Closed Bug 356404 Opened 18 years ago Closed 18 years ago

crash at nsGenericElement::SetMayHaveFrame with infinite tree of XML

Categories

(Core :: XML, defect)

Product:
Core
Component:
XML
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED DUPLICATE of bug 323394

People

(Reporter: bugzilla, Unassigned)

References

(
URL
)

Details

(Keywords: crash, testcase) 

In http://ha.ckers.org/blog/20061005/concurrency-related-vulnerabilities-in-browsers/ it says you can crash firefox and it's true:

http://lcamtuf.coredump.cx/ffoxdie.html
crashes your browser
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061011 Minefield/3.0a1 ID:2006101104 [cairo]

talkback TB24452708G
why isn't this a duplicate of bug 323394?

*** This bug has been marked as a duplicate of 323394 ***
Status: NEW → RESOLVED
Closed: 18 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.