Fix a crash when saving a <canvas> or <img> image which is large.

content/browser/renderer_host/render_message_filter.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_message_filter.h"
 
 #include <map>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ skipping 15 matching lines @@
 #include "content/browser/plugin_service_impl.h"
 #include "content/browser/ppapi_plugin_process_host.h"
 #include "content/browser/renderer_host/pepper/pepper_security_helper.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_helper.h"
 #include "content/browser/renderer_host/render_widget_resize_helper.h"
 #include "content/browser/transition_request_manager.h"
 #include "content/common/child_process_host_impl.h"
 #include "content/common/child_process_messages.h"
+#include "content/common/content_constants_internal.h"
 #include "content/common/cookie_data.h"
 #include "content/common/desktop_notification_messages.h"
 #include "content/common/frame_messages.h"
 #include "content/common/host_shared_bitmap_manager.h"
 #include "content/common/media/media_param_traits.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_child_process_host.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ skipping 338 matching lines @@
                         OnCreateFullscreenWidget)
     IPC_MESSAGE_HANDLER(ViewHostMsg_SetCookie, OnSetCookie)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_GetCookies, OnGetCookies)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_GetRawCookies, OnGetRawCookies)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DeleteCookie, OnDeleteCookie)
     IPC_MESSAGE_HANDLER(ViewHostMsg_CookiesEnabled, OnCookiesEnabled)
 #if defined(OS_MACOSX)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_LoadFont, OnLoadFont)
 #endif
     IPC_MESSAGE_HANDLER(ViewHostMsg_DownloadUrl, OnDownloadUrl)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_SaveImageFromDataURL,
+                        OnSaveImageFromDataURL)
 #if defined(ENABLE_PLUGINS)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_GetPlugins, OnGetPlugins)
     IPC_MESSAGE_HANDLER(FrameHostMsg_GetPluginInfo, OnGetPluginInfo)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_OpenChannelToPlugin,
                                     OnOpenChannelToPlugin)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_OpenChannelToPepperPlugin,
                                     OnOpenChannelToPepperPlugin)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DidCreateOutOfProcessPepperInstance,
                         OnDidCreateOutOfProcessPepperInstance)
     IPC_MESSAGE_HANDLER(ViewHostMsg_DidDeleteOutOfProcessPepperInstance,
@@ skipping 449 matching lines @@
       media::AudioManagerBase::kDefaultDeviceId);
 }
 
 #if defined(OS_WIN)
 void RenderMessageFilter::OnGetMonitorColorProfile(std::vector<char>* profile) {
   DCHECK(!BrowserThread::CurrentlyOn(BrowserThread::IO));
   *profile = g_color_profile.Get().profile();
 }
 #endif
 
-void RenderMessageFilter::OnDownloadUrl(int render_view_id,
-                                        const GURL& url,
-                                        const Referrer& referrer,
-                                        const base::string16& suggested_name,
-                                        const bool use_prompt) {
+void RenderMessageFilter::DownloadUrl(int render_view_id,
+                                      const GURL& url,
+                                      const Referrer& referrer,
+                                      const base::string16& suggested_name,
+                                      const bool use_prompt) {
   scoped_ptr<DownloadSaveInfo> save_info(new DownloadSaveInfo());
   save_info->suggested_name = suggested_name;
   save_info->prompt_for_save_location = use_prompt;
 
   // There may be a special cookie store that we could use for this download,
   // rather than the default one. Since this feature is generally only used for
   // proper render views, and not downloads, we do not need to retrieve the
   // special cookie store here, but just initialize the request to use the
   // default cookie store.
   // TODO(tburkard): retrieve the appropriate special cookie store, if this
   // is ever to be used for downloads as well.
   scoped_ptr<net::URLRequest> request(
       resource_context_->GetRequestContext()->CreateRequest(
           url, net::DEFAULT_PRIORITY, NULL, NULL));
   RecordDownloadSource(INITIATED_BY_RENDERER);
   resource_dispatcher_host_->BeginDownload(
       request.Pass(),
       referrer,
       true,  // is_content_initiated
       resource_context_,
       render_process_id_,
       render_view_id,
       false,
       save_info.Pass(),
       content::DownloadItem::kInvalidId,
       ResourceDispatcherHostImpl::DownloadStartedCallback());
 }
 
+void RenderMessageFilter::OnDownloadUrl(int render_view_id,
+                                        const GURL& url,
+                                        const Referrer& referrer,
+                                        const base::string16& suggested_name) {
+  DownloadUrl(render_view_id, url, referrer, suggested_name);
+}
+
+void RenderMessageFilter::OnSaveImageFromDataURL(int render_view_id,
+                                                 const std::string& data_url) {
+  // Note: |data_url| has a size limitation. (< 10MiB)

[palmer, 2014/09/03 17:31:46]

Minor nit: I think the code is so clear (line 910) that this comment is
unnecessary.

[zino, 2014/09/05 03:47:47]

Done.

+  // Please refer to RenderViewImpl::saveImageFromDataURL().
+  if (data_url.length() < kMaxLengthOfDataURLString)

[Ken Russell (switch to Gerrit), 2014/09/04 00:23:26]

Please see my comments in your other CL
https://codereview.chromium.org/518043003/ . After thinking about this more
carefully, I think that this should construct the GURL for the incoming data_url
and make sure the scheme is actually data:, returning immediately otherwise.
Then the old code path should be invoked for images, not this one. I suspect
there's a reason that images' download was initiated through ResourceRequest and
I don't think that should be changed.

[zino, 2014/09/05 03:47:47]

It will be return in WebViewImpl::saveImageAt(). (if the url is not data url)
In that case, this function is not invoked.
This new path is only used by canvas or img to have large data url.

+    DownloadUrl(render_view_id, GURL(data_url),
+        Referrer(), base::string16(), true);
+}
+
 void RenderMessageFilter::OnCheckNotificationPermission(
     const GURL& source_origin, int* result) {
 #if defined(ENABLE_NOTIFICATIONS)
   *result = GetContentClient()->browser()->
       CheckDesktopNotificationPermission(source_origin, resource_context_,
                                          render_process_id_);
 #else
   *result = blink::WebNotificationPresenter::PermissionAllowed;
 #endif
 }
@@ skipping 314 matching lines @@
     int render_frame_id,
     const std::string& allowed_destination_host_pattern,
     const std::string& selector,
     const std::string& markup) {
   TransitionRequestManager::GetInstance()->AddPendingTransitionRequestData(
       render_process_id_, render_frame_id, allowed_destination_host_pattern,
       selector, markup);
 }
 
 }  // namespace content