"ASSERTION: container didn't take ownership" mutating a deleted, matched CSS rule

NEW
Unassigned

Status

()

Core
CSS Parsing and Computation
5 years ago
5 years ago

People

(Reporter: Jesse Ruderman, Unassigned)

Tracking

({assertion, testcase})

Trunk
x86_64
Mac OS X
assertion, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

5 years ago
Created attachment 673036 [details]
testcase

###!!! ASSERTION: container didn't take ownership: 'Not Reached', file layout/style/StyleRule.cpp, line 1129

Not sure if this is a security issue.  Too-low refcnts scare me, but there's a runtime check for this particular Release() returning zero.
(Reporter)

Comment 1

5 years ago
Created attachment 673037 [details]
stack
I think this assertion is just bogus, precisely because we may not have a container...
Group: core-security
You need to log in before you can comment on or make changes to this bug.