Add a test to ensure that a case where SkCubicClipper::ChopMonoAtY returns false...

Also fixes a style issue in the fix for the issue being tested.

BUG=chromium:613918
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2021343004

Review-Url: https://codereview.chromium.org/2021343004

diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp
index bf27372a56e5337de76c9f3ee3be29832bd34ff2..f5b53fcc00e085785be61a23a0e9c601f891e6fb 100644 (file)
--- a/src/core/SkPath.cpp
+++ b/src/core/SkPath.cpp
@@ -2813,7 +2813,7 @@ static int winding_mono_cubic(const SkPoint pts[], SkScalar x, SkScalar y, int*
     // compute the actual x(t) value
     SkScalar t;
     if (!SkCubicClipper::ChopMonoAtY(pts, y, &t)) {
-      return 0;
+        return 0;
     }
     SkScalar xt = eval_cubic_pts(pts[0].fX, pts[1].fX, pts[2].fX, pts[3].fX, t);
     if (SkScalarNearlyEqual(xt, x)) {
@@ -3052,7 +3052,7 @@ static void tangent_cubic(const SkPoint pts[], SkScalar x, SkScalar y,
         SkPoint* c = &dst[i * 3];
         SkScalar t;
         if (!SkCubicClipper::ChopMonoAtY(c, y, &t)) {
-          continue;
+            continue;
         }
         SkScalar xt = eval_cubic_pts(c[0].fX, c[1].fX, c[2].fX, c[3].fX, t);
         if (!SkScalarNearlyEqual(x, xt)) {

diff --git a/tests/PathTest.cpp b/tests/PathTest.cpp
index b406f257f5ea8769724c7c4ef063e24dcca80d5b..9de5f816616f774a834bc3919caf9ae7464f32fe 100644 (file)
--- a/tests/PathTest.cpp
+++ b/tests/PathTest.cpp
@@ -484,6 +484,17 @@ static void test_crbug_495894(skiatest::Reporter* reporter) {
             65536);
 }
 
+static void test_crbug_613918() {
+    SkPath path;
+    path.conicTo(-6.62478e-08f, 4.13885e-08f, -6.36935e-08f, 3.97927e-08f, 0.729058f);
+    path.quadTo(2.28206e-09f, -1.42572e-09f, 3.91919e-09f, -2.44852e-09f);
+    path.cubicTo(-16752.2f, -26792.9f, -21.4673f, 10.9347f, -8.57322f, -7.22739f);
+
+    // This call could lead to an assert or uninitialized read due to a failure
+    // to check the return value from SkCubicClipper::ChopMonoAtY.
+    path.contains(-1.84817e-08f, 1.15465e-08f);
+}
+
 static void test_addrect(skiatest::Reporter* reporter) {
     SkPath path;
     path.lineTo(0, 0);
@@ -4277,6 +4288,7 @@ DEF_TEST(Paths, reporter) {
     test_crbug_170666();
     test_crbug_493450(reporter);
     test_crbug_495894(reporter);
+    test_crbug_613918();
     test_bad_cubic_crbug229478();
     test_bad_cubic_crbug234190();
     test_gen_id(reporter);