Fixed WebGL printing crash due to failed buffer allocation

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

 /*
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1227 matching lines @@
     if (isContextLost())
         return false;
 
     bool mustClearNow = clearIfComposited() != Skipped;
     if (!m_markedCanvasDirty && !mustClearNow)
         return false;
 
     canvas()->clearCopiedImage();
     m_markedCanvasDirty = false;
 
+    if (!canvas()->buffer())
+        return false;
+
     ScopedTexture2DRestorer restorer(this);
     ScopedFramebufferRestorer fboRestorer(this);
 
     drawingBuffer()->commit();
     if (!canvas()->buffer()->copyRenderingResultsFromDrawingBuffer(drawingBuffer(), sourceBuffer)) {
         canvas()->ensureUnacceleratedImageBuffer();
         if (canvas()->hasImageBuffer())
             drawingBuffer()->paintRenderingResultsToCanvas(canvas()->buffer());
     }
 
@@ skipping 453 matching lines @@
         g = 0;
     if (std::isnan(b))
         b = 0;
     if (std::isnan(a))
         a = 1;
     m_clearColor[0] = r;
     m_clearColor[1] = g;
     m_clearColor[2] = b;
     m_clearColor[3] = a;
     webContext()->clearColor(r, g, b, a);
+    markContextChanged(CanvasChanged);

[Ken Russell (switch to Gerrit), 2015/10/01 02:33:30]

This looks wrong. markContextChanged is only supposed to be called when the
canvas's contents are changed.

[Justin Novosad, 2015/10/01 02:40:57]

You are right. I am missing a call to clear() in the test. I was confused by the
fact that the clusterfuzz reduced test case did not have a call to clear(). The
way the clusterfuzz bot performs a print, the canvas does not need to be marked
dirty for the content update to happen.

 }
 
 void WebGLRenderingContextBase::clearDepth(GLfloat depth)
 {
     if (isContextLost())
         return;
     m_clearDepth = depth;
     webContext()->clearDepth(depth);
 }
 
@@ skipping 5003 matching lines @@
 
     return totalBytesPerPixel;
 }
 
 DrawingBuffer* WebGLRenderingContextBase::drawingBuffer() const
 {
     return m_drawingBuffer.get();
 }
 
 } // namespace blink