Steps to reproduce: 1) put the following rules in a user stylesheet h1, h2, h3, h4, h5, h6 { -webkit-transform: rotate(10deg); } p { -webkit-transform: rotate(-10deg); } tr { -webkit-transform: skew(50deg); } 2) go to arstechnica.com r31356/10.5.2/Intel
Created attachment 20115 [details] Backtrace First few frames: Thread 0 Crashed: 0 com.apple.WebCore 0x00e273ef WebCore::RenderBlock::insertPositionedObject(WebCore::RenderObject*) + 15 1 com.apple.WebCore 0x00ffa524 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 2884 2 com.apple.WebCore 0x00e305ea WebCore::RenderBlock::layoutBlock(bool) + 714 3 com.apple.WebCore 0x00e8d8c2 WebCore::RenderTableCell::layout() + 34 4 com.apple.WebCore 0x00e91676 WebCore::RenderTableRow::layout() + 214
Created attachment 20226 [details] Reduction (will crash) Having a transform turns the table row into a containing block, but only RenderBlocks can be containing blocks.
<rdar://problem/5830746>
No longer crashes on TOT. I think this was fixed in r32861.
Fixed in r32861, <rdar://problem/5840475>
http://trac.webkit.org/changeset/32861