| 1286911
|
|
Crash in msvcr120.dll@0xf608 | nsHtml5TreeBuilder::accumulateCharacters
|
Core
|
DOM: HTML Parser
|
hsivonen
|
RESO
|
FIXE
|
2017-02-09
|
| 1292590
|
|
IonBuilder scripts not traced for off thread compilation tasks
|
Core
|
JavaScript: GC
|
jcoppeard
|
RESO
|
FIXE
|
2017-02-09
|
| 1301343
|
|
Investigate tracing of data belong to helper threads
|
Core
|
JavaScript: GC
|
jdemooij
|
RESO
|
FIXE
|
2017-02-09
|
| 1308346
|
|
Crash [@ __pthread_kill] with [@ free] on the stack
|
Core
|
JavaScript Engine
|
jdemooij
|
RESO
|
FIXE
|
2017-02-09
|
| 1018486
|
|
Audit the rest of Gecko for problems similar to bug 1005584 where we hold a kungfudeathgrip to an object and call multiple methods on it
|
Core
|
DOM: Core & HTML
|
nika
|
RESO
|
FIXE
|
2019-03-13
|
| 1297062
|
|
Crash [@ JSScript::traceChildren] with use-after-free
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
FIXE
|
2017-02-09
|
| 1298169
|
|
Crash in nsViewManager::GetRootWidget
|
Core
|
DOM: Events
|
rjesup
|
RESO
|
FIXE
|
2017-02-09
|
| 1309720
|
|
Ensure the child passed to nsINode::InsertBefore is kept alive
|
Core
|
DOM: Core & HTML
|
smaug
|
RESO
|
FIXE
|
2019-03-13
|
| 1308048
|
|
Crash [@ js::CompartmentChecker::fail] or Assertion failure: arena()->allocated(), at js/src/gc/Heap.h:1211
|
Core
|
JavaScript Engine
|
jcoppeard
|
VERI
|
FIXE
|
2023-12-06
|
| 1303710
|
|
Assertion failure: !unknownObject(), at js/src/vm/TypeInference-inl.h:939
|
Core
|
JavaScript Engine: J
|
jdemooij
|
VERI
|
FIXE
|
2023-12-06
|
| 1299519
|
|
Assertion failure: loc->kind() != NameLocation::Kind::FrameSlot, at BytecodeEmitter.cpp
|
Core
|
JavaScript Engine
|
jwalden
|
VERI
|
FIXE
|
2017-11-09
|
| 1301496
|
|
Crash [@ js::gc::TenuredCell::arena]
|
Core
|
JavaScript Engine
|
nobody
|
VERI
|
FIXE
|
2023-12-06
|