There's still two int declarations (oldwidth, oldheight) in RenderImage::imageDimensionsChanged - these should be LayoutUnit's in my understanding. Patch follows.
Created attachment 150127 [details] Fixing declarations.
The intrinsic size for a replaced element is always in full pixels so in most cases this doesn't matter. You are right though that it should be using LayoutUnits. Thanks!
Comment on attachment 150127 [details] Fixing declarations. LGTM. I don't see any way to trigger this bug. Unless intrinsic size is somehow scaled (which I doubt).
Comment on attachment 150127 [details] Fixing declarations. Sorry, misclick.
Comment on attachment 150127 [details] Fixing declarations. Clearing flags on attachment: 150127 Committed r121795: <http://trac.webkit.org/changeset/121795>
All reviewed patches have been landed. Closing bug.