Ensure that SkMemoryStream does not crash dereferencing fData.

SkMemoryStream attempts to dereference fData in multiple places.
Instead of allowing it to be NULL, resulting in a crash, set it
to SkData::NewEmpty().

Add a test for SkStream that will crash when its SkData is set to NULL.

Review URL: https://codereview.appspot.com/7061059

git-svn-id: http://skia.googlecode.com/svn/trunk@7111 2bbb7eff-a529-9590-31e7-b0007b416f81

1 files changed, 14 insertions, 4 deletions

diff --git a/src/core/SkStream.cpp b/src/core/SkStream.cpp
index 2851e5fec3..f173b9e8c6 100644
--- a/src/core/SkStream.cpp
+++ b/src/core/SkStream.cpp
@@ -299,9 +299,13 @@ SkMemoryStream::SkMemoryStream(const void* src, size_t size, bool copyData) {
     fOffset = 0;
 }
 
-SkMemoryStream::SkMemoryStream(SkData *data) {
-    fData = SkSafeRef(data);
-    fOffset = 0;
+SkMemoryStream::SkMemoryStream(SkData* data) {
+    if (NULL == data) {
+        fData = SkData::NewEmpty();
+    } else {
+        fData = data;
+        fData->ref();
+    }
 }
 
 SkMemoryStream::~SkMemoryStream() {
@@ -326,7 +330,13 @@ SkData* SkMemoryStream::copyToData() const {
 }
 
 SkData* SkMemoryStream::setData(SkData* data) {
-    SkRefCnt_SafeAssign(fData, data);
+    fData->unref();
+    if (NULL == data) {
+        fData = SkData::NewEmpty();
+    } else {
+        fData = data;
+        fData->ref();
+    }
     return data;
 }