Last Comment Bug 749860 - Heap-use-after-free in nsBorderColors
: Heap-use-after-free in nsBorderColors
Status: VERIFIED FIXED
[asan][advisory-tracking+]
: csectype-dos, regression, sec-other
Product: Core
Classification: Components
Component: CSS Parsing and Computation (show other bugs)
: unspecified
: All All
: -- normal (vote)
: mozilla15
Assigned To: David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch)
:
Mentors:
Depends on:
Blocks: 389404
  Show dependency treegraph
 
Reported: 2012-04-27 18:21 PDT by Abhishek Arya
Modified: 2012-07-20 18:42 PDT (History)
9 users (show)
dbaron: in‑testsuite?
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
fixed
fixed
wontfix


Attachments
Testcase (154 bytes, text/html)
2012-04-27 18:21 PDT, Abhishek Arya
no flags Details
patch (1.29 KB, patch)
2012-04-27 21:26 PDT, David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch)
bzbarsky: review+
inferno: feedback+
akeybl: approval‑mozilla‑aurora+
Details | Diff | Review

Description Abhishek Arya 2012-04-27 18:21:42 PDT
Created attachment 619230 [details]
Testcase

Checked Aurora, Trunk and could trigger it on both.

==26466== Warning: client program overrides the handler for signal 11.
==26466== Warning: client program overrides the handler for signal 11.
=================================================================
==26466== ERROR: AddressSanitizer heap-use-after-free on address 0x7f14b304d388 at pc 0x7f14e01b06ec bp 0x7fff9880e330 sp 0x7fff9880e328
READ of size 4 at 0x7f14b304d388 thread T0
    #0 0x7f14e01b06ec in nsBorderColors firefox/aurora-src/layout/style/nsStyleStruct.h:633
    #1 0x7f14e01b0408 in nsBorderColors firefox/aurora-src/layout/style/nsStyleStruct.h:633
    #2 0x7f14e028f770 in nsBorderColors::Clone(bool) const firefox/aurora-src/layout/style/nsStyleStruct.cpp:443
    #3 0x7f14e0158ab8 in nsBorderColors::Clone() const firefox/aurora-src/layout/style/nsStyleStruct.h:636
    #4 0x7f14e0108649 in nsRuleNode::ComputeBorderData(void*, nsRuleData const*, nsStyleContext*, nsRuleNode*, nsRuleNode::RuleDetail, bool) firefox/aurora-src/layout/style/nsRuleNode.cpp:5608
    #5 0x7f14e00b7017 in nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) firefox/aurora-src/layout/style/nsStyleStructList.h:143
    #6 0x7f14e017b36e in nsRuleNode::GetStyleBorder(nsStyleContext*, bool) firefox/aurora-src/layout/style/nsStyleStructList.h:143
    #7 0x7f14df1512f1 in nsStyleContext::DoGetStyleBorder(bool) firefox/aurora-src/layout/style/nsStyleStructList.h:143
    #8 0x7f14df0ca258 in nsStyleContext::GetStyleBorder() firefox/aurora-src/layout/style/nsStyleStructList.h:143
    #9 0x7f14e0244e72 in nsStyleContext::CalcStyleDifference(nsStyleContext*) firefox/aurora-src/layout/style/nsStyleContext.cpp:478
    #10 0x7f14df2dc0c5 in CaptureChange firefox/aurora-src/layout/base/nsFrameManager.cpp:1012
    #11 0x7f14df2d4af3 in nsFrameManager::ReResolveStyleContext(nsPresContext*, nsIFrame*, nsIContent*, nsStyleChangeList*, nsChangeHint, nsRestyleHint, mozilla::css::RestyleTracker&, nsFrameManager::DesiredA11yNotifications, nsTArray<nsIContent*, nsTArrayDefaultAllocator>&, TreeMatchContext&) firefox/aurora-src/layout/base/nsFrameManager.cpp:1321
    #12 0x7f14df2dde76 in nsFrameManager::ComputeStyleChangeFor(nsIFrame*, nsStyleChangeList*, nsChangeHint, mozilla::css::RestyleTracker&, bool) firefox/aurora-src/layout/base/nsFrameManager.cpp:1696
