| 1473684
|
|
Crash in mozilla::dom::binding_detail::GenericMethod<T>
|
Core
|
DOM: Core & HTML
|
nobody
|
NEW
|
---
|
2022-10-27
|
| 1422631
|
|
suspect cubeb_data_callback called from refill_callback_duplex() while stream is draining
|
Core
|
Audio/Video: cubeb
|
achronop
|
RESO
|
FIXE
|
2018-11-05
|
| 1604117
|
|
Crash in [@ memcpy_repmovs | mozilla::AudioPacketizer<T>::Input]
|
Core
|
Audio/Video: cubeb
|
achronop
|
RESO
|
FIXE
|
2020-06-05
|
| 1439655
|
|
Wild pointer read in copy_and_extend_plane
|
Core
|
WebRTC: Audio/Video
|
apehrson
|
RESO
|
FIXE
|
2019-05-24
|
| 1386490
|
|
Crash in js::WrapperMap::lookup
|
Core
|
JavaScript Engine
|
bhackett1024
|
RESO
|
FIXE
|
2018-08-28
|
| 1419374
|
|
Crash in std::_Function_handler<T>::_M_invoke
|
Core
|
WebRTC: Audio/Video
|
bonchiang
|
RESO
|
FIXE
|
2018-02-05
|
| 1449388
|
|
Crash in CLockedList::ForEachEntry in plugin process
|
Core
|
Security: Process Sa
|
davidp99
|
RESO
|
FIXE
|
2019-08-07
|
| 1453899
|
|
Crash in vcruntime140.dll@0xc3c7 | mozilla::gmp::GMPPlaneImpl::Copy
|
Core
|
Audio/Video: GMP
|
docfaraday
|
RESO
|
DUPL
|
2019-05-24
|
| 1550133
|
|
Intermittent /webrtc/<randomtest> | application crashed [@ sctp_add_addr_to_vrf]
|
Core
|
WebRTC
|
docfaraday
|
RESO
|
FIXE
|
2020-12-18
|
| 1426483
|
|
Crash in mozilla::dom::FetchDriverObserver::Release
|
Core
|
Audio/Video: Playbac
|
drno
|
RESO
|
WORK
|
2023-06-25
|
| 825477
|
|
Fix passing of pointer to stack variable to WrapRunnableRet/NS_DISPATCH_NORMAL
|
Core
|
WebRTC: Networking
|
ekr
|
RESO
|
FIXE
|
2013-11-25
|
| 1436768
|
|
Crash in mozilla::detail::log_test called from LOG()/MOZ_LOG()
|
Core
|
XPCOM
|
ericrahm+bz
|
RESO
|
WORK
|
2020-01-09
|
| 1533918
|
|
Sandbox escape implications of CrossProcessMutex and CrossProcessSemaphore
|
Core
|
IPC
|
gpascutto
|
RESO
|
FIXE
|
2024-06-20
|
| 1322291
|
|
SEGV on unknown address [@ fetch_add]
|
Core
|
DOM: Animation
|
hikezoe.birchill
|
RESO
|
FIXE
|
2017-04-11
|
| 1508776
|
|
UAF in sftk_FreeSession due to improper refcounting
|
NSS
|
Libraries
|
jc
|
RESO
|
FIXE
|
2020-12-18
|
| 1555936
|
|
Crash in [@ js::AtomsTable::tracePinnedAtoms]
|
Core
|
JavaScript: GC
|
jcoppeard
|
RESO
|
FIXE
|
2022-01-10
|
| 1835886
|
|
Reproducible Tab Crash while doing module load in iframe
|
Core
|
JavaScript Engine
|
jcoppeard
|
RESO
|
FIXE
|
2023-10-17
|
| 1519699
|
|
Crash in rx::VertexDataManager::storeCurrentValue
|
Core
|
Graphics: CanvasWebG
|
jgilbert
|
RESO
|
WORK
|
2023-06-25
|
| 1429617
|
|
Crash in libyuv when rescalling Hangouts call
|
Core
|
WebRTC: Audio/Video
|
jib
|
RESO
|
DUPL
|
2020-12-18
|
| 1773396
|
|
stack-use-after-scope in [@ smallvec::SmallVec$LT$A$GT$::spilled]
|
Core
|
Graphics: WebGPU
|
jimb
|
RESO
|
FIXE
|
2023-10-17
|
| 1469505
|
|
Crash in mozilla::FrameLayerBuilder::RemoveFrameFromLayerManager
|
Core
|
Web Painting
|
jnicol
|
RESO
|
DUPL
|
2019-05-24
|
| 1274887
|
|
Crash in Fold
|
Core
|
JavaScript Engine
|
jorendorff
|
RESO
|
DUPL
|
2023-12-02
|
| 1425612
|
|
StructuredClone crash reading invalid data
|
Core
|
JavaScript Engine
|
jorendorff
|
RESO
|
FIXE
|
2021-10-06
|
| 1456255
|
|
Crash in JSScript::getFunction
|
Core
|
JavaScript Engine
|
jorendorff
|
RESO
|
WORK
|
2020-01-09
|
| 1459932
|
|
Crash in NameResolver::resolve
|
Core
|
JavaScript Engine
|
jorendorff
|
RESO
|
FIXE
|
2020-06-04
|
| 1547561
|
|
Crash in [@ js::frontend::RewritingParseNodeVisitor<T>::visit]
|
Core
|
JavaScript Engine
|
jorendorff
|
RESO
|
FIXE
|
2023-12-02
|
| 1412516
|
|
Crash in `anonymous namespace''::NameResolver::gatherNameable
|
Core
|
JavaScript Engine
|
jwalden
|
RESO
|
INCO
|
2020-01-09
|
| 1408276
|
|
races with LIFECYCLE_WAITING_FOR_MAIN_THREAD_CLEANUP and NotifyOutputData()
|
Core
|
Audio/Video: MediaSt
|
karlt
|
RESO
|
FIXE
|
2018-08-28
|
| 1736385
|
|
Crash in [@ mozilla::net::CacheIOThread::ThreadFunc]
|
Core
|
Networking: Cache
|
kershaw
|
RESO
|
FIXE
|
2024-04-28
|
| 1426196
|
|
Crash in CanAttachNativeGetProp
|
Core
|
JavaScript Engine
|
kvijayan
|
RESO
|
WORK
