Closed Bug 967762 Opened 6 years ago Closed 6 years ago

Faulty crash: null deref in ContainerLayer::RemoveChild called from LayerTransactionParent::RecvUpdate

Categories

(Core :: Graphics, defect)

x86_64
Linux
defect
Not set

Tracking

()

RESOLVED FIXED
mozilla30

People

(Reporter: bjacob, Assigned: bjacob)

References

(Blocks 1 open bug)

Details

Attachments

(1 file)

Attached file Faulty session
Found by Christoph Diehl's "Faulty" fuzzer, see bug 777067

This is a variant of bug 967327, living in a different case (different Op) of the same big switch statement.
Classification: PLayerTransactionParent, missing null check, easy
Depends on: 968825
Fixed by the landing of PLayerTransaction missing null pointer checks (bug 968825).
Assignee: nobody → bjacob
Status: NEW → RESOLVED
Closed: 6 years ago
Resolution: --- → FIXED
Target Milestone: --- → mozilla30
You need to log in before you can comment on or make changes to this bug.