tree da4d6a9e6e734116ea6108e44787e14fc6102195
parent 662d67133a239c7eddfb933fc2b020317131afca
author Mike Klein <mtklein@google.com> 1555171071 -0500
committer Skia Commit-Bot <skia-commit-bot@chromium.org> 1555349188 +0000

step carefully in decal_nofilter_scale

can_truncate_to_fixed_for_decal() is correct to check that we can step
fx by dx count-1 times without overflowing, but as written we actually
step count times, and sometimes the final fx does overflow.  Fuzzers
equipped with UBSAN have noticed.

There's no real bug here, as we ignore that final fx, but we can step
carefully to avoid this with very little impact on code complexity or
performance.

Bug: chromium:951264
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Change-Id: I5446dbdffdc5fa873c843c26654894bd79202971
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/207921
Commit-Queue: Mike Klein <mtklein@google.com>
Reviewed-by: Florin Malita <fmalita@chromium.org>
Auto-Submit: Mike Klein <mtklein@google.com>