summaryrefslogtreecommitdiff
path: root/core/fxge/skia
diff options
context:
space:
mode:
authorNicolas Pena <npm@chromium.org>2017-03-27 14:24:34 -0400
committerChromium commit bot <commit-bot@chromium.org>2017-03-27 18:42:14 +0000
commit48a2fac4f04a56d2e1cd7b2e61069fd06d39c1a9 (patch)
tree8b28bbc1d9c8ae4f26f14ad07a1522ea155e9415 /core/fxge/skia
parent43c195016f9c2e38654a484f9472c138b92d3ec3 (diff)
downloadpdfium-48a2fac4f04a56d2e1cd7b2e61069fd06d39c1a9.tar.xz
Fix some ASAN issues in fx_skia_device
- Flush is needed in ~CFX_FxgeDevice, otherwise it may be called after deleting the bitmap, when calling the destructor of the skia device driver. - SkDashPathEffect::Make copies the given intervals instead of owning them, so free the input to that method. - If StartDIBits creates a new CFX_ImageRenderer, then the corresponding CancelDIBits needs to delete the handle. Bug: chromium:705131 Change-Id: I22c7c51a4070e73538eb8af51a60afeaa67f8bb7 Reviewed-on: https://pdfium-review.googlesource.com/3230 Commit-Queue: Nicolás Peña <npm@chromium.org> Commit-Queue: dsinclair <dsinclair@chromium.org> Reviewed-by: dsinclair <dsinclair@chromium.org>
Diffstat (limited to 'core/fxge/skia')
-rw-r--r--core/fxge/skia/fx_skia_device.cpp22
-rw-r--r--core/fxge/skia/fx_skia_device.h2
2 files changed, 16 insertions, 8 deletions
diff --git a/core/fxge/skia/fx_skia_device.cpp b/core/fxge/skia/fx_skia_device.cpp
index 208b763b8f..a9cf7e67c7 100644
--- a/core/fxge/skia/fx_skia_device.cpp
+++ b/core/fxge/skia/fx_skia_device.cpp
@@ -1171,7 +1171,8 @@ void CFX_SkiaDeviceDriver::PaintStroke(SkPaint* spaint,
SkTMin(deviceUnits[0].length(), deviceUnits[1].length()));
if (pGraphState->m_DashArray) {
int count = (pGraphState->m_DashCount + 1) / 2;
- SkScalar* intervals = FX_Alloc2D(SkScalar, count, sizeof(SkScalar));
+ std::unique_ptr<SkScalar, FxFreeDeleter> intervals(
+ FX_Alloc2D(SkScalar, count, sizeof(SkScalar)));
// Set dash pattern
for (int i = 0; i < count; i++) {
float on = pGraphState->m_DashArray[i * 2];
@@ -1182,11 +1183,11 @@ void CFX_SkiaDeviceDriver::PaintStroke(SkPaint* spaint,
: pGraphState->m_DashArray[i * 2 + 1];
if (off < 0)
off = 0;
- intervals[i * 2] = on;
- intervals[i * 2 + 1] = off;
+ intervals.get()[i * 2] = on;
+ intervals.get()[i * 2 + 1] = off;
}
- spaint->setPathEffect(
- SkDashPathEffect::Make(intervals, count * 2, pGraphState->m_DashPhase));
+ spaint->setPathEffect(SkDashPathEffect::Make(intervals.get(), count * 2,
+ pGraphState->m_DashPhase));
}
spaint->setStyle(SkPaint::kStroke_Style);
spaint->setAntiAlias(true);
@@ -2009,6 +2010,15 @@ bool CFX_SkiaDeviceDriver::StartDIBits(const CFX_DIBSource* pSource,
return true;
}
+void CFX_SkiaDeviceDriver::CancelDIBits(void* handle) {
+#ifdef _SKIA_SUPPORT_PATHS_
+ if (!m_pBitmap->GetBuffer())
+ return;
+
+ delete reinterpret_cast<CFX_ImageRenderer*>(handle);
+#endif // _SKIA_SUPPORT_PATHS_
+}
+
bool CFX_SkiaDeviceDriver::ContinueDIBits(void* handle, IFX_Pause* pPause) {
#ifdef _SKIA_SUPPORT_
m_pCache->FlushForDraw();
@@ -2213,9 +2223,7 @@ bool CFX_FxgeDevice::Create(int width,
}
CFX_FxgeDevice::~CFX_FxgeDevice() {
-#ifdef _SKIA_SUPPORT_
Flush();
-#endif // _SKIA_SUPPORT_
// call destructor of CFX_RenderDevice / CFX_SkiaDeviceDriver immediately
if (m_bOwnedBitmap && GetBitmap())
delete GetBitmap();
diff --git a/core/fxge/skia/fx_skia_device.h b/core/fxge/skia/fx_skia_device.h
index b26ebdd724..494e6e1c44 100644
--- a/core/fxge/skia/fx_skia_device.h
+++ b/core/fxge/skia/fx_skia_device.h
@@ -122,7 +122,7 @@ class CFX_SkiaDeviceDriver : public IFX_RenderDeviceDriver {
bool ContinueDIBits(void* handle, IFX_Pause* pPause) override;
- void CancelDIBits(void* handle) override {}
+ void CancelDIBits(void* handle) override;
bool DrawBitsWithMask(const CFX_DIBSource* pBitmap,
const CFX_DIBSource* pMask,