drawVertices crashes when shader+colorfilter in the paint

src/core/SkDraw.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #define __STDC_LIMIT_MACROS
 
 #include "SkDraw.h"
 #include "SkBlitter.h"
@@ skipping 1872 matching lines @@
     src[1] = texs[state.f1];
     src[2] = texs[state.f2];
     dst[0] = verts[state.f0];
     dst[1] = verts[state.f1];
     dst[2] = verts[state.f2];
     return matrix->setPolyToPoly(src, dst, 3);
 }
 
 class SkTriColorShader : public SkShader {
 public:
-    SkTriColorShader() {}
+    SkTriColorShader();
 
     size_t contextSize() const override;
 
     class TriColorShaderContext : public SkShader::Context {
     public:
         TriColorShaderContext(const SkTriColorShader& shader, const ContextRec&);
         virtual ~TriColorShaderContext();
-
-        bool setup(const SkPoint pts[], const SkColor colors[], int, int, int);
-
         void shadeSpan(int x, int y, SkPMColor dstC[], int count) override;
 
     private:
+        bool setup(const SkPoint pts[], const SkColor colors[], int, int, int);
+
         SkMatrix    fDstToUnit;
         SkPMColor   fColors[3];
+        bool fSetup;
 
         typedef SkShader::Context INHERITED;
     };
 
+    struct TriColorShaderData {
+        const SkPoint* pts;
+        const SkColor* colors;
+        const VertState *state;
+    };
+
     SK_TO_STRING_OVERRIDE()
 
     // For serialization.  This will never be called.
     Factory getFactory() const override { sk_throw(); return nullptr; }
 
+    // Supply setup data to context from drawing setup
+    void bindSetupData(TriColorShaderData* setupData) { fSetupData = setupData; }
+
+    // Take the setup data from context when needed.
+    TriColorShaderData* takeSetupData() {
+        TriColorShaderData *data = fSetupData;
+        fSetupData = NULL;
+        return data;
+    }
+
 protected:
     Context* onCreateContext(const ContextRec& rec, void* storage) const override {
         return new (storage) TriColorShaderContext(*this, rec);
     }
 
 private:
+    TriColorShaderData *fSetupData;
+
     typedef SkShader INHERITED;
 };
 
 bool SkTriColorShader::TriColorShaderContext::setup(const SkPoint pts[], const SkColor colors[],
                                                     int index0, int index1, int index2) {
 
     fColors[0] = SkPreMultiplyColor(colors[index0]);
     fColors[1] = SkPreMultiplyColor(colors[index1]);
     fColors[2] = SkPreMultiplyColor(colors[index2]);
 
     SkMatrix m, im;
     m.reset();
     m.set(0, pts[index1].fX - pts[index0].fX);
     m.set(1, pts[index2].fX - pts[index0].fX);
     m.set(2, pts[index0].fX);
     m.set(3, pts[index1].fY - pts[index0].fY);
     m.set(4, pts[index2].fY - pts[index0].fY);
     m.set(5, pts[index0].fY);
     if (!m.invert(&im)) {
         return false;
     }
     // We can't call getTotalInverse(), because we explicitly don't want to look at the localmatrix
     // as our interators are intrinsically tied to the vertices, and nothing else.
     SkMatrix ctmInv;
     if (!this->getCTM().invert(&ctmInv)) {
         return false;
     }
+    // TODO replace INV(m) * INV(ctm) with INV(ctm * m)
     fDstToUnit.setConcat(im, ctmInv);
     return true;
 }
 
 #include "SkColorPriv.h"
 #include "SkComposeShader.h"
 
 static int ScalarTo256(SkScalar v) {
     int scale = SkScalarToFixed(v) >> 8;
     if (scale < 0) {
         scale = 0;
     }
     if (scale > 255) {
         scale = 255;
     }
     return SkAlpha255To256(scale);
 }
 
+SkTriColorShader::SkTriColorShader()
+    : INHERITED(NULL)
+    , fSetupData(NULL) {}
 
 SkTriColorShader::TriColorShaderContext::TriColorShaderContext(const SkTriColorShader& shader,
                                                                const ContextRec& rec)
-    : INHERITED(shader, rec) {}
+    : INHERITED(shader, rec)
+    , fSetup(false) {}
 
