b=390668, crash in gfxASurface::GetType (_moz_cairo_scaled_font_status and others), often using drawWindow

gfx/cairo/README

@@ -36,3 +36,6 @@ printers lie about their support for BitBlt, and we end up getting
 black instead of what we want.
 
 nonfatal-assertions.patch: Make assertions non-fatal
+
+clone-similar-fallback.patch: Implement fallback for clone_similar.
+

gfx/cairo/cairo/src/cairo-surface-fallback-private.h

@@ -1,3 +1,4 @@
+/* -*- Mode: c; tab-width: 8; c-basic-offset: 4; indent-tabs-mode: t; -*- */
 /* cairo - a vector graphics library with display and print output
  *
  * Copyright © 2002 University of Southern California
@@ -116,4 +117,13 @@ _cairo_surface_fallback_composite_trapezoids (cairo_operator_t		op,
 					      cairo_trapezoid_t	       *traps,
 					      int			num_traps);
 
+cairo_private cairo_status_t
+_cairo_surface_fallback_clone_similar (cairo_surface_t  *surface,
+				       cairo_surface_t  *src,
+				       int               src_x,
+				       int               src_y,
+				       int               width,
+				       int               height,
+				       cairo_surface_t **clone_out);
+
 #endif

gfx/cairo/cairo/src/cairo-surface-fallback.c

@@ -1,3 +1,4 @@
+/* -*- Mode: c; tab-width: 8; c-basic-offset: 4; indent-tabs-mode: t; -*- */
 /* cairo - a vector graphics library with display and print output
  *
  * Copyright © 2002 University of Southern California
@@ -1252,3 +1253,43 @@ _cairo_surface_fallback_composite_trapezoids (cairo_operator_t		op,
 
     return status;
 }
+
+cairo_status_t
+_cairo_surface_fallback_clone_similar (cairo_surface_t	*surface,
+				       cairo_surface_t	*src,
+				       int		 src_x,
+				       int		 src_y,
+				       int		 width,
+				       int		 height,
+				       cairo_surface_t **clone_out)
+{
+    cairo_status_t status;
+    cairo_pattern_union_t src_pattern;
+    cairo_surface_t *new_surface = NULL;
+
+    new_surface = _cairo_surface_create_similar_scratch (surface,
+							 cairo_surface_get_content (src),
+							 width, height);
+    if (new_surface->status)
+	return new_surface->status;
+
+    _cairo_pattern_init_for_surface (&src_pattern.surface, src);
+
+    status = _cairo_surface_composite (CAIRO_OPERATOR_SOURCE,
+				       &src_pattern.base,
+				       NULL,
+				       new_surface,
+				       src_x, src_y,
+				       0, 0,
+				       0, 0,
+				       width, height);
+
+    _cairo_pattern_fini (&src_pattern.base);
+
+    if (status == CAIRO_STATUS_SUCCESS)
+	*clone_out = new_surface;
+    else if (new_surface)
+	cairo_surface_destroy (new_surface);
+
+    return status;
+}

gfx/cairo/cairo/src/cairo-surface.c

@@ -1032,7 +1032,11 @@ _cairo_surface_clone_similar (cairo_surface_t  *surface,
 	return CAIRO_STATUS_SURFACE_FINISHED;
 
     if (surface->backend->clone_similar == NULL)
-	return CAIRO_INT_STATUS_UNSUPPORTED;
+	return (cairo_int_status_t)
+	    _cairo_surface_fallback_clone_similar (surface, src,
+						   src_x, src_y,
+						   width, height,
+						   clone_out);
 
     status = surface->backend->clone_similar (surface, src, src_x, src_y,
 					      width, height, clone_out);