|
2022-02-24
|
| 1386915
|
|
stylo: AddressSanitizer: attempting double-free [@ gtk_css_node_ensure_style.part.0]
|
Core
|
CSS Parsing and Comp
|
manishearth
|
RESO
|
FIXE
|
2020-02-28
|
| 1471179
|
|
Crash in mozilla::ComputedStyle::DoGetStyleBackground<T>
|
Core
|
Web Painting
|
matt.woodrow
|
RESO
|
WORK
|
2020-01-09
|
| 1407651
|
|
Crash in various points called from JS XDR
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1415546
|
|
Crash in SetNonexistentProperty<T>
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1418786
|
|
Crash in FlattenedDisplayItemIterator::GetNext
|
Core
|
Web Painting
|
nobody
|
RESO
|
WORK
|
2022-08-27
|
| 1471512
|
|
Intermittent testing\firefox-ui\tests\functional\safebrowsing\test_initial_download.py TestSafeBrowsingInitialDownload.test_safe_browsing_initial_download | application crashed [@ 0x8979eb77 | arena_t::AllocRun]
|
Core
|
Memory Allocator
|
nobody
|
RESO
|
WORK
|
2020-01-09
|
| 1475772
|
|
Crash in static union core::result::Result<T> style::properties::LonghandId::parse_value
|
Core
|
CSS Parsing and Comp
|
nobody
|
RESO
|
WONT
|
2019-10-23
|
| 1476319
|
|
Crash in JSScript::createScriptData
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INCO
|
2020-01-09
|
| 1524208
|
|
Crash in RGB24ToARGBRow_SSSE3
|
Core
|
WebRTC
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1536233
|
|
Crash in [@ mozilla::SVGObserverUtils::InvalidateDirectRenderingObservers] (due to nsIFrame's element being deleted?)
|
Core
|
SVG
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1626328
|
|
Crash in [@ js::wasm::WasmFrameIter::popFrame]
|
Core
|
JavaScript: WebAssem
|
nobody
|
RESO
|
DUPL
|
2023-05-22
|
| 1423916
|
|
Crash in webrtc::Deinterleave<T>
|
Core
|
WebRTC: Audio/Video
|
padenot
|
RESO
|
FIXE
|
2018-02-01
|
| 1424318
|
|
Crash in webrtc::FloatS16ToFloat
|
Core
|
WebRTC
|
padenot
|
RESO
|
FIXE
|
2018-01-04
|
| 1440937
|
|
Crash in mozilla::gfx::DrawTargetCaptureImpl::ReplayToDrawTarget
|
Core
|
Graphics: Layers
|
rhunt
|
RESO
|
WORK
|
2023-06-25
|
| 1489206
|
|
Intermittent /media-source/mediasource-changetype-play.html | application crashed [@ I422ToARGBRow_SSSE3]
|
Core
|
Graphics
|
rhunt
|
RESO
|
WORK
|
2023-06-25
|
| 1393011
|
|
ARM JIT: audit usage of Instruction::next()
|
Core
|
JavaScript Engine: J
|
sean.stangl
|
RESO
|
FIXE
|
2018-11-05
|
| 1374122
|
|
Crash in mozilla::EventTargetChainItem::HandleEventTargetChain
|
Core
|
DOM: Events
|
smaug
|
RESO
|
INCO
|
2021-05-12
|
| 1666285
|
|
AddressSanitizer: use-after-poison [@ __asan_memcpy | mozilla::dom::CropAndCopyDataSourceSurface] with READ of size 8
|
Core
|
Graphics: Canvas2D
|
smaug
|
RESO
|
FIXE
|
2021-04-04
|
| 1412391
|
|
Crash in js::shadow::Object::slotRef
|
Core
|
XPConnect
|
sphink
|
RESO
|
WORK
|
2023-06-25
|
| 1408157
|
|
Crash in xul.dll@0x2fa56f8 | mozilla::dom::CoalescedMouseMoveFlusher::WillRefresh
|
Core
|
DOM: Events
|
stone123456
|
RESO
|
FIXE
|
2018-02-01
|
| 1415441
|
|
Crash in mozilla::detail::log_test called from OnMediaSinkVideoComplete()
|
Core
|
Audio/Video: Playbac
|
suro001
|
RESO
|
FIXE
|
2018-08-28
|
| 1415788
|
|
Crash in mozilla::dom::HTMLMediaElement::InitializeDecoderForChannel
|
Core
|
Audio/Video: Playbac
|
suro001
|
RESO
|
FIXE
|
2018-08-28
|
| 1384544
|
|
Crash in NewFunctionClone
|
Core
|
JavaScript Engine
|
tcampbell
|
RESO
|
FIXE
|
2018-11-05
|
| 1567418
|
|
Crash in [@ mozilla::image::nsPNGDecoder::WriteRow]
|
Core
|
Graphics: ImageLib
|
tnikkel
|
RESO
|
WORK
|
2023-06-25
|
| 1451297
|
|
IPC: crash with PImageBridge::Msg_PTextureConstructor [@I422ToARGBRow_Any_AVX2]
|
Core
|
Graphics
|
aosmond
|
RESO
|
FIXE
|
2019-08-07
|
| 1828065
|
|
Crash in [@ webrtc::videocapturemodule::GetMaxOfFrameArray]
|
Core
|
WebRTC: Audio/Video
|
apehrson
|
RESO
|
FIXE
|
2023-10-17
|
| 1395073
|
|
Crash in mozilla::a11y::DocAccessibleWrap::QueryInterface with Sandboxie (SbieDll.dll)
|
Core
|
Disability Access AP
|
eitan
|
RESO
|
WONT
|
2018-03-08
|
| 1649728
|
|
