Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/push_messaging/PushMessageData.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8Binding.h"
@@ skipping 38 matching lines @@
 {
     m_data.append(data, bytesSize);
 }
 
 PushMessageData::~PushMessageData()
 {
 }
 
 PassRefPtr<DOMArrayBuffer> PushMessageData::arrayBuffer() const
 {
-    return DOMArrayBuffer::create(m_data.data(), m_data.size());
+    // TODO(junov): crbug.com/536816
+    // Use createOrNull instead of deprecatedCreateOrCrash. Requires
+    // defining behavior for when allocation fails. ECMAScript spec says
+    // allocation failure should throw a RangeError exception, but the
+    // spec for PushMessageData.arrayBuffer() does not state that
+    // such exceptions should be re-thrown. So for now, we just crash.
+    RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::deprecatedCreateOrCrash(m_data.data(), m_data.size());
+    return buffer.release();
 }
 
 Blob* PushMessageData::blob() const
 {
     OwnPtr<BlobData> blobData = BlobData::create();
     blobData->appendBytes(m_data.data(), m_data.size());
 
     // Note that the content type of the Blob object is deliberately not being
     // provided, following the specification.
 
@@ skipping 21 matching lines @@
 String PushMessageData::text() const
 {
     return UTF8Encoding().decode(m_data.data(), m_data.size());
 }
 
 DEFINE_TRACE(PushMessageData)
 {
 }
 
 } // namespace blink