cc: Fix PictureLayerTiling::Iterator crash

If you gave PictureLayerTiling a rect that was outside of its tiling
data, then it would incorrectly return its last tile as if that was
valid.  Fixed with an early-out and a unit test.

This situation should never have occurred however, as the bounds for the
tiling data should be absolutely equal to the layer's bounds.  It turned
out that during tiling sync, the active layer bounds were being set on
the pending layer tiling data instead of rewriting it with the new bounds.

R=danakj@chromium.org
BUG=170768


Review URL: https://chromiumcodereview.appspot.com/12026006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@177714 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 15 insertions, 1 deletions

diff --git a/cc/picture_layer_impl.cc b/cc/picture_layer_impl.cc
index 2aef705..063e600 100644
--- a/cc/picture_layer_impl.cc
+++ b/cc/picture_layer_impl.cc
@@ -254,6 +254,7 @@ void PictureLayerImpl::SyncFromActiveLayer() {
 
 void PictureLayerImpl::SyncFromActiveLayer(const PictureLayerImpl* other) {
   tilings_.CloneAll(other->tilings_, invalidation_);
+  DCHECK(bounds() == tilings_.LayerBounds());
 }
 
 void PictureLayerImpl::SyncTiling(
diff --git a/cc/picture_layer_tiling.cc b/cc/picture_layer_tiling.cc
index 1b2668c..7f19b43 100644
--- a/cc/picture_layer_tiling.cc
+++ b/cc/picture_layer_tiling.cc
@@ -163,6 +163,11 @@ PictureLayerTiling::Iterator::Iterator(const PictureLayerTiling* tiling,
 
   gfx::Rect content_rect =
       gfx::ToEnclosingRect(gfx::ScaleRect(dest_rect_, dest_to_content_scale_));
+  // IndexFromSrcCoord clamps to valid tile ranges, so it's necessary to
+  // check for non-intersection first.
+  content_rect.Intersect(gfx::Rect(tiling_->tiling_data_.total_size()));
+  if (content_rect.IsEmpty())
+    return;
 
   left_ = tiling_->tiling_data_.TileXIndexFromSrcCoord(content_rect.x());
   top_ = tiling_->tiling_data_.TileYIndexFromSrcCoord(content_rect.y());
diff --git a/cc/picture_layer_tiling_set.cc b/cc/picture_layer_tiling_set.cc
index 4e65869..c1d56e5 100644
--- a/cc/picture_layer_tiling_set.cc
+++ b/cc/picture_layer_tiling_set.cc
@@ -33,7 +33,8 @@ void PictureLayerTilingSet::CloneAll(
   tilings_.reserve(other.tilings_.size());
   for (size_t i = 0; i < other.tilings_.size(); ++i) {
     tilings_.push_back(other.tilings_[i]->Clone());
-    tilings_.back()->SetLayerBounds(LayerBounds());
+    // Intentionally use this set's layer bounds, as it may have changed.
+    tilings_.back()->SetLayerBounds(layer_bounds_);
     tilings_.back()->SetClient(client_);
     tilings_.back()->Invalidate(invalidation);
   }
diff --git a/cc/picture_layer_tiling_unittest.cc b/cc/picture_layer_tiling_unittest.cc
index e77b73c..f9628bbf 100644
--- a/cc/picture_layer_tiling_unittest.cc
+++ b/cc/picture_layer_tiling_unittest.cc
@@ -127,5 +127,12 @@ TEST_F(PictureLayerTilingIteratorTest, IteratorEmptyRect) {
   EXPECT_FALSE(iter);
 }
 
+TEST_F(PictureLayerTilingIteratorTest, NonIntersectingRect) {
+  Initialize(gfx::Size(100, 100), 1, gfx::Size(800, 600));
+  gfx::Rect non_intersecting(1000, 1000, 50, 50);
+  PictureLayerTiling::Iterator iter(tiling_.get(), 1, non_intersecting);
+  EXPECT_FALSE(iter);
+}
+
 }  // namespace
 }  // namespace cc