Bug 1352380 - Make sure gradient stops have ordered mPosition variables. r=dbaron

MozReview-Commit-ID: DsP5Q6qmvH2

--HG--
extra : rebase_source : 69d1480d116fd6d2bf47e594aba478145d142786

layout/base/crashtests/1352380.html

@@ -0,0 +1,9 @@
+<div style="
+  height: 20px;
+  background:
+    linear-gradient(green 20%,
+                    red 60%,
+                    white,
+                    40%, /* midpoint */
+                    rgba(0,0,255,0.5),
+                    rgba(0,255,255,0.5) 60%)"></div>

layout/base/crashtests/crashtests.list

@@ -490,3 +490,4 @@ load 1308848-2.html
 load 1338772-1.html
 load 1343937.html
 asserts(0-1) load 1343606.html # bug 1343948
+load 1352380.html

layout/painting/nsCSSRenderingGradients.cpp

@@ -629,7 +629,10 @@ nsCSSGradientRenderer::Create(nsPresContext* aPresContext,
     if (i > 0) {
       // Prevent decreasing stop positions by advancing this position
       // to the previous stop position, if necessary
-      position = std::max(position, stops[i - 1].mPosition);
+      double previousPosition = firstUnsetPosition > 0
+        ? stops[firstUnsetPosition - 1].mPosition
+        : stops[i - 1].mPosition;
+      position = std::max(position, previousPosition);
     }
     stops.AppendElement(ColorStop(position, stop.mIsInterpolationHint,
                                   Color::FromABGR(stop.mColor)));