Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp

Index: third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
diff --git a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
index 67688efcbfa9b0a448c0be345501727e236af9e1..29582758031eaa2e55397bd0bd4f0def712993a5 100644
--- a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
+++ b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
@@ -209,7 +209,10 @@ void DocumentWebSocketChannel::send(const DOMArrayBuffer& buffer, unsigned byteO
     // buffer.slice copies its contents.
     // FIXME: Reduce copy by sending the data immediately when we don't need to
     // queue the data.
-    m_messages.append(adoptPtr(new Message(buffer.slice(byteOffset, byteOffset + byteLength))));
+    RefPtr<DOMArrayBuffer> slice = buffer.sliceOrNull(byteOffset, byteOffset + byteLength);
+    // FIXME: Could we propagate a RangeError exception from here instead the following assert?
+    RELEASE_ASSERT(slice); // This is an out-of-memory condition.
+    m_messages.append(adoptPtr(new Message(slice.release())));
     processSendQueue();
 }