crash at nsIFrame::InvalidateTransformLayer

RESOLVED WORKSFORME

Status

()

defect
--
critical
RESOLVED WORKSFORME
8 years ago
Last year

People

(Reporter: aki.helin, Unassigned)

Tracking

({crash, testcase})

unspecified
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(1 attachment)

117 bytes, text/html
Details
User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

Browser crashes with a null deref at nsIFrame::InvalidateTransformLayer when a page is viewed.

Reproducible: Always

Steps to Reproduce:
1. $ echo '<body style="-moz-transform: rotate(520327040619807469187028288680706778649deg); position:fixed;"> <body text=black>' > crash.html
2. ...
3. $ firefox crash.html

Actual Results:  
Crashreporter is necessary.

Expected Results:  
Crashreported should not be necessary.

I don't have a debug build at hand to test with, but I only got a null deref out of this in initial tests.
Bug 668579
Severity: major → critical
Keywords: crash, testcase
OS: Linux → All
Hardware: x86_64 → All
Posted file testcase
Bumped up priority to get this noticed and marked platform to all/all after seeing this on 32- and 64-bit Linux, 64-bit Win7 and 32-bit WinNT (@ Bug 668579). Still crashes Aurora, Beta and has been crashing stable for a long time over here.
Crash Signature: [@ nsIFrame::InvalidateTransformLayer ]
Attachment #545058 - Attachment mime type: text/plain → text/html
Testcase doesn't crash anymore in Firefox27 on MacOS X.
Aki, can you confirm?
Status: UNCONFIRMED → RESOLVED
Closed: Last year
Flags: in-testsuite+
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.