Bug 1238928 - Don't assume that our child list is unchanged in nsDisplayPerspective::BuildLayer. r=tnikkel
authorMatt Woodrow <mwoodrow@mozilla.com>
Fri, 01 Apr 2016 14:37:15 +1300
changeset 291175 293229046bc268cf9fd3a40e53da0c792be924ae
parent 291174 2344e8a7c4b7849778c4df45bc67a510aae8c218
child 291176 8af4e6b9642767e130a8e30ce15d84d93b8eacaf
push id19656
push usergwagner@mozilla.com
push dateMon, 04 Apr 2016 13:43:23 +0000
treeherderb2g-inbound@e99061fde28a [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstnikkel
bugs1238928
milestone48.0a1
Bug 1238928 - Don't assume that our child list is unchanged in nsDisplayPerspective::BuildLayer. r=tnikkel
layout/base/nsDisplayList.cpp
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -6369,16 +6369,23 @@ nsDisplayPerspective::BuildLayer(nsDispl
 
   Matrix4x4 perspectiveMatrix;
   DebugOnly<bool> hasPerspective =
     nsDisplayTransform::ComputePerspectiveMatrix(mTransformFrame, appUnitsPerPixel,
                                                  perspectiveMatrix);
   MOZ_ASSERT(hasPerspective, "Why did we create nsDisplayPerspective?");
 
   /*
+   * ClipListToRange can remove our child after we were created.
+   */
+  if (!mList.GetChildren()->GetTop()) {
+    return nullptr;
+  }
+
+  /*
    * The resulting matrix is still in the coordinate space of the transformed
    * frame. Append a translation to the reference frame coordinates.
    */
   nsDisplayTransform* transform =
     static_cast<nsDisplayTransform*>(mList.GetChildren()->GetTop());
 
   Point3D newOrigin =
     Point3D(NSAppUnitsToFloatPixels(transform->ToReferenceFrame().x, appUnitsPerPixel),