From 0494c4820e8244fb456a2e5fe4c17094080148b1 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Mon, 22 Feb 2016 13:38:58 +1100
Subject: [PATCH] Bug 1249550 (part 1) - Flip BMPs with negative height when
 downscaling. r=tn.

---
 image/decoders/nsBMPDecoder.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/image/decoders/nsBMPDecoder.cpp b/image/decoders/nsBMPDecoder.cpp
index 51c675a6bee..172445cb9b2 100644
--- a/image/decoders/nsBMPDecoder.cpp
+++ b/image/decoders/nsBMPDecoder.cpp
@@ -682,10 +682,11 @@ nsBMPDecoder::ReadBitfields(const char* aData, size_t aLength)
 
   if (mDownscaler) {
     // BMPs store their rows in reverse order, so the downscaler needs to
-    // reverse them again when writing its output.
+    // reverse them again when writing its output. Unless the height is
+    // negative!
     rv = mDownscaler->BeginFrame(GetSize(), Nothing(),
                                  mImageData, mMayHaveTransparency,
-                                 /* aFlipVertically = */ true);
+                                 /* aFlipVertically = */ mH.mHeight >= 0);
     if (NS_FAILED(rv)) {
       return Transition::TerminateFailure();
     }