fix(imaging): Keep a brush off the source it left - #26370

GitHub Issue: closes #26368

PR Type:

🐞 Bugfix

What changed? 🚀

When its ImageSource changed, an ImageBrush subscribed to the new source before it disposed its subscription to the old one (#26368), since 0015c9b (5.0); before that, it disposed it first. A new source that has its image already, or opens synchronously (a WriteableBitmap), delivers it while the brush subscribes, and the brush raises ImageOpened then. If that handler, or other app code run meanwhile, made the old source open again synchronously (for example oldWriteableBitmap.Invalidate()), the old subscription was still active: the brush took the old image and drew it for the new source.

• Old source: the brush now disposes its subscription before it subscribes to the new source, as Image does (ReleaseSubscription) and as WinUI does: CImageBrush::SetValue calls RemoveCallback on the old source before it sets the new one (imagebrush.cpp).
• Replaced source: a subscription can't always be disposed before app code runs. When the brush's ImageOpened handler, raised while it subscribes, switches it to a third source, the subscription to the replaced source is only disposed once that first subscribe returns, and a synchronous open of the replaced source in between reached the brush too. Each subscription's callback now carries the version of the brush's source it was made for (the _subscriptionVersion the brush already keeps for that case), and the brush ignores deliveries for a version it has left.

Once disposed, a subscription is never notified: a source's asynchronous open, including a completed bitmap-cache entry, whose delivery is queued on the dispatcher, skips disposed subscriptions. So the bug needs app code that reopens a source synchronously while the brush switches. A brush whose BitmapImage.UriSource changes keeps drawing the previous image until the new one opens; that is unchanged and matches WinUI, which keeps the surface while it switches URIs (CImageSource::ReloadImage).

Image already disposed its old subscription first, and doesn't need the version check: the sources that run app code while an Image subscribes (BitmapImage, SvgImageSource) deliver through the dispatcher, after the Image has disposed the subscription, and the ones that open synchronously (WriteableBitmap, RenderTargetBitmap) raise no events.

Tests

In Given_Image_Release (Skia):

• When_Brush_Open_Handler_Reopens_Previous_Source_Then_Brush_Draws_New_One: a brush switched between two WriteableBitmaps, whose ImageOpened handler invalidates the one it left, draws the new one.
• When_Brush_Open_Handler_Switches_Source_Then_Reopened_Replaced_Source_Not_Drawn: a brush whose ImageOpened handler switches it to a third WriteableBitmap and then invalidates the one it replaced draws the third one.

Both fail without the change. With only the old subscription disposed first, the second test still fails. The version check alone would also make the first test pass, since it ignores the old source's delivery; disposing first keeps the old source from notifying the brush at all, as on WinUI.

Runs (Skia desktop): Given_ImageBrush, Given_Image_Release, Given_Image, Given_WriteableBitmap, Given_BitmapSource and Given_RelativeTransform: 128 passed, 5 skipped and 1 failed. The failure, When_WriteableBitmap_Assigned_With_Data_Present, also fails with master's code on this machine, which runs at 125% display scaling (see #25633).

Runs (Skia WebAssembly): Given_Image_Release and Given_ImageBrush: 45 passed (the two new tests among them) and 26 desktop-only tests skipped.

PR Checklist ✅

• 🧪 Added Runtime tests, UI tests, or a manual test sample (for bug fixes / features, if applicable)
• 📚 Docs have been added/updated following the documentation template (for bug fixes / features)
• 🖼️ Validated PR Screenshots Compare Test Run results.
• ❗ Contains NO breaking changes
• 👀 Reviewed 2 other open pull requests (optional but appreciated!)