    #13 0x7f14df07147b in nsCSSFrameConstructor::RestyleElement(mozilla::dom::Element*, nsIFrame*, nsChangeHint, mozilla::css::RestyleTracker&, bool) firefox/aurora-src/layout/base/nsCSSFrameConstructor.cpp:8031
    #14 0x7f14defc0f3d in mozilla::css::RestyleTracker::ProcessOneRestyle(mozilla::dom::Element*, nsRestyleHint, nsChangeHint) firefox/aurora-src/layout/base/RestyleTracker.cpp:158
    #15 0x7f14defbb35d in mozilla::css::RestyleTracker::DoProcessRestyles() firefox/aurora-src/layout/base/RestyleTracker.cpp:243
    #16 0x7f14df099baa in mozilla::css::RestyleTracker::ProcessRestyles() firefox/aurora-src/layout/base/RestyleTracker.h:103
    #17 0x7f14df0996de in nsCSSFrameConstructor::ProcessPendingRestyles() firefox/aurora-src/layout/base/nsCSSFrameConstructor.cpp:11638
    #18 0x7f14df44b416 in PresShell::FlushPendingNotifications(mozFlushType) firefox/aurora-src/layout/base/nsPresShell.cpp:3961
    #19 0x7f14e0c7b3de in nsDocument::FlushPendingNotifications(mozFlushType) firefox/aurora-src/content/base/src/nsDocument.cpp:6343
    #20 0x7f14e6249064 in nsDocLoader::DocLoaderIsEmpty(bool) firefox/aurora-src/uriloader/base/nsDocLoader.cpp:807
    #21 0x7f14e624da7c in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) firefox/aurora-src/uriloader/base/nsDocLoader.cpp:736
    #22 0x7f14e624f5ed in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) firefox/aurora-src/modules/zlib/src/inffast.c:0
    #23 0x7f14ddbd0829 in nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, unsigned int) firefox/aurora-src/netwerk/base/src/nsLoadGroup.cpp:731
    #24 0x7f14e0c90c54 in nsDocument::DoUnblockOnload() firefox/aurora-src/content/base/src/nsDocument.cpp:7255
    #25 0x7f14e0c906d1 in nsDocument::UnblockOnload(bool) firefox/aurora-src/content/base/src/nsDocument.cpp:7198
    #26 0x7f14e0c42f34 in nsDocument::DispatchContentLoadedEvents() firefox/aurora-src/content/base/src/nsDocument.cpp:4269
    #27 0x7f14e0cf3139 in nsRunnableMethodImpl<void (nsDocument::*)(), true>::Run() firefox/aurora-src/../../../dist/include/nsThreadUtils.h:345
    #28 0x7f14e93f6f81 in nsThread::ProcessNextEvent(bool, bool*) firefox/aurora-src/xpcom/threads/nsThread.cpp:658
    #29 0x7f14e9083bdd in NS_ProcessNextEvent_P(nsIThread*, bool) firefox/aurora-src/objdir-ff-asan-sym/xpcom/build/nsThreadUtils.cpp:245
    #30 0x7f14e85dc8c6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) firefox/aurora-src/ipc/glue/MessagePump.cpp:110
    #31 0x7f14e96aee3a in MessageLoop::RunInternal() firefox/aurora-src/ipc/chromium/src/base/message_loop.cc:209
    #32 0x7f14e96aec83 in MessageLoop::RunHandler() firefox/aurora-src/ipc/chromium/src/base/message_loop.cc:202
    #33 0x7f14e96aeb68 in MessageLoop::Run() firefox/aurora-src/ipc/chromium/src/base/message_loop.cc:176
    #34 0x7f14e7b167fe in nsBaseAppShell::Run() firefox/aurora-src/widget/xpwidgets/nsBaseAppShell.cpp:191
    #35 0x7f14e66e6098 in nsAppStartup::Run() firefox/aurora-src/toolkit/components/startup/nsAppStartup.cpp:295
    #36 0x7f14dd998323 in XRE_main firefox/aurora-src/toolkit/xre/nsAppRunner.cpp:3703
    #37 0x40a1f3 in do_main firefox/aurora-src/browser/app/nsBrowserApp.cpp:190
    #38 0x407d7e in main firefox/aurora-src/browser/app/nsBrowserApp.cpp:277
