Created attachment 571766 [details] testcase ###!!! ABORT: Failed to create pixman images?: 'src && dest', file gfx/layers/basic/BasicLayers.cpp, line 1701
This is caused by a crazy transform giving us an infinite sized transformed rect. Our call to surfaceRect.Intersect(transformedRect) isn't handling the infinite values correctly, so instead of being clamped to the surface rect we end up attempting to allocate an infinite sized destination surface. roc: Do you have any suggestions on how you'd prefer to handle this? My two ideas so far were to make BaseRect::Intersect correctly handle infinite float/double values or add a BaseRect::IsValid method which looks for inf/nan and we can skip the intersection.
That latter sounds better. The former is unnecessary overhead in most cases.
Created attachment 643224 [details] testcase 2 (requires fuzzing extension or blank profile) This one crashes during a drawWindow call. If you use a blank profile, Firefox's thumbnail service is likely to call drawWindow.
No longer asserts on trunk. The second testcase will require some help to land (to remove the fuzzer dependency), however.
removing the b2g 2.5 flag since this commit has been reverted due to an incorrect merge, sorry for the confusion