Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp

Index: third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp
diff --git a/third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp b/third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp
index aa8877c95d1639df5c10f447eaa832765ef66e77..749e8c768f2b8d1d1f571575c9247a02319fb72a 100644
--- a/third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp
+++ b/third_party/WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp
@@ -96,9 +96,17 @@ v8::Local<v8::Value> toV8(const IDBKey* key, v8::Local<v8::Object> creationConte
     case IDBKey::StringType:
         return v8String(isolate, key->string());
     case IDBKey::BinaryType:
-        // Experimental feature: binary keys
-        // https://w3c.github.io/IndexedDB/#steps-to-convert-a-key-to-a-value
-        return toV8(DOMArrayBuffer::create(reinterpret_cast<const unsigned char*>(key->binary()->data()), key->binary()->size()), creationContext, isolate);
+        {
+            // Experimental feature: binary keys
+            // https://w3c.github.io/IndexedDB/#steps-to-convert-a-key-to-a-value
+
+            // TODO(junov): crbug.com/536816 Find a more graceful way to handle allocation
+            // failures with createOrNull. It would be possible to throw a RangeError
+            // from here but the consequences of such a change need to be considered
+            // carefully.
+            RefPtr<DOMArrayBuffer> buffer = DOMArrayBuffer::deprecatedCreateOrCrash(reinterpret_cast<const unsigned char*>(key->binary()->data()), key->binary()->size());
+            return toV8(buffer, creationContext, isolate);
+        }
     case IDBKey::DateType:
         return v8::Date::New(context, key->date()).ToLocalChecked();
     case IDBKey::ArrayType:
@@ -185,7 +193,9 @@ static IDBKey* createIDBKeyFromValue(v8::Isolate* isolate, v8::Local<v8::Value>
         }
         if (value->IsArrayBufferView()) {
             DOMArrayBufferView* view = V8ArrayBufferView::toImpl(value.As<v8::Object>());
-            if (view->buffer()->isNeutered()) {
+            RefPtr<DOMArrayBuffer> buffer = view->bufferOrNull();
+            RELEASE_ASSERT(buffer); // This is essentially an out-of-memory crash (crbug.com/536816)
+            if (buffer->isNeutered()) {
                 exceptionState.throwTypeError("The viewed ArrayBuffer is neutered.");
                 return nullptr;
             }