Bug 1064864. Ensure the copying bounds are sane. r=jrmuizel a=sylvestre
authorBas Schouten <bschouten@mozilla.com>
Sat, 01 Nov 2014 14:02:20 -0400
changeset 225898 d4ad7d727dd6
parent 225897 8b1b897ca39c
child 225899 d9b49c7ee7fe
push id4062
push userrjesup@wgate.com
push date2014-11-02 21:47 +0000
treeherdermozilla-beta@d4ad7d727dd6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjrmuizel, sylvestre
bugs1064864
milestone34.0
Bug 1064864. Ensure the copying bounds are sane. r=jrmuizel a=sylvestre This prevents things from going really bad on some drivers.
gfx/layers/d3d11/CompositorD3D11.cpp
--- a/gfx/layers/d3d11/CompositorD3D11.cpp
+++ b/gfx/layers/d3d11/CompositorD3D11.cpp
@@ -451,17 +451,21 @@ CompositorD3D11::CreateRenderTargetFromS
     srcBox.front = 0;
     srcBox.right = aSourcePoint.x + aRect.width;
     srcBox.bottom = aSourcePoint.y + aRect.height;
     srcBox.back = 1;
 
     const IntSize& srcSize = sourceD3D11->GetSize();
     MOZ_ASSERT(srcSize.width >= 0 && srcSize.height >= 0,
                "render targets should have nonnegative sizes");
-    if (srcBox.right <= static_cast<uint32_t>(srcSize.width) &&
+    if (srcBox.left >= 0 &&
+        srcBox.top >= 0 &&
+        srcBox.left < srcBox.right &&
+        srcBox.top < srcBox.bottom &&
+        srcBox.right <= static_cast<uint32_t>(srcSize.width) &&
         srcBox.bottom <= static_cast<uint32_t>(srcSize.height)) {
       mContext->CopySubresourceRegion(texture, 0,
                                       0, 0, 0,
                                       sourceD3D11->GetD3D11Texture(), 0,
                                       &srcBox);
     } else {
       NS_WARNING("Could not copy render target - source rect out of bounds");
     }