6 files changed, 13 insertions, 4 deletions
diff --git a/include/core/SkPicture.h b/include/core/SkPicture.h
index 1dcbcc5b75..c398d3a4ec 100644
--- a/include/core/SkPicture.h
+++ b/include/core/SkPicture.h
@@ -247,7 +247,7 @@ private:
     static bool IsValidPictInfo(const SkPictInfo& info);
     static sk_sp<SkPicture> Forwardport(const SkPictInfo&,
                                         const SkPictureData*,
-                                        const SkReadBuffer* buffer);
+                                        SkReadBuffer* buffer);
 
     SkPictInfo createHeader() const;
     SkPictureData* backport() const;
diff --git a/src/core/SkPicture.cpp b/src/core/SkPicture.cpp
index 5409eb3465..60987b64c0 100644
--- a/src/core/SkPicture.cpp
+++ b/src/core/SkPicture.cpp
@@ -157,7 +157,7 @@ bool SkPicture::InternalOnly_BufferIsSKP(SkReadBuffer* buffer, SkPictInfo* pInfo
 
 sk_sp<SkPicture> SkPicture::Forwardport(const SkPictInfo& info,
                                         const SkPictureData* data,
-                                        const SkReadBuffer* buffer) {
+                                        SkReadBuffer* buffer) {
     if (!data) {
         return nullptr;
     }
diff --git a/src/core/SkPictureData.h b/src/core/SkPictureData.h
index 0e351509bc..353bbd9357 100644
--- a/src/core/SkPictureData.h
+++ b/src/core/SkPictureData.h
@@ -117,6 +117,9 @@ public:
 
     const SkPaint* getPaint(SkReadBuffer* reader) const {
         const int index = reader->readInt() - 1;
+        if (index == -1) {  // recorder wrote a zero for no paint (likely drawimage)
+            return nullptr;
+        }
         return reader->validateIndex(index, fPaints.count()) ? &fPaints[index] : nullptr;
     }
 
diff --git a/src/core/SkPicturePlayback.cpp b/src/core/SkPicturePlayback.cpp
index 2ffb6c20d1..1aa4712d4f 100644
--- a/src/core/SkPicturePlayback.cpp
+++ b/src/core/SkPicturePlayback.cpp
@@ -82,7 +82,7 @@ void get_text(SkReadBuffer* reader, TextContainer* text) {
 
 void SkPicturePlayback::draw(SkCanvas* canvas,
                              SkPicture::AbortCallback* callback,
-                             const SkReadBuffer* buffer) {
+                             SkReadBuffer* buffer) {
     AutoResetOpID aroi(this);
     SkASSERT(0 == fCurOffset);
 
@@ -114,6 +114,11 @@ void SkPicturePlayback::draw(SkCanvas* canvas,
 
         this->handleOp(reader, op, size, canvas, initialMatrix);
     }
+
+    // need to propagate invalid state to the parent reader
+    if (buffer) {
+        buffer->validate(reader->isValid());
+    }
 }
 
 void SkPicturePlayback::handleOp(SkReadBuffer* reader,
diff --git a/src/core/SkPicturePlayback.h b/src/core/SkPicturePlayback.h
index 6daeeeefd8..6bc13bf74f 100644
--- a/src/core/SkPicturePlayback.h
+++ b/src/core/SkPicturePlayback.h
@@ -23,7 +23,7 @@ public:
         , fCurOffset(0) {
     }
 
-    void draw(SkCanvas* canvas, SkPicture::AbortCallback*, const SkReadBuffer* buffer);
+    void draw(SkCanvas* canvas, SkPicture::AbortCallback*, SkReadBuffer* buffer);
 
     // TODO: remove the curOp calls after cleaning up GrGatherDevice
     // Return the ID of the operation currently being executed when playing
diff --git a/tests/SerializationTest.cpp b/tests/SerializationTest.cpp
index 24cab3f3fc..9e407015b9 100644
--- a/tests/SerializationTest.cpp
+++ b/tests/SerializationTest.cpp
@@ -566,6 +566,7 @@ DEF_TEST(Serialization, reporter) {
         // Deserialize picture
         SkValidatingReadBuffer reader(static_cast<void*>(data.get()), size);
         sk_sp<SkPicture> readPict(SkPicture::MakeFromBuffer(reader));
+        REPORTER_ASSERT(reporter, reader.isValid());
         REPORTER_ASSERT(reporter, readPict.get());
     }