diff --git a/content/media/test/crashtests/789075-1.html b/content/media/test/crashtests/789075-1.html new file mode 100644 index 000000000000..382a9ca8b336 --- /dev/null +++ b/content/media/test/crashtests/789075-1.html @@ -0,0 +1,8 @@ + + + + + + + + diff --git a/content/media/test/crashtests/789075.webm b/content/media/test/crashtests/789075.webm new file mode 100644 index 000000000000..602e53fca23f Binary files /dev/null and b/content/media/test/crashtests/789075.webm differ diff --git a/content/media/test/crashtests/crashtests.list b/content/media/test/crashtests/crashtests.list index f65e5391b2fb..ec2aac93b9ea 100644 --- a/content/media/test/crashtests/crashtests.list +++ b/content/media/test/crashtests/crashtests.list @@ -11,3 +11,4 @@ load 576612-1.html skip-if(Android) load 691096-1.html # Android sound API can't handle playing large number of sounds at once. load 752784-1.html HTTP load 795892-1.html +load 789075-1.html diff --git a/content/media/webm/nsWebMReader.cpp b/content/media/webm/nsWebMReader.cpp index 5fd041e867d5..3a87ce7871f4 100644 --- a/content/media/webm/nsWebMReader.cpp +++ b/content/media/webm/nsWebMReader.cpp @@ -705,14 +705,14 @@ bool nsWebMReader::DecodeVideoFrame(bool &aKeyframeSkip, b.mPlanes[1].mData = img->planes[1]; b.mPlanes[1].mStride = img->stride[1]; - b.mPlanes[1].mHeight = img->d_h >> img->y_chroma_shift; - b.mPlanes[1].mWidth = img->d_w >> img->x_chroma_shift; + b.mPlanes[1].mHeight = (img->d_h + 1) >> img->y_chroma_shift; + b.mPlanes[1].mWidth = (img->d_w + 1) >> img->x_chroma_shift; b.mPlanes[1].mOffset = b.mPlanes[1].mSkip = 0; b.mPlanes[2].mData = img->planes[2]; b.mPlanes[2].mStride = img->stride[2]; - b.mPlanes[2].mHeight = img->d_h >> img->y_chroma_shift; - b.mPlanes[2].mWidth = img->d_w >> img->x_chroma_shift; + b.mPlanes[2].mHeight = (img->d_h + 1) >> img->y_chroma_shift; + b.mPlanes[2].mWidth = (img->d_w + 1) >> img->x_chroma_shift; b.mPlanes[2].mOffset = b.mPlanes[2].mSkip = 0; nsIntRect picture = mPicture; diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp index 414c3a64462b..5c6aa03a406c 100644 --- a/gfx/thebes/gfxUtils.cpp +++ b/gfx/thebes/gfxUtils.cpp @@ -689,6 +689,12 @@ gfxUtils::ConvertYCbCrToRGB(const PlanarYCbCrImage::Data& aData, unsigned char* aDestBuffer, int32_t aStride) { + // ConvertYCbCrToRGB et al. assume the chroma planes are rounded up if the + // luma plane is odd sized. + MOZ_ASSERT((aData.mCbCrSize.width == aData.mYSize.width || + aData.mCbCrSize.width == (aData.mYSize.width + 1) >> 1) && + (aData.mCbCrSize.height == aData.mYSize.height || + aData.mCbCrSize.height == (aData.mYSize.height + 1) >> 1)); gfx::YUVType yuvtype = gfx::TypeFromSize(aData.mYSize.width, aData.mYSize.height,