Bug 1049138. Add more crashing to PadDrawTargetOutFromRegion. r=BenWa

try: -b do -p all -u all -t none
Hopefully, this will give us a better idea of what the problem is.

--HG--
extra : rebase_source : 4f048b2501bb13edc4e257aa561bce87ea3137fd

gfx/layers/client/TiledContentClient.cpp

@@ -987,6 +987,22 @@ void PadDrawTargetOutFromRegion(RefPtr<DrawTarget> drawTarget, nsIntRegion &regi
       return x;
     }
 
+    static void ensure_memcpy(uint8_t *dst, uint8_t *src, size_t n, uint8_t *bitmap, int stride, int height)
+    {
+        if (src + n > bitmap + stride*height) {
+            MOZ_CRASH("long src memcpy");
+        }
+        if (src < bitmap) {
+            MOZ_CRASH("short src memcpy");
+        }
+        if (dst + n > bitmap + stride*height) {
+            MOZ_CRASH("long dst mempcy");
+        }
+        if (dst < bitmap) {
+            MOZ_CRASH("short dst mempcy");
+        }
+    }
+
     static void visitor(void *closure, VisitSide side, int x1, int y1, int x2, int y2) {
       LockedBits *lb = static_cast<LockedBits*>(closure);
       uint8_t *bitmap = lb->data;
@@ -999,12 +1015,14 @@ void PadDrawTargetOutFromRegion(RefPtr<DrawTarget> drawTarget, nsIntRegion &regi
         if (y1 > 0) {
           x1 = clamp(x1, 0, width - 1);
           x2 = clamp(x2, 0, width - 1);
+          ensure_memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp, bitmap, stride, height);
           memcpy(&bitmap[x1*bpp + (y1-1) * stride], &bitmap[x1*bpp + y1 * stride], (x2 - x1) * bpp);
         }
       } else if (side == VisitSide::BOTTOM) {
         if (y1 < height) {
           x1 = clamp(x1, 0, width - 1);
           x2 = clamp(x2, 0, width - 1);
+          ensure_memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp, bitmap, stride, height);
           memcpy(&bitmap[x1*bpp + y1 * stride], &bitmap[x1*bpp + (y1-1) * stride], (x2 - x1) * bpp);
         }
       } else if (side == VisitSide::LEFT) {