Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/bluetooth/ConvertWebVectorToArrayBuffer.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "modules/bluetooth/ConvertWebVectorToArrayBuffer.h"
 
 namespace blink {
 
 PassRefPtr<DOMArrayBuffer> ConvertWebVectorToArrayBuffer::take(ScriptPromiseResolver*, const WebVector<uint8_t>& webVector)
 {
     static_assert(sizeof(*webVector.data()) == 1, "uint8_t should be a single byte");
-
-    RefPtr<DOMArrayBuffer> domBuffer = DOMArrayBuffer::create(webVector.data(), webVector.size());
-
+    // FIXME(crbug.com/536816):
+    // We should use DOMArrayBuffer::createOrNull here, but dealing
+    // with the null case is tricky because CallbackPromiseAdapter
+    // was not designed to allow the promise to be rejected in the success
+    // handler.
+    // The right thing to do would probably be to reject the promise with
+    // a RangeError exception when the ArrayBuffer allocation fails.
+    RefPtr<DOMArrayBuffer> domBuffer = DOMArrayBuffer::deprecatedCreateOrCrash(webVector.data(), webVector.size());
     return domBuffer;
 }
 
 } // namespace blink