commit 8051d38358293df1e5b8a1a513f8114147ec9fa3
author Robert Phillips <robertphillips@google.com> Thu Sep 13 08:22:15 2018 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Thu Sep 13 13:10:33 2018 +0000
tree f1b896f8ad9f67a816904da5165654b1b91eb14b
parent 637c06aec7b1f424c15db74639e8ed3a6759163b

Fix SkPath::reverseAddPath and fuzzing of SkPath enums

Bug: 882423
Change-Id: I2be2863574a5951b86e4d5e213094efee6081098
Reviewed-on: https://skia-review.googlesource.com/154300
Reviewed-by: Kevin Lubick <kjlubick@google.com>
Reviewed-by: Greg Daniel <egdaniel@google.com>
Commit-Queue: Robert Phillips <robertphillips@google.com>

src/core/SkPath.cpp

diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp
index 3470477..2808c12 100644
--- a/src/core/SkPath.cpp
+++ b/src/core/SkPath.cpp
@@ -1708,14 +1708,21 @@
     return *this;
 }
 
-SkPath& SkPath::reverseAddPath(const SkPath& src) {
-    SkPathRef::Editor ed(&fPathRef, src.fPathRef->countPoints(), src.fPathRef->countVerbs());
+SkPath& SkPath::reverseAddPath(const SkPath& srcPath) {
+    // Detect if we're trying to add ourself
+    const SkPath* src = &srcPath;
+    SkTLazy<SkPath> tmp;
+    if (this == src) {
+        src = tmp.set(srcPath);
+    }
 
-    const SkPoint* pts = src.fPathRef->pointsEnd();
+    SkPathRef::Editor ed(&fPathRef, src->fPathRef->countPoints(), src->fPathRef->countVerbs());
+
+    const SkPoint* pts = src->fPathRef->pointsEnd();
     // we will iterator through src's verbs backwards
-    const uint8_t* verbs = src.fPathRef->verbsMemBegin(); // points at the last verb
-    const uint8_t* verbsEnd = src.fPathRef->verbs(); // points just past the first verb
-    const SkScalar* conicWeights = src.fPathRef->conicWeightsEnd();
+    const uint8_t* verbs = src->fPathRef->verbsMemBegin(); // points at the last verb
+    const uint8_t* verbsEnd = src->fPathRef->verbs(); // points just past the first verb
+    const SkScalar* conicWeights = src->fPathRef->conicWeightsEnd();
 
     bool needMove = true;
     bool needClose = false;