Closed Bug 1304596 Opened 3 years ago Closed 3 years ago

Crash in InvalidArrayIndex_CRASH | mozilla::EventListenerManager::GetListenerInfo

Categories

(Core :: DOM: Events, defect, critical)

Unspecified
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 1300129

People

(Reporter: njn, Unassigned)

Details

(Keywords: crash)

Crash Data

This bug was filed from the Socorro interface and is 
report bp-498a161b-0000-441d-b32f-52e3d2160919.
=============================================================

This is an nsTArray bounds checking failure. The length of the array ranges from 2 to 14, and we are reading 1 or 2 past the end.

It's a low-volume crash, with 19 occurrences across 16 installations in the past week, all in Firefox 50.0a2.

smaug, do you know this code?
Flags: needinfo?(bugs)
Please file invalid array accesses as security bugs. They are safe in versions where we are hitting the release asserts, but not in other versions.
Group: dom-core-security
Status: NEW → RESOLVED
Closed: 3 years ago
Flags: needinfo?(bugs)
Resolution: --- → DUPLICATE
Duplicate of bug: 1300129
Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.