Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 78 matching lines @@
     switch (key->type()) {
     case IDBKey::InvalidType:
     case IDBKey::MinType:
         ASSERT_NOT_REACHED();
         return v8Undefined();
     case IDBKey::NumberType:
         return v8::Number::New(isolate, key->number());
     case IDBKey::StringType:
         return v8String(isolate, key->string());
     case IDBKey::BinaryType:
-        // Experimental feature: binary keys
-        // https://w3c.github.io/IndexedDB/#steps-to-convert-a-key-to-a-value
-        return toV8(DOMArrayBuffer::create(reinterpret_cast<const unsigned char*>(key->binary()->data()), key->binary()->size()), creationContext, isolate);
+        {
+            // Experimental feature: binary keys
+            // https://w3c.github.io/IndexedDB/#steps-to-convert-a-key-to-a-value
+
+            // FIXME: Find a more graceful way to handle allocation failures with
+            // createOrNull. It would be possible to throw a RangeError from here
+            // but the consequences of such a change need to be studied carefully.
+            RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::deprecatedCreateOrCrash(reinterpret_cast<const unsigned char*>(key->binary()->data()), key->binary()->size());
+            return toV8(buffer, creationContext, isolate);
+        }
     case IDBKey::DateType:
         return v8::Date::New(context, key->date()).ToLocalChecked();
     case IDBKey::ArrayType:
         {
             v8::Local<v8::Array> array = v8::Array::New(isolate, key->array().size());
             for (size_t i = 0; i < key->array().size(); ++i) {
                 v8::Local<v8::Value> value = toV8(key->array()[i].get(), creationContext, isolate);
                 if (value.IsEmpty())
                     value = v8::Undefined(isolate);
                 if (!v8CallBoolean(array->CreateDataProperty(context, i, value)))
@@ skipping 66 matching lines @@
             if (buffer->isNeutered()) {
                 exceptionState.throwTypeError("The ArrayBuffer is neutered.");
                 return nullptr;
             }
             const char* start = static_cast<const char*>(buffer->data());
             size_t length = buffer->byteLength();
             return IDBKey::createBinary(SharedBuffer::create(start, length));
         }
         if (value->IsArrayBufferView()) {
             DOMArrayBufferView* view = V8ArrayBufferView::toImpl(value.As<v8::Object>());
-            if (view->buffer()->isNeutered()) {
+            RefPtr<DOMArrayBuffer> buffer = view->bufferOrNull();
+            RELEASE_ASSERT(buffer);
+            if (buffer->isNeutered()) {
                 exceptionState.throwTypeError("The viewed ArrayBuffer is neutered.");
                 return nullptr;
             }
             const char* start = static_cast<const char*>(view->baseAddress());
             size_t length = view->byteLength();
             return IDBKey::createBinary(SharedBuffer::create(start, length));
         }
     }
     if (value->IsArray()) {
         v8::Local<v8::Array> array = value.As<v8::Array>();
@@ skipping 312 matching lines @@
     ASSERT(!exceptionState.hadException());
     if (expectedKey && expectedKey->isEqual(value->primaryKey()))
         return;
 
     bool injected = injectV8KeyIntoV8Value(isolate, keyValue.v8Value(), scriptValue.v8Value(), value->keyPath());
     ASSERT_UNUSED(injected, injected);
 }
 #endif
 
 } // namespace blink