Closed Bug 653675 Opened 13 years ago Closed 6 years ago

crash at nsIFrame::InvalidateTransformLayer

Categories

(Core :: CSS Parsing and Computation, defect)

defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: aki.helin, Unassigned)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(1 file)

User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

Browser crashes with a null deref at nsIFrame::InvalidateTransformLayer when a page is viewed.

Reproducible: Always

Steps to Reproduce:
1. $ echo '<body style="-moz-transform: rotate(520327040619807469187028288680706778649deg); position:fixed;"> <body text=black>' > crash.html
2. ...
3. $ firefox crash.html

Actual Results:  
Crashreporter is necessary.

Expected Results:  
Crashreported should not be necessary.

I don't have a debug build at hand to test with, but I only got a null deref out of this in initial tests.
Bug 668579
Severity: major → critical
Keywords: crash, testcase
OS: Linux → All
Hardware: x86_64 → All
Attached file testcase
Bumped up priority to get this noticed and marked platform to all/all after seeing this on 32- and 64-bit Linux, 64-bit Win7 and 32-bit WinNT (@ Bug 668579). Still crashes Aurora, Beta and has been crashing stable for a long time over here.
Crash Signature: [@ nsIFrame::InvalidateTransformLayer ]
Attachment #545058 - Attachment mime type: text/plain → text/html
Testcase doesn't crash anymore in Firefox27 on MacOS X.
Aki, can you confirm?
Status: UNCONFIRMED → RESOLVED
Closed: 6 years ago
Flags: in-testsuite+
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: