51465 2010-12-22 05:41:23 -0800 chrome.dll!WebCore::RenderLayer::currentTransform ReadAV@NULL (8968fc97874fa23b6799ff8f09c142e4) 2011-04-07 20:21:37 -0700 1 1 1 Unclassified WebKit CSS 528+ (Nightly build) PC Windows Vista RESOLVED FIXED P1 Normal --- 1 skylined webkit-unassigned commit-queue eric jchaffraix oldest_to_newest 325462 0 77209 skylined 2010-12-22 05:41:23 -0800 Created attachment 77209 Repro http://code.google.com/p/chromium/issues/detail?id=67785 Repro: <style> * { display: table-column; -webkit-transform-style: preserve-3d; } </style> id: chrome.dll!WebCore::RenderLayer::currentTransform ReadAV@NULL (8968fc97874fa23b6799ff8f09c142e4) description: Attempt to read from unallocated NULL pointer+0xA4 in chrome.dll!WebCore::RenderLayer::currentTransform stack: chrome.dll!WebCore::RenderLayer::currentTransform chrome.dll!WebCore::RenderBox::layoutOverflowRectForPropagation chrome.dll!WebCore::RenderBox::addOverflowFromChild chrome.dll!WebCore::RenderBlock::addOverflowFromBlockChildren chrome.dll!WebCore::RenderBlock::computeOverflow chrome.dll!WebCore::RenderBlock::layoutBlock chrome.dll!WebCore::RenderBlock::layout chrome.dll!WebCore::RenderBlock::layoutBlockChild chrome.dll!WebCore::RenderBlock::layoutBlockChildren chrome.dll!WebCore::RenderBlock::layoutBlock chrome.dll!WebCore::RenderBlock::layout chrome.dll!WebCore::RenderView::layout ... 370283 1 86295 jchaffraix 2011-03-20 22:32:44 -0700 Created attachment 86295 Proposed fix: check that the RenderBox has a layer before calling layer() on it 370288 2 86295 eric 2011-03-20 23:14:21 -0700 Comment on attachment 86295 Proposed fix: check that the RenderBox has a layer before calling layer() on it ok. 370310 3 86295 commit-queue 2011-03-21 01:20:25 -0700 Comment on attachment 86295 Proposed fix: check that the RenderBox has a layer before calling layer() on it Clearing flags on attachment: 86295 Committed r81574: <http://trac.webkit.org/changeset/81574> 370311 4 commit-queue 2011-03-21 01:20:29 -0700 All reviewed patches have been landed. Closing bug. 370476 5 eric 2011-03-21 11:03:35 -0700 I knew after I closed my laptop last night that something was wrong with this patch. It's missing the added files! Julien, please add the misisng files. 371021 6 jchaffraix 2011-03-21 16:54:01 -0700 > Julien, please add the misisng files. Sure I will update a new missing files to this bug tonight. 