Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  * Copyright (C) 2012, 2013 Intel Corporation. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
@@ skipping 1545 matching lines @@
     canvas()->didDraw(SkRect::Make(dirtyRect));
 }
 
 SkCanvas* CanvasRenderingContext2D::drawingCanvas() const
 {
     if (isContextLost())
         return nullptr;
     return canvas()->drawingCanvas();
 }
 
-ImageData* CanvasRenderingContext2D::createImageData(ImageData* imageData) const
+ImageData* CanvasRenderingContext2D::createImageData(ImageData* imageData, ExceptionState& exceptionState) const
 {
-    return ImageData::create(imageData->size());
+    return ImageData::create(imageData->size(), exceptionState);
 }
 
 ImageData* CanvasRenderingContext2D::createImageData(float sw, float sh, ExceptionState& exceptionState) const
 {
     if (!sw || !sh) {
         exceptionState.throwDOMException(IndexSizeError, String::format("The source %s is 0.", sw ? "height" : "width"));
         return nullptr;
     }
 
     FloatSize logicalSize(fabs(sw), fabs(sh));
     if (!logicalSize.isExpressibleAsIntSize())
         return nullptr;
 
     IntSize size = expandedIntSize(logicalSize);
     if (size.width() < 1)
         size.setWidth(1);
     if (size.height() < 1)
         size.setHeight(1);
 
-    return ImageData::create(size);
+    return ImageData::create(size, exceptionState);
 }
 
 ImageData* CanvasRenderingContext2D::getImageData(float sx, float sy, float sw, float sh, ExceptionState& exceptionState) const
 {
     if (!canvas()->originClean())
         exceptionState.throwSecurityError("The canvas has been tainted by cross-origin data.");
     else if (!sw || !sh)
         exceptionState.throwDOMException(IndexSizeError, String::format("The source %s is 0.", sw ? "height" : "width"));
 
     if (exceptionState.hadException())
@@ skipping 12 matching lines @@
     if (logicalRect.width() < 1)
         logicalRect.setWidth(1);
     if (logicalRect.height() < 1)
         logicalRect.setHeight(1);
     if (!logicalRect.isExpressibleAsIntRect())
         return nullptr;
 
     IntRect imageDataRect = enclosingIntRect(logicalRect);
     ImageBuffer* buffer = canvas()->buffer();
     if (!buffer || isContextLost())
-        return ImageData::create(imageDataRect.size());
+        return ImageData::create(imageDataRect.size(), exceptionState);
 
     WTF::ArrayBufferContents contents;
-    if (!buffer->getImageData(Unmultiplied, imageDataRect, contents))
+    if (!buffer->getImageData(Unmultiplied, imageDataRect, contents)) {
+        exceptionState.throwRangeError("Out of memory.");

[haraken, 2015/10/29 16:24:34]

Maybe do we want to invent a better error message for this?

[Justin Novosad, 2015/10/29 18:26:02]

Acknowledged.

         return nullptr;
+    }
 
     RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::create(contents);
     return ImageData::create(
         imageDataRect.size(),
         DOMUint8ClampedArray::create(arrayBuffer, 0, arrayBuffer->byteLength()));
 }
 
 void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy)
 {
     putImageData(data, dx, dy, 0, 0, data->width(), data->height());
@@ skipping 688 matching lines @@
         if (imageType == CanvasRenderingContext2DState::NonOpaqueImage)
             return;
         if (alpha < 0xFF)
             return;
     }
 
     canvas()->buffer()->willOverwriteCanvas();
 }
 
 } // namespace blink