Allow eviction of ImageBitmaps that are created from ImageElements.

Source/core/html/canvas/CanvasRenderingContext2D.cpp

Index: Source/core/html/canvas/CanvasRenderingContext2D.cpp
diff --git a/Source/core/html/canvas/CanvasRenderingContext2D.cpp b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
index 16248369b57dc383f2cd44936d60dd3f857e28a3..ffbb7e1eabe4046111953055cb5dca38a2c0f83f 100644
--- a/Source/core/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/core/html/canvas/CanvasRenderingContext2D.cpp
@@ -1253,10 +1253,10 @@ void CanvasRenderingContext2D::drawImage(ImageBitmap* bitmap,
         ec = TypeMismatchError;
         return;
     }
-    if (!bitmap->bitmapWidth() || !bitmap->bitmapHeight())
+    if (!bitmap->bitmapRect().width() || !bitmap->bitmapRect().height())
         return;
 
-    drawImage(bitmap, 0, 0, bitmap->bitmapWidth(), bitmap->bitmapHeight(), x, y, width, height, ec);
+    drawImage(bitmap, 0, 0, bitmap->width(), bitmap->height(), x, y, width, height, ec);
 }
 
 void CanvasRenderingContext2D::drawImage(ImageBitmap* bitmap,
@@ -1270,6 +1270,7 @@ void CanvasRenderingContext2D::drawImage(ImageBitmap* bitmap,
 
     FloatRect srcRect(sx, sy, sw, sh);
     FloatRect dstRect(dx, dy, dw, dh);
+    FloatRect bitmapRect = bitmap->bitmapRect();
 
     if (!std::isfinite(dstRect.x()) || !std::isfinite(dstRect.y()) || !std::isfinite(dstRect.width()) || !std::isfinite(dstRect.height())
         || !std::isfinite(srcRect.x()) || !std::isfinite(srcRect.y()) || !std::isfinite(srcRect.width()) || !std::isfinite(srcRect.height()))
@@ -1279,26 +1280,32 @@ void CanvasRenderingContext2D::drawImage(ImageBitmap* bitmap,
         return;
 
     ASSERT(bitmap->height() && bitmap->width());
-
     FloatRect normalizedSrcRect = normalizeRect(srcRect);
     FloatRect normalizedDstRect = normalizeRect(dstRect);
-    FloatRect actualDstRect(FloatPoint(bitmap->bitmapOffset()), bitmap->bitmapSize());
-    actualDstRect.scale(normalizedDstRect.width() / bitmap->width(), normalizedDstRect.height() / bitmap->height());
+    // We clip our rects to where the user thinks that the image is situated
+    clipRectsToImageRect(IntRect(IntPoint(), bitmap->size()), &normalizedSrcRect, &normalizedDstRect);
+
+    FloatRect intersectRect = intersection(bitmapRect, normalizedSrcRect);
+    FloatRect actualSrcRect(intersectRect);
+    actualSrcRect.move(-bitmapRect.x(), -bitmapRect.y());
+
+    FloatRect imageRect = FloatRect(FloatPoint(), bitmapRect.size());
+
+    FloatRect actualDstRect(FloatPoint(intersectRect.location() - normalizedSrcRect.location()), bitmapRect.size());
+    actualDstRect.scale(normalizedDstRect.width() / normalizedSrcRect.width() * intersectRect.width() / bitmapRect.width(),
+        normalizedDstRect.height() / normalizedSrcRect.height() * intersectRect.height() / bitmapRect.height());

[Stephen White, 2013/07/25 18:01:07]

Should we be checking for zero in normalizedSrcRect.width() and
normalizedSrcRect.height()? Could be a div-by-zero here.

     actualDstRect.moveBy(normalizedDstRect.location());
 
-    FloatRect imageRect = FloatRect(FloatPoint(), bitmap->bitmapSize());
     if (!srcRect.width() || !srcRect.height()) {
         ec = IndexSizeError;
         return;
     }
-    if (!imageRect.intersects(normalizedSrcRect))
+    if (!imageRect.intersects(actualSrcRect))
         return;
 
-    clipRectsToImageRect(imageRect, &normalizedSrcRect, &actualDstRect);
-
-    Image* imageForRendering = bitmap->bitmapImage();
+    RefPtr<Image> imageForRendering = bitmap->bitmapImage();
 
-    drawImageInternal(imageForRendering, normalizedSrcRect, actualDstRect, state().m_globalComposite, state().m_globalBlend);
+    drawImageInternal(imageForRendering.get(), actualSrcRect, actualDstRect, state().m_globalComposite, state().m_globalBlend);
 }
 
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y, ExceptionCode& ec)