Jesse Ruderman Reporter
	Description • 19 years ago

Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.9a1) Gecko/20050908
Firefox/1.6a1

TB9203727M

	Jesse Ruderman Reporter
	Comment 2 • 19 years ago

Assuming this crash is due to calling GetType on a deleted frame, bz thinks this
isn't an exploitable crash in opt builds, because frames are arena-allocated and
the arena isn't recycled until the page goes away.

	rbs Assignee
	Comment 3 • 19 years ago

Move the null checks inside functions. This way we can take away the early
returns in the other codes and give them a chance to continue updating the
remaing states of the frames, even when the underlying markup is invalid.

	Martijn Wargers (dead)
	Comment 4 • 19 years ago

With this testcase, I get approximately crashes with the same stacktrace:
TB9278959K TB9278831M
So this is probably also fixed with the patch.

	rbs Assignee
	Comment 5 • 19 years ago

Checked in the trunk yesterday. So today's builds now have the fix.

	Martijn Wargers (dead)
	Comment 6 • 19 years ago

Yup, verified with 2005-09-12 build.

	rbs Assignee
	Comment 7 • 19 years ago

Checked in the 1.8 branch.

	Jay Patel [:jay]
	Comment 8 • 19 years ago

v.fixed on branch with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5)
Gecko/20050928 Firefox/1.4, testcases don't crash and no crashes since 9/12 in
Talkback data.

	Jesse Ruderman Reporter
	Comment 9 • 17 years ago

Crashtests checked in.