823408 - crash in nsAttrValue::~nsAttrValue()

Status: REOPENED

(Core :: DOM: Core & HTML, defect)

Description

[Dirkjan Ochtman (:djc)]

This bug was filed from the Socorro interface and is 
report bp-e3b658a0-0c2a-4c4e-ac81-cb9e92121219 .
=============================================================

Comment 1

[Dirkjan Ochtman (:djc)]

I was not interacting with the browser at the time. I believe it might be correlated with a YouTube video ending (either https://www.youtube.com/watch?v=qf3q5qEjO10 or https://www.youtube.com/watch?NR=1&feature=fvwp&v=utyfnJsp0Xg).

Comment 2

[Boris Zbarsky [:bzbarsky]]

That's a null-deref on line 225, like so:

222     case eAtomBase:
223     {
224       nsIAtom* atom = GetAtomValue();
225       NS_RELEASE(atom);

That just shouldn't happen....

Comment 3

[Marcela (Please NI request to Brindusa Tot)]

Closing this as resolved- worksforme, there were no crashes with this signature in the last 6 months.

Comment 4

[Marcela (Please NI request to Brindusa Tot)]

Reopening this issue because it seems that for these Signatures
@ nsAttrValue::~nsAttrValue() ,
@ nsAttrValue::~nsAttrValue there are still crashes occurring in the last 6 months.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

Since the crash volume is low (less than 5 per week), the severity is downgraded to S3. Feel free to change it back if you think the bug is still critical.

For more information, please visit auto_nag documentation.