Remote Layer Tree: Sporadic memory corruption during painting

https://bugs.webkit.org/show_bug.cgi?id=124191

Reviewed by Brady Eidson.

Fix a logic error (flipped the logic, didn't flip the operator)
made in the last version of r158982 that caused some crashes because
it allowed us to overrun the end of cgPaintingRects.

* Shared/mac/RemoteLayerBackingStore.mm:
(RemoteLayerBackingStore::drawInContext):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@159098 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebKit2/ChangeLog

+2013-11-11  Tim Horton  <timothy_horton@apple.com>
+
+        Remote Layer Tree: Sporadic memory corruption during painting
+        https://bugs.webkit.org/show_bug.cgi?id=124191
+
+        Reviewed by Brady Eidson.
+
+        Fix a logic error (flipped the logic, didn't flip the operator)
+        made in the last version of r158982 that caused some crashes because
+        it allowed us to overrun the end of cgPaintingRects.
+
+        * Shared/mac/RemoteLayerBackingStore.mm:
+        (RemoteLayerBackingStore::drawInContext):
+
 2013-11-11  Commit Queue  <commit-queue@webkit.org>
 
         Unreviewed, rolling out r159088.

Source/WebKit2/Shared/mac/RemoteLayerBackingStore.mm

@@ -243,7 +243,7 @@ void RemoteLayerBackingStore::drawInContext(GraphicsContext& context, CGImageRef
     // Otherwise, repaint the entire bounding box of the dirty region.
     IntRect dirtyBounds = m_dirtyRegion.bounds();
     Vector<IntRect> dirtyRects = m_dirtyRegion.rects();
-    if (dirtyRects.size() > webLayerMaxRectsToPaint && m_dirtyRegion.totalArea() > webLayerWastedSpaceThreshold * dirtyBounds.width() * dirtyBounds.height()) {
+    if (dirtyRects.size() > webLayerMaxRectsToPaint || m_dirtyRegion.totalArea() > webLayerWastedSpaceThreshold * dirtyBounds.width() * dirtyBounds.height()) {
         dirtyRects.clear();
         dirtyRects.append(dirtyBounds);
     }