[cairo] [PATCH] Fix read of BITS members from a solid image.

[Chris Wilson]

During the fast-path query, the read_func and write_func from the bits
structure are queried for the solid image.

==32723== Conditional jump or move depends on uninitialised value(s)
==32723==    at 0x412AF20: _pixman_run_fast_path (pixman-utils.c:681)
==32723==    by 0x4136319: sse2_composite (pixman-sse2.c:5554)
==32723==    by 0x4100CD2: _pixman_implementation_composite
(pixman-implementation.c:227)
==32723==    by 0x412396E: pixman_image_composite (pixman.c:140)
==32723==    by 0x4123D64: pixman_image_fill_rectangles (pixman.c:322)
==32723==    by 0x40482B7: _cairo_image_surface_fill_rectangles
(cairo-image-surface.c:1180)
==32723==    by 0x4063BE7: _cairo_surface_fill_rectangles
(cairo-surface.c:1883)
==32723==    by 0x4063E38: _cairo_surface_fill_region
(cairo-surface.c:1840)
==32723==    by 0x4067FDC: _clip_and_composite_trapezoids
(cairo-surface-fallback.c:625)
==32723==    by 0x40689C5: _cairo_surface_fallback_paint
(cairo-surface-fallback.c:835)
==32723==    by 0x4065731: _cairo_surface_paint (cairo-surface.c:1923)
==32723==    by 0x4044098: _cairo_gstate_paint (cairo-gstate.c:900)
==32723==  Uninitialised value was created by a heap allocation
==32723==    at 0x402732D: malloc (vg_replace_malloc.c:180)
==32723==    by 0x410099F: _pixman_image_allocate (pixman-image.c:100)
==32723==    by 0x41265B8: pixman_image_create_solid_fill
(pixman-solid-fill.c:75)
==32723==    by 0x4123CE1: pixman_image_fill_rectangles (pixman.c:314)
==32723==    by 0x40482B7: _cairo_image_surface_fill_rectangles
(cairo-image-surface.c:1180)
==32723==    by 0x4063BE7: _cairo_surface_fill_rectangles
(cairo-surface.c:1883)
==32723==    by 0x4063E38: _cairo_surface_fill_region
(cairo-surface.c:1840)
==32723==    by 0x4067FDC: _clip_and_composite_trapezoids
(cairo-surface-fallback.c:625)
==32723==    by 0x40689C5: _cairo_surface_fallback_paint
(cairo-surface-fallback.c:835)
==32723==    by 0x4065731: _cairo_surface_paint (cairo-surface.c:1923)
==32723==    by 0x4044098: _cairo_gstate_paint (cairo-gstate.c:900)
==32723==    by 0x403C10B: cairo_paint (cairo.c:2052)
---
 pixman/pixman-utils.c |   47 ++++++++++++++++++++++++++++++-----------------
 1 files changed, 30 insertions(+), 17 deletions(-)

diff --git a/pixman/pixman-utils.c b/pixman/pixman-utils.c
index 3dfacde..6441ee8 100644
--- a/pixman/pixman-utils.c
+++ b/pixman/pixman-utils.c
@@ -666,24 +666,37 @@ _pixman_run_fast_path (const pixman_fast_path_t *paths,
     pixman_bool_t mask_repeat =
 	mask && mask->common.repeat == PIXMAN_REPEAT_NORMAL;
     pixman_bool_t result;
+    pixman_bool_t has_fast_path;
+
+    has_fast_path = !dest->common.alpha_map &&
+	            !dest->bits.read_func &&
+		    !dest->bits.write_func;
+
+    if (has_fast_path) {
+	has_fast_path = (src->type == BITS || _pixman_image_is_solid (src)) &&
+	                !src->common.transform &&
+	                !src->common.alpha_map &&
+			src->common.filter != PIXMAN_FILTER_CONVOLUTION &&
+			src->common.repeat != PIXMAN_REPEAT_PAD &&
+			src->common.repeat != PIXMAN_REPEAT_REFLECT;
+	if (has_fast_path && src->type == BITS) {
+	    has_fast_path = !src->bits.read_func &&
+	                    !src->bits.write_func;
+	}
+    }
 
-    if ((src->type == BITS || _pixman_image_is_solid (src)) &&
-        (!mask || mask->type == BITS)
-        && !src->common.transform && !(mask && mask->common.transform)
-	&& !src->common.alpha_map && !dest->common.alpha_map
-        && !(mask && mask->common.alpha_map)
-        && (src->common.filter != PIXMAN_FILTER_CONVOLUTION)
-        && (src->common.repeat != PIXMAN_REPEAT_PAD)
-        && (src->common.repeat != PIXMAN_REPEAT_REFLECT)
-        && (!mask || (mask->common.filter != PIXMAN_FILTER_CONVOLUTION &&
-                      mask->common.repeat != PIXMAN_REPEAT_PAD &&
-                      mask->common.repeat != PIXMAN_REPEAT_REFLECT))
-        && !src->bits.read_func && !src->bits.write_func
-        && !(mask && mask->bits.read_func)
-        && !(mask && mask->bits.write_func)
-        && !dest->bits.read_func
-        && !dest->bits.write_func)
-    {
+    if (mask && has_fast_path) {
+	has_fast_path = mask->type == BITS &&
+	                !mask->common.transform &&
+	                !mask->common.alpha_map &&
+	                !mask->bits.read_func &&
+	                !mask->bits.write_func &&
+			mask->common.filter != PIXMAN_FILTER_CONVOLUTION &&
+			mask->common.repeat != PIXMAN_REPEAT_PAD &&
+			mask->common.repeat != PIXMAN_REPEAT_REFLECT;
+    }
+
+    if (has_fast_path) {
 	const pixman_fast_path_t *info;
 	pixman_bool_t pixbuf;
 
-- 
1.6.3.3