Title: [159098] trunk/Source/WebKit2
- Revision
- 159098
- Author
- [email protected]
- Date
- 2013-11-11 23:56:45 -0800 (Mon, 11 Nov 2013)
Log Message
Remote Layer Tree: Sporadic memory corruption during painting
https://bugs.webkit.org/show_bug.cgi?id=124191
Reviewed by Brady Eidson.
Fix a logic error (flipped the logic, didn't flip the operator)
made in the last version of r158982 that caused some crashes because
it allowed us to overrun the end of cgPaintingRects.
* Shared/mac/RemoteLayerBackingStore.mm:
(RemoteLayerBackingStore::drawInContext):
Modified Paths
Diff
Modified: trunk/Source/WebKit2/ChangeLog (159097 => 159098)
--- trunk/Source/WebKit2/ChangeLog 2013-11-12 07:56:39 UTC (rev 159097)
+++ trunk/Source/WebKit2/ChangeLog 2013-11-12 07:56:45 UTC (rev 159098)
@@ -1,3 +1,17 @@
+2013-11-11 Tim Horton <[email protected]>
+
+ Remote Layer Tree: Sporadic memory corruption during painting
+ https://bugs.webkit.org/show_bug.cgi?id=124191
+
+ Reviewed by Brady Eidson.
+
+ Fix a logic error (flipped the logic, didn't flip the operator)
+ made in the last version of r158982 that caused some crashes because
+ it allowed us to overrun the end of cgPaintingRects.
+
+ * Shared/mac/RemoteLayerBackingStore.mm:
+ (RemoteLayerBackingStore::drawInContext):
+
2013-11-11 Commit Queue <[email protected]>
Unreviewed, rolling out r159088.
Modified: trunk/Source/WebKit2/Shared/mac/RemoteLayerBackingStore.mm (159097 => 159098)
--- trunk/Source/WebKit2/Shared/mac/RemoteLayerBackingStore.mm 2013-11-12 07:56:39 UTC (rev 159097)
+++ trunk/Source/WebKit2/Shared/mac/RemoteLayerBackingStore.mm 2013-11-12 07:56:45 UTC (rev 159098)
@@ -243,7 +243,7 @@
// Otherwise, repaint the entire bounding box of the dirty region.
IntRect dirtyBounds = m_dirtyRegion.bounds();
Vector<IntRect> dirtyRects = m_dirtyRegion.rects();
- if (dirtyRects.size() > webLayerMaxRectsToPaint && m_dirtyRegion.totalArea() > webLayerWastedSpaceThreshold * dirtyBounds.width() * dirtyBounds.height()) {
+ if (dirtyRects.size() > webLayerMaxRectsToPaint || m_dirtyRegion.totalArea() > webLayerWastedSpaceThreshold * dirtyBounds.width() * dirtyBounds.height()) {
dirtyRects.clear();
dirtyRects.append(dirtyBounds);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