gfx/cairo/clone-similar-fallback.patch

@@ -0,0 +1,150 @@
+Index: gfx/cairo/cairo/src/cairo-analysis-surface-private.h
+===================================================================
+RCS file: /cvsroot/mozilla/gfx/cairo/cairo/src/cairo-analysis-surface-private.h,v
+retrieving revision 1.11
+diff -u -8 -p -r1.11 cairo-analysis-surface-private.h
+--- gfx/cairo/cairo/src/cairo-analysis-surface-private.h	2 Aug 2007 06:58:47 -0000	1.11
++++ gfx/cairo/cairo/src/cairo-analysis-surface-private.h	7 Aug 2007 22:50:37 -0000
+@@ -1,9 +1,9 @@
+-/* $Id: clone-similar-fallback.patch,v 1.1 2007-08-09 18:54:17 vladimir%pobox.com Exp $
++/* $Id: clone-similar-fallback.patch,v 1.1 2007-08-09 18:54:17 vladimir%pobox.com Exp $
+  *
+  * Copyright © 2005 Keith Packard
+  *
+  * This library is free software; you can redistribute it and/or
+  * modify it either under the terms of the GNU Lesser General Public
+  * License version 2.1 as published by the Free Software Foundation
+  * (the "LGPL") or, at your option, under the terms of the Mozilla
+  * Public License Version 1.1 (the "MPL"). If you do not alter this
+Index: gfx/cairo/cairo/src/cairo-surface-fallback-private.h
+===================================================================
+RCS file: /cvsroot/mozilla/gfx/cairo/cairo/src/cairo-surface-fallback-private.h,v
+retrieving revision 1.7
+diff -u -8 -p -r1.7 cairo-surface-fallback-private.h
+--- gfx/cairo/cairo/src/cairo-surface-fallback-private.h	2 Aug 2007 06:58:47 -0000	1.7
++++ gfx/cairo/cairo/src/cairo-surface-fallback-private.h	7 Aug 2007 22:50:37 -0000
+@@ -1,8 +1,9 @@
++/* -*- Mode: c; tab-width: 8; c-basic-offset: 4; indent-tabs-mode: t; -*- */
+ /* cairo - a vector graphics library with display and print output
+  *
+  * Copyright © 2002 University of Southern California
+  * Copyright © 2005 Red Hat, Inc.
+  *
+  * This library is free software; you can redistribute it and/or
+  * modify it either under the terms of the GNU Lesser General Public
+  * License version 2.1 as published by the Free Software Foundation
+@@ -111,9 +112,18 @@ _cairo_surface_fallback_composite_trapez
+ 					      int			src_y,
+ 					      int			dst_x,
+ 					      int			dst_y,
+ 					      unsigned int		width,
+ 					      unsigned int		height,
+ 					      cairo_trapezoid_t	       *traps,
+ 					      int			num_traps);
+ 
++cairo_private cairo_status_t
++_cairo_surface_fallback_clone_similar (cairo_surface_t  *surface,
++				       cairo_surface_t  *src,
++				       int               src_x,
++				       int               src_y,
++				       int               width,
++				       int               height,
++				       cairo_surface_t **clone_out);
++
+ #endif
+Index: gfx/cairo/cairo/src/cairo-surface-fallback.c
+===================================================================
+RCS file: /cvsroot/mozilla/gfx/cairo/cairo/src/cairo-surface-fallback.c,v
+retrieving revision 1.18
+diff -u -8 -p -r1.18 cairo-surface-fallback.c
+--- gfx/cairo/cairo/src/cairo-surface-fallback.c	2 Aug 2007 06:58:47 -0000	1.18
++++ gfx/cairo/cairo/src/cairo-surface-fallback.c	7 Aug 2007 22:50:37 -0000
+@@ -1,8 +1,9 @@
++/* -*- Mode: c; tab-width: 8; c-basic-offset: 4; indent-tabs-mode: t; -*- */
+ /* cairo - a vector graphics library with display and print output
+  *
+  * Copyright © 2002 University of Southern California
+  * Copyright © 2005 Red Hat, Inc.
+  *
+  * This library is free software; you can redistribute it and/or
+  * modify it either under the terms of the GNU Lesser General Public
+  * License version 2.1 as published by the Free Software Foundation
+@@ -1247,8 +1248,48 @@ _cairo_surface_fallback_composite_trapez
+     if (offset_traps)
+ 	free (offset_traps);
+ 
+  DONE:
+     _fallback_fini (&state);
+ 
+     return status;
+ }
++
++cairo_status_t
++_cairo_surface_fallback_clone_similar (cairo_surface_t	*surface,
++				       cairo_surface_t	*src,
++				       int		 src_x,
++				       int		 src_y,
++				       int		 width,
++				       int		 height,
++				       cairo_surface_t **clone_out)
++{
++    cairo_status_t status;
++    cairo_pattern_union_t src_pattern;
++    cairo_surface_t *new_surface = NULL;
++
++    new_surface = _cairo_surface_create_similar_scratch (surface,
++							 cairo_surface_get_content (src),
++							 width, height);
++    if (new_surface->status)
++	return new_surface->status;
++
++    _cairo_pattern_init_for_surface (&src_pattern.surface, src);
++
++    status = _cairo_surface_composite (CAIRO_OPERATOR_SOURCE,
++				       &src_pattern.base,
++				       NULL,
++				       new_surface,
++				       src_x, src_y,
++				       0, 0,
++				       0, 0,
++				       width, height);
++
++    _cairo_pattern_fini (&src_pattern.base);
++
++    if (status == CAIRO_STATUS_SUCCESS)
++	*clone_out = new_surface;
++    else if (new_surface)
++	cairo_surface_destroy (new_surface);
++
++    return status;
++}
+Index: gfx/cairo/cairo/src/cairo-surface.c
+===================================================================
+RCS file: /cvsroot/mozilla/gfx/cairo/cairo/src/cairo-surface.c,v
+retrieving revision 1.27
+diff -u -8 -p -r1.27 cairo-surface.c
+--- gfx/cairo/cairo/src/cairo-surface.c	2 Aug 2007 06:58:47 -0000	1.27
++++ gfx/cairo/cairo/src/cairo-surface.c	7 Aug 2007 22:50:37 -0000
+@@ -1027,17 +1027,21 @@ _cairo_surface_clone_similar (cairo_surf
+     cairo_status_t status;
+     cairo_image_surface_t *image;
+     void *image_extra;
+ 
+     if (surface->finished)
+ 	return CAIRO_STATUS_SURFACE_FINISHED;
+ 
+     if (surface->backend->clone_similar == NULL)
+-	return CAIRO_INT_STATUS_UNSUPPORTED;
++	return (cairo_int_status_t)
++	    _cairo_surface_fallback_clone_similar (surface, src,
++						   src_x, src_y,
++						   width, height,
++						   clone_out);
+ 
+     status = surface->backend->clone_similar (surface, src, src_x, src_y,
+ 					      width, height, clone_out);
+     if (status == CAIRO_STATUS_SUCCESS && *clone_out != src)
+         (*clone_out)->device_transform = src->device_transform;
+ 
+     if (status != CAIRO_INT_STATUS_UNSUPPORTED)
+ 	return status;

