Closed
Bug 1269224
Opened 9 years ago
Closed 9 years ago
Assertion failure: IsCanceled() (Subclass Cancel() didn't set IsCanceled()!) | AddressSanitizer: heap-use-after-free
Categories
(Core :: DOM: Workers, defect)
Core
DOM: Workers
Tracking
()
RESOLVED
DUPLICATE
of bug 1267907
People
(Reporter: bc, Unassigned)
References
()
Details
(Keywords: assertion, crash)
Crash Data
Attachments
(2 files)
1. http://lukewagner.github.io/AngryBotsPacked/
2. Assert, Crash or ASAN Error.
Bughunter found this with builds prior today on 2016-04-29 and 2016-04-30. It initially showed Assertion failure: IsCanceled() (Subclass Cancel() didn't set IsCanceled()!) in debug builds and AddressSanitizer: heap-use-after-free. I retested with new builds from today and reproduced the assertion but not the ASAN Error. There are crashes on Linux and Windows for Aurora/48 and Nightly/49 at least. Some of the Windows crashes from today showed low exploitability ratings while some of the Linux exploitability ratings where rated high.
|
Reporter | |
Comment 1•9 years ago
|
||
Assertion failure: IsCanceled() (Subclass Cancel() didn't set IsCanceled()!), at /mozilla/builds/nightly/mozilla/dom/workers/WorkerRunnable.cpp:260
Fedora x86_64 with a build from https://hg.mozilla.org/mozilla-central/rev/1461a4071341c282afcf7b72e33036412d2251d4
|
|
Reporter | |
Updated•9 years ago
|
Crash Signature: [@ mozilla::dom::workers::WorkerRunnable::Run ]
[@ mozilla::dom::workers::WorkerPrivate::NotifyFeatures ]
[@ mozilla::dom::workers::WorkerPrivate::NotifyInternal ]
status-firefox48:
--- → affected
|
||
Comment 2•9 years ago
|
||
I think this is the same as bug 1267907 which I filed and was then duped to bug 1268303.
|
||
Updated•9 years ago
|
Group: core-security → dom-core-security
|
||
Comment 3•9 years ago
|
||
Yes. It's a duplicate.
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
|
|
||
Updated•6 years ago
|
You need to log in
before you can comment on or make changes to this bug.
Description
•