XMLHttpRequest: return null upon failing responseArrayBuffer allocation.

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 233 matching lines @@
       m_eventDispatchRecursionLevel(0),
       m_async(true),
       m_includeCredentials(false),
       m_parsedResponse(false),
       m_error(false),
       m_uploadEventsAllowed(true),
       m_uploadComplete(false),
       m_sameOriginRequest(true),
       m_downloadingToFile(false),
       m_responseTextOverflow(false),
-      m_sendFlag(false) {}
+      m_sendFlag(false),
+      m_responseArrayBufferFailure(false) {}
 
 XMLHttpRequest::~XMLHttpRequest() {}
 
 Document* XMLHttpRequest::document() const {
   DCHECK(getExecutionContext()->isDocument());
   return toDocument(getExecutionContext());
 }
 
 SecurityOrigin* XMLHttpRequest::getSecurityOrigin() const {
   return m_isolatedWorldSecurityOrigin
@@ skipping 114 matching lines @@
 
   return m_responseBlob;
 }
 
 DOMArrayBuffer* XMLHttpRequest::responseArrayBuffer() {
   DCHECK_EQ(m_responseTypeCode, ResponseTypeArrayBuffer);
 
   if (m_error || m_state != kDone)
     return nullptr;
 
-  if (!m_responseArrayBuffer) {
+  if (!m_responseArrayBuffer && !m_responseArrayBufferFailure) {
     if (m_binaryResponseBuilder && m_binaryResponseBuilder->size()) {
-      DOMArrayBuffer* buffer = DOMArrayBuffer::createUninitialized(
+      DOMArrayBuffer* buffer = DOMArrayBuffer::createUninitializedOrNull(
           m_binaryResponseBuilder->size(), 1);
-      m_binaryResponseBuilder->getAsBytes(
-          buffer->data(), static_cast<size_t>(buffer->byteLength()));
-      m_responseArrayBuffer = buffer;
+      if (buffer) {
+        m_binaryResponseBuilder->getAsBytes(
+            buffer->data(), static_cast<size_t>(buffer->byteLength()));
+        m_responseArrayBuffer = buffer;
+      }
+      // https://xhr.spec.whatwg.org/#arraybuffer-response allows clearing
+      // of the 'received bytes' payload when the response buffer allocation
+      // fails.
       m_binaryResponseBuilder.clear();
+      // Mark allocation as failed; subsequent calls to the accessor must
+      // continue to report |null|.
+      //
+      m_responseArrayBufferFailure = !buffer;
     } else {
       m_responseArrayBuffer = DOMArrayBuffer::create(nullptr, 0);
     }
   }
 
   return m_responseArrayBuffer;
 }
 
 void XMLHttpRequest::setTimeout(unsigned timeout,
                                 ExceptionState& exceptionState) {
@@ skipping 780 matching lines @@
 
   m_responseBlob = nullptr;
 
   m_downloadingToFile = false;
   m_lengthDownloadedToFile = 0;
 
   // These variables may referred by the response accessors. So, we can clear
   // this only when we clear the response holder variables above.
   m_binaryResponseBuilder.clear();
   m_responseArrayBuffer.clear();
+  m_responseArrayBufferFailure = false;
 }
 
 void XMLHttpRequest::clearRequest() {
   m_requestHeaders.clear();
 }
 
 void XMLHttpRequest::dispatchProgressEvent(const AtomicString& type,
                                            long long receivedLength,
                                            long long expectedLength) {
   bool lengthComputable =
@@ skipping 682 matching lines @@
   visitor->traceWrappers(m_responseDocument);
   visitor->traceWrappers(m_responseArrayBuffer);
   XMLHttpRequestEventTarget::traceWrappers(visitor);
 }
 
 std::ostream& operator<<(std::ostream& ostream, const XMLHttpRequest* xhr) {
   return ostream << "XMLHttpRequest " << static_cast<const void*>(xhr);
 }
 
 }  // namespace blink