Fix int32 overflow in LinearGradientContext::shade4_dx_clamp

src/effects/gradients/SkLinearGradient.cpp

 /*
  * Copyright 2012 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "Sk4fLinearGradient.h"
 #include "SkLinearGradient.h"
 
@@ skipping 592 matching lines @@
                                                               const float dither[2]) {
     Sk4f dither0(dither[0]);
     Sk4f dither1(dither[1]);
     const Rec* rec = fRecs.begin();
 
     const Sk4f dx4 = Sk4f(dx);
     SkDEBUGCODE(SkPMColor* endDstC = dstC + count;)
 
     if (dx_is_pos) {
         if (fx < 0) {
-            int n = SkTMin(SkFloatToIntFloor(-fx * invDx) + 1, count);
+            // count is guaranteed to be positive, but the first arg may overflow int32 after
+            // increment => casting to uint32 ensures correct clamping.
+            int n = SkTMin<uint32_t>(SkFloatToIntFloor(-fx * invDx) + 1, count);
+            SkASSERT(n > 0);
             fill<apply_alpha>(dstC, n, rec[0].fColor);
             count -= n;
             dstC += n;
             fx += n * dx;
             SkASSERT(0 == count || fx >= 0);
             if (n & 1) {
                 SkTSwap(dither0, dither1);
             }
         }
     } else { // dx < 0
         if (fx > 1) {
-            int n = SkTMin(SkFloatToIntFloor((1 - fx) * invDx) + 1, count);
+            // count is guaranteed to be positive, but the first arg may overflow int32 after
+            // increment => casting to uint32 ensures correct clamping.
+            int n = SkTMin<uint32_t>(SkFloatToIntFloor((1 - fx) * invDx) + 1, count);
+            SkASSERT(n > 0);
             fill<apply_alpha>(dstC, n, rec[fRecs.count() - 1].fColor);
             count -= n;
             dstC += n;
             fx += n * dx;
             SkASSERT(0 == count || fx <= 1);
             if (n & 1) {
                 SkTSwap(dither0, dither1);
             }
         }
     }
@@ skipping 110 matching lines @@
             this->shade4_dx_clamp<false, true>(dstC, count, fx, dx, invDx, dither);
         }
     } else {
         if (fApplyAlphaAfterInterp) {
             this->shade4_dx_clamp<true, false>(dstC, count, fx, dx, invDx, dither);
         } else {
             this->shade4_dx_clamp<false, false>(dstC, count, fx, dx, invDx, dither);
         }
     }
 }