10488.diff

commit 8d6b2b6f6161c8a1d44d191dd68e75f0347d7cc1
Author: Mike Klein <mtklein@google.com>
Date:   Mon Sep 24 20:37:33 2018 -0400

    invalidate pathref bounds when we attach an editor
    
    It's possible to change path bounds by changing path points using
    SkPath::setLastPt(), but we don't invalidate the bounds when we do.
    
    Seems like the best thing to do is to invalidate the bounds when
    we attach an editor, the same way we invalidate the gen ID.
    
    Bug: oss-fuzz:10488, oss-fuzz:10698
    Change-Id: Idd04d37f9e39979aac135d675aa4e5949c55a453
    Reviewed-on: https://skia-review.googlesource.com/156700
    Reviewed-by: Brian Salomon <bsalomon@google.com>
    Commit-Queue: Brian Salomon <bsalomon@google.com>
    Auto-Submit: Mike Klein <mtklein@google.com>

diff --git a/src/core/SkPathRef.cpp b/src/core/SkPathRef.cpp
index 44272991bd..8c8e7fb103 100644
--- a/src/core/SkPathRef.cpp
+++ b/src/core/SkPathRef.cpp
@@ -28,21 +28,22 @@ static bool validate_conic_weights(const SkScalar weights[], int count) {
 //////////////////////////////////////////////////////////////////////////////
 SkPathRef::Editor::Editor(sk_sp<SkPathRef>* pathRef,
                           int incReserveVerbs,
                           int incReservePoints)
 {
     if ((*pathRef)->unique()) {
         (*pathRef)->incReserve(incReserveVerbs, incReservePoints);
     } else {
         SkPathRef* copy = new SkPathRef;
         copy->copy(**pathRef, incReserveVerbs, incReservePoints);
         pathRef->reset(copy);
     }
     fPathRef = pathRef->get();
     fPathRef->callGenIDChangeListeners();
     fPathRef->fGenerationID = 0;
+    fPathRef->fBoundsIsDirty = true;
     SkDEBUGCODE(sk_atomic_inc(&fPathRef->fEditorsAttached);)
 }
 
 // Sort of like makeSpace(0) but the the additional requirement that we actively shrink the
 // allocations to just fit the current needs. makeSpace() will only grow, but never shrinks.
 //