Fix pointer aliasing bug in SkImageFilter::computeFastBounds.

src/core/SkImageFilter.cpp

 /*
  * Copyright 2012 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkImageFilter.h"
 #include "SkImageFilterCacheKey.h"
 
@@ skipping 295 matching lines @@
         this->getCropRect().applyTo(temp, ctm, dst);
         return true;
     }
 }
 
 void SkImageFilter::computeFastBounds(const SkRect& src, SkRect* dst) const {
     if (0 == fInputCount) {
         *dst = src;
         return;
     }
+    // We can't work directly on dst, since src and dst may alias.
+    SkRect combinedBounds;
     if (this->getInput(0)) {
-        this->getInput(0)->computeFastBounds(src, dst);
+        this->getInput(0)->computeFastBounds(src, &combinedBounds);
     } else {
-        *dst = src;
+        combinedBounds = src;
     }
     for (int i = 1; i < fInputCount; i++) {
         SkImageFilter* input = this->getInput(i);
         if (input) {
             SkRect bounds;
             input->computeFastBounds(src, &bounds);
-            dst->join(bounds);
+            combinedBounds.join(bounds);
         } else {
-            dst->join(src);
+            combinedBounds.join(src);
         }
     }
+    *dst = combinedBounds;
 }
 
 bool SkImageFilter::canComputeFastBounds() const {
     for (int i = 0; i < fInputCount; i++) {
         SkImageFilter* input = this->getInput(i);
         if (input && !input->canComputeFastBounds()) {
             return false;
         }
     }
     return true;
@@ skipping 467 matching lines @@
     }
     return dev;
 }
 
 bool SkImageFilter::DeviceProxy::filterImage(const SkImageFilter* filter, const SkBitmap& src,
                                        const SkImageFilter::Context& ctx,
                                        SkBitmap* result, SkIPoint* offset) {
     return fDevice->filterImage(filter, src, ctx, result, offset);
 }