1 files changed, 33 insertions, 32 deletions

diff --git a/src/core/SkPicturePlayback.cpp b/src/core/SkPicturePlayback.cpp
index 9a9aed3192..a2260952d7 100644
--- a/src/core/SkPicturePlayback.cpp
+++ b/src/core/SkPicturePlayback.cpp
@@ -7,6 +7,7 @@
 
 #include "SkCanvas.h"
 #include "SkDrawShadowInfo.h"
+#include "SkPaintPriv.h"
 #include "SkPatchUtils.h"
 #include "SkPictureData.h"
 #include "SkPicturePlayback.h"
@@ -70,20 +71,28 @@ static const SkRect* get_rect_ptr(SkReadBuffer* reader, SkRect* storage) {
 
 class TextContainer {
 public:
-    size_t length() { return fByteLength; }
-    const void* text() { return (const void*)fText; }
-    size_t fByteLength;
-    const char* fText;
-
-    bool validate(SkReadBuffer* reader, int count, const SkPaint& paint) const {
-        return reader->validate(paint.countText(fText, fByteLength) == count);
+    TextContainer(SkReadBuffer* reader, const SkPaint* paint) {
+        if (reader->validate(paint != nullptr)) {
+            fByteLength = reader->readInt();
+            fText = (const char*)reader->skip(fByteLength);
+            if (reader->isValid()) {
+                fCount = SkPaintPriv::ValidCountText(fText, fByteLength, paint->getTextEncoding());
+                reader->validate(fCount >= 0);
+            }
+        }
     }
-};
 
-void get_text(SkReadBuffer* reader, TextContainer* text) {
-    size_t length = text->fByteLength = reader->readInt();
-    text->fText = (const char*)reader->skip(length);
-}
+    operator bool() const { return fCount >= 0; }
+
+    size_t length() const { return fByteLength; }
+    const void* text() const { return (const void*)fText; }
+    unsigned count() const { return fCount; }
+
+private:
+    size_t fByteLength = 0;
+    const char* fText = nullptr;
+    int fCount = -1;
+};
 
 void SkPicturePlayback::draw(SkCanvas* canvas,
                              SkPicture::AbortCallback* callback,
@@ -480,10 +489,9 @@ void SkPicturePlayback::handleOp(SkReadBuffer* reader,
         } break;
         case DRAW_POS_TEXT: {
             const SkPaint* paint = fPictureData->getPaint(reader);
-            TextContainer text;
-            get_text(reader, &text);
+            TextContainer text(reader, paint);
             size_t points = reader->readInt();
-            text.validate(reader, points, *paint);
+            reader->validate(points == text.count());
             const SkPoint* pos = (const SkPoint*)reader->skip(points * sizeof(SkPoint));
             BREAK_ON_READ_ERROR(reader);
 
@@ -493,10 +501,9 @@ void SkPicturePlayback::handleOp(SkReadBuffer* reader,
         } break;
         case DRAW_POS_TEXT_TOP_BOTTOM: {
             const SkPaint* paint = fPictureData->getPaint(reader);
-            TextContainer text;
-            get_text(reader, &text);
+            TextContainer text(reader, paint);
             size_t points = reader->readInt();
-            text.validate(reader, points, *paint);
+            reader->validate(points == text.count());
             const SkPoint* pos = (const SkPoint*)reader->skip(points * sizeof(SkPoint));
             const SkScalar top = reader->readScalar();
             const SkScalar bottom = reader->readScalar();
@@ -510,10 +517,9 @@ void SkPicturePlayback::handleOp(SkReadBuffer* reader,
         } break;
         case DRAW_POS_TEXT_H: {
             const SkPaint* paint = fPictureData->getPaint(reader);
-            TextContainer text;
-            get_text(reader, &text);
+            TextContainer text(reader, paint);
             size_t xCount = reader->readInt();
-            text.validate(reader, xCount, *paint);
+            reader->validate(xCount == text.count());
             const SkScalar constY = reader->readScalar();
             const SkScalar* xpos = (const SkScalar*)reader->skip(xCount * sizeof(SkScalar));
             BREAK_ON_READ_ERROR(reader);
@@ -524,10 +530,9 @@ void SkPicturePlayback::handleOp(SkReadBuffer* reader,
         } break;
         case DRAW_POS_TEXT_H_TOP_BOTTOM: {
             const SkPaint* paint = fPictureData->getPaint(reader);
-            TextContainer text;
-            get_text(reader, &text);
+            TextContainer text(reader, paint);
             size_t xCount = reader->readInt();
-            text.validate(reader, xCount, *paint);
+            reader->validate(xCount == text.count());
             const SkScalar* xpos = (const SkScalar*)reader->skip((3 + xCount) * sizeof(SkScalar));
             BREAK_ON_READ_ERROR(reader);
 
@@ -592,8 +597,7 @@ void SkPicturePlayback::handleOp(SkReadBuffer* reader,
         } break;
         case DRAW_TEXT: {
             const SkPaint* paint = fPictureData->getPaint(reader);
-            TextContainer text;
-            get_text(reader, &text);
+            TextContainer text(reader, paint);
             SkScalar x = reader->readScalar();
             SkScalar y = reader->readScalar();
             BREAK_ON_READ_ERROR(reader);
@@ -615,8 +619,7 @@ void SkPicturePlayback::handleOp(SkReadBuffer* reader,
         } break;
         case DRAW_TEXT_TOP_BOTTOM: {
             const SkPaint* paint = fPictureData->getPaint(reader);
-            TextContainer text;
-            get_text(reader, &text);
+            TextContainer text(reader, paint);
             const SkScalar* ptr = (const SkScalar*)reader->skip(4 * sizeof(SkScalar));
             BREAK_ON_READ_ERROR(reader);
 
@@ -633,8 +636,7 @@ void SkPicturePlayback::handleOp(SkReadBuffer* reader,
         } break;
         case DRAW_TEXT_ON_PATH: {
             const SkPaint* paint = fPictureData->getPaint(reader);
-            TextContainer text;
-            get_text(reader, &text);
+            TextContainer text(reader, paint);
             const SkPath& path = fPictureData->getPath(reader);
             SkMatrix matrix;
             reader->readMatrix(&matrix);
@@ -648,8 +650,7 @@ void SkPicturePlayback::handleOp(SkReadBuffer* reader,
             const SkPaint* paint = fPictureData->getPaint(reader);
             int count = reader->readInt();
             uint32_t flags = reader->read32();
-            TextContainer text;
-            get_text(reader, &text);
+            TextContainer text(reader, paint);
             const SkRSXform* xform = (const SkRSXform*)reader->skip(count * sizeof(SkRSXform));
             const SkRect* cull = nullptr;
             if (flags & DRAW_TEXT_RSXFORM_HAS_CULL) {