Bug 1238928 - Don't assume that our child list is unchanged in nsDisplayPerspective::BuildLayer. r=tnikkel
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -6369,16 +6369,23 @@ nsDisplayPerspective::BuildLayer(nsDispl
Matrix4x4 perspectiveMatrix;
DebugOnly<bool> hasPerspective =
nsDisplayTransform::ComputePerspectiveMatrix(mTransformFrame, appUnitsPerPixel,
perspectiveMatrix);
MOZ_ASSERT(hasPerspective, "Why did we create nsDisplayPerspective?");
/*
+ * ClipListToRange can remove our child after we were created.
+ */
+ if (!mList.GetChildren()->GetTop()) {
+ return nullptr;
+ }
+
+ /*
* The resulting matrix is still in the coordinate space of the transformed
* frame. Append a translation to the reference frame coordinates.
*/
nsDisplayTransform* transform =
static_cast<nsDisplayTransform*>(mList.GetChildren()->GetTop());
Point3D newOrigin =
Point3D(NSAppUnitsToFloatPixels(transform->ToReferenceFrame().x, appUnitsPerPixel),