| 1406398
|
|
Assertion failure: MOZ_ASSERT(isNative()) in in js::NativeObject::lookup
|
Core
|
JavaScript Engine
|
andrebargull
|
RESO
|
FIXE
|
2018-08-28
|
| 1339259
|
|
Crash in mozilla::widget::AudioSession::OnSessionDisconnectedInternal
|
Core
|
Widget: Win32
|
davidp99
|
RESO
|
FIXE
|
2018-08-28
|
| 1369561
|
|
misc potentially unsafe snprintf and related calls
|
Core
|
Security
|
dkeeler
|
RESO
|
FIXE
|
2018-08-28
|
| 1411458
|
|
type confusion in VerifyCMSDetachedSignatureIncludingCertificate (potential RCE in parent process)
|
Core
|
Security: PSM
|
dkeeler
|
RESO
|
FIXE
|
2018-09-11
|
| 1400003
|
|
nsTArray copies JS::ObjectPtr with memmove
|
Core
|
JavaScript: GC
|
jcoppeard
|
RESO
|
FIXE
|
2018-08-28
|
| 1404636
|
|
Differential Testing: Different output message involving typed arrays
|
Core
|
JavaScript Engine: J
|
jdemooij
|
RESO
|
FIXE
|
2018-08-28
|
| 1408412
|
|
Max number of actual arguments is not checked everywhere
|
Core
|
JavaScript Engine: J
|
jdemooij
|
RESO
|
FIXE
|
2018-08-28
|
| 1394265
|
|
Crash in OOM | large | NS_ABORT_OOM | nsTArray_base<T>::EnsureCapacity<T> | nsTArray_base<T>::InsertSlotsAt<T> | nsTArray_Impl<T>::SetLength<T> | mozilla::WebGLContext::InitAndValidateGL
|
Core
|
Graphics: CanvasWebG
|
jgilbert
|
RESO
|
FIXE
|
2018-08-28
|
| 1395138
|
|
Crash in mozilla::layers::RenderLayers<T>
|
Core
|
Graphics: Layers
|
jnicol
|
RESO
|
FIXE
|
2018-08-28
|
| 1375146
|
|
heap-use-after-free in [@ mozilla::dom::TabParent::SendRealDragEvent]
|
Core
|
DOM: Events
|
stone123456
|
RESO
|
FIXE
|
2018-08-28
|
| 1400554
|
|
Crash in mozilla::net::nsHttpConnection::EnsureNPNComplete
|
Core
|
Networking: HTTP
|
dd.mozilla
|
RESO
|
FIXE
|
2018-08-28
|
| 1400763
|
|
heap-buffer-overflow [@ char16_t* nsTextFrameUtils::TransformText<char16_t>] with READ of size 2
|
Core
|
Layout: Text and Fon
|
jfkthame
|
RESO
|
FIXE
|
2018-08-28
|
| 1261175
|
|
crash in nsPresContext::GetRootPresContext or nsPresContext::GetParentPresContext (from nsRefreshDriver::IsWaitingForPaint())
|
Core
|
Layout
|
matt.woodrow
|
RESO
|
FIXE
|
2018-08-28
|
| 1387799
|
|
AddressSanitizer: heap-use-after-free @ nsTArray_base<...>::Length() | mozilla::layers::CompositorBridgeChild::RecvDidComposite
|
Core
|
Graphics: Layers
|
milaninbugzilla
|
RESO
|
FIXE
|
2020-02-28
|
| 1401804
|
|
Intermittent application crashed [@ js::ProxyObject::setPrivate(JS::Value const&)] (Assertion failure: !JS::GCThingIsMarkedGray(JS::GCCellPtr(priv)), at js/src/vm/ProxyObject.cpp:131)
|
Core
|
JavaScript: GC
|
jcoppeard
|
RESO
|
FIXE
|
2018-08-28
|
| 1397811
|
|
heap-use-after-free in [@ nsINode::DeleteProperty]
|
Core
|
DOM: Core & HTML
|
smaug
|
RESO
|
FIXE
|
2019-03-13
|
| 1394530
|
|
Assertion failure: this->is<T>(), at js/src/jsobj.h:575 with Promise
|
Core
|
JavaScript Engine
|
arai.unmht
|
VERI
|
FIXE
|
2023-12-06
|
| 1407740
|
|
Crash with failed "@mozilla.org/docshell;1" instance
|
Core
|
DOM: Navigation
|
continuation
|
VERI
|
FIXE
|
2018-08-28
|
| 1407751
|
|
Crash with failed "@mozilla.org/net/osfileconstantsservice;1" and "@mozilla.org/places/colorAnalyzer;1" instances
|
Core
|
XPCOM
|
amarchesini
|
VERI
|
FIXE
|
2018-08-28
|
| 1393840
|
|
Assertion failure: mList.GetChildren()->GetTop()->GetType() == DisplayItemType::TYPE_TRANSFORM
|
Core
|
Web Painting
|
u459114
|
VERI
|
FIXE
|
2018-08-28
|
| 1408005
|
|
Crash with failed "@mozilla.org/downloads/application-reputation-service;1" instance
|
Toolkit
|
Downloads API
|
continuation
|
VERI
|
FIXE
|
2018-08-28
|