commit 7b376940e4722f0da14807bd3b18823d0f7c1964
author Stephen White <senorblanco@chromium.org> Tue May 22 11:51:32 2018 -0400
committer Skia Commit-Bot <skia-commit-bot@chromium.org> Tue May 22 16:52:45 2018 +0000
tree 56c6b1c3fcacb6f9a07818626afbef7bb73fa18f
parent d26e446927051bc3eed3aed9e5e2db19e7122cf0

GrTessellator: fix crash on merging a dead edge.

When merging coincident vertices, sometimes merging an edge will cause
the next edge in the list to die. But since merge_vertices() retrieves
the next edge before merging the current one, we then try to merge its
lifeless corpse, bringing it back as a zombie. The fix is to leave
dead edges, dead.

This was revealed by ec79c39a770205910f0abd762de7e19a96c986ca, but was
likely a real bug that was being mishandled before that.

Bug: 844873
Bug: skia:7982
Change-Id: I752c45f7551df4278fa4cb4587e7ead48cd16a21
Reviewed-on: https://skia-review.googlesource.com/129524
Commit-Queue: Stephen White <senorblanco@chromium.org>
Reviewed-by: Robert Phillips <robertphillips@google.com>

tests/TessellatingPathRendererTests.cpp

diff --git a/tests/TessellatingPathRendererTests.cpp b/tests/TessellatingPathRendererTests.cpp
index 27dc7e5..00f4398 100644
--- a/tests/TessellatingPathRendererTests.cpp
+++ b/tests/TessellatingPathRendererTests.cpp
@@ -486,6 +486,22 @@
     return path;
 }
 
+// From crbug.com/844873. Crashes trying to merge a zombie edge.
+static SkPath create_path_33() {
+    SkPath path;
+    path.moveTo( 316.000579833984375, -4338355948977389568);
+    path.lineTo(1.5069369808623501312e+20, 75180972320904708096.0);
+    path.lineTo(1.5069369808623501312e+20, 75180972320904708096.0);
+    path.lineTo(  771.21014404296875, -4338355948977389568.0);
+    path.lineTo( 316.000579833984375, -4338355948977389568.0);
+    path.moveTo(       354.208984375, -4338355948977389568.0);
+    path.lineTo(  773.00177001953125, -4338355948977389568.0);
+    path.lineTo(1.5069369808623501312e+20, 75180972320904708096.0);
+    path.lineTo(1.5069369808623501312e+20, 75180972320904708096.0);
+    path.lineTo(       354.208984375, -4338355948977389568.0);
+    return path;
+}
+
 static std::unique_ptr<GrFragmentProcessor> create_linear_gradient_processor(GrContext* ctx) {
 
     SkPoint pts[2] = { {0, 0}, {1, 1} };
@@ -578,5 +594,6 @@
     test_path(ctx, rtc.get(), create_path_30());
     test_path(ctx, rtc.get(), create_path_31(), SkMatrix(), GrAAType::kCoverage);
     test_path(ctx, rtc.get(), create_path_32());
+    test_path(ctx, rtc.get(), create_path_33());
 }
 #endif