Crash in [@ mozilla::SharedStyleSheetCache::CancelLoadsForLoader]
|
Core
|
CSS Parsing and Comp
|
emilio
|
RESO
|
FIXE
|
2020-12-18
|
| 1413033
|
|
Crash in js::ZoneGroup::enter called from AutoJSAPI::InitInternal()
|
Core
|
JavaScript Engine
|
jdemooij
|
RESO
|
FIXE
|
2019-08-07
|
| 1804640
|
|
Crash [@ sec_pkcs12_decoder_safe_bag_notify]
|
NSS
|
Libraries
|
jschanck
|
RESO
|
FIXE
|
2023-10-17
|
| 1542517
|
|
Crash in [@ mozilla::AudioSink::CheckIsAudible]
|
Core
|
Audio/Video
|
jya-moz
|
RESO
|
WORK
|
2023-06-25
|
| 1481745
|
|
Intermittent SUMMARY: AddressSanitizer: bad-malloc_usable_size Z:\task_1533162563\build\src\build\build-clang\build-clang\src\llvm\projects\compiler-rt\lib\asan\asan_thread.cc:262 in __asan::AsanThread::ThreadStart
|
Core
|
Web Audio
|
karlt
|
RESO
|
FIXE
|
2020-02-28
|
| 1505834
|
|
Crash in mozilla::net::nsHttpConnection::OnInputStreamReady
|
Core
|
Networking: HTTP
|
kershaw
|
RESO
|
DUPL
|
2023-12-02
|
| 1529759
|
|
Crash in [@ mozilla::net::nsHttpChannel::DoConnect]
|
Core
|
Networking: HTTP
|
kershaw
|
RESO
|
WORK
|
2023-06-25
|
| 1769635
|
|
Crash in mozilla::css::SheetLoadData::~SheetLoadData (dropping listener without notifying)
|
Core
|
Networking
|
kershaw
|
RESO
|
FIXE
|
2023-07-17
|
| 1412647
|
|
Crash in mozilla::places::History::KeyClass::`scalar deleting destructor''
|
Toolkit
|
Places
|
mak
|
RESO
|
FIXE
|
2018-08-28
|
| 1418807
|
|
Crash in nsTArray_Impl<T>::RemoveElementsAt | nsDisplayLayerEventRegions::~nsDisplayLayerEventRegions
|
Core
|
Web Painting
|
matt.woodrow
|
RESO
|
WORK
|
2020-01-09
|
| 1436572
|
|
Crash in nsDisplayLayerEventRegions::DispatchToContentHitRegion
|
Core
|
Web Painting
|
matt.woodrow
|
RESO
|
WORK
|
2020-01-09
|
| 1490702
|
|
[libFuzzer] Crash on unknown address [@ mozilla::gfx::InlineTranslator::TranslateRecording]
|
Core
|
Graphics: WebRender
|
matt.woodrow
|
RESO
|
FIXE
|
2023-02-28
|
| 1445448
|
|
Crash in sctp_handle_old_unordered_data
|
Core
|
WebRTC: Networking
|
na-g
|
RESO
|
WORK
|
2020-02-24
|
| 858050
|
|
crash in closesocket
|
Core
|
Networking
|
nobody
|
RESO
|
INAC
|
2024-06-07
|
| 1388382
|
|
Crash in realloc_impl | mozilla::Vector<T>::growStorageBy
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
WORK
|
2020-01-09
|
| 1394790
|
|
Crash at [@ CIImeIPoint::DoUpdateContextWithLock ] with MS Japanese IME on Win10 Creators Update (Will be fixed by Fall Creators Update)
|
Core
|
Widget: Win32
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1404623
|
|
Crash in CStdMarshal::DisconnectSrvIPIDs
|
Core
|
Disability Access AP
|
nobody
|
RESO
|
FIXE
|
2023-10-17
|
| 1406727
|
|
Crash in nsDisplayWrapList::Destroy
|
Core
|
Web Painting
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1425293
|
|
Crash in js::ConstraintTypeSet::sweep
|
Core
|
JavaScript: GC
|
nobody
|
RESO
|
DUPL
|
2024-06-07
|
| 1447133
|
|
Raft of wildptr failures in many opus functions
|
Core
|
Audio/Video: Playbac
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1451302
|
|
Crash in mozilla::layers::ComputeVisibleRegionForChildren
|
Core
|
Graphics: Layers
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1451477
|
|
Crash in nsDisplayItem::RestoreState
|
Core
|
Web Painting
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1453950
|
|
Crash in js::frontend::GeneralParser<T>::assignExpr
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1455366
|
|
Crash in style::gecko::data::PerDocumentStyleData::new
|
Core
|
CSS Parsing and Comp
|
nobody
|
RESO
|
INVA
|
2020-01-09
|
| 1460493
|
|
Crash in nsAtom::Release - called from stylo
|
Core
|
CSS Parsing and Comp
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1461180
|
|
Crash in nsFont::CalcDifference
|
Core
|
CSS Parsing and Comp
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1474172
|
|
Crash in _PR_NativeRunThread | static unsigned int pr_root
|
Core
|
General
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1475381
|
|
Crash in js::frontend::TokenStreamSpecific<T>::identifierName
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1478581
