From cb783928c7baf331eb2389caa5741aa3cb8d0a94 Mon Sep 17 00:00:00 2001
From: "tor%cs.brown.edu"
 <tor%cs.brown.edu@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Tue, 9 May 2000 20:56:34 +0000
Subject: [PATCH] Couple of crash fixes to DrawComposited* suggested by pavlov
 and bryner@uiuc.edu.

git-svn-id: svn://10.0.0.236/trunk@68878 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/gfx/src/gtk/nsImageGTK.cpp | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/mozilla/gfx/src/gtk/nsImageGTK.cpp b/mozilla/gfx/src/gtk/nsImageGTK.cpp
index 43586193bca..6267fc4e0d0 100644
--- a/mozilla/gfx/src/gtk/nsImageGTK.cpp
+++ b/mozilla/gfx/src/gtk/nsImageGTK.cpp
@@ -627,12 +627,12 @@ nsImageGTK::DrawCompositedGeneral(PRBool isLSB, PRBool flipBytes,
   }
 
   // now composite
-  for (int y=0; y<mHeight; y++) {
-    unsigned char *targetRow = readData+3*y*mWidth;
+  for (int y=0; y<height; y++) {
+    unsigned char *targetRow = readData+3*y*width;
     unsigned char *imageRow  = mImageBits   +(y+offsetY)*mRowBytes+3*offsetX;
     unsigned char *alphaRow  = mAlphaBits   +(y+offsetY)*mAlphaRowBytes+offsetX;
     
-    for (int i=0; i<mWidth; i++) {
+    for (int i=0; i<width; i++) {
       targetRow[3*i] =   (unsigned(targetRow[3*i])*(255-alphaRow[i]) +
                            unsigned(imageRow[3*i])*alphaRow[i])>>8;
       targetRow[3*i+1] = (unsigned(targetRow[3*i+1])*(255-alphaRow[i]) +
@@ -669,6 +669,11 @@ nsImageGTK::DrawComposited(nsIRenderingContext &aContext,
 
   readX = aX; readY = aY;
   destX = 0;  destY = 0;
+  if ((readY>=surfaceHeight) || (readX>=surfaceWidth)) {
+    // This should never happen if the layout engine is sane,
+    // but pavlov says he saw it.  Bulletproof gfx for now...
+    return;
+  }
   if (readY<0) {
     destY = -readY;
     readY = 0;