Merge WebKit at branches/chromium/742 r88085: Initial merge by git.

Change-Id: I0501b484b9528e31b0026e5ad64416dd6541cdde

9 files changed, 35 insertions, 13 deletions

diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.cpp b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
index eead000..5afbb43 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -187,7 +187,7 @@ void FEComposite::determineAbsolutePaintRect()
     case FECOMPOSITE_OPERATOR_ARITHMETIC:
         // Arithmetic may influnce the compele filter primitive region. So we can't
         // optimize the paint region here.
-        setAbsolutePaintRect(maxEffectRect());
+        setAbsolutePaintRect(enclosingIntRect(maxEffectRect()));
         return;
     default:
         // Take the union of both input effects.
diff --git a/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h b/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h
index 5dc8873..940aa92 100644
--- a/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h
+++ b/Source/WebCore/platform/graphics/filters/FEConvolveMatrix.h
@@ -75,7 +75,7 @@ public:
     virtual void apply();
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h b/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h
index 9b7dda8..fd80458 100644
--- a/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h
+++ b/Source/WebCore/platform/graphics/filters/FEDisplacementMap.h
@@ -53,7 +53,7 @@ public:
     virtual void apply();
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/Source/WebCore/platform/graphics/filters/FEFlood.h b/Source/WebCore/platform/graphics/filters/FEFlood.h
index cac4153..497ca24 100644
--- a/Source/WebCore/platform/graphics/filters/FEFlood.h
+++ b/Source/WebCore/platform/graphics/filters/FEFlood.h
@@ -42,7 +42,7 @@ public:
     virtual void apply();
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/Source/WebCore/platform/graphics/filters/FELighting.h b/Source/WebCore/platform/graphics/filters/FELighting.h
index 3dc46e9..501339c 100644
--- a/Source/WebCore/platform/graphics/filters/FELighting.h
+++ b/Source/WebCore/platform/graphics/filters/FELighting.h
@@ -43,7 +43,7 @@ class FELighting : public FilterEffect {
 public:
     virtual void apply();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
 protected:
     enum LightingType {
diff --git a/Source/WebCore/platform/graphics/filters/FETile.h b/Source/WebCore/platform/graphics/filters/FETile.h
index 9b02b4c..72e7e60 100644
--- a/Source/WebCore/platform/graphics/filters/FETile.h
+++ b/Source/WebCore/platform/graphics/filters/FETile.h
@@ -35,7 +35,7 @@ public:
     virtual void apply();
     virtual void dump();
 
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual FilterEffectType filterEffectType() const { return FilterEffectTypeTile; }
 
diff --git a/Source/WebCore/platform/graphics/filters/FETurbulence.h b/Source/WebCore/platform/graphics/filters/FETurbulence.h
index dfeb220..f03afc4 100644
--- a/Source/WebCore/platform/graphics/filters/FETurbulence.h
+++ b/Source/WebCore/platform/graphics/filters/FETurbulence.h
@@ -61,7 +61,7 @@ public:
     virtual void apply();
     virtual void dump();
     
-    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(maxEffectRect()); }
+    virtual void determineAbsolutePaintRect() { setAbsolutePaintRect(enclosingIntRect(maxEffectRect())); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
index f07d00c..6e5422e 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -46,6 +46,14 @@ FilterEffect::~FilterEffect()
 {
 }
 
+inline bool isFilterSizeValid(IntRect rect)
+{
+    if (rect.width() < 0 || rect.width() > kMaxFilterSize
+        || rect.height() < 0 || rect.height() > kMaxFilterSize)
+        return false;
+    return true;
+}
+
 void FilterEffect::determineAbsolutePaintRect()
 {
     m_absolutePaintRect = IntRect();
@@ -54,7 +62,7 @@ void FilterEffect::determineAbsolutePaintRect()
         m_absolutePaintRect.unite(m_inputEffects.at(i)->absolutePaintRect());
     
     // SVG specification wants us to clip to primitive subregion.
-    m_absolutePaintRect.intersect(m_maxEffectRect);
+    m_absolutePaintRect.intersect(enclosingIntRect(m_maxEffectRect));
 }
 
 IntRect FilterEffect::requestedRegionOfInputImageData(const IntRect& effectRect) const
@@ -104,6 +112,7 @@ ImageBuffer* FilterEffect::asImageBuffer()
 
 PassRefPtr<ByteArray> FilterEffect::asUnmultipliedImage(const IntRect& rect)
 {
+    ASSERT(isFilterSizeValid(rect));
     RefPtr<ByteArray> imageData = ByteArray::create(rect.width() * rect.height() * 4);
     copyUnmultipliedImage(imageData.get(), rect);
     return imageData.release();
@@ -111,6 +120,7 @@ PassRefPtr<ByteArray> FilterEffect::asUnmultipliedImage(const IntRect& rect)
 
