Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/fileapi/FileReader.cpp

 /*
  * Copyright (C) 2010 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 352 matching lines @@
 
     // All possible events have fired and we're done, no more pending activity.
     ThrottlingController::finishReader(executionContext(), this, finalStep);
 }
 
 void FileReader::result(StringOrArrayBuffer& resultAttribute) const
 {
     if (!m_loader || m_error)
         return;
 
-    if (m_readType == FileReaderLoader::ReadAsArrayBuffer)
-        resultAttribute.setArrayBuffer(m_loader->arrayBufferResult());
-    else
+    if (m_readType == FileReaderLoader::ReadAsArrayBuffer) {
+        // FIXME(crbug.com/536816):
+        // In on-going work for crbug.com/536816 the code was left in this state
+        // to avoid changing pre-existing behavior, but we may want to revisit
+        // this code to determine the proper course of action for cases where
+        // arrayBufferResultOrNull() returns a nullptr, presumably due to a
+        // memory allocation failure. Would it be aprropriate to throw a
+        // RangeError DOM exception from here? Should we cancel the setting
+        // of resultAttribute instead of setting it to null?
+        resultAttribute.setArrayBuffer(m_loader->arrayBufferResultOrNull());
+    } else {
         resultAttribute.setString(m_loader->stringResult());
+    }
 }
 
 void FileReader::terminate()
 {
     if (m_loader) {
         m_loader->cancel();
         m_loader = nullptr;
     }
     m_state = DONE;
     m_loadingState = LoadingStateNone;
@@ skipping 82 matching lines @@
 }
 
 DEFINE_TRACE(FileReader)
 {
     visitor->trace(m_error);
     RefCountedGarbageCollectedEventTargetWithInlineData<FileReader>::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink