Consider the start_coord in interlaced PNG

src/codec/SkPngCodec.cpp

 /*
  * Copyright 2015 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBitmap.h"
 #include "SkCodecPriv.h"
 #include "SkColorPriv.h"
@@ skipping 708 matching lines @@
             }
             return SkCodec::kIncompleteInput;
         }
 
         const int sampleY = this->swizzler() ? this->swizzler()->sampleY() : 1;
         const int rowsNeeded = get_scaled_dimension(fLastRow - fFirstRow + 1, sampleY);
         int rowsWrittenToOutput = 0;
 
         // FIXME: For resuming interlace, we may swizzle a row that hasn't changed. But it
         // may be too tricky/expensive to handle that correctly.
-        png_bytep srcRow = fInterlaceBuffer.get();
+
+        // Offset srcRow by get_start_coord rows. We do not need to account for fFirstRow,
+        // since the first row in fInterlaceBuffer corresponds to fFirstRow.
+        png_bytep srcRow = SkTAddOffset<png_byte>(fInterlaceBuffer.get(),
+                                                  fPng_rowbytes * get_start_coord(sampleY));
         void* dst = fDst;
-        for (int rowNum = fFirstRow + get_start_coord(sampleY); rowsWrittenToOutput < rowsNeeded;

[scroggo_chromium, 2016/10/18 14:32:19]

Notice that I used get_start_coord to compute rowNum, but the only thing I do
with rowNum is add to it! This should've been the first clue that something was
wrong...

-                rowNum += sampleY) {
+        for (; rowsWrittenToOutput < rowsNeeded; rowsWrittenToOutput++) {
             this->applyXformRow(dst, srcRow);
             dst = SkTAddOffset<void>(dst, fRowBytes);
             srcRow = SkTAddOffset<png_byte>(srcRow, fPng_rowbytes * sampleY);
-            rowsWrittenToOutput++;
         }
 
         if (fInterlacedComplete) {
             return SkCodec::kSuccess;
         }
 
         if (rowsDecoded) {
             *rowsDecoded = rowsWrittenToOutput;
         }
         return SkCodec::kIncompleteInput;
@@ skipping 509 matching lines @@
     SkCodec* outCodec = nullptr;
     if (read_header(streamDeleter.get(), chunkReader, &outCodec, nullptr, nullptr)) {
         // Codec has taken ownership of the stream.
         SkASSERT(outCodec);
         streamDeleter.release();
         return outCodec;
     }
 
     return nullptr;
 }