Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 141 matching lines @@
             }
         } else {
             Vector<v8::Local<v8::ArrayBuffer>, 4> bufferHandles;
             v8::HandleScope handleScope(isolate);
             acculumateArrayBuffersForAllWorlds(isolate, static_pointer_cast<DOMArrayBuffer>(arrayBuffers[i]).get(), bufferHandles);
             bool isNeuterable = true;
             for (size_t j = 0; j < bufferHandles.size(); j++)
                 isNeuterable &= bufferHandles[j]->IsNeuterable();
             RefPtr<DOMArrayBufferBase> toTransfer = arrayBuffers[i];
             if (!isNeuterable)
-                toTransfer = DOMArrayBuffer::create(arrayBuffers[i]->buffer());
-            bool result = toTransfer->transfer(contents->at(i));
+                toTransfer = DOMArrayBuffer::createOrNull(arrayBuffers[i]->buffer());
+            bool result = toTransfer ? toTransfer->transfer(contents->at(i)) : false;
             if (!result) {
                 exceptionState.throwDOMException(DataCloneError, "ArrayBuffer at index " + String::number(i) + " could not be transferred.");
                 return nullptr;
             }
 
             if (isNeuterable)
                 for (size_t j = 0; j < bufferHandles.size(); j++)
                     bufferHandles[j]->Neuter();
         }
     }
@@ skipping 114 matching lines @@
 {
     m_arrayBufferContentsArray = createArrayBuffers(isolate, arrayBuffers, exceptionState);
 }
 
 void SerializedScriptValue::transferImageBitmaps(v8::Isolate* isolate, ImageBitmapArray& imageBitmaps, ExceptionState& exceptionState)
 {
     m_imageBitmapsArray = createImageBitmaps(isolate, imageBitmaps, exceptionState);
 }
 
 } // namespace blink