Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp

Index: third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
diff --git a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
index 684d0769189f78cc87681f83bcded743e9ed103b..a570834943ae9393e5ae650f8eb345e371dac70e 100644
--- a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
+++ b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
@@ -100,7 +100,7 @@ void DocumentWebSocketChannel::BlobLoader::cancel()
 
 void DocumentWebSocketChannel::BlobLoader::didFinishLoading()
 {
-    m_channel->didFinishLoadingBlob(m_loader.arrayBufferResult());
+    m_channel->didFinishLoadingBlob(m_loader.arrayBufferResultOrNull());
     // |this| is deleted here.
 }
 
@@ -199,7 +199,13 @@ void DocumentWebSocketChannel::send(const DOMArrayBuffer& buffer, unsigned byteO
     // buffer.slice copies its contents.
     // FIXME: Reduce copy by sending the data immediately when we don't need to
     // queue the data.
-    m_messages.append(adoptPtr(new Message(buffer.slice(byteOffset, byteOffset + byteLength))));
+    RefPtr<DOMArrayBuffer> slice = buffer.sliceOrNull(byteOffset, byteOffset + byteLength);
+    // TODO(junov): crbug.com/536816
+    // Could we propagate a RangeError exception from here instead the
+    // following assert? Would have to edit the spec to state that exceptions
+    // thrown by ArrayBuffer allocation are re-thrown.
+    RELEASE_ASSERT(slice); // This is an out-of-memory condition.
+    m_messages.append(adoptPtr(new Message(slice.release())));
     processSendQueue();
 }