371354 7 86456 jchaffraix 2011-03-22 06:33:46 -0700 Created attachment 86456 Trivial patch: add the missing test cases 374990 8 86456 eric 2011-03-28 21:37:46 -0700 Comment on attachment 86456 Trivial patch: add the missing test cases LGTM. Don't we normally obscure the bug title in the ChangeLog for securityb ugs? 374999 9 jchaffraix 2011-03-28 22:13:07 -0700 (In reply to comment #8) > (From update of attachment 86456 [details]) > LGTM. Don't we normally obscure the bug title in the ChangeLog for securityb ugs? Not sure about the security bugs' policy. This bug was not marked as such so it won't apply anyway. 381958 10 86456 commit-queue 2011-04-07 20:21:31 -0700 Comment on attachment 86456 Trivial patch: add the missing test cases Clearing flags on attachment: 86456 Committed r83243: <http://trac.webkit.org/changeset/83243> 381959 11 commit-queue 2011-04-07 20:21:37 -0700 All reviewed patches have been landed. Closing bug. 77209 2010-12-22 05:41:23 -0800 2010-12-22 05:41:23 -0800 Repro repro.html text/html 87 skylined PHN0eWxlPgoqIHsKICBkaXNwbGF5OiB0YWJsZS1jb2x1bW47CiAgLXdlYmtpdC10cmFuc2Zvcm0t c3R5bGU6IHByZXNlcnZlLTNkOwp9Cjwvc3R5bGU+ 86295 2011-03-20 22:32:44 -0700 2011-03-21 01:20:25 -0700 Proposed fix: check that the RenderBox has a layer before calling layer() on it bug-51465-crash-fix-1.diff text/plain 2457 jchaffraix ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCA3ZDRiNmE0Li41ZGJkOTA2IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMgQEAKKzIwMTEtMDMt MjAgIEp1bGllbiBDaGFmZnJhaXggIDxqY2hhZmZyYWl4QHdlYmtpdC5vcmc+CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGVzdCBmb3IgQnVnIDUxNDY1 IC0gY2hyb21lLmRsbCFXZWJDb3JlOjpSZW5kZXJMYXllcjo6Y3VycmVudFRyYW5zZm9ybQorICAg ICAgICBSZWFkQVZATlVMTCAoODk2OGZjOTc4NzRmYTIzYjY3OTlmZjhmMDljMTQyZTQpCisKKyAg ICAgICAgKiBmYXN0L2Nzcy93ZWJraXQtZW1wdHktdHJhbnNmb3JtLXByZXNlcnZlM2QtY3Jhc2gt ZXhwZWN0ZWQudHh0OiBBZGRlZC4KKyAgICAgICAgKiBmYXN0L2Nzcy93ZWJraXQtZW1wdHktdHJh bnNmb3JtLXByZXNlcnZlM2QtY3Jhc2guaHRtbDogQWRkZWQuCisKIDIwMTEtMDMtMTggIEphbWVz IFJvYmluc29uICA8amFtZXNyQGNocm9taXVtLm9yZz4KIAogICAgICAgICBVcGRhdGUgY2hyb21p dW0gd2luIHBpeGVsIGJhc2VsaW5lcyBmb3IgdGVzdHMgd2l0aCBqdXN0aWZpZWQgdGV4dCBmb3Ig cjgxNTI4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cKaW5kZXggNmU1NzdhZC4uMzRiNWRkZSAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwz ICsxLDE3IEBACisyMDExLTAzLTIwICBKdWxpZW4gQ2hhZmZyYWl4ICA8amNoYWZmcmFpeEB3ZWJr aXQub3JnPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAg