Fix a crash when saving a <canvas> or <img> image which is large.

content/browser/renderer_host/render_message_filter.cc

Index: content/browser/renderer_host/render_message_filter.cc
diff --git a/content/browser/renderer_host/render_message_filter.cc b/content/browser/renderer_host/render_message_filter.cc
index b43c67d6a45f25596b4113e08ed6c0cd3a8b2ac1..4ef4a11f1f596993efd734fd86e39042e4544c11 100644
--- a/content/browser/renderer_host/render_message_filter.cc
+++ b/content/browser/renderer_host/render_message_filter.cc
@@ -31,6 +31,7 @@
 #include "content/browser/transition_request_manager.h"
 #include "content/common/child_process_host_impl.h"
 #include "content/common/child_process_messages.h"
+#include "content/common/content_constants_internal.h"
 #include "content/common/cookie_data.h"
 #include "content/common/desktop_notification_messages.h"
 #include "content/common/frame_messages.h"
@@ -396,6 +397,8 @@ bool RenderMessageFilter::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_LoadFont, OnLoadFont)
 #endif
     IPC_MESSAGE_HANDLER(ViewHostMsg_DownloadUrl, OnDownloadUrl)
+    IPC_MESSAGE_HANDLER(ViewHostMsg_SaveImageFromDataURL,
+                        OnSaveImageFromDataURL)
 #if defined(ENABLE_PLUGINS)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(ViewHostMsg_GetPlugins, OnGetPlugins)
     IPC_MESSAGE_HANDLER(FrameHostMsg_GetPluginInfo, OnGetPluginInfo)
@@ -865,11 +868,11 @@ void RenderMessageFilter::OnGetMonitorColorProfile(std::vector<char>* profile) {
 }
 #endif
 
-void RenderMessageFilter::OnDownloadUrl(int render_view_id,
-                                        const GURL& url,
-                                        const Referrer& referrer,
-                                        const base::string16& suggested_name,
-                                        const bool use_prompt) {
+void RenderMessageFilter::DownloadUrl(int render_view_id,
+                                      const GURL& url,
+                                      const Referrer& referrer,
+                                      const base::string16& suggested_name,
+                                      const bool use_prompt) {
   scoped_ptr<DownloadSaveInfo> save_info(new DownloadSaveInfo());
   save_info->suggested_name = suggested_name;
   save_info->prompt_for_save_location = use_prompt;
@@ -898,6 +901,21 @@ void RenderMessageFilter::OnDownloadUrl(int render_view_id,
       ResourceDispatcherHostImpl::DownloadStartedCallback());
 }
 
+void RenderMessageFilter::OnDownloadUrl(int render_view_id,
+                                        const GURL& url,
+                                        const Referrer& referrer,
+                                        const base::string16& suggested_name) {
+  DownloadUrl(render_view_id, url, referrer, suggested_name, false);
+}
+
+void RenderMessageFilter::OnSaveImageFromDataURL(int render_view_id,
+                                                 const std::string& data_url) {
+  // Please refer to RenderViewImpl::saveImageFromDataURL().
+  if (data_url.length() < kMaxLengthOfDataURLString)
+    DownloadUrl(render_view_id, GURL(data_url),

[Ken Russell (switch to Gerrit), 2014/09/11 00:38:53]

Please construct the GURL in a separate statement and verify that the scheme is
"data", returning immediately if not (or if something else went wrong in GURL
construction). The browser does not trust the renderer. All assumptions about
incoming inputs must be verified.

[zino, 2014/09/12 09:38:27]

Done.

+        Referrer(), base::string16(), true);
+}
+
 void RenderMessageFilter::OnCheckNotificationPermission(
     const GURL& source_origin, int* result) {
 #if defined(ENABLE_NOTIFICATIONS)