    #39 0x7f14f5c31c4d in ?? ??:0
0x7f14b304d388 is located 8 bytes inside of 16-byte region [0x7f14b304d380,0x7f14b304d390)
freed by thread T0 here:
    #0 0x42b972 in free ??:0
    #1 0x7f14f419a673 in moz_free firefox/aurora-src/memory/mozalloc/mozalloc.cpp:98
    #2 0x7f14e015833d in nsStyleBorder::ClearBorderColors(mozilla::css::Side) firefox/aurora-src/layout/style/nsStyleStruct.h:780
    #3 0x7f14e0108617 in nsRuleNode::ComputeBorderData(void*, nsRuleData const*, nsStyleContext*, nsRuleNode*, nsRuleNode::RuleDetail, bool) firefox/aurora-src/layout/style/nsRuleNode.cpp:5608
    #4 0x7f14e00b7017 in nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) firefox/aurora-src/layout/style/nsStyleStructList.h:143
    #5 0x7f14e017b36e in nsRuleNode::GetStyleBorder(nsStyleContext*, bool) firefox/aurora-src/layout/style/nsStyleStructList.h:143
    #6 0x7f14df1512f1 in nsStyleContext::DoGetStyleBorder(bool) firefox/aurora-src/layout/xul/base/src/tree/src/../../../../../style/nsStyleStructList.h:143
    #7 0x7f14df0ca258 in nsStyleContext::GetStyleBorder() firefox/aurora-src/layout/xul/base/src/tree/src/../../../../../style/nsStyleStructList.h:143
    #8 0x7f14e0244e72 in nsStyleContext::CalcStyleDifference(nsStyleContext*) firefox/aurora-src/layout/style/nsStyleContext.cpp:478
    #9 0x7f14df2dc0c5 in CaptureChange firefox/aurora-src/layout/base/nsFrameManager.cpp:1012
    #10 0x7f14df2d4af3 in nsFrameManager::ReResolveStyleContext(nsPresContext*, nsIFrame*, nsIContent*, nsStyleChangeList*, nsChangeHint, nsRestyleHint, mozilla::css::RestyleTracker&, nsFrameManager::DesiredA11yNotifications, nsTArray<nsIContent*, nsTArrayDefaultAllocator>&, TreeMatchContext&) firefox/aurora-src/layout/base/nsFrameManager.cpp:1321
    #11 0x7f14df2dde76 in nsFrameManager::ComputeStyleChangeFor(nsIFrame*, nsStyleChangeList*, nsChangeHint, mozilla::css::RestyleTracker&, bool) firefox/aurora-src/layout/base/nsFrameManager.cpp:1696
    #12 0x7f14df07147b in nsCSSFrameConstructor::RestyleElement(mozilla::dom::Element*, nsIFrame*, nsChangeHint, mozilla::css::RestyleTracker&, bool) firefox/aurora-src/layout/base/nsCSSFrameConstructor.cpp:8031
    #13 0x7f14defc0f3d in mozilla::css::RestyleTracker::ProcessOneRestyle(mozilla::dom::Element*, nsRestyleHint, nsChangeHint) firefox/aurora-src/layout/base/RestyleTracker.cpp:158
    #14 0x7f14defbb35d in mozilla::css::RestyleTracker::DoProcessRestyles() firefox/aurora-src/layout/base/RestyleTracker.cpp:243
    #15 0x7f14df099baa in mozilla::css::RestyleTracker::ProcessRestyles() firefox/aurora-src/layout/base/RestyleTracker.h:103
    #16 0x7f14df0996de in nsCSSFrameConstructor::ProcessPendingRestyles() firefox/aurora-src/layout/base/nsCSSFrameConstructor.cpp:11638
    #17 0x7f14df44b416 in PresShell::FlushPendingNotifications(mozFlushType) firefox/aurora-src/layout/base/nsPresShell.cpp:3961
    #18 0x7f14e0c7b3de in nsDocument::FlushPendingNotifications(mozFlushType) firefox/aurora-src/content/base/src/nsDocument.cpp:6343
    #19 0x7f14e6249064 in nsDocLoader::DocLoaderIsEmpty(bool) firefox/aurora-src/uriloader/base/nsDocLoader.cpp:807
    #20 0x7f14e624da7c in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) firefox/aurora-src/uriloader/base/nsDocLoader.cpp:736
    #21 0x7f14e624f5ed in non-virtual thunk to nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) firefox/aurora-src/modules/zlib/src/inffast.c:0
