Attachment 93821 Details for Bug 74733 – Possible fix for the crash

[patch] Possible fix for the crash

fix_put_image_crash_in_google_firefox.diff (text/plain), 2.86 KB, created by Anthony Waters on 2014-02-11 02:37:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Anthony Waters

Created: 2014-02-11 02:37:07 UTC

Size: 2.86 KB

patch

obsolete

>diff --git a/src/glamor_pixmap.c b/src/glamor_pixmap.c
>index 9f2ecbb..9830856 100644
>--- a/src/glamor_pixmap.c
>+++ b/src/glamor_pixmap.c
>@@ -648,27 +648,6 @@ glamor_pixmap_upload_prepare(PixmapPtr pixmap, GLenum format, int no_alpha, int
> }
> 
> /*
>- * upload sub region to a large region.
>- * */
>-static void
>-glamor_put_bits(char *dst_bits, int dst_stride, char *src_bits,
>-		int src_stride, int bpp,
>-		int x, int y, int w, int h)
>-{
>-	int j;
>-	int byte_per_pixel;
>-
>-	byte_per_pixel = bpp / 8;
>-	src_bits += y * src_stride + (x * byte_per_pixel);
>-
>-	for(j = y; j < y + h; j++)
>-	{
>-		memcpy(dst_bits, src_bits, w * byte_per_pixel);
>-		src_bits += src_stride;
>-		dst_bits += dst_stride;
>-	}
>-}
>-/*
>  * download sub region from a large region.
>  */
> static void
>@@ -722,12 +701,8 @@ glamor_upload_sub_pixmap_to_texture(PixmapPtr pixmap, int x, int y, int w, int h
> 		BoxRec box;
> 		int n_region;
> 		glamor_pixmap_clipped_regions *clipped_regions;
>-		void *sub_bits;
> 		int i,j;
> 
>-		sub_bits = malloc(h * stride);
>-		if (sub_bits == NULL)
>-			return FALSE;
> 		box.x1 = x;
> 		box.y1 = y;
> 		box.x2 = x + w;
>@@ -744,7 +719,6 @@ glamor_upload_sub_pixmap_to_texture(PixmapPtr pixmap, int x, int y, int w, int h
> 		{
> 			BoxPtr boxes;
> 			int nbox;
>-			int temp_stride;
> 			void *temp_bits;
> 
> 			assert(pbo == 0);
>@@ -756,37 +730,24 @@ glamor_upload_sub_pixmap_to_texture(PixmapPtr pixmap, int x, int y, int w, int h
> 			DEBUGF("split to %d boxes\n", nbox);
> 			for(j = 0; j < nbox; j++)
> 			{
>-				temp_stride = PixmapBytePad(boxes[j].x2 - boxes[j].x1,
>-							    pixmap->drawable.depth);
>-
>-				if (boxes[j].x1 == x && temp_stride == stride) {
>-					temp_bits = (char*)bits + (boxes[j].y1 - y) * stride;
>-				} else {
>-					temp_bits = sub_bits;
>-					glamor_put_bits(temp_bits, temp_stride, bits, stride,
>-							pixmap->drawable.bitsPerPixel,
>-							boxes[j].x1 - x, boxes[j].y1 - y,
>-							boxes[j].x2 - boxes[j].x1,
>-							boxes[j].y2 - boxes[j].y1);
>-				}
>-				DEBUGF("upload x %d y %d w %d h %d temp stride %d \n",
>+				temp_bits = (char *)bits + (boxes[i].y1 - y) * stride +
>+										 (boxes[i].x1 - x) * (pixmap->drawable.bitsPerPixel / 8);
>+				DEBUGF("upload x %d y %d w %d h %d stride %d \n",
> 					boxes[j].x1 - x, boxes[j].y1 - y,
> 					boxes[j].x2 - boxes[j].x1,
>-					boxes[j].y2 - boxes[j].y1, temp_stride);
>+					boxes[j].y2 - boxes[j].y1, stride);
> 				if (_glamor_upload_bits_to_pixmap_texture(pixmap, format, type, no_alpha,
> 									  revert, swap_rb, boxes[j].x1, boxes[j].y1,
> 									  boxes[j].x2 - boxes[j].x1,
> 									  boxes[j].y2 - boxes[j].y1,
>-									  temp_stride, temp_bits, pbo) == FALSE) {
>+									  stride, temp_bits, pbo) == FALSE) {
> 					RegionUninit(&region);
>-					free(sub_bits);
> 					assert(0);
> 					return FALSE;
> 				}
> 			}
> 			RegionDestroy(clipped_regions[i].region);
> 		}
>-		free(sub_bits);
> 		free(clipped_regions);
> 		RegionUninit(&region);
> 		return TRUE;

Actions: View | Splinter Review

Attachments on bug 74733: 93689 | 93821

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.