Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp

Index: third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp
diff --git a/third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp b/third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp
index 78a7447e23b99407fa47bc313b3a1b68d4739533..ee44bed7f85fa529fc4594db28e00836c4a7db2d 100644
--- a/third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp
+++ b/third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp
@@ -42,7 +42,7 @@ ArrayBufferBuilder::ArrayBufferBuilder()
     : m_bytesUsed(0)
     , m_variableCapacity(true)
 {
-    m_buffer = ArrayBuffer::create(defaultBufferCapacity, 1);
+    m_buffer = ArrayBuffer::createOrNull(defaultBufferCapacity, 1);
 }
 
 bool ArrayBufferBuilder::expandCapacity(unsigned sizeToIncrease)
@@ -64,7 +64,7 @@ bool ArrayBufferBuilder::expandCapacity(unsigned sizeToIncrease)
         newBufferSize = exponentialGrowthNewBufferSize;
 
     // Copy existing data in current buffer to new buffer.
-    RefPtr<ArrayBuffer> newBuffer = ArrayBuffer::create(newBufferSize, 1);
+    RefPtr<ArrayBuffer> newBuffer = ArrayBuffer::createOrNull(newBufferSize, 1);
     if (!newBuffer)
         return false;
 
@@ -106,7 +106,10 @@ PassRefPtr<ArrayBuffer> ArrayBufferBuilder::toArrayBuffer()
     if (m_buffer->byteLength() == m_bytesUsed)
         return m_buffer;
 
-    return m_buffer->slice(0, m_bytesUsed);
+    RefPtr<ArrayBuffer> tmp = m_buffer->sliceOrNull(0, m_bytesUsed);
+    if (tmp)
+        return tmp;
+    return m_buffer;
 }
 
 String ArrayBufferBuilder::toString()
@@ -118,8 +121,11 @@ void ArrayBufferBuilder::shrinkToFit()
 {
     ASSERT(m_bytesUsed <= m_buffer->byteLength());
 
-    if (m_buffer->byteLength() > m_bytesUsed)
-        m_buffer = m_buffer->slice(0, m_bytesUsed);
+    if (m_buffer->byteLength() > m_bytesUsed) {
+        RefPtr<ArrayBuffer> tmp = m_buffer->sliceOrNull(0, m_bytesUsed);
+        if (tmp)
+            m_buffer = tmp;
+    }
 }
 
 } // namespace WTF