 PassRefPtr<ByteArray> FilterEffect::asPremultipliedImage(const IntRect& rect)
 {
+    ASSERT(isFilterSizeValid(rect));
     RefPtr<ByteArray> imageData = ByteArray::create(rect.width() * rect.height() * 4);
     copyPremultipliedImage(imageData.get(), rect);
     return imageData.release();
@@ -118,10 +128,14 @@ PassRefPtr<ByteArray> FilterEffect::asPremultipliedImage(const IntRect& rect)
 
 inline void FilterEffect::copyImageBytes(ByteArray* source, ByteArray* destination, const IntRect& rect)
 {
-    // Copy the necessary lines.
-    if (rect.x() < 0 || rect.y() < 0 || rect.maxY() > m_absolutePaintRect.width() || rect.maxY() > m_absolutePaintRect.height())
+    // Initialize the destination to transparent black, if not entirely covered by the source.
+    if (rect.x() < 0 || rect.y() < 0 || rect.maxX() > m_absolutePaintRect.width() || rect.maxY() > m_absolutePaintRect.height())
         memset(destination->data(), 0, destination->length());
 
+    // Early return if the rect does not intersect with the source.
+    if (rect.maxX() <= 0 || rect.maxY() <= 0 || rect.x() >= m_absolutePaintRect.width() || rect.y() >= m_absolutePaintRect.height())
+        return;
+
     int xOrigin = rect.x();
     int xDest = 0;
     if (xOrigin < 0) {
@@ -165,6 +179,7 @@ void FilterEffect::copyUnmultipliedImage(ByteArray* destination, const IntRect&
         if (m_imageBufferResult)
             m_unmultipliedImageResult = m_imageBufferResult->getUnmultipliedImageData(IntRect(IntPoint(), m_absolutePaintRect.size()));
         else {
+            ASSERT(isFilterSizeValid(m_absolutePaintRect));
             m_unmultipliedImageResult = ByteArray::create(m_absolutePaintRect.width() * m_absolutePaintRect.height() * 4);
             unsigned char* sourceComponent = m_premultipliedImageResult->data();
             unsigned char* destinationComponent = m_unmultipliedImageResult->data();
@@ -198,6 +213,7 @@ void FilterEffect::copyPremultipliedImage(ByteArray* destination, const IntRect&
         if (m_imageBufferResult)
             m_premultipliedImageResult = m_imageBufferResult->getPremultipliedImageData(IntRect(IntPoint(), m_absolutePaintRect.size()));
         else {
+            ASSERT(isFilterSizeValid(m_absolutePaintRect));
             m_premultipliedImageResult = ByteArray::create(m_absolutePaintRect.width() * m_absolutePaintRect.height() * 4);
             unsigned char* sourceComponent = m_unmultipliedImageResult->data();
             unsigned char* destinationComponent = m_premultipliedImageResult->data();
@@ -234,6 +250,8 @@ ByteArray* FilterEffect::createUnmultipliedImageResult()
 {
     // Only one result type is allowed.
     ASSERT(!hasResult());
+    ASSERT(isFilterSizeValid(m_absolutePaintRect));
+
     determineAbsolutePaintRect();
     if (m_absolutePaintRect.isEmpty())
         return 0;
@@ -245,6 +263,8 @@ ByteArray* FilterEffect::createPremultipliedImageResult()
 {
     // Only one result type is allowed.
     ASSERT(!hasResult());
+    ASSERT(isFilterSizeValid(m_absolutePaintRect));
+
     determineAbsolutePaintRect();
     if (m_absolutePaintRect.isEmpty())
         return 0;
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.h b/Source/WebCore/platform/graphics/filters/FilterEffect.h
index 2de8ac5..74fdc29 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.h
@@ -32,6 +32,8 @@
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
+static const float kMaxFilterSize = 5000.0f;
+
 namespace WebCore {
 
 class Filter;
@@ -74,8 +76,8 @@ public:
     IntRect absolutePaintRect() const { return m_absolutePaintRect; }
     void setAbsolutePaintRect(const IntRect& absolutePaintRect) { m_absolutePaintRect = absolutePaintRect; }
 
-    IntRect maxEffectRect() const { return m_maxEffectRect; }
-    void setMaxEffectRect(const IntRect& maxEffectRect) { m_maxEffectRect = maxEffectRect; } 
+    FloatRect maxEffectRect() const { return m_maxEffectRect; }
+    void setMaxEffectRect(const FloatRect& maxEffectRect) { m_maxEffectRect = maxEffectRect; } 
 
     virtual void apply() = 0;
     virtual void dump() = 0;
@@ -128,7 +130,7 @@ private:
     
     // The maximum size of a filter primitive. In SVG this is the primitive subregion in absolute coordinate space.
     // The absolute paint rect should never be bigger than m_maxEffectRect.
-    IntRect m_maxEffectRect;
+    FloatRect m_maxEffectRect;
     Filter* m_filter;
 
 private: