Fix int32 overflow in LinearGradientContext::shade4_dx_clamp

src/effects/gradients/SkLinearGradient.cpp

Index: src/effects/gradients/SkLinearGradient.cpp
diff --git a/src/effects/gradients/SkLinearGradient.cpp b/src/effects/gradients/SkLinearGradient.cpp
index 1bdce39d985370c51e5dbcd3c9187c26518c3379..209b833973291f3b4199299320510935c6f31ecd 100644
--- a/src/effects/gradients/SkLinearGradient.cpp
+++ b/src/effects/gradients/SkLinearGradient.cpp
@@ -610,7 +610,10 @@ void SkLinearGradient::LinearGradientContext::shade4_dx_clamp(SkPMColor dstC[],
 
     if (dx_is_pos) {
         if (fx < 0) {
-            int n = SkTMin(SkFloatToIntFloor(-fx * invDx) + 1, count);
+            // count is guaranteed to be positive, but the first arg may overflow int32 after
+            // increment => casting to uint32 ensures correct clamping.
+            int n = SkTMin<uint32_t>(SkFloatToIntFloor(-fx * invDx) + 1, count);
+            SkASSERT(n > 0);
             fill<apply_alpha>(dstC, n, rec[0].fColor);
             count -= n;
             dstC += n;
@@ -622,7 +625,10 @@ void SkLinearGradient::LinearGradientContext::shade4_dx_clamp(SkPMColor dstC[],
         }
     } else { // dx < 0
         if (fx > 1) {
-            int n = SkTMin(SkFloatToIntFloor((1 - fx) * invDx) + 1, count);
+            // count is guaranteed to be positive, but the first arg may overflow int32 after
+            // increment => casting to uint32 ensures correct clamping.
+            int n = SkTMin<uint32_t>(SkFloatToIntFloor((1 - fx) * invDx) + 1, count);
+            SkASSERT(n > 0);
             fill<apply_alpha>(dstC, n, rec[fRecs.count() - 1].fColor);
             count -= n;
             dstC += n;