Bug 1238928 - Don't assume that our child list is unchanged in nsDisplayPerspective::BuildLayer. r=tnikkel

--HG--
extra : rebase_source : 80c25d1bfca68986294aae5b35c1e204237a33f4

layout/base/nsDisplayList.cpp

@@ -6373,6 +6373,13 @@ nsDisplayPerspective::BuildLayer(nsDisplayListBuilder *aBuilder,
                                                  perspectiveMatrix);
   MOZ_ASSERT(hasPerspective, "Why did we create nsDisplayPerspective?");
 
+  /*
+   * ClipListToRange can remove our child after we were created.
+   */
+  if (!mList.GetChildren()->GetTop()) {
+    return nullptr;
+  }
+
   /*
    * The resulting matrix is still in the coordinate space of the transformed
    * frame. Append a translation to the reference frame coordinates.