Closed Bug 1852227 Opened 2 years ago Closed 2 years ago

Crash in [@ mozilla::dom::WindowGlobalChild::SetDocumentURI]

Categories

(Core :: DOM: Core & HTML, defect)

Unspecified
Android
defect

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: gsvelto, Unassigned)

References

(Regression)

Details

(Keywords: crash, regression)

Crash Data

Crash report: https://crash-stats.mozilla.org/report/index/d4989b65-cf07-4820-9642-6c8ce0230907

Reason: SIGSEGV / SEGV_MAPERR

Top 10 frames of crashing thread:

0  libxul.so  mozilla::dom::WindowGlobalChild::SetDocumentURI  dom/ipc/WindowGlobalChild.cpp:594
1  libxul.so  mozilla::dom::Document::SetDocumentURI  dom/base/Document.cpp:4098
2  libxul.so  nsDocShell::HandleSameDocumentNavigation  docshell/base/nsDocShell.cpp:8875
3  libxul.so  nsDocShell::InternalLoad  docshell/base/nsDocShell.cpp:9428
4  libxul.so  nsDocShell::LoadHistoryEntry  docshell/base/nsDocShell.cpp:12154
5  libxul.so  nsDocShell::LoadHistoryEntry  docshell/base/nsDocShell.cpp:12075
6  libxul.so  nsDocShell::LoadURI  docshell/base/nsDocShell.cpp:789
7  libxul.so  mozilla::dom::BrowsingContext::LoadURI  docshell/base/BrowsingContext.cpp:1967
8  libxul.so  nsSHistory::LoadURIOrBFCache  docshell/shistory/nsSHistory.cpp:1403
8  libxul.so  nsSHistory::LoadURIs  docshell/shistory/nsSHistory.cpp:1409

We have only four crashes on Android, but they appear to be from four different users so this might be a regression.

Fixed by backout of bug 1783504.

Status: NEW → RESOLVED
Closed: 2 years ago
Keywords: regression
Regressed by: CVE-2024-0748
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.