Merge r249937 - [Cairo] Image::drawTiled → Cairo::drawSurface → cairo…

…_paint_with_alpha → segfault happens in pixman

https://bugs.webkit.org/show_bug.cgi?id=201755

Reviewed by Don Olmstead.

Segmentation faults happened in pixman while painting a image. In
Cairo::drawSurface, originalSrcRect can be slightly larger than
the surface size because of floating number calculations.
Cairo::drawSurface created a subsurface which is running over the
parent surface boundaries.

* platform/graphics/cairo/CairoOperations.cpp:
(WebCore::Cairo::drawSurface): Calculated a intersection with
expandedSrcRect and the parent surface size for subsurface size.

Source/WebCore/ChangeLog

@@ -1,3 +1,20 @@
+2019-09-16  Fujii Hironori  <Hironori.Fujii@sony.com>
+
+        [Cairo] Image::drawTiled → Cairo::drawSurface → cairo_paint_with_alpha → segfault happens in pixman
+        https://bugs.webkit.org/show_bug.cgi?id=201755
+
+        Reviewed by Don Olmstead.
+
+        Segmentation faults happened in pixman while painting a image. In
+        Cairo::drawSurface, originalSrcRect can be slightly larger than
+        the surface size because of floating number calculations.
+        Cairo::drawSurface created a subsurface which is running over the
+        parent surface boundaries.
+
+        * platform/graphics/cairo/CairoOperations.cpp:
+        (WebCore::Cairo::drawSurface): Calculated a intersection with
+        expandedSrcRect and the parent surface size for subsurface size.
+
 2019-09-11  Charlie Turner  <cturner@igalia.com>
 
         [GStreamer] Do not adopt floating references.

Source/WebCore/platform/graphics/cairo/CairoOperations.cpp

@@ -933,6 +933,7 @@ void drawSurface(PlatformContextCairo& platformContext, cairo_surface_t* surface
     if (srcRect.x() || srcRect.y() || srcRect.size() != cairoSurfaceSize(surface)) {
         // Cairo subsurfaces don't support floating point boundaries well, so we expand the rectangle.
         IntRect expandedSrcRect(enclosingIntRect(srcRect));
+        expandedSrcRect.intersect({ { }, cairoSurfaceSize(surface) });
 
         // We use a subsurface here so that we don't end up sampling outside the originalSrcRect rectangle.
         // See https://bugs.webkit.org/show_bug.cgi?id=58309