Bug 1615091 - Fix panic in resolve_split_planes with invalid transform. r=nical
authorGlenn Watson <gw@intuitionlibrary.com>
Mon, 17 Feb 2020 14:37:34 +0000
changeset 514337 9d76363fefb284574d16b7310ab9d21820e92854
parent 514336 09688f0bad8aa4b25e6d40f6090c76f5e8141175
child 514338 0a121aa7d5276f109ab16d797745d2d226edb2dc
push id37132
push userrmaries@mozilla.com
push dateTue, 18 Feb 2020 04:10:21 +0000
treeherdermozilla-central@5df075b6a6bb [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnical
bugs1615091
milestone75.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1615091 - Fix panic in resolve_split_planes with invalid transform. r=nical Differential Revision: https://phabricator.services.mozilla.com/D63033
gfx/tests/crashtests/1615091.html
gfx/tests/crashtests/crashtests.list
gfx/wr/webrender/src/picture.rs
new file mode 100644
--- /dev/null
+++ b/gfx/tests/crashtests/1615091.html
@@ -0,0 +1,11 @@
+<style>
+:not(track) {
+  transform-style: preserve-3d;
+  rotate: 43deg 0 52 1;
+  border-bottom: -moz-mac-menuselect solid;
+}
+:root { -webkit-perspective: 1px }
+</style>
+<textarea>aaaaaa</textarea>
+<summary style="rotate: 32deg -1 1 -1">aa</summary>
+
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@@ -183,9 +183,10 @@ load 1494062-blob-image-wraplist-clip.ht
 load texture-allocator-zero-region.html
 load 1524418.html
 pref(layout.css.individual-transform.enabled,true) load 1529149.html
 load 1541113.html
 pref(layout.css.individual-transform.enabled,true) load 1547169.html
 load 1535657.html
 load 1566206.html
 load 1615141.html
+load 1615091.html
 
--- a/gfx/wr/webrender/src/picture.rs
+++ b/gfx/wr/webrender/src/picture.rs
@@ -4773,24 +4773,35 @@ impl PicturePrimitive {
                 .inverse()
             {
                 Some(transform) => transform.into_transform(),
                 // logging this would be a bit too verbose
                 None => continue,
             };
 
             let local_points = [
-                transform.transform_point3d(poly.points[0].cast()).unwrap(),
-                transform.transform_point3d(poly.points[1].cast()).unwrap(),
-                transform.transform_point3d(poly.points[2].cast()).unwrap(),
-                transform.transform_point3d(poly.points[3].cast()).unwrap(),
+                transform.transform_point3d(poly.points[0].cast()),
+                transform.transform_point3d(poly.points[1].cast()),
+                transform.transform_point3d(poly.points[2].cast()),
+                transform.transform_point3d(poly.points[3].cast()),
             ];
+
+            // If any of the points are un-transformable, just drop this
+            // plane from drawing.
+            if local_points.iter().any(|p| p.is_none()) {
+                continue;
+            }
+
+            let p0 = local_points[0].unwrap();
+            let p1 = local_points[1].unwrap();
+            let p2 = local_points[2].unwrap();
+            let p3 = local_points[3].unwrap();
             let gpu_blocks = [
-                [local_points[0].x, local_points[0].y, local_points[1].x, local_points[1].y].into(),
-                [local_points[2].x, local_points[2].y, local_points[3].x, local_points[3].y].into(),
+                [p0.x, p0.y, p1.x, p1.y].into(),
+                [p2.x, p2.y, p3.x, p3.y].into(),
             ];
             let gpu_handle = gpu_cache.push_per_frame_blocks(&gpu_blocks);
             let gpu_address = gpu_cache.get_address(&gpu_handle);
 
             ordered.push(OrderedPictureChild {
                 anchor: poly.anchor,
                 spatial_node_index,
                 gpu_address,