Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/fetch/BodyStreamBuffer.cpp

Index: third_party/WebKit/Source/modules/fetch/BodyStreamBuffer.cpp
diff --git a/third_party/WebKit/Source/modules/fetch/BodyStreamBuffer.cpp b/third_party/WebKit/Source/modules/fetch/BodyStreamBuffer.cpp
index f3efdfc5fa6f02cc035f7e2117616d3a56184313..9969e8af402aa0cd099d1d825c064cc4e4759ca3 100644
--- a/third_party/WebKit/Source/modules/fetch/BodyStreamBuffer.cpp
+++ b/third_party/WebKit/Source/modules/fetch/BodyStreamBuffer.cpp
@@ -213,9 +213,18 @@ void BodyStreamBuffer::processData()
         WebDataConsumerHandle::Result result = m_reader->beginRead(&buffer, WebDataConsumerHandle::FlagNone, &available);
         switch (result) {
         case WebDataConsumerHandle::Ok:
-            m_streamNeedsMore = m_stream->enqueue(DOMUint8Array::create(static_cast<const unsigned char*>(buffer), available));
-            m_reader->endRead(available);
-            break;
+            {
+                RefPtr<DOMUint8Array> domArray = DOMUint8Array::createOrNull(static_cast<const unsigned char*>(buffer), available);
+                if (!domArray) {
+                    m_reader = nullptr;
+                    m_stream->error(DOMException::create(V8RangeError, "Out of Memory."));
+                    m_handle.clear();
+                } else {
+                    m_streamNeedsMore = m_stream->enqueue(domArray);
+                    m_reader->endRead(available);
+                }
+            }
+            return;
 
         case WebDataConsumerHandle::Done:
             close();