Bug 859526 - Null check parent frames when wrapping preserve-3d display lists. r=roc
authorMatt Woodrow <mwoodrow@mozilla.com>
Mon, 15 Apr 2013 18:55:34 +1200
changeset 128755 3b0cda3057dfc1a3c9a2342ad938a8a7ea6bcf32
parent 128754 457ff5b67290524866ad1d23d4f7166c9246fcca
child 128756 c05b48c2503553226bdefda865f526784f23d88f
push id24540
push userryanvm@gmail.com
push dateMon, 15 Apr 2013 16:12:05 +0000
treeherdermozilla-central@53c2e7b9753b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs859526
milestone23.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 859526 - Null check parent frames when wrapping preserve-3d display lists. r=roc
layout/base/crashtests/859526-1.html
layout/base/crashtests/crashtests.list
layout/generic/nsFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/859526-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html style="transform-style: preserve-3d;"><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252"></head><body>
+<iframe></iframe>
+
+
+</body></html>
\ No newline at end of file
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -386,8 +386,9 @@ asserts(0-2) load 736389-1.xhtml # somet
 asserts-if(winWidget,0-2) load 736924-1.html # bug 738803
 load 749816-1.html
 load 763223-1.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,100) load 763702.xhtml
 load 770381-1.html
 load 795646.html
 load 813372-1.html
 load 836990-1.html
+pref(layers.force-active,true) load 859526-1.html
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -1668,17 +1668,19 @@ WrapPreserve3DListInternal(nsIFrame* aFr
   nsresult rv = NS_OK;
   while (nsDisplayItem *item = aList->RemoveBottom()) {
     nsIFrame *childFrame = item->GetUnderlyingFrame();
 
     // We accumulate sequential items that aren't transforms into the 'temp' list
     // and then flush this list into aOutput by wrapping the whole lot with a single
     // nsDisplayTransform.
 
-    if (childFrame && (childFrame->GetParent()->Preserves3DChildren() || childFrame == aFrame)) {
+    if (childFrame &&
+        childFrame->GetParent() &&
+        (childFrame->GetParent()->Preserves3DChildren() || childFrame == aFrame)) {
       switch (item->GetType()) {
         case nsDisplayItem::TYPE_TRANSFORM: {
           if (!aTemp->IsEmpty()) {
             aOutput->AppendToTop(new (aBuilder) nsDisplayTransform(aBuilder, aFrame, aTemp, aIndex++));
           }
           aOutput->AppendToTop(item);
           break;
         }