Closed
Bug 513877
Opened 16 years ago
Closed 16 years ago
Crash [@ nsAbsoluteContainingBlock::RemoveFrame] with -moz-column, position:absolute
Categories
(Core :: Layout, defect)
Core
Layout
Tracking
()
RESOLVED
FIXED
People
(Reporter: pvnick, Unassigned)
References
Details
(Whiteboard: [sg:critical])
Attachments
(2 files, 1 obsolete file)
The more I reduce this bug, the less it is actually hit, until it gets to the point where the bug will get hit like 1/50 tries and the testcase is still 1000 lines long, so I'm uploading the unreduced testcase until I can figure something else out. I'm sorry.
Not only is this bug exploitable, it seems that doing so would be as trivial as slapping on some heap-spraying code and voila!
Flags: blocking1.9.2?
|
Reporter | |
Comment 1•16 years ago
|
||
|
||
Updated•16 years ago
|
Whiteboard: [sg:critical]
|
|
Reporter | |
Comment 3•16 years ago
|
||
All of the commands have been reduced, but I still need to reduce the dom construction script, which I'll work on in a bit. This should clear things up considerably, though. Load the testcase, wait for it to finish loading, and refresh a couple times.
|
|
Reporter | |
Comment 4•16 years ago
|
||
Finally reduced all the way :)
|
|
Reporter | |
Comment 5•16 years ago
|
||
Attachment #397820 -
Attachment is obsolete: true
|
|
Reporter | |
Updated•16 years ago
|
Summary: Crash [@nsFrameManager::RemoveFrame] → Crash [@nsAbsoluteContainingBlock::RemoveFrame]
|
||
Updated•16 years ago
|
Summary: Crash [@nsAbsoluteContainingBlock::RemoveFrame] → Crash [@ nsAbsoluteContainingBlock::RemoveFrame] with -moz-column, position:absolute
|
|
||
Comment 6•16 years ago
|
||
Likely related to bug 468563.
I'm not crashing here with the patch for bug 508473, so I assume that fixes this. Marking dependency.
Depends on: 508473
Flags: blocking1.9.2? → wanted1.9.2+
|
|
||
Comment 8•16 years ago
|
||
The (reduced) testcase doesn't crash for me now.
Status: NEW → RESOLVED
Closed: 16 years ago
Resolution: --- → FIXED
|
||
Updated•13 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•