Closed Bug 501535 Opened 13 years ago Closed 13 years ago

Crash [@ nsHTMLAudioElement::GetNodeName] with <audio poster>

Categories

(Core :: Audio/Video, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED
Tracking Status
status1.9.1 --- unaffected

People

(Reporter: jruderman, Assigned: cpearce)

References

(Blocks 2 open bugs)

Details

(4 keywords, Whiteboard: [sg:critical?])

Crash Data

Attachments

(3 files, 1 obsolete file)

###!!! ASSERTION: Only call this on <video> elements.: 'HasVideoElement()', file /Users/jruderman/central/layout/generic/nsVideoFrame.cpp, line 464

Crash [@ nsHTMLAudioElement::GetNodeName], likely exploitable (due to static cast?).
Attached file stack trace
Attached patch Patch v1 (obsolete) — Splinter Review
Pretty simple. I wasn't checking that we were only updating the poster attribute for nsVideoFrames which correspond to video elements.
Assignee: nobody → chris
Status: NEW → ASSIGNED
Attachment #386181 - Flags: superreview?(roc)
Attachment #386181 - Flags: review?(roc)
Duplicate of this bug: 500656
Comment on attachment 386181 [details] [diff] [review]
Patch v1

Please add Jesse's test as a crashtest.
Attachment #386181 - Flags: superreview?(roc)
Attachment #386181 - Flags: superreview+
Attachment #386181 - Flags: review?(roc)
Attachment #386181 - Flags: review+
As Patch v1, but with crashtest. r+/sr+ roc.
Attachment #386181 - Attachment is obsolete: true
Attachment #386908 - Flags: superreview+
Attachment #386908 - Flags: review+
Flags: wanted1.9.2?
Flags: blocking1.9.2?
Keywords: checkin-needed
Whiteboard: [needs landing]
Pushed: http://hg.mozilla.org/mozilla-central/rev/48e6821dff34
Status: ASSIGNED → RESOLVED
Closed: 13 years ago
Keywords: checkin-needed
Resolution: --- → FIXED
Whiteboard: [needs landing]
Group: core-security
Whiteboard: [sg:critical?]
Flags: wanted1.9.2?
Flags: blocking1.9.2?
Keywords: regression
Crash Signature: [@ nsHTMLAudioElement::GetNodeName]
You need to log in before you can comment on or make changes to this bug.