WinRT QPA: Fix crash in QWinRTBackingStore::flush()

QWinRTBackingStore::flush() was not considering the possibility that the supplied region may fall partially outside the bounds of the paint device. This resulted in possible accesses to invalid memory addresses, causing a crash. This bug was exposed by an update in ANGLE that was causing a crash when running tst_QTableView::bigMode with a small screen size. With this fix the function will use the intersection of the supplied region with the paint device bounds. Change-Id: I2f0f0f7f5510688bfa1459320a0c146df6be65d1 Reviewed-by: Miguel Costa <[email protected]>
brad0 · Oct 12, 2018 · 4d51e09 · 4d51e09
1 parent 9098ef6
commit 4d51e09
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/src/plugins/platforms/winrt/qwinrtbackingstore.cpp b/src/plugins/platforms/winrt/qwinrtbackingstore.cpp
@@ -118,11 +118,14 @@ void QWinRTBackingStore::flush(QWindow *window, const QRegion &region, const QPo
     if (d->size.isEmpty())
         return;
 
+    const QRect bounds = region.boundingRect() & d->paintDevice.rect();
+    if (bounds.isEmpty())
+        return;
+
     const bool ok = d->context->makeCurrent(window);
     if (!ok)
         qWarning("unable to flush");
 
-    const QRect bounds = region.boundingRect();
     glBindTexture(GL_TEXTURE_2D, d->fbo->texture());
     // TODO: when ANGLE GLES3 support is finished, use the glPixelStorei functions to minimize upload
     glTexSubImage2D(GL_TEXTURE_2D, 0, 0, bounds.y(), d->size.width(), bounds.height(),