Bug 896047 - Clear builder when fill rule for path changes. r=Bas
authorYury Delendik <ydelendik@mozilla.com>
Fri, 08 Nov 2013 21:24:24 -0600
changeset 170463 52e4b1e785fdccfaece6e833cf87e3a6d383fb7f
parent 170462 7c3719fec07c4b502e53ddf392723e40630f67e9
child 170464 f4449a06e97f517473389ccfb828070f8fb8807c
push id445
push userffxbld
push dateMon, 10 Mar 2014 22:05:19 +0000
treeherdermozilla-release@dc38b741b04e [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersBas
bugs896047
milestone28.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 896047 - Clear builder when fill rule for path changes. r=Bas
content/canvas/crashtests/896047-1.html
content/canvas/crashtests/896047-2.html
content/canvas/crashtests/crashtests.list
content/canvas/src/CanvasRenderingContext2D.cpp
new file mode 100644
--- /dev/null
+++ b/content/canvas/crashtests/896047-1.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.save();
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.fill('evenodd');
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
new file mode 100644
--- /dev/null
+++ b/content/canvas/crashtests/896047-2.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<body>
+<canvas id="c" width="200" height="100">
+</canvas>
+<script>
+var ctx = document.getElementById("c").getContext("2d");
+ctx.save();
+ctx.mozFillRule = 'nonzero';
+ctx.save();
+ctx.mozFillRule = 'evenodd';
+ctx.rect(0,0, 1,1);
+ctx.restore();
+ctx.isPointInPath(0,0);
+ctx.restore();
+ctx.lineTo(10, 0);
+</script>
+</body>
+</html>
--- a/content/canvas/crashtests/crashtests.list
+++ b/content/canvas/crashtests/crashtests.list
@@ -12,9 +12,11 @@ load 746813-1.html
 # this test crashes in a bunch places still
 #load 745818-large-source.html
 load 743499-negative-size.html
 skip-if(Android) load 767337-1.html
 skip-if(Android||B2G) load 780392-1.html # bug 833371 for B2G
 skip-if(Android||B2G) load 789933-1.html # bug 833371
 load 794463-1.html
 load 802926-1.html
+load 896047-1.html
+load 896047-2.html
 load 916128-1.html
--- a/content/canvas/src/CanvasRenderingContext2D.cpp
+++ b/content/canvas/src/CanvasRenderingContext2D.cpp
@@ -1998,16 +1998,17 @@ CanvasRenderingContext2D::EnsureUserSpac
       dsPath->TransformedCopyToBuilder(inverse, fillRule);
     mPath = mPathBuilder->Finish();
     mPathBuilder = nullptr;
   }
 
   if (mPath && mPath->GetFillRule() != fillRule) {
     mPathBuilder = mPath->CopyToBuilder(fillRule);
     mPath = mPathBuilder->Finish();
+    mPathBuilder = nullptr;
   }
 
   NS_ASSERTION(mPath, "mPath should exist");
 }
 
 void
 CanvasRenderingContext2D::TransformWillUpdate()
 {