Closed Bug 796561 Opened 9 years ago Closed 9 years ago

Heap-use-after-free in mozilla::FrameLayerBuilder::UpdateDisplayItemDataForFrame

Tracking

()

Status:

RESOLVED DUPLICATE of bug 795899

People

(Reporter: inferno, Unassigned)

Details

Attachments

(1 file)

Testcase 9 years ago Abhishek Arya 2.07 KB, text/html		Details

Abhishek Arya

Reporter

Description

•

9 years ago

Attached file Testcase — Details

Reproduces on trunk.

=================================================================
==16282== ERROR: AddressSanitizer heap-use-after-free on address 0x7f2e313c2488 at pc 0x7f2e5d1bb426 bp 0x7fffb3e27b70 sp 0x7fffb3e27b68
READ of size 4 at 0x7f2e313c2488 thread T0
    #0 0x7f2e5d1bb425 in nsAutoRefCnt::operator--() src/objdir-ff-asan-sym/toolkit/xre/../../dist/include/nsISupportsImpl.h:263
    #1 0x7f2e5e79aca5 in mozilla::layers::Layer::Release() src/../../dist/include/Layers.h:514
    #2 0x7f2e5e7a9f65 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:874
    #3 0x7f2e5e75bbf6 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:872
    #4 0x7f2e5e75b6a7 in ~DisplayItemData src/layout/base/FrameLayerBuilder.cpp:62
    #5 0x7f2e5e7a1351 in mozilla::FrameLayerBuilder::DisplayItemData::Release() src/layout/base/FrameLayerBuilder.h:537
    #6 0x7f2e5e7a11a5 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:874
    #7 0x7f2e5e771686 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:872
    #8 0x7f2e5e79cc26 in nsTArrayElementTraits<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData> >::Destruct(nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>*) src/../../dist/include/nsTArray.h:360
    #9 0x7f2e5e79c991 in nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultAllocator>::DestructRange(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:1225
    #10 0x7f2e5e79c3f8 in nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultAllocator>::RemoveElementsAt(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:945
    #11 0x7f2e5e7f6f52 in nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultAllocator>::Clear() src/../../dist/include/nsTArray.h:956
    #12 0x7f2e5e7f6e1e in ~nsTArray src/../../dist/include/nsTArray.h:442
    #13 0x7f2e5e7f6d09 in nsAutoArrayBase<nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultAllocator>, 1u>::~nsAutoArrayBase() src/../../dist/include/nsTArray.h:1303
    #14 0x7f2e5e7f6bf9 in nsAutoTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, 1u, nsTArrayDefaultAllocator>::~nsAutoTArray() src/../../dist/include/nsTArray.h:1357
    #15 0x7f2e5e7f69e6 in nsAutoTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, 1u, nsTArrayDefaultAllocator>::~nsAutoTArray() src/../../dist/include/nsTArray.h:1357
    #16 0x7f2e5e7f68d8 in ~DisplayItemDataEntry src/layout/base/FrameLayerBuilder.h:597
    #17 0x7f2e5e7f67b6 in ~DisplayItemDataEntry src/layout/base/FrameLayerBuilder.h:597
    #18 0x7f2e5e7f5fb1 in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::s_ClearEntry(PLDHashTable*, PLDHashEntryHdr*) src/../../dist/include/nsTHashtable.h:464
    #19 0x7f2e6a095f54 in PL_DHashTableRawRemove src/objdir-ff-asan-sym/xpcom/build/pldhash.cpp:685
    #20 0x7f2e5e766782 in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::RawRemoveEntry(mozilla::FrameLayerBuilder::DisplayItemDataEntry*) src/../../dist/include/nsTHashtable.h:211
    #21 0x7f2e5e764282 in mozilla::FrameLayerBuilder::UpdateDisplayItemDataForFrame(mozilla::FrameLayerBuilder::DisplayItemDataEntry*, void*) src/layout/base/FrameLayerBuilder.cpp:998
    #22 0x7f2e5e7a390b in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::s_EnumStub(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*) src/../../dist/include/nsTHashtable.h:485
