Bug 1352380 - Make sure gradient stops have ordered mPosition variables. r?dbaron draft
authorMarkus Stange <mstange@themasta.com>
Wed, 05 Apr 2017 09:54:03 -0400
changeset 556155 aa2f2b5121ac4c6d7cb256297a453743a7363b01
parent 556154 874c630cfccf7d9722a66d7e8386fe06c72e51dc
child 557452 a29f7c33ac2cde48e10f97ac7d74bc27946abced
push id52472
push userbmo:mstange@themasta.com
push dateWed, 05 Apr 2017 13:55:19 +0000
reviewersdbaron
bugs1352380
milestone55.0a1
Bug 1352380 - Make sure gradient stops have ordered mPosition variables. r?dbaron MozReview-Commit-ID: DsP5Q6qmvH2
layout/base/crashtests/1352380.html
layout/base/crashtests/crashtests.list
layout/painting/nsCSSRenderingGradients.cpp
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/1352380.html
@@ -0,0 +1,9 @@
+<div style="
+  height: 20px;
+  background:
+    linear-gradient(green 20%,
+                    red 60%,
+                    white,
+                    40%, /* midpoint */
+                    rgba(0,0,255,0.5),
+                    rgba(0,255,255,0.5) 60%)"></div>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -485,8 +485,9 @@ load 1288946-2b.html
 load 1297835.html
 load 1299736-1.html
 load 1308793.svg
 load 1308848-1.html
 load 1308848-2.html
 load 1338772-1.html
 skip-if(stylo) load 1343937.html
 asserts(0-1) load 1343606.html # bug 1343948
+load 1352380.html
--- a/layout/painting/nsCSSRenderingGradients.cpp
+++ b/layout/painting/nsCSSRenderingGradients.cpp
@@ -624,17 +624,20 @@ nsCSSGradientRenderer::Create(nsPresCont
       break;
     default:
       MOZ_ASSERT(false, "Unknown stop position type");
     }
 
     if (i > 0) {
       // Prevent decreasing stop positions by advancing this position
       // to the previous stop position, if necessary
-      position = std::max(position, stops[i - 1].mPosition);
+      double previousPosition = firstUnsetPosition > 0
+        ? stops[firstUnsetPosition - 1].mPosition
+        : stops[i - 1].mPosition;
+      position = std::max(position, previousPosition);
     }
     stops.AppendElement(ColorStop(position, stop.mIsInterpolationHint,
                                   Color::FromABGR(stop.mColor)));
     if (firstUnsetPosition > 0) {
       // Interpolate positions for all stops that didn't have a specified position
       double p = stops[firstUnsetPosition - 1].mPosition;
       double d = (stops[i].mPosition - p)/(i - firstUnsetPosition + 1);
       for (uint32_t j = firstUnsetPosition; j < i; ++j) {