Bug 1375858 - Don't allow nsBulletFrame to be transformed. r=dbaron
authorMatt Woodrow <mwoodrow@mozilla.com>
Wed, 18 Oct 2017 12:38:17 +1300
changeset 682066 e7a617e26b9696c2656a09bc711649549f3e0875
parent 682065 65de500fc528d3d06e700dbf5af557b10b837ccd
child 682067 80acc252947941171929d39a03f3e4c6b14f1064
push id84995
push userbmo:rail@mozilla.com
push dateWed, 18 Oct 2017 02:21:51 +0000
reviewersdbaron
bugs1375858
milestone58.0a1
Bug 1375858 - Don't allow nsBulletFrame to be transformed. r=dbaron
layout/generic/crashtests/1375858.html
layout/generic/crashtests/crashtests.list
layout/generic/nsBulletFrame.h
new file mode 100644
--- /dev/null
+++ b/layout/generic/crashtests/1375858.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<style>
+  *::-moz-list-bullet, * {
+    transform-style:preserve-3d;
+  }
+</style>
+</head>
+<body>
+  <li></li>
+</body>
+</html>
--- a/layout/generic/crashtests/crashtests.list
+++ b/layout/generic/crashtests/crashtests.list
@@ -657,14 +657,15 @@ load 1308876-1.html
 load 1316649.html
 load 1349650.html
 asserts-if(browserIsRemote,0-5) load 1349816-1.html # bug 1350352
 load 1350372.html
 load 1364361-1.html
 load 1367413-1.html
 load 1368617-1.html
 load 1373586.html
+load 1375858.html
 load 1381134.html
 load 1381134-2.html
 load 1401420-1.html
 load 1401709.html
 load 1401807.html
 load 1405443.html
--- a/layout/generic/nsBulletFrame.h
+++ b/layout/generic/nsBulletFrame.h
@@ -82,16 +82,24 @@ public:
                       nsReflowStatus& aStatus) override;
   virtual nscoord GetMinISize(gfxContext *aRenderingContext) override;
   virtual nscoord GetPrefISize(gfxContext *aRenderingContext) override;
   void AddInlineMinISize(gfxContext* aRenderingContext,
                          nsIFrame::InlineMinISizeData* aData) override;
   void AddInlinePrefISize(gfxContext* aRenderingContext,
                           nsIFrame::InlinePrefISizeData* aData) override;
 
+  virtual bool IsFrameOfType(uint32_t aFlags) const override
+  {
+    if (aFlags & eSupportsCSSTransforms) {
+      return false;
+    }
+    return nsFrame::IsFrameOfType(aFlags);
+  }
+
   // nsBulletFrame
   int32_t SetListItemOrdinal(int32_t aNextOrdinal, bool* aChanged,
                              int32_t aIncrement);
 
   /* get list item text, with prefix & suffix */
   void GetListItemText(nsAString& aResult);
 
   void GetSpokenText(nsAString& aText);