IEJ1ZyA1MTQ2NSAtIGNocm9tZS5kbGwhV2ViQ29yZTo6UmVuZGVyTGF5ZXI6OmN1cnJlbnRUcmFu c2Zvcm0KKyAgICAgICAgUmVhZEFWQE5VTEwgKDg5NjhmYzk3ODc0ZmEyM2I2Nzk5ZmY4ZjA5YzE0 MmU0KQorCisgICAgICAgIFRlc3Q6IGZhc3QvY3NzL3dlYmtpdC1lbXB0eS10cmFuc2Zvcm0tcHJl c2VydmUzZC1jcmFzaC5odG1sCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyQm94LmNwcDoK KyAgICAgICAgKFdlYkNvcmU6OlJlbmRlckJveDo6bGF5b3V0T3ZlcmZsb3dSZWN0Rm9yUHJvcGFn YXRpb24pOiBNaW1pY2tlZCB0aGUKKyAgICAgICAgcmVzdCBvZiB0aGUgY29kZSBhbmQgY2hlY2sg dGhhdCB0aGUgUmVuZGVyQm94IGhhcyBhIGxheWVyIHRvIGF2b2lkCisgICAgICAgIGNyYXNoaW5n IG9uIHRoZSBsYXllcigpIGNhbGwuCisKIDIwMTEtMDMtMTkgIFhhbiBMb3BleiAgPHhsb3BlekBp Z2FsaWEuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5IE1hcnRpbiBSb2JpbnNvbi4KZGlmZiAt LWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJCb3guY3BwIGIvU291cmNlL1dl YkNvcmUvcmVuZGVyaW5nL1JlbmRlckJveC5jcHAKaW5kZXggOWYxMjdiZi4uMGMzZjNiNCAxMDA2 NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJveC5jcHAKKysrIGIvU291 cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJveC5jcHAKQEAgLTMzMTYsMTMgKzMzMTYsMTQg QEAgSW50UmVjdCBSZW5kZXJCb3g6OmxheW91dE92ZXJmbG93UmVjdEZvclByb3BhZ2F0aW9uKFJl bmRlclN0eWxlKiBwYXJlbnRTdHlsZSkgY28KICAgICBpZiAoIWhhc092ZXJmbG93Q2xpcCgpKQog ICAgICAgICByZWN0LnVuaXRlKGxheW91dE92ZXJmbG93UmVjdCgpKTsKIAotICAgIGlmIChpc1Jl bFBvc2l0aW9uZWQoKSB8fCBoYXNUcmFuc2Zvcm0oKSkgeworICAgIGJvb2wgaGFzVHJhbnNmb3Jt ID0gaGFzTGF5ZXIoKSAmJiBsYXllcigpLT50cmFuc2Zvcm0oKTsKKyAgICBpZiAoaXNSZWxQb3Np dGlvbmVkKCkgfHwgaGFzVHJhbnNmb3JtKSB7CiAgICAgICAgIC8vIElmIHdlIGFyZSByZWxhdGl2 ZWx5IHBvc2l0aW9uZWQgb3IgaWYgd2UgaGF2ZSBhIHRyYW5zZm9ybSwgdGhlbiB3ZSBoYXZlIHRv IGNvbnZlcnQKICAgICAgICAgLy8gdGhpcyByZWN0YW5nbGUgaW50byBwaHlzaWNhbCBjb29yZGlu YXRlcywgYXBwbHkgcmVsYXRpdmUgcG9zaXRpb25pbmcgYW5kIHRyYW5zZm9ybXMKICAgICAgICAg Ly8gdG8gaXQsIGFuZCB0aGVuIGNvbnZlcnQgaXQgYmFjay4KICAgICAgICAgZmxpcEZvcldyaXRp bmdNb2RlKHJlY3QpOwogICAgICAgICAKLSAgICAgICAgaWYgKGhhc1RyYW5zZm9ybSgpKQorICAg ICAgICBpZiAoaGFzVHJhbnNmb3JtKQogICAgICAgICAgICAgcmVjdCA9IGxheWVyKCktPmN1cnJl bnRUcmFuc2Zvcm0oKS5tYXBSZWN0KHJlY3QpOwogCiAgICAgICAgIGlmIChpc1JlbFBvc2l0aW9u ZWQoKSkK 86456 2011-03-22 06:33:46 -0700 2011-04-07 20:21:31 -0700 Trivial patch: add the missing test cases bug51465-testcases.diff text/plain 1959 jchaffraix ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCBjN2MxMzhhLi5iNzBlNGU0IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTEtMDMt MjIgIEp1bGllbiBDaGFmZnJhaXggIDxqY2hhZmZyYWl4QHdlYmtpdC5vcmc+CisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGVzdCBmb3IgQnVnIDUxNDY1 