Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

Index: third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index 33c94ce4305b2b71abc3ffa947e9bfeff9a3c3aa..14beaf38349ea2962cc5434d9433e9a97c1824c6 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
@@ -286,7 +286,7 @@ ScriptValue WebGL2RenderingContextBase::getInternalformatParameter(ScriptState*
     case GL_RGBA16I:
     case GL_RGBA32UI:
     case GL_RGBA32I:
-        return WebGLAny(scriptState, DOMInt32Array::create(0));
+        return WebGLAny(scriptState, DOMInt32Array::deprecatedCreateOrCrash(nullptr, 0));
     case GL_R8:
     case GL_RG8:
     case GL_RGB8:
@@ -314,13 +314,14 @@ ScriptValue WebGL2RenderingContextBase::getInternalformatParameter(ScriptState*
             GLint length = -1;
             webContext()->getInternalformativ(target, internalformat, GL_NUM_SAMPLE_COUNTS, 1, &length);
             if (length <= 0)
-                return WebGLAny(scriptState, DOMInt32Array::create(0));
+                return WebGLAny(scriptState, DOMInt32Array::deprecatedCreateOrCrash(nullptr, 0));
 
             OwnPtr<GLint[]> values = adoptArrayPtr(new GLint[length]);
             for (GLint ii = 0; ii < length; ++ii)
                 values[ii] = 0;
             webContext()->getInternalformativ(target, internalformat, GL_SAMPLES, length, values.get());
-            return WebGLAny(scriptState, DOMInt32Array::create(values.get(), length));
+            RefPtr<DOMInt32Array> valueArray = DOMInt32Array::deprecatedCreateOrCrash(values.get(), length);
+            return WebGLAny(scriptState, valueArray.release());
         }
     default:
         synthesizeGLError(GL_INVALID_ENUM, "getInternalformatParameter", "invalid parameter name");
@@ -2020,7 +2021,8 @@ ScriptValue WebGL2RenderingContextBase::getActiveUniformBlockParameter(ScriptSta
 
             Vector<GLint> indices(uniformCount);
             webContext()->getActiveUniformBlockiv(objectOrZero(program), uniformBlockIndex, pname, indices.data());
-            return WebGLAny(scriptState, DOMUint32Array::create(reinterpret_cast<GLuint*>(indices.data()), indices.size()));
+            // FIXME: Should we consider throwing a RangeError exception instead of crashing when array alloc fails.
+            return WebGLAny(scriptState, DOMUint32Array::deprecatedCreateOrCrash(reinterpret_cast<GLuint*>(indices.data()), indices.size()));
         }
     case GL_UNIFORM_BLOCK_REFERENCED_BY_VERTEX_SHADER:
     case GL_UNIFORM_BLOCK_REFERENCED_BY_FRAGMENT_SHADER: