Clip the dirty rect to ensure it's within the X11 drawable. b=445707 r+sr=roc

layout/generic/nsObjectFrame.cpp

@@ -4152,25 +4152,31 @@ nsPluginInstanceOwner::Renderer::NativeDraw(Screen* screen, Drawable drawable,
     doupdatewindow = PR_TRUE;
   }
 
-  // The clip rect is relative to plugin top-left.
+  // The clip rect is relative to drawable top-left.
   NS_ASSERTION(numClipRects <= 1, "We don't support multiple clip rectangles!");
-  nsPluginRect newClipRect;
+  nsIntRect clipRect;
   if (numClipRects) {
-    newClipRect.left = clipRects[0].x;
+    clipRect.x = clipRects[0].x;
-    newClipRect.top = clipRects[0].y;
+    clipRect.y = clipRects[0].y;
-    newClipRect.right  = clipRects[0].x + clipRects[0].width;
+    clipRect.width  = clipRects[0].width;
-    newClipRect.bottom = clipRects[0].y + clipRects[0].height;
+    clipRect.height = clipRects[0].height;
   }
   else {
-    // We should have been given a clip if an offset is -ve.
+    // nsPluginRect members are unsigned, but
+    // we should have been given a clip if an offset is -ve.
     NS_ASSERTION(offsetX >= 0 && offsetY >= 0,
                  "Clip rectangle offsets are negative!");
-    newClipRect.left = offsetX;
+    clipRect.x = offsetX;
-    newClipRect.top  = offsetY;
+    clipRect.y = offsetY;
-    newClipRect.right  = offsetX + mWindow->width;
+    clipRect.width  = mWindow->width;
-    newClipRect.bottom = offsetY + mWindow->height;
+    clipRect.height = mWindow->height;
   }
 
+  nsPluginRect newClipRect;
+  newClipRect.left = clipRect.x;
+  newClipRect.top = clipRect.y;
+  newClipRect.right = clipRect.XMost();
+  newClipRect.bottom = clipRect.YMost();
   if (mWindow->clipRect.left    != newClipRect.left   ||
       mWindow->clipRect.top     != newClipRect.top    ||
       mWindow->clipRect.right   != newClipRect.right  ||
@@ -4191,16 +4197,23 @@ nsPluginInstanceOwner::Renderer::NativeDraw(Screen* screen, Drawable drawable,
   if (doupdatewindow)
       mInstance->SetWindow(mWindow);
 
+  // Translate the dirty rect to drawable coordinates.
+  nsIntRect dirtyRect = mDirtyRect + nsIntPoint(offsetX, offsetY);
+  // Intersect the dirty rect with the clip rect to ensure that it lies within
+  // the drawable.
+  if (!dirtyRect.IntersectRect(dirtyRect, clipRect))
+    return NS_OK;
+
   nsPluginEvent pluginEvent;
   XGraphicsExposeEvent& exposeEvent = pluginEvent.event.xgraphicsexpose;
   // set the drawing info
   exposeEvent.type = GraphicsExpose;
   exposeEvent.display = DisplayOfScreen(screen);
   exposeEvent.drawable = drawable;
-  exposeEvent.x = mDirtyRect.x + offsetX;
+  exposeEvent.x = dirtyRect.x;
-  exposeEvent.y = mDirtyRect.y + offsetY;
+  exposeEvent.y = dirtyRect.y;
-  exposeEvent.width  = mDirtyRect.width;
+  exposeEvent.width  = dirtyRect.width;
-  exposeEvent.height = mDirtyRect.height;
+  exposeEvent.height = dirtyRect.height;
   exposeEvent.count = 0;
   // information not set:
   exposeEvent.serial = 0;