|
|
AddressSanitizer: heap-buffer-overflow [@ nsHtml5TreeOperation::Perform] with READ of size 8
|
Core
|
DOM: HTML Parser
|
nobody
|
RESO
|
INCO
|
2024-05-30
|
| 1481038
|
|
Crash [@ mozilla::net::nsHttpConnectionMgr::ShouldThrottle]
|
Core
|
Networking: HTTP
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1491844
|
|
Crash in mbrtoc32
|
Firefox for Android
|
General
|
nobody
|
RESO
|
WORK
|
2020-12-21
|
| 1502428
|
|
Crash in mozilla::net::LoadInfo::GetPerformanceStorage
|
Core
|
Networking
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1502853
|
|
Crash in js::jit::GetNativeDataPropertyByValuePure<T>
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1507141
|
|
Crash in mozilla::net::nsSocketTransportService::Run
|
Core
|
Networking
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1513458
|
|
Crash in mozilla::net::HttpChannelChild::OnStartRequest
|
Core
|
Networking: HTTP
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1518960
|
|
AddressSanitizer: heap-buffer-overflow [@ mozilla::a11y::DocAccessibleChildBase::ActorDestroy] with WRITE of size 8
|
Core
|
Disability Access AP
|
nobody
|
RESO
|
DUPL
|
2024-05-30
|
| 1528620
|
|
Crash in [@ mozilla::dom::TimeoutExecutor::MaybeExecute]
|
Core
|
DOM: Core & HTML
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1555635
|
|
Crash in [@ mozilla::MediaRawData::Clone]
|
Core
|
Audio/Video
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1560182
|
|
Crash in [@ mozilla::gfx::CaptureCommandList::Clear]
|
Core
|
Graphics
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1575253
|
|
Crash in [@ mozilla::InactiveLayerData::~InactiveLayerData]
|
Core
|
Web Painting
|
nobody
|
RESO
|
FIXE
|
2022-08-27
|
| 1627946
|
|
Intermittent runner.py | application crashed [@ mozilla::net::HttpChannelChild::~HttpChannelChild]
|
Core
|
Networking: HTTP
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1732885
|
|
Investigate bug 1732249
|
Core
|
Networking: HTTP
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1424660
|
|
Crash in mozilla::MediaEngineWebRTCMicrophoneSource::PacketizeAndProcess
|
Core
|
WebRTC: Audio/Video
|
padenot
|
RESO
|
FIXE
|
2018-01-04
|
| 1720594
|
|
Crash in [@ mozilla::net::nsSocketTransportService::SocketContext::TimeoutIn]
|
Core
|
Networking
|
rjesup
|
RESO
|
FIXE
|
2023-10-17
|
| 1799568
|
|
Crash in [@ nsZipArchive::BuildSynthetics]
|
Core
|
Networking: JAR
|
rjesup
|
RESO
|
INCO
|
2024-02-10
|
| 1830099
|
|
Crash [@ IsAutoArray] with WebTransport
|
Core
|
DOM: Networking
|
rjesup
|
RESO
|
FIXE
|
2023-10-17
|
| 1609951
|
|
MOZ_CRASH(Origin must be available when deserialized) in [@ mozilla::ipc::PrincipalInfoToPrincipal]
|
Core
|
DOM: File
|
subhamoy
|
RESO
|
FIXE
|
2024-01-16
|
| 1504462
|
|
Crash in mozilla::nsRFPService::ReduceTimePrecisionAsUSecsWrapper
|
Core
|
Security
|
tom
|
RESO
|
INCO
|
2024-02-10
|
| 1402798
|
|
SVG: Invalid memory access at 0x00009fdf8004 in isNothing
|
Core
|
SVG
|
u459114
|
RESO
|
FIXE
|
2024-05-30
|
| 1576592
|
|
Crash in [@ js::AtomsTable::sweepIncrementally]
|
Core
|
JavaScript: GC
|
allstars.chh
|
RESO
|
INCO
|
2024-02-10
|
| 1257921
|
|
crash in mozilla::MozPromise<T>::ThenValueBase::ResolveOrRejectRunnable::ResolveOrRejectRunnable
|
Core
|
Audio/Video: Playbac
|
alwu
|
RESO
|
WORK
|
2023-06-25
|
| 1403845
|
|
stylo: Crash in style::properties::cascade
|
Core
|
CSS Parsing and Comp
|
emilio
|
RESO
|
WORK
|
2020-01-09
|
| 1459680
|
|
Crash in QueryDnsForFamily
|
External Software Af
|
Other
|
gstoll
|
RESO
|
FIXE
|
2024-01-17
|
| 1575257
|
|
Crash in [@ mozilla::ipc::IProtocol::DestroySubtree]
|
Core
|
IPC
|
jld
|
RESO
|
INCO
|
2024-02-10
|
| 1203273
|
|
Crash in js::TraceManuallyBarrieredGenericPointerEdge after corruption (Mac OS X)
|
Core
|
JavaScript: GC
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1385925
|
|
stylo: Crash in core::ptr::drop_in_place<T>
|
Core
|
CSS Parsing and Comp
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1404791
|
|