    #23 0x7f2e6a096cc5 in PL_DHashTableEnumerate src/objdir-ff-asan-sym/xpcom/build/pldhash.cpp:716
    #24 0x7f2e5e7638a2 in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::EnumerateEntries(PLDHashOperator (*)(mozilla::FrameLayerBuilder::DisplayItemDataEntry*, void*), void*) src/../../dist/include/nsTHashtable.h:238
    #25 0x7f2e5e7634c1 in mozilla::FrameLayerBuilder::WillEndTransaction() src/layout/base/FrameLayerBuilder.cpp:924
    #26 0x7f2e5ea4f383 in nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const src/layout/base/nsDisplayList.cpp:1096
    #27 0x7f2e5ea4ca71 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const src/layout/base/nsDisplayList.cpp:966
    #28 0x7f2e5ebda718 in nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) src/layout/base/nsLayoutUtils.cpp:1743
    #29 0x7f2e5ed25526 in PresShell::Paint(nsIView*, nsRegion const&, nsIPresShell::PaintType, bool) src/layout/base/nsPresShell.cpp:5323
    #30 0x7f2e62631bfb in nsViewManager::ProcessPendingUpdatesForView(nsView*, bool) src/view/src/nsViewManager.cpp:436
    #31 0x7f2e62645145 in nsViewManager::ProcessPendingUpdates() src/view/src/nsViewManager.cpp:1210
    #32 0x7f2e5eda2c35 in nsRefreshDriver::Notify(nsITimer*) src/layout/base/nsRefreshDriver.cpp:431
    #33 0x7f2e6a42a46d in nsTimerImpl::Fire() src/xpcom/threads/nsTimerImpl.cpp:476
    #34 0x7f2e6a42b88a in nsTimerEvent::Run() src/xpcom/threads/nsTimerImpl.cpp:556
    #35 0x7f2e6a3eef90 in nsThread::ProcessNextEvent(bool, bool*) src/xpcom/threads/nsThread.cpp:612
    #36 0x7f2e6a0818db in NS_ProcessNextEvent_P(nsIThread*, bool) src/objdir-ff-asan-sym/xpcom/build/nsThreadUtils.cpp:220
    #37 0x7f2e68ac7a56 in mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate*) src/ipc/glue/MessagePump.cpp:82
    #38 0x7f2e6a6a9e61 in MessageLoop::RunInternal() src/ipc/chromium/src/base/message_loop.cc:208
    #39 0x7f2e6a6a9c96 in MessageLoop::RunHandler() src/ipc/chromium/src/base/message_loop.cc:201
    #40 0x7f2e6a6a9b7b in MessageLoop::Run() src/ipc/chromium/src/base/message_loop.cc:175
    #41 0x7f2e67f6f47a in nsBaseAppShell::Run() src/widget/xpwidgets/nsBaseAppShell.cpp:163
    #42 0x7f2e66ba2054 in nsAppStartup::Run() src/toolkit/components/startup/nsAppStartup.cpp:290
    #43 0x7f2e5d1e349d in XREMain::XRE_mainRun() src/toolkit/xre/nsAppRunner.cpp:3782
    #44 0x7f2e5d1e9315 in XREMain::XRE_main(int, char**, nsXREAppData const*) src/toolkit/xre/nsAppRunner.cpp:3848
    #45 0x7f2e5d1ec1c4 in XRE_main src/toolkit/xre/nsAppRunner.cpp:3923
    #46 0x40d013 in do_main(int, char**) src/browser/app/nsBrowserApp.cpp:174
    #47 0x40a755 in main src/browser/app/nsBrowserApp.cpp:279
    #48 0x7f2e7b167c4c in ?? ??:0
0x7f2e313c2488 is located 8 bytes inside of 896-byte region [0x7f2e313c2480,0x7f2e313c2800)
freed by thread T0 here:
    #0 0x4c4af0 in free ??:0
    #1 0x7f2e77ff2586 in moz_free src/memory/mozalloc/mozalloc.cpp:51
    #2 0x7f2e6acd37ed in operator delete(void*) src/../../dist/include/mozilla/mozalloc.h:224
    #3 0x7f2e5e79ad6b in mozilla::layers::Layer::Release() src/gfx/layers/Layers.h:514
    #4 0x7f2e5e7a9f65 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:874
    #5 0x7f2e5e75bbf6 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:872
    #6 0x7f2e5e75b6a7 in ~DisplayItemData src/layout/base/FrameLayerBuilder.cpp:62
    #7 0x7f2e5e7a1351 in mozilla::FrameLayerBuilder::DisplayItemData::Release() src/layout/base/FrameLayerBuilder.h:537
    #8 0x7f2e5e7a11a5 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:874
    #9 0x7f2e5e771686 in ~nsRefPtr src/../../dist/include/nsAutoPtr.h:872
