Bug 24277

Summary: WebKit crashes after seeing style "-webkit-transform-style:preserve-3d;"
Product: WebKit Reporter: f.tomalty
Component: CSSAssignee: Simon Fraser (smfr) <simon.fraser>
Status: RESOLVED DUPLICATE    
Severity: Critical CC: dino, simon.fraser
Priority: P2 Keywords: HasReduction, Regression
Version: 528+ (Nightly build)   
Hardware: Macintosh   
OS: OS X 10.5   
URL: http://itechnique.ca/webkit_crash.html
Attachments:
Description Flags
A log of the crash. Ignore the SIMBL plugins. none

Description f.tomalty 2009-03-01 14:51:41 PST
Using the nightly build from the 29th of February on Mac OS 10.5.6, on both Safari 3 and 4b,
'<div style="-webkit-transform-style:preserve-3d;">crash</div>' will cause an immediate crash.

To reproduce the bug, view a page containing that CSS string with the Mac OS X nightly build of WebKit.

Now checking the Windows nightly...
Comment 1 f.tomalty 2009-03-01 14:53:40 PST
Created attachment 28152 [details]
A log of the crash. Ignore the SIMBL plugins.
Comment 2 Simon Fraser (smfr) 2009-03-01 19:57:29 PST
Similar to bug 24252.
Comment 3 Simon Fraser (smfr) 2009-03-01 20:03:56 PST
Fixed by bug 24252.

*** This bug has been marked as a duplicate of 24252 ***