Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/platform/graphics/ImageBuffer.cpp

 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 36 matching lines @@
 #include "platform/image-encoders/skia/JPEGImageEncoder.h"
 #include "platform/image-encoders/skia/PNGImageEncoder.h"
 #include "platform/image-encoders/skia/WEBPImageEncoder.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebExternalTextureMailbox.h"
 #include "public/platform/WebGraphicsContext3D.h"
 #include "public/platform/WebGraphicsContext3DProvider.h"
 #include "third_party/skia/include/core/SkPicture.h"
 #include "wtf/ArrayBufferContents.h"
 #include "wtf/MathExtras.h"
+#include "wtf/PartitionAlloc.h"
 #include "wtf/Vector.h"
 #include "wtf/text/Base64.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 PassOwnPtr<ImageBuffer> ImageBuffer::create(PassOwnPtr<ImageBufferSurface> surface)
 {
     if (!surface->isValid())
         return nullptr;
@@ skipping 212 matching lines @@
 
 bool ImageBuffer::getImageData(Multiply multiplied, const IntRect& rect, WTF::ArrayBufferContents& contents) const
 {
     Checked<int, RecordOverflow> dataSize = 4;
     dataSize *= rect.width();
     dataSize *= rect.height();
     if (dataSize.hasOverflowed())
         return false;
 
     if (!isSurfaceValid()) {
-        WTF::ArrayBufferContents result(rect.width() * rect.height(), 4, WTF::ArrayBufferContents::NotShared, WTF::ArrayBufferContents::ZeroInitialize);
+        WTF::ArrayBufferContents result(rect.width() * rect.height(), 4, WTF::ArrayBufferContents::NotShared, WTF::ArrayBufferContents::ZeroInitialize, WTF::ArrayBufferContents::NullDataIfOutOfMemory);
+        if (!result.data())
+            return false;
         result.transfer(contents);
         return true;
     }
 
     ASSERT(canvas());
     RefPtr<SkImage> snapshot = m_surface->newImageSnapshot(PreferNoAcceleration);
     if (!snapshot)
         return false;
 
     const bool mayHaveStrayArea =
         m_surface->isAccelerated() // GPU readback may fail silently
         || rect.x() < 0
         || rect.y() < 0
         || rect.maxX() > m_surface->size().width()
         || rect.maxY() > m_surface->size().height();
     WTF::ArrayBufferContents result(
         rect.width() * rect.height(), 4,
         WTF::ArrayBufferContents::NotShared,
         mayHaveStrayArea
         ? WTF::ArrayBufferContents::ZeroInitialize
-        : WTF::ArrayBufferContents::DontInitialize);
+        : WTF::ArrayBufferContents::DontInitialize,
+        WTF::ArrayBufferContents::NullDataIfOutOfMemory);
+
+    if (!result.data())
+        return false;
 
     SkAlphaType alphaType = (multiplied == Premultiplied) ? kPremul_SkAlphaType : kUnpremul_SkAlphaType;
     SkImageInfo info = SkImageInfo::Make(rect.width(), rect.height(), kRGBA_8888_SkColorType, alphaType);
 
     snapshot->readPixels(info, result.data(), 4 * rect.width(), rect.x(), rect.y());
     result.transfer(contents);
     return true;
 }
 
 void ImageBuffer::putByteArray(Multiply multiplied, const unsigned char* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint)
@@ skipping 53 matching lines @@
     ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
 
     Vector<unsigned char> result;
     if (!encodeImage(mimeType, quality, &result))
         return "data:,";
 
     return "data:" + mimeType + ";base64," + base64Encode(result);
 }
 
 } // namespace blink