820187 - crash in nsGenericHTMLElement::SetOnerror

Status: RESOLVED DUPLICATE of bug 819745

(Core :: DOM: Core & HTML, defect)

Description

[Martijn Wargers (dead)]

I'm seeing this crash with trunk Fennec on the Samsung Galaxy Nexus, using the fuzz script from the url.
It's crashing consistently there. 
I'm not seeing it on desktop, but the crash is probably there too.

This bug was filed from the Socorro interface and is 
report bp-7b18c744-3f14-43e7-ba65-df4482121209 .
============================================================= 
0 	libxul.so 	nsGenericHTMLElement::SetOnerror 	CallbackFunction.h:92
1 	libxul.so 	mozilla::dom::HTMLElementBinding::set_onerror 	HTMLElementBinding.cpp:1921
2 	libxul.so 	mozilla::dom::HTMLElementBinding::genericSetter 	HTMLElementBinding.cpp:4842
3 	libxul.so 	js::InvokeGetterOrSetter 	jscntxtinlines.h:364
4 	libxul.so 	js::baseops::SetPropertyHelper 	jsscopeinlines.h:313
5 	libxul.so 	js::DirectProxyHandler::set 	jsobjinlines.h:96
6 	libxul.so 	js::Wrapper::set 	jswrapper.cpp:275
7 	libxul.so 	js::CrossCompartmentWrapper::set 	jswrapper.cpp:513
8 	libxul.so 	proxy_SetGeneric 	jsproxy.cpp:2409
9 	libxul.so 	JSObject::nonNativeSetProperty 	jsobj.cpp:2494
10 	libxul.so 	JSObject::setGeneric 	jsobjinlines.h:95
11 	libxul.so 	js::Interpret 	jsinterpinlines.h:367
12 	libxul.so 	js::RunScript 	jsinterp.cpp:326
13 	libxul.so 	js::ExecuteKernel 	jsinterp.cpp:515
14 	libxul.so 	EvalKernel 	Eval.cpp:286
15 	libxul.so 	js::DirectEval 	Eval.cpp:337
16 	libxul.so 	js::mjit::stubs::Eval 	InvokeHelpers.cpp:440
17 	libxul.so 	libxul.so@0xf4c909 	
18 	libxul.so 	js::mjit::stubs::UncachedNewHelper 	MethodJIT.h:854

Comment 1

[Peter Van der Beken [:peterv]]

Duplicate of bug 819745?

Comment 2

[Martijn Wargers (dead)]

Yes, thanks.