Closed Bug 342132 Opened 19 years ago Closed 19 years ago

Crash [@ operator new[]] [@ nsXULPrototypeElement::Deserialize]

Categories

(Core :: XUL, defect)

Product:
Core
Component:
XUL
Platform:
x86
SunOS
Type:
defect
Priority:
Not set
Severity:
critical

Tracking

()

Status:
RESOLVED DUPLICATE of bug 341595

People

(Reporter: alfred.peng, Unassigned)

References

Details

(Keywords: crash)

Crash Data

Attachments

(2 files)

Core stack
3.07 KB, text/plain
Details
Patch v1
1.04 KB, patch
Details | Diff | Splinter Review
Mozilla/5.0 (X11; U; SunOS i86pc; en-US; rv:1.9a1) Gecko/20060619 Minefield/3.0a1 The crash can only be reproduced in a specific profile. During startup, a session restore dialogue shows up. No matter I select "Restore Session" or "Cancel", Firefox crashes.
Attached file Core stack —
this is the general "corrupt fastload" leads to trying to allocate a very large block which triggers oom.
Assignee: general → nobody
Severity: major → critical
Component: DOM → XP Toolkit/Widgets: XUL
Keywords: crash
QA Contact: ian → xptoolkit.xul
Whiteboard: DUPEME
Attached patch Patch v1 — — Splinter Review
Attachment #226331 - Flags: review?(bzbarsky)
Comment on attachment 226331 [details] [diff] [review] Patch v1 I'm not the right reviewer for this code; I don't really know it. Try markh, maybe. That said, won't this still break if it just happens that mScriptTypeID is small enough but the rest of the stuff is bogus? Given that, this doesn't look to me like the right patch...
Attachment #226331 - Flags: review?(bzbarsky)
And yes, this looks like a duplicate of bug 341595. Once that's fixed, we should revisit this.
Depends on: 341595
*** Bug 342255 has been marked as a duplicate of this bug. ***
*** This bug has been marked as a duplicate of 341595 ***
Status: NEW → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
*** Bug 343446 has been marked as a duplicate of this bug. ***
No longer depends on: 341595
Whiteboard: DUPEME
Component: XP Toolkit/Widgets: XUL → XUL
QA Contact: xptoolkit.xul → xptoolkit.widgets
Crash Signature: [@ operator new[]] [@ nsXULPrototypeElement::Deserialize]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: