Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp

Index: third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
index c5771ec58a11e48c7189e4d17d8e6241efc31c28..9937c493e6e74013f1a422a3d6b838467b49c388 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
@@ -1563,9 +1563,9 @@ SkCanvas* CanvasRenderingContext2D::drawingCanvas() const
     return canvas()->drawingCanvas();
 }
 
-ImageData* CanvasRenderingContext2D::createImageData(ImageData* imageData) const
+ImageData* CanvasRenderingContext2D::createImageData(ImageData* imageData, ExceptionState& exceptionState) const
 {
-    return ImageData::create(imageData->size());
+    return ImageData::create(imageData->size(), exceptionState);
 }
 
 ImageData* CanvasRenderingContext2D::createImageData(float sw, float sh, ExceptionState& exceptionState) const
@@ -1585,7 +1585,7 @@ ImageData* CanvasRenderingContext2D::createImageData(float sw, float sh, Excepti
     if (size.height() < 1)
         size.setHeight(1);
 
-    return ImageData::create(size);
+    return ImageData::create(size, exceptionState);
 }
 
 ImageData* CanvasRenderingContext2D::getImageData(float sx, float sy, float sw, float sh, ExceptionState& exceptionState) const
@@ -1618,11 +1618,13 @@ ImageData* CanvasRenderingContext2D::getImageData(float sx, float sy, float sw,
     IntRect imageDataRect = enclosingIntRect(logicalRect);
     ImageBuffer* buffer = canvas()->buffer();
     if (!buffer || isContextLost())
-        return ImageData::create(imageDataRect.size());
+        return ImageData::create(imageDataRect.size(), exceptionState);
 
     WTF::ArrayBufferContents contents;
-    if (!buffer->getImageData(Unmultiplied, imageDataRect, contents))
+    if (!buffer->getImageData(Unmultiplied, imageDataRect, contents)) {
+        exceptionState.throwRangeError("ImageData object creation failed due to insufficient available memory.");
         return nullptr;
+    }
 
     RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::create(contents);
     return ImageData::create(