crash at nsGenericElement::SetMayHaveFrame with infinite tree of XML

RESOLVED DUPLICATE of bug 323394

Status

()

RESOLVED DUPLICATE of bug 323394
12 years ago
12 years ago

People

(Reporter: bugzilla, Unassigned)

Tracking

({crash, testcase})

Trunk
x86
Windows XP
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(URL)

(Reporter)

Description

12 years ago
In http://ha.ckers.org/blog/20061005/concurrency-related-vulnerabilities-in-browsers/ it says you can crash firefox and it's true:

http://lcamtuf.coredump.cx/ffoxdie.html
crashes your browser
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a1) Gecko/20061011 Minefield/3.0a1 ID:2006101104 [cairo]

talkback TB24452708G

Comment 1

12 years ago
why isn't this a duplicate of bug 323394?

Comment 2

12 years ago

*** This bug has been marked as a duplicate of 323394 ***
Status: NEW → RESOLVED
Last Resolved: 12 years ago
Resolution: --- → DUPLICATE
You need to log in before you can comment on or make changes to this bug.