GrTessellator: fix for zombie edge fuzzer crash.
While splitting one edge, merge_collinear_edges() may in rare cases
merge the other edge of the intersection out of existence.
split_edge() then brings these dead edges partially back to life,
leaving the mesh in an inconsistent state.
The fix is to null out the top and bottom pointers of dead edges to
mark them as dead, and only split living edges.
Bug: skia:7911
Change-Id: I1c0b59581acfcd0b8191f2d129b33f7d0d1a2516
Reviewed-on: https://skia-review.googlesource.com/129181
Reviewed-by: Robert Phillips <robertphillips@google.com>
Commit-Queue: Stephen White <senorblanco@chromium.org>
diff --git a/src/gpu/GrTessellator.cpp b/src/gpu/GrTessellator.cpp
index 1125ef4..fd7bf51 100644
--- a/src/gpu/GrTessellator.cpp
+++ b/src/gpu/GrTessellator.cpp
@@ -1013,6 +1013,7 @@
rewind(activeEdges, current, edge->fTop, c);
other->fWinding += edge->fWinding;
disconnect(edge);
+ edge->fTop = edge->fBottom = nullptr;
} else if (c.sweep_lt(edge->fTop->fPoint, other->fTop->fPoint)) {
rewind(activeEdges, current, edge->fTop, c);
other->fWinding += edge->fWinding;
@@ -1033,6 +1034,7 @@
rewind(activeEdges, current, edge->fTop, c);
other->fWinding += edge->fWinding;
disconnect(edge);
+ edge->fTop = edge->fBottom = nullptr;
} else if (c.sweep_lt(edge->fBottom->fPoint, other->fBottom->fPoint)) {
rewind(activeEdges, current, other->fTop, c);
edge->fWinding += other->fWinding;
@@ -1070,7 +1072,7 @@
void split_edge(Edge* edge, Vertex* v, EdgeList* activeEdges, Vertex** current, Comparator& c,
SkArenaAlloc& alloc) {
- if (v == edge->fTop || v == edge->fBottom) {
+ if (!edge->fTop || !edge->fBottom || v == edge->fTop || v == edge->fBottom) {
return;
}
LOG("splitting edge (%g -> %g) at vertex %g (%g, %g)\n",