Avoid null-pointer dereference for PPAPI Instance BindGraphics....

webkit/plugins/ppapi/ppapi_plugin_instance.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppapi_plugin_instance.h"
 
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
 #include "base/scoped_ptr.h"
 #include "base/utf_string_conversions.h"
@@ skipping 440 matching lines @@
 
   if (graphics_2d) {
     if (!graphics_2d->BindToInstance(this))
       return false;  // Can't bind to more than one instance.
 
     // See http://crbug.com/49403: this can be further optimized by keeping the
     // old device around and painting from it.
     if (bound_graphics_2d()) {
       // Start the new image with the content of the old image until the plugin
       // repaints.
+      // Use ImageDataAutoMapper to ensure the image data is valid.
+      ImageDataAutoMapper mapper(bound_graphics_2d()->image_data());
+      if (!mapper.is_valid())
+        return false;
       const SkBitmap* old_backing_bitmap =
           bound_graphics_2d()->image_data()->GetMappedBitmap();
       SkRect old_size = SkRect::MakeWH(
           SkScalar(static_cast<float>(old_backing_bitmap->width())),
           SkScalar(static_cast<float>(old_backing_bitmap->height())));
 
       SkCanvas canvas(*graphics_2d->image_data()->GetMappedBitmap());
       canvas.drawBitmap(*old_backing_bitmap, 0, 0);
 
       // Fill in any extra space with white.
@@ skipping 759 matching lines @@
   return found->second;
 }
 
 bool PluginInstance::IsFullPagePlugin() const {
   WebFrame* frame = container()->element().document().frame();
   return frame->view()->mainFrame()->document().isPluginDocument();
 }
 
 }  // namespace ppapi
 }  // namespace webkit