Closed Bug 580504 Opened 9 years ago Closed 9 years ago

Crash [@ GetSpecialSibling] with execCommand insertHTML, -moz-column, abs pos

Categories

(Core :: Editor, defect, critical)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

(Blocks 2 open bugs)

Details

(Keywords: crash, regression, testcase, Whiteboard: [sg:dos])

Crash Data

Attachments

(2 files)

Looks like the frame-poison address.
Attached file crash report
Looks like we're traversing the frame tree and we get a poisoned frame, so not critical.
Whiteboard: [sg:dos]
dbaron is on a -moz-column crash-killing rampage.
I can't reproduce this on the latest trunk...
WFM on trunk (built from rev b2bc1dd449b7).
Status: NEW → RESOLVED
Closed: 9 years ago
Resolution: --- → WORKSFORME
No crash on 1.9.2 branch, so making public.
Group: core-security
Test: http://hg.mozilla.org/mozilla-central/rev/6830c0424329
Flags: in-testsuite+
Crash Signature: [@ GetSpecialSibling]
You need to log in before you can comment on or make changes to this bug.