Closed
Bug 473278
Opened 16 years ago
Closed 15 years ago
Crash [@ nsRect::nsRect] with MathML, clip-path, transform
Categories
(Core :: MathML, defect)
Tracking
()
RESOLVED
WORKSFORME
People
(Reporter: jruderman, Unassigned)
References
Details
(Keywords: crash, testcase, Whiteboard: [sg:dos] null deref)
Crash Data
Attachments
(2 files)
Null deref [@ nsRect::nsRect]
|
Reporter | |
Comment 1•16 years ago
|
||
|
||
Comment 2•16 years ago
|
||
Related to bug 467914?
|
||
Comment 3•16 years ago
|
||
Here's !exploitable output from WinDbg:
0:000> !exploitable
Exploitability Classification: UNKNOWN
Recommended Bug Title: Data from Faulting Address may be used as a return value starting at gkgfx!nsRect::nsRect+0x25 (Hash=0x6536375b.0x645b3f71)
The data from the faulting address may later be used as a return value from this function.
|
||
Comment 4•16 years ago
|
||
See bug 467914 comment 1 for cause and I think bug 467914 comment 2 has the cure too.
|
|
Reporter | |
Comment 5•15 years ago
|
||
WFM. I'll add a crashtest soon.
Status: NEW → RESOLVED
Closed: 15 years ago
Resolution: --- → WORKSFORME
|
|
Reporter | |
Comment 6•15 years ago
|
||
Flags: in-testsuite+
|
Assignee | |
Updated•13 years ago
|
Crash Signature: [@ nsRect::nsRect]
You need to log in
before you can comment on or make changes to this bug.
Description
•