Closed Bug 275651 Opened 20 years ago Closed 20 years ago

Potential crash in CTextToken::ConsumeParsedCharacterData

Categories

(Core :: DOM: HTML Parser, defect)

defect
Not set
critical

Tracking

()

VERIFIED FIXED

People

(Reporter: mrbkap, Assigned: mrbkap)

Details

(Keywords: crash)

Attachments

(1 file)

I'm spinning this bug off of bug 274105 comment 9. The root cause is the same,
but the crash has a different stack and therefore deserves its own bug. This is
another case of a nsScanner::SetPosition() call with its argument being in a
previous buffer from the current position.
Attached patch The obvious fixSplinter Review
Attachment #169353 - Flags: superreview?(dmose)
Attachment #169353 - Flags: review?(jst)
Comment on attachment 169353 [details] [diff] [review]
The obvious fix

r=jst
Attachment #169353 - Flags: review?(jst) → review+
Comment on attachment 169353 [details] [diff] [review]
The obvious fix

sr=dmose
Attachment #169353 - Flags: superreview?(dmose) → superreview+
Checked in.
Status: NEW → RESOLVED
Closed: 20 years ago
Resolution: --- → FIXED
Verified FIXED: 0 crashes found where the Stack Signature contains
'ctexttoken::consumeparsedcharacterdata'.

Build 2005-01-13-08, Windows XP.  While not statistically significant, the data
means at least that there have been 0 new incidents.
Status: RESOLVED → VERIFIED
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: