Firefox 10.0a1 Crash Report [@ WrapPreserve3DList ]

VERIFIED FIXED in mozilla10

Status

()

Core
Layout
--
critical
VERIFIED FIXED
6 years ago
6 years ago

People

(Reporter: marcia, Unassigned)

Tracking

({crash, regression, reproducible})

Trunk
mozilla10
crash, regression, reproducible
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [mobile-crash][inbound], crash signature, URL)

Attachments

(1 attachment)

(Reporter)

Description

6 years ago
Seen while looking at trunk crash stats. https://crash-stats.mozilla.com/report/list?signature=WrapPreserve3DList - crashes started showing up in crash stats using the 20111001 build.

Possible pushlog regression range: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=cb4b93331e4f&tochange=f25928e4847d

http://gmailblog.blogspot.com/view/flipcard is mentioned twice in the comments.

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	WrapPreserve3DList 	layout/generic/nsFrame.cpp:1528
1 	xul.dll 	WrapPreserve3DList 	layout/generic/nsFrame.cpp:1540
2 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext 	
3 	xul.dll 	nsWindowSH::NewResolve 	dom/base/nsDOMClassInfo.cpp:6483
4 	xul.dll 	SelectorMatchesTree 	layout/style/nsCSSRuleProcessor.cpp:2135
5 	xul.dll 	PL_DHashTableOperate 	obj-firefox/xpcom/build/pldhash.cpp:622
6 	xul.dll 	ApplyOverflowClipping 	layout/generic/nsFrame.cpp:1358
7 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1923
(Reporter)

Comment 1

6 years ago
I can reproduce this by loading http://gmailblog.blogspot.com/view/flipcard.

https://crash-stats.mozilla.com/report/index/bp-0456ab35-7cbc-43dd-9248-9b6e12111003
Keywords: reproducible
(Reporter)

Comment 2

6 years ago
Adding the Mac specific signature.
Crash Signature: [@ WrapPreserve3DList ] → [@ WrapPreserve3DList ] [@ WrapPreserve3DListInternal ]
Android crashes as well.  I can crash on the site as well by going to the URL and then clicking on the unsupported site link.

https://crash-stats.mozilla.com/report/index/bp-2b73974c-7056-4f5a-a6b2-9a4e52111003
Same crash signature as on Mac : [@ WrapPreserve3DListInternal ]
Whiteboard: [mobile-crash]
Created attachment 564349 [details] [diff] [review]
Remove invalid assertion and add NULL check

This assertion was invalid, and we need to null check that the item has a frame.
Attachment #564349 - Flags: review?(roc)
Not that this patch still doesn't make the site look completely correct.

The site is using -moz-perspective:1000; (no px) which we parse as invalid, as per the spec. Webkit accepts persective numbers and treats them as pixels.
Attachment #564349 - Flags: review?(roc) → review+
https://hg.mozilla.org/integration/mozilla-inbound/rev/0efaec07b653
Whiteboard: [mobile-crash] → [mobile-crash][inbound]
https://hg.mozilla.org/mozilla-central/rev/0efaec07b653
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla10
(Reporter)

Comment 8

6 years ago
Verified fixed using Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:10.0a1) Gecko/20111018 Firefox/10.0a1. I checked the latest Mac nightly as well and no crash there.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.