Web+ crash (BAffineTransform::Unflatten())

[humdinger]

This is hrev51927 (32bit)

Go to this Trac's "View Tickets" at https://dev.haiku-os.org/query and see WebPositive crash (full report attached):

thread 9569: WebPositive (main)
	state: Exception (Segment violation)

	Frame		IP			Function Name
	-----------------------------------------------
	00000000	0x0006dc	? 
		Unable to retrieve disassembly for IP 0x6dc: address not contained in any valid image.
	0x7199cfe0	0x96cf63	BAffineTransform::Unflatten(unsigned long, void const*, long) + 0x15 
	0x7199d0f0	0xa052dd	BPrivate::ViewState::UpdateFrom(BPrivate::PortLink&) + 0x1e7 
	0x7199d110	0xa05419	BView::GetFont(BFont*) const + 0x37 
	0x7199d1e0	0x996968	BPrivate::HaikuControlLook::DrawCheckBox(BView*, BRect&, BRect const&, rgb_color const&, unsigned long) + 0x324 
	0x7199d248	0x382319a	WebCore::RenderThemeHaiku::paintCheckbox(WebCore::RenderObject const&, WebCore::PaintInfo const&, WebCore::IntRect const&) + 0xba 
	0x7199d2a8	0x360ab7a	WebCore::RenderTheme::paint(WebCore::RenderBox const&, WebCore::ControlStates&, WebCore::PaintInfo const&, WebCore::LayoutRect const&) + 0x10a 
	0x7199d398	0x34f976a	WebCore::RenderBox::paintBoxDecorations(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 0x51a 
	0x7199d418	0x34a327c	WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 0xec 
	0x7199d498	0x347d280	WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 0xf0 

[humdinger]

Crash on https://dev.haiku-os.org/query

[pulkomandy]

Tentative fix at ​https://review.haiku-os.org/#/c/haiku/+/174/

[korli]

Applied in ​https://git.haiku-os.org/haiku/commit/?id=ad33fd78a50fc20fc1ff3f8df85f6c09c0a619a1