From 93e3fff79eaaa86bc2fb740a42111a074ccc73ab Mon Sep 17 00:00:00 2001
From: senorblanco <senorblanco@chromium.org>
Date: Tue, 7 Jun 2016 12:36:00 -0700
Subject: Fix for rare crash in Poly::addEdge().

Don't add an edge if the bottom vertex was already added, or
if an island vertex has a left poly but no right poly.

(Sorry for the lack of test, but the only reduction I could create was still a huge path and only crashes in Chrome.)

BUG=617907
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2043873005

Review-Url: https://codereview.chromium.org/2043873005
---
 src/gpu/GrTessellator.cpp | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

(limited to 'src')

diff --git a/src/gpu/GrTessellator.cpp b/src/gpu/GrTessellator.cpp
index 25d1bb3a24..fc09c0c649 100644
--- a/src/gpu/GrTessellator.cpp
+++ b/src/gpu/GrTessellator.cpp
@@ -418,13 +418,12 @@ struct Poly {
         if (!fTail) {
             fHead = fTail = ALLOC_NEW(MonotonePoly, (e, side), alloc);
             fCount += 2;
+        } else if (e->fBottom == fTail->fLastEdge->fBottom) {
+            return poly;
         } else if (side == fTail->fSide) {
             fTail->addEdge(e);
             fCount++;
         } else {
-            if (e->fBottom == fTail->fLastEdge->fBottom) {
-                return poly;
-            }
             e = ALLOC_NEW(Edge, (fTail->fLastEdge->fBottom, e->fBottom, 1), alloc);
             fTail->addEdge(e);
             fCount++;
@@ -1240,7 +1239,7 @@ Poly* tessellate(Vertex* vertices, SkChunkAlloc& alloc) {
         }
         if (v->fFirstEdgeBelow) {
             if (!v->fFirstEdgeAbove) {
-                if (leftPoly) {
+                if (leftPoly && rightPoly) {
                     if (leftPoly == rightPoly) {
                         if (leftPoly->fTail && leftPoly->fTail->fSide == Poly::kLeft_Side) {
                             leftPoly = new_poly(&polys, leftPoly->lastVertex(),
-- 
cgit v1.2.3