    #10 0x7f2e5e79cc26 in nsTArrayElementTraits<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData> >::Destruct(nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>*) src/../../dist/include/nsTArray.h:360
    #11 0x7f2e5e79c991 in nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultAllocator>::DestructRange(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:1225
    #12 0x7f2e5e79c3f8 in nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultAllocator>::RemoveElementsAt(unsigned int, unsigned int) src/../../dist/include/nsTArray.h:945
    #13 0x7f2e5e7f6f52 in nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultAllocator>::Clear() src/../../dist/include/nsTArray.h:956
    #14 0x7f2e5e7f6e1e in ~nsTArray src/../../dist/include/nsTArray.h:442
    #15 0x7f2e5e7f6d09 in nsAutoArrayBase<nsTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, nsTArrayDefaultAllocator>, 1u>::~nsAutoArrayBase() src/../../dist/include/nsTArray.h:1303
    #16 0x7f2e5e7f6bf9 in nsAutoTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, 1u, nsTArrayDefaultAllocator>::~nsAutoTArray() src/../../dist/include/nsTArray.h:1357
    #17 0x7f2e5e7f69e6 in nsAutoTArray<nsRefPtr<mozilla::FrameLayerBuilder::DisplayItemData>, 1u, nsTArrayDefaultAllocator>::~nsAutoTArray() src/../../dist/include/nsTArray.h:1357
    #18 0x7f2e5e7f68d8 in ~DisplayItemDataEntry src/layout/base/FrameLayerBuilder.h:597
    #19 0x7f2e5e7f67b6 in ~DisplayItemDataEntry src/layout/base/FrameLayerBuilder.h:597
    #20 0x7f2e5e7f5fb1 in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::s_ClearEntry(PLDHashTable*, PLDHashEntryHdr*) src/../../dist/include/nsTHashtable.h:464
    #21 0x7f2e6a095f54 in PL_DHashTableRawRemove src/objdir-ff-asan-sym/xpcom/build/pldhash.cpp:685
    #22 0x7f2e5e766782 in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::RawRemoveEntry(mozilla::FrameLayerBuilder::DisplayItemDataEntry*) src/../../dist/include/nsTHashtable.h:211
    #23 0x7f2e5e764282 in mozilla::FrameLayerBuilder::UpdateDisplayItemDataForFrame(mozilla::FrameLayerBuilder::DisplayItemDataEntry*, void*) src/layout/base/FrameLayerBuilder.cpp:998
    #24 0x7f2e5e7a390b in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::s_EnumStub(PLDHashTable*, PLDHashEntryHdr*, unsigned int, void*) src/../../dist/include/nsTHashtable.h:485
    #25 0x7f2e6a096cc5 in PL_DHashTableEnumerate src/objdir-ff-asan-sym/xpcom/build/pldhash.cpp:716
    #26 0x7f2e5e7638a2 in nsTHashtable<mozilla::FrameLayerBuilder::DisplayItemDataEntry>::EnumerateEntries(PLDHashOperator (*)(mozilla::FrameLayerBuilder::DisplayItemDataEntry*, void*), void*) src/../../dist/include/nsTHashtable.h:238
    #27 0x7f2e5e7634c1 in mozilla::FrameLayerBuilder::WillEndTransaction() src/layout/base/FrameLayerBuilder.cpp:924
    #28 0x7f2e5ea4f383 in nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const src/layout/base/nsDisplayList.cpp:1096
    #29 0x7f2e5ea4ca71 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const src/layout/base/nsDisplayList.cpp:966
previously allocated by thread T0 here:
    #0 0x4c4bb0 in __interceptor_malloc ??:0
    #1 0x7f2e77ff26da in moz_xmalloc src/memory/mozalloc/mozalloc.cpp:57
    #2 0x7f2e6ac734cc in operator new(unsigned long) src/../../dist/include/mozilla/mozalloc.h:200
    #3 0x7f2e5e7d67d6 in mozilla::(anonymous namespace)::ContainerState::CreateOrRecycleThebesLayer(nsIFrame const*, nsIFrame const*, nsPoint const&) src/layout/base/FrameLayerBuilder.cpp:1426
    #4 0x7f2e5e7d43d4 in mozilla::(anonymous namespace)::ContainerState::FindThebesLayerFor(nsDisplayItem*, nsIntRect const&, nsIntRect const&, mozilla::FrameLayerBuilder::Clip const&, nsIFrame const*, nsPoint const&) src/layout/base/FrameLayerBuilder.cpp:1949
