Reject createImageBitmap promise when the cropRect or resize is too big

third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp

Index: third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
diff --git a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
index a376b6c1e45025880a6e39a082736ecacc529a4a..b73c43bd4fc8c8106842ab2495df4c62ba6d534b 100644
--- a/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
+++ b/third_party/WebKit/Source/modules/webgl/WebGLRenderingContextBase.cpp
@@ -4529,7 +4529,6 @@ void WebGLRenderingContextBase::texImageHelperImageBitmap(TexImageFunctionID fun
     }
     RefPtr<SkImage> skImage = bitmap->bitmapImage()->imageForCurrentFrame();
     SkPixmap pixmap;
-    std::unique_ptr<uint8_t[]> pixelData;
     uint8_t* pixelDataPtr = nullptr;
     // In the case where an ImageBitmap is not texture backed, peekPixels() always succeed.
     // However, when it is texture backed and !canUseTexImageByGPU, we do a GPU read back.
@@ -4537,8 +4536,7 @@ void WebGLRenderingContextBase::texImageHelperImageBitmap(TexImageFunctionID fun
     if (peekSucceed) {
         pixelDataPtr = static_cast<uint8_t*>(pixmap.writable_addr());
     } else {
-        pixelData = bitmap->copyBitmapData(bitmap->isPremultiplied() ? PremultiplyAlpha : DontPremultiplyAlpha);
-        pixelDataPtr = pixelData.get();
+        pixelDataPtr = bitmap->copyBitmapData(bitmap->isPremultiplied() ? PremultiplyAlpha : DontPremultiplyAlpha).leakRef()->data();

[Justin Novosad, 2016/08/24 14:57:00]

Why the leakRef here? Who is responsible for deleting the array?  I think you
should hold on to the array in a local RefPtr<Uint8Array>

[xidachen, 2016/08/25 20:36:20]

Done.

     }
     Vector<uint8_t> data;
     bool needConversion = true;