Improve the SSSE3 scaler.

3 files changed, 25 insertions, 9 deletions

diff --git a/gfx/2d/ssse3-scaler.c b/gfx/2d/ssse3-scaler.c
index 345844b84..745f58f6f 100644
--- a/gfx/2d/ssse3-scaler.c
+++ b/gfx/2d/ssse3-scaler.c
@@ -37,6 +37,7 @@
 #include <tmmintrin.h>
 #include <stdint.h>
 #include <assert.h>
+#include "ssse3-scaler.h"
 
 typedef int32_t                 pixman_fixed_16_16_t;
 typedef pixman_fixed_16_16_t    pixman_fixed_t;
@@ -44,6 +45,8 @@ typedef pixman_fixed_16_16_t    pixman_fixed_t;
 #define pixman_fixed_to_int(f)          ((int) ((f) >> 16))
 #define pixman_int_to_fixed(i)          ((pixman_fixed_t) ((i) << 16))
 #define pixman_double_to_fixed(d)       ((pixman_fixed_t) ((d) * 65536.0))
+#define PIXMAN_FIXED_INT_MAX 32767
+#define PIXMAN_FIXED_INT_MIN -32768
 typedef struct pixman_vector pixman_vector_t;
 
 typedef int pixman_bool_t;
@@ -463,6 +466,12 @@ ssse3_bilinear_cover_iter_init (pixman_iter_t *iter)
     bilinear_info_t *info;
     pixman_vector_t v;
 
+    if (iter->x > PIXMAN_FIXED_INT_MAX ||
+        iter->x < PIXMAN_FIXED_INT_MIN ||
+        iter->y > PIXMAN_FIXED_INT_MAX ||
+        iter->y < PIXMAN_FIXED_INT_MIN)
+      goto fail;
+
     /* Reference point is the center of the pixel */
     v.vector[0] = pixman_int_to_fixed (iter->x) + pixman_fixed_1 / 2;
     v.vector[1] = pixman_int_to_fixed (iter->y) + pixman_fixed_1 / 2;
@@ -505,7 +514,7 @@ fail:
 /* scale the src from src_width/height to dest_width/height drawn
  * into the rectangle x,y width,height
  * src_stride and dst_stride are 4 byte units */
-void ssse3_scale_data(uint32_t *src, int src_width, int src_height, int src_stride,
+bool ssse3_scale_data(uint32_t *src, int src_width, int src_height, int src_stride,
                       uint32_t *dest, int dest_width, int dest_height,
                       int dest_stride,
                       int x, int y,
@@ -551,6 +560,10 @@ void ssse3_scale_data(uint32_t *src, int src_width, int src_height, int src_stri
     iter.data = NULL;
 
     ssse3_bilinear_cover_iter_init(&iter);
+
+    if (!iter.fini)
+      return false;
+
     if (iter.data) {
         for (int iy = 0; iy < height; iy++) {
             ssse3_fetch_bilinear_cover(&iter, NULL);
@@ -558,4 +571,5 @@ void ssse3_scale_data(uint32_t *src, int src_width, int src_height, int src_stri
         }
         ssse3_bilinear_cover_iter_fini(&iter);
     }
+    return true;
 }
diff --git a/gfx/2d/ssse3-scaler.h b/gfx/2d/ssse3-scaler.h
index b3b53ed64..ea8d8a066 100644
--- a/gfx/2d/ssse3-scaler.h
+++ b/gfx/2d/ssse3-scaler.h
@@ -6,10 +6,12 @@
 #ifndef MOZILLA_GFX_2D_SSSE3_SCALER_H_
 #define MOZILLA_GFX_2D_SSSE3_SCALER_H_
 
+#include <stdbool.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
-void ssse3_scale_data(uint32_t *src, int src_width, int src_height,
+bool ssse3_scale_data(uint32_t *src, int src_width, int src_height,
                 int src_stride,
                 uint32_t *dest, int dest_width, int dest_height,
                 int dest_rowstride,
diff --git a/gfx/layers/basic/BasicCompositor.cpp b/gfx/layers/basic/BasicCompositor.cpp
index 1ff27f795..634d9e340 100644
--- a/gfx/layers/basic/BasicCompositor.cpp
+++ b/gfx/layers/basic/BasicCompositor.cpp
@@ -470,15 +470,15 @@ AttemptVideoScale(TextureSourceBasic* aSource, const SourceSurface* aSourceMask,
     RefPtr<DataSourceSurface> srcSource = aSource->GetSurface(aDest)->GetDataSurface();
     DataSourceSurface::ScopedMap mapSrc(srcSource, DataSourceSurface::READ);
 
-    ssse3_scale_data((uint32_t*)mapSrc.GetData(), srcSource->GetSize().width, srcSource->GetSize().height,
-                     mapSrc.GetStride()/4,
-                     ((uint32_t*)dstData) + fillRect.x + (dstStride / 4) * fillRect.y, dstRect.width, dstRect.height,
-                     dstStride / 4,
-                     offset.x, offset.y,
-                     fillRect.width, fillRect.height);
+    bool success = ssse3_scale_data((uint32_t*)mapSrc.GetData(), srcSource->GetSize().width, srcSource->GetSize().height,
+                                    mapSrc.GetStride()/4,
+                                    ((uint32_t*)dstData) + fillRect.x + (dstStride / 4) * fillRect.y, dstRect.width, dstRect.height,
+                                    dstStride / 4,
+                                    offset.x, offset.y,
+                                    fillRect.width, fillRect.height);
 
     aDest->ReleaseBits(dstData);
-    return true;
+    return success;
   } else
 #endif // MOZILLA_SSE_HAVE_CPUID_DETECTION
     return false;