corysanin/tubestation
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 1430589 - Add crashtest. r=mattwoodrow,mstange

Browse Source 
MozReview-Commit-ID: 4KBEobcNx7w
This commit is contained in:
Kartikaya Gupta
2018-01-19 23:47:29 -05:00
parent 86488eef84
commit 3da5e78f17
4 changed files with 71 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
layout/painting/DisplayItemClipChain.h
View File

@@ -66,14 +66,24 @@ struct DisplayItemClipChain {
: mClip(aClip)
, mASR(aASR)
, mParent(aParent)
#ifdef DEBUG
, mOnStack(true)
#endif
{}
DisplayItemClipChain() {}
DisplayItemClipChain()
#ifdef DEBUG
: mOnStack(true)
#endif
{}
DisplayItemClip mClip;
const ActiveScrolledRoot* mASR;
RefPtr<const DisplayItemClipChain> mParent;
mutable uint32_t mRefCount = 0;
#ifdef DEBUG
bool mOnStack;
#endif
};
struct DisplayItemClipChainHasher

55
layout/painting/crashtests/1430589-1.html Normal file
View File

@@ -0,0 +1,55 @@
<html class="reftest-wait"><head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<style>
:root {
flex-wrap: wrap-reverse;
}
menuitem {
-webkit-mask-image: url(data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7);
}
* {
margin-right: -1px;
display: -webkit-box;
overflow: scroll;
}
.css1 {
-webkit-border-bottom-left-radius: 10px;
}
</style>
<script>
function BOOM(){
setTimeout(() => {
var elem = document.getElementById("vuln");
elem.style.width = 600;
elem.style.height = 600;
window.requestAnimationFrame(() => {
window.requestAnimationFrame(() => {
document.documentElement.removeAttribute("class");
});
});
}, 0);
}
document.addEventListener("MozReftestInvalidate", BOOM);
//window.addEventListener("load", BOOM);
</script></head>
<body>
<footer>
<textarea id="vuln" style="width: 500px; height: 500px;">Ashitaka</textarea>
</footer>
<menu>
<menuitem>
<iframe></iframe>
</menuitem></menu>
<menuitem>
<hr>
<dialog class="css1"></dialog>
</menuitem></body></html>

1
layout/painting/crashtests/crashtests.list
View File

@@ -8,3 +8,4 @@ load 1418722-1.html
load 1419917.html
load 1425271-1.html
load 1428906-1.html
skip-if(webrender) load 1430589-1.html # bug 1421825 for webrender

4
layout/painting/nsDisplayList.cpp
View File

@@ -1569,8 +1569,12 @@ nsDisplayListBuilder::AllocateDisplayItemClipChain(const DisplayItemClip& aClip,
const ActiveScrolledRoot* aASR,
const DisplayItemClipChain* aParent)
{
MOZ_ASSERT(!(aParent && aParent->mOnStack));
void* p = Allocate(sizeof(DisplayItemClipChain), DisplayItemType::TYPE_ZERO);
DisplayItemClipChain* c = new (KnownNotNull, p) DisplayItemClipChain(aClip, aASR, aParent);
#ifdef DEBUG
c->mOnStack = false;
#endif
auto result = mClipDeduplicator.insert(c);
if (!result.second) {
// An equivalent clip chain item was already created, so let's return that