Memory management for different size display items that share a type is handled incorrectly.

[Pretty sure you meant to mark this as a "Security-Sensitive Layout Bug" rather than "Employee-Confidential". Both are hidden, but to different groups. --> Fixing.]

(In reply to Daniel Holbert [:dholbert] from comment #1) > [Pretty sure you meant to mark this as a "Security-Sensitive Layout Bug" > rather than "Employee-Confidential". Both are hidden, but to different > groups. --> Fixing.] I was not completely sure about the security implications of this bug and marked it employee confidential just in case. After examining this further and discussing it with Matt, this is most likely not exploitable at the moment.

Comment on attachment 8951272 [details] [diff] [review] unique-displayitem-types.diff Review of attachment 8951272 [details] [diff] [review]: ----------------------------------------------------------------- Please make the assertion in nsDisplayListBuilder::Allocate a MOZ_RELEASE_ASSERT too!

Pushed by mikokm@gmail.com: https://hg.mozilla.org/integration/mozilla-inbound/rev/7faf85adc898 Ensure that all display items have a unique type r=mattwoodrow