Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/wtf/ArrayBufferBuilder.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 35 matching lines @@
     WTF_MAKE_NONCOPYABLE(ArrayBufferBuilder);
 
 public:
     // Creates an ArrayBufferBuilder using the default capacity.
     ArrayBufferBuilder();
 
     ArrayBufferBuilder(unsigned capacity)
         : m_bytesUsed(0)
         , m_variableCapacity(true)
     {
-        m_buffer = ArrayBuffer::create(capacity, 1);
+        m_buffer = ArrayBuffer::createOrNull(capacity, 1);
     }
 
     bool isValid() const
     {
         return m_buffer;
     }
 
     // Appending empty data is not allowed.
     unsigned append(const char* data, unsigned length);
 
     // Returns the accumulated data as an ArrayBuffer instance. If needed,
     // creates a new ArrayBuffer instance and copies contents from the internal
     // buffer to it. Otherwise, returns a PassRefPtr pointing to the internal
     // buffer.
     PassRefPtr<ArrayBuffer> toArrayBuffer();
 
     // Converts the accumulated data into a String using the default encoding.
     String toString();
 
     // Number of bytes currently accumulated.
     unsigned byteLength() const
     {
         return m_bytesUsed;
     }
 
     // Number of bytes allocated.
     unsigned capacity() const
     {
+        ASSERT(isValid());
         return m_buffer->byteLength();
     }
 
     void shrinkToFit();
 
     const void* data() const
     {
+        ASSERT(isValid());
         return m_buffer->data();
     }
 
     // If set to false, the capacity won't be expanded and when appended data
     // overflows, the overflowed part will be dropped.
     void setVariableCapacity(bool value)
     {
         m_variableCapacity = value;
     }
 
 private:
     // Expands the size of m_buffer to size + m_bytesUsed bytes. Returns true
     // iff successful. If reallocation is needed, copies only data in
     // [0, m_bytesUsed) range.
     bool expandCapacity(unsigned size);
 
     unsigned m_bytesUsed;
     bool m_variableCapacity;
     RefPtr<ArrayBuffer> m_buffer;
 };
 
 } // namespace WTF
 
 using WTF::ArrayBufferBuilder;
 
 #endif // ArrayBufferBuilder_h