Bug 641019 - "Crash on video with odd widths and 16-bit displays" [r=tterribe a=stuart]

gfx/layers/basic/BasicImages.cpp

@@ -129,6 +129,7 @@ protected:
   nsAutoArrayPtr<PRUint8>              mBuffer;
   nsCountedRef<nsMainThreadSurfaceRef> mSurface;
   gfxIntSize                           mScaleHint;
+  PRInt32                              mStride;
   gfxImageFormat                       mOffscreenFormat;
 };
 
@@ -158,8 +159,8 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
   gfxIntSize size(prescale ? mScaleHint.width : aData.mPicSize.width,
                   prescale ? mScaleHint.height : aData.mPicSize.height);
 
-  int bpp = gfxASurface::BytePerPixelFromFormat(format);
-  mBuffer = new PRUint8[size.width * size.height * bpp];
+  mStride = gfxASurface::FormatStrideForWidth(format, size.width);
+  mBuffer = new PRUint8[size.height * mStride];
   if (!mBuffer) {
     // out of memory
     return;
@@ -195,7 +196,7 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
                              size.height,
                              aData.mYStride,
                              aData.mCbCrStride,
-                             size.width*bpp,
+                             mStride,
                              type,
                              gfx::ROTATE_0,
                              gfx::FILTER_BILINEAR);
@@ -215,7 +216,7 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
                                 aData.mPicSize.height,
                                 aData.mYStride,
                                 aData.mCbCrStride,
-                                aData.mPicSize.width*bpp,
+                                mStride,
                                 type);
     } else { // format != gfxASurface::ImageFormatRGB16_565
       gfx::ConvertYCbCrToRGB32(aData.mYChannel,
@@ -228,7 +229,7 @@ BasicPlanarYCbCrImage::SetData(const Data& aData)
                                aData.mPicSize.height,
                                aData.mYStride,
                                aData.mCbCrStride,
-                               aData.mPicSize.width*bpp,
+                               mStride,
                                type);
     }
   }
@@ -261,10 +262,8 @@ BasicPlanarYCbCrImage::GetAsSurface()
   gfxASurface::gfxImageFormat format = GetOffscreenFormat();
 
   nsRefPtr<gfxImageSurface> imgSurface =
-      new gfxImageSurface(mBuffer, mSize,
-                          mSize.width * gfxASurface::BytePerPixelFromFormat(format),
-                          format);
-  if (!imgSurface) {
+      new gfxImageSurface(mBuffer, mSize, mStride, format);
+  if (!imgSurface || imgSurface->CairoStatus() != 0) {
     return nsnull;
   }
 

gfx/thebes/gfxASurface.cpp

@@ -373,6 +373,13 @@ gfxASurface::CheckSurfaceSize(const gfxIntSize& sz, PRInt32 limit)
     return PR_TRUE;
 }
 
+/* static */
+PRInt32
+gfxASurface::FormatStrideForWidth(gfxImageFormat format, PRInt32 width)
+{
+    return cairo_format_stride_for_width((cairo_format_t)format, (int)width);
+}
+
 nsresult
 gfxASurface::BeginPrinting(const nsAString& aTitle, const nsAString& aPrintToFileName)
 {

gfx/thebes/gfxASurface.h

@@ -170,6 +170,11 @@ public:
      */
     static PRBool CheckSurfaceSize(const gfxIntSize& sz, PRInt32 limit = 0);
 
+    /* Provide a stride value that will respect all alignment requirements of
+     * the accelerated image-rendering code.
+     */
+    static PRInt32 FormatStrideForWidth(gfxImageFormat format, PRInt32 width);
+
     /* Return the default set of context flags for this surface; these are
      * hints to the context about any special rendering considerations.  See
      * gfxContext::SetFlag for documentation.

gfx/ycbcr/convert.patch

@@ -68,7 +68,7 @@ diff --git a/gfx/ycbcr/yuv_convert.cpp b/gfx/ycbcr/yuv_convert.cpp
 +{
 +#ifdef HAVE_YCBCR_TO_RGB565
 +  for (int i = 0; i < pic_height; i++) {
-+    yv12_to_rgb565_neon((uint16*)rgb_buf + pic_width * i,
++    yv12_to_rgb565_neon((uint16*)(rgb_buf + rgb_pitch * i),
 +                         y_buf + y_pitch * i,
 +                         u_buf + uv_pitch * (i / 2),
 +                         v_buf + uv_pitch * (i / 2),

gfx/ycbcr/yuv_convert.cpp

@@ -52,7 +52,7 @@ NS_GFX_(void) ConvertYCbCrToRGB565(const uint8* y_buf,
 {
 #ifdef HAVE_YCBCR_TO_RGB565
   for (int i = 0; i < pic_height; i++) {
-    yv12_to_rgb565_neon((uint16*)rgb_buf + pic_width * i,
+    yv12_to_rgb565_neon((uint16*)(rgb_buf + rgb_pitch * i),
                          y_buf + y_pitch * i,
                          u_buf + uv_pitch * (i / 2),
                          v_buf + uv_pitch * (i / 2),