stylo: Crash in geckoservo::glue::Servo_ComputedValues_EqualCustomProperties
|
Core
|
CSS Parsing and Comp
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1415325
|
|
Crash in SkRefCntBase::unref in 57b13 on AMD (only)
|
Core
|
Graphics
|
nobody
|
RESO
|
INCO
|
2018-07-20
|
| 1418790
|
|
Crash in mozilla::ActiveScrolledRoot::Release
|
Core
|
Web Painting
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1431147
|
|
Crash in nsIFrame::RemoveDisplayItemDataForDeletion
|
Core
|
Web Painting
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1454959
|
|
Crash in static js::jit::JitExecStatus EnterBaseline
|
Core
|
JavaScript Engine: J
|
nobody
|
RESO
|
DUPL
|
2022-08-27
|
| 1502047
|
|
Crash in js::irregexp::ChoiceNode::Emit
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1509581
|
|
Use-After-Free Crash in MergeState::UpdateContainerASR
|
Core
|
Web Painting
|
nobody
|
RESO
|
WORK
|
2023-06-23
|
| 1511417
|
|
Crash in js::TypeScript::destroy
|
Core
|
JavaScript Engine: J
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1544194
|
|
Crash in [@ `anonymous namespace'::ProcessTwoPixelPairs<T>]
|
Core
|
Graphics
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1552320
|
|
Crash in [@ DirectedAcyclicGraph<T>::Clear]
|
Core
|
Web Painting
|
nobody
|
RESO
|
WORK
|
2020-01-09
|
| 1559699
|
|
Crash in [@ nsDisplayHitTestInfoItem::~nsDisplayHitTestInfoItem]
|
Core
|
Web Painting
|
nobody
|
RESO
|
WORK
|
2022-01-10
|
| 1576843
|
|
Crash in [@ ssse3::S32_alpha_D32_filter_DX]
|
Core
|
Graphics
|
nobody
|
RESO
|
FIXE
|
2022-01-10
|
| 1621246
|
|
Intermittent AddressSanitizer: access-violation (C:\Windows\SYSTEM32\ntdll.dll+0x1800a0b76) SQLite3
|
Toolkit
|
Storage
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1628717
|
|
Crash in [@ DllFreeSplMem]
|
Core
|
Printing: Setup
|
nobody
|
RESO
|
INVA
|
2023-07-07
|
| 1797372
|
|
Mozilla crashes on [@ send ] perhaps because of various buggy LSPs
|
Core
|
Networking
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1846326
|
|
UAF & Wildptr Crashes in [@ mozilla::detail::CompactPairHelper<T>::CompactPairHelper]
|
Core
|
IPC
|
nobody
|
RESO
|
INCO
|
2024-06-25
|
| 1755388
|
|
Serialize and deserialize tags correctly
|
Core
|
JavaScript: WebAssem
|
rhunt
|
RESO
|
FIXE
|
2022-08-27
|
| 1689628
|
|
Crash in [@ mozilla::net::HttpChannelChild::Release]
|
Core
|
Networking: HTTP
|
rjesup
|
RESO
|
INCO
|
2024-02-10
|
| 1670521
|
|
Crash in [@ nsTArray_Impl<T>::~nsTArray_Impl | mozilla::layers::AnimationInfo::~AnimationInfo]
|
Core
|
Layout
|
hikezoe.birchill
|
RESO
|
WORK
|
2023-06-25
|
| 1468888
|
|
Crash in mozilla::dom::SVGViewportElement::IsInner
|
Core
|
General
|
nobody
|
RESO
|
WORK
|
2020-01-09
|
| 1452478
|
|
[meta] Crash in nsAtom::Release
|
Core
|
XPCOM
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1471235
|
|
Intermittent PROCESS-CRASH | Main app process exited normally | application crashed [@ 0x2ade4905]
|
Core
|
DOM: Device Interfac
|
nobody
|
RESO
|
DUPL
|
2023-01-16
|
| 1472573
|
|
Crash in mozilla::dom::ServiceWorkerRegistrationInfo::ServiceWorkerRegistrationInfo
|
Core
|
DOM: Service Workers
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1497050
|
|
Crash in js::UnsafeTraceManuallyBarrieredEdge<T>
|
Core
|
JavaScript: GC
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1502338
|
|
Crash in nsAccessibilityService::GetRootDocumentAccessible
|
Core
|
Disability Access AP
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1543689
|
|
Crash in [@ js::gc::UniqueIdGCPolicy::needsSweep]
|
Core
|
JavaScript: GC
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1560624
|
|
Crash in [@ js::XDRIncrementalEncoder::DepthFirstSliceIterator::iterate<T>]
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
WORK
|
2022-06-01
|
| 1652246
|
|
Crash in [@ js::NestedIterator<T>::next]
|
Core
|
JavaScript: GC
|
nobody
|
RESO
|
WORK
|
2024-05-29
|
| 1516834
|
|
Intermittent AddressSanitizer: SEGV /builds/worker/workspace/build/src/media/libyuv/libyuv/source/row_gcc.cc:1945:3 in I422ToARGBRow_SSSE3
