User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Build Identifier: Mozilla/5.0 (X11; Linux x86_64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1 Browser crashes with a null deref at nsIFrame::InvalidateTransformLayer when a page is viewed. Reproducible: Always Steps to Reproduce: 1. $ echo '<body style="-moz-transform: rotate(520327040619807469187028288680706778649deg); position:fixed;"> <body text=black>' > crash.html 2. ... 3. $ firefox crash.html Actual Results: Crashreporter is necessary. Expected Results: Crashreported should not be necessary. I don't have a debug build at hand to test with, but I only got a null deref out of this in initial tests.
Bumped up priority to get this noticed and marked platform to all/all after seeing this on 32- and 64-bit Linux, 64-bit Win7 and 32-bit WinNT (@ Bug 668579). Still crashes Aurora, Beta and has been crashing stable for a long time over here.
Attachment #545058 - Attachment mime type: text/plain → text/html
Testcase doesn't crash anymore in Firefox27 on MacOS X. Aki, can you confirm?
Pushed by email@example.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/0943ce386625 Add a crashtest. r=mats
Status: UNCONFIRMED → RESOLVED
Closed: Last year
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.