Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/dom/DOMTypedArray.h

Index: third_party/WebKit/Source/core/dom/DOMTypedArray.h
diff --git a/third_party/WebKit/Source/core/dom/DOMTypedArray.h b/third_party/WebKit/Source/core/dom/DOMTypedArray.h
index e8ea244f2d0bf12225cd317cbcf36dd025915ecb..45b0e0eca8d462b976402888865b475f77580310 100644
--- a/third_party/WebKit/Source/core/dom/DOMTypedArray.h
+++ b/third_party/WebKit/Source/core/dom/DOMTypedArray.h
@@ -29,17 +29,24 @@ class CORE_TEMPLATE_CLASS_EXPORT DOMTypedArray final : public DOMArrayBufferView
 public:
     typedef typename WTFTypedArray::ValueType ValueType;
 
+    static PassRefPtr<ThisType> createOrNull(PassRefPtr<WTFTypedArray> bufferView)
+    {
+        if (!bufferView)
+            return nullptr;
+        return adoptRef(new ThisType(bufferView));
+    }
     static PassRefPtr<ThisType> create(PassRefPtr<WTFTypedArray> bufferView)
     {
+        RELEASE_ASSERT(bufferView);
         return adoptRef(new ThisType(bufferView));
     }
-    static PassRefPtr<ThisType> create(unsigned length)
+    static PassRefPtr<ThisType> createOrNull(const ValueType* array, unsigned length)
     {
-        return create(WTFTypedArray::create(length));
+        return createOrNull(WTFTypedArray::createOrNull(array, length));
     }
-    static PassRefPtr<ThisType> create(const ValueType* array, unsigned length)
+    static PassRefPtr<ThisType> deprecatedCreateOrCrash(const ValueType* array, unsigned length)
     {
-        return create(WTFTypedArray::create(array, length));
+        return create(WTFTypedArray::deprecatedCreateOrCrash(array, length));
     }
     static PassRefPtr<ThisType> create(PassRefPtr<WTF::ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
     {
@@ -58,6 +65,13 @@ public:
         return buffer ? create(buffer.release(), 0, length) : nullptr;
     }
 
+    static PassRefPtr<ThisType> deprecatedCreateOrCrash(unsigned length)
+    {
+        RefPtr<WTF::ArrayBuffer> buffer = WTF::ArrayBuffer::deprecatedCreateOrCrash(length, 1);

[binji, 2015/10/16 22:12:39]

what is the 1 here? Ah, element size.

Seems weird that length is byteLength, not number of elements. Maybe the naming
is just unclear.

[Justin Novosad, 2015/10/19 16:42:52]

Acknowledged.

+        ASSERT(buffer);
+        return create(buffer.release(), 0, length);
+    }
+
     const WTFTypedArray* view() const { return static_cast<const WTFTypedArray*>(DOMArrayBufferView::view()); }
     WTFTypedArray* view() { return static_cast<WTFTypedArray*>(DOMArrayBufferView::view()); }