GrTessellator: fix crash on merging a dead edge.

When merging coincident vertices, sometimes merging an edge will cause
the next edge in the list to die. But since merge_vertices() retrieves
the next edge before merging the current one, we then try to merge its
lifeless corpse, bringing it back as a zombie. The fix is to leave
dead edges, dead.

This was revealed by ec79c39a770205910f0abd762de7e19a96c986ca, but was
likely a real bug that was being mishandled before that.

Bug: 844873
Bug: skia:7982
Change-Id: I752c45f7551df4278fa4cb4587e7ead48cd16a21
Reviewed-on: https://skia-review.googlesource.com/129524
Commit-Queue: Stephen White <senorblanco@chromium.org>
Reviewed-by: Robert Phillips <robertphillips@google.com>

2 files changed, 21 insertions, 6 deletions

diff --git a/src/gpu/GrTessellator.cpp b/src/gpu/GrTessellator.cpp
index d3c2578da5..308d5bcc36 100644
--- a/src/gpu/GrTessellator.cpp
+++ b/src/gpu/GrTessellator.cpp
@@ -908,6 +908,7 @@ void insert_edge_below(Edge* edge, Vertex* v, Comparator& c) {
 }
 
 void remove_edge_above(Edge* edge) {
+    SkASSERT(edge->fTop && edge->fBottom);
     LOG("removing edge (%g -> %g) above vertex %g\n", edge->fTop->fID, edge->fBottom->fID,
         edge->fBottom->fID);
     list_remove<Edge, &Edge::fPrevEdgeAbove, &Edge::fNextEdgeAbove>(
@@ -915,6 +916,7 @@ void remove_edge_above(Edge* edge) {
 }
 
 void remove_edge_below(Edge* edge) {
+    SkASSERT(edge->fTop && edge->fBottom);
     LOG("removing edge (%g -> %g) below vertex %g\n", edge->fTop->fID, edge->fBottom->fID,
         edge->fTop->fID);
     list_remove<Edge, &Edge::fPrevEdgeBelow, &Edge::fNextEdgeBelow>(
@@ -1120,15 +1122,11 @@ void merge_vertices(Vertex* src, Vertex* dst, VertexList* mesh, Comparator& c,
     if (src->fPartner) {
         src->fPartner->fPartner = dst;
     }
-    for (Edge* edge = src->fFirstEdgeAbove; edge;) {
-        Edge* next = edge->fNextEdgeAbove;
+    while (Edge* edge = src->fFirstEdgeAbove) {
         set_bottom(edge, dst, nullptr, nullptr, c);
-        edge = next;
     }
-    for (Edge* edge = src->fFirstEdgeBelow; edge;) {
-        Edge* next = edge->fNextEdgeBelow;
+    while (Edge* edge = src->fFirstEdgeBelow) {
         set_top(edge, dst, nullptr, nullptr, c);
-        edge = next;
     }
     mesh->remove(src);
 }
diff --git a/tests/TessellatingPathRendererTests.cpp b/tests/TessellatingPathRendererTests.cpp
index 27dc7e5e4c..00f43985dd 100644
--- a/tests/TessellatingPathRendererTests.cpp
+++ b/tests/TessellatingPathRendererTests.cpp
@@ -486,6 +486,22 @@ static SkPath create_path_32() {
     return path;
 }
 
+// From crbug.com/844873. Crashes trying to merge a zombie edge.
+static SkPath create_path_33() {
+    SkPath path;
+    path.moveTo( 316.000579833984375, -4338355948977389568);
+    path.lineTo(1.5069369808623501312e+20, 75180972320904708096.0);
+    path.lineTo(1.5069369808623501312e+20, 75180972320904708096.0);
+    path.lineTo(  771.21014404296875, -4338355948977389568.0);
+    path.lineTo( 316.000579833984375, -4338355948977389568.0);
+    path.moveTo(       354.208984375, -4338355948977389568.0);
+    path.lineTo(  773.00177001953125, -4338355948977389568.0);
+    path.lineTo(1.5069369808623501312e+20, 75180972320904708096.0);
+    path.lineTo(1.5069369808623501312e+20, 75180972320904708096.0);
+    path.lineTo(       354.208984375, -4338355948977389568.0);
+    return path;
+}
+
 static std::unique_ptr<GrFragmentProcessor> create_linear_gradient_processor(GrContext* ctx) {
 
     SkPoint pts[2] = { {0, 0}, {1, 1} };
@@ -578,5 +594,6 @@ DEF_GPUTEST_FOR_ALL_CONTEXTS(TessellatingPathRendererTests, reporter, ctxInfo) {
     test_path(ctx, rtc.get(), create_path_30());
     test_path(ctx, rtc.get(), create_path_31(), SkMatrix(), GrAAType::kCoverage);
     test_path(ctx, rtc.get(), create_path_32());
+    test_path(ctx, rtc.get(), create_path_33());
 }
 #endif