    #22 0x7f14ddbd0829 in nsLoadGroup::RemoveRequest(nsIRequest*, nsISupports*, unsigned int) firefox/aurora-src/netwerk/base/src/nsLoadGroup.cpp:731
    #23 0x7f14e0c90c54 in nsDocument::DoUnblockOnload() firefox/aurora-src/content/base/src/nsDocument.cpp:7255
    #24 0x7f14e0c906d1 in nsDocument::UnblockOnload(bool) firefox/aurora-src/content/base/src/nsDocument.cpp:7198
    #25 0x7f14e0c42f34 in nsDocument::DispatchContentLoadedEvents() firefox/aurora-src/content/base/src/nsDocument.cpp:4269
    #26 0x7f14e0cf3139 in nsRunnableMethodImpl<void (nsDocument::*)(), true>::Run() firefox/aurora-src/../../../dist/include/nsThreadUtils.h:345
    #27 0x7f14e93f6f81 in nsThread::ProcessNextEvent(bool, bool*) firefox/aurora-src/xpcom/threads/nsThread.cpp:658
    #28 0x7f14e9083bdd in NS_ProcessNextEvent_P(nsIThread*, bool) firefox/aurora-src/objdir-ff-asan-sym/xpcom/build/nsThreadUtils.cpp:245
    #29 0x7f14e85dc8c6 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) firefox/aurora-src/ipc/glue/MessagePump.cpp:110
previously allocated by thread T0 here:
    #0 0x42ba32 in malloc ??:0
    #1 0x7f14f419a7c7 in moz_xmalloc firefox/aurora-src/memory/mozalloc/mozalloc.cpp:103
    #2 0x7f14e028f74a in nsBorderColors::Clone(bool) const firefox/aurora-src/layout/style/nsStyleStruct.cpp:443
    #3 0x7f14e0158ab8 in nsBorderColors::Clone() const firefox/aurora-src/layout/style/nsStyleStruct.h:636
    #4 0x7f14e0290d35 in nsStyleBorder firefox/aurora-src/layout/style/nsStyleStruct.cpp:475
    #5 0x7f14e0106485 in nsRuleNode::ComputeBorderData(void*, nsRuleData const*, nsStyleContext*, nsRuleNode*, nsRuleNode::RuleDetail, bool) firefox/aurora-src/layout/style/nsRuleNode.cpp:5450
    #6 0x7f14e00b7017 in nsRuleNode::WalkRuleTree(nsStyleStructID, nsStyleContext*) firefox/aurora-src/layout/style/nsStyleStructList.h:143
    #7 0x7f14e017b36e in nsRuleNode::GetStyleBorder(nsStyleContext*, bool) firefox/aurora-src/layout/style/nsStyleStructList.h:143
    #8 0x7f14df1512f1 in nsStyleContext::DoGetStyleBorder(bool) firefox/aurora-src/layout/xul/base/src/tree/src/../../../../../style/nsStyleStructList.h:143
    #9 0x7f14df0ca258 in nsStyleContext::GetStyleBorder() firefox/aurora-src/layout/xul/base/src/tree/src/../../../../../style/nsStyleStructList.h:143
    #10 0x7f14e0244e72 in nsStyleContext::CalcStyleDifference(nsStyleContext*) firefox/aurora-src/layout/style/nsStyleContext.cpp:478
    #11 0x7f14df2dc0c5 in CaptureChange firefox/aurora-src/layout/base/nsFrameManager.cpp:1012
    #12 0x7f14df2d4af3 in nsFrameManager::ReResolveStyleContext(nsPresContext*, nsIFrame*, nsIContent*, nsStyleChangeList*, nsChangeHint, nsRestyleHint, mozilla::css::RestyleTracker&, nsFrameManager::DesiredA11yNotifications, nsTArray<nsIContent*, nsTArrayDefaultAllocator>&, TreeMatchContext&) firefox/aurora-src/layout/base/nsFrameManager.cpp:1321
    #13 0x7f14df2dde76 in nsFrameManager::ComputeStyleChangeFor(nsIFrame*, nsStyleChangeList*, nsChangeHint, mozilla::css::RestyleTracker&, bool) firefox/aurora-src/layout/base/nsFrameManager.cpp:1696
    #14 0x7f14df07147b in nsCSSFrameConstructor::RestyleElement(mozilla::dom::Element*, nsIFrame*, nsChangeHint, mozilla::css::RestyleTracker&, bool) firefox/aurora-src/layout/base/nsCSSFrameConstructor.cpp:8031
