New issue
Advanced search Search tips

Issue 648452 link

Starred by 1 user
Status: Fixed
Owner:
cblume@chromium.org
Closed: Sep 2016
Cc:
ericrk@chromium.org
bsalo...@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 1
Type: Bug



Sign in to add a comment

Assert firing due to large pointer values wrapping negative in signed int

Project Member Reported by cblume@chromium.org, Sep 19 2016 
src/image/SkImage_Gpu.cpp has

SkAssert(mipLevelPtr > bufferAsInt);

mipLevelPtr (as well as other pointers in that function) are saved as intptr_t so they can be used with SkAlign8.
char* won't work with SkAlign8.
Any other pointer type would additionally cause aliasing.

But if the value of mipLevelPtr is large, when cast to an intptr_t it will wrap into the negatives. This causes the assert to fail, since it is now less than bufferAsInt.


Change the intptr_t to uintptr_t
Project Member

Comment 1 by bugdroid1@chromium.org, Sep 20 2016 

The following revision refers to this bug:
  https://skia.googlesource.com/skia.git/+/05a3eac35c58295caf5937da42c32da540b05cb0

commit 05a3eac35c58295caf5937da42c32da540b05cb0
Author: cblume <cblume@chromium.org>
Date: Tue Sep 20 04:05:18 2016

SkASSERT firing because pointer wraps negative.

Some pointers are being cast to intptr_t so they can be used with
SkAlign8(). However, a large pointer value might become a negative
integer since intptr_t is signed.

When comparing these intptr_ts, we expect the larger pointer value to be
greater. But it might be so large that it becomes negative, causing it
to be less than.

A SkASSERT is firing for this exact reason.

BUG= 648452 
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2353453004

Review-Url: https://codereview.chromium.org/2353453004

[modify] https://crrev.com/05a3eac35c58295caf5937da42c32da540b05cb0/src/image/SkImage_Gpu.cpp

Comment 2 by cblume@chromium.org, Sep 20 2016

Status: Fixed (was: Assigned)
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 20 2016 

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8a2e1b67e9efc059cddf7a030b353b44311a19dd

commit 8a2e1b67e9efc059cddf7a030b353b44311a19dd
Author: skia-deps-roller <skia-deps-roller@chromium.org>
Date: Tue Sep 20 05:07:42 2016

Roll src/third_party/skia/ 4562f6ecd..05a3eac35 (1 commit).

https://chromium.googlesource.com/skia.git/+log/4562f6ecda4d..05a3eac35c58

$ git log 4562f6ecd..05a3eac35 --date=short --no-merges --format='%ad %ae %s'
2016-09-19 cblume SkASSERT firing because pointer wraps negative.

BUG= 648452 

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
TBR=borenet@google.com

Review-Url: https://codereview.chromium.org/2354813002
Cr-Commit-Position: refs/heads/master@{#419683}

[modify] https://crrev.com/8a2e1b67e9efc059cddf7a030b353b44311a19dd/DEPS
►

Sign in to add a comment