Allow negative width or height values to be passed into canvas.drawImage...

WebCore/platform/graphics/skia/ImageSkia.cpp

 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 269 matching lines @@
 
     // Now measure the length of the two transformed vectors relative to the
     // transformed origin to see how big the bitmap will be. Note: for skews,
     // this isn't the best thing, but we don't have skews.
     SkPoint dest_points[3];
     matrix.mapPoints(dest_points, src_points, 3);
     *dest_width = SkScalarToFloat((dest_points[1] - dest_points[0]).length());
     *dest_height = SkScalarToFloat((dest_points[2] - dest_points[0]).length());
 }
 
+// A helper method for translating negative width and height values.
+FloatRect normalizeRect(const FloatRect& rect)
+{
+    FloatRect norm = rect;
+    if (norm.width() < 0) {
+        norm.setX(norm.x() + norm.width());
+        norm.setWidth(-norm.width());
+    }
+    if (norm.height() < 0) {
+        norm.setY(norm.y() + norm.height());
+        norm.setHeight(-norm.height());
+    }
+    return norm;
+}
+
 }  // namespace
 
 void FrameData::clear()
 {
     // ImageSource::createFrameAtIndex() allocated |m_frame| and passed
     // ownership to BitmapImage; we must delete it here.
     delete m_frame;
     m_frame = 0;
     // NOTE: We purposefully don't reset metadata here, so that even if we
     // throw away previously-decoded data, animation loops can still access
@@ skipping 117 matching lines @@
 
     // Spin the animation to the correct frame before we try to draw it, so we
     // don't draw an old frame and then immediately need to draw a newer one,
     // causing flicker and wasting CPU.
     startAnimation();
 
     const NativeImageSkia* bm = nativeImageForCurrentFrame();
     if (!bm)
         return;  // It's too early and we don't have an image yet.
 
-    if (srcRect.isEmpty() || dstRect.isEmpty())
+    FloatRect normDstRect = normalizeRect(dstRect);
+    FloatRect normSrcRect = normalizeRect(srcRect);
+
+    if (normSrcRect.isEmpty() || normDstRect.isEmpty())
         return;  // Nothing to draw.
 
     paintSkBitmap(ctxt->platformContext(),
                   *bm,
-                  enclosingIntRect(srcRect),
-                  enclosingIntRect(dstRect),
+                  enclosingIntRect(normSrcRect),
+                  enclosingIntRect(normDstRect),
                   WebCoreCompositeToSkiaComposite(compositeOp));
 }
 
 void BitmapImageSingleFrameSkia::draw(GraphicsContext* ctxt,
                                       const FloatRect& dstRect,
                                       const FloatRect& srcRect,
                                       CompositeOperator compositeOp)
 {
-    if (srcRect.isEmpty() || dstRect.isEmpty())
+    FloatRect normDstRect = normalizeRect(dstRect);
+    FloatRect normSrcRect = normalizeRect(srcRect);
+
+    if (normSrcRect.isEmpty() || normDstRect.isEmpty())
         return;  // Nothing to draw.
 
     paintSkBitmap(ctxt->platformContext(),
                   m_nativeImage,
-                  enclosingIntRect(srcRect),
-                  enclosingIntRect(dstRect),
+                  enclosingIntRect(normSrcRect),
+                  enclosingIntRect(normDstRect),
                   WebCoreCompositeToSkiaComposite(compositeOp));
 }
 
 PassRefPtr<BitmapImageSingleFrameSkia> BitmapImageSingleFrameSkia::create(
     const SkBitmap& bitmap)
 {
     RefPtr<BitmapImageSingleFrameSkia> image(new BitmapImageSingleFrameSkia());
     if (!bitmap.copyTo(&image->m_nativeImage, bitmap.config()))
         return 0;
     return image.release();
 }
 
 }  // namespace WebCore