UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Steps to reproduce the problem:
load crash.html in chrome and you'll see the crash, my reproduce environment is 64 bit chrome in Ubuntu.

What is the expected behavior?
don't crash

What went wrong?
maybe you think this is work as design, but it can be handled more elegant. it should throw an exception but no a crash.

0  0x00007ffff7d3d33f in base::internal::PartitionExcessiveAllocationSize () at ../../base/allocator/partition_allocator/partition_oom.cc:14
#1  0x00007ffff7d34109 in base::PartitionReallocGenericFlags (root=0x7fffe656cd00 <WTF::lazy_buffer+8>, flags=0, ptr=0x22bc69004010, new_size=4294967296, 
    type_name=0x7fffe6a2934f "SerializedScriptValue buffer") at ../../base/allocator/partition_allocator/partition_alloc.cc:281
#2  0x00007ffff7d34421 in base::PartitionRootGeneric::Realloc (this=0x7fffe656cd00 <WTF::lazy_buffer+8>, ptr=0x22bc69004010, new_size=4294967296, 
    type_name=0x7fffe6a2934f "SerializedScriptValue buffer") at ../../base/allocator/partition_allocator/partition_alloc.cc:341
#3  0x00007fffe75f07fd in WTF::Partitions::BufferRealloc (p=0x22bc69004010, n=4294967296, type_name=0x7fffe6a2934f "SerializedScriptValue buffer")
    at ../../third_party/blink/renderer/platform/wtf/allocator/partitions.h:114
#4  0x00007fffe75eee9f in blink::V8ScriptValueSerializer::ReallocateBufferMemory (this=0x7fffb6c4b680, old_buffer=0x22bc69004010, size=4294967296, actual_size=0x7fffb6c4ac60)
    at ../../third_party/blink/renderer/bindings/core/v8/serialization/v8_script_value_serializer.cc:581
#5  0x00007fffea83962d in v8::internal::ValueSerializer::ExpandBuffer (this=<optimized out>, required_capacity=<optimized out>) at ../../v8/src/value-serializer.cc:302
#6  0x00007fffea83d8cd in ReserveRawBytes (this=<optimized out>, bytes=<optimized out>) at ../../v8/src/value-serializer.cc:287
#7  WriteRawBytes (this=<optimized out>, source=<optimized out>, length=<optimized out>) at ../../v8/src/value-serializer.cc:277
#8  v8::internal::ValueSerializer::WriteJSArrayBuffer (this=<optimized out>, array_buffer=...) at ../../v8/src/value-serializer.cc:833
#9  0x00007fffea83a228 in v8::internal::ValueSerializer::WriteJSReceiver (this=<optimized out>, receiver=...) at ../../v8/src/value-serializer.cc:507
#10 0x00007fffea839f0c in v8::internal::ValueSerializer::WriteObject (this=<optimized out>, object=...) at ../../v8/src/value-serializer.cc:378
#11 0x00007fffea83aff2 in v8::internal::ValueSerializer::WriteJSArray (this=<optimized out>, array=...) at ../../v8/src/value-serializer.cc:643
#12 0x00007fffea83a238 in v8::internal::ValueSerializer::WriteJSReceiver (this=<optimized out>, receiver=...) at ../../v8/src/value-serializer.cc:482
#13 0x00007fffea839f0c in v8::internal::ValueSerializer::WriteObject (this=<optimized out>, object=...) at ../../v8/src/value-serializer.cc:378
#14 0x00007fffe9eef174 in v8::ValueSerializer::WriteValue (this=<optimized out>, context=..., value=...) at ../../v8/src/api.cc:3237
#15 0x00007fffe75ebc7f in blink::V8ScriptValueSerializer::Serialize (this=0x7fffb6c4b680, value=..., exception_state=...)
    at ../../third_party/blink/renderer/bindings/core/v8/serialization/v8_script_value_serializer.cc:93
#16 0x00007fffe36faea1 in blink::SerializedScriptValueForModulesFactory::Create (this=0x178492e180d8, isolate=0x174759b6b020, value=..., options=..., exception_state=...)
    at ../../third_party/blink/renderer/bindings/modules/v8/serialization/serialized_script_value_for_modules_factory.cc:22
#17 0x00007fffe75cc884 in blink::SerializedScriptValue::Serialize (isolate=0x174759b6b020, value=..., options=..., exception=...)
    at ../../third_party/blink/renderer/bindings/core/v8/serialization/serialized_script_value.cc:74
#18 0x00007fffe9003f35 in blink::DedicatedWorkerV8Internal::postMessageImpl (interfaceName=0x7fffe6a74e19 "Worker", instance=0x3a8ffaaa2d78, info=...)
    at gen/third_party/blink/renderer/bindings/core/v8/v8_worker.cc:149
#19 0x00007fffe90039cb in blink::V8Worker::postMessageMethodCallback (info=...) at gen/third_party/blink/renderer/bindings/core/v8/v8_worker.cc:260
#20 0x00007fffe9fbca03 in v8::internal::FunctionCallbackArguments::Call (this=<optimized out>, handler=<optimized out>) at ../../v8/src/api-arguments-inl.h:94
#21 0x00007fffe9fbad53 in v8::internal::(anonymous namespace)::HandleApiCallHelper<false> (isolate=<optimized out>, function=..., new_target=..., fun_data=..., receiver=..., args=...)
    at ../../v8/src/builtins/builtins-api.cc:109
#22 0x00007fffe9fb9109 in v8::internal::Builtin_Impl_HandleApiCall (args=..., isolate=<optimized out>) at ../../v8/src/builtins/builtins-api.cc:139
#23 0x00007fffe9fb8b4d in v8::internal::Builtin_HandleApiCall (args_length=<optimized out>, args_object=<optimized out>, isolate=<optimized out>)
    at ../../v8/src/builtins/builtins-api.cc:127

the root cause is this function
https://cs.chromium.org/chromium/src/v8/src/value-serializer.cc?rcl=56b60a2ebac6c90c3989fb5ad0d9109d9c35ae76&l=295
never return is the allocation fails.
Maybe<bool> ValueSerializer::ExpandBuffer(size_t required_capacity) {
  DCHECK_GT(required_capacity, buffer_capacity_);
  size_t requested_capacity =
      std::max(required_capacity, buffer_capacity_ * 2) + 64;
  size_t provided_capacity = 0;
  void* new_buffer = nullptr;
  if (delegate_) {
    new_buffer = delegate_->ReallocateBufferMemory(buffer_, requested_capacity,
                                                   &provided_capacity);----------------->this line never return null, allocation fail will crash the chrome.
  } else {
    new_buffer = realloc(buffer_, requested_capacity);
    provided_capacity = requested_capacity;
  }
  if (new_buffer) {
    DCHECK(provided_capacity >= requested_capacity);
    buffer_ = reinterpret_cast<uint8_t*>(new_buffer);
    buffer_capacity_ = provided_capacity;
    return Just(true);
  } else {---------------->this branch never be executed in chrome.
    out_of_memory_ = true;
    return Nothing<bool>();
  }
}

suggested fix:
maybe you can call the function PartitionReallocGenericFlags with flag PartitionAllocReturnNull.

Crashed report ID: 

How much crashed? Just one tab

Is it a problem with a plugin? N/A 

Did this work before? N/A 

Chrome version: 67.0.3396.87  Channel: n/a
OS Version: 
Flash Version:
 

Deleted: crash.html 141 bytes

crash.html 141 bytes View Download