Closed Bug 306787 Opened 19 years ago Closed 19 years ago

[@ nsStyleContext::GetStyleData]

Categories

(Core :: Layout, defect)

1.8 Branch
PowerPC
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 306782

People

(Reporter: jruderman, Unassigned)

References

Details

(Keywords: crash, Whiteboard: [sg:dupe 306782] hold for 306663-based testcase)

Crash Data

The testcase crashes Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US;
rv:1.8b4) Gecko/20050901 Firefox/1.0+, but doesn't crash trunk.

I'm filing this bug as security-sensitive because the testcase includes code
from bug 306663 and I was unable to make a simple testcase.  This crash doesn't
seem to be exploitable based on stacks.
Steps to reproduce:
1. Load the testcase.
2. Wait 1-5 seconds after the testcase finishes loading.

Result: Crash (TB8953568W, TB8953741Z, TB8954484Q).
Blocks: stirdom
No crash with a Gecko 1.8 branch hourly.  Fixed by the patch for bug 265367.

*** This bug has been marked as a duplicate of 306782 ***
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Whiteboard: [sg:dupe 306782] hold for 306663-based testcase
Group: security
Crash Signature: [@ nsStyleContext::GetStyleData]
You need to log in before you can comment on or make changes to this bug.