Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 78 matching lines @@
     switch (key->type()) {
     case IDBKey::InvalidType:
     case IDBKey::MinType:
         ASSERT_NOT_REACHED();
         return v8Undefined();
     case IDBKey::NumberType:
         return v8::Number::New(isolate, key->number());
     case IDBKey::StringType:
         return v8String(isolate, key->string());
     case IDBKey::BinaryType:
-        // Experimental feature: binary keys
-        // https://w3c.github.io/IndexedDB/#steps-to-convert-a-key-to-a-value
-        return toV8(DOMArrayBuffer::create(reinterpret_cast<const unsigned char*>(key->binary()->data()), key->binary()->size()), creationContext, isolate);
+        {
+            // Experimental feature: binary keys
+            // https://w3c.github.io/IndexedDB/#steps-to-convert-a-key-to-a-value
+
+            // TODO(junov): crbug.com/536816 Find a more graceful way to handle allocation
+            // failures with createOrNull. It would be possible to throw a RangeError
+            // from here but the consequences of such a change need to be considered
+            // carefully.
+            RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::deprecatedCreateOrCrash(reinterpret_cast<const unsigned char*>(key->binary()->data()), key->binary()->size());
+            return toV8(buffer, creationContext, isolate);
+        }
     case IDBKey::DateType:
         return v8::Date::New(context, key->date()).ToLocalChecked();
     case IDBKey::ArrayType:
         {
             v8::Local<v8::Array> array = v8::Array::New(isolate, key->array().size());
             for (size_t i = 0; i < key->array().size(); ++i) {
                 v8::Local<v8::Value> value = toV8(key->array()[i].get(), creationContext, isolate);
                 if (value.IsEmpty())
                     value = v8::Undefined(isolate);
                 if (!v8CallBoolean(array->CreateDataProperty(context, i, value)))
@@ skipping 399 matching lines @@
     ASSERT(!exceptionState.hadException());
     if (expectedKey && expectedKey->isEqual(value->primaryKey()))
         return;
 
     bool injected = injectV8KeyIntoV8Value(isolate, keyValue.v8Value(), scriptValue.v8Value(), value->keyPath());
     ASSERT_UNUSED(injected, injected);
 }
 #endif
 
 } // namespace blink