diff --git a/src/gpu/ganesh/ops/GrOvalOpFactory.cpp b/src/gpu/ganesh/ops/GrOvalOpFactory.cpp index 39ed8ff5523..58cd5dfe6da 100644 --- a/src/gpu/ganesh/ops/GrOvalOpFactory.cpp +++ b/src/gpu/ganesh/ops/GrOvalOpFactory.cpp @@ -22,6 +22,7 @@ #include "include/private/base/SkFloatingPoint.h" #include "include/private/base/SkOnce.h" #include "include/private/base/SkTArray.h" +#include "include/private/base/SkTo.h" #include "include/private/gpu/ganesh/GrTypesPriv.h" #include "src/base/SkArenaAlloc.h" #include "src/core/SkMatrixPriv.h" @@ -61,6 +62,7 @@ #include #include +#include #include #include #include @@ -2831,8 +2833,11 @@ class CircularRRectOp final : public GrMeshDrawOp { CombineResult onCombineIfPossible(GrOp* t, SkArenaAlloc*, const GrCaps& caps) override { CircularRRectOp* that = t->cast(); - // can only represent 65535 unique vertices with 16-bit indices - if (fVertCount + that->fVertCount > 65536) { + // Cannot combine if the net number of indices would overflow int32, or if the net number + // of vertices would overflow uint16 (since the index values are 16-bit that point into + // the vertex buffer). + if ((fIndexCount > INT32_MAX - that->fIndexCount) || + (fVertCount > SkToInt(UINT16_MAX) - that->fVertCount)) { return CombineResult::kCannotCombine; } diff --git a/src/gpu/ganesh/ops/ShadowRRectOp.cpp b/src/gpu/ganesh/ops/ShadowRRectOp.cpp index aa92694a63a..e3c861c66c4 100644 --- a/src/gpu/ganesh/ops/ShadowRRectOp.cpp +++ b/src/gpu/ganesh/ops/ShadowRRectOp.cpp @@ -51,6 +51,7 @@ #include #include +#include #include #include #include @@ -648,7 +649,8 @@ class ShadowCircularRRectOp final : public GrMeshDrawOp { } fMesh = target->allocMesh(); - fMesh->setIndexed(std::move(indexBuffer), fIndexCount, firstIndex, 0, fVertCount - 1, + fMesh->setIndexed(std::move(indexBuffer), fIndexCount, firstIndex, 0, + SkTo(fVertCount - 1), GrPrimitiveRestart::kNo, std::move(vertexBuffer), firstVertex); } @@ -669,6 +671,15 @@ class ShadowCircularRRectOp final : public GrMeshDrawOp { CombineResult onCombineIfPossible(GrOp* t, SkArenaAlloc*, const GrCaps& caps) override { ShadowCircularRRectOp* that = t->cast(); + + // Cannot combine if the net number of indices would overflow int32, or if the net number + // of vertices would overflow uint16 (since the index values are 16-bit that point into + // the vertex buffer). + if ((fIndexCount > INT32_MAX - that->fIndexCount) || + (fVertCount > SkToInt(UINT16_MAX) - that->fVertCount)) { + return CombineResult::kCannotCombine; + } + fGeoData.push_back_n(that->fGeoData.size(), that->fGeoData.begin()); fVertCount += that->fVertCount; fIndexCount += that->fIndexCount;