Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp

Index: third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
diff --git a/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp b/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
index d7c888848d0e54971342da1dda9e783cc74c0342..c00a21e11ec70df2727e4d1a1ae532ab682e6bdc 100644
--- a/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
+++ b/third_party/WebKit/Source/modules/webaudio/AudioBuffer.cpp
@@ -151,6 +151,13 @@ AudioBuffer::AudioBuffer(unsigned numberOfChannels, size_t numberOfFrames, float
         RefPtr<DOMFloat32Array> channelDataArray = createFloat32ArrayOrNull(m_length);
         // If the channel data array could not be created, just return. The caller will need to
         // check that the desired number of channels were created.
+
+        // TODO(junov) crbug.com/536816
+        // According to ECMAScript spec, failure to allocate should result in a
+        // RangeError exception being thrown:
+        // http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+        // The spec for createBuffer does not specify whether such an exception
+        // should be re-thrown.
         if (!channelDataArray) {
             return;
         }
@@ -171,6 +178,11 @@ AudioBuffer::AudioBuffer(AudioBus* bus)
         RefPtr<DOMFloat32Array> channelDataArray = createFloat32ArrayOrNull(m_length);
         // If the channel data array could not be created, just return. The caller will need to
         // check that the desired number of channels were created.
+
+        // TODO(junov): crbug.com/536816
+        // According to ECMAScript spec, failure to allocate should result in a
+        // RangeError exception being thrown:
+        // http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
         if (!channelDataArray)
             return;
 
@@ -190,7 +202,9 @@ PassRefPtr<DOMFloat32Array> AudioBuffer::getChannelData(unsigned channelIndex, E
     }
 
     DOMFloat32Array* channelData = m_channels[channelIndex].get();
-    return DOMFloat32Array::create(channelData->buffer(), channelData->byteOffset(), channelData->length());
+    RefPtr<DOMArrayBuffer> buffer = channelData->bufferOrNull();
+    RELEASE_ASSERT(buffer); // crbug.com/536816
+    return DOMFloat32Array::create(buffer.release(), channelData->byteOffset(), channelData->length());
 }
 
 DOMFloat32Array* AudioBuffer::getChannelData(unsigned channelIndex)