commit 3dad80308d1eaafc73e3081b311c42df789a4b72
author Michael Ludwig <michaelludwig@google.com> Mon Sep 28 11:24:05 2020 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Mon Sep 28 17:13:33 2020 +0000
tree bf47c5b21e2d1ffec6ab7cb1bc0ded43840a8707
parent 9c983682e40a961a3299039ad7279f4b4d597db7

Check SkRRect::transform result, don't assume S+T matrix is safe

Bug: chromium:1132739
Change-Id: I67b7ac535232925e98e44c0bb90964fded9f4d05
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/320068
Reviewed-by: Greg Daniel <egdaniel@google.com>
Commit-Queue: Michael Ludwig <michaelludwig@google.com>

src/gpu/GrClipStack.cpp

diff --git a/src/gpu/GrClipStack.cpp b/src/gpu/GrClipStack.cpp
index 1d7c9a0..0072727 100644
--- a/src/gpu/GrClipStack.cpp
+++ b/src/gpu/GrClipStack.cpp
@@ -570,16 +570,19 @@
                 SkASSERT(fOuterBounds.contains(fInnerBounds) || fInnerBounds.isEmpty());
             }
         } else if (fShape.isRRect()) {
-            // Can't transform in place
-            SkRRect src = fShape.rrect();
-            SkAssertResult(src.transform(fLocalToDevice, &fShape.rrect()));
-            fLocalToDevice.setIdentity();
-            fDeviceToLocal.setIdentity();
+            // Can't transform in place and must still check transform result since some very
+            // ill-formed scale+translate matrices can cause invalid rrect radii.
+            SkRRect src;
+            if (fShape.rrect().transform(fLocalToDevice, &src)) {
+                fShape.rrect() = src;
+                fLocalToDevice.setIdentity();
+                fDeviceToLocal.setIdentity();
 
-            SkRect inner = SkRRectPriv::InnerBounds(fShape.rrect());
-            fInnerBounds = GrClip::GetPixelIBounds(inner, fAA, BoundsType::kInterior);
-            if (!fInnerBounds.intersect(deviceBounds)) {
-                fInnerBounds = SkIRect::MakeEmpty();
+                SkRect inner = SkRRectPriv::InnerBounds(fShape.rrect());
+                fInnerBounds = GrClip::GetPixelIBounds(inner, fAA, BoundsType::kInterior);
+                if (!fInnerBounds.intersect(deviceBounds)) {
+                    fInnerBounds = SkIRect::MakeEmpty();
+                }
             }
         }
     }