Bug 730508. Clip canvas invalidations to the content area of the canvas. r=roc

Previously, operations like drawImage() could invalidate areas outside of the
canvas. This hurt performance of runfield on maple.

content/html/content/src/nsHTMLCanvasElement.cpp

@@ -709,6 +709,8 @@ nsHTMLCanvasElement::InvalidateCanvasContent(const gfxRect* damageRect)
       // then make it a nsRect
       invalRect = nsRect(realRect.X(), realRect.Y(),
                          realRect.Width(), realRect.Height());
+
+      invalRect = invalRect.Intersect(nsRect(nsPoint(0,0), contentArea.Size()));
     }
   } else {
     invalRect = nsRect(nsPoint(0, 0), contentArea.Size());