From: Chris Wilson <chris@chris-wilson.co.uk>
Date: Mon, 20 Jul 2009 13:07:18 +0000 (+0100)
Subject: Fix read of BITS members from a solid image.
X-Git-Tag: pixman-0.15.18~5
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=0b95afd259bb839a026955e7fda15b44fa22a805;p=platform%2Fupstream%2Fpixman.git

Fix read of BITS members from a solid image.

During the fast-path query, the read_func and write_func from the bits
structure are queried for the solid image.

==32723== Conditional jump or move depends on uninitialised value(s)
==32723==    at 0x412AF20: _pixman_run_fast_path (pixman-utils.c:681)
==32723==    by 0x4136319: sse2_composite (pixman-sse2.c:5554)
==32723==    by 0x4100CD2: _pixman_implementation_composite
(pixman-implementation.c:227)
==32723==    by 0x412396E: pixman_image_composite (pixman.c:140)
==32723==    by 0x4123D64: pixman_image_fill_rectangles (pixman.c:322)
==32723==    by 0x40482B7: _cairo_image_surface_fill_rectangles
(cairo-image-surface.c:1180)
==32723==    by 0x4063BE7: _cairo_surface_fill_rectangles
(cairo-surface.c:1883)
==32723==    by 0x4063E38: _cairo_surface_fill_region
(cairo-surface.c:1840)
==32723==    by 0x4067FDC: _clip_and_composite_trapezoids
(cairo-surface-fallback.c:625)
==32723==    by 0x40689C5: _cairo_surface_fallback_paint
(cairo-surface-fallback.c:835)
==32723==    by 0x4065731: _cairo_surface_paint (cairo-surface.c:1923)
==32723==    by 0x4044098: _cairo_gstate_paint (cairo-gstate.c:900)
==32723==  Uninitialised value was created by a heap allocation
==32723==    at 0x402732D: malloc (vg_replace_malloc.c:180)
==32723==    by 0x410099F: _pixman_image_allocate (pixman-image.c:100)
==32723==    by 0x41265B8: pixman_image_create_solid_fill
(pixman-solid-fill.c:75)
==32723==    by 0x4123CE1: pixman_image_fill_rectangles (pixman.c:314)
==32723==    by 0x40482B7: _cairo_image_surface_fill_rectangles
(cairo-image-surface.c:1180)
==32723==    by 0x4063BE7: _cairo_surface_fill_rectangles
(cairo-surface.c:1883)
==32723==    by 0x4063E38: _cairo_surface_fill_region
(cairo-surface.c:1840)
==32723==    by 0x4067FDC: _clip_and_composite_trapezoids
(cairo-surface-fallback.c:625)
==32723==    by 0x40689C5: _cairo_surface_fallback_paint
(cairo-surface-fallback.c:835)
==32723==    by 0x4065731: _cairo_surface_paint (cairo-surface.c:1923)
==32723==    by 0x4044098: _cairo_gstate_paint (cairo-gstate.c:900)
==32723==    by 0x403C10B: cairo_paint (cairo.c:2052)
---

diff --git a/pixman/pixman-utils.c b/pixman/pixman-utils.c
index 2c34d02..a981418 100644
--- a/pixman/pixman-utils.c
+++ b/pixman/pixman-utils.c
@@ -646,23 +646,40 @@ _pixman_run_fast_path (const pixman_fast_path_t *paths,
     pixman_bool_t mask_repeat =
 	mask && mask->common.repeat == PIXMAN_REPEAT_NORMAL;
     pixman_bool_t result;
+    pixman_bool_t has_fast_path;
 
-    if ((src->type == BITS || _pixman_image_is_solid (src)) &&
-        (!mask || mask->type == BITS)
-        && !src->common.transform && !(mask && mask->common.transform)
-	&& !src->common.alpha_map && !dest->common.alpha_map
-        && !(mask && mask->common.alpha_map)
-        && (src->common.filter != PIXMAN_FILTER_CONVOLUTION)
-        && (src->common.repeat != PIXMAN_REPEAT_PAD)
-        && (src->common.repeat != PIXMAN_REPEAT_REFLECT)
-        && (!mask || (mask->common.filter != PIXMAN_FILTER_CONVOLUTION &&
-                      mask->common.repeat != PIXMAN_REPEAT_PAD &&
-                      mask->common.repeat != PIXMAN_REPEAT_REFLECT))
-        && !src->bits.read_func && !src->bits.write_func
-        && !(mask && mask->bits.read_func)
-        && !(mask && mask->bits.write_func)
-        && !dest->bits.read_func
-        && !dest->bits.write_func)
+    has_fast_path = !dest->common.alpha_map &&
+		    !dest->bits.read_func &&
+		    !dest->bits.write_func;
+
+    if (has_fast_path)
+    {
+	has_fast_path = (src->type == BITS || _pixman_image_is_solid (src)) &&
+	                !src->common.transform &&
+	                !src->common.alpha_map &&
+			src->common.filter != PIXMAN_FILTER_CONVOLUTION &&
+			src->common.repeat != PIXMAN_REPEAT_PAD &&
+			src->common.repeat != PIXMAN_REPEAT_REFLECT;
+	if (has_fast_path && src->type == BITS)
+	{
+	    has_fast_path = !src->bits.read_func &&
+	                    !src->bits.write_func;
+	}
+    }
+
+    if (mask && has_fast_path)
+    {
+	has_fast_path = mask->type == BITS &&
+	                !mask->common.transform &&
+	                !mask->common.alpha_map &&
+	                !mask->bits.read_func &&
+	                !mask->bits.write_func &&
+			mask->common.filter != PIXMAN_FILTER_CONVOLUTION &&
+			mask->common.repeat != PIXMAN_REPEAT_PAD &&
+			mask->common.repeat != PIXMAN_REPEAT_REFLECT;
+    }
+
+    if (has_fast_path)
     {
 	const pixman_fast_path_t *info;
 	pixman_bool_t pixbuf;