Fix crash in canvas.toBlob caused by allocation failure

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

 /*
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 286 matching lines @@
         // For querying PaintLayer::compositingState()
         // FIXME: is this invalidation using the correct compositing state?
         DisableCompositingQueryAsserts disabler;
         ro->invalidatePaintRectangle(mappedDirtyRect);
     }
     m_dirtyRect = FloatRect();
 
     m_numFramesSinceLastRenderingModeSwitch++;
     if (RuntimeEnabledFeatures::enableCanvas2dDynamicRenderingModeSwitchingEnabled()
         && !RuntimeEnabledFeatures::canvas2dFixedRenderingModeEnabled()) {
         if (m_context->is2d() && buffer()->isAccelerated()

[xidachen, 2016/09/13 16:53:03]

should we worry about this call site?

             && m_numFramesSinceLastRenderingModeSwitch >= ExpensiveCanvasHeuristicParameters::MinFramesBeforeSwitch
             && !m_pendingRenderingModeSwitch) {
             if (!m_context->isAccelerationOptimalForCanvasContent()) {
                 // The switch must be done asynchronously in order to avoid switching during the paint invalidation step.
                 Platform::current()->currentThread()->getWebTaskRunner()->postTask(
                     BLINK_FROM_HERE,
                     WTF::bind([](WeakPtr<ImageBuffer> buffer) {
                         if (buffer) {
                             buffer->disableAcceleration();
                         }
                     },
                     m_imageBuffer->m_weakPtrFactory.createWeakPtr()));
                 m_numFramesSinceLastRenderingModeSwitch = 0;
                 m_pendingRenderingModeSwitch = true;
             }
         }
     }
 
     if (m_pendingRenderingModeSwitch && !buffer()->isAccelerated()) {

[xidachen, 2016/09/13 16:53:03]

This one as well?

         m_pendingRenderingModeSwitch = false;
     }
 
     m_context->incrementFrameCount();
 }
 
 void HTMLCanvasElement::didDisableAcceleration()
 {
     // We must force a paint invalidation on the canvas even if it's
     // content did not change because it layer was destroyed.
@@ skipping 259 matching lines @@
 {
     ImageData* imageData;
     if (is3D()) {
         // Get non-premultiplied data because of inaccurate premultiplied alpha conversion of buffer()->toDataURL().
         imageData = m_context->paintRenderingResultsToImageData(sourceBuffer);
         if (imageData)
             return imageData;
 
         m_context->paintRenderingResultsToCanvas(sourceBuffer);
         imageData = ImageData::create(m_size);
-        sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
-        if (snapshot) {
-            SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
-            snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+        if (hasImageBuffer()) {
+            sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
+            if (snapshot) {
+                SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
+                snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+            }
         }
         return imageData;
     }
 
     imageData = ImageData::create(m_size);
 
     if (!m_context)
         return imageData;
 
     DCHECK(m_context->is2d());
-    sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
-    if (snapshot) {
-        SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
-        snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+    if (hasImageBuffer()) {
+        sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
+        if (snapshot) {
+            SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
+            snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+        }
     }
 
     return imageData;
 }
 
 String HTMLCanvasElement::toDataURLInternal(const String& mimeType, const double& quality, SourceDrawingBuffer sourceBuffer) const
 {
     if (!isPaintable())
         return String("data:,");
 
@@ skipping 618 matching lines @@
 
 bool HTMLCanvasElement::createSurfaceLayer()
 {
     DCHECK(!m_surfaceLayerBridge);
     std::unique_ptr<CanvasSurfaceLayerBridgeClient> bridgeClient = wrapUnique(new CanvasSurfaceLayerBridgeClientImpl());
     m_surfaceLayerBridge = wrapUnique(new CanvasSurfaceLayerBridge(std::move(bridgeClient)));
     return m_surfaceLayerBridge->createSurfaceLayer(this->width(), this->height());
 }
 
 } // namespace blink