Make toDataURL robust with respect to allocation failures

It is not safe to assume that ImageData::create always returns
a valid point.  Internally it uses DOMUint8ClampedArray::createOrNull
which returns null instead of crashing when allocation fails.
This change adds the appropriate null pointer checks to take
that into account.

BUG=647824
NOTRY=true

Review-Url: https://codereview.chromium.org/2361493003
Cr-Commit-Position: refs/heads/master@{#420625}

third_party/WebKit/Source/core/html/HTMLCanvasElement.cpp

@@ -626,7 +626,7 @@ ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer, Snap
 
         m_context->paintRenderingResultsToCanvas(sourceBuffer);
         imageData = ImageData::create(m_size);
-        if (hasImageBuffer()) {
+        if (imageData && hasImageBuffer()) {
             sk_sp<SkImage> snapshot = buffer()->newSkImageSnapshot(PreferNoAcceleration, reason);
             if (snapshot) {
                 SkImageInfo imageInfo = SkImageInfo::Make(width(), height(), kRGBA_8888_SkColorType, kUnpremul_SkAlphaType);
@@ -638,7 +638,7 @@ ImageData* HTMLCanvasElement::toImageData(SourceDrawingBuffer sourceBuffer, Snap
 
     imageData = ImageData::create(m_size);
 
-    if (!m_context)
+    if (!m_context || !imageData)
         return imageData;
 
     DCHECK(m_context->is2d());
@@ -662,6 +662,9 @@ String HTMLCanvasElement::toDataURLInternal(const String& mimeType, const double
 
     ImageData* imageData = toImageData(sourceBuffer, SnapshotReasonToDataURL);
 
+    if (!imageData) // allocation failure
+        return String("data:,");
+
     return ImageDataBuffer(imageData->size(), imageData->data()->data()).toDataURL(encodingMimeType, quality);
 }
 
@@ -746,6 +749,12 @@ void HTMLCanvasElement::toBlob(BlobCallback* callback, const String& mimeType, c
 
     ImageData* imageData = toImageData(BackBuffer, SnapshotReasonToBlob);
 
+    if (!imageData) {
+        // ImageData allocation faillure
+        TaskRunnerHelper::get(TaskType::CanvasBlobSerialization, &document())->postTask(BLINK_FROM_HERE, WTF::bind(&BlobCallback::handleEvent, wrapPersistent(callback), nullptr));
+        return;
+    }
+
     CanvasAsyncBlobCreator* asyncCreator = CanvasAsyncBlobCreator::create(imageData->data(), encodingMimeType, imageData->size(), callback, startTime, document());
 
     bool useIdlePeriodScheduling = (encodingMimeType != "image/webp");