Do not crash when out of memory at ImageData::create().

Source/core/html/ImageData.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 23 matching lines @@
 #include "core/dom/ExceptionCode.h"
 #include "platform/RuntimeEnabledFeatures.h"
 
 namespace blink {
 
 ImageData* ImageData::create(const IntSize& size)
 {
     Checked<int, RecordOverflow> dataSize = 4;
     dataSize *= size.width();
     dataSize *= size.height();
-    if (dataSize.hasOverflowed())
+    if (dataSize.hasOverflowed() || dataSize.unsafeGet() < 0)
         return nullptr;
 
-    return new ImageData(size);
+    RefPtr<DOMUint8ClampedArray> byteArray =
+        DOMUint8ClampedArray::createOrNull(dataSize.unsafeGet());
+    if (!byteArray)
+        return nullptr;
+
+    return new ImageData(size, byteArray.release());
 }
 
 ImageData* ImageData::create(const IntSize& size, PassRefPtr<DOMUint8ClampedArray> byteArray)
 {
     Checked<int, RecordOverflow> dataSize = 4;
     dataSize *= size.width();
     dataSize *= size.height();
     if (dataSize.hasOverflowed())
         return nullptr;
 
     if (dataSize.unsafeGet() < 0
         || static_cast<unsigned>(dataSize.unsafeGet()) > byteArray->length())
         return nullptr;
 
     return new ImageData(size, byteArray);
 }
 
 ImageData* ImageData::create(unsigned width, unsigned height, ExceptionState& exceptionState)
 {
     if (!width || !height) {
         exceptionState.throwDOMException(IndexSizeError, String::format("The source %s is zero or not a number.", width ? "height" : "width"));
         return nullptr;
     }
 
     Checked<unsigned, RecordOverflow> dataSize = 4;
     dataSize *= width;
     dataSize *= height;
-    if (dataSize.hasOverflowed()) {
+    if (dataSize.hasOverflowed()
+        || static_cast<int>(width) < 0
+        || static_cast<int>(height) < 0) {
         exceptionState.throwDOMException(IndexSizeError, "The requested image size exceeds the supported range.");
         return nullptr;
     }
 
-    return new ImageData(IntSize(width, height));
+    RefPtr<DOMUint8ClampedArray> byteArray =
+        DOMUint8ClampedArray::createOrNull(dataSize.unsafeGet());
+    if (!byteArray) {
+        exceptionState.throwDOMException(V8GeneralError, "Out of memory at ImageData creation");

[haraken, 2015/09/09 09:23:55]

What error does Firefox or IE throw for this case?

Given that we're throwing IndexSizeError for an invalid width and height,
IndexSizeError might make more sense here as well.

[Yuki, 2015/09/09 09:31:30]

I failed to make Firefox throw an exception, but I'll try it again.

The spec explicitly requires that ImageData throws IndexSizeError in case of
the invalid range of size.  The error is not designed for out of memory.  Out
of memory error can happen even if the size is valid.  Should be distinguished
one from another.  (Actually we check the range first and throw in the case.)

Anyway, I'll try to check other browser's behaviors.

[Yuki, 2015/09/09 12:50:10]

As far as I tested with Firefox on GNU/Linux, Firefox does not respond...
Something bad seems happening in it.

+        return nullptr;
+    }
+
+    return new ImageData(IntSize(width, height), byteArray.release());
 }
 
 bool ImageData::validateConstructorArguments(DOMUint8ClampedArray* data, unsigned width, unsigned& lengthInPixels, ExceptionState& exceptionState)
 {
     if (!width) {
         exceptionState.throwDOMException(IndexSizeError, "The source width is zero or not a number.");
         return false;
     }
     ASSERT(data);
     unsigned length = data->length();
@@ skipping 49 matching lines @@
         // Create a V8 Uint8ClampedArray object and set the "data" property
         // of the ImageData object to the created v8 object, eliminating the
         // C++ callback when accessing the "data" property.
         v8::Local<v8::Value> pixelArray = toV8(m_data.get(), wrapper, isolate);
         if (pixelArray.IsEmpty() || !v8CallBoolean(wrapper->DefineOwnProperty(isolate->GetCurrentContext(), v8AtomicString(isolate, "data"), pixelArray, v8::ReadOnly)))
             return v8::Local<v8::Object>();
     }
     return wrapper;
 }
 
-ImageData::ImageData(const IntSize& size)
-    : m_size(size)
-    , m_data(DOMUint8ClampedArray::create(size.width() * size.height() * 4))
-{
-}
-
 ImageData::ImageData(const IntSize& size, PassRefPtr<DOMUint8ClampedArray> byteArray)
     : m_size(size)
     , m_data(byteArray)
 {
     ASSERT_WITH_SECURITY_IMPLICATION(static_cast<unsigned>(size.width() * size.height() * 4) <= m_data->length());
 }
 
 void ImageData::dispose()
 {
     m_data.clear();
 }
 
 } // namespace blink