Bug 1467847 - avoid taking inverse in Polygon::TransformToScreenSpace when possible. r=miko

2018-07-09 15:52:42 -04:00 · 2018-07-09 15:52:42 -04:00 · 23c3cc8f6b
--- a/gfx/2d/Polygon.h
+++ b/gfx/2d/Polygon.h
@ -328,10 +328,9 @@ public:
    mNormal = DefaultNormal();
  }

-  void TransformToScreenSpace(const Matrix4x4Typed<Units, Units>& aTransform)
+  void TransformToScreenSpace(const Matrix4x4Typed<Units, Units>& aTransform,
+                              const Matrix4x4Typed<Units, Units>& aInverseTransform)
  {
-    MOZ_ASSERT(!aTransform.IsSingular());
-
    TransformPoints(aTransform, false);

    // Perspective projection transformation might produce points with w <= 0,
@ -339,7 +338,15 @@ public:
    mPoints = ClipPointsAtInfinity(mPoints);

    // Normal vectors should be transformed using inverse transpose.
-    mNormal = aTransform.Inverse().Transpose().TransformPoint(mNormal);
+    mNormal = aInverseTransform.TransposeTransform4D(mNormal);
+  }
+
+
+  void TransformToScreenSpace(const Matrix4x4Typed<Units, Units>& aTransform)
+  {
+    MOZ_ASSERT(!aTransform.IsSingular());
+
+    TransformToScreenSpace(aTransform, aTransform.Inverse());
  }

 private:
--- a/gfx/layers/composite/ContainerLayerComposite.cpp
+++ b/gfx/layers/composite/ContainerLayerComposite.cpp
@ -148,7 +148,7 @@ TransformLayerGeometry(Layer* aLayer, Maybe<gfx::Polygon>& aGeometry)
  transform = transform.ProjectTo2D();

  if (!transform.IsSingular()) {
-    aGeometry->TransformToScreenSpace(transform.Inverse());
+    aGeometry->TransformToScreenSpace(transform.Inverse(), transform);
  } else {
    // Discard the geometry since the result might not be correct.
    aGeometry.reset();
--- a/gfx/tests/crashtests/1467847-1.html
+++ b/gfx/tests/crashtests/1467847-1.html
@ -0,0 +1,15 @@
+<html>
+<style>
+:root{
+transform-style:preserve-3d;
+}
+</style>
+<script>
+addEventListener("DOMContentLoaded", () => {
+  let s = document.createElement("fieldset")
+  document.getElementsByTagName("body")[0].appendChild(s)
+  s.animate([{ "transform": "matrix3d(258,8,296,626,168,58,272,151,47,-0,90,-101,116,-119,65,182) translate3d(199ch,238in,47q)" }], 1000)
+})
+</script>
+<body></body>
+</html>
--- a/gfx/tests/crashtests/crashtests.list
+++ b/gfx/tests/crashtests/crashtests.list
@ -164,3 +164,5 @@ load 1325159-1.html
 load 1331683.html
 skip-if(Android) pref(dom.disable_open_during_load,false) load 1343666.html
 load 1408078-1.html
+load 1467847-1.html
+