Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/core/html/ImageData.cpp

Index: third_party/WebKit/Source/core/html/ImageData.cpp
diff --git a/third_party/WebKit/Source/core/html/ImageData.cpp b/third_party/WebKit/Source/core/html/ImageData.cpp
index f0cec65d2ecd00cf4d5c6b57a1d593615b16ecda..ee27e7d863ca240ae7aff06a1c0d9df0d74e9b71 100644
--- a/third_party/WebKit/Source/core/html/ImageData.cpp
+++ b/third_party/WebKit/Source/core/html/ImageData.cpp
@@ -36,18 +36,22 @@
 
 namespace blink {
 
-ImageData* ImageData::create(const IntSize& size)
+ImageData* ImageData::create(const IntSize& size, ExceptionState& exceptionState)
 {
     Checked<int, RecordOverflow> dataSize = 4;
     dataSize *= size.width();
     dataSize *= size.height();
-    if (dataSize.hasOverflowed() || dataSize.unsafeGet() < 0)
+    if (dataSize.hasOverflowed() || dataSize.unsafeGet() < 0) {
+        exceptionState.throwDOMException(IndexSizeError, "The requested image size exceeds the supported range.");
         return nullptr;
+    }
 
     RefPtr<DOMUint8ClampedArray> byteArray =
         DOMUint8ClampedArray::createOrNull(dataSize.unsafeGet());
-    if (!byteArray)
+    if (!byteArray) {
+        exceptionState.throwRangeError("Out of memory.");
         return nullptr;
+    }
 
     return new ImageData(size, byteArray.release());
 }
@@ -57,12 +61,11 @@ ImageData* ImageData::create(const IntSize& size, PassRefPtr<DOMUint8ClampedArra
     Checked<int, RecordOverflow> dataSize = 4;
     dataSize *= size.width();
     dataSize *= size.height();
-    if (dataSize.hasOverflowed())
-        return nullptr;
-
-    if (dataSize.unsafeGet() < 0
-        || static_cast<unsigned>(dataSize.unsafeGet()) > byteArray->length())
+    if (dataSize.hasOverflowed()
+        || dataSize.unsafeGet() < 0
+        || static_cast<unsigned>(dataSize.unsafeGet()) > byteArray->length()) {
         return nullptr;
+    }
 
     return new ImageData(size, byteArray);
 }
@@ -87,7 +90,7 @@ ImageData* ImageData::create(unsigned width, unsigned height, ExceptionState& ex
     RefPtr<DOMUint8ClampedArray> byteArray =
         DOMUint8ClampedArray::createOrNull(dataSize.unsafeGet());
     if (!byteArray) {
-        exceptionState.throwDOMException(V8GeneralError, "Out of memory at ImageData creation");
+        exceptionState.throwRangeError("Out of memory.");
         return nullptr;
     }