    #15 0x7f14defc0f3d in mozilla::css::RestyleTracker::ProcessOneRestyle(mozilla::dom::Element*, nsRestyleHint, nsChangeHint) firefox/aurora-src/layout/base/RestyleTracker.cpp:158
    #16 0x7f14defbb35d in mozilla::css::RestyleTracker::DoProcessRestyles() firefox/aurora-src/layout/base/RestyleTracker.cpp:243
    #17 0x7f14df099baa in mozilla::css::RestyleTracker::ProcessRestyles() firefox/aurora-src/layout/base/RestyleTracker.h:103
    #18 0x7f14df0996de in nsCSSFrameConstructor::ProcessPendingRestyles() firefox/aurora-src/layout/base/nsCSSFrameConstructor.cpp:11638
    #19 0x7f14df44b416 in PresShell::FlushPendingNotifications(mozFlushType) firefox/aurora-src/layout/base/nsPresShell.cpp:3961
    #20 0x7f14e0c7b3de in nsDocument::FlushPendingNotifications(mozFlushType) firefox/aurora-src/content/base/src/nsDocument.cpp:6343
    #21 0x7f14e6249064 in nsDocLoader::DocLoaderIsEmpty(bool) firefox/aurora-src/uriloader/base/nsDocLoader.cpp:807
    #22 0x7f14e624da7c in nsDocLoader::OnStopRequest(nsIRequest*, nsISupports*, unsigned int) firefox/aurora-src/uriloader/base/nsDocLoader.cpp:736
==26466== ABORTING
Stats: 152M malloced (152M for red zones) by 328426 calls
Stats: 40M realloced by 18121 calls
Stats: 131M freed by 224886 calls
Stats: 0M really freed by 0 calls
Stats: 336M (86065 full pages) mmaped in 84 calls
  mmaps   by size class: 8:262128; 9:49146; 10:20475; 11:16376; 12:3072; 13:2048; 14:1536; 15:384; 16:640; 17:192; 18:112; 19:48; 20:16;
  mallocs by size class: 8:243052; 9:47441; 10:17171; 11:14146; 12:2135; 13:1762; 14:1418; 15:342; 16:615; 17:185; 18:98; 19:48; 20:13;
  frees   by size class: 8:153448; 9:39298; 10:14983; 11:11624; 12:1556; 13:1563; 14:1247; 15:304; 16:551; 17:171; 18:87; 19:44; 20:10;
  rfrees  by size class:
Stats: malloc large: 344 small slow: 1806
Shadow byte and word:
  0x1fe296609a71: fd
  0x1fe296609a70: fd fd fd fd fd fd fd fd
More shadow bytes:
  0x1fe296609a50: 00 00 00 00 fb fb fb fb
  0x1fe296609a58: fb fb fb fb fb fb fb fb
  0x1fe296609a60: fa fa fa fa fa fa fa fa
  0x1fe296609a68: fa fa fa fa fa fa fa fa
=>0x1fe296609a70: fd fd fd fd fd fd fd fd
  0x1fe296609a78: fd fd fd fd fd fd fd fd
  0x1fe296609a80: fa fa fa fa fa fa fa fa
  0x1fe296609a88: fa fa fa fa fa fa fa fa
  0x1fe296609a90: 00 00 fb fb fb fb fb fb
Comment 1 Kyle Huey [:khuey] (khuey@mozilla.com) (Away until 6/13) 2012-04-27 20:35:20 PDT
I was not able to produce a crash on http://hg.mozilla.org/mozilla-central/rev/cc5254f9825f
Comment 2 Abhishek Arya 2012-04-27 21:08:54 PDT
I am on http://hg.mozilla.org/mozilla-central/rev/0f8ea3826bf7 (Fri Apr 27 08:39:28 2012) ASANified Trunk and http://hg.mozilla.org/releases/mozilla-aurora/rev/2949b3533041 (Fri Apr 27 09:13:39 2012) ASANified Aurora.
Comment 3 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2012-04-27 21:14:32 PDT
Yeah, this looks like a bug in nsRuleNode::ComputeBorderData.  The code there is assuming that parentBorder != border, which isn't necessarily the case.  (In particular, when there's an 'inherit' value, we ensure that parentBorder is a sensible value for anything other than the root; however, we're dealing with the root here, so parentBorder == border.)  (See COMPUTE_START_RESET.)
Comment 4 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2012-04-27 21:16:30 PDT
In particular, the broken code is here:

