Closed Bug 742237 Opened 8 years ago Closed 8 years ago

Crash [@ nsMutationReceiver::NodeWillBeDestroyed] during GC

Categories

(Core :: DOM: Core & HTML, defect, critical)

x86_64
macOS
defect
Not set
critical

Tracking

()

RESOLVED FIXED

People

(Reporter: jruderman, Assigned: smaug)

References

(Blocks 1 open bug)

Details

(Keywords: crash, testcase, Whiteboard: [sg:critical])

Attachments

(4 files, 1 obsolete file)

This testcase causes a crash during the next GC, or later.  Running with 
   MallocScribble=1 MallocPreScribble=1
helps make it crash during the GC rather than later.
Attached file stack trace
Awesome!
Assignee: nobody → bugs
Attached patch patch (obsolete) — Splinter Review
Attachment #612139 - Flags: review?(jonas)
Comment on attachment 612139 [details] [diff] [review]
patch

er, silly me
Attachment #612139 - Attachment is obsolete: true
Attachment #612139 - Flags: review?(jonas)
Attached patch patchSplinter Review
Attachment #612145 - Flags: review?(jonas)
Might be worth adding a comment to the extent of "do this last since it can cause us to be destroyed."
Attached patch patchSplinter Review
https://hg.mozilla.org/mozilla-central/rev/d9678c14dea9
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
Keywords: sec-critical
Keywords: sec-critical
Whiteboard: [sg:critical]
Component: DOM → DOM: Core & HTML
You need to log in before you can comment on or make changes to this bug.