Bug 1615141 - Fix panic in picture cache dependency building. r=Bert
authorGlenn Watson <gw@intuitionlibrary.com>
Fri, 14 Feb 2020 00:30:02 +0000
changeset 513860 fc74126fedeb2bb945db4d52e54266c955e9bbe7
parent 513859 118ce2f460fcb323600bbc1080110066edf9a798
child 513861 c7172b32a80d6ec2be386c60d48f42b4dbbcf5a6
push id37122
push usercsabou@mozilla.com
push dateFri, 14 Feb 2020 10:05:11 +0000
treeherdermozilla-central@ccbbd26e4bec [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersBert
bugs1615141
milestone75.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1615141 - Fix panic in picture cache dependency building. r=Bert Differential Revision: https://phabricator.services.mozilla.com/D62851
gfx/tests/crashtests/1615141.html
gfx/tests/crashtests/crashtests.list
gfx/wr/webrender/src/picture.rs
new file mode 100644
--- /dev/null
+++ b/gfx/tests/crashtests/1615141.html
@@ -0,0 +1,13 @@
+<style>
+#a {
+  outline: solid;
+  mix-blend-mode: difference;
+}
+:not(animateTransform),
+feDiffuseLighting:nth-last-of-type(2) {
+  -webkit-transform-style: preserve-3d;
+  transform: translate3d(7px, 6px, 6px);
+  -webkit-perspective: 1px;
+</style>
+<ol id="a">
+
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@@ -182,8 +182,10 @@ load 1509123.html
 load 1494062-blob-image-wraplist-clip.html
 load texture-allocator-zero-region.html
 load 1524418.html
 pref(layout.css.individual-transform.enabled,true) load 1529149.html
 load 1541113.html
 pref(layout.css.individual-transform.enabled,true) load 1547169.html
 load 1535657.html
 load 1566206.html
+load 1615141.html
+
--- a/gfx/wr/webrender/src/picture.rs
+++ b/gfx/wr/webrender/src/picture.rs
@@ -2536,20 +2536,27 @@ impl TileCacheInstance {
 
                 let map_local_to_surface = SpaceMapper::new_with_target(
                     surface.surface_spatial_node_index,
                     current_spatial_node_index,
                     surface.rect,
                     frame_context.spatial_tree,
                 );
 
-                current_pic_clip_rect = map_local_to_surface
-                    .map(&current_pic_clip_rect)
-                    .expect("bug: unable to map")
-                    .inflate(surface.inflation_factor, surface.inflation_factor);
+                // Map the rect into the parent surface, and inflate if this surface requires
+                // it. If the rect can't be mapping (e.g. due to an invalid transform) then
+                // just bail out from the dependencies and cull this primitive.
+                current_pic_clip_rect = match map_local_to_surface.map(&current_pic_clip_rect) {
+                    Some(rect) => {
+                        rect.inflate(surface.inflation_factor, surface.inflation_factor)
+                    }
+                    None => {
+                        return false;
+                    }
+                };
 
                 current_spatial_node_index = surface.surface_spatial_node_index;
             }
 
             current_pic_clip_rect
         };
 
         // Get the tile coordinates in the picture space.