Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2025-01-13 07:24:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1375858 - Don't allow nsBulletFrame to be transformed. r=dbaron

Browse Source
This commit is contained in:
Matt Woodrow 2017-10-18 12:38:17 +13:00
parent 6792d1f16c
commit 12e6704c14
3 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
layout/generic/crashtests/1375858.html Normal file
View File

@ -0,0 +1,12 @@
<html>
<head>
<style>
*::-moz-list-bullet, * {
transform-style:preserve-3d;
}
</style>
</head>
<body>
<li></li>
</body>
</html>

1
layout/generic/crashtests/crashtests.list
View File

@ -662,6 +662,7 @@ load 1364361-1.html
load 1367413-1.html
load 1368617-1.html
load 1373586.html
load 1375858.html
load 1381134.html
load 1381134-2.html
load 1401420-1.html

8
layout/generic/nsBulletFrame.h
View File

@ -87,6 +87,14 @@ public:
void AddInlinePrefISize(gfxContext* aRenderingContext,
nsIFrame::InlinePrefISizeData* aData) override;
virtual bool IsFrameOfType(uint32_t aFlags) const override
{
if (aFlags & eSupportsCSSTransforms) {
return false;
}
return nsFrame::IsFrameOfType(aFlags);
}
// nsBulletFrame
int32_t SetListItemOrdinal(int32_t aNextOrdinal, bool* aChanged,
int32_t aIncrement);