBufferContents();
-    ArrayBufferContents(unsigned numElements, unsigned elementByteSize, SharingType isShared, ArrayBufferContents::InitializationPolicy);
+    ArrayBufferContents(unsigned numElements, unsigned elementByteSize, SharingType isShared, InitializationPolicy, OutOfMemoryPolicy);
 
     // Use with care. data must be allocated with allocateMemory.
     // ArrayBufferContents will take ownership of the data and free it (using freeMemory)
     // upon destruction.
     // This constructor will not call observer->StartObserving(), so it is a responsibility
     // of the caller to make sure JS knows about external memory.
-    ArrayBufferContents(void* data, unsigned sizeInBytes, SharingType isShared);
+    ArrayBufferContents(void* data, unsigned sizeInBytes, SharingType, OutOfMemoryPolicy);
 
     ~ArrayBufferContents();
 
@@ -69,15 +83,20 @@ public:
 
     void transfer(ArrayBufferContents& other);
     void shareWith(ArrayBufferContents& other);
-    void copyTo(ArrayBufferContents& other);
+    void copyTo(ArrayBufferContents& other, OutOfMemoryPolicy);
 
-    static void allocateMemory(size_t, InitializationPolicy, void*&);
+    static void deprecatedAllocateMemoryOrCrash(size_t, InitializationPolicy, void*& data);
+    static void allocateMemoryOrNull(size_t, InitializationPolicy, void*& data);
     static void freeMemory(void*, size_t);
     static void setAdjustAmoutOfExternalAllocatedMemoryFunction(AdjustAmountOfExternalAllocatedMemoryFunction function)
     {
         ASSERT(!s_adjustAmountOfExternalAllocatedMemoryFunction);
         s_adjustAmountOfExternalAllocatedMemoryFunction = function;
     }
+    static void fakeOutOfMemoryForNextArrayBufferAllocationForTesting()
+    {
+        s_fakeAllocationFailureForTestingOneTime = true;
+    }
 
 private:
     class DataHolder : public ThreadSafeRefCounted<DataHolder> {
@@ -86,9 +105,9 @@ private:
         DataHolder();
         ~DataHolder();
 
-        void allocateNew(unsigned sizeInBytes, SharingType isShared, InitializationPolicy);
+        void allocateNew(unsigned sizeInBytes, SharingType, InitializationPolicy, OutOfMemoryPolicy);
         void adopt(void* data, unsigned sizeInBytes, SharingType isShared);
-        void copyMemoryTo(DataHolder& other);
+        void copyMemoryTo(DataHolder& other, OutOfMemoryPolicy);
 
         void* data() const { return m_data; }
         unsigned sizeInBytes() const { return m_sizeInBytes; }
@@ -102,6 +121,7 @@ private:
 
     RefPtr<DataHolder> m_holder;
     static AdjustAmountOfExternalAllocatedMemoryFunction s_adjustAmountOfExternalAllocatedMemoryFunction;
+    static bool s_fakeAllocationFailureForTestingOneTime;
 };
 
 } // namespace WTF