|
Core
|
Graphics: Layers
|
sotaro.ikeda.g
|
RESO
|
FIXE
|
2020-02-28
|
| 1850259
|
|
Crash in [@ start_thread]
|
Core
|
Graphics
|
aosmond
|
RESO
|
FIXE
|
2024-04-28
|
| 1507504
|
|
Crash in mozilla::nt::PEHeaders::FindResourceLeaf<T>
|
Core
|
mozglue
|
bugzilla
|
RESO
|
FIXE
|
2020-06-04
|
| 783867
|
|
ASSERTION: This only works on nsISupports classes! and segfault
|
Core
|
XPConnect
|
bzbarsky
|
RESO
|
FIXE
|
2024-05-30
|
| 832899
|
|
crash with __proto__ and Events (destructor of xul!mozilla::dom::battery::BatteryManager)
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
RESO
|
FIXE
|
2024-05-30
|
| 1346248
|
|
Crash [@gfxTextRun::BreakAndMeasureText]
|
Core
|
Layout
|
chenpighead
|
RESO
|
FIXE
|
2017-04-11
|
| 1736224
|
|
Crash in [@ sctp_setopt]
|
Core
|
WebRTC
|
docfaraday
|
RESO
|
FIXE
|
2023-04-05
|
| 1740361
|
|
Crash in [@ mozilla::MediaTransportHandlerIPC::GetIceStats]
|
Core
|
WebRTC: Networking
|
docfaraday
|
RESO
|
INCO
|
2023-10-30
|
| 922068
|
|
Intermittent crash in test_peerConnection_setLocalOfferInHaveRemoteOffer.html | application crashed [@ msvcr100.dll + 0x1e2ad][@ nr_ice_format_candidate_attribute(ns_ice_candidate *,char*,in)]
|
Core
|
WebRTC: Networking
|
ekr
|
RESO
|
FIXE
|
2014-01-14
|
| 1871194
|
|
SIGILL [@ mozilla::dom::KeyframeEffect::ShouldBlockAsyncTransformAnimations]
|
Core
|
DOM: Animation
|
emilio
|
RESO
|
FIXE
|
2024-02-21
|
| 1296078
|
|
format string mismatch in CreateDXVAManagerEvent::Run()
|
Core
|
Audio/Video
|
froydnj+bz
|
RESO
|
FIXE
|
2017-08-28
|
| 816462
|
|
IonMonkey: Assertion failure: JS_ObjectIsFunction(__null, this), at ../../jsfun.h:290 or Bus Error
|
Core
|
JavaScript Engine
|
general
|
RESO
|
DUPL
|
2015-06-17
|
| 889808
|
|
Crash on heap with ParallelArray and jump to invalid memory
|
Core
|
JavaScript Engine
|
general
|
RESO
|
DUPL
|
2016-10-11
|
| 906016
|
|
Crash [@ js::EncapsulatedPtr::operator->] with ParallelArray and Proxy
|
Core
|
JavaScript Engine
|
general
|
RESO
|
DUPL
|
2016-10-11
|
| 906856
|
|
Crash on Heap with controllable read involving Array.length
|
Core
|
JavaScript Engine
|
general
|
RESO
|
DUPL
|
2016-10-11
|
| 1322382
|
|
SEGV on unknown address [@ GetUnit]
|
Core
|
DOM: Animation
|
hikezoe.birchill
|
RESO
|
FIXE
|
2017-04-11
|
| 809021
|
|
IonMonkey: Opt-only Crash [@ GetValueType] or Crash [@ js::ion::ReflowTypeInfo]
|
Core
|
JavaScript Engine
|
jdemooij
|
RESO
|
FIXE
|
2013-04-18
|
| 824863
|
|
Incorrect behavior on emscripten "stack_byval" test
|
Core
|
JavaScript Engine
|
jdemooij
|
RESO
|
FIXE
|
2014-05-05
|
| 1871089
|
|
Wild pointer-deref from jitted code
|
Core
|
JavaScript Engine
|
jdemooij
|
RESO
|
FIXE
|
2024-06-13
|
| 1186621
|
|
Memory-safety bug in Buffer11::NativeBuffer11::map
|
Core
|
Graphics
|
jgilbert
|
RESO
|
FIXE
|
2024-05-30
|
| 1202619
|
|
SEGV in FastConvertYUVToRGB32Row
|
Core
|
Graphics
|
jnicol
|
RESO
|
DUPL
|
2024-05-30
|
| 780963
|
|
invalid cast with svg feImage
|
Core
|
SVG
|
jwatt
|
RESO
|
FIXE
|
2024-05-30
|
| 1592502
|
|
initialize all fields of GdkEvents in nsClipboardX11.cpp
|
Core
|
Widget: Gtk
|
karlt
|
RESO
|
FIXE
|
2020-06-05
|
| 849606
|
|
"ASSERTION: Invalid offset" and crash with textPath and "svg.text.css-frames.enabled" preffed on
|
Core
|
SVG
|
longsonr
|
RESO
|
FIXE
|
2016-06-04
|
| 1568858
|
|
Crash in [@ hsw::gather_8888]
|
Core
|
Graphics
|
lsalzman
|
RESO
|
FIXE
|
2020-06-05
|
| 1804998
|
|
src/gl.cc:558:16: runtime error: applying non-zero offset 2196480 to null pointer
|
Core
|
Graphics: WebRender
|
lsalzman
|
RESO
|
FIXE
|
2023-10-17
|
| 1395100
|
|
Assertion failure: cmpret == 0, at js/src/jit/arm/Simulator-arm.cpp:1074
|
Core
|
JavaScript Engine
|
mail
|
RESO
|
FIXE
|
2017-10-03
|
| 1338328
|
|
Bug 860857 added some untested codepaths that trigger assertions and memory-corruption crashes when exercised
|
Core
|
DOM: Core & HTML
|
nika
|
RESO
|
FIXE
|
2018-02-01
|
| 989299
|
|
GenerationalGC: Crash [@ js::gc::BarrieredCell<js::ObjectImpl>::zone] with TypedObject
|
Core
|
