Closed Bug 674156 Opened 13 years ago Closed 13 years ago

late-added deviceorientation listener causes a crash

Categories

(Core :: DOM: Events, defect)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED DUPLICATE of bug 676316

People

(Reporter: jruderman, Assigned: dougt)

References

Details

(Keywords: crash, testcase, Whiteboard: [sg:critical?])

Crash Data

Attachments

(2 files)

Attached file testcase
Steps to reproduce **in a debug build**:
1. Load the testcase.
2. Click the button.
3. Shut down (or trigger GC?)

Result: assertion in nsGlobalWindow::~nsGlobalWindow followed by crash in nsDeviceMotion::DeviceMotionChanged.

The assertion was added in bug 669105. (Are those raw weak pointers?)

Less reliable and possibly exploitable in opt: bp-4bd37aec-011d-41b3-8d5d-04d182110725
Group: core-security
Whiteboard: [sg:critical?]
Attached file stack traces
This looks exactly like bug 673472 which I just fixed and landed. The testcase is a simpler, though.
Jesse, can you test with a nightly that contains the fix mentioned in the previous comment?
Can't reproduce with the attached testcase in today's nightly.
I still get the assertion failure, but not the crash.
Olli, any idea how sever this assertion might be? Still sg:critical?
Assignee: nobody → Olli.Pettay
Bug 676316 seems to be a continuation of these crashes. It should presumably receive the same sg: priority as whatever is decided here.
Assignee: Olli.Pettay → doug.turner
this is fixed by the patch in bug 676316.
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Group: core-security
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: