Check negative overflow of quickSkFDot6Div

src/core/SkAnalyticEdge.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkAnalyticEdge.h"
 #include "SkFDot6.h"
 #include "SkMathPriv.h"
 #include "SkAAAConstants.h"
 
 class QuickFDot6Inverse {
 private:
     static constexpr const SkFDot6* table = gFDot6INVERSE + kInverseTableSize;
 public:
     inline static SkFixed Lookup(SkFDot6 x) {
         SkASSERT(SkAbs32(x) < kInverseTableSize);
         return table[x];
     }
 };
 
 static inline SkFixed quickSkFDot6Div(SkFDot6 a, SkFDot6 b) {
-    if (SkAbs32(b) < kInverseTableSize) {
-        SkASSERT((int64_t)a * QuickFDot6Inverse::Lookup(b) <= SK_MaxS32);
+    // Max inverse of b is 2^6 which is 2^22 in SkFixed format.
+    // Hence the safe value of abs(a) should be less than 2^10.
+    if (SkAbs32(b) < kInverseTableSize && SkAbs32(a) < (1 << 10)) {
+        SkASSERT((int64_t)a * QuickFDot6Inverse::Lookup(b) <= SK_MaxS32
+                && (int64_t)a * QuickFDot6Inverse::Lookup(b) >= SK_MinS32);
         SkFixed ourAnswer = (a * QuickFDot6Inverse::Lookup(b)) >> 6;
         #ifdef SK_DEBUG
         SkFixed directAnswer = SkFDot6Div(a, b);
         SkASSERT(
             (directAnswer == 0 && ourAnswer == 0) ||
             SkFixedDiv(SkAbs32(directAnswer - ourAnswer), SkAbs32(directAnswer)) <= 1 << 10
         );
         #endif
         return ourAnswer;
     } else {
@@ skipping 199 matching lines @@
                         SkFDot6Div(SkFixedToFDot6(newx - oldx), SkFixedToFDot6(newy - oldy)));
         oldx = newx;
         oldy = newy;
     } while (count < 0 && !success);
 
     fCEdge.fCx  = newx;
     fCEdge.fCy  = newy;
     fCurveCount = SkToS8(count);
     return success;
 }