Fix heap snapshot crash when JSArrayBuffer has no backing_store.

src/heap-snapshot-generator.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1446 matching lines @@
 
 
 void V8HeapExplorer::ExtractJSArrayBufferReferences(
     int entry, JSArrayBuffer* buffer) {
   SetWeakReference(buffer, entry, "weak_next", buffer->weak_next(),
                    JSArrayBuffer::kWeakNextOffset);
   SetWeakReference(buffer, entry,
                    "weak_first_view", buffer->weak_first_view(),
                    JSArrayBuffer::kWeakFirstViewOffset);
   // Setup a reference to a native memory backing_store object.
+  if (!buffer->backing_store())
+    return;
   size_t data_size = NumberToSize(heap_->isolate(), buffer->byte_length());
   CHECK(data_size <= static_cast<size_t>(kMaxInt));
   HeapEntry* data_entry = AddEntry(
       static_cast<Address>(buffer->backing_store()),
       HeapEntry::kNative, "system / ArrayBufferData",
       static_cast<int>(data_size));
   filler_->SetNamedReference(HeapGraphEdge::kInternal,
                              entry, "backing_store", data_entry);
 }
 
@@ skipping 1544 matching lines @@
   writer_->AddString("\"<dummy>\"");
   for (int i = 1; i < sorted_strings.length(); ++i) {
     writer_->AddCharacter(',');
     SerializeString(sorted_strings[i]);
     if (writer_->aborted()) return;
   }
 }
 
 
 } }  // namespace v8::internal