Allow eviction of ImageBitmaps that are created from ImageElements.

Source/core/html/canvas/CanvasRenderingContext2D.cpp

 /*
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  * Copyright (C) 2013 Adobe Systems Incorporated. All rights reserved.
  *
@@ skipping 1235 matching lines @@
     drawImage(bitmap, x, y, bitmap->width(), bitmap->height(), ec);
 }
 
 void CanvasRenderingContext2D::drawImage(ImageBitmap* bitmap,
     float x, float y, float width, float height, ExceptionCode& ec)
 {
     if (!bitmap) {
         ec = TypeMismatchError;
         return;
     }
-    if (!bitmap->bitmapWidth() || !bitmap->bitmapHeight())
+    if (!bitmap->bitmapRect().width() || !bitmap->bitmapRect().height())
         return;
 
-    drawImage(bitmap, 0, 0, bitmap->bitmapWidth(), bitmap->bitmapHeight(), x, y, width, height, ec);
+    drawImage(bitmap, 0, 0, bitmap->width(), bitmap->height(), x, y, width, height, ec);
 }
 
 void CanvasRenderingContext2D::drawImage(ImageBitmap* bitmap,
     float sx, float sy, float sw, float sh,
     float dx, float dy, float dw, float dh, ExceptionCode& ec)
 {
     if (!bitmap) {
         ec = TypeMismatchError;
         return;
     }
 
     FloatRect srcRect(sx, sy, sw, sh);
     FloatRect dstRect(dx, dy, dw, dh);
+    FloatRect bitmapRect = bitmap->bitmapRect();
 
     if (!std::isfinite(dstRect.x()) || !std::isfinite(dstRect.y()) || !std::isfinite(dstRect.width()) || !std::isfinite(dstRect.height())
         || !std::isfinite(srcRect.x()) || !std::isfinite(srcRect.y()) || !std::isfinite(srcRect.width()) || !std::isfinite(srcRect.height()))
         return;
 
     if (!dstRect.width() || !dstRect.height())
         return;
 
     ASSERT(bitmap->height() && bitmap->width());
-
     FloatRect normalizedSrcRect = normalizeRect(srcRect);
     FloatRect normalizedDstRect = normalizeRect(dstRect);
-    FloatRect actualDstRect(FloatPoint(bitmap->bitmapOffset()), bitmap->bitmapSize());
-    actualDstRect.scale(normalizedDstRect.width() / bitmap->width(), normalizedDstRect.height() / bitmap->height());
+    // We clip our rects to where the user thinks that the image is situated
+    clipRectsToImageRect(IntRect(IntPoint(), bitmap->size()), &normalizedSrcRect, &normalizedDstRect);
+
+    FloatRect intersectRect = intersection(bitmapRect, normalizedSrcRect);
+    FloatRect actualSrcRect(intersectRect);
+    actualSrcRect.move(-bitmapRect.x(), -bitmapRect.y());
+
+    FloatRect imageRect = FloatRect(FloatPoint(), bitmapRect.size());
+
+    FloatRect actualDstRect(FloatPoint(intersectRect.location() - normalizedSrcRect.location()), bitmapRect.size());
+    actualDstRect.scale(normalizedDstRect.width() / normalizedSrcRect.width() * intersectRect.width() / bitmapRect.width(),
+        normalizedDstRect.height() / normalizedSrcRect.height() * intersectRect.height() / bitmapRect.height());

[Stephen White, 2013/07/25 18:01:07]

Should we be checking for zero in normalizedSrcRect.width() and
normalizedSrcRect.height()? Could be a div-by-zero here.

     actualDstRect.moveBy(normalizedDstRect.location());
 
-    FloatRect imageRect = FloatRect(FloatPoint(), bitmap->bitmapSize());
     if (!srcRect.width() || !srcRect.height()) {
         ec = IndexSizeError;
         return;
     }
-    if (!imageRect.intersects(normalizedSrcRect))
+    if (!imageRect.intersects(actualSrcRect))
         return;
 
-    clipRectsToImageRect(imageRect, &normalizedSrcRect, &actualDstRect);
+    RefPtr<Image> imageForRendering = bitmap->bitmapImage();
 
-    Image* imageForRendering = bitmap->bitmapImage();
-
-    drawImageInternal(imageForRendering, normalizedSrcRect, actualDstRect, state().m_globalComposite, state().m_globalBlend);
+    drawImageInternal(imageForRendering.get(), actualSrcRect, actualDstRect, state().m_globalComposite, state().m_globalBlend);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y, ExceptionCode& ec)
 {
     if (!image) {
         ec = TypeMismatchError;
         return;
     }
     LayoutSize s = size(image);
     drawImage(image, x, y, s.width(), s.height(), ec);
@@ skipping 1019 matching lines @@
 }
 
 PassRefPtr<Canvas2DContextAttributes> CanvasRenderingContext2D::getContextAttributes() const
 {
     RefPtr<Canvas2DContextAttributes> attributes = Canvas2DContextAttributes::create();
     attributes->setAlpha(m_hasAlpha);
     return attributes.release();
 }
 
 } // namespace WebCore