756555 - Coalescing upload region can cause us to try to upload outside the valid region

Status: RESOLVED FIXED

(Core :: Graphics: Layers, defect)

Description

[Benoit Girard (:BenWa)]

Coalescing upload region can cause us to try to upload outside the valid region. This happens when we get two paints from a layer at different offset back-to-back before we process the upload. We have to be careful that we only try to upload the region that is valid when coalescing these regions.

Comment 1

[Kartikaya Gupta (email:[e-mail])]

Attachment: Patch

Since BenWa pretty much wrote this patch, asking ali for a review

Comment 2

[Ali Juma [:ajuma]]

Comment on attachment 625196 [details] [diff] [review]
Patch

Review of attachment 625196 [details] [diff] [review]:
-----------------------------------------------------------------

::: gfx/layers/opengl/TiledThebesLayerOGL.cpp
@@ +167,5 @@
>    }
>  
> +  // If we coalesce uploads while the layers' valid region is changing we will
> +  // end up trying to upload area outside of the valid region. (bug 756555)
> +  mRegionToUpload = mRegionToUpload.And(mRegionToUpload, mMainMemoryTiledBuffer.GetValidRegion());

The assignment is just self-assignment here, so it isn't needed.

Comment 3

[Benoit Girard (:BenWa)]

Kats, the reason these API return 'this' is to allow chaining X.And(...).Or(...).

Comment 4

[Kartikaya Gupta (email:[e-mail])]

Landed on inbound with the assignment part removed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ab3f805f3210

(In reply to Benoit Girard (:BenWa) from comment #3)
> Kats, the reason these API return 'this' is to allow chaining
> X.And(...).Or(...).

That makes sense, but I still don't think it makes sense to be passing in the object itself as the first parameter. That's just confusing :)

Comment 5

[Kartikaya Gupta (email:[e-mail])]

Also noming for fennec blocker; this prevents a crash (I was able to reproduce the crash pretty easily by panning around on http://www.bbc.co.uk/persian/mobile/index.shtml with the patches from bug 748384 applied on the SGS 2).

Comment 6

[Benoit Girard (:BenWa)]

(In reply to Kartikaya Gupta (:kats) from comment #4)
Agreed :)

Comment 7

[Matt Brubeck (:mbrubeck)]

https://hg.mozilla.org/mozilla-central/rev/ab3f805f3210

Comment 8

[Kartikaya Gupta (email:[e-mail])]

Comment on attachment 625196 [details] [diff] [review]
Patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 739679
User impact if declined: possible crash in some cases
Testing completed (on m-c, etc.): on m-c
Risk to taking this patch (and alternatives if risky): low-risk 
String or UUID changes made by this patch: none

Comment 9

[Kartikaya Gupta (email:[e-mail])]

https://hg.mozilla.org/releases/mozilla-aurora/rev/a5ef446a214c