634267 - crash[@ nsSVGFEMorphologyElement::Filter] using cross_fuzzv3

Status: RESOLVED INCOMPLETE

(Core :: SVG, defect)

Description

[eherokles]

Attachment: Here is the WinDbg output

manually stopped because of a frozen firefox.

using cross_fuzzv3 on
firefox4b11 32bit windowsxp

Comment 1

[Robert Longson [:longsonr]]

I can't see from inspection how the second argument to Filter could be null, it's an nsAutoTArray.

Comment 2

[Robert Longson [:longsonr]]

Do you have a testcase, or can you create one?

Comment 3

[eherokles]

Both: No

I run the fuzzer on a virtual machine in the background and look from time to time what happends. That´s all.

Comment 4

[Robert Longson [:longsonr]]

Needs a testcase to progress.

Comment 5

[Wayne Mery (:wsmwk)]

I checked with gary and we are thinking the old stack is not very valuable.  So it would be best to have new info, with testcase, if crash still exists.