diff -up webkitgtk-2.8.3/Source/bmalloc/bmalloc/Allocator.cpp.bmalloc_xlarge webkitgtk-2.8.3/Source/bmalloc/bmalloc/Allocator.cpp
--- webkitgtk-2.8.3/Source/bmalloc/bmalloc/Allocator.cpp.bmalloc_xlarge	2015-05-12 11:03:12.000000000 +0200
+++ webkitgtk-2.8.3/Source/bmalloc/bmalloc/Allocator.cpp	2015-05-28 08:52:35.782657396 +0200
@@ -59,8 +59,12 @@ void* Allocator::tryAllocate(size_t size
     if (size <= largeMax)
         return allocate(size);
 
-    std::lock_guard<StaticMutex> lock(PerProcess<Heap>::mutex());
-    return PerProcess<Heap>::get()->tryAllocateXLarge(lock, superChunkSize, roundUpToMultipleOf<xLargeAlignment>(size));
+    if (size <= xLargeMax) {
+        std::lock_guard<StaticMutex> lock(PerProcess<Heap>::mutex());
+        return PerProcess<Heap>::getFastCase()->tryAllocateXLarge(lock, superChunkSize, roundUpToMultipleOf<xLargeAlignment>(size));
+    }
+
+    return nullptr;
 }
 
 void* Allocator::allocate(size_t alignment, size_t size)
@@ -93,18 +97,25 @@ void* Allocator::allocate(size_t alignme
         }
     }
 
-    size = std::max(largeMin, roundUpToMultipleOf<largeAlignment>(size));
-    alignment = roundUpToMultipleOf<largeAlignment>(alignment);
-    size_t unalignedSize = largeMin + alignment + size;
-    if (unalignedSize <= largeMax && alignment <= largeChunkSize / 2) {
+    if (size <= largeMax && alignment <= largeMax) {
+        size = std::max(largeMin, roundUpToMultipleOf<largeAlignment>(size));
+        alignment = roundUpToMultipleOf<largeAlignment>(alignment);
+        size_t unalignedSize = largeMin + alignment + size;
+        if (unalignedSize <= largeMax && alignment <= largeChunkSize / 2) {
+            std::lock_guard<StaticMutex> lock(PerProcess<Heap>::mutex());
+            return PerProcess<Heap>::getFastCase()->allocateLarge(lock, alignment, size, unalignedSize);
+        }
+    }
+
+    if (size <= xLargeMax && alignment <= xLargeMax) {
+        size = roundUpToMultipleOf<xLargeAlignment>(size);
+        alignment = std::max(superChunkSize, alignment);
         std::lock_guard<StaticMutex> lock(PerProcess<Heap>::mutex());
-        return PerProcess<Heap>::getFastCase()->allocateLarge(lock, alignment, size, unalignedSize);
+        return PerProcess<Heap>::getFastCase()->allocateXLarge(lock, alignment, size);
     }
 
-    size = roundUpToMultipleOf<xLargeAlignment>(size);
-    alignment = std::max(superChunkSize, alignment);
-    std::lock_guard<StaticMutex> lock(PerProcess<Heap>::mutex());
-    return PerProcess<Heap>::getFastCase()->allocateXLarge(lock, alignment, size);
+    BCRASH();
+    return nullptr;
 }
 
 void* Allocator::reallocate(void* object, size_t newSize)
@@ -242,7 +253,11 @@ void* Allocator::allocateSlowCase(size_t
     if (size <= largeMax)
         return allocateLarge(size);
 
-    return allocateXLarge(size);
+    if (size <= xLargeMax)
+        return allocateXLarge(size);
+
+    BCRASH();
+    return nullptr;
 }
 
 } // namespace bmalloc
diff -up webkitgtk-2.8.3/Source/bmalloc/bmalloc/BAssert.h.bmalloc_xlarge webkitgtk-2.8.3/Source/bmalloc/bmalloc/BAssert.h
--- webkitgtk-2.8.3/Source/bmalloc/bmalloc/BAssert.h.bmalloc_xlarge	2015-05-15 10:41:50.000000000 +0200
+++ webkitgtk-2.8.3/Source/bmalloc/bmalloc/BAssert.h	2015-05-28 08:52:35.781657379 +0200
@@ -26,10 +26,14 @@
 #ifndef BAssert_h
 #define BAssert_h
 
+#define BCRASH() do { \
+    *(int*)0xbbadbeef = 0; \
+} while (0);
+
 #define BASSERT_IMPL(x) do { \
     if (!(x)) \
-        *(int*)0xbbadbeef = 0; \
-} while(0);
+        BCRASH(); \
+} while (0);
 
 #define RELEASE_BASSERT(x) BASSERT_IMPL(x)
 
diff -up webkitgtk-2.8.3/Source/bmalloc/bmalloc/Sizes.h.bmalloc_xlarge webkitgtk-2.8.3/Source/bmalloc/bmalloc/Sizes.h
--- webkitgtk-2.8.3/Source/bmalloc/bmalloc/Sizes.h.bmalloc_xlarge	2015-04-28 12:38:00.000000000 +0200
+++ webkitgtk-2.8.3/Source/bmalloc/bmalloc/Sizes.h	2015-05-28 08:52:35.782657396 +0200
@@ -80,6 +80,7 @@ namespace Sizes {
     static const size_t largeMin = mediumMax;
     
     static const size_t xLargeAlignment = vmPageSize;
+    static const size_t xLargeMax = std::numeric_limits<size_t>::max() - xLargeAlignment; // Make sure that rounding up to xLargeAlignment does not overflow.
 
     static const size_t freeListSearchDepth = 16;
     static const size_t freeListGrowFactor = 2;