зеркало из https://github.com/mozilla/gecko-dev.git
12991c6b74
When we call nsCanvasFrame::BuildDisplayList from nsHTMLScrollFrame::BuildDisplayList there is already a compositor hit test item in it, created here https://searchfox.org/mozilla-central/rev/ff08e36e1f368bd193b54f569dbd79105b50f9a0/layout/generic/nsGfxScrollFrame.cpp#4146 If we create a blend container item in nsCanvasFrame::BuildDisplayList it puts everything that might already exist in the display list inside the blend container item. It should only do this for the background items that we just created as this is for background blend mode, we are only blending within the background of this frame. In the fuzz testcase we then have a partial display list build that visits the root scroll frame (because a scroll bar is dirty), so it builds the compositor hit test item for the canvas frame (the child of the scroll frame), but canvas frame is not modified, so we don't descend into it, and we don't call nsCanvasFrame::BuildDisplayList, so the compositor hit test item does not get wrapped in the blend container, and thus it has moved in the display list without being marked modified. Differential Revision: https://phabricator.services.mozilla.com/D209511 |
||
|---|---|---|
| .. | ||
| 1402183-1.html | ||
| 1405881-1.html | ||
| 1407470-1.html | ||
| 1413073-1.html | ||
| 1413073-2.html | ||
| 1418177-1.html | ||
| 1418722-1.html | ||
| 1419917.html | ||
| 1425271-1.html | ||
| 1428906-1.html | ||
| 1430589-1.html | ||
| 1454105-1.html | ||
| 1455944-1.html | ||
| 1458145.html | ||
| 1465305-1.html | ||
| 1468124-1.html | ||
| 1469472.html | ||
| 1477831-1.html | ||
| 1504033.html | ||
| 1514544-1.html | ||
| 1547420-1.html | ||
| 1549909.html | ||
| 1551389-1.html | ||
| 1555819-1.html | ||
| 1574392.html | ||
| 1589800-1.html | ||
| 1667503-1.html | ||
| 1713880-1.html | ||
| 1714584-1.html | ||
| 1717655-1.html | ||
| 1763006-1.html | ||
| 1819957-1.html | ||
| 1851726-1.html | ||
| 1862277-1.html | ||
| 1870415-1.html | ||
| crashtests.list | ||