The default bug view has changed. See this FAQ.

Crash [@ nsMutationReceiver::NodeWillBeDestroyed] during GC

RESOLVED FIXED

Status

()

Core
DOM
--
critical
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Assigned: smaug)

Tracking

(Blocks: 1 bug, {crash, testcase})

Trunk
x86_64
Mac OS X
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [sg:critical])

Attachments

(4 attachments, 1 obsolete attachment)

(Reporter)

Description

5 years ago
Created attachment 612135 [details]
testcase (crashes Firefox eventually)

This testcase causes a crash during the next GC, or later.  Running with 
   MallocScribble=1 MallocPreScribble=1
helps make it crash during the GC rather than later.
(Reporter)

Comment 1

5 years ago
Created attachment 612136 [details]
stack trace
(Assignee)

Comment 2

5 years ago
Awesome!
Assignee: nobody → bugs
(Assignee)

Comment 3

5 years ago
Created attachment 612139 [details] [diff] [review]
patch
Attachment #612139 - Flags: review?(jonas)
(Assignee)

Comment 4

5 years ago
Comment on attachment 612139 [details] [diff] [review]
patch

er, silly me
Attachment #612139 - Attachment is obsolete: true
Attachment #612139 - Flags: review?(jonas)
(Assignee)

Comment 5

5 years ago
Created attachment 612145 [details] [diff] [review]
patch
Attachment #612145 - Flags: review?(jonas)
Attachment #612145 - Flags: review?(jonas) → review+
Might be worth adding a comment to the extent of "do this last since it can cause us to be destroyed."
(Assignee)

Comment 7

5 years ago
Created attachment 612195 [details] [diff] [review]
patch
(Assignee)

Comment 8

5 years ago
https://hg.mozilla.org/mozilla-central/rev/d9678c14dea9
Status: NEW → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
(Reporter)

Updated

5 years ago
Keywords: sec-critical
Keywords: sec-critical
Whiteboard: [sg:critical]
You need to log in before you can comment on or make changes to this bug.