691431 - Firefox 10.0a1 Crash Report [@ WrapPreserve3DList ]

Status: VERIFIED FIXED

(Core :: Layout, defect)

Description

[Marcia Knous [:marcia]]

Seen while looking at trunk crash stats. https://crash-stats.mozilla.com/report/list?signature=WrapPreserve3DList - crashes started showing up in crash stats using the 20111001 build.

Possible pushlog regression range: http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=cb4b93331e4f&tochange=f25928e4847d

http://gmailblog.blogspot.com/view/flipcard is mentioned twice in the comments.

Frame 	Module 	Signature [Expand] 	Source
0 	xul.dll 	WrapPreserve3DList 	layout/generic/nsFrame.cpp:1528
1 	xul.dll 	WrapPreserve3DList 	layout/generic/nsFrame.cpp:1540
2 	xul.dll 	nsIFrame::BuildDisplayListForStackingContext 	
3 	xul.dll 	nsWindowSH::NewResolve 	dom/base/nsDOMClassInfo.cpp:6483
4 	xul.dll 	SelectorMatchesTree 	layout/style/nsCSSRuleProcessor.cpp:2135
5 	xul.dll 	PL_DHashTableOperate 	obj-firefox/xpcom/build/pldhash.cpp:622
6 	xul.dll 	ApplyOverflowClipping 	layout/generic/nsFrame.cpp:1358
7 	xul.dll 	nsIFrame::BuildDisplayListForChild 	layout/generic/nsFrame.cpp:1923

Comment 1

[Marcia Knous [:marcia]]

I can reproduce this by loading http://gmailblog.blogspot.com/view/flipcard.

https://crash-stats.mozilla.com/report/index/bp-0456ab35-7cbc-43dd-9248-9b6e12111003

Comment 2

[Marcia Knous [:marcia]]

Adding the Mac specific signature.

Comment 3

[Naoki Hirata :nhirata (please use needinfo instead of cc)]

Android crashes as well.  I can crash on the site as well by going to the URL and then clicking on the unsupported site link.

https://crash-stats.mozilla.com/report/index/bp-2b73974c-7056-4f5a-a6b2-9a4e52111003
Same crash signature as on Mac : [@ WrapPreserve3DListInternal ]

Comment 4

[Matt Woodrow (:mattwoodrow)]

Attachment: Remove invalid assertion and add NULL check

This assertion was invalid, and we need to null check that the item has a frame.

Comment 5

[Matt Woodrow (:mattwoodrow)]

Not that this patch still doesn't make the site look completely correct.

The site is using -moz-perspective:1000; (no px) which we parse as invalid, as per the spec. Webkit accepts persective numbers and treats them as pixels.

Comment 6

[Matt Woodrow (:mattwoodrow)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0efaec07b653

Comment 7

[Marco Bonardo [:mak]]

https://hg.mozilla.org/mozilla-central/rev/0efaec07b653

Comment 8

[Marcia Knous [:marcia]]

Verified fixed using Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:10.0a1) Gecko/20111018 Firefox/10.0a1. I checked the latest Mac nightly as well and no crash there.