Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/webmidi/MIDIOutput.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 197 matching lines @@
 
     if (MessageValidator::validate(array, exceptionState, midiAccess()->sysexEnabled()))
         midiAccess()->sendMIDIData(m_portIndex, array->data(), array->length(), timestamp);
 }
 
 void MIDIOutput::send(Vector<unsigned> unsignedData, double timestamp, ExceptionState& exceptionState)
 {
     if (timestamp == 0.0)
         timestamp = now(executionContext());
 
-    RefPtr<DOMUint8Array> array = DOMUint8Array::create(unsignedData.size());
+    // TODO(junov): crbug.com/536816
+    // Use createOrNull instead of deprecatedCreateOrCrash. Requires determining
+    // the appropriate course of action for dealing with allocation failures, which
+    // is currently not specified in the spec. Throwing a RangeError may be
+    // appropriate considering the ECMAScript spec:
+    // http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+    // However the spec for MIDIOutput.send does not state that such exceptions
+    // should be re-thrown, so for now we just crash the process when out of memory.
+    RefPtr<DOMUint8Array> array = DOMUint8Array::deprecatedCreateOrCrash(unsignedData.size());
     DOMUint8Array::ValueType* const arrayData = array->data();
     const uint32_t arrayLength = array->length();
 
     for (size_t i = 0; i < unsignedData.size(); ++i) {
         if (unsignedData[i] > 0xff) {
             exceptionState.throwTypeError("The value at index " + String::number(i) + " (" + String::number(unsignedData[i]) + ") is greater than 0xFF.");
             return;
         }
         if (i < arrayLength)
             arrayData[i] = unsignedData[i] & 0xff;
@@ skipping 11 matching lines @@
 {
     send(unsignedData, 0.0, exceptionState);
 }
 
 DEFINE_TRACE(MIDIOutput)
 {
     MIDIPort::trace(visitor);
 }
 
 } // namespace blink