Closed Bug 342132 Opened 18 years ago Closed 18 years ago

Crash [@ operator new[]] [@ nsXULPrototypeElement::Deserialize]

Categories

(Core :: XUL, defect)

Product:
Core
Component:
XUL
Platform:
x86
SunOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 341595

People

(Reporter: alfred.peng, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Attachments

(2 files)

Core stack
3.07 KB, text/plain
Details
Patch v1
1.04 KB, patch
Details | Diff | Splinter Review 
Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9a1) Gecko/20060619 Minefield/3.0a1

The crash can only be reproduced in a specific profile. During startup, a session restore dialogue shows up. No matter I select "Restore Session" or "Cancel", Firefox crashes.
Attached file Core stack — 

    
    

    
  
this is the general "corrupt fastload" leads to trying to allocate a very large block which triggers oom.
Assignee: general → nobody
Severity: major → critical
Component: DOM → XP Toolkit/Widgets: XUL
Keywords: crash
QA Contact: ian → xptoolkit.xul
Whiteboard: DUPEME

    
    

    
  

      
      
      
      

        Attached patch
          
          
        Patch v1
        — 
          — Splinter Review
      

    


  

        Attachment #226331 -
        Flags: review?(bzbarsky)

    
    

    
  
Comment on attachment 226331 [details] [diff] [review]
Patch v1

I'm not the right reviewer for this code; I don't really know it.  Try markh, maybe.

That said, won't this still break if it just happens that mScriptTypeID is small enough but the rest of the stuff is bogus?  Given that, this doesn't look to me like the right patch...

        Attachment #226331 -
        Flags: review?(bzbarsky)

    
    

    
  
And yes, this looks like a duplicate of bug 341595.  Once that's fixed, we should revisit this.
Depends on: 341595

    
    

    
  
*** Bug 342255 has been marked as a duplicate of this bug. ***

    
    

    
  

*** This bug has been marked as a duplicate of 341595 ***
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → DUPLICATE

    
    

    
  
*** Bug 343446 has been marked as a duplicate of this bug. ***

    
  
No longer depends on: 341595
Whiteboard: DUPEME

    
  
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
Crash Signature: [@ operator new[]]
[@ nsXULPrototypeElement::Deserialize]

          You need to log in
          before you can comment on or make changes to this bug.
        






  

    
  







  

    

      
Attachment

      

      
      
      
      
    

    

      

        

          

            
General

            

              Creator: 



            

            
Created: 

            
Updated: 

            
Size: