add bounds check in layer merging

Change-Id: Ie35c0bf17535a6234986bc47344407697ce68d4b

1 files changed, 15 insertions, 13 deletions

diff --git a/Source/WebCore/platform/graphics/android/LayerGroup.cpp b/Source/WebCore/platform/graphics/android/LayerGroup.cpp
index 5ec41f8..0061a3a 100644
--- a/Source/WebCore/platform/graphics/android/LayerGroup.cpp
+++ b/Source/WebCore/platform/graphics/android/LayerGroup.cpp
@@ -102,19 +102,21 @@ bool LayerGroup::tryUpdateLayerGroup(LayerGroup* oldLayerGroup)
         m_dualTiledTexture->markAsDirty(*layerInval);
     } else {
         SkRegion invalRegion;
-        bool fullInval = false;
-        for (unsigned int i = 0; i < m_layers.size(); i++) {
-            if (m_layers[i]->uniqueId() != oldLayerGroup->m_layers[i]->uniqueId()) {
-                // layer list has changed, fully invalidate
-                // TODO: partially invalidate based on layer size/position
-                fullInval = true;
-                break;
-            } else if (!m_layers[i]->getInvalRegion()->isEmpty()) {
-                // merge layer inval - translate the layer's inval region into group coordinates
-                SkPoint pos = m_layers[i]->getPosition();
-                m_layers[i]->getInvalRegion()->translate(pos.fX, pos.fY);
-                invalRegion.op(*(m_layers[i]->getInvalRegion()), SkRegion::kUnion_Op);
-                break;
+        bool fullInval = m_layers.size() != oldLayerGroup->m_layers.size();
+        if (!fullInval) {
+            for (unsigned int i = 0; i < m_layers.size(); i++) {
+                if (m_layers[i]->uniqueId() != oldLayerGroup->m_layers[i]->uniqueId()) {
+                    // layer list has changed, fully invalidate
+                    // TODO: partially invalidate based on layer size/position
+                    fullInval = true;
+                    break;
+                } else if (!m_layers[i]->getInvalRegion()->isEmpty()) {
+                    // merge layer inval - translate the layer's inval region into group coordinates
+                    SkPoint pos = m_layers[i]->getPosition();
+                    m_layers[i]->getInvalRegion()->translate(pos.fX, pos.fY);
+                    invalRegion.op(*(m_layers[i]->getInvalRegion()), SkRegion::kUnion_Op);
+                    break;
+                }
             }
         }