Closed
Bug 865880
Opened 12 years ago
Closed 12 years ago
Crash when setting attribute of DOMSVGStringList
Categories
(Core :: SVG, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 864509
| Tracking | Status | |
|---|---|---|
| firefox23 | --- | affected |
People
(Reporter: nils, Unassigned)
References
Details
(Keywords: regression)
Attachments
(2 files)
The attached testcase crashes when accessing unmapped memory.
Attachment #742059 -
Attachment mime type: text/plain → text/html
|
||
Comment 2•12 years ago
|
||
On linux I get Assertion failure: clasp && clasp->mDOMObjectIsISupports, at /home/smaug/mozilla/hg/mozilla/js/xpconnect/src/XPCWrappedNativeScope.cpp:431
|
|
||
Comment 3•12 years ago
|
||
I think this is a regression from bug 861507
|
|
||
Comment 4•12 years ago
|
||
and I think we're missing nsContentUtils::ReleaseWrapper(this, this); from the dtor of
DOMSVGStringList.
But I don't know about the assertion.
|
||
Updated•12 years ago
|
status-b2g18:
--- → unaffected
status-firefox21:
--- → unaffected
status-firefox22:
--- → unaffected
status-firefox-esr17:
--- → unaffected
Keywords: regression
|
|
||
Comment 5•12 years ago
|
||
Er, hmm, nsContentUtils::ReleaseWrapper shouldn't be needed, since unlink should do it.
status-b2g18:
unaffected → ---
status-firefox21:
unaffected → ---
status-firefox22:
unaffected → ---
status-firefox-esr17:
unaffected → ---
|
||
Comment 6•12 years ago
|
||
As far as I can tell this is a duplicate of bug 864509.
|
|
||
Comment 7•12 years ago
|
||
I confirmed that I crash with the testcase here, and then don't crash with the patch in bug 864509 applied.
Status: NEW → RESOLVED
Closed: 12 years ago
Resolution: --- → DUPLICATE
|
||
Updated•12 years ago
|
Whiteboard: [sg:dupe 864509]
|
||
Updated•12 years ago
|
tracking-firefox23:
? → ---
Whiteboard: [sg:dupe 864509]
|
|
||
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•