Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp

Index: third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
diff --git a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
index 422ab061da14c92860b5bb19173c086db082e433..bbac01a865f8d240d36effd6b273b0b079099a06 100644
--- a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
+++ b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
@@ -176,11 +176,14 @@ void ImageBitmapFactories::ImageBitmapLoader::rejectPromise()
 
 void ImageBitmapFactories::ImageBitmapLoader::didFinishLoading()
 {
-    if (!m_loader.arrayBufferResult()) {
+    RefPtr<DOMArrayBuffer> buffer = m_loader.arrayBufferResultOrNull();
+    if (!buffer) {
         rejectPromise();
         return;
     }
-    RefPtr<SharedBuffer> sharedBuffer = SharedBuffer::create((char*)m_loader.arrayBufferResult()->data(), m_loader.arrayBufferResult()->byteLength());
+    // TODO(junov) crbug.com/549191: Is there a way to transfer 'buffer' without making a copy?
+    // The loaded data is read-only, so it should be possible to avoid copying.
+    RefPtr<SharedBuffer> sharedBuffer = SharedBuffer::create((char*)buffer->data(), buffer->byteLength());
 
     OwnPtr<ImageSource> source = adoptPtr(new ImageSource());
     source->setData(*sharedBuffer, true);