Check if ArrayBuffer allocation in ArrayBufferBuilder is successful.

ArrayBuffer::create may return NULL if allocation fails.

BUG=353966

Review URL: https://codereview.chromium.org/206243002

git-svn-id: svn://svn.chromium.org/blink/trunk@169680 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/fileapi/FileReaderLoader.cpp

@@ -201,18 +201,20 @@ void FileReaderLoader::didReceiveResponse(unsigned long, const ResourceResponse&
             return;
         }
 
-        if (initialBufferLength < 0) {
+        if (initialBufferLength < 0)
             m_rawData = adoptPtr(new ArrayBufferBuilder());
-        } else {
+        else
             m_rawData = adoptPtr(new ArrayBufferBuilder(static_cast<unsigned>(initialBufferLength)));
-            // Total size is known. Set m_rawData to ignore overflowed data.
-            m_rawData->setVariableCapacity(false);
-        }
 
-        if (!m_rawData) {
+        if (!m_rawData || !m_rawData->isValid()) {
             failed(FileError::NOT_READABLE_ERR);
             return;
         }
+
+        if (initialBufferLength >= 0) {
+            // Total size is known. Set m_rawData to ignore overflowed data.
+            m_rawData->setVariableCapacity(false);
+        }
     }
 
     if (m_client)

third_party/WebKit/Source/wtf/ArrayBufferBuilder.h

@@ -38,7 +38,8 @@
 
 namespace WTF {
 
-// A utility class to build an ArrayBuffer instance.
+// A utility class to build an ArrayBuffer instance. Validity must be checked
+// by isValid() before using an instance.
 class WTF_EXPORT ArrayBufferBuilder {
     // Disallow copying since it's expensive and we don't want code to do it by
     // accident.
@@ -55,6 +56,12 @@ public:
         m_buffer = ArrayBuffer::create(capacity, 1);
     }
 
+    bool isValid() const
+    {
+        return m_buffer;
+    }
+
+    // Appending empty data is not allowed.
     unsigned append(const char* data, unsigned length);
 
     // Returns the accumulated data as an ArrayBuffer instance. If needed,