Bug 1153426 - Don't crash when doing an off-main-thread animation of a transform to or from the 'none' value. r=birtles
authorL. David Baron <dbaron@dbaron.org>
Thu, 16 Apr 2015 18:13:15 -0700
changeset 239679 62b47badf9f9557385658eb42cf2a025fa70ea5e
parent 239678 76671894fe90e9245c5714026987059d79252b38
child 239680 abe6234be8a3dc97ac5136041b6c462c3430790a
push id12444
push userryanvm@gmail.com
push dateFri, 17 Apr 2015 20:04:42 +0000
treeherderfx-team@560a202db924 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersbirtles
bugs1153426
milestone40.0a1
Bug 1153426 - Don't crash when doing an off-main-thread animation of a transform to or from the 'none' value. r=birtles I confirmed locally (with ./mach mochitest-plain --e10s on Linux) that the added test crashes without the patch and passes with the patch.
layout/style/nsStyleTransformMatrix.cpp
layout/style/test/test_animations_omta.html
--- a/layout/style/nsStyleTransformMatrix.cpp
+++ b/layout/style/nsStyleTransformMatrix.cpp
@@ -602,18 +602,23 @@ ReadTransforms(const nsCSSValueList* aLi
                bool &aCanStoreInRuleTree,
                nsRect& aBounds,
                float aAppUnitsPerMatrixUnit)
 {
   gfx3DMatrix result;
 
   for (const nsCSSValueList* curr = aList; curr != nullptr; curr = curr->mNext) {
     const nsCSSValue &currElem = curr->mValue;
-    NS_ASSERTION(currElem.GetUnit() == eCSSUnit_Function,
-                 "Stream should consist solely of functions!");
+    if (currElem.GetUnit() != eCSSUnit_Function) {
+      NS_ASSERTION(currElem.GetUnit() == eCSSUnit_None &&
+                   !aList->mNext,
+                   "stream should either be a list of functions or a "
+                   "lone None");
+      continue;
+    }
     NS_ASSERTION(currElem.GetArrayValue()->Count() >= 1,
                  "Incoming function is too short!");
 
     /* Read in a single transform matrix. */
     MatrixForTransformFunction(result, currElem.GetArrayValue(), aContext,
                                aPresContext, aCanStoreInRuleTree, aBounds);
   }
 
--- a/layout/style/test/test_animations_omta.html
+++ b/layout/style/test/test_animations_omta.html
@@ -154,16 +154,21 @@ https://bugzilla.mozilla.org/show_bug.cg
 
     .visitedLink:link { background-color: yellow }
     .visitedLink:visited { background-color: blue }
 
     @keyframes opacitymid {
       0% { opacity: 0.2 }
       100% { opacity: 0.8 }
     }
+
+    @keyframes transformnone {
+      0%, 100% { transform: translateX(50px) }
+      25%, 75% { transform: none }
+    }
   </style>
 </head>
 <body>
 <a target="_blank"
   href="https://bugzilla.mozilla.org/show_bug.cgi?id=964646">Mozilla Bug
   964646</a>
 <div id="display"></div>
 <pre id="test">
@@ -2252,12 +2257,23 @@ addAsyncAnimTest(function *() {
   // via painting.
   yield waitForPaints();
   omta_is("opacity", 0.75, RunningOn.Compositor,
           "anim2 at 825ms");
   advance_clock(75);
   omta_is("opacity", 0.875, RunningOn.Compositor,
           "anim2 at 900ms");
   done_div();
+
+  // Test that an interpolation that produces transform: none doesn't
+  // crash.
+  new_div("animation: transformnone 1s linear");
+  yield waitForPaintsFlushed();
+  omta_is("transform", { tx: 50 }, RunningOn.Compositor,
+          "transformnone animation at 0ms");
+  advance_clock(500);
+  omta_is("transform", { tx: 0 }, RunningOn.Compositor,
+          "transformnone animation at 500ms, interpolating none values");
+  done_div();
 });
 
 </script>
 </html>