Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(644)

Unified Diff: third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp

Issue 1414553002: Fix out-of-memory crashes related to ArrayBuffer allocation Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: rebase and applied senorblanco+haraken feedbac Created 5 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp b/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
index d7c888848d0e54971342da1dda9e783cc74c0342..c00a21e11ec70df2727e4d1a1ae532ab682e6bdc 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
@@ -151,6 +151,13 @@ AudioBuffer::AudioBuffer(unsigned numberOfChannels, size_t numberOfFrames, float
RefPtr<DOMFloat32Array> channelDataArray = createFloat32ArrayOrNull(m_length);
// If the channel data array could not be created, just return. The caller will need to
// check that the desired number of channels were created.
+
+ // TODO(junov) crbug.com/536816
+ // According to ECMAScript spec, failure to allocate should result in a
+ // RangeError exception being thrown:
+ // http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+ // The spec for createBuffer does not specify whether such an exception
+ // should be re-thrown.
if (!channelDataArray) {
return;
}
@@ -171,6 +178,11 @@ AudioBuffer::AudioBuffer(AudioBus* bus)
RefPtr<DOMFloat32Array> channelDataArray = createFloat32ArrayOrNull(m_length);
// If the channel data array could not be created, just return. The caller will need to
// check that the desired number of channels were created.
+
+ // TODO(junov): crbug.com/536816
+ // According to ECMAScript spec, failure to allocate should result in a
+ // RangeError exception being thrown:
+ // http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
if (!channelDataArray)
return;
@@ -190,7 +202,9 @@ PassRefPtr<DOMFloat32Array> AudioBuffer::getChannelData(unsigned channelIndex, E
}
DOMFloat32Array* channelData = m_channels[channelIndex].get();
- return DOMFloat32Array::create(channelData->buffer(), channelData->byteOffset(), channelData->length());
+ RefPtr<DOMArrayBuffer> buffer = channelData->bufferOrNull();
+ RELEASE_ASSERT(buffer); // crbug.com/536816
+ return DOMFloat32Array::create(buffer.release(), channelData->byteOffset(), channelData->length());
}
DOMFloat32Array* AudioBuffer::getChannelData(unsigned channelIndex)

Powered by Google App Engine
This is Rietveld 408576698