1 files changed, 21 insertions, 1 deletions
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index a14cbef..6b5a3a3 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -66,6 +66,9 @@ static const int DefaultHeight = 150;
 // in exchange for a smaller maximum canvas size.
 static const float MaxCanvasArea = 32768 * 8192; // Maximum canvas area in CSS pixels
 
+//In Skia, we will also limit width/height to 32767.
+static const float MaxSkiaDim = 32767.0F; // Maximum width/height in CSS pixels.
+
 HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , m_observer(0)
@@ -275,7 +278,7 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
     if (hasCreatedImageBuffer()) {
         ImageBuffer* imageBuffer = buffer();
         if (imageBuffer) {
-            Image* image = imageBuffer->image();
+            Image* image = imageBuffer->imageForRendering();
             if (image)
                 context->drawImage(image, DeviceColorSpace, r);
         }
@@ -294,6 +297,16 @@ bool HTMLCanvasElement::is3D() const
 }
 #endif
 
+void HTMLCanvasElement::makeRenderingResultsAvailable()
+{
+#if ENABLE(3D_CANVAS)
+    if (is3D()) {
+        WebGLRenderingContext* context3d = reinterpret_cast<WebGLRenderingContext*>(renderingContext());
+        context3d->paintRenderingResultsToCanvas();
+    }
+#endif
+}
+
 void HTMLCanvasElement::recalcStyle(StyleChange change)
 {
     HTMLElement::recalcStyle(change);
@@ -324,6 +337,8 @@ String HTMLCanvasElement::toDataURL(const String& mimeType, const double* qualit
 
     String lowercaseMimeType = mimeType.lower();
 
+    makeRenderingResultsAvailable();
+
     // FIXME: Make isSupportedImageMIMETypeForEncoding threadsafe (to allow this method to be used on a worker thread).
     if (mimeType.isNull() || !MIMETypeRegistry::isSupportedImageMIMETypeForEncoding(lowercaseMimeType))
         return buffer()->toDataURL("image/png");
@@ -344,6 +359,11 @@ IntSize HTMLCanvasElement::convertLogicalToDevice(const FloatSize& logicalSize)
     if (!(wf >= 1 && hf >= 1 && wf * hf <= MaxCanvasArea))
         return IntSize();
 
+#if PLATFORM(SKIA)
+    if (wf > MaxSkiaDim || hf > MaxSkiaDim)
+        return IntSize();
+#endif
+
     return IntSize(static_cast<unsigned>(wf), static_cast<unsigned>(hf));
 }