Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp

Index: third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp
diff --git a/third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp b/third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp
index 78a7447e23b99407fa47bc313b3a1b68d4739533..90eb8b7ffb88fb93d34e389f9f336035a6bc7b05 100644
--- a/third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp
+++ b/third_party/WebKit/Source/wtf/ArrayBufferBuilder.cpp
@@ -42,11 +42,12 @@ ArrayBufferBuilder::ArrayBufferBuilder()
     : m_bytesUsed(0)
     , m_variableCapacity(true)
 {
-    m_buffer = ArrayBuffer::create(defaultBufferCapacity, 1);
+    m_buffer = ArrayBuffer::createOrNull(defaultBufferCapacity, 1);
 }
 
 bool ArrayBufferBuilder::expandCapacity(unsigned sizeToIncrease)
 {
+    ASSERT(isValid());
     unsigned currentBufferSize = m_buffer->byteLength();
 
     // If the size of the buffer exceeds max of unsigned, it can't be grown any
@@ -64,7 +65,7 @@ bool ArrayBufferBuilder::expandCapacity(unsigned sizeToIncrease)
         newBufferSize = exponentialGrowthNewBufferSize;
 
     // Copy existing data in current buffer to new buffer.
-    RefPtr<ArrayBuffer> newBuffer = ArrayBuffer::create(newBufferSize, 1);
+    RefPtr<ArrayBuffer> newBuffer = ArrayBuffer::createOrNull(newBufferSize, 1);
     if (!newBuffer)
         return false;
 
@@ -75,6 +76,7 @@ bool ArrayBufferBuilder::expandCapacity(unsigned sizeToIncrease)
 
 unsigned ArrayBufferBuilder::append(const char* data, unsigned length)
 {
+    ASSERT(isValid());
     ASSERT(length > 0);
 
     unsigned currentBufferSize = m_buffer->byteLength();
@@ -102,24 +104,33 @@ unsigned ArrayBufferBuilder::append(const char* data, unsigned length)
 
 PassRefPtr<ArrayBuffer> ArrayBufferBuilder::toArrayBuffer()
 {
+    ASSERT(isValid());
     // Fully used. Return m_buffer as-is.
     if (m_buffer->byteLength() == m_bytesUsed)
         return m_buffer;
 
-    return m_buffer->slice(0, m_bytesUsed);
+    RefPtr<ArrayBuffer> tmp = m_buffer->sliceOrNull(0, m_bytesUsed);
+    if (tmp)
+        return tmp;
+    return m_buffer;
 }
 
 String ArrayBufferBuilder::toString()
 {
+    ASSERT(isValid());
     return String(static_cast<const char*>(m_buffer->data()), m_bytesUsed);
 }
 
 void ArrayBufferBuilder::shrinkToFit()
 {
+    ASSERT(isValid());
     ASSERT(m_bytesUsed <= m_buffer->byteLength());
 
-    if (m_buffer->byteLength() > m_bytesUsed)
-        m_buffer = m_buffer->slice(0, m_bytesUsed);
+    if (m_buffer->byteLength() > m_bytesUsed) {
+        RefPtr<ArrayBuffer> tmp = m_buffer->sliceOrNull(0, m_bytesUsed);
+        if (tmp)
+            m_buffer = tmp;
+    }
 }
 
 } // namespace WTF