Closed Bug 1811228 Opened 3 years ago Closed 3 years ago

macOS Crash in [@ mozilla::dom::Element_Binding::get_classList]

Categories

(Core :: DOM: Bindings (WebIDL), defect)

Product:
Core
Component:
DOM: Bindings (WebIDL)
Platform:
Unspecified
macOS
Type:
defect

Tracking

()

Status:
RESOLVED DUPLICATE of bug 1808352
Tracking Flags:
Tracking Status
firefox-esr102 --- unaffected
firefox109 --- affected
firefox110 --- affected
firefox111 --- affected

People

(Reporter: aryx, Unassigned)

Details

(Keywords: crash)

Crash Data

8 crashes from 8 different installations of Firefox 109.0 on macOS, but also observed for its betas.

Stack looks corrupted.

Crash report: https://crash-stats.mozilla.org/report/index/1613e8de-bf0b-4824-bf0a-b80b50230119

Reason: EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE

Top 10 frames of crashing thread:

0  ?  @0x00000001154b5c00  
1  XUL  mozilla::dom::Element_Binding::get_classList  dom/bindings/ElementBinding.cpp:1361
2  ?  @0x000002c282d505e1  
3  ?  @0x000002c282c04aaa  
4  ?  @0x000002c282c475f2  
5  ?  @0x000002c282c04efd  
6  ?  @0x000002c282a5f5dd  
7  ?  @0x000002c282a554ed  
8  XUL  EnterJit  js/src/jit/Jit.cpp:107
8  XUL  js::jit::MaybeEnterJit  js/src/jit/Jit.cpp:205

Many, but not all, of these crashes are on poison addresses.

Group: dom-core-security
Status: NEW → RESOLVED
Closed: 3 years ago
Component: General → DOM: Bindings (WebIDL)
Duplicate of bug: 1808352
Resolution: --- → DUPLICATE

This is the same crash as bug 1808352, except with a different signature.

Group: dom-core-security
You need to log in before you can comment on or make changes to this bug.