Bug 696188. Fix leak when adding different transform lists for animation. r=dholbert

2011-10-25 12:58:35 -04:00 · 2011-10-25 12:58:35 -04:00 · 97dfd95cc1
--- a/layout/style/crashtests/696188-1.html
+++ b/layout/style/crashtests/696188-1.html
@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html>
+<head>
+
+<script>
+
+function boom()
+{
+  var e = document.createElementNS("http://www.w3.org/1999/xhtml", "div");
+  document.body.appendChild(e);
+  e.setAttribute("style", "-moz-transform: rotate3d(2, 3, 4, 45deg) scale(10);");
+  e.offsetHeight;
+  e.setAttribute("style", "-moz-transition-duration: 1ms;");
+}
+
+</script>
+</head>
+
+<body onload="boom();"></body>
+</html>
--- a/layout/style/crashtests/crashtests.list
+++ b/layout/style/crashtests/crashtests.list
@ -73,3 +73,4 @@ load 665209-1.html
 asserts(2) load 671799-1.html
 asserts(2) load 671799-2.html
 load 690990-1.html
+load 696188-1.html
--- a/layout/style/nsStyleAnimation.cpp
+++ b/layout/style/nsStyleAnimation.cpp
@ -1544,7 +1544,8 @@ AddTransformLists(const nsCSSValueList* aList1, double aCoeff1,
            AddDifferentTransformLists(&tempList1, aCoeff1, &tempList2, aCoeff2);
        }

-        while ((*resultTail)->mNext) {
+        // Now advance resultTail to point to the new tail slot.
+        while (*resultTail) {
          resultTail = &(*resultTail)->mNext;
        }