Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/dom/DOMMatrixReadOnly.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/dom/DOMMatrix.h"
 
 namespace blink {
 
 bool DOMMatrixReadOnly::is2D() const
@@ skipping 33 matching lines @@
 }
 
 PassRefPtr<DOMFloat32Array> DOMMatrixReadOnly::toFloat32Array() const
 {
     float array[] = {
         static_cast<float>(m_matrix->m11()), static_cast<float>(m_matrix->m12()), static_cast<float>(m_matrix->m13()), static_cast<float>(m_matrix->m14()),
         static_cast<float>(m_matrix->m21()), static_cast<float>(m_matrix->m22()), static_cast<float>(m_matrix->m23()), static_cast<float>(m_matrix->m24()),
         static_cast<float>(m_matrix->m31()), static_cast<float>(m_matrix->m32()), static_cast<float>(m_matrix->m33()), static_cast<float>(m_matrix->m34()),
         static_cast<float>(m_matrix->m41()), static_cast<float>(m_matrix->m42()), static_cast<float>(m_matrix->m43()), static_cast<float>(m_matrix->m44())
     };
-
-    return DOMFloat32Array::create(array, 16);
+    // TODO(junov): crbug.com/536816 Should we throw a RangeError instead
+    // of crashing when allocation fails?
+    RefPtr<DOMFloat32Array> domArray = DOMFloat32Array::deprecatedCreateOrCrash(array, 16);
+    return domArray.release();
 }
 
 PassRefPtr<DOMFloat64Array> DOMMatrixReadOnly::toFloat64Array() const
 {
     double array[] = {
         m_matrix->m11(), m_matrix->m12(), m_matrix->m13(), m_matrix->m14(),
         m_matrix->m21(), m_matrix->m22(), m_matrix->m23(), m_matrix->m24(),
         m_matrix->m31(), m_matrix->m32(), m_matrix->m33(), m_matrix->m34(),
         m_matrix->m41(), m_matrix->m42(), m_matrix->m43(), m_matrix->m44()
     };
-
-    return DOMFloat64Array::create(array, 16);
+    // TODO(junov): crbug.com/536816 Should we throw a RangeError instead
+    // of crashing when allocation fails?
+    RefPtr<DOMFloat64Array> domArray =  DOMFloat64Array::deprecatedCreateOrCrash(array, 16);
+    return domArray.release();
 }
 
 } // namespace blink