diff options
| author | Nicolas Pena <npm@chromium.org> | 2017-03-27 14:24:34 -0400 |
|---|---|---|
| committer | Chromium commit bot <commit-bot@chromium.org> | 2017-03-27 18:42:14 +0000 |
| commit | 48a2fac4f04a56d2e1cd7b2e61069fd06d39c1a9 (patch) | |
| tree | 8b28bbc1d9c8ae4f26f14ad07a1522ea155e9415 | |
| parent | 43c195016f9c2e38654a484f9472c138b92d3ec3 (diff) | |
| download | pdfium-48a2fac4f04a56d2e1cd7b2e61069fd06d39c1a9.tar.xz | |
Fix some ASAN issues in fx_skia_device
- Flush is needed in ~CFX_FxgeDevice, otherwise it may be called after deleting
the bitmap, when calling the destructor of the skia device driver.
- SkDashPathEffect::Make copies the given intervals instead of owning them, so
free the input to that method.
- If StartDIBits creates a new CFX_ImageRenderer, then the corresponding
CancelDIBits needs to delete the handle.
Bug: chromium:705131
Change-Id: I22c7c51a4070e73538eb8af51a60afeaa67f8bb7
Reviewed-on: https://pdfium-review.googlesource.com/3230
Commit-Queue: Nicolás Peña <npm@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>
| -rw-r--r-- | core/fxge/skia/fx_skia_device.cpp | 22 | ||||
| -rw-r--r-- | core/fxge/skia/fx_skia_device.h | 2 |
2 files changed, 16 insertions, 8 deletions
diff --git a/core/fxge/skia/fx_skia_device.cpp b/core/fxge/skia/fx_skia_device.cpp index 208b763b8f..a9cf7e67c7 100644 --- a/core/fxge/skia/fx_skia_device.cpp +++ b/core/fxge/skia/fx_skia_device.cpp @@ -1171,7 +1171,8 @@ void CFX_SkiaDeviceDriver::PaintStroke(SkPaint* spaint, SkTMin(deviceUnits[0].length(), deviceUnits[1].length())); if (pGraphState->m_DashArray) { int count = (pGraphState->m_DashCount + 1) / 2; - SkScalar* intervals = FX_Alloc2D(SkScalar, count, sizeof(SkScalar)); + std::unique_ptr<SkScalar, FxFreeDeleter> intervals( + FX_Alloc2D(SkScalar, count, sizeof(SkScalar))); // Set dash pattern for (int i = 0; i < count; i++) { float on = pGraphState->m_DashArray[i * 2]; @@ -1182,11 +1183,11 @@ void CFX_SkiaDeviceDriver::PaintStroke(SkPaint* spaint, : pGraphState->m_DashArray[i * 2 + 1]; if (off < 0) off = 0; - intervals[i * 2] = on; - intervals[i * 2 + 1] = off; + intervals.get()[i * 2] = on; + intervals.get()[i * 2 + 1] = off; } - spaint->setPathEffect( - SkDashPathEffect::Make(intervals, count * 2, pGraphState->m_DashPhase)); + spaint->setPathEffect(SkDashPathEffect::Make(intervals.get(), count * 2, + pGraphState->m_DashPhase)); } spaint->setStyle(SkPaint::kStroke_Style); spaint->setAntiAlias(true); @@ -2009,6 +2010,15 @@ bool CFX_SkiaDeviceDriver::StartDIBits(const CFX_DIBSource* pSource, return true; } +void CFX_SkiaDeviceDriver::CancelDIBits(void* handle) { +#ifdef _SKIA_SUPPORT_PATHS_ + if (!m_pBitmap->GetBuffer()) + return; + + delete reinterpret_cast<CFX_ImageRenderer*>(handle); +#endif // _SKIA_SUPPORT_PATHS_ +} + bool CFX_SkiaDeviceDriver::ContinueDIBits(void* handle, IFX_Pause* pPause) { #ifdef _SKIA_SUPPORT_ m_pCache->FlushForDraw(); @@ -2213,9 +2223,7 @@ bool CFX_FxgeDevice::Create(int width, } CFX_FxgeDevice::~CFX_FxgeDevice() { -#ifdef _SKIA_SUPPORT_ Flush(); -#endif // _SKIA_SUPPORT_ // call destructor of CFX_RenderDevice / CFX_SkiaDeviceDriver immediately if (m_bOwnedBitmap && GetBitmap()) delete GetBitmap(); diff --git a/core/fxge/skia/fx_skia_device.h b/core/fxge/skia/fx_skia_device.h index b26ebdd724..494e6e1c44 100644 --- a/core/fxge/skia/fx_skia_device.h +++ b/core/fxge/skia/fx_skia_device.h @@ -122,7 +122,7 @@ class CFX_SkiaDeviceDriver : public IFX_RenderDeviceDriver { bool ContinueDIBits(void* handle, IFX_Pause* pPause) override; - void CancelDIBits(void* handle) override {} + void CancelDIBits(void* handle) override; bool DrawBitsWithMask(const CFX_DIBSource* pBitmap, const CFX_DIBSource* pMask, |