Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp

Index: third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp b/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
index d7c888848d0e54971342da1dda9e783cc74c0342..151e2871eacae0dc1c8496be76d694aa6afa1eba 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
@@ -151,6 +151,11 @@ AudioBuffer::AudioBuffer(unsigned numberOfChannels, size_t numberOfFrames, float
         RefPtr<DOMFloat32Array> channelDataArray = createFloat32ArrayOrNull(m_length);
         // If the channel data array could not be created, just return. The caller will need to
         // check that the desired number of channels were created.
+
+        // FIXME(crbug.com/536816): According to ECMAScript spec, failure to allocate should result in a
+        // RangeError exception being thrown: http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+        // The spec for createBuffer does not specify whether such an exception should be
+        // re-thrown.
         if (!channelDataArray) {
             return;
         }
@@ -171,6 +176,9 @@ AudioBuffer::AudioBuffer(AudioBus* bus)
         RefPtr<DOMFloat32Array> channelDataArray = createFloat32ArrayOrNull(m_length);
         // If the channel data array could not be created, just return. The caller will need to
         // check that the desired number of channels were created.
+
+        // FIXME(crbug.com/536816): According to ECMAScript spec, failure to allocate should result in a
+        // RangeError exception being thrown: http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
         if (!channelDataArray)
             return;
 
@@ -190,7 +198,9 @@ PassRefPtr<DOMFloat32Array> AudioBuffer::getChannelData(unsigned channelIndex, E
     }
 
     DOMFloat32Array* channelData = m_channels[channelIndex].get();
-    return DOMFloat32Array::create(channelData->buffer(), channelData->byteOffset(), channelData->length());
+    RefPtr<DOMArrayBuffer> buffer = channelData->bufferOrNull();
+    RELEASE_ASSERT(buffer); // crbug.com/536816
+    return DOMFloat32Array::create(buffer.release(), channelData->byteOffset(), channelData->length());
 }
 
 DOMFloat32Array* AudioBuffer::getChannelData(unsigned channelIndex)