Bug 1238928 - Don't assume that our child list is unchanged in nsDisplayPerspective::BuildLayer. r=tnikkel
☠☠ backed out by 3d3834cc0e36 ☠ ☠
authorMatt Woodrow <mwoodrow@mozilla.com>
Thu, 24 Mar 2016 18:14:44 +1300
changeset 290188 41de0b26ddd2349c616815788c1ed10c3dc43789
parent 290187 f1ad49c0b7219e69880fc23fd0d018e5b8ec72a8
child 290189 e3853bd7905106f0ad6674ff9fd1b62713a58333
push id30114
push usercbook@mozilla.com
push dateThu, 24 Mar 2016 15:15:54 +0000
treeherdermozilla-central@24c5fbde4488 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstnikkel
bugs1238928
milestone48.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1238928 - Don't assume that our child list is unchanged in nsDisplayPerspective::BuildLayer. r=tnikkel
layout/base/nsDisplayList.cpp
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -6369,16 +6369,23 @@ nsDisplayPerspective::BuildLayer(nsDispl
 
   Matrix4x4 perspectiveMatrix;
   DebugOnly<bool> hasPerspective =
     nsDisplayTransform::ComputePerspectiveMatrix(mTransformFrame, appUnitsPerPixel,
                                                  perspectiveMatrix);
   MOZ_ASSERT(hasPerspective, "Why did we create nsDisplayPerspective?");
 
   /*
+   * ClipListToRange can remove our child after we were created.
+   */
+  if (!mList.GetChildren()->GetTop()) {
+    return nullptr;
+  }
+
+  /*
    * The resulting matrix is still in the coordinate space of the transformed
    * frame. Append a translation to the reference frame coordinates.
    */
   nsDisplayTransform* transform =
     static_cast<nsDisplayTransform*>(mList.GetChildren()->GetTop());
 
   Point3D newOrigin =
     Point3D(NSAppUnitsToFloatPixels(transform->ToReferenceFrame().x, appUnitsPerPixel),