Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/fileapi/FileReaderSync.cpp

 /*
  * Copyright (C) 2010 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 37 matching lines @@
 PassRefPtr<DOMArrayBuffer> FileReaderSync::readAsArrayBuffer(ExecutionContext* executionContext, Blob* blob, ExceptionState& exceptionState)
 {
     if (!blob) {
         exceptionState.throwDOMException(NotFoundError, FileError::notFoundErrorMessage);
         return nullptr;
     }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsArrayBuffer, nullptr);
     startLoading(executionContext, loader, *blob, exceptionState);
 
-    return loader.arrayBufferResult();
+    RefPtr<DOMArrayBuffer> result = loader.arrayBufferResultOrNull();
+    // FIXME(crbug.com/536816): Instead of crashing on OOM here, we should
+    // probably throw a RangeError exception which is what the ECMAScript
+    // spec says to do when allocation fails. However, the File API spec
+    // would need to be modified to state that execption thrown by referenced
+    // procedures are re-thrown.
+    RELEASE_ASSERT(result); // This is essentially an OOM crash
+    return result.release();
 }
 
 String FileReaderSync::readAsBinaryString(ExecutionContext* executionContext, Blob* blob, ExceptionState& exceptionState)
 {
     if (!blob) {
         exceptionState.throwDOMException(NotFoundError, FileError::notFoundErrorMessage);
         return String();
     }
 
     FileReaderLoader loader(FileReaderLoader::ReadAsBinaryString, 0);
@@ skipping 28 matching lines @@
 }
 
 void FileReaderSync::startLoading(ExecutionContext* executionContext, FileReaderLoader& loader, const Blob& blob, ExceptionState& exceptionState)
 {
     loader.start(executionContext, blob.blobDataHandle());
     if (loader.errorCode())
         FileError::throwDOMException(exceptionState, loader.errorCode());
 }
 
 } // namespace blink