Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp

Index: third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
diff --git a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
index 6111349b6b7ff973b539732352fa66437b5cd1d2..ffed6967a5fd3682634ff9012469de62b8673d97 100644
--- a/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
+++ b/third_party/WebKit/Source/modules/encryptedmedia/MediaKeySession.cpp
@@ -434,7 +434,10 @@ ScriptPromise MediaKeySession::generateRequest(ScriptState* scriptState, const S
     }
 
     // 6. Let init data be a copy of the contents of the initData parameter.
-    RefPtr<DOMArrayBuffer> initDataBuffer = DOMArrayBuffer::create(initData.data(), initData.byteLength());
+    RefPtr<DOMArrayBuffer> initDataBuffer = DOMArrayBuffer::createOrNull(initData.data(), initData.byteLength());
+    if (!initDataBuffer) {
+
+    }
 
     // 7. Let session type be this object's session type.
     //    (Done in constructor.)
@@ -529,7 +532,11 @@ ScriptPromise MediaKeySession::update(ScriptState* scriptState, const DOMArrayPi
     }
 
     // 3. Let response copy be a copy of the contents of the response parameter.
-    RefPtr<DOMArrayBuffer> responseCopy = DOMArrayBuffer::create(response.data(), response.byteLength());
+    RefPtr<DOMArrayBuffer> responseCopy = DOMArrayBuffer::createOrNull(response.data(), response.byteLength());
+    if (!responseCopy) {
+        return ScriptPromise::rejectWithDOMException(
+            scriptState, DOMException::create(V8RangeError, "Out of Memory."));
+    }
 
     // 4. Let promise be a new promise.
     SimpleContentDecryptionModuleResultPromise* result = new SimpleContentDecryptionModuleResultPromise(scriptState);
@@ -800,7 +807,7 @@ void MediaKeySession::message(MessageType messageType, const unsigned char* mess
         init.setMessageType("license-release");
         break;
     }
-    init.setMessage(DOMArrayBuffer::create(static_cast<const void*>(message), messageLength));
+    init.setMessage(DOMArrayBuffer::deprecatedCreateOrCrash(static_cast<const void*>(message), messageLength));
 
     RefPtrWillBeRawPtr<MediaKeyMessageEvent> event = MediaKeyMessageEvent::create(EventTypeNames::message, init);
     event->setTarget(this);