Crash with layers.force-active and "transform-style: preserve-3d"

RESOLVED FIXED in mozilla23

Status

()

Core
Graphics
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: mattwoodrow)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
mozilla23
crash, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(4 attachments)

(Reporter)

Description

5 years ago
Created attachment 734854 [details]
testcase (requires pref)

With:
  user_pref("layers.force-active", true);
(which was added in bug 812908)

the testcase causes a crash [@ WrapPreserve3DListInternal] calling nsIFrame::Preserves3DChildren with null |this|.

Nightly: bp-fff5226c-5e36-4520-b710-ce5eb2130408
(Reporter)

Comment 2

5 years ago
Created attachment 734857 [details]
stack (gdb)

Using a local debug build.

Comment 3

5 years ago
On Windows: bp-a6fa1e93-0dfc-470b-a274-94e3c2130409.
Crash Signature: [@ WrapPreserve3DListInternal] [@ nsIFrame::Preserves3DChildren] → [@ nsIFrame::StyleDisplay()] [@ nsIFrame::Preserves3DChildren() const ] [@ nsIFrame::Preserves3DChildren() ]
OS: Mac OS X → All
Hardware: x86_64 → All
(Assignee)

Comment 4

5 years ago
Created attachment 737346 [details] [diff] [review]
Check parent before using it
Attachment #737346 - Flags: review?(roc)
Comment on attachment 737346 [details] [diff] [review]
Check parent before using it

Review of attachment 737346 [details] [diff] [review]:
-----------------------------------------------------------------

add crashtest
Attachment #737346 - Flags: review?(roc) → review+
https://hg.mozilla.org/mozilla-central/rev/3b0cda3057df
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Flags: in-testsuite+
Resolution: --- → FIXED
Target Milestone: --- → mozilla23
(Reporter)

Updated

5 years ago
Assignee: nobody → matt.woodrow
You need to log in before you can comment on or make changes to this bug.