Created attachment 77209 [details] Repro http://code.google.com/p/chromium/issues/detail?id=67785 Repro: <style> * { display: table-column; -webkit-transform-style: preserve-3d; } </style> id: chrome.dll!WebCore::RenderLayer::currentTransform ReadAV@NULL (8968fc97874fa23b6799ff8f09c142e4) description: Attempt to read from unallocated NULL pointer+0xA4 in chrome.dll!WebCore::RenderLayer::currentTransform stack: chrome.dll!WebCore::RenderLayer::currentTransform chrome.dll!WebCore::RenderBox::layoutOverflowRectForPropagation chrome.dll!WebCore::RenderBox::addOverflowFromChild chrome.dll!WebCore::RenderBlock::addOverflowFromBlockChildren chrome.dll!WebCore::RenderBlock::computeOverflow chrome.dll!WebCore::RenderBlock::layoutBlock chrome.dll!WebCore::RenderBlock::layout chrome.dll!WebCore::RenderBlock::layoutBlockChild chrome.dll!WebCore::RenderBlock::layoutBlockChildren chrome.dll!WebCore::RenderBlock::layoutBlock chrome.dll!WebCore::RenderBlock::layout chrome.dll!WebCore::RenderView::layout ...
Created attachment 86295 [details] Proposed fix: check that the RenderBox has a layer before calling layer() on it
Comment on attachment 86295 [details] Proposed fix: check that the RenderBox has a layer before calling layer() on it ok.
Comment on attachment 86295 [details] Proposed fix: check that the RenderBox has a layer before calling layer() on it Clearing flags on attachment: 86295 Committed r81574: <http://trac.webkit.org/changeset/81574>
All reviewed patches have been landed. Closing bug.
I knew after I closed my laptop last night that something was wrong with this patch. It's missing the added files! Julien, please add the misisng files.
> Julien, please add the misisng files. Sure I will update a new missing files to this bug tonight.
Created attachment 86456 [details] Trivial patch: add the missing test cases
Comment on attachment 86456 [details] Trivial patch: add the missing test cases LGTM. Don't we normally obscure the bug title in the ChangeLog for securityb ugs?
(In reply to comment #8) > (From update of attachment 86456 [details]) > LGTM. Don't we normally obscure the bug title in the ChangeLog for securityb ugs? Not sure about the security bugs' policy. This bug was not marked as such so it won't apply anyway.
Comment on attachment 86456 [details] Trivial patch: add the missing test cases Clearing flags on attachment: 86456 Committed r83243: <http://trac.webkit.org/changeset/83243>