Pepper: Initialize PP_ImageDataDesc when creating ImageData.

ppapi/proxy/ppb_image_data_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/ppb_image_data_proxy.h"
 
 #include <string.h>  // For memcpy
 
 #include <map>
 #include <vector>
@@ skipping 476 matching lines @@
   scoped_refptr<ImageData> cached_image_data =
       ImageDataCache::GetInstance()->Get(instance, type,
                                          size.width, size.height, format);
   if (cached_image_data.get()) {
     // We have one we can re-use rather than allocating a new one.
     cached_image_data->RecycleToPlugin(PP_ToBool(init_to_zero));
     return cached_image_data->GetReference();
   }
 
   HostResource result;
-  PP_ImageDataDesc desc;
+  // Initialize desc so we don't send unitialized memory over IPC.
+  // https://crbug.com/391023.
+  PP_ImageDataDesc desc = {};
   switch (type) {
     case PPB_ImageData_Shared::SIMPLE: {
       ppapi::proxy::SerializedHandle image_handle_wrapper;
       dispatcher->Send(new PpapiHostMsg_PPBImageData_CreateSimple(
           kApiID, instance, format, size, init_to_zero,
           &result, &desc, &image_handle_wrapper));
       if (image_handle_wrapper.is_shmem()) {
         base::SharedMemoryHandle image_handle = image_handle_wrapper.shmem();
         if (!result.is_null())
           return
@@ skipping 173 matching lines @@
   // still cached in our process, the proxy still holds a reference so we can
   // remove the one the renderer just sent is. If the proxy no longer holds a
   // reference, we released everything and we should also release the one the
   // renderer just sent us.
   dispatcher()->Send(new PpapiHostMsg_PPBCore_ReleaseResource(
       API_ID_PPB_CORE, old_image_data));
 }
 
 }  // namespace proxy
 }  // namespace ppapi