Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/encryptedmedia/MediaKeys.cpp

 /*
  * Copyright (C) 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 133 matching lines @@
             scriptState, DOMException::create(InvalidAccessError, "The serverCertificate parameter is empty."));
     }
 
     // 2. If the keySystem does not support server certificates, return a
     //    promise rejected with a new DOMException whose name is
     //    "NotSupportedError".
     //    (Let the CDM decide whether to support this or not.)
 
     // 3. Let certificate be a copy of the contents of the serverCertificate
     //    parameter.
-    RefPtr<DOMArrayBuffer> serverCertificateBuffer = DOMArrayBuffer::create(serverCertificate.data(), serverCertificate.byteLength());
+    RefPtr<DOMArrayBuffer> serverCertificateBuffer = DOMArrayBuffer::createOrNull(serverCertificate.data(), serverCertificate.byteLength());
+    if (!serverCertificateBuffer) {
+        return ScriptPromise::rejectWithDOMException(
+            scriptState, DOMException::create(V8RangeError, "Out of Memory. Server certificate buffer allocation failed."));
+    }
 
     // 4. Let promise be a new promise.
     SimpleContentDecryptionModuleResultPromise* result = new SimpleContentDecryptionModuleResultPromise(scriptState);
     ScriptPromise promise = result->promise();
 
     // 5. Run the following steps asynchronously (documented in timerFired()).
     m_pendingActions.append(PendingAction::CreatePendingSetServerCertificate(result, serverCertificateBuffer.release()));
     if (!m_timer.isActive())
         m_timer.startOneShot(0, FROM_HERE);
 
@@ skipping 99 matching lines @@
 void MediaKeys::stop()
 {
     ActiveDOMObject::stop();
 
     if (m_timer.isActive())
         m_timer.stop();
     m_pendingActions.clear();
 }
 
 } // namespace blink