Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/bluetooth/ConvertWebVectorToArrayBuffer.cpp

Index: third_party/WebKit/Source/modules/bluetooth/ConvertWebVectorToArrayBuffer.cpp
diff --git a/third_party/WebKit/Source/modules/bluetooth/ConvertWebVectorToArrayBuffer.cpp b/third_party/WebKit/Source/modules/bluetooth/ConvertWebVectorToArrayBuffer.cpp
index b0e34fd6397a93683355789d13053eff78a5fd44..45a2d0ced5fff38b1d209bda7489b7ba4efed246 100644
--- a/third_party/WebKit/Source/modules/bluetooth/ConvertWebVectorToArrayBuffer.cpp
+++ b/third_party/WebKit/Source/modules/bluetooth/ConvertWebVectorToArrayBuffer.cpp
@@ -10,9 +10,14 @@ namespace blink {
 PassRefPtr<DOMArrayBuffer> ConvertWebVectorToArrayBuffer::take(ScriptPromiseResolver*, const WebVector<uint8_t>& webVector)
 {
     static_assert(sizeof(*webVector.data()) == 1, "uint8_t should be a single byte");
-
-    RefPtr<DOMArrayBuffer> domBuffer = DOMArrayBuffer::create(webVector.data(), webVector.size());
-
+    // TODO(junov): crbug.com/536816
+    // We should use DOMArrayBuffer::createOrNull here, but dealing
+    // with the null case is tricky because CallbackPromiseAdapter
+    // was not designed to allow the promise to be rejected in the success
+    // handler.
+    // The right thing to do would probably be to reject the promise with
+    // a RangeError exception when the ArrayBuffer allocation fails.
+    RefPtr<DOMArrayBuffer> domBuffer = DOMArrayBuffer::deprecatedCreateOrCrash(webVector.data(), webVector.size());
     return domBuffer;
 }