Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webmidi/MIDIOutput.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 197 matching lines @@
 
     if (MessageValidator::validate(array, exceptionState, midiAccess()->sysexEnabled()))
         midiAccess()->sendMIDIData(m_portIndex, array->data(), array->length(), timestamp);
 }
 
 void MIDIOutput::send(Vector<unsigned> unsignedData, double timestamp, ExceptionState& exceptionState)
 {
     if (timestamp == 0.0)
         timestamp = now(executionContext());
 
-    RefPtr<DOMUint8Array> array = DOMUint8Array::create(unsignedData.size());
+    RefPtr<DOMUint8Array> array = DOMUint8Array::createOrNull(unsignedData.size());
+    if (!array) {
+        exceptionState.throwRangeError("Out of memory.");
+        return;
+    }
     DOMUint8Array::ValueType* const arrayData = array->data();
     const uint32_t arrayLength = array->length();
 
     for (size_t i = 0; i < unsignedData.size(); ++i) {
         if (unsignedData[i] > 0xff) {
             exceptionState.throwTypeError("The value at index " + String::number(i) + " (" + String::number(unsignedData[i]) + ") is greater than 0xFF.");
             return;
         }
         if (i < arrayLength)
             arrayData[i] = unsignedData[i] & 0xff;
@@ skipping 11 matching lines @@
 {
     send(unsignedData, 0.0, exceptionState);
 }
 
 DEFINE_TRACE(MIDIOutput)
 {
     MIDIPort::trace(visitor);
 }
 
 } // namespace blink