Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/html/HTMLCanvasElement.h

 /*
  * Copyright (C) 2004, 2006, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 178 matching lines @@
 
     PassOwnPtr<ImageBufferSurface> createImageBufferSurface(const IntSize& deviceSize, int* msaaSampleCount);
     void createImageBuffer();
     void createImageBufferInternal(PassOwnPtr<ImageBufferSurface> externalSurface);
     bool shouldUseDisplayList(const IntSize& deviceSize);
 
     void setSurfaceSize(const IntSize&);
 
     bool paintsIntoCanvasBuffer() const;
 
-    ImageData* toImageData(SourceDrawingBuffer) const;
-    String toDataURLInternal(const String& mimeType, const double& quality, SourceDrawingBuffer) const;
+    ImageData* toImageData(SourceDrawingBuffer, ExceptionState&) const;
+    String toDataURLInternal(const String& mimeType, const double& quality, SourceDrawingBuffer, ExceptionState&) const;
 
     static void encodeImageAsync(DOMUint8ClampedArray* imagedata, IntSize imageSize, FileCallback*, const String& mimeType, double quality);
     static void createBlobAndCall(PassOwnPtr<Vector<char>> encodedImage, const String& mimeType, FileCallback*);
 
     IntSize m_size;
 
     OwnPtrWillBeMember<CanvasRenderingContext> m_context;
 
     bool m_ignoreReset;
     FloatRect m_dirtyRect;
 
     mutable intptr_t m_externallyAllocatedMemory;
 
     bool m_originClean;
 
     // It prevents HTMLCanvasElement::buffer() from continuously re-attempting to allocate an imageBuffer
     // after the first attempt failed.
     mutable bool m_didFailToCreateImageBuffer;
     bool m_imageBufferIsClear;
     OwnPtr<ImageBuffer> m_imageBuffer;
 
     mutable RefPtr<Image> m_copiedImage; // FIXME: This is temporary for platforms that have to copy the image buffer to render (and for CSSCanvasValue).
 };
 
 } // namespace blink
 
 #endif // HTMLCanvasElement_h