Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
index d0b1507be5a13a82865857ab3516b60d57bd2885..e463ee0f70ab209f1a53629fb7d4d46ef8ec1bb0 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
@@ -487,7 +487,11 @@ String HTMLCanvasElement::toEncodingMimeType(const String& mimeType)
 
 const AtomicString HTMLCanvasElement::imageSourceURL() const
 {
-    return AtomicString(toDataURLInternal("image/png", 0, FrontBuffer));
+    NonThrowableExceptionState exceptionState;
+    AtomicString dataURL(toDataURLInternal("image/png", 0, FrontBuffer, exceptionState));
+    if (exceptionState.hadException())
+        return AtomicString("data:,");
+    return dataURL;
 }
 
 void HTMLCanvasElement::prepareSurfaceForPaintingIfNeeded() const
@@ -497,7 +501,7 @@ void HTMLCanvasElement::prepareSurfaceForPaintingIfNeeded() const
         m_imageBuffer->prepareSurfaceForPaintingIfNeeded();
 }
 
-ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer) const
+ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer, ExceptionState& exceptionState) const
 {
     ImageData* imageData;
     if (is3D()) {
@@ -507,7 +511,9 @@ ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer) cons
             return imageData;
 
         m_context->paintRenderingResultsToCanvas(sourceBuffer);
-        imageData = ImageData::create(m_size);
+        imageData = ImageData::create(m_size, exceptionState);
+        if (exceptionState.hadException())
+            return nullptr;
         RefPtr<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration);
         if (snapshot) {
             SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
@@ -516,7 +522,9 @@ ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer) cons
         return imageData;
     }
 
-    imageData = ImageData::create(m_size);
+    imageData = ImageData::create(m_size, exceptionState);
+    if (exceptionState.hadException())
+        return nullptr;
 
     if (!m_context)
         return imageData;
@@ -531,14 +539,17 @@ ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer) cons
     return imageData;
 }
 
-String HTMLCanvasElement::toDataURLInternal(const String& mimeType, const double& quality, SourceDrawingBuffer sourceBuffer) const
+String HTMLCanvasElement::toDataURLInternal(const String& mimeType, const double& quality, SourceDrawingBuffer sourceBuffer, ExceptionState& exceptionState) const
 {
     if (!isPaintable())
         return String("data:,");
 
     String encodingMimeType = toEncodingMimeType(mimeType);
 
-    ImageData* imageData = toImageData(sourceBuffer);
+    ImageData* imageData = toImageData(sourceBuffer, exceptionState);
+    if (exceptionState.hadException())
+        return String();
+
     ScopedDisposal<ImageData> disposer(imageData);
 
     return ImageDataBuffer(imageData->size(), imageData->data()->data()).toDataURL(encodingMimeType, quality);
@@ -557,7 +568,7 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, const ScriptValue& q
             quality = v8Value.As<v8::Number>()->Value();
         }
     }
-    return toDataURLInternal(mimeType, quality, BackBuffer);
+    return toDataURLInternal(mimeType, quality, BackBuffer, exceptionState);
 }
 
 void HTMLCanvasElement::encodeImageAsync(DOMUint8ClampedArray* imageData, IntSize imageSize, FileCallback* callback, const String& mimeType, double quality)
@@ -603,8 +614,11 @@ void HTMLCanvasElement::toBlob(FileCallback* callback, const String& mimeType, c
 
     String encodingMimeType = toEncodingMimeType(mimeType);
 
-    ImageData* imageData = toImageData(BackBuffer);
-    // imageData unref its data, which we still keep alive for the async toBlob thread
+    ImageData* imageData = toImageData(BackBuffer, exceptionState);
+    if (exceptionState.hadException())
+        return;
+
+    // ImageData unrefs its data, which we still keep alive for the async toBlob thread
     ScopedDisposal<ImageData> disposer(imageData);
 
     // Add a ref to keep image data alive until completion of encoding