use after free (mozilla::dom::FragmentOrElement::Release)

RESOLVED DUPLICATE of bug 855174

Status

()

RESOLVED DUPLICATE of bug 855174
6 years ago
4 years ago

People

(Reporter: rforbes, Unassigned)

Tracking

(Blocks: 1 bug, {crash, testcase})

Other Branch
x86
macOS
crash, testcase
Points:
---

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(2 attachments)

(Reporter)

Description

6 years ago
Created attachment 735034 [details]
testcase

using peach this is a use after free that was found.  testcase and stacktrace included.
(Reporter)

Comment 1

6 years ago
Created attachment 735036 [details]
stacktrace
Status: NEW → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → DUPLICATE
Duplicate of bug: 855174
Group: core-security
You need to log in before you can comment on or make changes to this bug.