Throw a RangeError exception from get/createImageData when out of memory

third_party/WebKit/Source/platform/graphics/ImageBuffer.cpp

 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 274 matching lines @@
 
 bool ImageBuffer::getImageData(Multiply multiplied, const IntRect& rect, WTF::ArrayBufferContents& contents) const
 {
     Checked<int, RecordOverflow> dataSize = 4;
     dataSize *= rect.width();
     dataSize *= rect.height();
     if (dataSize.hasOverflowed())
         return false;
 
     if (!isSurfaceValid()) {
-        WTF::ArrayBufferContents result(rect.width() * rect.height(), 4, WTF::ArrayBufferContents::NotShared, WTF::ArrayBufferContents::ZeroInitialize);
+        size_t allocSizeInBytes = rect.width() * rect.height() * 4;
+        void* data;
+        WTF::ArrayBufferContents::allocateMemoryOrNull(allocSizeInBytes, WTF::ArrayBufferContents::ZeroInitialize, data);
+        if (!data)
+            return false;
+        WTF::ArrayBufferContents result(data, allocSizeInBytes, WTF::ArrayBufferContents::NotShared);
         result.transfer(contents);
         return true;
     }
 
     ASSERT(canvas());
     RefPtr<SkImage> snapshot = m_surface->newImageSnapshot(PreferNoAcceleration, SnapshotReasonGetImageData);
     if (!snapshot)
         return false;
 
     const bool mayHaveStrayArea =
         m_surface->isAccelerated() // GPU readback may fail silently
         || rect.x() < 0
         || rect.y() < 0
         || rect.maxX() > m_surface->size().width()
         || rect.maxY() > m_surface->size().height();
-    WTF::ArrayBufferContents result(
-        rect.width() * rect.height(), 4,
-        WTF::ArrayBufferContents::NotShared,
-        mayHaveStrayArea
-        ? WTF::ArrayBufferContents::ZeroInitialize
-        : WTF::ArrayBufferContents::DontInitialize);
+    size_t allocSizeInBytes = rect.width() * rect.height() * 4;
+    void* data;
+    WTF::ArrayBufferContents::allocateMemoryOrNull(allocSizeInBytes, mayHaveStrayArea ? WTF::ArrayBufferContents::ZeroInitialize : WTF::ArrayBufferContents::DontInitialize, data);

[Stephen White, 2016/03/07 22:09:54]

Nit: might be clearer to pull the initialize enum (results of the ternary) out
into a temporary var.

+    if (!data)
+        return false;
+    WTF::ArrayBufferContents result(data, allocSizeInBytes, WTF::ArrayBufferContents::NotShared);
 
     SkAlphaType alphaType = (multiplied == Premultiplied) ? kPremul_SkAlphaType : kUnpremul_SkAlphaType;
     SkImageInfo info = SkImageInfo::Make(rect.width(), rect.height(), kRGBA_8888_SkColorType, alphaType);
 
     snapshot->readPixels(info, result.data(), 4 * rect.width(), rect.x(), rect.y());
     result.transfer(contents);
     return true;
 }
 
 void ImageBuffer::putByteArray(Multiply multiplied, const unsigned char* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint)
@@ skipping 72 matching lines @@
     ASSERT(MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(mimeType));
 
     Vector<unsigned char> result;
     if (!encodeImage(mimeType, quality, &result))
         return "data:,";
 
     return "data:" + mimeType + ";base64," + base64Encode(result);
 }
 
 } // namespace blink