 SkTriColorShader::TriColorShaderContext::~TriColorShaderContext() {}
 
 size_t SkTriColorShader::contextSize() const {
     return sizeof(TriColorShaderContext);
 }
 void SkTriColorShader::TriColorShaderContext::shadeSpan(int x, int y, SkPMColor dstC[], int count) {
+    SkTriColorShader* parent = static_cast<SkTriColorShader*>(const_cast<SkShader*>(&fShader));
+    TriColorShaderData* set = parent->takeSetupData();
+    if (set) {
+        fSetup = setup(set->pts, set->colors, set->state->f0, set->state->f1, set->state->f2);

[aleksandar_stojiljkovic, 2015/11/10 08:58:51]

Reed, what do you think about this approach?

There's memory corruption after invalid static cast. I could try different
approach from outside, since this one introduces a check in every shadeSpan
call.

+    }
+
+    if (!fSetup) {
+        // Invalid matrices. Not checked before so no need to assert.
+        return;
+    }
+
     const int alphaScale = Sk255To256(this->getPaintAlpha());
 
     SkPoint src;
 
     for (int i = 0; i < count; i++) {
         fDstToUnit.mapXY(SkIntToScalar(x), SkIntToScalar(y), &src);
         x += 1;
 
         int scale1 = ScalarTo256(src.fX);
         int scale2 = ScalarTo256(src.fY);
@@ skipping 96 matching lines @@
     // Abort early if we failed to create a shader context.
     if (blitter->isNullBlitter()) {
         return;
     }
 
     // setup our state and function pointer for iterating triangles
     VertState       state(count, indices, indexCount);
     VertState::Proc vertProc = state.chooseProc(vmode);
 
     if (textures || colors) {
+        SkTriColorShader::TriColorShaderData verticesSetup = { vertices, colors, &state };
+
         while (vertProc(&state)) {
             if (textures) {
                 SkMatrix tempM;
                 if (texture_to_matrix(state, vertices, textures, &tempM)) {
                     SkShader::ContextRec rec(p, *fMatrix, &tempM);
                     if (!blitter->resetShaderContext(rec)) {
                         continue;
                     }
                 }
             }
             if (colors) {
-                // Find the context for triShader.
-                SkTriColorShader::TriColorShaderContext* triColorShaderContext;
-
-                SkShader::Context* shaderContext = blitter->getShaderContext();
-                SkASSERT(shaderContext);
-                if (p.getShader() == &triShader) {
-                    triColorShaderContext =
-                            static_cast<SkTriColorShader::TriColorShaderContext*>(shaderContext);
-                } else {
-                    // The shader is a compose shader and triShader is its first shader.
-                    SkASSERT(p.getShader() == composeShader);
-                    SkASSERT(composeShader->getShaderA() == &triShader);
-                    SkComposeShader::ComposeShaderContext* composeShaderContext =
-                            static_cast<SkComposeShader::ComposeShaderContext*>(shaderContext);
-                    SkShader::Context* shaderContextA = composeShaderContext->getShaderContextA();
-                    triColorShaderContext =
-                            static_cast<SkTriColorShader::TriColorShaderContext*>(shaderContextA);
-                }
-
-                if (!triColorShaderContext->setup(vertices, colors,
-                                                  state.f0, state.f1, state.f2)) {
-                    continue;
-                }
+                triShader.bindSetupData(&verticesSetup);
             }
 
             SkPoint tmp[] = {
                 devVerts[state.f0], devVerts[state.f1], devVerts[state.f2]
             };
             SkScan::FillTriangle(tmp, *fRC, blitter.get());
+            triShader.bindSetupData(NULL);
         }
     } else {
         // no colors[] and no texture, stroke hairlines with paint's color.
         SkScan::HairRCProc hairProc = ChooseHairProc(paint.isAntiAlias());
         const SkRasterClip& clip = *fRC;
         while (vertProc(&state)) {
             SkPoint array[] = {
                 devVerts[state.f0], devVerts[state.f1], devVerts[state.f2], devVerts[state.f0]
             };
             hairProc(array, 4, clip, blitter.get());
@@ skipping 112 matching lines @@
         mask->fImage = SkMask::AllocImage(size);
         memset(mask->fImage, 0, mask->computeImageSize());
     }
 
     if (SkMask::kJustComputeBounds_CreateMode != mode) {
         draw_into_mask(*mask, devPath, style);
     }
 
     return true;
 }