Merge 114487 - Skia OOM error when upscaling small subsets of images by large quantities

Source/WebCore/platform/graphics/skia/NativeImageSkia.cpp

 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  * 
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 109 matching lines @@
         m_resizedImage.reset();
     }
 
     // We can not cache incomplete frames. This might be a good optimization in
     // the future, were we know how much of the frame has been decoded, so when
     // we incrementally draw more of the image, we only have to resample the
     // parts that are changed.
     if (!isDataComplete())
         return false;
 
+    // If the destination bitmap is excessively large, we'll never allow caching.
+    static const unsigned long long kLargeBitmapSize = 4096ULL * 4096ULL;
+    if ((static_cast<unsigned long long>(destWidth) * static_cast<unsigned long long>(destHeight)) > kLargeBitmapSize)
+        return false;
+
     // If the destination bitmap is small, we'll always allow caching, since
     // there is not very much penalty for computing it and it may come in handy.
     static const int kSmallBitmapSize = 4096;
     if (destWidth * destHeight <= kSmallBitmapSize)
         return true;
 
     // If "too many" requests have been made for this bitmap, we assume that
     // many more will be made as well, and we'll go ahead and cache it.
     static const int kManyRequestThreshold = 4;
     if (m_resizeRequests >= kManyRequestThreshold)
@@ skipping 17 matching lines @@
 }
 
 void NativeImageSkia::CachedImageInfo::set(const SkIRect& otherSrcSubset, int width, int height)
 {
     srcSubset = otherSrcSubset;
     requestSize.setWidth(width);
     requestSize.setHeight(height);
 }
 
 } // namespace WebCore