Throw a RangeError exception from get/createImageData when out of memory

third_party/WebKit/Source/modules/canvas2d/BaseRenderingContext2D.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/canvas2d/BaseRenderingContext2D.h"
 
 #include "bindings/core/v8/ExceptionMessages.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ExceptionStatePlaceholder.h"
 #include "core/css/parser/CSSParser.h"
@@ skipping 1122 matching lines @@
     static_cast<SkRect>(canvasRect).roundOut(&canvasIRect);
     if (!canvasIRect.intersect(transformedClipBounds))
         return false;
 
     if (dirtyRect)
         *dirtyRect = canvasIRect;
 
     return true;
 }
 
-ImageData* BaseRenderingContext2D::createImageData(ImageData* imageData) const
+ImageData* BaseRenderingContext2D::createImageData(ImageData* imageData, ExceptionState &exceptionState) const
 {
-    return ImageData::create(imageData->size());
+    ImageData* result = ImageData::create(imageData->size());
+    if (!result)
+        exceptionState.throwRangeError("Out of memory at ImageData creation");
+    return result;
 }
 
 ImageData* BaseRenderingContext2D::createImageData(double sw, double sh, ExceptionState& exceptionState) const
 {
     if (!sw || !sh) {
         exceptionState.throwDOMException(IndexSizeError, String::format("The source %s is 0.", sw ? "height" : "width"));
         return nullptr;
     }
 
     FloatSize logicalSize(fabs(sw), fabs(sh));
     if (!logicalSize.isExpressibleAsIntSize())
         return nullptr;
 
     IntSize size = expandedIntSize(logicalSize);
     if (size.width() < 1)
         size.setWidth(1);
     if (size.height() < 1)
         size.setHeight(1);
 
-    return ImageData::create(size);
+    ImageData* result = ImageData::create(size);
+    if (!result)
+        exceptionState.throwRangeError("Out of memory at ImageData creation");
+    return result;
 }
 
 ImageData* BaseRenderingContext2D::getImageData(double sx, double sy, double sw, double sh, ExceptionState& exceptionState) const
 {
     if (!originClean())
         exceptionState.throwSecurityError("The canvas has been tainted by cross-origin data.");
     else if (!sw || !sh)
         exceptionState.throwDOMException(IndexSizeError, String::format("The source %s is 0.", sw ? "height" : "width"));
 
     if (exceptionState.hadException())
@@ skipping 11 matching lines @@
     FloatRect logicalRect(sx, sy, sw, sh);
     if (logicalRect.width() < 1)
         logicalRect.setWidth(1);
     if (logicalRect.height() < 1)
         logicalRect.setHeight(1);
     if (!logicalRect.isExpressibleAsIntRect())
         return nullptr;
 
     IntRect imageDataRect = enclosingIntRect(logicalRect);
     ImageBuffer* buffer = imageBuffer();
-    if (!buffer || isContextLost())
-        return ImageData::create(imageDataRect.size());
+    if (!buffer || isContextLost()) {
+        ImageData* result = ImageData::create(imageDataRect.size());
+        if (!result)
+            exceptionState.throwRangeError("Out of memory at ImageData creation");
+        return result;
+    }
 
     WTF::ArrayBufferContents contents;
-    if (!buffer->getImageData(Unmultiplied, imageDataRect, contents))
+    if (!buffer->getImageData(Unmultiplied, imageDataRect, contents)) {
+        exceptionState.throwRangeError("Out of memory at ImageData creation");
         return nullptr;
+    }
 
     RefPtr<DOMArrayBuffer> arrayBuffer = DOMArrayBuffer::create(contents);
     return ImageData::create(
         imageDataRect.size(),
         DOMUint8ClampedArray::create(arrayBuffer, 0, arrayBuffer->byteLength()));
 }
 
 void BaseRenderingContext2D::putImageData(ImageData* data, double dx, double dy, ExceptionState& exceptionState)
 {
     putImageData(data, dx, dy, 0, 0, data->width(), data->height(), exceptionState);
@@ skipping 144 matching lines @@
 
     imageBuffer()->willOverwriteCanvas();
 }
 
 DEFINE_TRACE(BaseRenderingContext2D)
 {
     visitor->trace(m_stateStack);
 }
 
 } // namespace blink