detect nonfinite cubic points

Bug: oss-fuzz:7031
Cq-Include-Trybots: skia.primary:Test-Debian9-Clang-GCE-CPU-AVX2-x86_64-Release-All-SKNX_NO_SIMD
Change-Id: I657c0652dc863256f445a84c084ccc37d287f534
Reviewed-on: https://skia-review.googlesource.com/115222
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Mike Reed <reed@google.com>

1 files changed, 15 insertions, 3 deletions

diff --git a/src/core/SkScan_Hairline.cpp b/src/core/SkScan_Hairline.cpp
index 7954ccc5a2..815130d532 100644
--- a/src/core/SkScan_Hairline.cpp
+++ b/src/core/SkScan_Hairline.cpp
@@ -345,6 +345,13 @@ static bool quick_cubic_niceness_check(const SkPoint pts[4]) {
            lt_90(pts[2], pts[3], pts[0]);
 }
 
+typedef SkNx<2, uint32_t> Sk2x32;
+
+static inline Sk2x32 sk2s_is_finite(const Sk2s& x) {
+    const Sk2x32 exp_mask = Sk2x32(0xFF << 23);
+    return (Sk2x32::Load(&x) & exp_mask) != exp_mask;
+}
+
 static void hair_cubic(const SkPoint pts[4], const SkRegion* clip, SkBlitter* blitter,
                        SkScan::HairRgnProc lineproc) {
     const int lines = compute_cubic_segs(pts);
@@ -368,12 +375,17 @@ static void hair_cubic(const SkPoint pts[4], const SkRegion* clip, SkBlitter* bl
     Sk2s B = coeff.fB;
     Sk2s C = coeff.fC;
     Sk2s D = coeff.fD;
+    Sk2x32 is_finite(~0);   // start out as true
     for (int i = 1; i < lines; ++i) {
         t = t + dt;
-        (((A * t + B) * t + C) * t + D).store(&tmp[i]);
+        Sk2s p = ((A * t + B) * t + C) * t + D;
+        is_finite &= sk2s_is_finite(p);
+        p.store(&tmp[i]);
     }
-    tmp[lines] = pts[3];
-    lineproc(tmp, lines + 1, clip, blitter);
+    if (is_finite.allTrue()) {
+        tmp[lines] = pts[3];
+        lineproc(tmp, lines + 1, clip, blitter);
+    } // else some point(s) are non-finite, so don't draw
 }
 
 static SkRect compute_nocheck_cubic_bounds(const SkPoint pts[4]) {