Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/dom/DOMTypedArray.h

Index: third_party/WebKit/Source/core/dom/DOMTypedArray.h
diff --git a/third_party/WebKit/Source/core/dom/DOMTypedArray.h b/third_party/WebKit/Source/core/dom/DOMTypedArray.h
index e8ea244f2d0bf12225cd317cbcf36dd025915ecb..9e1546a4103e9a164601c9c32bfbf3e2118202f8 100644
--- a/third_party/WebKit/Source/core/dom/DOMTypedArray.h
+++ b/third_party/WebKit/Source/core/dom/DOMTypedArray.h
@@ -29,17 +29,24 @@ class CORE_TEMPLATE_CLASS_EXPORT DOMTypedArray final : public DOMArrayBufferView
 public:
     typedef typename WTFTypedArray::ValueType ValueType;
 
+    static PassRefPtr<ThisType> createOrNull(PassRefPtr<WTFTypedArray> bufferView)
+    {
+        if (!bufferView)
+            return nullptr;
+        return adoptRef(new ThisType(bufferView));
+    }
     static PassRefPtr<ThisType> create(PassRefPtr<WTFTypedArray> bufferView)
     {
+        RELEASE_ASSERT(bufferView);
         return adoptRef(new ThisType(bufferView));
     }
-    static PassRefPtr<ThisType> create(unsigned length)
+    static PassRefPtr<ThisType> createOrNull(const ValueType* array, unsigned length)
     {
-        return create(WTFTypedArray::create(length));
+        return createOrNull(WTFTypedArray::createOrNull(array, length));
     }
-    static PassRefPtr<ThisType> create(const ValueType* array, unsigned length)
+    static PassRefPtr<ThisType> deprecatedCreateOrCrash(const ValueType* array, unsigned length)
     {
-        return create(WTFTypedArray::create(array, length));
+        return create(WTFTypedArray::deprecatedCreateOrCrash(array, length));
     }
     static PassRefPtr<ThisType> create(PassRefPtr<WTF::ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
     {
@@ -52,10 +59,19 @@ public:
         return adoptRef(new ThisType(bufferView.release(), buffer.release()));
     }
 
-    static PassRefPtr<ThisType> createOrNull(unsigned length)
+    static PassRefPtr<ThisType> createOrNull(unsigned byteLength)
+    {
+        const unsigned numElements = 1;
+        RefPtr<WTF::ArrayBuffer> buffer = WTF::ArrayBuffer::createOrNull(byteLength, numElements);
+        return buffer ? create(buffer.release(), 0, byteLength) : nullptr;
+    }
+
+    static PassRefPtr<ThisType> deprecatedCreateOrCrash(unsigned byteLength)
     {
-        RefPtr<WTF::ArrayBuffer> buffer = WTF::ArrayBuffer::createOrNull(length, 1);
-        return buffer ? create(buffer.release(), 0, length) : nullptr;
+        const unsigned numElements = 1;
+        RefPtr<WTF::ArrayBuffer> buffer = WTF::ArrayBuffer::deprecatedCreateOrCrash(byteLength, numElements);
+        ASSERT(buffer);
+        return create(buffer.release(), 0, byteLength);
     }
 
     const WTFTypedArray* view() const { return static_cast<const WTFTypedArray*>(DOMArrayBufferView::view()); }