Fix crash when creating an ImageBitmap from an invalid canvas

Source/modules/imagebitmap/ImageBitmapFactories.cpp

 /*
  * Copyright (c) 2013, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 45 matching lines @@
     return IntSize();
 }
 
 static IntSize sizeFor(HTMLVideoElement* video)
 {
     if (MediaPlayer* player = video->player())
         return player->naturalSize();
     return IntSize();
 }
 
-static ScriptPromise fulfillImageBitmap(ExecutionContext* context, PassRefPtrWillBeRawPtr<ImageBitmap> imageBitmap)
+ScriptPromise fulfillImageBitmap(ExecutionContext* context, PassRefPtrWillBeRawPtr<ImageBitmap> imageBitmap)

[Stephen White, 2014/03/25 16:56:31]

Is there a reason this needs to be non-static?

 {
     RefPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(context);
     ScriptPromise promise = resolver->promise();
-    resolver->resolve(imageBitmap);
+    if (imageBitmap) {
+        resolver->resolve(imageBitmap);
+    } else {
+        v8::Isolate* isolate = ScriptState::current()->isolate();
+        resolver->reject(ScriptValue(v8::Null(isolate), isolate));
+    }
     return promise;
 }
 
 ScriptPromise ImageBitmapFactories::createImageBitmap(EventTarget& eventTarget, HTMLImageElement* image, ExceptionState& exceptionState)
 {
     LayoutSize s = sizeFor(image);
     return createImageBitmap(eventTarget, image, 0, 0, s.width(), s.height(), exceptionState);
 }
 
 ScriptPromise ImageBitmapFactories::createImageBitmap(EventTarget& eventTarget, HTMLImageElement* image, int sx, int sy, int sw, int sh, ExceptionState& exceptionState)
@@ skipping 97 matching lines @@
         return ScriptPromise();
     }
     if (!canvas->originClean()) {
         exceptionState.throwSecurityError("The canvas element provided is tainted with cross-origin data.");
         return ScriptPromise();
     }
     if (!sw || !sh) {
         exceptionState.throwDOMException(IndexSizeError, String::format("The source %s provided is 0.", sw ? "height" : "width"));
         return ScriptPromise();
     }
+
     // FIXME: make ImageBitmap creation asynchronous crbug.com/258082
-    return fulfillImageBitmap(eventTarget.executionContext(), ImageBitmap::create(canvas, IntRect(sx, sy, sw, sh)));
+    return fulfillImageBitmap(eventTarget.executionContext(), canvas->buffer() ? ImageBitmap::create(canvas, IntRect(sx, sy, sw, sh)) : nullptr);
 }
 
 ScriptPromise ImageBitmapFactories::createImageBitmap(EventTarget& eventTarget, Blob* blob, ExceptionState& exceptionState)
 {
     if (!blob) {
         exceptionState.throwTypeError("The blob provided is invalid.");
         return ScriptPromise();
     }
     RefPtr<ScriptPromiseResolver> resolver = ScriptPromiseResolver::create(eventTarget.executionContext());
     ScriptPromise promise = resolver->promise();
@@ skipping 161 matching lines @@
         WillBeHeapSupplement<WorkerGlobalScope>::provideTo(object, ImageBitmapFactories::supplementName(), adoptPtrWillBeNoop(supplement));
     }
     return *supplement;
 }
 
 void WorkerGlobalScopeImageBitmapFactories::trace(Visitor*)
 {
 }
 
 } // namespace WebCore