diff options
| author |  Stephen White <senorblanco@chromium.org> | 2018-05-18 11:49:21 -0400 |
|---|---|---|
| committer |  Skia Commit-Bot <skia-commit-bot@chromium.org> | 2018-05-18 17:42:24 +0000 |
| commit | ec79c39a770205910f0abd762de7e19a96c986ca (patch) | |
| tree | 13db1c8bdf6ac72e2c49e21f318a339621e0a743 /src/gpu/GrTessellator.cpp | |
| parent | 13197b8d4f1000249fa98b587c047d35f4ab1cf2 (diff) | |
GrTessellator: fix for zombie edge fuzzer crash.
While splitting one edge, merge_collinear_edges() may in rare cases
merge the other edge of the intersection out of existence.
split_edge() then brings these dead edges partially back to life,
leaving the mesh in an inconsistent state.
The fix is to null out the top and bottom pointers of dead edges to
mark them as dead, and only split living edges.
Bug: skia:7911
Change-Id: I1c0b59581acfcd0b8191f2d129b33f7d0d1a2516
Reviewed-on: https://skia-review.googlesource.com/129181
Reviewed-by: Robert Phillips <robertphillips@google.com>
Commit-Queue: Stephen White <senorblanco@chromium.org>
Diffstat (limited to 'src/gpu/GrTessellator.cpp')
| -rw-r--r-- | src/gpu/GrTessellator.cpp | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/src/gpu/GrTessellator.cpp b/src/gpu/GrTessellator.cpp index 1125ef44b2..fd7bf5133a 100644 --- a/src/gpu/GrTessellator.cpp +++ b/src/gpu/GrTessellator.cpp @@ -1013,6 +1013,7 @@ void merge_edges_above(Edge* edge, Edge* other, EdgeList* activeEdges, Vertex** rewind(activeEdges, current, edge->fTop, c); other->fWinding += edge->fWinding; disconnect(edge); + edge->fTop = edge->fBottom = nullptr; } else if (c.sweep_lt(edge->fTop->fPoint, other->fTop->fPoint)) { rewind(activeEdges, current, edge->fTop, c); other->fWinding += edge->fWinding; @@ -1033,6 +1034,7 @@ void merge_edges_below(Edge* edge, Edge* other, EdgeList* activeEdges, Vertex** rewind(activeEdges, current, edge->fTop, c); other->fWinding += edge->fWinding; disconnect(edge); + edge->fTop = edge->fBottom = nullptr; } else if (c.sweep_lt(edge->fBottom->fPoint, other->fBottom->fPoint)) { rewind(activeEdges, current, other->fTop, c); edge->fWinding += other->fWinding; @@ -1070,7 +1072,7 @@ void merge_collinear_edges(Edge* edge, EdgeList* activeEdges, Vertex** current, void split_edge(Edge* edge, Vertex* v, EdgeList* activeEdges, Vertex** current, Comparator& c, SkArenaAlloc& alloc) { - if (v == edge->fTop || v == edge->fBottom) { + if (!edge->fTop || !edge->fBottom || v == edge->fTop || v == edge->fBottom) { return; } LOG("splitting edge (%g -> %g) at vertex %g (%g, %g)\n", |