commit 1b95ef9f99121f3978cfc9db4be1ed8255decc93
author Hal Canary <halcanary@google.com> Mon Aug 13 13:52:22 2018 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Mon Aug 13 19:57:18 2018 +0000
tree 2fd0a419b61985e14e55f5dd0f10648c8c3fdc48
parent beac4195ccb7c92aa6e76633a4e109ccb2cf85a4

SkRegion: Do not assume good input.

BUG=chromium:873051

Change-Id: I2b84bade333e101fade81994203640ddf724f550
Reviewed-on: https://skia-review.googlesource.com/147041
Auto-Submit: Hal Canary <halcanary@google.com>
Commit-Queue: Cary Clark <caryclark@google.com>
Reviewed-by: Cary Clark <caryclark@google.com>

src/core/SkRegion.cpp

diff --git a/src/core/SkRegion.cpp b/src/core/SkRegion.cpp
index 722346b..68aeaa2 100644
--- a/src/core/SkRegion.cpp
+++ b/src/core/SkRegion.cpp
@@ -189,14 +189,12 @@
 }
 
 bool SkRegion::setRect(const SkIRect& r) {
-    if (r.isEmpty()) {
+    if (r.isEmpty() ||
+        SkRegion_kRunTypeSentinel == r.right() ||
+        SkRegion_kRunTypeSentinel == r.bottom()) {
         return this->setEmpty();
     }
     this->freeRuns();
-    SkASSERT(r.left()   != SkRegion_kRunTypeSentinel);
-    SkASSERT(r.top()    != SkRegion_kRunTypeSentinel);
-    SkASSERT(r.right()  != SkRegion_kRunTypeSentinel);
-    SkASSERT(r.bottom() != SkRegion_kRunTypeSentinel);
     fBounds = r;
     fRunHead = SkRegion_gRectRunHeadPtr;
     return true;

tests/RegionTest.cpp

diff --git a/tests/RegionTest.cpp b/tests/RegionTest.cpp
index 0b8872a..d3d93d5 100644
--- a/tests/RegionTest.cpp
+++ b/tests/RegionTest.cpp
@@ -467,3 +467,10 @@
     rgn.setPath(path, SkRegion{SkIRect{0, 0, 24, 24}});
 }
 
+DEF_TEST(region_bug_chromium_873051, reporter) {
+    SkRegion region;
+    REPORTER_ASSERT(reporter,  region.setRect({0, 0, 0x7FFFFFFE, 0x7FFFFFFE}));
+    REPORTER_ASSERT(reporter, !region.setRect({0, 0, 0x7FFFFFFE, 0x7FFFFFFF}));
+    REPORTER_ASSERT(reporter, !region.setRect({0, 0, 0x7FFFFFFF, 0x7FFFFFFE}));
+    REPORTER_ASSERT(reporter, !region.setRect({0, 0, 0x7FFFFFFF, 0x7FFFFFFF}));
+}