drawVertices crashes when shader+colorfilter in the paint

4377:  drawVertices crashes when shader+colorfilter in the paint

Fix memory corruption that is result of static_casting SkFilterShaderContext*
 to SkTriColorShaderContext* and then changing it's state using setup()

SkTriColorShader and it's Context could be wrapped by Compose, 3DShader and
 SkFilterShader, but the link SkTriColorShaderContext -> SkTriColorShader
 (fShader) always remain - so this way, data about triangle is propagated.

BUG=4377
Didn't add new unit test - it would be redundant since the GM vertices update here: https://codereview.chromium.org/1361173003/ is covering the bug. With this patch it passes.

Committed: https://skia.googlesource.com/skia/+/88cb82246a5dc141cb9f49a3b9187abb515cd49d

[aleksandar.stojiljkovic, 2015-11-03 23:36:09]

Description was changed from

==========
4377:  drawVertices crashes when shader+colorfilter in the paint

Fix memory corruption that is result of static_casting SkFilterShaderContext*
 to SkTriColorShaderContext* and then changing it's state using setup()

SkTriColorShader and it's Context could be wrapped by Compose, 3DShader and
 SkFilterShader, but the link SkTriColorShaderContext -> SkTriColorShader
 (fShader) always remain - so this way, data about triangle is propagated.

BUG=4377
==========

to

==========
4377:  drawVertices crashes when shader+colorfilter in the paint

Fix memory corruption that is result of static_casting SkFilterShaderContext*
 to SkTriColorShaderContext* and then changing it's state using setup()

SkTriColorShader and it's Context could be wrapped by Compose, 3DShader and
 SkFilterShader, but the link SkTriColorShaderContext -> SkTriColorShader
 (fShader) always remain - so this way, data about triangle is propagated.

BUG=4377

Didn't add new unit test - it would be redundant since the GM vertices update
here: https://codereview.chromium.org/1361173003/ is covering the bug. With this
patch it passes.
==========

[aleksandar.stojiljkovic, 2015-11-03 23:36:09]

aleksandar.stojiljkovic@intel.com changed reviewers:
+ reed@chromium.org

[aleksandar_stojiljkovic, 2015-11-10 08:58:51]

astojilj@gmail.com changed reviewers:
+ astojilj@gmail.com

[aleksandar_stojiljkovic, 2015-11-10 08:58:51]

https://codereview.chromium.org/1431713003/diff/20001/src/core/SkDraw.cpp
File src/core/SkDraw.cpp (right):

https://codereview.chromium.org/1431713003/diff/20001/src/core/SkDraw.cpp#new...
src/core/SkDraw.cpp:2006: fSetup = setup(set->pts, set->colors, set->state->f0,
set->state->f1, set->state->f2);

Reed, what do you think about this approach?

There's memory corruption after invalid static cast. I could try different
approach from outside, since this one introduces a check in every shadeSpan
call.

[reed1, 2016-03-08 18:18:48]

reed@google.com changed reviewers:
+ reed@google.com

[reed1, 2016-03-08 18:18:48]

Only 4 months later ... but I think this looks good. Testing now...

[reed1, 2016-03-08 19:02:18]

The CQ bit was checked by reed@google.com

[reed1, 2016-03-08 19:02:24]

lgtm

[commit-bot: I haz the power, 2016-03-08 19:02:26]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1431713003/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1431713003/20001

[commit-bot: I haz the power, 2016-03-08 19:18:24]

Description was changed from

==========
4377:  drawVertices crashes when shader+colorfilter in the paint

Fix memory corruption that is result of static_casting SkFilterShaderContext*
 to SkTriColorShaderContext* and then changing it's state using setup()

SkTriColorShader and it's Context could be wrapped by Compose, 3DShader and
 SkFilterShader, but the link SkTriColorShaderContext -> SkTriColorShader
 (fShader) always remain - so this way, data about triangle is propagated.

BUG=4377

Didn't add new unit test - it would be redundant since the GM vertices update
here: https://codereview.chromium.org/1361173003/ is covering the bug. With this
patch it passes.
==========

to

==========
4377:  drawVertices crashes when shader+colorfilter in the paint

Fix memory corruption that is result of static_casting SkFilterShaderContext*
 to SkTriColorShaderContext* and then changing it's state using setup()

SkTriColorShader and it's Context could be wrapped by Compose, 3DShader and
 SkFilterShader, but the link SkTriColorShaderContext -> SkTriColorShader
 (fShader) always remain - so this way, data about triangle is propagated.

BUG=4377

Didn't add new unit test - it would be redundant since the GM vertices update
here: https://codereview.chromium.org/1361173003/ is covering the bug. With this
patch it passes.

Committed:
https://skia.googlesource.com/skia/+/88cb82246a5dc141cb9f49a3b9187abb515cd49d
==========

[commit-bot: I haz the power, 2016-03-08 19:18:24]

Committed patchset #2 (id:20001) as
https://skia.googlesource.com/skia/+/88cb82246a5dc141cb9f49a3b9187abb515cd49d