Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp

Index: third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp
diff --git a/third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp b/third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp
index b262989882dd4ea2ba48c0107d01fa74a32fdb18..f8df5665adf5a5d3438f6e67516df683dcd07a6e 100644
--- a/third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp
+++ b/third_party/WebKit/Source/modules/presentation/PresentationConnection.cpp
@@ -203,11 +203,11 @@ void PresentationConnection::send(PassRefPtr<DOMArrayBuffer> arrayBuffer, Except
 
 void PresentationConnection::send(PassRefPtr<DOMArrayBufferView> arrayBufferView, ExceptionState& exceptionState)
 {
-    ASSERT(arrayBufferView);
+    ASSERT(arrayBufferView && arrayBufferView->bufferOrNull());
     if (!canSendMessage(exceptionState))
         return;
 
-    m_messages.append(adoptPtr(new Message(arrayBufferView->buffer())));
+    m_messages.append(adoptPtr(new Message(arrayBufferView->bufferOrNull())));
     handleMessageQueue();
 }
 
@@ -304,9 +304,11 @@ void PresentationConnection::didReceiveBinaryMessage(const uint8_t* data, size_t
         return;
     }
     case BinaryTypeArrayBuffer:
-        RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::create(data, length);
-        dispatchEvent(MessageEvent::create(buffer.release()));
-        return;
+        RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::createOrNull(data, length);
+        // Can't throw a RangeError exception from here, so being out
+        // of memory will fail silently by dropping the message.
+        if (buffer)
+            dispatchEvent(MessageEvent::create(buffer.release()));
     }
     ASSERT_NOT_REACHED();
 }