Closed
Bug 827962
Opened 11 years ago
Closed 11 years ago
Compartment mismatch in mozilla::dom::URLBinding::revokeObjectURL
Categories
(Core :: DOM: Core & HTML, defect)
Core
DOM: Core & HTML
Tracking
()
RESOLVED
DUPLICATE
of bug 821760
Tracking | Status | |
---|---|---|
firefox18 | --- | unaffected |
firefox19 | --- | affected |
firefox20 | --- | affected |
firefox21 | --- | affected |
People
(Reporter: mccr8, Unassigned)
References
Details
I see three crash stacks like this: 0 js::CompartmentChecker::fail js/src/jscntxtinlines.h:204 1 JS_GetGlobalForObject js/src/jsapi.cpp:2233 2 mozilla::dom::URLBinding::revokeObjectURL obj-firefox/dom/bindings/URLBinding.cpp:268 3 js::InvokeKernel js/src/jsinterp.cpp:389 4 js::Interpret js/src/jsinterp.cpp:2348 5 js::RunScript I'm not sure exactly what is calling JS_GetGlobalForObject, as the line numbers don't seem to match what I have locally. https://crash-stats.mozilla.com/report/index/896e519b-6b03-424b-be5a-156902130107 https://crash-stats.mozilla.com/report/index/7a896715-fdf0-452a-8682-a95362130102 https://crash-stats.mozilla.com/report/index/bdb83485-e593-44bb-9577-555762130102 URL was converted to the new DOM bindings in bug 792675, which is in 19. Speculatively marking 19 and later as affected.
Comment 1•11 years ago
|
||
The build ID for those three crashes is "20121214030827". Bug 821760 landed on m-c on 2012-12-15. So as far as I can tell, this is a duplicate of that bug.
Status: NEW → RESOLVED
Closed: 11 years ago
Resolution: --- → DUPLICATE
Updated•9 years ago
|
Group: core-security
Assignee | ||
Updated•5 years ago
|
Component: DOM → DOM: Core & HTML
You need to log in
before you can comment on or make changes to this bug.
Description
•