summaryrefslogtreecommitdiffstats
path: root/layout/mathml/nsMathMLmpaddedFrame.cpp
diff options
context:
space:
mode:
authorMarkus Stange <mstange@themasta.com>2019-09-04 12:00:52 +0200
committerwolfbeast <mcwerewolf@wolfbeast.com>2019-09-04 12:13:10 +0200
commit7c09f0ed7e3bbc2f4da4df7496478594b4f0fa0e (patch)
tree93ea636f49aab55dc7b912c64b5cf8c41103f625 /layout/mathml/nsMathMLmpaddedFrame.cpp
parent69ac6335874875b3dd14a391e5ddcd73ad60f23d (diff)
downloadUXP-7c09f0ed7e3bbc2f4da4df7496478594b4f0fa0e.tar
UXP-7c09f0ed7e3bbc2f4da4df7496478594b4f0fa0e.tar.gz
UXP-7c09f0ed7e3bbc2f4da4df7496478594b4f0fa0e.tar.lz
UXP-7c09f0ed7e3bbc2f4da4df7496478594b4f0fa0e.tar.xz
UXP-7c09f0ed7e3bbc2f4da4df7496478594b4f0fa0e.zip
Correctly return zero vertices if clipping plane 0 or 2 clip away the
entire polygon. This fixes a bug that was introduced three years ago in BZ bug 1268854. What happened was that the final pass over the polygon assumed that the current polygon was living in plane[0]. But due to the double buffering, the "current" polygon alternates between plane[0] and plane[1]. The bug had also introduced an early exit so that we could hit the final pass at a time where the current, now empty, polygon was in plane[1]. So we would incorrectly treat all 32 points in plane[0] as part of the final polygon. This bug was responsible for intermittently unreasonable numbers in CompositorOGL's fill rate / overdraw overlay. This fixes a regression caused by the fix for CVE-2016-5252.
Diffstat (limited to 'layout/mathml/nsMathMLmpaddedFrame.cpp')
0 files changed, 0 insertions, 0 deletions