1 files changed, 8 insertions, 5 deletions
diff --git a/core/java/android/webkit/ByteArrayBuilder.java b/core/java/android/webkit/ByteArrayBuilder.java
index d32a962e5e4f..334526b8ab57 100644
--- a/core/java/android/webkit/ByteArrayBuilder.java
+++ b/core/java/android/webkit/ByteArrayBuilder.java
@@ -114,14 +114,17 @@ class ByteArrayBuilder {
             length = DEFAULT_CAPACITY;
         }
         synchronized (sPool) {
-            // Process any queued references so that sPool does not contain
-            // dead entries.
+            // Process any queued references and remove them from the pool.
             processPoolLocked();
             if (!sPool.isEmpty()) {
-                return sPool.removeFirst().get();
-            } else {
-                return new Chunk(length);
+                Chunk c = sPool.removeFirst().get();
+                // The first item may have been queued after processPoolLocked
+                // so check for null.
+                if (c != null) {
+                    return c;
+                }
             }
+            return new Chunk(length);
         }
     }