From ec79c39a770205910f0abd762de7e19a96c986ca Mon Sep 17 00:00:00 2001 From: Stephen White Date: Fri, 18 May 2018 11:49:21 -0400 Subject: GrTessellator: fix for zombie edge fuzzer crash. While splitting one edge, merge_collinear_edges() may in rare cases merge the other edge of the intersection out of existence. split_edge() then brings these dead edges partially back to life, leaving the mesh in an inconsistent state. The fix is to null out the top and bottom pointers of dead edges to mark them as dead, and only split living edges. Bug: skia:7911 Change-Id: I1c0b59581acfcd0b8191f2d129b33f7d0d1a2516 Reviewed-on: https://skia-review.googlesource.com/129181 Reviewed-by: Robert Phillips Commit-Queue: Stephen White --- tests/TessellatingPathRendererTests.cpp | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'tests/TessellatingPathRendererTests.cpp') diff --git a/tests/TessellatingPathRendererTests.cpp b/tests/TessellatingPathRendererTests.cpp index 0ff0af71e0..27dc7e5e4c 100644 --- a/tests/TessellatingPathRendererTests.cpp +++ b/tests/TessellatingPathRendererTests.cpp @@ -472,6 +472,20 @@ static SkPath create_path_31() { return path; } +// Reduction from skbug.com/7911 that causes a crash due to splitting a +// zombie edge. +static SkPath create_path_32() { + SkPath path; + path.moveTo( 0, 1.0927740941146660348e+24); + path.lineTo(2.9333931225865729333e+32, 16476101); + path.lineTo(1.0927731573659435417e+24, 1.0927740941146660348e+24); + path.lineTo(1.0927740941146660348e+24, 3.7616281094287041715e-37); + path.lineTo(1.0927740941146660348e+24, 1.0927740941146660348e+24); + path.lineTo(1.3061803026169399536e-33, 1.0927740941146660348e+24); + path.lineTo(4.7195362919941370727e-16, -8.4247545146051822591e+32); + return path; +} + static std::unique_ptr create_linear_gradient_processor(GrContext* ctx) { SkPoint pts[2] = { {0, 0}, {1, 1} }; @@ -563,5 +577,6 @@ DEF_GPUTEST_FOR_ALL_CONTEXTS(TessellatingPathRendererTests, reporter, ctxInfo) { test_path(ctx, rtc.get(), create_path_29()); test_path(ctx, rtc.get(), create_path_30()); test_path(ctx, rtc.get(), create_path_31(), SkMatrix(), GrAAType::kCoverage); + test_path(ctx, rtc.get(), create_path_32()); } #endif -- cgit v1.2.3