Bug 51465 – chrome.dll!WebCore::RenderLayer::currentTransform ReadAV@NULL (8968fc97874fa23b6799ff8f09c142e4)

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Berend-Jan Wever]

Created attachment 77209 [details]
Repro

http://code.google.com/p/chromium/issues/detail?id=67785

Repro:
<style>
* {
  display: table-column;
  -webkit-transform-style: preserve-3d;
}
</style>

id:             chrome.dll!WebCore::RenderLayer::currentTransform ReadAV@NULL (8968fc97874fa23b6799ff8f09c142e4)
description:    Attempt to read from unallocated NULL pointer+0xA4 in chrome.dll!WebCore::RenderLayer::currentTransform
stack:          chrome.dll!WebCore::RenderLayer::currentTransform
                chrome.dll!WebCore::RenderBox::layoutOverflowRectForPropagation
                chrome.dll!WebCore::RenderBox::addOverflowFromChild
                chrome.dll!WebCore::RenderBlock::addOverflowFromBlockChildren
                chrome.dll!WebCore::RenderBlock::computeOverflow
                chrome.dll!WebCore::RenderBlock::layoutBlock
                chrome.dll!WebCore::RenderBlock::layout
                chrome.dll!WebCore::RenderBlock::layoutBlockChild
                chrome.dll!WebCore::RenderBlock::layoutBlockChildren
                chrome.dll!WebCore::RenderBlock::layoutBlock
                chrome.dll!WebCore::RenderBlock::layout
                chrome.dll!WebCore::RenderView::layout
                ...

[Julien Chaffraix]

Created attachment 86295 [details]
Proposed fix: check that the RenderBox has a layer before calling layer() on it

[Eric Seidel (no email)]

Comment on attachment 86295 [details]
Proposed fix: check that the RenderBox has a layer before calling layer() on it

ok.

[WebKit Commit Bot]

Comment on attachment 86295 [details]
Proposed fix: check that the RenderBox has a layer before calling layer() on it

Clearing flags on attachment: 86295

Committed r81574: <http://trac.webkit.org/changeset/81574>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Eric Seidel (no email)]

I knew after I closed my laptop last night that something was wrong with this patch.  It's missing the added files!

Julien, please add the misisng files.

[Julien Chaffraix]

> Julien, please add the misisng files.

Sure I will update a new missing files to this bug tonight.

[Julien Chaffraix]

Created attachment 86456 [details]
Trivial patch: add the missing test cases

[Eric Seidel (no email)]

Comment on attachment 86456 [details]
Trivial patch: add the missing test cases

LGTM.  Don't we normally obscure the bug title in the ChangeLog for securityb ugs?

[Julien Chaffraix]

(In reply to comment #8)
> (From update of attachment 86456 [details])
> LGTM.  Don't we normally obscure the bug title in the ChangeLog for securityb ugs?

Not sure about the security bugs' policy. This bug was not marked as such so it won't apply anyway.

[WebKit Commit Bot]

Comment on attachment 86456 [details]
Trivial patch: add the missing test cases

Clearing flags on attachment: 86456

Committed r83243: <http://trac.webkit.org/changeset/83243>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.