Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 13:51:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1321357 part 1 - Copy elements from mMilestoneEntries before iterating over them; r=dholbert

Browse Source 
MozReview-Commit-ID: GjkXYlhoeoy
This commit is contained in:
Brian Birtles 2016-12-02 11:22:35 +09:00
parent ae7f7bd4ae
commit eb1500c6db
3 changed files with 30 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
dom/smil/nsSMILTimeContainer.cpp
View File

@ -317,18 +317,23 @@ nsSMILTimeContainer::NotifyTimeChange()
// milestone elements. This is because any timed element with dependents and
// with significant transitions yet to fire should have their next milestone
// registered. Other timed elements don't matter.
AutoRestore<bool> saveHolding(mHoldingEntries);
mHoldingEntries = true;
const MilestoneEntry* p = mMilestoneEntries.Elements();
#if DEBUG
uint32_t queueLength = mMilestoneEntries.Length();
#endif
while (p < mMilestoneEntries.Elements() + mMilestoneEntries.Length()) {
mozilla::dom::SVGAnimationElement* elem = p->mTimebase.get();
// Copy the timed elements to a separate array before calling
// HandleContainerTimeChange on each of them in case doing so mutates
// mMilestoneEntries.
nsTArray<RefPtr<mozilla::dom::SVGAnimationElement>> elems;
{
AutoRestore<bool> saveHolding(mHoldingEntries);
mHoldingEntries = true;
for (const MilestoneEntry* p = mMilestoneEntries.Elements();
p < mMilestoneEntries.Elements() + mMilestoneEntries.Length();
++p) {
elems.AppendElement(p->mTimebase.get());
}
}
for (auto& elem : elems) {
elem->TimedElement().HandleContainerTimeChange();
MOZ_ASSERT(queueLength == mMilestoneEntries.Length(),
"Call to HandleContainerTimeChange resulted in a change to the "
"queue of milestones");
++p;
}
}

12
layout/style/crashtests/1321357-1.html Normal file
View File

@ -0,0 +1,12 @@
<!doctype html>
<html>
<body onload="document.getElementById('containerA').pauseAnimations()">
<svg id="containerA">
<animate id="ia" end="50s"></animate>
<animate begin="60s" end="ic.end"></animate>
</svg>
<svg>
<animate id="ic" end="ia.end"></animate>
</svg>
</body>
</html>

1
layout/style/crashtests/crashtests.list
View File

@ -164,3 +164,4 @@ load 1315889-1.html
load 1315894-1.html
load 1319072-1.html
HTTP load 1320423-1.html
load 1321357-1.html