Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/dom/DOMMatrixReadOnly.cpp

Index: third_party/WebKit/Source/core/dom/DOMMatrixReadOnly.cpp
diff --git a/third_party/WebKit/Source/core/dom/DOMMatrixReadOnly.cpp b/third_party/WebKit/Source/core/dom/DOMMatrixReadOnly.cpp
index aed65e3389df9b64dd10ee922f226ac300a343bc..54dfeaa50dbde46f5abc8a7819df9b4924d6da96 100644
--- a/third_party/WebKit/Source/core/dom/DOMMatrixReadOnly.cpp
+++ b/third_party/WebKit/Source/core/dom/DOMMatrixReadOnly.cpp
@@ -51,8 +51,10 @@ PassRefPtr<DOMFloat32Array> DOMMatrixReadOnly::toFloat32Array() const
         static_cast<float>(m_matrix->m31()), static_cast<float>(m_matrix->m32()), static_cast<float>(m_matrix->m33()), static_cast<float>(m_matrix->m34()),
         static_cast<float>(m_matrix->m41()), static_cast<float>(m_matrix->m42()), static_cast<float>(m_matrix->m43()), static_cast<float>(m_matrix->m44())
     };
-
-    return DOMFloat32Array::create(array, 16);
+    // TODO(junov): crbug.com/536816 Should we throw a RangeError instead
+    // of crashing when allocation fails?
+    RefPtr<DOMFloat32Array> domArray = DOMFloat32Array::deprecatedCreateOrCrash(array, 16);
+    return domArray.release();
 }
 
 PassRefPtr<DOMFloat64Array> DOMMatrixReadOnly::toFloat64Array() const
@@ -63,8 +65,10 @@ PassRefPtr<DOMFloat64Array> DOMMatrixReadOnly::toFloat64Array() const
         m_matrix->m31(), m_matrix->m32(), m_matrix->m33(), m_matrix->m34(),
         m_matrix->m41(), m_matrix->m42(), m_matrix->m43(), m_matrix->m44()
     };
-
-    return DOMFloat64Array::create(array, 16);
+    // TODO(junov): crbug.com/536816 Should we throw a RangeError instead
+    // of crashing when allocation fails?
+    RefPtr<DOMFloat64Array> domArray =  DOMFloat64Array::deprecatedCreateOrCrash(array, 16);
+    return domArray.release();
 }
 
 } // namespace blink