Fixed WebGL printing crash due to failed buffer allocation

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

Index: third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index d0f75fcae8b4f0af5dc0d06a431493bca717fb04..08d7e982e4dc742fdcc4f1cb6e63bba479827a34 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -1245,6 +1245,9 @@ bool WebGLRenderingContextBase::paintRenderingResultsToCanvas(SourceDrawingBuffe
     canvas()->clearCopiedImage();
     m_markedCanvasDirty = false;
 
+    if (!canvas()->buffer())
+        return false;
+
     ScopedTexture2DRestorer restorer(this);
     ScopedFramebufferRestorer fboRestorer(this);
 
@@ -1718,6 +1721,7 @@ void WebGLRenderingContextBase::clearColor(GLfloat r, GLfloat g, GLfloat b, GLfl
     m_clearColor[2] = b;
     m_clearColor[3] = a;
     webContext()->clearColor(r, g, b, a);
+    markContextChanged(CanvasChanged);

[Ken Russell (switch to Gerrit), 2015/10/01 02:33:30]

This looks wrong. markContextChanged is only supposed to be called when the
canvas's contents are changed.

[Justin Novosad, 2015/10/01 02:40:57]

You are right. I am missing a call to clear() in the test. I was confused by the
fact that the clusterfuzz reduced test case did not have a call to clear(). The
way the clusterfuzz bot performs a print, the canvas does not need to be marked
dirty for the content update to happen.

 }
 
 void WebGLRenderingContextBase::clearDepth(GLfloat depth)