michael@0: # HG changeset patch
michael@0: # User Milan Sreckovic <msreckovic@mozilla.com>
michael@0: # Date 1362078121 18000
michael@0: # Node ID e9e6d97b153d8ec17ee03bb1deef1dec24c7a17c
michael@0: # Parent  c65d59d33aa86b7e75bc420ea3beda6201e0aceb
michael@0: Bug 825721: clamp negative box starts and disallow negative sizes. r=jmuizelaar
michael@0: 
michael@0: diff --git a/gfx/cairo/cairo/src/cairo-image-surface.c b/gfx/cairo/cairo/src/cairo-image-surface.c
michael@0: --- a/gfx/cairo/cairo/src/cairo-image-surface.c
michael@0: +++ b/gfx/cairo/cairo/src/cairo-image-surface.c
michael@0: @@ -1846,16 +1846,20 @@ static cairo_status_t
michael@0:      if (likely (status == CAIRO_STATUS_SUCCESS)) {
michael@0:  	for (chunk = &clear.chunks; chunk != NULL; chunk = chunk->next) {
michael@0:  	    for (i = 0; i < chunk->count; i++) {
michael@0:  		int x1 = _cairo_fixed_integer_part (chunk->base[i].p1.x);
michael@0:  		int y1 = _cairo_fixed_integer_part (chunk->base[i].p1.y);
michael@0:  		int x2 = _cairo_fixed_integer_part (chunk->base[i].p2.x);
michael@0:  		int y2 = _cairo_fixed_integer_part (chunk->base[i].p2.y);
michael@0:  
michael@0: +		x1 = (x1 < 0 ? 0 : x1);
michael@0: +		y1 = (y1 < 0 ? 0 : y1);
michael@0: +		if (x2 <= x1 || y2 <= y1)
michael@0: +		    continue;
michael@0:  		pixman_fill ((uint32_t *) dst->data, dst->stride / sizeof (uint32_t),
michael@0:  			     PIXMAN_FORMAT_BPP (dst->pixman_format),
michael@0:  			     x1, y1, x2 - x1, y2 - y1,
michael@0:  			     0);
michael@0:  	    }
michael@0:  	}
michael@0:      }
michael@0:  
michael@0: @@ -2669,16 +2673,18 @@ static cairo_status_t
michael@0:  	const cairo_box_t *box = chunk->base;
michael@0:  
michael@0:  	for (i = 0; i < chunk->count; i++) {
michael@0:  	    int x1 = _cairo_fixed_integer_ceil (box[i].p1.x);
michael@0:  	    int y1 = _cairo_fixed_integer_ceil (box[i].p1.y);
michael@0:  	    int x2 = _cairo_fixed_integer_floor (box[i].p2.x);
michael@0:  	    int y2 = _cairo_fixed_integer_floor (box[i].p2.y);
michael@0:  
michael@0: +	    x1 = (x1 < 0 ? 0 : x1);
michael@0: +	    y1 = (y1 < 0 ? 0 : y1);
michael@0:  	    if (x2 > x1 && y2 > y1) {
michael@0:  		cairo_box_t b;
michael@0:  
michael@0:  		pixman_fill ((uint32_t *) dst->data,
michael@0:  			     dst->stride / sizeof (uint32_t),
michael@0:  			     PIXMAN_FORMAT_BPP (dst->pixman_format),
michael@0:  			     x1, y1, x2 - x1, y2 - y1,
michael@0:  			     pixel);
michael@0: @@ -2929,17 +2935,19 @@ static cairo_status_t
michael@0:  	    cairo_box_t *box = chunk->base;
michael@0:  
michael@0:  	    for (i = 0; i < chunk->count; i++) {
michael@0:  		int x1 = _cairo_fixed_integer_round_down (box[i].p1.x);
michael@0:  		int y1 = _cairo_fixed_integer_round_down (box[i].p1.y);
michael@0:  		int x2 = _cairo_fixed_integer_round_down (box[i].p2.x);
michael@0:  		int y2 = _cairo_fixed_integer_round_down (box[i].p2.y);
michael@0:  
michael@0: -		if (x2 == x1 || y2 == y1)
michael@0: +		x1 = (x1 < 0 ? 0 : x1);
michael@0: +		y1 = (y1 < 0 ? 0 : y1);
michael@0: +		if (x2 <= x1 || y2 <= y1)
michael@0:  		    continue;
michael@0:  
michael@0:  		pixman_fill ((uint32_t *) dst->data, dst->stride / sizeof (uint32_t),
michael@0:  			     PIXMAN_FORMAT_BPP (dst->pixman_format),
michael@0:  			     x1, y1, x2 - x1, y2 - y1,
michael@0:  			     pixel);
michael@0:  	    }
michael@0:  	}