Closed Bug 580504 Opened 14 years ago Closed 14 years ago

Crash [@ GetSpecialSibling] with execCommand insertHTML, -moz-column, abs pos

Categories

(Core :: DOM: Editor, defect)

x86
macOS
defect
Not set
critical

Tracking

()

RESOLVED WORKSFORME

People

(Reporter: jruderman, Unassigned)

References

(Blocks 1 open bug)

Details

(Keywords: crash, regression, testcase, Whiteboard: [sg:dos])

Crash Data

Attachments

(2 files)

Looks like the frame-poison address.
Attached file crash report (deleted) —
Looks like we're traversing the frame tree and we get a poisoned frame, so not critical.
Whiteboard: [sg:dos]
dbaron is on a -moz-column crash-killing rampage.
I can't reproduce this on the latest trunk...
WFM on trunk (built from rev b2bc1dd449b7).
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
No crash on 1.9.2 branch, so making public.
Group: core-security
Keywords: regression
Flags: in-testsuite+
Crash Signature: [@ GetSpecialSibling]
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: