Changeset 269328 in webkit


Ignore:
Timestamp:
Nov 3, 2020 12:32:45 PM (3 years ago)
Author:
Fujii Hironori
Message:

[TextureMapper] Crashed in TextureMapperLayer::paintUsingOverlapRegions
https://bugs.webkit.org/show_bug.cgi?id=214817
<rdar://problem/66489090>

Reviewed by Don Olmstead.

Source/WebCore:

TextureMapperLayer::paintUsingOverlapRegions has the expression
overlapRegion.bounds().size().area() which crashes for a very
large layer.

computeOverlapRegions returned very large overlap and non-overlap
regions without taking the clip bounds into account.

Change computeOverlapRegions to return clipped regions.
paintUsingOverlapRegions no longer needs to clip the returned
regions.

Test: compositing/tiling/huge-layer-with-opacity.html

  • platform/graphics/texmap/TextureMapperLayer.cpp:

(WebCore::TextureMapperLayer::computeOverlapRegions):
(WebCore::TextureMapperLayer::paintUsingOverlapRegions):

  • platform/graphics/texmap/TextureMapperLayer.h:

LayoutTests:

  • compositing/tiling/huge-layer-with-opacity-expected.html: Added.
  • compositing/tiling/huge-layer-with-opacity.html: Added.
Location:
trunk
Files:
2 added
3 edited

Legend:

Unmodified
Added
Removed
  • trunk/LayoutTests/ChangeLog

    r269320 r269328  
     12020-11-03  Fujii Hironori  <Hironori.Fujii@sony.com>
     2
     3        [TextureMapper] Crashed in TextureMapperLayer::paintUsingOverlapRegions
     4        https://bugs.webkit.org/show_bug.cgi?id=214817
     5        <rdar://problem/66489090>
     6
     7        Reviewed by Don Olmstead.
     8
     9        * compositing/tiling/huge-layer-with-opacity-expected.html: Added.
     10        * compositing/tiling/huge-layer-with-opacity.html: Added.
     11
    1122020-11-03  Yusuke Suzuki  <ysuzuki@apple.com>
    213
  • trunk/Source/WebCore/ChangeLog

    r269325 r269328  
     12020-11-03  Fujii Hironori  <Hironori.Fujii@sony.com>
     2
     3        [TextureMapper] Crashed in TextureMapperLayer::paintUsingOverlapRegions
     4        https://bugs.webkit.org/show_bug.cgi?id=214817
     5        <rdar://problem/66489090>
     6
     7        Reviewed by Don Olmstead.
     8
     9        TextureMapperLayer::paintUsingOverlapRegions has the expression
     10        `overlapRegion.bounds().size().area()` which crashes for a very
     11        large layer.
     12
     13        computeOverlapRegions returned very large overlap and non-overlap
     14        regions without taking the clip bounds into account.
     15
     16        Change computeOverlapRegions to return clipped regions.
     17        paintUsingOverlapRegions no longer needs to clip the returned
     18        regions.
     19
     20        Test: compositing/tiling/huge-layer-with-opacity.html
     21
     22        * platform/graphics/texmap/TextureMapperLayer.cpp:
     23        (WebCore::TextureMapperLayer::computeOverlapRegions):
     24        (WebCore::TextureMapperLayer::paintUsingOverlapRegions):
     25        * platform/graphics/texmap/TextureMapperLayer.h:
     26
    1272020-11-03  Stephan Szabo  <stephan.szabo@sony.com>
    228
  • trunk/Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp

    r269204 r269328  
    331331        return;
    332332
    333     FloatRect boundingRect;
     333    FloatRect localBoundingRect;
    334334    if (m_backingStore || m_state.masksToBounds || m_state.maskLayer || hasFilters())
    335         boundingRect = layerRect();
     335        localBoundingRect = layerRect();
    336336    else if (m_contentsLayer || m_state.solidColor.isVisible())
    337         boundingRect = m_state.contentsRect;
     337        localBoundingRect = m_state.contentsRect;
    338338
    339339    if (m_currentFilters.hasOutsets()) {
    340340        auto outsets = m_currentFilters.outsets();
    341         IntRect unfilteredTargetRect(boundingRect);
    342         boundingRect.move(std::max(0, -outsets.left()), std::max(0, -outsets.top()));
    343         boundingRect.expand(outsets.left() + outsets.right(), outsets.top() + outsets.bottom());
    344         boundingRect.unite(unfilteredTargetRect);
     341        IntRect unfilteredTargetRect(localBoundingRect);
     342        localBoundingRect.move(std::max(0, -outsets.left()), std::max(0, -outsets.top()));
     343        localBoundingRect.expand(outsets.left() + outsets.right(), outsets.top() + outsets.bottom());
     344        localBoundingRect.unite(unfilteredTargetRect);
    345345    }
    346346
     
    352352    if (m_state.replicaLayer) {
    353353        replicaMatrix = replicaTransform();
    354         boundingRect.unite(replicaMatrix.mapRect(boundingRect));
    355     }
    356 
    357     boundingRect = transform.mapRect(boundingRect);
     354        localBoundingRect.unite(replicaMatrix.mapRect(localBoundingRect));
     355    }
     356
     357    IntRect clipBounds(options.textureMapper.clipBounds());
     358    clipBounds.move(-options.offset);
     359
     360    IntRect viewportBoundingRect = enclosingIntRect(transform.mapRect(localBoundingRect));
     361    viewportBoundingRect.intersect(clipBounds);
    358362
    359363    // Count all masks and filters as overlap layers.
    360364    if (hasFilters() || m_state.maskLayer || (m_state.replicaLayer && m_state.replicaLayer->m_state.maskLayer)) {
    361         Region newOverlapRegion(enclosingIntRect(boundingRect));
     365        Region newOverlapRegion(viewportBoundingRect);
    362366        nonOverlapRegion.subtract(newOverlapRegion);
    363367        overlapRegion.unite(newOverlapRegion);
     
    366370
    367371    Region newOverlapRegion;
    368     Region newNonOverlapRegion(enclosingIntRect(boundingRect));
     372    Region newNonOverlapRegion(viewportBoundingRect);
    369373
    370374    if (!m_state.masksToBounds) {
     
    409413
    410414    for (auto& rect : rects) {
    411         if (!rect.intersects(options.textureMapper.clipBounds()))
    412             continue;
    413 
    414415        options.textureMapper.beginClip(TransformationMatrix(), FloatRoundedRect(rect));
    415416        paintSelfAndChildrenWithReplica(options);
     
    425426
    426427    IntSize maxTextureSize = options.textureMapper.maxTextureSize();
    427     IntRect adjustedClipBounds(options.textureMapper.clipBounds());
    428     adjustedClipBounds.move(-options.offset);
    429428    for (auto& rect : rects) {
    430429        for (int x = rect.x(); x < rect.maxX(); x += maxTextureSize.width()) {
     
    432431                IntRect tileRect(IntPoint(x, y), maxTextureSize);
    433432                tileRect.intersect(rect);
    434                 if (!tileRect.intersects(adjustedClipBounds))
    435                     continue;
    436433
    437434                paintWithIntermediateSurface(options, tileRect);
Note: See TracChangeset for help on using the changeset viewer.