[M52] Cherry-pick e6c515f3d34096426b6822ad90a757131e8baf31
authorfmalita <fmalita@chromium.org>
Sat, 28 May 2016 13:57:33 +0000 (06:57 -0700)
committerCommit bot <commit-bot@chromium.org>
Sat, 28 May 2016 13:57:33 +0000 (06:57 -0700)
commit1fd666cbb9655e1ce5f37f435d1f9ea2d7b47827
treeeedacc8d18ab61ea2918269f21a9c9726deab15a
parent4db42b79974180b3e05e00cff90801e0d7b4b650
[M52] Cherry-pick e6c515f3d34096426b6822ad90a757131e8baf31

Fix int32 overflow in LinearGradientContext::shade4_dx_clamp

The unconditional increment in shade4_dx_clamp can overflow int32

=> n == SK_MinS32
=> count ~= SK_MinS32
=> we skip the main shader loop 'cause count < 0

Also include trivial 0e59bb7aaad272ac42d6fba53e8439bd9fa1ff3d followup
to ensure we're not tripping ASAN.

TBR=reed@google.com,mtklein@google.com
BUG=chromium:599458

Review-Url: https://codereview.chromium.org/2010843002
NOTREECHECKS=true
NOTRY=true
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2021673002
src/effects/gradients/SkLinearGradient.cpp
tests/GradientTest.cpp