do not mergeandroid-sdk-2.0.1_r1android-sdk-2.0.1-docs_r1android-2.0.1_r1eclair-sholes-release

read/write fDither in flattening/unflatten, otherwise it is uninitialized

http://b/issue?id=2187714&query=2187714

ImageRefs get flattened by the picture code when we serialize a picture, which we do sometimes
in the browser so we can unserialize it and show something right away after the browser has been
killed (due to low-memory).

With this dither field uninitialized, we pass it down to the SkImageDecoder_libpng.cpp, by way of
calling setDitherImage() on the codec. Now the codec has this random value. It, in turn, passes it
to the ScaledBitmapSampler, which says the follow, as it computes an index into a table of
function pointers.

int index = 0;
if (dither) {
    index += 1;
}

GCC (at least the current 4.4 version) has optimized that into just (effectively)

    index = dither;

Thus the index is some random value, and hence the wacky functions that sometimes appear in the
stack traces when we crash, since we walk off the end of the local function-ptr table and load
some other function-ptr.

This change (read/write the dither value from/to the stream) was recently added to MR2, fixing a
bug where we lost the dithering (i.e. the random value turned out to be 0, and the caller expected
1)

1 files changed, 2 insertions, 0 deletions

diff --git a/src/images/SkImageRef.cpp b/src/images/SkImageRef.cpp
index 7ef5f40418..3756d4e2c0 100644
--- a/src/images/SkImageRef.cpp
+++ b/src/images/SkImageRef.cpp
@@ -160,6 +160,7 @@ SkImageRef::SkImageRef(SkFlattenableReadBuffer& buffer)
         : INHERITED(buffer, &gImageRefMutex), fErrorInDecoding(false) {
     fConfig = (SkBitmap::Config)buffer.readU8();
     fSampleSize = buffer.readU8();
+    fDoDither = buffer.readBool();
     size_t length = buffer.readU32();
     fStream = SkNEW_ARGS(SkMemoryStream, (length));
     buffer.read((void*)fStream->getMemoryBase(), length);
@@ -173,6 +174,7 @@ void SkImageRef::flatten(SkFlattenableWriteBuffer& buffer) const {
 
     buffer.write8(fConfig);
     buffer.write8(fSampleSize);
+    buffer.writeBool(fDoDither);
     size_t length = fStream->getLength();
     buffer.write32(length);
     fStream->rewind();