306782 - [@ nsCSSFrameConstructor::GetFloatContainingBlock], [@ 0x4e800020] and other addresses

Status: RESOLVED DUPLICATE of bug 265367

(Core :: Layout, defect)

Description

[Jesse Ruderman]

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8b4) Gecko/20050901
Firefox/1.0+ crashes with the following testcase.  Trunk does not.  I think this
is an exploitable crash.

Comment 1

[Jesse Ruderman]

Attachment: testcase (not reduced)

Crash reports for this testcase: TB8952610X, TB8952630Q

Crash reports with similar JavaScript used as a bookmarklet on various pages:
TB8922738K, TB8923005W, TB8923133W (from bug 306663).

Comment 2

[Jesse Ruderman]

Steps to reproduce:
1. Load the testcase.
2. Watch for about 3 seconds.

Result: Firefox crashes.

Comment 3

[Jesse Ruderman]

No crash with a Gecko 1.8 branch hourly.  Fixed by the patch for bug 265367.

Comment 4

[Jesse Ruderman]

*** Bug 306787 has been marked as a duplicate of this bug. ***

Comment 5

[Jesse Ruderman]

*** Bug 306789 has been marked as a duplicate of this bug. ***

Comment 6

[Jesse Ruderman]

*** Bug 306798 has been marked as a duplicate of this bug. ***

Comment 7

[Jesse Ruderman]

I'm marking this as a dup of a public bug, but this bug should remain
security-sensitive until we decide to make the JavaScript code from bug 306663
public.

*** This bug has been marked as a duplicate of 265367 ***