XMLHttpRequest: return null upon failing responseArrayBuffer allocation.

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 370 matching lines @@
 }
 
 DOMArrayBuffer* XMLHttpRequest::responseArrayBuffer() {
   DCHECK_EQ(m_responseTypeCode, ResponseTypeArrayBuffer);
 
   if (m_error || m_state != kDone)
     return nullptr;
 
   if (!m_responseArrayBuffer) {
     if (m_binaryResponseBuilder && m_binaryResponseBuilder->size()) {
-      DOMArrayBuffer* buffer = DOMArrayBuffer::createUninitialized(
+      DOMArrayBuffer* buffer = DOMArrayBuffer::createUninitializedOrNull(
           m_binaryResponseBuilder->size(), 1);
-      m_binaryResponseBuilder->getAsBytes(
-          buffer->data(), static_cast<size_t>(buffer->byteLength()));
-      m_responseArrayBuffer = buffer;
+      if (buffer) {
+        m_binaryResponseBuilder->getAsBytes(
+            buffer->data(), static_cast<size_t>(buffer->byteLength()));
+        m_responseArrayBuffer = buffer;
+      }
+      // https://xhr.spec.whatwg.org/#arraybuffer-response allows clearing
+      // of the 'received bytes' payload when the response buffer allocation
+      // fails.
       m_binaryResponseBuilder.clear();
     } else {
       m_responseArrayBuffer = DOMArrayBuffer::create(nullptr, 0);

[yhirano, 2017/03/06 09:19:53]

This getter returns null for the first time, and will return an empty
DOMArrayBuffer from the second time, right?

[sof, 2017/03/06 09:29:16]

Hmm, yes. It implements the spec by doing so, I'd say.

     }
   }
 
   return m_responseArrayBuffer;
 }
 
 void XMLHttpRequest::setTimeout(unsigned timeout,
                                 ExceptionState& exceptionState) {
   // FIXME: Need to trigger or update the timeout Timer here, if needed.
   // http://webkit.org/b/98156
@@ skipping 1480 matching lines @@
   visitor->traceWrappers(m_responseDocument);
   visitor->traceWrappers(m_responseArrayBuffer);
   XMLHttpRequestEventTarget::traceWrappers(visitor);
 }
 
 std::ostream& operator<<(std::ostream& ostream, const XMLHttpRequest* xhr) {
   return ostream << "XMLHttpRequest " << static_cast<const void*>(xhr);
 }
 
 }  // namespace blink