Bug 739604 - Don't leave mCurrentImage in an inconsistent state. r=ajuma
authorChris Lord <chrislord.net@gmail.com>
Wed, 28 Mar 2012 19:10:10 +0100
changeset 90542 35546f02ddb10a4094345a7c624fbc401333defa
parent 90541 7b18a4980189bde77a5c64b8f7e823694adf6f62
child 90543 f4ab0eddbe90b4c588b29ea1f1b39d6b14a47e09
push id22366
push usermak77@bonardo.net
push dateThu, 29 Mar 2012 15:38:30 +0000
treeherdermozilla-central@ff3521bc6559 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersajuma
bugs739604, 732917
milestone14.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 739604 - Don't leave mCurrentImage in an inconsistent state. r=ajuma Setting MOZ_DUMP_PAINT_LIST when using tiled textures was causing crashes, one of which was due to TextureImage function calls happening outside of tile iteration and accessing invalid memory. Fix this crash by reverting NextTile behaviour to never leave mCurrentImage point to an invalid tile, as was the case prior to bug 732917.
gfx/gl/GLContext.cpp
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@@ -926,18 +926,19 @@ TiledTextureImage::DirectUpdate(gfxASurf
         }
 
         result &= mImages[mCurrentImage]->
           DirectUpdate(aSurf, tileRegion, aFrom + nsIntPoint(xPos, yPos));
 
         // Override a callback cancelling iteration if the texture wasn't valid.
         // We need to force the update in that situation, or we may end up
         // showing invalid/out-of-date texture data.
-    } while (NextTile() ||
-             (mTextureState != Valid && mCurrentImage < mImages.Length()));
+        if (mCurrentImage == mImages.Length() - 1)
+            break;
+    } while (NextTile() || (mTextureState != Valid));
     mCurrentImage = oldCurrentImage;
 
     mShaderType = mImages[0]->GetShaderProgramType();
     mTextureState = Valid;
     return result;
 }
 
 void
@@ -1086,18 +1087,21 @@ void TiledTextureImage::BeginTileIterati
 bool TiledTextureImage::NextTile()
 {
     bool continueIteration = true;
 
     if (mIterationCallback)
         continueIteration = mIterationCallback(this, mCurrentImage,
                                                mIterationCallbackData);
 
-    mCurrentImage++;
-    return continueIteration && (mCurrentImage < mImages.Length());
+    if (mCurrentImage + 1 < mImages.Length()) {
+        mCurrentImage++;
+        return continueIteration;
+    }
+    return false;
 }
 
 void TiledTextureImage::SetIterationCallback(TileIterationCallback aCallback,
                                              void* aCallbackData)
 {
     mIterationCallback = aCallback;
     mIterationCallbackData = aCallbackData;
 }
@@ -1212,16 +1216,17 @@ void TiledTextureImage::Resize(const nsI
     for (; i < length; i++)
       mImages.RemoveElementAt(mImages.Length()-1);
 
     // Reset tile-store properties.
     mRows = rows;
     mColumns = columns;
     mSize = aSize;
     mTextureState = Allocated;
+    mCurrentImage = 0;
 }
 
 PRUint32 TiledTextureImage::GetTileCount()
 {
     return mImages.Length();
 }
 
 bool