Bug 859526 - Null check parent frames when wrapping preserve-3d display lists. r=roc
authorMatt Woodrow <mwoodrow@mozilla.com>
Mon, 15 Apr 2013 18:55:34 +1200
changeset 135530 3b0cda3057dfc1a3c9a2342ad938a8a7ea6bcf32
parent 135529 457ff5b67290524866ad1d23d4f7166c9246fcca
child 135531 c05b48c2503553226bdefda865f526784f23d88f
push id3752
push userlsblakk@mozilla.com
push dateMon, 13 May 2013 17:21:10 +0000
treeherdermozilla-aurora@1580544aef0b [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersroc
bugs859526
milestone23.0a1
Bug 859526 - Null check parent frames when wrapping preserve-3d display lists. r=roc
layout/base/crashtests/859526-1.html
layout/base/crashtests/crashtests.list
layout/generic/nsFrame.cpp
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/859526-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html style="transform-style: preserve-3d;"><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252"></head><body>
+<iframe></iframe>
+
+
+</body></html>
\ No newline at end of file
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -386,8 +386,9 @@ asserts(0-2) load 736389-1.xhtml # somet
 asserts-if(winWidget,0-2) load 736924-1.html # bug 738803
 load 749816-1.html
 load 763223-1.html
 test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,100) load 763702.xhtml
 load 770381-1.html
 load 795646.html
 load 813372-1.html
 load 836990-1.html
+pref(layers.force-active,true) load 859526-1.html
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -1668,17 +1668,19 @@ WrapPreserve3DListInternal(nsIFrame* aFr
   nsresult rv = NS_OK;
   while (nsDisplayItem *item = aList->RemoveBottom()) {
     nsIFrame *childFrame = item->GetUnderlyingFrame();
 
     // We accumulate sequential items that aren't transforms into the 'temp' list
     // and then flush this list into aOutput by wrapping the whole lot with a single
     // nsDisplayTransform.
 
-    if (childFrame && (childFrame->GetParent()->Preserves3DChildren() || childFrame == aFrame)) {
+    if (childFrame &&
+        childFrame->GetParent() &&
+        (childFrame->GetParent()->Preserves3DChildren() || childFrame == aFrame)) {
       switch (item->GetType()) {
         case nsDisplayItem::TYPE_TRANSFORM: {
           if (!aTemp->IsEmpty()) {
             aOutput->AppendToTop(new (aBuilder) nsDisplayTransform(aBuilder, aFrame, aTemp, aIndex++));
           }
           aOutput->AppendToTop(item);
           break;
         }