Bug 1450162. Add a crash test that invalidates our previous assumptions. r=mstange
authorJeff Muizelaar <jmuizelaar@mozilla.com>
Wed, 04 Apr 2018 23:05:00 -0400
changeset 777821 f1307a26d16715c99a218ce848f09f97f39b8c37
parent 777820 b92f856e15a80efb562203ca00169c06fb1f4ae4
child 777822 93fda7f5d1f8e66663e8adcd36cb17ac90c1c938
child 777884 e72d2ab40d64f67d61207a31093b38e09a7c92c1
child 778018 79201aa0b1b19f0dc0f1ff341a256446db34da29
push id105296
push userpaolo.mozmail@amadzone.org
push dateThu, 05 Apr 2018 10:49:16 +0000
reviewersmstange
bugs1450162
milestone61.0a1
Bug 1450162. Add a crash test that invalidates our previous assumptions. r=mstange
layout/svg/crashtests/blob-merging-and-retained-display-list.html
layout/svg/crashtests/crashtests.list
new file mode 100644
--- /dev/null
+++ b/layout/svg/crashtests/blob-merging-and-retained-display-list.html
@@ -0,0 +1,62 @@
+<!doctype html>
+<html class="reftest-wait">
+<script>
+        var r = 40;
+        var xmlns = "http://www.w3.org/2000/svg";
+        const raf = f => requestAnimationFrame(f);
+        function rect(x, y) {
+            var r = document.createElementNS (xmlns, "rect");
+            r.setAttribute("x", x);
+            r.setAttribute("y", y);
+            r.setAttribute("width", "100");
+            r.setAttribute("height", "100");
+            r.setAttribute("fill", "blue");
+            return r;
+        }
+        function f1() {
+            svg = document.getElementById("cnvs");
+            svg.appendChild(rect(0, 0));
+            svg.appendChild(rect(600, 0));
+            svg.appendChild(rect(600, 400));
+            svg.appendChild(rect(0, 400));
+            let a = rect(110, 110);
+            let b = rect(120, 120);
+            let c = rect(130, 130);
+            let d = rect(140, 140);
+            let a2 = rect(310, 140);
+            let b2 = rect(320, 130);
+            let c2 = rect(330, 120);
+            let d2 = rect(340, 110);
+            raf(() => {
+                svg.appendChild(a);
+                svg.appendChild(b);
+                svg.appendChild(c);
+                svg.appendChild(d);
+                raf(() => {
+                    // the display list partial update will end up with these items before x,y,w,z
+                    svg.appendChild(d2);
+                    svg.appendChild(c2);
+                    svg.appendChild(b2);
+                    svg.appendChild(a2);
+                    raf(() => {
+                        // this forces all the items to be ordered and makes the new display list
+                        // contain reorded items outside of the invalid area
+                        let mix = rect(220, 220);
+                        svg.insertBefore(mix, d2);
+                        raf(() => { document.documentElement.className = "" });
+                    })
+                })
+            })
+        }
+
+        function f() {
+                requestAnimationFrame(f1);
+        }
+
+        onload = f;
+</script>
+
+<body>
+<svg width="700" height="600" id=cnvs>
+
+</svg>
--- a/layout/svg/crashtests/crashtests.list
+++ b/layout/svg/crashtests/crashtests.list
@@ -201,8 +201,9 @@ load 1322537-1.html
 load 1322537-2.html
 load 1322852.html
 load 1348564.svg
 load 1402109.html
 load 1402124.html
 load 1402486.html
 load conditional-outer-svg-nondirty-reflow-assert.xhtml
 load extref-test-1.xhtml
+load blob-merging-and-retained-display-list.html