Fix crash in canvas.toBlob caused by allocation failure

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
index 2e58bec4cd36bf80e7f4042a0613b8a186f9b851..0e75ecfed823d8c1033ee290883be376132c1a49 100644
--- a/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp
@@ -304,7 +304,7 @@ void HTMLCanvasElement::didFinalizeFrame()
     m_numFramesSinceLastRenderingModeSwitch++;
     if (RuntimeEnabledFeatures::enableCanvas2dDynamicRenderingModeSwitchingEnabled()
         && !RuntimeEnabledFeatures::canvas2dFixedRenderingModeEnabled()) {
-        if (m_context->is2d() && buffer()->isAccelerated()
+        if (m_context->is2d() && buffer() && buffer()->isAccelerated()
             && m_numFramesSinceLastRenderingModeSwitch >= ExpensiveCanvasHeuristicParameters::MinFramesBeforeSwitch
             && !m_pendingRenderingModeSwitch) {
             if (!m_context->isAccelerationOptimalForCanvasContent()) {
@@ -323,7 +323,7 @@ void HTMLCanvasElement::didFinalizeFrame()
         }
     }
 
-    if (m_pendingRenderingModeSwitch && !buffer()->isAccelerated()) {
+    if (m_pendingRenderingModeSwitch && buffer() && !buffer()->isAccelerated()) {
         m_pendingRenderingModeSwitch = false;
     }
 
@@ -603,10 +603,12 @@ ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer, Snap
 
         m_context->paintRenderingResultsToCanvas(sourceBuffer);
         imageData = ImageData::create(m_size);
-        sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
-        if (snapshot) {
-            SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
-            snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+        if (hasImageBuffer()) {
+            sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
+            if (snapshot) {
+                SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
+                snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+            }
         }
         return imageData;
     }
@@ -617,10 +619,12 @@ ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer, Snap
         return imageData;
 
     DCHECK(m_context->is2d());
-    sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
-    if (snapshot) {
-        SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
-        snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+    if (hasImageBuffer()) {
+        sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
+        if (snapshot) {
+            SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
+            snapshot->readPixels(imageInfo, imageData->data()->data(), imageInfo.minRowBytes(), 0, 0);
+        }
     }
 
     return imageData;