Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/bluetooth/BluetoothGATTCharacteristic.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/bluetooth/BluetoothGATTCharacteristic.h"
 
 #include "bindings/core/v8/CallbackPromiseAdapter.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
@@ skipping 27 matching lines @@
     // See note in ActiveDOMObject about suspendIfNeeded.
     characteristic->suspendIfNeeded();
     return characteristic;
 }
 
 void BluetoothGATTCharacteristic::dispatchCharacteristicValueChanged(
     const WebVector<uint8_t>& value)
 {
     static_assert(sizeof(*value.data()) == 1, "uint8_t should be a single byte");
 
-    m_value = DOMArrayBuffer::create(value.data(), value.size());
+    // TODO(junov): crbug.com/536816
+    // Should use createOrNull. Requires figuring out a graceful way
+    // to handle allocation failures.
+    m_value = DOMArrayBuffer::deprecatedCreateOrCrash(value.data(), value.size());
 
     dispatchEvent(Event::create(EventTypeNames::characteristicvaluechanged));
 }
 
 void BluetoothGATTCharacteristic::stop()
 {
     notifyCharacteristicObjectRemoved();
 }
 
 void BluetoothGATTCharacteristic::dispose()
@@ skipping 83 matching lines @@
 }
 
 DEFINE_TRACE(BluetoothGATTCharacteristic)
 {
     RefCountedGarbageCollectedEventTargetWithInlineData<BluetoothGATTCharacteristic>::trace(visitor);
     ActiveDOMObject::trace(visitor);
     visitor->trace(m_properties);
 }
 
 } // namespace blink