Fix a CHECK-failure in BrushTipShape constructor for infinitely-large brush tips

Even a valid brush can result in an infinitely-large tip state, due to float overflow, so we shouldn't crash if that happens.  However, previously `CalculateCircleRadius` could potentially return NaN for an infinitely-large tip state, causing the `Circle` constructor to CHECK-fail, since it requires a non-negative radius. (This CL also clarifies `Circle`'s API a bit, but doesn't change it.)

This crash was found by temporarily re-enabling the stroke generation fuzz test in `strokes/stroke_test.cc`. Fixing this crash is one step toward re-enabling that fuzz test.

PiperOrigin-RevId: 827472736

Author: Ink Open Source

ink/geometry/internal/circle.h

@@ -33,14 +33,17 @@ class Circle {
   Circle() = default;
 
   // Constructs with the given `center` and `radius`. CHECK-fails if `radius` is
-  // not greater than or equal to zero.
+  // negative or NaN.
   Circle(Point center, float radius);
 
   Circle(const Circle&) = default;
   Circle& operator=(const Circle&) = default;
   ~Circle() = default;
 
   Point Center() const;
+
+  // Returns the radius of the circle. This is guaranteed to be non-negative
+  // (and not NaN), but may be infinite.
   float Radius() const;
 
   // Returns the point on the circle at the given `angle`.

ink/geometry/internal/circle_test.cc

@@ -38,6 +38,7 @@ using ::testing::FloatNear;
 using ::testing::Ge;
 using ::testing::SizeIs;
 
+constexpr float kInfinity = std::numeric_limits<float>::infinity();
 constexpr float kNan = std::numeric_limits<float>::quiet_NaN();
 
 // Matcher for checking that every `Point` in the `arg` array lies on the
@@ -125,6 +126,12 @@ TEST(CircleTest, ConstructWithZeroRadius) {
   EXPECT_EQ(c.Radius(), 0);
 }
 
+TEST(CircleTest, ConstructWithInfiniteRadius) {
+  Circle c({-4, 7}, kInfinity);
+  EXPECT_THAT(c.Center(), PointEq({-4, 7}));
+  EXPECT_EQ(c.Radius(), kInfinity);
+}
+
 TEST(CircleTest, GetPoint) {
   Circle circle({1, 2}, 3.f);
 
@@ -405,6 +412,10 @@ TEST(CircleDeathTest, ConstructWithNegativeRadius) {
   EXPECT_DEATH_IF_SUPPORTED(Circle circle({1, 2}, -1), "");
 }
 
+TEST(CircleDeathTest, ConstructWithNanRadius) {
+  EXPECT_DEATH_IF_SUPPORTED(Circle circle({1, 2}, kNan), "");
+}
+
 TEST(CircleDeathTest, AppendArcToPolylineZeroChordHeight) {
   Circle circle;
   std::vector<Point> polyline;

ink/strokes/internal/brush_tip_shape.cc

@@ -54,11 +54,28 @@ using ::ink::geometry_internal::SegmentIntersection;
 float CalculateCircleRadius(float percent_radius, float half_width,
                             float half_height,
                             float min_nonzero_radius_and_separation) {
+  ABSL_DCHECK_GE(percent_radius, 0);
+  ABSL_DCHECK_LE(percent_radius, 1);
+  ABSL_DCHECK_GE(half_width, 0);
+  ABSL_DCHECK_GE(half_height, 0);
+  ABSL_DCHECK_GE(min_nonzero_radius_and_separation, 0);
+
+  // If `percent_radius` is exactly zero, we should always return zero, even if
+  // `half_width` and `half_height` are infinite (which can happen due to float
+  // overflow in an earlier calculation). This special case prevents multiplying
+  // zero times infinity below and getting a radius of NaN (which would then
+  // CHECK-fail when passed to the `Circle` constructor).
+  if (percent_radius == 0) {
+    return 0;
+  }
+
   float min_half_dimension = std::min(half_width, half_height);
   float unmodified_radius = percent_radius * min_half_dimension;
+  ABSL_DCHECK_GE(unmodified_radius, 0);
 
-  // This will result in the shape control circles to be points.
-  if (unmodified_radius < min_nonzero_radius_and_separation) return 0;
+  if (unmodified_radius < min_nonzero_radius_and_separation) {
+    return 0;
+  }
 
   return unmodified_radius;
 }

ink/strokes/internal/brush_tip_shape_test.cc

@@ -14,6 +14,8 @@
 
 #include "ink/strokes/internal/brush_tip_shape.h"
 
+#include <limits>
+
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
 #include "absl/strings/str_cat.h"
@@ -31,9 +33,13 @@ namespace {
 using ::ink::geometry_internal::Circle;
 using ::ink::geometry_internal::CircleEq;
 using ::ink::geometry_internal::CircleNear;
+using ::testing::Each;
 using ::testing::ElementsAre;
+using ::testing::Eq;
+using ::testing::Property;
 
 constexpr float kEpsilon = 1e-5;
+constexpr float kInfinity = std::numeric_limits<float>::infinity();
 
 BrushTipShape ShapeWithZeroMinRadiusAndSeparation(BrushTipState state) {
   return BrushTipShape(state, 0);
@@ -460,6 +466,25 @@ TEST(BrushTipShapeTest, ConstructedWithZeroHeight) {
       ElementsAre(CircleEq(Circle({2, 0}, 0)), CircleEq(Circle({-2, 0}, 0))));
 }
 
+TEST(BrushTipShapeTest, ConstructedWithInfiniteWidthAndHeightAndZeroRadius) {
+  // It's possible for a valid brush to end up with an infinitely-large tip
+  // state, due to float overflow. We should be able to construct a tip shape
+  // from that without crashing.
+  BrushTipState state = {
+      .position = {5, 3},
+      .width = kInfinity,
+      .height = kInfinity,
+      .percent_radius = 0,
+  };
+  BrushTipShape shape = ShapeWithZeroMinRadiusAndSeparation(state);
+  // Even though the tip shape is infinitely large, it should still have a
+  // well-defined center.
+  EXPECT_THAT(shape.Center(), PointEq({5, 3}));
+  // A `percent_radius` of exactly zero should always result in circles of zero
+  // radius (even though the size is infinite, and zero times infinity is NaN).
+  EXPECT_THAT(shape.PerimeterCircles(), Each(Property(&Circle::Radius, Eq(0))));
+}
+
 TEST(BrushTipShapeDeathTest, ConstructedWithPercentRadiusLessThanZero) {
   EXPECT_DEATH_IF_SUPPORTED(BrushTipShape(BrushTipState{.position = {0, 0},
                                                         .width = 2,