mirror of
https://github.com/HeyPuter/firefox.git
synced 2026-11-13 20:14:57 -10:00
Xida Chen
2a49935fa3
Automatic update from web-platform-tests Fix a crash PaintWorkletImageProvider::GetPaintRecordResult The root cause of this crash is: At DiscardableImageMap::GatherDiscardableImages, we got early exist when the PaintOp::ComputePaintRect. The early out makes sense because there is nothing to paint if the paint rect is empty. Due to the above early out, the |paint_worklet_records_| in the PictureLayerImpl is empty. But later on at DrawImageRectOp::RasterWithFlags, we do not have the same check using PaintOp::ComputePaintRect, so it will try to look for the RasterContent in the |paint_worklet_records_|. The solution is that at DrawImageRectOp::RasterWithFlags, if the PaintOp::ComputePaintRect is empty, we should just early return because there is nothing to paint, so no paint record at all. Bug: 1095163, 1156955 Change-Id: Ic46636cfe7c256f58261430e07c9ff3a9efa6c80 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2570548 Commit-Queue: Xida Chen <[email protected]> Reviewed-by: Khushal <[email protected]> Cr-Commit-Position: refs/heads/master@{#835369} -- wpt-commits: 145ee7b74fd7dcc7e7cfc22ee75a7f51d1714e66 wpt-pr: 26761
40 lines
898 B
HTML
40 lines
898 B
HTML
<!DOCTYPE html>
|
|
<html class="test-wait">
|
|
<link rel="help" href="https://drafts.css-houdini.org/css-paint-api/">
|
|
<style>
|
|
#output {
|
|
width: 100px;
|
|
height: 100px;
|
|
}
|
|
body {
|
|
-webkit-mask-box-image-source: url(resources/dot.png);
|
|
column-count: 3;
|
|
}
|
|
.test-wait {
|
|
column-count: 600;
|
|
}
|
|
</style>
|
|
<body>
|
|
<div id="output"></div>
|
|
|
|
<script id="code" type="text/worklet">
|
|
registerPaint('green', class {
|
|
paint(ctx, geom) {}
|
|
});
|
|
</script>
|
|
|
|
<script>
|
|
// Regression test for crbug.com/1095163, the test passes as long as it doesn't
|
|
// crash.
|
|
var el = document.getElementById('output');
|
|
el.style.backgroundImage = 'paint(green)';
|
|
|
|
var blob = new Blob([document.getElementById('code').textContent],
|
|
{type: 'text/javascript'});
|
|
CSS.paintWorklet.addModule(URL.createObjectURL(blob)).then(function() {
|
|
document.documentElement.classList.remove("test-wait");
|
|
});
|
|
</script>
|
|
</body>
|
|
</html>
|