Closed Bug 1304596 Opened 8 years ago Closed 8 years ago

Crash in InvalidArrayIndex_CRASH | mozilla::EventListenerManager::GetListenerInfo

Categories

(Core :: DOM: Events, defect)

Product:
Core
Component:
DOM: Events
Platform:
Unspecified
macOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1300129

People

(Reporter: n.nethercote, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-498a161b-0000-441d-b32f-52e3d2160919.
=============================================================

This is an nsTArray bounds checking failure. The length of the array ranges from 2 to 14, and we are reading 1 or 2 past the end.

It's a low-volume crash, with 19 occurrences across 16 installations in the past week, all in Firefox 50.0a2.

smaug, do you know this code?
Flags: needinfo?(bugs)
Please file invalid array accesses as security bugs. They are safe in versions where we are hitting the release asserts, but not in other versions.
Group: dom-core-security
Status: NEW → RESOLVED
Closed: 8 years ago
Flags: needinfo?(bugs)
Resolution: --- → DUPLICATE
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.