Sat Apr 19 2025 12:48:31 PDT
  • Bug ID: 1394530, 1369561, 1411458, 1400003, 1395138, 1408412, 1393840, 1400763, 1339259, 1394265, 1407740, 1407751, 1408005, 1406398, 1387799, 1261175, 1400554, 1375146, 1397811, 1404636, 1401804

21 bugs found.
ID Type Summary Product Comp Assignee Status Resolution Updated
1406398 Assertion failure: MOZ_ASSERT(isNative()) in in js::NativeObject::lookup Core JavaScript Engine andrebargull RESO FIXE 2018-08-28
1339259 Crash in mozilla::widget::AudioSession::OnSessionDisconnectedInternal Core Widget: Win32 davidp99 RESO FIXE 2018-08-28
1369561 misc potentially unsafe snprintf and related calls Core Security dkeeler RESO FIXE 2018-08-28
1411458 type confusion in VerifyCMSDetachedSignatureIncludingCertificate (potential RCE in parent process) Core Security: PSM dkeeler RESO FIXE 2018-09-11
1400003 nsTArray copies JS::ObjectPtr with memmove Core JavaScript: GC jcoppeard RESO FIXE 2018-08-28
1404636 Differential Testing: Different output message involving typed arrays Core JavaScript Engine: J jdemooij RESO FIXE 2018-08-28
1408412 Max number of actual arguments is not checked everywhere Core JavaScript Engine: J jdemooij RESO FIXE 2018-08-28
1394265 Crash in OOM | large | NS_ABORT_OOM | nsTArray_base<T>::EnsureCapacity<T> | nsTArray_base<T>::InsertSlotsAt<T> | nsTArray_Impl<T>::SetLength<T> | mozilla::WebGLContext::InitAndValidateGL Core Graphics: CanvasWebG jgilbert RESO FIXE 2018-08-28
1395138 Crash in mozilla::layers::RenderLayers<T> Core Graphics: Layers jnicol RESO FIXE 2018-08-28
1375146 heap-use-after-free in [@ mozilla::dom::TabParent::SendRealDragEvent] Core DOM: Events stone123456 RESO FIXE 2018-08-28
1400554 Crash in mozilla::net::nsHttpConnection::EnsureNPNComplete Core Networking: HTTP dd.mozilla RESO FIXE 2018-08-28
1400763 heap-buffer-overflow [@ char16_t* nsTextFrameUtils::TransformText<char16_t>] with READ of size 2 Core Layout: Text and Fon jfkthame RESO FIXE 2018-08-28
1261175 crash in nsPresContext::GetRootPresContext or nsPresContext::GetParentPresContext (from nsRefreshDriver::IsWaitingForPaint()) Core Layout matt.woodrow RESO FIXE 2018-08-28
1387799 AddressSanitizer: heap-use-after-free @ nsTArray_base<...>::Length() | mozilla::layers::CompositorBridgeChild::RecvDidComposite Core Graphics: Layers milaninbugzilla RESO FIXE 2020-02-28
1401804 Intermittent application crashed [@ js::ProxyObject::setPrivate(JS::Value const&)] (Assertion failure: !JS::GCThingIsMarkedGray(JS::GCCellPtr(priv)), at js/src/vm/ProxyObject.cpp:131) Core JavaScript: GC jcoppeard RESO FIXE 2018-08-28
1397811 heap-use-after-free in [@ nsINode::DeleteProperty] Core DOM: Core & HTML smaug RESO FIXE 2019-03-13
1394530 Assertion failure: this->is<T>(), at js/src/jsobj.h:575 with Promise Core JavaScript Engine arai.unmht VERI FIXE 2023-12-06
1407740 Crash with failed "@mozilla.org/docshell;1" instance Core DOM: Navigation continuation VERI FIXE 2018-08-28
1407751 Crash with failed "@mozilla.org/net/osfileconstantsservice;1" and "@mozilla.org/places/colorAnalyzer;1" instances Core XPCOM amarchesini VERI FIXE 2018-08-28
1393840 Assertion failure: mList.GetChildren()->GetTop()->GetType() == DisplayItemType::TYPE_TRANSFORM Core Web Painting u459114 VERI FIXE 2018-08-28
1408005 Crash with failed "@mozilla.org/downloads/application-reputation-service;1" instance Toolkit Downloads API continuation VERI FIXE 2018-08-28
21 bugs found.