commit 48a2fac4f04a56d2e1cd7b2e61069fd06d39c1a9
author Nicolas Pena <npm@chromium.org> Mon Mar 27 14:24:34 2017 -0400
committer Chromium commit bot <commit-bot@chromium.org> Mon Mar 27 18:42:14 2017 +0000
tree 8b28bbc1d9c8ae4f26f14ad07a1522ea155e9415
parent 43c195016f9c2e38654a484f9472c138b92d3ec3

Fix some ASAN issues in fx_skia_device

- Flush is needed in ~CFX_FxgeDevice, otherwise it may be called after deleting
the bitmap, when calling the destructor of the skia device driver.
- SkDashPathEffect::Make copies the given intervals instead of owning them, so
free the input to that method.
- If StartDIBits creates a new CFX_ImageRenderer, then the corresponding
CancelDIBits needs to delete the handle.

Bug: chromium:705131
Change-Id: I22c7c51a4070e73538eb8af51a60afeaa67f8bb7
Reviewed-on: https://pdfium-review.googlesource.com/3230
Commit-Queue: Nicolás Peña <npm@chromium.org>
Commit-Queue: dsinclair <dsinclair@chromium.org>
Reviewed-by: dsinclair <dsinclair@chromium.org>

core/fxge/skia/fx_skia_device.cpp

diff --git a/core/fxge/skia/fx_skia_device.cpp b/core/fxge/skia/fx_skia_device.cpp
index 208b763..a9cf7e6 100644
--- a/core/fxge/skia/fx_skia_device.cpp
+++ b/core/fxge/skia/fx_skia_device.cpp
@@ -1171,7 +1171,8 @@
              SkTMin(deviceUnits[0].length(), deviceUnits[1].length()));
   if (pGraphState->m_DashArray) {
     int count = (pGraphState->m_DashCount + 1) / 2;
-    SkScalar* intervals = FX_Alloc2D(SkScalar, count, sizeof(SkScalar));
+    std::unique_ptr<SkScalar, FxFreeDeleter> intervals(
+        FX_Alloc2D(SkScalar, count, sizeof(SkScalar)));
     // Set dash pattern
     for (int i = 0; i < count; i++) {
       float on = pGraphState->m_DashArray[i * 2];
@@ -1182,11 +1183,11 @@
                       : pGraphState->m_DashArray[i * 2 + 1];
       if (off < 0)
         off = 0;
-      intervals[i * 2] = on;
-      intervals[i * 2 + 1] = off;
+      intervals.get()[i * 2] = on;
+      intervals.get()[i * 2 + 1] = off;
     }
-    spaint->setPathEffect(
-        SkDashPathEffect::Make(intervals, count * 2, pGraphState->m_DashPhase));
+    spaint->setPathEffect(SkDashPathEffect::Make(intervals.get(), count * 2,
+                                                 pGraphState->m_DashPhase));
   }
   spaint->setStyle(SkPaint::kStroke_Style);
   spaint->setAntiAlias(true);
@@ -2009,6 +2010,15 @@
   return true;
 }
 
+void CFX_SkiaDeviceDriver::CancelDIBits(void* handle) {
+#ifdef _SKIA_SUPPORT_PATHS_
+  if (!m_pBitmap->GetBuffer())
+    return;
+
+  delete reinterpret_cast<CFX_ImageRenderer*>(handle);
+#endif  // _SKIA_SUPPORT_PATHS_
+}
+
 bool CFX_SkiaDeviceDriver::ContinueDIBits(void* handle, IFX_Pause* pPause) {
 #ifdef _SKIA_SUPPORT_
   m_pCache->FlushForDraw();
@@ -2213,9 +2223,7 @@
 }
 
 CFX_FxgeDevice::~CFX_FxgeDevice() {
-#ifdef _SKIA_SUPPORT_
   Flush();
-#endif  // _SKIA_SUPPORT_
   // call destructor of CFX_RenderDevice / CFX_SkiaDeviceDriver immediately
   if (m_bOwnedBitmap && GetBitmap())
     delete GetBitmap();

core/fxge/skia/fx_skia_device.h

diff --git a/core/fxge/skia/fx_skia_device.h b/core/fxge/skia/fx_skia_device.h
index b26ebdd..494e6e1 100644
--- a/core/fxge/skia/fx_skia_device.h
+++ b/core/fxge/skia/fx_skia_device.h
@@ -122,7 +122,7 @@
 
   bool ContinueDIBits(void* handle, IFX_Pause* pPause) override;
 
-  void CancelDIBits(void* handle) override {}
+  void CancelDIBits(void* handle) override;
 
   bool DrawBitsWithMask(const CFX_DIBSource* pBitmap,
                         const CFX_DIBSource* pMask,