From e170114ee8d3365615c00fcb8ce8d500d303c902 Mon Sep 17 00:00:00 2001
From: Julian Seward <jseward@acm.org>
Date: Sun, 15 Aug 2010 11:01:49 +0200
Subject: [PATCH] Bug 582668 - gfxAlphaBoxBlur::Paint appears to pass garbage
 down through Cairo. r=roc

---
 gfx/thebes/gfxBlur.cpp | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/gfx/thebes/gfxBlur.cpp b/gfx/thebes/gfxBlur.cpp
index 7bc55605691..5e5c5763d94 100644
--- a/gfx/thebes/gfxBlur.cpp
+++ b/gfx/thebes/gfxBlur.cpp
@@ -315,10 +315,17 @@ gfxAlphaBoxBlur::Paint(gfxContext* aDestinationCtx, const gfxPoint& offset)
     // no need to do all this if not blurring
     if (mBlurRadius.width != 0 || mBlurRadius.height != 0) {
         nsTArray<unsigned char> tempAlphaDataBuf;
-        if (!tempAlphaDataBuf.SetLength(mImageSurface->GetDataSize()))
-            return; // OOM
+        PRSize szB = mImageSurface->GetDataSize();
+        if (!tempAlphaDataBuf.SetLength(szB))
+           return; // OOM
 
         unsigned char* tmpData = tempAlphaDataBuf.Elements();
+        // .SetLength above doesn't initialise the new elements since
+        // they are unsigned chars and so have no default constructor.
+        // So we have to initialise them by hand.
+        // https://bugzilla.mozilla.org/show_bug.cgi?id=582668#c10
+        memset(tmpData, 0, szB);
+
         PRInt32 stride = mImageSurface->Stride();
         PRInt32 rows = mImageSurface->Height();