Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp

Index: third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
diff --git a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
index 1e249164fbf8d0eb30c4f7789c6b32b40b9e9427..877fce7e76ae908da0f76393d51d5a0cee99c7de 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGL2RenderingContextBase.cpp
@@ -286,7 +286,7 @@ ScriptValue WebGL2RenderingContextBase::getInternalformatParameter(ScriptState*
     case GL_RGBA16I:
     case GL_RGBA32UI:
     case GL_RGBA32I:
-        return WebGLAny(scriptState, DOMInt32Array::create(0));
+        return WebGLAny(scriptState, DOMInt32Array::deprecatedCreateOrCrash(nullptr, 0));
     case GL_R8:
     case GL_RG8:
     case GL_RGB8:
@@ -314,13 +314,14 @@ ScriptValue WebGL2RenderingContextBase::getInternalformatParameter(ScriptState*
             GLint length = -1;
             webContext()->getInternalformativ(target, internalformat, GL_NUM_SAMPLE_COUNTS, 1, &length);
             if (length <= 0)
-                return WebGLAny(scriptState, DOMInt32Array::create(0));
+                return WebGLAny(scriptState, DOMInt32Array::deprecatedCreateOrCrash(nullptr, 0));
 
             OwnPtr<GLint[]> values = adoptArrayPtr(new GLint[length]);
             for (GLint ii = 0; ii < length; ++ii)
                 values[ii] = 0;
             webContext()->getInternalformativ(target, internalformat, GL_SAMPLES, length, values.get());
-            return WebGLAny(scriptState, DOMInt32Array::create(values.get(), length));
+            RefPtr<DOMInt32Array> valueArray = DOMInt32Array::deprecatedCreateOrCrash(values.get(), length);
+            return WebGLAny(scriptState, valueArray.release());
         }
     default:
         synthesizeGLError(GL_INVALID_ENUM, "getInternalformatParameter", "invalid parameter name");
@@ -2082,7 +2083,8 @@ ScriptValue WebGL2RenderingContextBase::getActiveUniformBlockParameter(ScriptSta
 
             Vector<GLint> indices(uniformCount);
             webContext()->getActiveUniformBlockiv(objectOrZero(program), uniformBlockIndex, pname, indices.data());
-            return WebGLAny(scriptState, DOMUint32Array::create(reinterpret_cast<GLuint*>(indices.data()), indices.size()));
+            // FIXME: Should we consider throwing a RangeError exception instead of crashing when array alloc fails.

[haraken, 2015/10/29 18:58:37]

allocation

[Justin Novosad, 2015/11/05 00:17:52]

Done.

+            return WebGLAny(scriptState, DOMUint32Array::deprecatedCreateOrCrash(reinterpret_cast<GLuint*>(indices.data()), indices.size()));
         }
     case GL_UNIFORM_BLOCK_REFERENCED_BY_VERTEX_SHADER:
     case GL_UNIFORM_BLOCK_REFERENCED_BY_FRAGMENT_SHADER: