Bug 463217. Don't let nsLayoutUtils::DrawSingleImage/DrawSingleUnscaledImage do any tiling, restrict their drawing to the single tile. r+sr=dbaron

layout/base/nsLayoutUtils.cpp

@@ -2805,6 +2805,10 @@ nsLayoutUtils::DrawSingleUnscaledImage(nsIRenderingContext* aRenderingContext,
   nsRect dest(aDest - source.TopLeft(),
     nsSize(size.width*appUnitsPerCSSPixel, size.height*appUnitsPerCSSPixel));
   nsRect fill(aDest, source.Size());
+  // Ensure that only a single image tile is drawn. If aSourceArea extends
+  // outside the image bounds, we want to honor the aSourceArea-to-aDest
+  // translation but we don't want to actually tile the image.
+  fill.IntersectRect(fill, dest);
   return DrawImage(aRenderingContext, aImage, dest, fill, aDest, aDirty);
 }
 
@@ -2831,7 +2835,12 @@ nsLayoutUtils::DrawSingleImage(nsIRenderingContext* aRenderingContext,
   }
 
   nsRect dest = GetWholeImageDestination(size, source, aDest);
-  return DrawImage(aRenderingContext, aImage, dest, aDest, aDest.TopLeft(), aDirty);
+  // Ensure that only a single image tile is drawn. If aSourceArea extends
+  // outside the image bounds, we want to honor the aSourceArea-to-aDest
+  // transform but we don't want to actually tile the image.
+  nsRect fill;
+  fill.IntersectRect(aDest, dest);
+  return DrawImage(aRenderingContext, aImage, dest, fill, fill.TopLeft(), aDirty);
 }
 
 /* static */ nsRect

layout/reftests/bugs/463217-1-ref.xul

@@ -0,0 +1,7 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <vbox style="height:204px; border:2px solid blue;" flex="0">
+    <image style="list-style-image: url(mozilla-banner.gif);"/>
+  </vbox>
+  <vbox/>
+</window>

layout/reftests/bugs/463217-1.xul

@@ -0,0 +1,4 @@
+<?xml version="1.0"?>
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul">
+  <image style="border:2px solid blue; list-style-image: url(mozilla-banner.gif); -moz-image-region: rect(0 600px 200px 0);"/>
+</window>

layout/reftests/bugs/reftest.list

@@ -959,3 +959,4 @@ fails-if(MOZ_WIDGET_TOOLKIT=="cocoa") == 456147.xul 456147-ref.html # bug 456147
 == 461266-1.html 461266-1-ref.html
 fails == 461512-1.html 461512-1-ref.html # Bug 461512
 == 463204-1.html 463204-1-ref.html
+== 463217-1.xul 463217-1-ref.xul