Bug 1238928 - Don't assume that our child list is unchanged in nsDisplayPerspective::BuildLayer. r=tnikkel, a=lizzard
authorMatt Woodrow <mwoodrow@mozilla.com>
Fri, 01 Apr 2016 14:37:15 +1300
changeset 325806 ad52021053bf4933b36fde59be3954597f06ac3e
parent 325805 0f7a5afcc4079532f435326762a6d77a6834e38b
child 325807 e956f6247d517996dde09ad8efba8cb07d95b1d6
push id1128
push userjlund@mozilla.com
push dateWed, 01 Jun 2016 01:31:59 +0000
treeherdermozilla-release@fe0d30de989d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstnikkel, lizzard
bugs1238928
milestone47.0a2
Bug 1238928 - Don't assume that our child list is unchanged in nsDisplayPerspective::BuildLayer. r=tnikkel, a=lizzard
layout/base/nsDisplayList.cpp
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -6311,16 +6311,23 @@ nsDisplayPerspective::BuildLayer(nsDispl
 
   Matrix4x4 perspectiveMatrix;
   DebugOnly<bool> hasPerspective =
     nsDisplayTransform::ComputePerspectiveMatrix(mTransformFrame, appUnitsPerPixel,
                                                  perspectiveMatrix);
   MOZ_ASSERT(hasPerspective, "Why did we create nsDisplayPerspective?");
 
   /*
+   * ClipListToRange can remove our child after we were created.
+   */
+  if (!mList.GetChildren()->GetTop()) {
+    return nullptr;
+  }
+
+  /*
    * The resulting matrix is still in the coordinate space of the transformed
    * frame. Append a translation to the reference frame coordinates.
    */
   nsDisplayTransform* transform =
     static_cast<nsDisplayTransform*>(mList.GetChildren()->GetTop());
 
   Point3D newOrigin =
     Point3D(NSAppUnitsToFloatPixels(transform->ToReferenceFrame().x, appUnitsPerPixel),