1 files changed, 33 insertions, 13 deletions

diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h
index 9ba70628af2..00ba385dafc 100644
--- a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h
+++ b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h
@@ -5,9 +5,10 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_CORE_TYPED_ARRAYS_DOM_ARRAY_BUFFER_H_
 #define THIRD_PARTY_BLINK_RENDERER_CORE_TYPED_ARRAYS_DOM_ARRAY_BUFFER_H_
 
+#include "base/allocator/partition_allocator/oom.h"
 #include "base/containers/span.h"
 #include "third_party/blink/renderer/core/core_export.h"
-#include "third_party/blink/renderer/core/typed_arrays/array_buffer/array_buffer.h"
+#include "third_party/blink/renderer/core/typed_arrays/array_buffer/array_buffer_contents.h"
 #include "third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
@@ -17,29 +18,43 @@ class CORE_EXPORT DOMArrayBuffer final : public DOMArrayBufferBase {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  static DOMArrayBuffer* Create(scoped_refptr<ArrayBuffer> buffer) {
-    return MakeGarbageCollected<DOMArrayBuffer>(std::move(buffer));
+  static DOMArrayBuffer* Create(ArrayBufferContents contents) {
+    return MakeGarbageCollected<DOMArrayBuffer>(std::move(contents));
   }
   static DOMArrayBuffer* Create(size_t num_elements, size_t element_byte_size) {
-    return Create(ArrayBuffer::Create(num_elements, element_byte_size));
+    ArrayBufferContents contents(num_elements, element_byte_size,
+                                 ArrayBufferContents::kNotShared,
+                                 ArrayBufferContents::kZeroInitialize);
+    if (UNLIKELY(!contents.Data())) {
+      OOM_CRASH(num_elements * element_byte_size);
+    }
+    return Create(std::move(contents));
   }
   static DOMArrayBuffer* Create(const void* source, size_t byte_length) {
-    return Create(ArrayBuffer::Create(source, byte_length));
-  }
-  static DOMArrayBuffer* Create(ArrayBufferContents& contents) {
-    return Create(ArrayBuffer::Create(contents));
+    ArrayBufferContents contents(byte_length, 1,
+                                 ArrayBufferContents::kNotShared,
+                                 ArrayBufferContents::kDontInitialize);
+    if (UNLIKELY(!contents.Data())) {
+      OOM_CRASH(byte_length);
+    }
+    memcpy(contents.Data(), source, byte_length);
+    return Create(std::move(contents));
   }
+
   static DOMArrayBuffer* Create(scoped_refptr<SharedBuffer>);
   static DOMArrayBuffer* Create(const Vector<base::span<const char>>&);
 
+  static DOMArrayBuffer* CreateOrNull(size_t num_elements,
+                                      size_t element_byte_size);
+
   // Only for use by XMLHttpRequest::responseArrayBuffer,
   // Internals::serializeObject, and
   // FetchDataLoaderAsArrayBuffer::OnStateChange.
   static DOMArrayBuffer* CreateUninitializedOrNull(size_t num_elements,
                                                    size_t element_byte_size);
 
-  explicit DOMArrayBuffer(scoped_refptr<ArrayBuffer> buffer)
-      : DOMArrayBufferBase(std::move(buffer)) {}
+  explicit DOMArrayBuffer(ArrayBufferContents contents)
+      : DOMArrayBufferBase(std::move(contents)) {}
 
   DOMArrayBuffer* Slice(size_t begin, size_t end) const;
 
@@ -53,11 +68,16 @@ class CORE_EXPORT DOMArrayBuffer final : public DOMArrayBufferBase {
   // for e.g. WebAudio which uses a separate thread for processing the
   // ArrayBuffer while at the same time exposing a NonShared Float32Array.
   bool ShareNonSharedForInternalUse(ArrayBufferContents& result) {
-    return Buffer()->ShareNonSharedForInternalUse(result);
+    if (!Content()->BackingStore()) {
+      result.Detach();
+      return false;
+    }
+    Content()->ShareNonSharedForInternalUse(result);
+    return true;
   }
 
-  v8::Local<v8::Object> Wrap(v8::Isolate*,
-                             v8::Local<v8::Object> creation_context) override;
+  v8::Local<v8::Value> Wrap(v8::Isolate*,
+                            v8::Local<v8::Object> creation_context) override;
 };
 
 }  // namespace blink