Allocate memory through wrapper functions which check for failure.

This is a compromise between the exorbitant cost of gracefully handling
any allocation failure (exorbitant since allocation failure is so unlikely
and clean recovery after allocation failure is so difficult), and the
risk of an allocation failure remaining undetected until a later access,
thus masking the allocation failure itself.