Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp

Index: third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp
diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp b/third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp
index 011ddadef6d79bb5e181d30930495d8824bd4920..cdfa490f888dfb4121dd855c4ce676e85c7e8553 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp
@@ -80,7 +80,14 @@ public:
     void didReceiveData() override { }
     void didFinishLoading() override
     {
-        m_PresentationConnection->didFinishLoadingBlob(m_loader.arrayBufferResult());
+        RefPtr<DOMArrayBuffer> result = m_loader.arrayBufferResultOrNull();
+        // TODO(junov): crbug.com/536816
+        // Is there a better way to handle an allocation failure instead
+        // of crashing? Would it be okay to fail silently by passing a nullptr?
+        // Should we call didFailLoadingBlob? If so, with which ErrorCode?
+        // Spec may need to be ammended for this.
+        RELEASE_ASSERT(result); // This is essentially an out-of-memory crash.
+        m_PresentationConnection->didFinishLoadingBlob(result.release());
     }
     void didFail(FileError::ErrorCode errorCode) override
     {
@@ -207,7 +214,9 @@ void PresentationConnection::send(PassRefPtr<DOMArrayBufferView> arrayBufferView
     if (!canSendMessage(exceptionState))
         return;
 
-    m_messages.append(adoptPtr(new Message(arrayBufferView->buffer())));
+    RefPtr<DOMArrayBuffer> buffer = arrayBufferView->bufferOrNull();
+    RELEASE_ASSERT(buffer); // crbug.com/536816

[haraken, 2015/10/29 18:58:37]

Another idea would be to create bufferOrCrash(). Then you don't need to write
RELEASE_ASSERT in the caller site.

[Justin Novosad, 2015/11/05 00:17:52]

This bit of code was reverted. Getting a buffer out of a bufferview does not
fail.

+    m_messages.append(adoptPtr(new Message(buffer)));
     handleMessageQueue();
 }
 
@@ -304,9 +313,14 @@ void PresentationConnection::didReceiveBinaryMessage(const uint8_t* data, size_t
         return;
     }
     case BinaryTypeArrayBuffer:
-        RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::create(data, length);
+        // TODO(junov): crbug.com/536816
+        // Use createOrNull instead of deprecatedCReateOrCrash. Requires
+        // determing an accepatble alternative to crashing when buffer

[haraken, 2015/10/29 18:58:37]

determining an acceptable

[Justin Novosad, 2015/11/05 00:17:52]

Done.

+        // allocation fails. Should we just drop the event? Dispatch
+        // an event with null data? Dispatch some kind of error code?
+        // Behavior needs to be defined in the spec.
+        RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::deprecatedCreateOrCrash(data, length);
         dispatchEvent(MessageEvent::create(buffer.release()));
-        return;
     }
     ASSERT_NOT_REACHED();
 }