turn on pointer-overflow on ASAN/UBSAN bots
I know SkRasterPipelineBlitter will add back offsets
to the mask pointer to make these fMaskPtr.pixels safe.
SkImageInfo wasn't making out-of-bounds pointers, but was moving
between two in-bounds pointers by subtracting large (negative)
size_t. Switching to explicit negate and add quiets this down.
Bug: chromium:836282
Change-Id: Ia65e380ec41dbfedce0659106830fbacb1a5cf4a
Reviewed-on: https://skia-review.googlesource.com/131147
Reviewed-by: Mike Reed <reed@google.com>
Reviewed-by: Cary Clark <caryclark@google.com>
Commit-Queue: Mike Klein <mtklein@chromium.org>
diff --git a/src/core/SkRasterPipelineBlitter.cpp b/src/core/SkRasterPipelineBlitter.cpp
index 0d45fa1..ae76617 100644
--- a/src/core/SkRasterPipelineBlitter.cpp
+++ b/src/core/SkRasterPipelineBlitter.cpp
@@ -472,19 +472,21 @@
std::function<void(size_t,size_t,size_t,size_t)>* blitter = nullptr;
// Update fMaskPtr to point "into" this current mask, but lined up with fDstPtr at (0,0).
+ // This sort of trickery upsets UBSAN (pointer-overflow) so we do our math in uintptr_t.
+
// mask.fRowBytes is a uint32_t, which would break our addressing math on 64-bit builds.
size_t rowBytes = mask.fRowBytes;
switch (effectiveMaskFormat) {
case SkMask::kA8_Format:
fMaskPtr.stride = rowBytes;
- fMaskPtr.pixels = (uint8_t*)(mask.fImage - mask.fBounds.left() * (size_t)1
- - mask.fBounds.top() * rowBytes);
+ fMaskPtr.pixels = (void*)((uintptr_t)mask.fImage - mask.fBounds.left() * (size_t)1
+ - mask.fBounds.top() * rowBytes);
blitter = &fBlitMaskA8;
break;
case SkMask::kLCD16_Format:
fMaskPtr.stride = rowBytes / 2;
- fMaskPtr.pixels = (uint16_t*)(mask.fImage - mask.fBounds.left() * (size_t)2
- - mask.fBounds.top() * rowBytes);
+ fMaskPtr.pixels = (void*)((uintptr_t)mask.fImage - mask.fBounds.left() * (size_t)2
+ - mask.fBounds.top() * rowBytes);
blitter = &fBlitMaskLCD16;
break;
default: