Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp

Index: third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
diff --git a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
index 422ab061da14c92860b5bb19173c086db082e433..807559deb835a1e2d162937b955a9362b39d6a29 100644
--- a/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
+++ b/third_party/WebKit/Source/core/imagebitmap/ImageBitmapFactories.cpp
@@ -176,11 +176,14 @@ void ImageBitmapFactories::ImageBitmapLoader::rejectPromise()
 
 void ImageBitmapFactories::ImageBitmapLoader::didFinishLoading()
 {
-    if (!m_loader.arrayBufferResult()) {
+    RefPtr<DOMArrayBuffer> buffer = m_loader.arrayBufferResultOrNull();
+    if (!buffer) {
         rejectPromise();
         return;
     }
-    RefPtr<SharedBuffer> sharedBuffer = SharedBuffer::create((char*)m_loader.arrayBufferResult()->data(), m_loader.arrayBufferResult()->byteLength());
+    // FIXME: Is there a way to transfer 'buffer' without making a copy?

[Stephen White, 2015/10/29 16:29:52]

Log a bug for this?

[Justin Novosad, 2015/10/29 18:26:02]

Done.

+    // The loaded data is read-only, so it should be possible to avoid copying.
+    RefPtr<SharedBuffer> sharedBuffer = SharedBuffer::create((char*)buffer->data(), buffer->byteLength());
 
     OwnPtr<ImageSource> source = adoptPtr(new ImageSource());
     source->setData(*sharedBuffer, true);