diff options
| author |  Stephen White <senorblanco@chromium.org> | 2018-05-18 11:49:21 -0400 |
|---|---|---|
| committer |  Skia Commit-Bot <skia-commit-bot@chromium.org> | 2018-05-18 17:42:24 +0000 |
| commit | ec79c39a770205910f0abd762de7e19a96c986ca (patch) | |
| tree | 13db1c8bdf6ac72e2c49e21f318a339621e0a743 /tests/TessellatingPathRendererTests.cpp | |
| parent | 13197b8d4f1000249fa98b587c047d35f4ab1cf2 (diff) | |
GrTessellator: fix for zombie edge fuzzer crash.
While splitting one edge, merge_collinear_edges() may in rare cases
merge the other edge of the intersection out of existence.
split_edge() then brings these dead edges partially back to life,
leaving the mesh in an inconsistent state.
The fix is to null out the top and bottom pointers of dead edges to
mark them as dead, and only split living edges.
Bug: skia:7911
Change-Id: I1c0b59581acfcd0b8191f2d129b33f7d0d1a2516
Reviewed-on: https://skia-review.googlesource.com/129181
Reviewed-by: Robert Phillips <robertphillips@google.com>
Commit-Queue: Stephen White <senorblanco@chromium.org>
Diffstat (limited to 'tests/TessellatingPathRendererTests.cpp')
| -rw-r--r-- | tests/TessellatingPathRendererTests.cpp | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/tests/TessellatingPathRendererTests.cpp b/tests/TessellatingPathRendererTests.cpp index 0ff0af71e0..27dc7e5e4c 100644 --- a/tests/TessellatingPathRendererTests.cpp +++ b/tests/TessellatingPathRendererTests.cpp @@ -472,6 +472,20 @@ static SkPath create_path_31() { return path; } +// Reduction from skbug.com/7911 that causes a crash due to splitting a +// zombie edge. +static SkPath create_path_32() { + SkPath path; + path.moveTo( 0, 1.0927740941146660348e+24); + path.lineTo(2.9333931225865729333e+32, 16476101); + path.lineTo(1.0927731573659435417e+24, 1.0927740941146660348e+24); + path.lineTo(1.0927740941146660348e+24, 3.7616281094287041715e-37); + path.lineTo(1.0927740941146660348e+24, 1.0927740941146660348e+24); + path.lineTo(1.3061803026169399536e-33, 1.0927740941146660348e+24); + path.lineTo(4.7195362919941370727e-16, -8.4247545146051822591e+32); + return path; +} + static std::unique_ptr<GrFragmentProcessor> create_linear_gradient_processor(GrContext* ctx) { SkPoint pts[2] = { {0, 0}, {1, 1} }; @@ -563,5 +577,6 @@ DEF_GPUTEST_FOR_ALL_CONTEXTS(TessellatingPathRendererTests, reporter, ctxInfo) { test_path(ctx, rtc.get(), create_path_29()); test_path(ctx, rtc.get(), create_path_30()); test_path(ctx, rtc.get(), create_path_31(), SkMatrix(), GrAAType::kCoverage); + test_path(ctx, rtc.get(), create_path_32()); } #endif |