    #5 0x7f2e5e7812f5 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2193
    #6 0x7f2e5e7788cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #7 0x7f2e5ea7fbea in nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2574
    #8 0x7f2e5e780304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #9 0x7f2e5e7788cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #10 0x7f2e5eaa1f98 in nsDisplayTransform::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:3737
    #11 0x7f2e5e780304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #12 0x7f2e5e7788cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #13 0x7f2e5ea7fbea in nsDisplayOpacity::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2574
    #14 0x7f2e5e780304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #15 0x7f2e5e77ef9e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #16 0x7f2e5e7788cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #17 0x7f2e5ea857f2 in nsDisplayOwnLayer::BuildLayer(nsDisplayListBuilder*, mozilla::layers::LayerManager*, mozilla::FrameLayerBuilder::ContainerParameters const&) src/layout/base/nsDisplayList.cpp:2670
    #18 0x7f2e5e780304 in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2125
    #19 0x7f2e5e77ef9e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #20 0x7f2e5e77ef9e in mozilla::(anonymous namespace)::ContainerState::ProcessDisplayItems(nsDisplayList const&, mozilla::FrameLayerBuilder::Clip&, unsigned int) src/layout/base/FrameLayerBuilder.cpp:2063
    #21 0x7f2e5e7788cb in mozilla::FrameLayerBuilder::BuildContainerLayerFor(nsDisplayListBuilder*, mozilla::layers::LayerManager*, nsIFrame*, nsDisplayItem*, nsDisplayList const&, mozilla::FrameLayerBuilder::ContainerParameters const&, gfx3DMatrix const*) src/layout/base/FrameLayerBuilder.cpp:2870
    #22 0x7f2e5ea4e598 in nsDisplayList::PaintForFrame(nsDisplayListBuilder*, nsRenderingContext*, nsIFrame*, unsigned int) const src/layout/base/nsDisplayList.cpp:1043
    #23 0x7f2e5ea4ca71 in nsDisplayList::PaintRoot(nsDisplayListBuilder*, nsRenderingContext*, unsigned int) const src/layout/base/nsDisplayList.cpp:966
    #24 0x7f2e5ebda718 in nsLayoutUtils::PaintFrame(nsRenderingContext*, nsIFrame*, nsRegion const&, unsigned int, unsigned int) src/layout/base/nsLayoutUtils.cpp:1743
Shadow byte and word:
  0x1fe5c6278491: fd
  0x1fe5c6278490: fd fd fd fd fd fd fd fd
More shadow bytes:
  0x1fe5c6278470: fa fa fa fa fa fa fa fa
  0x1fe5c6278478: fa fa fa fa fa fa fa fa
  0x1fe5c6278480: fa fa fa fa fa fa fa fa
  0x1fe5c6278488: fa fa fa fa fa fa fa fa
=>0x1fe5c6278490: fd fd fd fd fd fd fd fd
  0x1fe5c6278498: fd fd fd fd fd fd fd fd
  0x1fe5c62784a0: fd fd fd fd fd fd fd fd
  0x1fe5c62784a8: fd fd fd fd fd fd fd fd
  0x1fe5c62784b0: fd fd fd fd fd fd fd fd
Stats: 252M malloced (298M for red zones) by 538949 calls
Stats: 42M realloced by 26950 calls
Stats: 219M freed by 311621 calls
Stats: 86M really freed by 203172 calls
Stats: 480M (122968 full pages) mmaped in 120 calls
  mmaps   by size class: 8:311277; 9:32764; 10:8190; 11:14329; 12:3072; 13:1536; 14:1280; 15:384; 16:1024; 17:1248; 18:144; 19:40; 20:20;
  mallocs by size class: 8:466968; 9:36986; 10:9291; 11:16668; 12:2578; 13:1897; 14:1486; 15:347; 16:1191; 17:1317; 18:159; 19:41; 20:20;
  frees   by size class: 8:256314; 9:28192; 10:6062; 11:13506; 12:1767; 13:1596; 14:1291; 15:305; 16:1128; 17:1300; 18:105; 19:38; 20:17;
  rfrees  by size class: 8:181345; 9:8453; 10:1791; 11:8563; 12:576; 13:497; 14:483; 15:178; 16:931; 17:326; 18:24; 19:4; 20:1;
Stats: malloc large: 1537 small slow: 2511
==16282== ABORTING

