Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/fetch/Body.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/fetch/Body.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
@@ skipping 106 matching lines @@
     // gone (which means that the V8::TerminateExecution() signal has been sent
     // to this worker thread).
     if (!scriptState->executionContext())
         return ScriptPromise();
 
     ScriptPromiseResolver* resolver = ScriptPromiseResolver::create(scriptState);
     ScriptPromise promise = resolver->promise();
     if (bodyBuffer()) {
         bodyBuffer()->startLoading(scriptState->executionContext(), FetchDataLoader::createLoaderAsArrayBuffer(), new BodyArrayBufferConsumer(resolver));
     } else {
-        resolver->resolve(DOMArrayBuffer::create(0u, 1));
+        resolver->resolve(DOMArrayBuffer::deprecatedCreateOrCrash(0u, 1));

[haraken, 2015/10/29 18:58:37]

0u => nullptr

     }
     return promise;
 }
 
 ScriptPromise Body::blob(ScriptState* scriptState)
 {
     if (m_opaque)
         return ScriptPromise::reject(scriptState, V8ThrowException::createTypeError(scriptState->isolate(), "The body is opaque."));
 
     if (bodyUsed())
@@ skipping 82 matching lines @@
 
 Body::Body(ExecutionContext* context)
     : ActiveDOMObject(context)
     , m_bodyPassed(false)
     , m_opaque(false)
 {
     suspendIfNeeded();
 }
 
 } // namespace blink