JavaScript Engine
|
nmatsakis
|
RESO
|
FIXE
|
2016-06-04
|
| 467167
|
|
Mozilla crashes on startup [@ _PR_MD_SEND ] [@ VirtualAllocEx ] [@ send ] because of various buggy LSPs
|
Core
|
Networking
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 657892
|
|
Start-up crash [@ nsZipArchive::OpenArchive ]
|
Core
|
Networking: JAR
|
nobody
|
RESO
|
INAC
|
2023-05-25
|
| 774657
|
|
Intermittent test_websocket.html | application timed out after 330 seconds with no output (with MSVC debug assertion failed dialog: "dbgheap.c, line: 1322, expression: _CrtIsValidHeapPointer(pUserData)")
|
Core
|
General
|
nobody
|
RESO
|
WORK
|
2015-10-07
|
| 1141089
|
|
crash in mozilla::ContainerState::InvalidateForLayerChange(nsDisplayItem*, mozilla::layers::PaintedLayer*)
|
Core
|
Web Painting
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1192323
|
|
ASan: SEGV in sec_asn1d_free_child()
|
NSS
|
Libraries
|
nobody
|
RESO
|
DUPL
|
2016-05-04
|
| 1194500
|
|
ASan: SEGV in sec_asn1d_add_to_subitems
|
NSS
|
Libraries
|
nobody
|
RESO
|
DUPL
|
2016-11-02
|
| 1194507
|
|
ASan: SEGV in SEC_ASN1DecoderUpdate_Util() secasn1d.c:2712
|
NSS
|
Libraries
|
nobody
|
RESO
|
DUPL
|
2016-11-02
|
| 1194933
|
|
ASan: SEGV in FastConvertYUVToRGB32Row
|
Core
|
Graphics: Layers
|
nobody
|
RESO
|
WORK
|
2016-11-02
|
| 1203739
|
|
ASan: SEGV in SEC_ASN1DecoderUpdate_Util() secasn1d.c:2738
|
NSS
|
Libraries
|
nobody
|
RESO
|
DUPL
|
2016-11-02
|
| 1207165
|
|
crash @ xul!AssertNotOnGrayList+0x00000138
|
Core
|
JavaScript: GC
|
nobody
|
RESO
|
WORK
|
2015-12-16
|
| 1215837
|
|
SEGV in nsStandardURL::BuildNormalizedSpec
|
Core
|
Networking
|
nobody
|
RESO
|
DUPL
|
2024-05-30
|
| 1222933
|
|
crash in nsSocketOutputStream::Write due to PR_Write interception
|
Core
|
Networking
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1227341
|
|
OpenH264: Invalid write in [@WelsDec::DecodeFrameConstruction]
|
Core
|
Audio/Video: GMP
|
nobody
|
RESO
|
FIXE
|
2022-09-09
|
| 1337052
|
|
Crash in nsTArray_Impl<T>::RemoveElementsAt | nsTArray_Impl<T>::RemoveElementsAt | FireForgetSkippable
|
Core
|
DOM: Core & HTML
|
nobody
|
RESO
|
DUPL
|
2019-08-07
|
| 1414382
|
|
Crash in ToParticipant
|
Core
|
XPCOM
|
nobody
|
RESO
|
INCO
|
2022-02-24
|
| 1426184
|
|
AddressSanitizer: heap-buffer-overflow READ of size 3 nsTDependentString (involving hang reporter)
|
Core
|
XPCOM
|
nobody
|
RESO
|
DUPL
|
2024-05-30
|
| 1438562
|
|
Crash in GetMessageA (with Diebold Warsaw)
|
External Software Af
|
Other
|
nobody
|
RESO
|
DUPL
|
2020-12-21
|
| 1441143
|
|
MOZ_RELEASE_ASSERT(chunk->arena->mMagic == 0x947d3d24) from addEnumerableDataProperty
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
WORK
|
2018-08-31
|
| 1441951
|
|
Crash in mozilla::dom::ContentParent::EnsurePermissionsByKey
|
Core
|
Permission Manager
|
nobody
|
RESO
|
INCO
|
2022-06-01
|
| 1446539
|
|
Crash in ldexp() called from float32_unpack()/book_unquantize() in vorbis decode
|
Core
|
Audio/Video
|
nobody
|
RESO
|
INCO
|
2018-07-20
|
| 1447151
|
|
Crash in nsDisplayListBuilder::OutOfFlowDisplayData::ComputeVisibleRectForFrame
|
Core
|
Web Painting
|
nobody
|
RESO
|
DUPL
|
2022-08-27
|
| 1452463
|
|
Crash in js::NativeObject::addDataPropertyInternal
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INCO
|
2022-06-01
|
| 1452468
|
|
Crash in nsContentUtils::GetInnerWindowID
|
Core
|
XPCOM
|
nobody
|
RESO
|
WORK
|
2020-01-09
|
| 1453601
|
|
Crash in TransformGfxRectToAncestor
|
Core
|
Web Painting
|
nobody
|
RESO
|
WORK
|
2018-06-06
|
| 1458562
|
|
Crash in UserCallWinProcCheckWow after win10 1803 update with 3rd party smartcard software
|
External Software Af
|
Other
|
nobody
|
RESO
|
DUPL
|
2023-12-02
|
| 1461177
|
|
Crash in mozilla::FLBDisplayItemIterator::ShouldFlattenNextItem
|
Core
|
Web Painting
|
nobody
|
RESO
|
DUPL
|
2022-08-27
|
| 1471714
|
|
Crash in nsRegion::AddRect
|
Core
|
Graphics
|
nobody
|
RESO
|
INCO
|
2019-05-24
|
| 1475936
|
|
Crash in PLDHashTable::Add | pref_SetPref (Citrix)
|
External Software Af
|
Other
