Open Bug 476670 Opened 15 years ago Updated 3 years ago

nsHTMLAnonymousUtils violates layout invariants

Categories

(Core :: DOM: Editor, defect, P5)

Product:
Core
Component:
DOM: Editor
Platform:
x86
macOS
Type:
defect

Tracking

()

People

(Reporter: bzbarsky, Unassigned)

Details

In particular, it calls nsIMutationObserver methods and passes native anonymous content to them.  This is bad.  We've hacked around it in the frame constructor for now, but it's _very_ easy for crashes to be reintroduced if this code stays as it is.
Flags: wanted1.9.2?
Flags: wanted1.9.2?
Flags: wanted1.9.2-
Flags: blocking1.9.2-

Bulk-downgrade of unassigned, >=5 years untouched DOM/Storage bugs' priority and severity.

If you have reason to believe this is wrong, please write a comment and ni :jstutte.

Severity: critical → S4
Priority: -- → P5
You need to log in before you can comment on or make changes to this bug.