    case eCSSUnit_Inherit: {
      canStoreInRuleTree = false;
      nsBorderColors *parentColors;
      parentBorder->GetCompositeColors(side, &parentColors);
      if (parentColors) {
        border->EnsureBorderColors();
        border->ClearBorderColors(side);
        border->mBorderColors[side] = parentColors->Clone();
      } else {
        border->ClearBorderColors(side);
      }
      break;
    }
Comment 5 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2012-04-27 21:26:38 PDT
Created attachment 619249 [details] [diff] [review]
patch

I haven't tested this, but I think it's the problem.
Comment 6 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2012-04-27 21:27:14 PDT
Comment on attachment 619249 [details] [diff] [review]
patch

Would you mind testing that this fixes the problem
Comment 7 Boris Zbarsky [:bz] 2012-04-27 21:39:13 PDT
Comment on attachment 619249 [details] [diff] [review]
patch

r=me
Comment 8 Abhishek Arya 2012-04-27 21:53:56 PDT
Comment on attachment 619249 [details] [diff] [review]
patch

Tested the patch on trunk. It fixes the use-after-free.
Comment 9 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2012-04-27 21:59:11 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/1d3c3f280f60
Comment 10 Ed Morley [:emorley] 2012-04-29 15:43:20 PDT
http://hg.mozilla.org/mozilla-central/rev/1d3c3f280f60
Comment 11 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2012-05-02 20:18:03 PDT
Comment on attachment 619249 [details] [diff] [review]
patch

[Approval Request Comment]
Regression caused by (bug #): bug 389404 (December 2008)
User impact if declined: crash, probably denial of service (I *think* it's not exploitable, but I'm not 100% sure about that)
Testing completed (on m-c, etc.): on mozilla-central, patch tested to fix bug
Risk to taking this patch (and alternatives if risky): low; affects relatively obscure CSS property used pretty much only by our own chrome (if that anymore)
String changes made by this patch: none
Comment 12 Alex Keybl [:akeybl] 2012-05-03 09:25:38 PDT
Comment on attachment 619249 [details] [diff] [review]
patch

[Triage Comment]
Low risk sg:dos fix. Given where we are in the cycle, approving for Aurora 14.
Comment 13 David Baron :dbaron: ⌚️UTC-7 (review requests must explain patch) 2012-05-03 10:03:56 PDT
https://hg.mozilla.org/releases/mozilla-aurora/rev/0a959bb63c20
Comment 14 Alex Keybl [:akeybl] 2012-05-10 16:28:10 PDT
Since we believe this is just an sg:dos, we've opted to wontfix for ESR10.
Comment 15 Al Billings [:abillings] 2012-05-14 14:40:34 PDT
Verified fixed in my 5/10 ASAN build.
Comment 16 Al Billings [:abillings] 2012-07-09 17:21:50 PDT
Is this really just a DOS security rating? We didn't mark the keywords. Dan Veditz?

Note You need to log in before you can comment on or make changes to this bug.