Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/web/WebSocketImpl.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 154 matching lines @@
     m_client->didReceiveMessage(WebString(payload));
 }
 
 void WebSocketImpl::didReceiveBinaryMessage(PassOwnPtr<Vector<char>> payload)
 {
     switch (m_binaryType) {
     case BinaryTypeBlob:
         // FIXME: Handle Blob after supporting WebBlob.
         break;
     case BinaryTypeArrayBuffer:
-        m_client->didReceiveArrayBuffer(WebArrayBuffer(DOMArrayBuffer::create(payload->data(), payload->size())));
+        RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::createOrNull(payload->data(), payload->size());
+        if (buffer)
+            m_client->didReceiveArrayBuffer(WebArrayBuffer(buffer.release()));
         break;
     }
 }
 
 void WebSocketImpl::didError()
 {
     m_client->didReceiveMessageError();
 }
 
 void WebSocketImpl::didConsumeBufferedAmount(unsigned long consumed)
@@ skipping 13 matching lines @@
 void WebSocketImpl::didClose(WebSocketChannelClient::ClosingHandshakeCompletionStatus status, unsigned short code, const String& reason)
 {
     m_isClosingOrClosed = true;
     m_client->didClose(static_cast<WebSocketClient::ClosingHandshakeCompletionStatus>(status), code, WebString(reason));
 
     // FIXME: Deprecate this call.
     m_client->didClose(m_bufferedAmount - m_bufferedAmountAfterClose, static_cast<WebSocketClient::ClosingHandshakeCompletionStatus>(status), code, WebString(reason));
 }
 
 } // namespace blink