Cherry-pick 5870285. rdar://problem/108072383

    [GPU Process] (REGRESSION 262607@main): Copy pixels of CGImage only if it is not a sub-image
    https://bugs.webkit.org/show_bug.cgi?id=255677
    rdar://108072383

    Reviewed by Simon Fraser.

    In ShareableBitmap::createFromImagePixels(), CGImage and its CGDataProvider
    may disagree about how many bytes are in the pixels buffers. CGImage is most
    likely a sub-image of another CGImage which inherits its meta data but not
    the full pixels buffer.

    In this case we should fallback to ShareableBitmap::createFromImageDraw().
    Ortherwise  ShareableBitmapConfiguration will falsely describe the data in the
    SharedMemory.

    * Source/WebKit/Shared/cg/ShareableBitmapCG.cpp:
    (WebKit::ShareableBitmap::createFromImagePixels):

    Canonical link: https://commits.webkit.org/264021@main

Identifier: 263769.31@safari-7616.1.14.10-branch

Source/WebKit/Shared/cg/ShareableBitmapCG.cpp

@@ -26,6 +26,7 @@
 #include "config.h"
 #include "ShareableBitmap.h"
 
+#include "Logging.h"
 #include <WebCore/BitmapImage.h>
 #include <WebCore/GraphicsContextCG.h>
 #include <WebCore/IOSurface.h>
@@ -119,17 +120,29 @@ RefPtr<ShareableBitmap> ShareableBitmap::createFromImagePixels(NativeImage& imag
         return nullptr;
 
     const auto* bytes = reinterpret_cast<const uint8_t*>(CFDataGetBytePtr(pixels.get()));
-    auto sizeInBytes = CFDataGetLength(pixels.get());
-    if (!bytes || !sizeInBytes)
+    CheckedUint32 sizeInBytes = CFDataGetLength(pixels.get());
+    if (!bytes || !sizeInBytes || sizeInBytes.hasOverflowed())
         return nullptr;
 
+    auto configuration = ShareableBitmapConfiguration(image);
+    if (configuration.sizeInBytes() != sizeInBytes) {
+        LOG_WITH_STREAM(Images, stream
+            << "ShareableBitmap::createFromImagePixels() " << image. platformImage().get()
+            << " CGImage size: " << configuration.size()
+            << " CGImage bytesPerRow: " << configuration.bytesPerRow()
+            << " CGImage sizeInBytes: " << configuration.sizeInBytes()
+            << " CGDataProvider sizeInBytes: " << sizeInBytes
+            << " CGImage and its CGDataProvider disagree about how many bytes are in pixels buffer. CGImage is a sub-image; bailing.");
+        return nullptr;
+    }
+
     RefPtr<SharedMemory> sharedMemory = SharedMemory::allocate(sizeInBytes);
     if (!sharedMemory)
         return nullptr;
 
     memcpy(sharedMemory->data(), bytes, sizeInBytes);
 
-    return adoptRef(new ShareableBitmap(ShareableBitmapConfiguration(image), sharedMemory.releaseNonNull()));
+    return adoptRef(new ShareableBitmap(configuration, sharedMemory.releaseNonNull()));
 }
 
 std::unique_ptr<GraphicsContext> ShareableBitmap::createGraphicsContext()