Closed Bug 668579 Opened 13 years ago Closed 10 years ago

crash [@ nsIFrame::InvalidateTransformLayer() ] with position: fixed; -moz-transition-duration: 1s;-moz-transform: scale(1.5)

Categories

(Core :: Layout, defect)

defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME
Tracking Status
firefox7 - ---
firefox8 - ---

People

(Reporter: martijn.martijn, Assigned: martijn.martijn)

Details

(Keywords: crash, testcase)

Crash Data

Attachments

(2 files)

This bug was filed from the Socorro interface and is 
report bp-350988fe-818a-4239-b34a-b9e302110630 .
=============================================================
(Sorry about that, the bugzilla ui played tricks on me).

The crash that I'm seeing is:
https://crash-stats.mozilla.com/report/index/53e3b245-691a-4762-8c47-fc5322110630
0 	xul.dll 	nsIFrame::InvalidateTransformLayer 	layout/generic/nsFrame.cpp:3991
1 	xul.dll 	DoApplyRenderingChangeToTree 	
2 	xul.dll 	ApplyRenderingChangeToTree 	layout/base/nsCSSFrameConstructor.cpp:7720
3 	xul.dll 	nsCSSFrameConstructor::ProcessRestyledFrames 	
4 	xul.dll 	mozilla::css::RestyleTracker::ProcessRestyles 	layout/base/RestyleTracker.cpp:240
5 	xul.dll 	nsCSSFrameConstructor::ProcessPendingRestyles 	layout/base/nsCSSFrameConstructor.cpp:11616
6 	xul.dll 	PresShell::FlushPendingNotifications 	layout/base/nsPresShell.cpp:4764
7 	xul.dll 	nsDocument::FlushPendingNotifications 	content/base/src/nsDocument.cpp:6298
8 	xul.dll 	nsDocLoader::DocLoaderIsEmpty 	uriloader/base/nsDocLoader.cpp:777
9 	xul.dll 	nsDocLoader::OnStopRequest 	uriloader/base/nsDocLoader.cpp:707
10 	xul.dll 	nsLoadGroup::RemoveRequest 	netwerk/base/src/nsLoadGroup.cpp:680
11 	xul.dll 	xul.dll@0xb7d33b 	
12 	xul.dll 	nsDocument::UnblockOnload 	content/base/src/nsDocument.cpp:7161
13 	xul.dll 	nsDocument::DispatchContentLoadedEvents 	content/base/src/nsDocument.cpp:4196
14 	xul.dll 	nsRunnableMethodImpl<void 	obj-firefox/dist/include/nsThreadUtils.h:341
15 	xul.dll 	nsThread::ProcessNextEvent 	xpcom/threads/nsThread.cpp:617
16 	xul.dll 	mozilla::ipc::MessagePump::Run 	ipc/glue/MessagePump.cpp:110
17 	xul.dll 	xul.dll@0xb770cf 	
18 	xul.dll 	MessageLoop::RunHandler 	ipc/chromium/src/base/message_loop.cc:202
19 	xul.dll 	xul.dll@0x371f5f 	
20 	xul.dll 	MessageLoop::Run 	ipc/chromium/src/base/message_loop.cc:176
21 	xul.dll 	nsTextEditorState::GetValue 	content/html/content/src/nsTextEditorState.cpp:1692
22 		@0x6c6b 	

I'll attach a testcase that crashes current trunk with that stacktrace.
Keywords: testcase
Summary: crash nsIFrame::InvalidateTransformLayer → crash [@ nsIFrame::InvalidateTransformLayer() ] with position: fixed; -moz-transition-duration: 1s;-moz-transform: scale(1.5)
Attached file testcase
Ugh, also crashes on Firefox 5.
Not version-specific and the crash level doesn't make us track it as a top issue.
Attached file stack traces
###!!! ASSERTION: How can a viewport frame have a transform?: 'mParent', file layout/generic/nsFrame.cpp, line 4262

Crash [@ nsIFrame::InvalidateTransformLayer]
Crash Signature: [@ nsIFrame::InvalidateTransformLayer()] → [@ nsIFrame::InvalidateTransformLayer()] [@ nsIFrame::InvalidateTransformLayer ]
OS: Windows NT → All
Hardware: x86 → All
automation hit this testcase and reproduced on Beta/12, Aurora/13, Nightly/14 on all three platforms.
I get no crash with attachment 543194 [details] testcase,  nor with bug 653675 testcase
Yeah, also wfm.
Status: NEW → RESOLVED
Closed: 10 years ago
Flags: in-testsuite?
Resolution: --- → WORKSFORME
Landed the crashtest:
https://hg.mozilla.org/integration/mozilla-inbound/rev/b475aeb6558b
Flags: in-testsuite? → in-testsuite+
You need to log in before you can comment on or make changes to this bug.