* fixed the crashing result of bug #634, check if the supplied region

falls within the frame buffer bounds. This should not happen, and
  I am going to search for the cause next, but at least app_server
  dosn't crash anymore in this context. Left a comment on my findings
  so far.


git-svn-id: file:///srv/svn/repos/haiku/haiku/trunk@22721 a95241bf-73f2-0310-859d-f6bbb57e9c96

src/servers/app/drawing/DrawingEngine.cpp

@@ -741,6 +741,20 @@ DrawingEngine::FillRegion(BRegion& r, const rgb_color& color)
 
 	// NOTE: region expected to be already clipped correctly!!
 	BRect frame = r.Frame();
+	if (!fPainter->Bounds().Contains(frame)) {
+		// NOTE: I am not quite sure yet how this can happen, but appearantly it can (see bug 634)
+		// This function is used for internal app_server painting, in the case of bug 634,
+		// the background of views is painted. But the view region should never be outside the
+		// frame buffer bounds.
+//		char message[1024];
+//		BRect bounds = fPainter->Bounds();
+//		sprintf(message, "FillRegion() - painter: (%d, %d)->(%d, %d), region: (%d, %d)->(%d, %d)",
+//			(int)bounds.left, (int)bounds.top, (int)bounds.right, (int)bounds.bottom,
+//			(int)frame.left, (int)frame.top, (int)frame.right, (int)frame.bottom);
+//		debugger(message);
+		return;
+	}
+
 	bool cursorTouched = fGraphicsCard->HideSoftwareCursor(frame);
 
 	// try hardware optimized version first
@@ -751,7 +765,7 @@ DrawingEngine::FillRegion(BRegion& r, const rgb_color& color)
 	} else {
 		int32 count = r.CountRects();
 		for (int32 i = 0; i < count; i++) {
-			fPainter->FillRectNoClipping(r.RectAt(i), color);
+			fPainter->FillRectNoClipping(r.RectAtInt(i), color);
 		}
 
 		fGraphicsCard->Invalidate(frame);

src/servers/app/drawing/Painter/Painter.cpp

@@ -117,6 +117,13 @@ Painter::DetachFromBuffer()
 {
 }
 
+// Bounds
+BRect
+Painter::Bounds() const
+{
+	return BRect(0, 0, fBuffer.width() - 1, fBuffer.height() - 1);
+}
+
 // #pragma mark -
 
 // SetDrawState
@@ -719,15 +726,13 @@ gfxset32(offset + y1 * bpr, color.data32, (x2 - x1 + 1) * 4);
 
 // FillRectNoClipping
 void
-Painter::FillRectNoClipping(const BRect& r, const rgb_color& c) const
+Painter::FillRectNoClipping(const clipping_rect& r, const rgb_color& c) const
 {
-	int32 left = (int32)r.left;
 	int32 y = (int32)r.top;
-	int32 right = (int32)r.right;
-	int32 bottom = (int32)r.bottom;
 
-	uint8* dst = fBuffer.row_ptr(y);
+	uint8* dst = fBuffer.row_ptr(y) + r.left * 4;
 	uint32 bpr = fBuffer.stride();
+	int32 bytes = (r.right - r.left + 1) * 4;
 
 	// get a 32 bit pixel ready with the color
 	pixel32 color;
@@ -736,14 +741,12 @@ Painter::FillRectNoClipping(const BRect& r, const rgb_color& c) const
 	color.data8[2] = c.red;
 	color.data8[3] = c.alpha;
 
-	dst += left * 4;
+	for (; y <= r.bottom; y++) {
-
-	for (; y <= bottom; y++) {
 //			uint32* handle = (uint32*)dst;
 //			for (int32 x = left; x <= right; x++) {
 //				*handle++ = color.data32;
 //			}
-gfxset32(dst, color.data32, (right - left + 1) * 4);
+gfxset32(dst, color.data32, bytes);
 		dst += bpr;
 	}
 }

src/servers/app/drawing/Painter/Painter.h

@@ -41,6 +41,7 @@ class Painter {
 								// frame buffer stuff
 			void				AttachToBuffer(RenderingBuffer* buffer);
 			void				DetachFromBuffer();
+			BRect				Bounds() const;
 
 			void				ConstrainClipping(const BRegion* region);
 			const BRegion*		ClippingRegion() const
@@ -130,7 +131,7 @@ class Painter {
 			void				FillRect(		const BRect& r,
 												const rgb_color& c) const;
 			// fills a solid rect with color c, no blending, no clipping
-			void				FillRectNoClipping(const BRect& r,
+			void				FillRectNoClipping(const clipping_rect& r,
 												const rgb_color& c) const;
 
 								// round rects