Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp

Index: third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp
diff --git a/third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp b/third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp
index f870943c2f7a4d7eee536ddc6a1d3e488f95a59d..f7d6a91ae5c125a21f3e17fe3b2e24691246345d 100644
--- a/third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp
+++ b/third_party/WebKit/Source/modules/push_messaging/PushMessageData.cpp
@@ -17,18 +17,22 @@
 
 namespace blink {
 
-PushMessageData* PushMessageData::create(const String& messageString)
+PushMessageData* PushMessageData::create(const String& messageString, ExceptionState& exceptionState)
 {
-    return PushMessageData::create(ArrayBufferOrArrayBufferViewOrUSVString::fromUSVString(messageString));
+    return PushMessageData::create(ArrayBufferOrArrayBufferViewOrUSVString::fromUSVString(messageString), exceptionState);
 }
 
-PushMessageData* PushMessageData::create(const ArrayBufferOrArrayBufferViewOrUSVString& messageData)
+PushMessageData* PushMessageData::create(const ArrayBufferOrArrayBufferViewOrUSVString& messageData, ExceptionState& exceptionState)
 {
     if (messageData.isArrayBuffer() || messageData.isArrayBufferView()) {
         RefPtr<DOMArrayBuffer> buffer = messageData.isArrayBufferView()
-            ? messageData.getAsArrayBufferView()->buffer()
+            ? messageData.getAsArrayBufferView()->bufferOrNull()
             : messageData.getAsArrayBuffer();
 
+        if (!buffer) {
+            exceptionState.throwRangeError("Out of memory. Failed to allocate array buffer for push message data.");
+            return nullptr;
+        }
         return new PushMessageData(static_cast<const char*>(buffer->data()), buffer->byteLength());
     }
 
@@ -54,9 +58,12 @@ PushMessageData::~PushMessageData()
 {
 }
 
-PassRefPtr<DOMArrayBuffer> PushMessageData::arrayBuffer() const
+PassRefPtr<DOMArrayBuffer> PushMessageData::arrayBuffer(ExceptionState& exceptionState) const
 {
-    return DOMArrayBuffer::create(m_data.data(), m_data.size());
+    RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::createOrNull(m_data.data(), m_data.size());
+    if (!buffer)
+        exceptionState.throwRangeError("Out of memory. Failed to allocate array buffer.");
+    return buffer.release();
 }
 
 Blob* PushMessageData::blob() const