b=359054, crash in moz_cairo_pixman_composite_src (image data was freed shortly before being used in compositing op), r=pavlov

gfx/cairo/libpixman/src/Makefile.in

@@ -78,9 +78,8 @@ ifdef MOZ_X11
 endif
 
 ifdef _MSC_VER
-# MMX disabled until we figure out the cause of bug 359054.
-#CSRCS   += fbmmx.c
-#DEFINES += -DUSE_MMX
+CSRCS   += fbmmx.c
+DEFINES += -DUSE_MMX
 endif
 
 EXPORTS		= pixman.h pixman-remap.h

gfx/src/thebes/nsThebesImage.cpp

@@ -447,6 +447,8 @@ nsThebesImage::ThebesDrawTile(gfxContext *thebesContext,
         thebesContext->SetMatrix(roundedCTM);
     }
 
+    nsRefPtr<gfxASurface> tmpSurfaceGrip;
+
     if (mSinglePixel && !hasPadding) {
         thebesContext->SetColor(mSinglePixelColor);
     } else {
@@ -457,9 +459,10 @@ nsThebesImage::ThebesDrawTile(gfxContext *thebesContext,
             /* Ugh we have padding; create a temporary surface that's the size of the surface + pad area,
              * and render the image into it first.  Then we'll tile that surface. */
             width = mWidth + xPadding;
-            height = mHeight + xPadding;
+            height = mHeight + yPadding;
             surface = new gfxImageSurface(gfxASurface::ImageFormatARGB32,
                                           width, height);
+            tmpSurfaceGrip = surface;
 
             nsRefPtr<gfxContext> tmpContext = new gfxContext(surface);
             if (mSinglePixel) {
@@ -500,6 +503,7 @@ nsThebesImage::ThebesDrawTile(gfxContext *thebesContext,
     thebesContext->Rectangle(targetRect, doSnap);
     thebesContext->Fill();
 
+    thebesContext->SetColor(gfxRGBA(0,0,0,0));
     if (doSnap)
         thebesContext->SetMatrix(savedCTM);