commit ae8e0634a89403bdad4049b14712fd18e2a1971d
author Brian Osman <brianosman@google.com> Mon Jul 26 16:07:35 2021 -0400
committer SkCQ <skcq-be@skia-corp.google.com.iam.gserviceaccount.com> Tue Jul 27 14:30:42 2021 +0000
tree e35219ceb213a3bfcadcebcb790e660fcc4d8c12
parent e33845317bf21e47713bdf819387a1c6e66ab787

Reject degenerate quads in AA hairline path renderer

Includes unit test that reproduces the original bug.

Bug: chromium:1232834
Change-Id: Iae2f52b42d35f0774c4cf9fa686df7aaf57c130a
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/433279
Reviewed-by: Brian Salomon <bsalomon@google.com>
Commit-Queue: Brian Osman <brianosman@google.com>

src/gpu/ops/GrAAHairLinePathRenderer.cpp

diff --git a/src/gpu/ops/GrAAHairLinePathRenderer.cpp b/src/gpu/ops/GrAAHairLinePathRenderer.cpp
index e60558e..d128092 100644
--- a/src/gpu/ops/GrAAHairLinePathRenderer.cpp
+++ b/src/gpu/ops/GrAAHairLinePathRenderer.cpp
@@ -1266,6 +1266,9 @@
         int unsubdivQuadCnt = quads.count() / 3;
         for (int i = 0; i < unsubdivQuadCnt; ++i) {
             SkASSERT(qSubdivs[i] >= 0);
+            if (!quads[3*i].isFinite() || !quads[3*i+1].isFinite() || !quads[3*i+2].isFinite()) {
+                return;
+            }
             add_quads(&quads[3*i], qSubdivs[i], toDevice, toSrc, &bezVerts);
         }
 

tests/GpuDrawPathTest.cpp

diff --git a/tests/GpuDrawPathTest.cpp b/tests/GpuDrawPathTest.cpp
index f3e5dc3..d71ea2f 100644
--- a/tests/GpuDrawPathTest.cpp
+++ b/tests/GpuDrawPathTest.cpp
@@ -112,3 +112,21 @@
     surface->getCanvas()->drawPath(path, paint);
     surface->flushAndSubmit();
 }
+
+DEF_GPUTEST_FOR_ALL_CONTEXTS(PathTest_CrBug1232834, reporter, ctxInfo) {
+    // GrAAHairlinePathRenderer chops this path to quads that include infinities (and then NaNs).
+    // It used to trigger asserts, now the degenerate quad segments should cause it to be rejected.
+    SkImageInfo info = SkImageInfo::MakeN32Premul(256, 256);
+    auto surface(SkSurface::MakeRenderTarget(ctxInfo.directContext(), SkBudgeted::kNo, info));
+
+    SkPaint paint;
+    paint.setAntiAlias(true);
+    paint.setStyle(SkPaint::kStroke_Style);
+
+    SkPath path;
+    path.moveTo(9.0072E15f, 60);
+    path.cubicTo(0, 3.40282e+38f, 0, 3.40282e+38f, 0, 0);
+
+    surface->getCanvas()->drawPath(path, paint);
+    surface->flushAndSubmit();
+}