Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp

Index: third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
diff --git a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
index 684d0769189f78cc87681f83bcded743e9ed103b..ac8a688aa748ce3be8eee7d397400f74ff576d83 100644
--- a/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
+++ b/third_party/WebKit/Source/modules/websockets/DocumentWebSocketChannel.cpp
@@ -100,7 +100,14 @@ void DocumentWebSocketChannel::BlobLoader::cancel()
 
 void DocumentWebSocketChannel::BlobLoader::didFinishLoading()
 {
-    m_channel->didFinishLoadingBlob(m_loader.arrayBufferResult());
+    RefPtr<DOMArrayBuffer> result = m_loader.arrayBufferResultOrNull();
+    // TODO(junov): crbug.com/536816
+    // Is there a better way to handle an allocation failure instead
+    // of crashing? Would it be okay to fail silently by passing a nullptr?
+    // Should we call didFailLoadingBlob? If so, with which ErrorCode?
+    // Spec may need to be ammended for this.
+    RELEASE_ASSERT(result); // This is essentially an out-of-memory crash
+    m_channel->didFinishLoadingBlob(result.release());
     // |this| is deleted here.
 }
 
@@ -199,7 +206,10 @@ void DocumentWebSocketChannel::send(const DOMArrayBuffer& buffer, unsigned byteO
     // buffer.slice copies its contents.
     // FIXME: Reduce copy by sending the data immediately when we don't need to
     // queue the data.
-    m_messages.append(adoptPtr(new Message(buffer.slice(byteOffset, byteOffset + byteLength))));
+    RefPtr<DOMArrayBuffer> slice = buffer.sliceOrNull(byteOffset, byteOffset + byteLength);
+    // FIXME: Could we propagate a RangeError exception from here instead the following assert?
+    RELEASE_ASSERT(slice); // This is an out-of-memory condition.
+    m_messages.append(adoptPtr(new Message(slice.release())));
     processSendQueue();
 }