426295 - Crash [@nsCachedStyleData::GetStyleMargin] when zooming page with script

Status: RESOLVED FIXED

(Core :: DOM: CSS Object Model, defect)

Comment 2

[Martijn Wargers (dead)]

Is this script zooming in/out while it is also changing styles (or something else)? 
I filed 2 bugs, bug 398853 and bug 403763 doing similar stuff. I think I filed some more, but those became worksforme. After that, I kinda gave up filing new ones, since nobody was working on those kind of bugs anyway.

Comment 3

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

roc, what do you think here?  This sounds scary enough that it should block...

Comment 4

[Robert O'Callahan (:roc) (email my personal email if necessary)]

It does sound scary but I don't think we should block on it, especially given that user-initiated zooming doesn't trigger the bug.

Comment 5

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

-'ing, but if user-initiated zooming can trigger the bug then it needs to be a +..

Comment 6

[Lucas Adamski [:ladamski]]

Marking sg:high for now as its a critical bug mitigate by the fact there is no straightforward remote exploit vector.

Comment 7

[David Baron :dbaron: (⌚️UTC-4, no longer working on Mozilla)]

The patch in bug 475128 will likely fix this by changing the underlying problem from a crash into a correctness bug.  I haven't tested, though, and it looks really complicated.

Comment 8

[Brandon Sterne (:bsterne)]

Can someone do the investigation David referred to?  This bug has been added to our Top Security Bugs list and could use some attention.  If bug 475128 fixed this bug then we can knock one off the list.

Comment 10

[Jesse Ruderman]

Since Paul can no longer reproduce, marking as fixed (believed to be fixed by bug 475128).