Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp

Index: third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
diff --git a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
index f68c76779941577de2f63eb62323949d601ffe41..945ad9e8dc2234ad0214c1936ea45c85c5d887b6 100644
--- a/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
+++ b/third_party/WebKit/Source/modules/websockets/DOMWebSocket.cpp
@@ -431,7 +431,9 @@ void DOMWebSocket::send(DOMArrayBufferView* arrayBufferView, ExceptionState& exc
     Platform::current()->histogramEnumeration("WebCore.WebSocket.SendType", WebSocketSendTypeArrayBufferView, WebSocketSendTypeMax);
     ASSERT(m_channel);
     m_bufferedAmount += arrayBufferView->byteLength();
-    m_channel->send(*arrayBufferView->buffer(), arrayBufferView->byteOffset(), arrayBufferView->byteLength());
+    RefPtr<DOMArrayBuffer> buffer = arrayBufferView->bufferOrNull();
+    RELEASE_ASSERT(buffer); // crbug.com/536816
+    m_channel->send(*buffer, arrayBufferView->byteOffset(), arrayBufferView->byteLength());
 }
 
 void DOMWebSocket::send(Blob* binaryData, ExceptionState& exceptionState)
@@ -638,7 +640,12 @@ void DOMWebSocket::didReceiveBinaryMessage(PassOwnPtr<Vector<char>> binaryData)
     }
 
     case BinaryTypeArrayBuffer:
-        RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::create(binaryData->data(), binaryData->size());
+        // TODO(junov): crbug.com/536816
+        // Avoid crashing when out of memory by using createOrNull(). Requires
+        // determining appropriate alternate behavior for dealing with allocation
+        // failures. Should the event be droped? Should we dispatch an event

[haraken, 2015/10/29 18:58:37]

dropped

[Justin Novosad, 2015/11/05 00:17:52]

Done.

+        // with null data? Should we dispatch some kind of failure code?
+        RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::deprecatedCreateOrCrash(binaryData->data(), binaryData->size());
         Platform::current()->histogramEnumeration("WebCore.WebSocket.ReceiveType", WebSocketReceiveTypeArrayBuffer, WebSocketReceiveTypeMax);
         m_eventQueue->dispatch(MessageEvent::create(arrayBuffer.release(), SecurityOrigin::create(m_url)->toString()));
         break;