commit 4a9b4143baed7ab31d426be12c31cb4082014bd5
author herb <herb@google.com> Wed Mar 29 12:12:42 2017 -0400
committer Herb Derby <herb@google.com> Wed Mar 29 16:57:15 2017 +0000
tree f1510e2a183459adff9f36b54435aa05da0aa4c6
parent 98b82dd9c5e1e4a658ace6e1907c4add37961ed3

Fix overflow bug in slow span.

Fix an overflow in the address calculation in the sampler.

BUG=chromium:700836

TBR=hcm@google.com

Change-Id: Ifadbdc9541138219e8aec08c1342a241da75705c
Reviewed-on: https://skia-review.googlesource.com/9815
Reviewed-by: Mike Reed <reed@google.com>
Commit-Queue: Herb Derby <herb@google.com>
Reviewed-on: https://skia-review.googlesource.com/10479
Reviewed-by: Herb Derby <herb@google.com>

src/core/SkLinearBitmapPipeline_sample.h

diff --git a/src/core/SkLinearBitmapPipeline_sample.h b/src/core/SkLinearBitmapPipeline_sample.h
index 0bfe8f2..a7f5d73 100644
--- a/src/core/SkLinearBitmapPipeline_sample.h
+++ b/src/core/SkLinearBitmapPipeline_sample.h
@@ -13,7 +13,7 @@
 #include "SkAutoMalloc.h"
 #include "SkColor.h"
 #include "SkColorPriv.h"
-#include "SkFixed.h"
+#include "SkFixed.h"  // for SkFixed1 only. Don't use SkFixed in this file.
 #include "SkHalf.h"
 #include "SkLinearBitmapPipeline_core.h"
 #include "SkNx.h"
@@ -388,15 +388,17 @@
         SkPoint start; SkScalar length; int count;
         std::tie(start, length, count) = span;
         SkScalar x = X(start);
-        SkFixed fx = SkScalarToFixed(x);
+        // fx is a fixed 48.16 number.
+        int64_t fx = static_cast<int64_t>(x * SK_Fixed1);
         SkScalar dx = length / (count - 1);
-        SkFixed fdx = SkScalarToFixed(dx);
+        // fdx is a fixed 48.16 number.
+        int64_t fdx = static_cast<int64_t>(dx * SK_Fixed1);
 
         const void* row = fAccessor.row((int)std::floor(Y(start)));
         Next* next = fNext;
 
-        int ix = SkFixedFloorToInt(fx);
-        int prevIX = ix;
+        int64_t ix = fx >> 16;
+        int64_t prevIX = ix;
         Sk4f fpixel = fAccessor.getPixelFromRow(row, ix);
 
         // When dx is less than one, each pixel is used more than once. Using the fixed point fx
@@ -408,7 +410,7 @@
                 prevIX = ix;
             }
             fx += fdx;
-            ix = SkFixedFloorToInt(fx);
+            ix = fx >> 16;
             return fpixel;
         };