Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 346 matching lines @@
 
 DOMArrayBuffer* XMLHttpRequest::responseArrayBuffer()
 {
     ASSERT(m_responseTypeCode == ResponseTypeArrayBuffer);
 
     if (m_error || m_state != DONE)
         return nullptr;
 
     if (!m_responseArrayBuffer) {
         if (m_binaryResponseBuilder && m_binaryResponseBuilder->size()) {
-            RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::createUninitialized(m_binaryResponseBuilder->size(), 1);
-            if (!m_binaryResponseBuilder->getAsBytes(buffer->data(), buffer->byteLength())) {
+            RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::createUninitializedOrNull(m_binaryResponseBuilder->size(), 1);
+            if (!buffer || !m_binaryResponseBuilder->getAsBytes(buffer->data(), buffer->byteLength())) {
                 // m_binaryResponseBuilder failed to allocate an ArrayBuffer.
                 // We need to crash the renderer since there's no way defined in
                 // the spec to tell this to the user.
                 CRASH();
             }
             m_responseArrayBuffer = buffer.release();
             m_binaryResponseBuilder.clear();
         } else {
-            m_responseArrayBuffer = DOMArrayBuffer::create(nullptr, 0);
+            m_responseArrayBuffer = DOMArrayBuffer::createOrNull(nullptr, 0);
+            RELEASE_ASSERT(m_responseArrayBuffer); // size 0 -> should never fail internal buffer alloc
         }
     }
 
     return m_responseArrayBuffer.get();
 }
 
 Stream* XMLHttpRequest::responseLegacyStream()
 {
     ASSERT(m_responseTypeCode == ResponseTypeLegacyStream);
 
@@ skipping 1326 matching lines @@
     visitor->trace(m_responseDocumentParser);
     visitor->trace(m_progressEventThrottle);
     visitor->trace(m_upload);
     visitor->trace(m_blobLoader);
     XMLHttpRequestEventTarget::trace(visitor);
     DocumentParserClient::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink