659626 - Special crafted select element crashes in direct2d enabled

Status: RESOLVED DUPLICATE of bug 656589

(Core :: Layout: Form Controls, defect)

Description

[Markus Fischer]

User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1
Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0.1) Gecko/20100101 Firefox/4.0.1

During web development I generated a HTML code fragment which crashed the browser.

Reproducible: Always

Steps to Reproduce:
1. open select.html in browser
2. click on select element


Actual Results:  
Crashes browser

Expected Results:  
Should not crash

Only crashes when "gfx.direct2d.disabled" is set to "false" (the default on my system).

Comment 1

[Markus Fischer]

Attachment: Special crafted select element crashes browser on click when direct2d is enabled

Comment 2

[Markus Fischer]

I'm actually not sure if it's really a security issue at all, but the browse being able to be crashed that way didn't look good to me.

Here's one of the crash reports I sent:
https://crash-stats.mozilla.com/report/index/bp-c0d71539-4dcc-4b6f-8ea0-8396a2110525