Sat Apr 19 2025 08:53:42 PDT
  • Bug ID: 1309720, 1297062, 1303710, 1018486, 1292590, 1301343, 1301496, 1308048, 1308346, 1299519, 1286911, 1298169

12 bugs found.
ID Type Summary Product Comp Assignee Status Resolution Updated
1286911 Crash in msvcr120.dll@0xf608 | nsHtml5TreeBuilder::accumulateCharacters Core DOM: HTML Parser hsivonen RESO FIXE 2017-02-09
1292590 IonBuilder scripts not traced for off thread compilation tasks Core JavaScript: GC jcoppeard RESO FIXE 2017-02-09
1301343 Investigate tracing of data belong to helper threads Core JavaScript: GC jdemooij RESO FIXE 2017-02-09
1308346 Crash [@ __pthread_kill] with [@ free] on the stack Core JavaScript Engine jdemooij RESO FIXE 2017-02-09
1018486 Audit the rest of Gecko for problems similar to bug 1005584 where we hold a kungfudeathgrip to an object and call multiple methods on it Core DOM: Core & HTML nika RESO FIXE 2019-03-13
1297062 Crash [@ JSScript::traceChildren] with use-after-free Core JavaScript Engine nobody RESO FIXE 2017-02-09
1298169 Crash in nsViewManager::GetRootWidget Core DOM: Events rjesup RESO FIXE 2017-02-09
1309720 Ensure the child passed to nsINode::InsertBefore is kept alive Core DOM: Core & HTML smaug RESO FIXE 2019-03-13
1308048 Crash [@ js::CompartmentChecker::fail] or Assertion failure: arena()->allocated(), at js/src/gc/Heap.h:1211 Core JavaScript Engine jcoppeard VERI FIXE 2023-12-06
1303710 Assertion failure: !unknownObject(), at js/src/vm/TypeInference-inl.h:939 Core JavaScript Engine: J jdemooij VERI FIXE 2023-12-06
1299519 Assertion failure: loc->kind() != NameLocation::Kind::FrameSlot, at BytecodeEmitter.cpp Core JavaScript Engine jwalden VERI FIXE 2017-11-09
1301496 Crash [@ js::gc::TenuredCell::arena] Core JavaScript Engine nobody VERI FIXE 2023-12-06
12 bugs found.

File a new bug in the "Core" product