Bug 859526 - Null check parent frames when wrapping preserve-3d display lists. r=roc
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/859526-1.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<html style="transform-style: preserve-3d;"><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252"></head><body>
+<iframe></iframe>
+
+
+</body></html>
\ No newline at end of file
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -386,8 +386,9 @@ asserts(0-2) load 736389-1.xhtml # somet
asserts-if(winWidget,0-2) load 736924-1.html # bug 738803
load 749816-1.html
load 763223-1.html
test-pref(font.size.inflation.emPerLine,15) test-pref(font.size.inflation.lineThreshold,100) load 763702.xhtml
load 770381-1.html
load 795646.html
load 813372-1.html
load 836990-1.html
+pref(layers.force-active,true) load 859526-1.html
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -1668,17 +1668,19 @@ WrapPreserve3DListInternal(nsIFrame* aFr
nsresult rv = NS_OK;
while (nsDisplayItem *item = aList->RemoveBottom()) {
nsIFrame *childFrame = item->GetUnderlyingFrame();
// We accumulate sequential items that aren't transforms into the 'temp' list
// and then flush this list into aOutput by wrapping the whole lot with a single
// nsDisplayTransform.
- if (childFrame && (childFrame->GetParent()->Preserves3DChildren() || childFrame == aFrame)) {
+ if (childFrame &&
+ childFrame->GetParent() &&
+ (childFrame->GetParent()->Preserves3DChildren() || childFrame == aFrame)) {
switch (item->GetType()) {
case nsDisplayItem::TYPE_TRANSFORM: {
if (!aTemp->IsEmpty()) {
aOutput->AppendToTop(new (aBuilder) nsDisplayTransform(aBuilder, aFrame, aTemp, aIndex++));
}
aOutput->AppendToTop(item);
break;
}