Closed
Bug 674156
Opened 13 years ago
Closed 13 years ago
late-added deviceorientation listener causes a crash
Categories
(Core :: DOM: Events, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 676316
People
(Reporter: jruderman, Assigned: dougt)
References
Details
(Keywords: crash, testcase, Whiteboard: [sg:critical?])
Crash Data
Attachments
(2 files)
Steps to reproduce **in a debug build**: 1. Load the testcase. 2. Click the button. 3. Shut down (or trigger GC?) Result: assertion in nsGlobalWindow::~nsGlobalWindow followed by crash in nsDeviceMotion::DeviceMotionChanged. The assertion was added in bug 669105. (Are those raw weak pointers?) Less reliable and possibly exploitable in opt: bp-4bd37aec-011d-41b3-8d5d-04d182110725
Reporter | ||
Updated•13 years ago
|
Group: core-security
Whiteboard: [sg:critical?]
Reporter | ||
Comment 1•13 years ago
|
||
Comment 2•13 years ago
|
||
This looks exactly like bug 673472 which I just fixed and landed. The testcase is a simpler, though.
Comment 3•13 years ago
|
||
Jesse, can you test with a nightly that contains the fix mentioned in the previous comment?
Comment 4•13 years ago
|
||
Can't reproduce with the attached testcase in today's nightly.
Reporter | ||
Comment 5•13 years ago
|
||
I still get the assertion failure, but not the crash.
Comment 6•13 years ago
|
||
Olli, any idea how sever this assertion might be? Still sg:critical?
Assignee: nobody → Olli.Pettay
Comment 7•13 years ago
|
||
Bug 676316 seems to be a continuation of these crashes. It should presumably receive the same sg: priority as whatever is decided here.
Assignee | ||
Updated•13 years ago
|
Assignee: Olli.Pettay → doug.turner
Assignee | ||
Comment 8•13 years ago
|
||
this is fixed by the patch in bug 676316.
Assignee | ||
Updated•13 years ago
|
Status: NEW → RESOLVED
Closed: 13 years ago
Resolution: --- → DUPLICATE
Updated•10 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•