Fixed bug 64847: Graphics2D paints outside plugin boundaries.

webkit/plugins/ppapi/ppb_graphics_2d_impl.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/plugins/ppapi/ppb_graphics_2d_impl.h"
 
 #include <iterator>
 
 #include "base/logging.h"
 #include "base/message_loop.h"
@@ skipping 463 matching lines @@
     // actually painted something. By not bothering to schedule an invalidate
     // when an empty device is initially bound, we can save an extra paint for
     // many plugins during the critical page initialization phase.
     new_instance->InvalidateRect(gfx::Rect());
   }
 
   bound_instance_ = new_instance;
   return true;
 }
 
+// The |backing_bitmap| must be clipped to the |plugin_rect| to avoid painting
+// outside the plugin area. This can happen if the plugin has been resized since
+// PaintImageData verified the image is within the plugin size.
 void PPB_Graphics2D_Impl::Paint(WebKit::WebCanvas* canvas,
                                 const gfx::Rect& plugin_rect,
                                 const gfx::Rect& paint_rect) {
   ImageDataAutoMapper auto_mapper(image_data_);
   const SkBitmap& backing_bitmap = *image_data_->GetMappedBitmap();
 
 #if defined(OS_MACOSX)
   SkAutoLockPixels lock(backing_bitmap);
 
   base::mac::ScopedCFTypeRef<CGDataProviderRef> data_provider(
       CGDataProviderCreateWithData(
           NULL, backing_bitmap.getAddr32(0, 0),
           backing_bitmap.rowBytes() * backing_bitmap.height(), NULL));
   base::mac::ScopedCFTypeRef<CGImageRef> image(
       CGImageCreate(
           backing_bitmap.width(), backing_bitmap.height(),
           8, 32, backing_bitmap.rowBytes(),
           base::mac::GetSystemColorSpace(),
           kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host,
           data_provider, NULL, false, kCGRenderingIntentDefault));
 
   // Flip the transform
   CGContextSaveGState(canvas);
   float window_height = static_cast<float>(CGBitmapContextGetHeight(canvas));
   CGContextTranslateCTM(canvas, 0, window_height);
   CGContextScaleCTM(canvas, 1.0, -1.0);
 
+  // To avoid painting outside the plugin boundaries and clip instead of
+  // scaling, CGContextDrawImage() must draw the full image using |bitmap_rect|
+  // but the context must be clipped to the plugin using |bounds|.
+
+  CGRect bitmap_rect;
+  bitmap_rect.origin.x = plugin_rect.origin().x();
+  bitmap_rect.origin.y = window_height - plugin_rect.origin().y() -
+      backing_bitmap.height();
+  bitmap_rect.size.width = backing_bitmap.width();
+  bitmap_rect.size.height = backing_bitmap.height();
+
   CGRect bounds;
   bounds.origin.x = plugin_rect.origin().x();
   bounds.origin.y = window_height - plugin_rect.origin().y() -
-      backing_bitmap.height();
-  bounds.size.width = backing_bitmap.width();
-  bounds.size.height = backing_bitmap.height();
+      plugin_rect.height();
+  bounds.size.width = plugin_rect.width();
+  bounds.size.height = plugin_rect.height();
+
+  CGContextClipToRect(canvas, bounds);
 
   // TODO(brettw) bug 56673: do a direct memcpy instead of going through CG
-  // if the is_always_opaque_ flag is set.
+  // if the is_always_opaque_ flag is set. Must ensure bitmap is still clipped.
 
-  CGContextDrawImage(canvas, bounds, image);
+  CGContextDrawImage(canvas, bitmap_rect, image);
   CGContextRestoreGState(canvas);
 #else
   SkPaint paint;
   if (is_always_opaque_) {
     // When we know the device is opaque, we can disable blending for slightly
     // more optimized painting.
     paint.setXfermodeMode(SkXfermode::kSrc_Mode);
   }
 
-  gfx::Point origin(plugin_rect.origin().x(), plugin_rect.origin().y());
+  canvas->save();
+  SkRect clip_rect = SkRect::MakeXYWH(SkIntToScalar(plugin_rect.origin().x()),
+                                      SkIntToScalar(plugin_rect.origin().y()),
+                                      SkIntToScalar(plugin_rect.width()),
+                                      SkIntToScalar(plugin_rect.height()));
+  canvas->clipRect(clip_rect);
   canvas->drawBitmap(backing_bitmap,
-                     SkIntToScalar(plugin_rect.origin().x()),
-                     SkIntToScalar(plugin_rect.origin().y()),
+                     SkIntToScalar(plugin_rect.x()),
+                     SkIntToScalar(plugin_rect.y()),
                      &paint);
+  canvas->restore();
 #endif
 }
 
 void PPB_Graphics2D_Impl::ViewInitiatedPaint() {
   // Move any "unpainted" callback to the painted state. See
   // |unpainted_flush_callback_| in the header for more.
   if (!unpainted_flush_callback_.is_null()) {
     DCHECK(painted_flush_callback_.is_null());
     std::swap(painted_flush_callback_, unpainted_flush_callback_);
   }
@@ skipping 98 matching lines @@
 
 bool PPB_Graphics2D_Impl::HasPendingFlush() const {
   return !unpainted_flush_callback_.is_null() ||
          !painted_flush_callback_.is_null() ||
          offscreen_flush_pending_;
 }
 
 }  // namespace ppapi
 }  // namespace webkit