Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp

Index: third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp
diff --git a/third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp b/third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp
index 00b41011c1a4a635e19d3bd5bc174438560672a7..a8a7b9fade170c9ebf283afda3c09a04ef8914c6 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp
+++ b/third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp
@@ -17,18 +17,25 @@
 
 namespace blink {
 
-PushMessageData* PushMessageData::create(const String& messageString)
+PushMessageData* PushMessageData::create(const String& messageString, ExceptionState& exceptionState)
 {
-    return PushMessageData::create(ArrayBufferOrArrayBufferViewOrUSVString::fromUSVString(messageString));
+    return PushMessageData::create(ArrayBufferOrArrayBufferViewOrUSVString::fromUSVString(messageString), exceptionState);
 }
 
-PushMessageData* PushMessageData::create(const ArrayBufferOrArrayBufferViewOrUSVString& messageData)
+PushMessageData* PushMessageData::create(const ArrayBufferOrArrayBufferViewOrUSVString& messageData, ExceptionState& exceptionState)
 {
     if (messageData.isArrayBuffer() || messageData.isArrayBufferView()) {
         RefPtr<DOMArrayBuffer> buffer = messageData.isArrayBufferView()
-            ? messageData.getAsArrayBufferView()->buffer()
+            ? messageData.getAsArrayBufferView()->bufferOrNull()
             : messageData.getAsArrayBuffer();
 
+        // TODO(junov): crbug.com/536816
+        // Instead of crashing when buffer allocation fails, we should consider
+        // throwing a RangeError exception. It is what the ECMAScript spec says to do:
+        // http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+        // However the PushMessageData specification does not state that such
+        // exceptions should be re-thrown.
+        RELEASE_ASSERT(buffer); // This is essentially an out-of-memory crash
         return new PushMessageData(static_cast<const char*>(buffer->data()), buffer->byteLength());
     }
 
@@ -56,7 +63,14 @@ PushMessageData::~PushMessageData()
 
 PassRefPtr<DOMArrayBuffer> PushMessageData::arrayBuffer() const
 {
-    return DOMArrayBuffer::create(m_data.data(), m_data.size());
+    // TODO(junov): crbug.com/536816
+    // Use createOrNull instead of deprecatedCreateOrCrash. Requires
+    // defining behavior for when allocation fails. ECMAScript spec says
+    // allocation failure should throw a RangeError exception, but the
+    // spec for PushMessageData.arrayBuffer() does not state that
+    // such exceptions should be re-thrown. So for now, we just crash.
+    RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::deprecatedCreateOrCrash(m_data.data(), m_data.size());
+    return buffer.release();
 }
 
 Blob* PushMessageData::blob() const