IC0gY2hyb21lLmRsbCFXZWJDb3JlOjpSZW5kZXJMYXllcjo6Y3VycmVudFRyYW5zZm9ybQorICAg ICAgICBSZWFkQVZATlVMTCAoODk2OGZjOTc4NzRmYTIzYjY3OTlmZjhmMDljMTQyZTQpCisKKyAg ICAgICAgRm9yZ290IHRvIGFkZCB0aGVtIHRvIHRoZSBvcmlnaW5hbCBwYXRjaC4KKworICAgICAg ICAqIGZhc3QvY3NzL3dlYmtpdC1lbXB0eS10cmFuc2Zvcm0tcHJlc2VydmUzZC1jcmFzaC1leHBl Y3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvY3NzL3dlYmtpdC1lbXB0eS10cmFuc2Zv cm0tcHJlc2VydmUzZC1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxMS0wMy0yMSAgQWJoaXNoZWsg QXJ5YSAgPGluZmVybm9AY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEVyaWMg U2VpZGVsLgpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9jc3Mvd2Via2l0LWVtcHR5LXRy YW5zZm9ybS1wcmVzZXJ2ZTNkLWNyYXNoLWV4cGVjdGVkLnR4dCBiL0xheW91dFRlc3RzL2Zhc3Qv Y3NzL3dlYmtpdC1lbXB0eS10cmFuc2Zvcm0tcHJlc2VydmUzZC1jcmFzaC1leHBlY3RlZC50eHQK bmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uNDk3OThmNAotLS0gL2Rldi9udWxs CisrKyBiL0xheW91dFRlc3RzL2Zhc3QvY3NzL3dlYmtpdC1lbXB0eS10cmFuc2Zvcm0tcHJlc2Vy dmUzZC1jcmFzaC1leHBlY3RlZC50eHQKQEAgLTAsMCArMSwzIEBACitUZXN0IGZvciBidWcgNTE0 NjU6IGNocm9tZS5kbGwhV2ViQ29yZTo6UmVuZGVyTGF5ZXI6OmN1cnJlbnRUcmFuc2Zvcm0gUmVh ZEFWQE5VTEwgKDg5NjhmYzk3ODc0ZmEyM2I2Nzk5ZmY4ZjA5YzE0MmU0KQorCitJZiBpdCBkaWQg bm90IGNyYXNoLCB0aGlzIHRlc3QgaGFzIFBBU1NFRApkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMv ZmFzdC9jc3Mvd2Via2l0LWVtcHR5LXRyYW5zZm9ybS1wcmVzZXJ2ZTNkLWNyYXNoLmh0bWwgYi9M YXlvdXRUZXN0cy9mYXN0L2Nzcy93ZWJraXQtZW1wdHktdHJhbnNmb3JtLXByZXNlcnZlM2QtY3Jh c2guaHRtbApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi44ZjBiYWNmCi0tLSAv ZGV2L251bGwKKysrIGIvTGF5b3V0VGVzdHMvZmFzdC9jc3Mvd2Via2l0LWVtcHR5LXRyYW5zZm9y bS1wcmVzZXJ2ZTNkLWNyYXNoLmh0bWwKQEAgLTAsMCArMSwxOSBAQAorPGh0bWw+Cis8aGVhZD4K KzxzY3JpcHQ+CitpZiAod2luZG93LmxheW91dFRlc3RDb250cm9sbGVyKQorICAgIGxheW91dFRl c3RDb250cm9sbGVyLmR1bXBBc1RleHQoKTsKKzwvc2NyaXB0PgorPHN0eWxlPgorc3BhbiB7Cisg IGRpc3BsYXk6IHRhYmxlLWNvbHVtbjsKKyAgLXdlYmtpdC10cmFuc2Zvcm0tc3R5bGU6IHByZXNl cnZlLTNkOworfQorPC9zdHlsZT4KKzwvaGVhZD4KKzxib2R5PgorPHNwYW4+PC9zcGFuPgorPHA+ VGVzdCBmb3IgYnVnIDxhIGhyZWY9Imh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNn aT9pZD01MTQ2NSI+NTE0NjU8L2E+OiBjaHJvbWUuZGxsIVdlYkNvcmU6OlJlbmRlckxheWVyOjpj dXJyZW50VHJhbnNmb3JtIFJlYWRBVkBOVUxMICg4OTY4ZmM5Nzg3NGZhMjNiNjc5OWZmOGYwOWMx NDJlNCk8L3A+Cis8cD5JZiBpdCBkaWQgbm90IGNyYXNoLCB0aGlzIHRlc3QgaGFzIFBBU1NFRDwv cD4KKzwvYm9keT4KKzwvaHRtbD4K