Fix out-of-memory crashes related to ArrayBuffer allocation

third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp

Index: third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
diff --git a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
index 7675cd2118071be4469f7d6b9805b63dd516480e..78dd7c6cf03cfd04fc25b0088fff5e42718bdb8b 100644
--- a/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
+++ b/third_party/WebKit/Source/modules/canvas2d/CanvasRenderingContext2D.cpp
@@ -1563,9 +1563,9 @@ SkCanvas* CanvasRenderingContext2D::drawingCanvas() const
     return canvas()->drawingCanvas();
 }
 
-ImageData* CanvasRenderingContext2D::createImageData(ImageData* imageData) const
+ImageData* CanvasRenderingContext2D::createImageData(ImageData* imageData, ExceptionState& exceptionState) const
 {
-    return ImageData::create(imageData->size());
+    return ImageData::create(imageData->size(), exceptionState);
 }
 
 ImageData* CanvasRenderingContext2D::createImageData(float sw, float sh, ExceptionState& exceptionState) const
@@ -1585,7 +1585,7 @@ ImageData* CanvasRenderingContext2D::createImageData(float sw, float sh, Excepti
     if (size.height() < 1)
         size.setHeight(1);
 
-    return ImageData::create(size);
+    return ImageData::create(size, exceptionState);
 }
 
 ImageData* CanvasRenderingContext2D::getImageData(float sx, float sy, float sw, float sh, ExceptionState& exceptionState) const
@@ -1618,11 +1618,13 @@ ImageData* CanvasRenderingContext2D::getImageData(float sx, float sy, float sw,
     IntRect imageDataRect = enclosingIntRect(logicalRect);
     ImageBuffer* buffer = canvas()->buffer();
     if (!buffer || isContextLost())
-        return ImageData::create(imageDataRect.size());
+        return ImageData::create(imageDataRect.size(), exceptionState);
 
     WTF::ArrayBufferContents contents;
-    if (!buffer->getImageData(Unmultiplied, imageDataRect, contents))
+    if (!buffer->getImageData(Unmultiplied, imageDataRect, contents)) {
+        exceptionState.throwRangeError("Out of memory.");

[haraken, 2015/10/29 16:24:34]

Maybe do we want to invent a better error message for this?

[Justin Novosad, 2015/10/29 18:26:02]

Acknowledged.

         return nullptr;
+    }
 
     RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::create(contents);
     return ImageData::create(