Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/fetch/BodyStreamBuffer.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/fetch/BodyStreamBuffer.h"
 
 #include "core/dom/DOMArrayBuffer.h"
 #include "core/dom/DOMTypedArray.h"
 #include "core/dom/ExceptionCode.h"
@@ skipping 195 matching lines @@
 
 void BodyStreamBuffer::processData()
 {
     ASSERT(m_reader);
     while (m_streamNeedsMore) {
         const void* buffer;
         size_t available;
         WebDataConsumerHandle::Result result = m_reader->beginRead(&buffer, WebDataConsumerHandle::FlagNone, &available);
         switch (result) {
         case WebDataConsumerHandle::Ok:
-            m_streamNeedsMore = m_stream->enqueue(DOMUint8Array::create(static_cast<const unsigned char*>(buffer), available));
-            m_reader->endRead(available);
-            break;
+            {
+                RefPtr<DOMUint8Array> domArray = DOMUint8Array::createOrNull(static_cast<const unsigned char*>(buffer), available);
+                if (!domArray) {
+                    m_reader = nullptr;
+                    m_stream->error(DOMException::create(V8RangeError, "Out of Memory."));
+                    m_handle.clear();
+                } else {
+                    m_streamNeedsMore = m_stream->enqueue(domArray);
+                    m_reader->endRead(available);
+                }
+            }
+            return;
 
         case WebDataConsumerHandle::Done:
             close();
             return;
 
         case WebDataConsumerHandle::ShouldWait:
             return;
 
         case WebDataConsumerHandle::Busy:
         case WebDataConsumerHandle::ResourceExhausted:
@@ skipping 21 matching lines @@
     unlock();
     if (mode == EndLoadingDone) {
         close();
     } else {
         ASSERT(mode == EndLoadingErrored);
         error();
     }
 }
 
 } // namespace blink