Created attachment 417519 [details]
the script caused crash

1. Reproduce of crash: 

(1) open inspector window and run the script below in the console;
(2) the script is:
// ==========================================
(function () {
    const _1 = 32769;
    const _0 = new ImageData(1, _1);
    const _3 = {resizeHeight: 1};
    return createImageBitmap(_0, _3);
})();
// ==========================================

change `_1` less than 32768 will be safe.

the critical point `32768` would cause crash on `debug` version, but OK on `release` version.

 
2. Analysis
I found the crash was caused by a null pointer dereference in `Source/WebCore/html/ImageBitmap.cpp:823`.

Because the `Cairo` library limit image width and height less than 32768, and will return nullptr if larger than the limit. 

The limit `cairoMaxImageSize` defined in `Source/WebCore/platform/graphics/ImageBackingStore.h:39`
The function `create` defined in `Source/WebCore/platform/graphics/cairo/ImageBufferCairoImageSurfaceBackend.cpp:44`

part of the code that returns nullptr

```
// ========== Source/WebCore/platform/graphics/cairo/ImageBufferCairoImageSurfaceBackend.cpp:50 ==========

    IntSize backendSize = calculateBackendSize(parameters.logicalSize, parameters.resolutionScale);
    if (backendSize.isEmpty() || backendSize.width() > cairoMaxImageSize || backendSize.height() > cairoMaxImageSize)
        return nullptr;
 
```