Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp

 /*
  * Copyright (c) 2013, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 158 matching lines @@
 }
 
 void ImageBitmapFactories::ImageBitmapLoader::rejectPromise()
 {
     m_resolver->reject(ScriptValue(m_resolver->scriptState(), v8::Null(m_resolver->scriptState()->isolate())));
     m_factory->didFinishLoading(this);
 }
 
 void ImageBitmapFactories::ImageBitmapLoader::didFinishLoading()
 {
-    if (!m_loader.arrayBufferResult()) {
+    RefPtr<DOMArrayBuffer> buffer = m_loader.arrayBufferResultOrNull();
+    if (!buffer) {
         rejectPromise();
         return;
     }
-    RefPtr<SharedBuffer> sharedBuffer = SharedBuffer::create((char*)m_loader.arrayBufferResult()->data(), m_loader.arrayBufferResult()->byteLength());
+    // TODO(junov) crbug.com/549191: Is there a way to transfer 'buffer' without making a copy?
+    // The loaded data is read-only, so it should be possible to avoid copying.
+    RefPtr<SharedBuffer> sharedBuffer = SharedBuffer::create((char*)buffer->data(), buffer->byteLength());
 
     OwnPtr<ImageSource> source = adoptPtr(new ImageSource());
     source->setData(*sharedBuffer, true);
 
     RefPtr<SkImage> frame = source->createFrameAtIndex(0);
     ASSERT(!frame || (frame->width() && frame->height()));
     if (!frame) {
         rejectPromise();
         return;
     }
@@ skipping 14 matching lines @@
     rejectPromise();
 }
 
 DEFINE_TRACE(ImageBitmapFactories::ImageBitmapLoader)
 {
     visitor->trace(m_factory);
     visitor->trace(m_resolver);
 }
 
 } // namespace blink