Bug 1352380 - Make sure gradient stops have ordered mPosition variables. r?dbaron
MozReview-Commit-ID: DsP5Q6qmvH2
new file mode 100644
--- /dev/null
+++ b/layout/base/crashtests/1352380.html
@@ -0,0 +1,9 @@
+<div style="
+ height: 20px;
+ background:
+ linear-gradient(green 20%,
+ red 60%,
+ white,
+ 40%, /* midpoint */
+ rgba(0,0,255,0.5),
+ rgba(0,255,255,0.5) 60%)"></div>
--- a/layout/base/crashtests/crashtests.list
+++ b/layout/base/crashtests/crashtests.list
@@ -485,8 +485,9 @@ load 1288946-2b.html
load 1297835.html
load 1299736-1.html
load 1308793.svg
load 1308848-1.html
load 1308848-2.html
load 1338772-1.html
skip-if(stylo) load 1343937.html
asserts(0-1) load 1343606.html # bug 1343948
+load 1352380.html
--- a/layout/painting/nsCSSRenderingGradients.cpp
+++ b/layout/painting/nsCSSRenderingGradients.cpp
@@ -624,17 +624,20 @@ nsCSSGradientRenderer::Create(nsPresCont
break;
default:
MOZ_ASSERT(false, "Unknown stop position type");
}
if (i > 0) {
// Prevent decreasing stop positions by advancing this position
// to the previous stop position, if necessary
- position = std::max(position, stops[i - 1].mPosition);
+ double previousPosition = firstUnsetPosition > 0
+ ? stops[firstUnsetPosition - 1].mPosition
+ : stops[i - 1].mPosition;
+ position = std::max(position, previousPosition);
}
stops.AppendElement(ColorStop(position, stop.mIsInterpolationHint,
Color::FromABGR(stop.mColor)));
if (firstUnsetPosition > 0) {
// Interpolate positions for all stops that didn't have a specified position
double p = stops[firstUnsetPosition - 1].mPosition;
double d = (stops[i].mPosition - p)/(i - firstUnsetPosition + 1);
for (uint32_t j = firstUnsetPosition; j < i; ++j) {