Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/crypto/CryptoResultImpl.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 163 matching lines @@
     else
         m_resolver->reject(DOMException::create(ec, errorDetails));
     clearResolver();
 }
 
 void CryptoResultImpl::completeWithBuffer(const void* bytes, unsigned bytesSize)
 {
     if (!m_resolver)
         return;
 
-    m_resolver->resolve(DOMArrayBuffer::create(bytes, bytesSize));
+    RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::createOrNull(bytes, bytesSize);
+    if (!buffer) {
+        // The specs for all crypto methods that use this code state: "If the
+        // following steps or referenced procedures say to throw an error,
+        // reject promise with the returned error and then terminate the algorithm."
+        // In this case, the procedure of allocating an ArrayBuffer is not explicitly
+        // referenced in the algorithms laid out in the spec, but it is implied,
+        // and the ECMAScript spec says that failure to allocate the buffer should
+        // result in a RangeError being thrown.
+        // http://ecma-international.org/ecma-262/6.0/#sec-createbytedatablock
+        m_resolver->reject(DOMException::create(V8RangeError, "Out of memory. Could not allocate buffer."));
+    } else {
+        m_resolver->resolve(buffer);
+    }
     clearResolver();
 }
 
 void CryptoResultImpl::completeWithJson(const char* utf8Data, unsigned length)
 {
     if (!m_resolver)
         return;
 
     ScriptState* scriptState = m_resolver->scriptState();
     ScriptState::Scope scope(scriptState);
@@ skipping 51 matching lines @@
     m_cancel.clear();
     clearResolver();
 }
 
 ScriptPromise CryptoResultImpl::promise()
 {
     return m_resolver ? m_resolver->promise() : ScriptPromise();
 }
 
 } // namespace blink