Bug 1279819 - Copy keyframes array before iterating over it. r=hiro, a=lizzard
authorBrian Birtles <birtles@gmail.com>
Thu, 07 Jul 2016 20:34:14 -0400
changeset 341879 0f0647de29598b4d556e32372612329a9d743a12
parent 341878 7e901e35101221882ccf8867d767c9f47a2a6e0f
child 341880 9212b9883204873295964a20e72aa1665598e0dd
push id1183
push userraliiev@mozilla.com
push dateMon, 05 Sep 2016 20:01:49 +0000
treeherdermozilla-release@3148731bed45 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewershiro, lizzard
bugs1279819
milestone49.0a2
Bug 1279819 - Copy keyframes array before iterating over it. r=hiro, a=lizzard MozReview-Commit-ID: Fh99Ny4IOgJ
dom/animation/KeyframeEffect.cpp
--- a/dom/animation/KeyframeEffect.cpp
+++ b/dom/animation/KeyframeEffect.cpp
@@ -515,21 +515,28 @@ KeyframeEffectReadOnly::HasAnimationOfPr
 
 void
 KeyframeEffectReadOnly::UpdateProperties(nsStyleContext* aStyleContext)
 {
   MOZ_ASSERT(aStyleContext);
 
   nsTArray<AnimationProperty> properties;
   if (mTarget) {
+    // When GetAnimationPropertiesFromKeyframes calculates computed values
+    // from |mKeyframes|, if it triggers a subsequent restyle where we
+    // rebuild animations, we could find that |mKeyframes| is overwritten
+    // while it is being iterated over. Normally that shouldn't happen,
+    // but, just in case, we make a copy of |mKeyframes| first and iterate over
+    // that instead.
+    auto keyframesCopy(mKeyframes);
     properties =
       KeyframeUtils::GetAnimationPropertiesFromKeyframes(aStyleContext,
                                                          mTarget->mElement,
                                                          mTarget->mPseudoType,
-                                                         mKeyframes);
+                                                         keyframesCopy);
   }
 
   if (mProperties == properties) {
     return;
   }
 
   // Preserve the state of mWinsInCascade and mIsRunningOnCompositor flags.
   nsCSSPropertySet winningInCascadeProperties;