[Webkit-unassigned] [Bug 181836] REGRESSION (r226981): ASSERTION FAILED: startY >= 0 && endY <= height && startY < endY in WebCore::FEMorphology::platformApplyGeneric

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=181836

--- Comment #3 from Simon Fraser (smfr) <simon.fraser at apple.com> ---
This logic is bad:

            const int jobSize = paintingData.height / numOfThreads;
            const int jobsWithExtra = paintingData.height % numOfThreads;

when numOfThreads > paintingData.height, because you end up with jobSize=0 and jobsWithExtra = paintingData.height, but we loop on numOfThreads.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180120/7ea2960b/attachment.html>