Closed
Bug 840898
Opened 12 years ago
Closed 12 years ago
CSSValueListBinding crash with out-of-range .item()
Categories
(Core :: DOM: CSS Object Model, defect)
Core
DOM: CSS Object Model
Tracking
()
RESOLVED
FIXED
mozilla21
People
(Reporter: jruderman, Assigned: bzbarsky)
References
Details
(Keywords: crash, testcase)
Crash Data
Attachments
(3 files)
|
300 bytes,
text/html
|
Details | |
|
10.55 KB,
text/plain
|
Details | |
|
1.88 KB,
patch
|
tbsaunde
:
review+
lsblakk
:
approval-mozilla-aurora+
|
Details | Diff | Splinter Review |
No description provided.
|
Reporter | |
Comment 1•12 years ago
|
||
|
||
Comment 2•12 years ago
|
||
On Windows: bp-7c8f6639-d356-4069-a9f4-b92832130213
Crash Signature: [@ mozilla::dom::WrapNewBindingObjectHelper<nsRefPtr<mozilla::WebGLBuffer>, int>::Wrap(JSContext*, JSObject*, nsRefPtr<mozilla::WebGLBuffer> const&, JS::Value*)]
OS: Mac OS X → All
Hardware: x86_64 → All
|
Assignee | |
Comment 3•12 years ago
|
||
Attachment #713367 -
Flags: review?(trev.saunders)
|
|
Assignee | |
Updated•12 years ago
|
Assignee: nobody → bzbarsky
|
|
Assignee | |
Updated•12 years ago
|
|
||
Updated•12 years ago
|
Attachment #713367 -
Flags: review?(trev.saunders) → review+
|
||
Updated•12 years ago
|
status-firefox20:
--- → affected
status-firefox21:
--- → affected
|
|
Assignee | |
Comment 4•12 years ago
|
||
Comment on attachment 713367 [details] [diff] [review]
Flag our nullable return value as actually being nullable.
[Approval Request Comment]
Bug caused by (feature/regressing bug #): Bug 798567 (
User impact if declined: Easy to trigger null-deref crash
Testing completed (on m-c, etc.): Passes tests.
Risk to taking this patch (and alternatives if risky): Very very low risk.
String or UUID changes made by this patch: None.
Attachment #713367 -
Flags: approval-mozilla-aurora?
|
|
Assignee | |
Comment 5•12 years ago
|
||
Flags: in-testsuite+
Whiteboard: [need review]
Target Milestone: --- → mozilla21
|
||
Comment 6•12 years ago
|
||
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → FIXED
|
||
Comment 7•12 years ago
|
||
Comment on attachment 713367 [details] [diff] [review]
Flag our nullable return value as actually being nullable.
Approving low risk fix for uplift.
Attachment #713367 -
Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
|
|
||
Comment 8•12 years ago
|
||
You need to log in
before you can comment on or make changes to this bug.
Description
•