Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

Index: third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index 121203c794f0f4ef26cbf827366cea2a23d4c805..0aae2800cf1bcc77a85650f7379a92bcca4cecdd 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
@@ -333,7 +333,7 @@ ScriptValue WebGL2RenderingContextBase::getInternalformatParameter(ScriptState*
     case GL_RGBA16I:
     case GL_RGBA32UI:
     case GL_RGBA32I:
-        return WebGLAny(scriptState, DOMInt32Array::create(0));
+        return WebGLAny(scriptState, DOMInt32Array::deprecatedCreateOrCrash(nullptr, 0));
     case GL_R8:
     case GL_RG8:
     case GL_RGB8:
@@ -361,13 +361,14 @@ ScriptValue WebGL2RenderingContextBase::getInternalformatParameter(ScriptState*
             GLint length = -1;
             webContext()->getInternalformativ(target, internalformat, GL_NUM_SAMPLE_COUNTS, 1, &length);
             if (length <= 0)
-                return WebGLAny(scriptState, DOMInt32Array::create(0));
+                return WebGLAny(scriptState, DOMInt32Array::deprecatedCreateOrCrash(nullptr, 0));
 
             OwnPtr<GLint[]> values = adoptArrayPtr(new GLint[length]);
             for (GLint ii = 0; ii < length; ++ii)
                 values[ii] = 0;
             webContext()->getInternalformativ(target, internalformat, GL_SAMPLES, length, values.get());
-            return WebGLAny(scriptState, DOMInt32Array::create(values.get(), length));
+            RefPtr<DOMInt32Array> valueArray = DOMInt32Array::deprecatedCreateOrCrash(values.get(), length);
+            return WebGLAny(scriptState, valueArray.release());
         }
     default:
         synthesizeGLError(GL_INVALID_ENUM, "getInternalformatParameter", "invalid parameter name");
@@ -2129,7 +2130,11 @@ ScriptValue WebGL2RenderingContextBase::getActiveUniformBlockParameter(ScriptSta
 
             Vector<GLint> indices(uniformCount);
             webContext()->getActiveUniformBlockiv(objectOrZero(program), uniformBlockIndex, pname, indices.data());
-            return WebGLAny(scriptState, DOMUint32Array::create(reinterpret_cast<GLuint*>(indices.data()), indices.size()));
+            // TODO(junov): crbug.com/536816
+            // We should consider throwing a RangeError exception instead
+            // of crashing when array allocation fails. Doing so may require
+            // amending the WebGL specification.
+            return WebGLAny(scriptState, DOMUint32Array::deprecatedCreateOrCrash(reinterpret_cast<GLuint*>(indices.data()), indices.size()));
         }
     case GL_UNIFORM_BLOCK_REFERENCED_BY_VERTEX_SHADER:
     case GL_UNIFORM_BLOCK_REFERENCED_BY_FRAGMENT_SHADER: