2010-12-28 Adrienne Walker <enne@google.com>
authorenne@google.com <enne@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 28 Dec 2010 21:53:52 +0000 (21:53 +0000)
committerenne@google.com <enne@google.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 28 Dec 2010 21:53:52 +0000 (21:53 +0000)
commit421e57ee6a6b73c0cad3dea340448096dbaf132c
treedb6d35fa8f07abd0f0d01a7e01745bc66776cc28
parent42d8f4a3feefa20bd508de7e8fe3e66ceafdcce9
2010-12-28  Adrienne Walker  <enne@google.com>

        Reviewed by Kenneth Russell.

        [chromium] Fix tiled compositor assertion after GPU process recovery.
        https://bugs.webkit.org/show_bug.cgi?id=51682

        After the GPU process recovers, the layer size is set to IntSize(),
        but IntRect::unite() has a special case for empty rects.  This
        behavior was causing the layer size to be too small, causing an
        out-of-bounds array access elsewhere.

        No new tests.

        * platform/graphics/chromium/LayerTilerChromium.cpp:
        (WebCore::LayerTilerChromium::growLayerToContain):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@74722 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebCore/ChangeLog
WebCore/platform/graphics/chromium/LayerTilerChromium.cpp