Ludovic Hirlimann [:Usul]

Updated

•

9 years ago

Component: General → Graphics: Layers

Product: Firefox → Core

Abhishek Arya

Reporter

Comment 1

•

9 years ago

Just a fyi, this bug is different from https://bugzilla.mozilla.org/show_bug.cgi?id=795899 and still reproduces after i synced to trunk which has the fix for 795899

Matt Woodrow (:mattwoodrow)

Comment 2

•

9 years ago

I can't reproduce this one with the fix for bug 795899

Abhishek Arya

Reporter

Comment 3

•

9 years ago

(In reply to Matt Woodrow (:mattwoodrow) from comment #2)
> I can't reproduce this one with the fix for bug 795899

ah! my build has an error, so it was still using an older version. blowing away build-dir and recompiling.

Abhishek Arya

Reporter

Comment 4

•

9 years ago

Yes it is a dupe. I had trunk build on another machine where it didn't crash without the patch in 795899 and after i reverted the patch, it crashed.

Matt Woodrow (:mattwoodrow)

Updated

•

9 years ago

Status: NEW → RESOLVED

Closed: 9 years ago

Resolution: --- → DUPLICATE

Duplicate of bug: 795899

Daniel Veditz [:dveditz]

Updated

•

7 years ago

Group: core-security

You need to log in before you can comment on or make changes to this bug.

Bugzilla

Heap-use-after-free in mozilla::FrameLayerBuilder::UpdateDisplayItemDataForFrame

Categories

(Core :: Graphics: Layers, defect)

Tracking

()

People

(Reporter: inferno, Unassigned)

References

Details

Crash Data

Security

(public)

User Story

Attachments

(1 file)

Description

Updated

Comment 1

Comment 2

Comment 3

Comment 4

Updated

Updated