gfx/src/thebes/nsThebesRenderingContext.cpp

@@ -706,6 +706,8 @@ nsThebesRenderingContext::GetNativeGraphicData(GraphicDataType aType)
 #ifdef XP_WIN
     if (aType == NATIVE_WINDOWS_DC) {
         nsRefPtr<gfxASurface> surf(mThebes->CurrentSurface());
+        if (!surf || surf->CairoStatus())
+            return nsnull;
         return static_cast<gfxWindowsSurface*>(static_cast<gfxASurface*>(surf.get()))->GetDC();
     }
 #endif

gfx/thebes/public/gfxWindowsNativeDrawing.h

@@ -88,6 +88,8 @@ public:
      *   gfxWindowsNativeDrawing nativeDraw(ctx, destGfxRect);
      *   do {
      *     HDC dc = nativeDraw.BeginNativeDrawing();
+     *     if (!dc)
+     *       return NS_ERROR_FAILURE;
      *
      *     RECT winRect;
      *     nativeDraw.TransformToNativeRect(rect, winRect);

gfx/thebes/src/gfxASurface.cpp

@@ -196,12 +196,18 @@ gfxASurface::Init(cairo_surface_t* surface, PRBool existingSurface)
 gfxASurface::gfxSurfaceType
 gfxASurface::GetType() const
 {
+    if (!mSurfaceValid)
+        return (gfxSurfaceType)-1;
+
     return (gfxSurfaceType)cairo_surface_get_type(mSurface);
 }
 
 gfxASurface::gfxContentType
 gfxASurface::GetContentType() const
 {
+    if (!mSurfaceValid)
+        return (gfxContentType)-1;
+
     return (gfxContentType)cairo_surface_get_content(mSurface);
 }
 

gfx/thebes/src/gfxWindowsNativeDrawing.cpp

@@ -69,6 +69,8 @@ gfxWindowsNativeDrawing::BeginNativeDrawing()
 {
     if (mRenderState == RENDER_STATE_INIT) {
         nsRefPtr<gfxASurface> surf = mContext->CurrentSurface(&mDeviceOffset.x, &mDeviceOffset.y);
+        if (!surf || surf->CairoStatus())
+            return nsnull;
 
         gfxMatrix m = mContext->CurrentMatrix();
         if (!m.HasNonTranslation())

widget/src/windows/nsNativeThemeWin.cpp

@@ -1116,6 +1116,8 @@ nsNativeThemeWin::DrawWidgetBackground(nsIRenderingContext* aContext,
 RENDER_AGAIN:
 
   HDC hdc = nativeDrawing.BeginNativeDrawing();
+  if (!hdc)
+    return NS_ERROR_FAILURE;
 
   nativeDrawing.TransformToNativeRect(tr, widgetRect);
   nativeDrawing.TransformToNativeRect(cr, clipRect);
@@ -2435,6 +2437,8 @@ nsresult nsNativeThemeWin::ClassicDrawWidgetBackground(nsIRenderingContext* aCon
 RENDER_AGAIN:
 
   HDC hdc = nativeDrawing.BeginNativeDrawing();
+  if (!hdc)
+    return NS_ERROR_FAILURE;
 
   nativeDrawing.TransformToNativeRect(tr, widgetRect);