Closed Bug 664397 Opened 13 years ago Closed 13 years ago

Crash in [@ nsBindingManager::RemovedFromDocument(nsIContent*, nsIDocument*) ]

Categories

(Core :: XML, defect)

defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 485941

People

(Reporter: Tobbi, Unassigned)

Details

(Keywords: crash, testcase, Whiteboard: [sg:dos])

Crash Data

Attachments

(1 file)

Attached file testcase
I'm not sure how exploitable this is, so turning on security-group, just to be sure.

I got mailed about this some time ago (a week or so). I ignored it at first because I thought it was spam. But apparently, it's a valid crash.

The XML file attached crashes in [@ nsBindingManager::RemovedFromDocument(nsIContent*, nsIDocument*) ]. See https://crash-stats.mozilla.com/report/index/bp-5dcf3de9-125b-49d2-ad5a-3d4d12110615
Sure looks like it....
The stack in the crash report is definitely not exploitable.
Group: core-security
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Whiteboard: [sg:dos]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Created:
Updated:
Size: