Closed Bug 790746 Opened 7 years ago Closed 7 years ago

Manully deleting JSObject* is not allowed

Categories

(Firefox OS Graveyard :: General, defect)

x86_64
Windows 7
defect
Not set

Tracking

(firefox-esr10 unaffected)

RESOLVED FIXED
Tracking Status
firefox-esr10 --- unaffected

People

(Reporter: bent.mozilla, Assigned: mikeh)

References

Details

(Keywords: regression, sec-high)

Attachments

(1 file)

Introduced in bug 740997, nsDOMCameraManager::GetListOfCameras tries to delete 'a' (a JSObject*) if something fails. The GC will get it on its own and this will probably corrupt memory.
Assignee: nobody → mhabicher
Status: NEW → ASSIGNED
Attachment #660607 - Flags: review?(bent.mozilla)
Duplicate of this bug: 790480
Attachment #660607 - Flags: review?(bent.mozilla) → review+
https://hg.mozilla.org/mozilla-central/rev/ace13c6f5fc0
Status: ASSIGNED → RESOLVED
Closed: 7 years ago
Resolution: --- → FIXED
Blocks: 740997
No longer depends on: 740997
Keywords: regression
Group: core-security
Keywords: sec-high
You need to log in before you can comment on or make changes to this bug.