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1479691
|
|
Crash in JS::Rooted<T>::operator=
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
WORK
|
2018-11-08
|
| 1486197
|
|
Crash in js::irregexp::TextNode::TextEmitPass
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
DUPL
|
2023-07-18
|
| 1501343
|
|
Crash in vcruntime140.dll@0xcacf | sftk_NewAttribute
|
NSS
|
Libraries
|
nobody
|
RESO
|
WORK
|
2019-02-07
|
| 1501362
|
|
Crash in PR_Write | mozilla::net::PollableEvent::Signal with Eset and Zemana Anti-Keylogger
|
External Software Af
|
Other
|
nobody
|
RESO
|
WORK
|
2019-11-26
|
| 1502845
|
|
Crash in mozilla::detail::HashTable<T>::changeTableSize
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
WORK
|
2018-11-05
|
| 1504527
|
|
Crash in mozilla::net::LoadInfo::Release
|
Core
|
DOM: Core & HTML
|
nobody
|
RESO
|
DUPL
|
2023-06-23
|
| 1507102
|
|
Crash in MessageBuilder::WriteElement spiking from users of WPS Office
|
Core
|
Disability Access AP
|
nobody
|
RESO
|
WORK
|
2019-10-23
|
| 1516850
|
|
Crash in SelectContainerASR
|
Core
|
Web Painting
|
nobody
|
RESO
|
DUPL
|
2023-06-23
|
| 1517317
|
|
Crash in trunc
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
INVA
|
2020-01-09
|
| 1530672
|
|
Crash in [@ js::UncheckedUnwrapWithoutExpose]
|
Core
|
JavaScript Engine
|
nobody
|
RESO
|
DUPL
|
2023-05-22
|
| 1534751
|
|
Crash in [@ PR_Poll | TelemetryHistogram::Accumulate]
|
Core
|
Networking
|
nobody
|
RESO
|
DUPL
|
2023-05-22
|
| 1567756
|
|
Firefox crashes on any page that plays a video...
|
Core
|
Audio/Video
|
nobody
|
RESO
|
INCO
|
2020-01-06
|
| 1576824
|
|
Crash in [@ TelemetryOrigin::InitializeGlobalState]
|
Toolkit
|
Telemetry
|
nobody
|
RESO
|
WONT
|
2019-10-30
|
| 1585383
|
|
Crash in [@ MatrixForTransformFunction]
|
Core
|
CSS Parsing and Comp
|
nobody
|
RESO
|
DUPL
|
2023-07-18
|
| 1610884
|
|
heap-buffer-overflow (READ of size 8) in mozilla::dom::quota::QuotaObject::LockedMaybeUpdateSize
|
Core
|
Storage: Quota Manag
|
nobody
|
RESO
|
DUPL
|
2024-05-30
|
| 1616073
|
|
Crash in [@ mozilla::MediaRawData::~MediaRawData]
|
Core
|
Audio/Video
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1629829
|
|
Crash in [@ MessageLoop::PostTask | mozilla::ipc::MessageChannel::OnMessageReceivedFromLink]
|
Core
|
IPC
|
nobody
|
RESO
|
WORK
|
2024-06-28
|
| 1664229
|
|
ASan: about:home startup cache wild pointer
|
Toolkit
|
Startup and Profile
|
nobody
|
RESO
|
DUPL
|
2024-06-07
|
| 1695935
|
|
Intermittent AddressSanitizer: access-violation /builds/worker/workspace/obj-build/dist/include/mozilla/layers/TextureD3D11.h:135 in mozilla::layers::DXGIYCbCrTextureData::~DXGIYCbCrTextureData
|
Core
|
Graphics: Layers
|
nobody
|
RESO
|
FIXE
|
2021-11-22
|
| 1697810
|
|
Crash in [@ nsOuterWindowProxy::set]
|
Core
|
DOM: Core & HTML
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1734457
|
|
Crash in [@ CreateWRCommandsForBorderSegment]
|
Core
|
Graphics: WebRender
|
nobody
|
RESO
|
WORK
|
2023-06-25
|
| 1742233
|
|
Firefox crashes after 30 seconds
|
Core
|
Networking
|
nobody
|
RESO
|
DUPL
|
2024-02-20
|
| 1746733
|
|
Crash in [@ sqlite3AddGenerated]
|
Core
|
Networking
|
nobody
|
RESO
|
FIXE
|
2021-12-21
|
| 1753060
|
|
Crash in [@ memcpy | mozilla::image::BlendAnimationFilter<T>::WriteBaseFrameRow]
|
Core
|
Graphics: ImageLib
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1760846
|
|
Crash in [@ hb_lazy_loader_t<T>::get_stored]
|
Core
|
Layout: Text and Fon
|
nobody
|
RESO
|
INCO
|
2024-02-10
|
| 1852060
|
|
Android Crash in [@ style::values::generics::calc::GenericCalcNode<T>::resolve_internal]
|
Core
|
Audio/Video: cubeb
|
padenot
|
RESO
|
FIXE
|
2024-05-22
|
| 830192
|
|
Out of bounds read in nsCellMap::GetRowSpanForNewCell
|
Core
|
Layout: Tables
|
roc
|
RESO
|
FIXE
|
2024-05-30
|
| 876092
|
|
out of bounds stack read in mozilla::DisplayItemClip::IntersectWith
|
Core
|
Layout
|
roc
|
RESO
|
FIXE
|
2024-05-30
|
| 790373
|
|
plugin scroll position listener callback may destroy listener list (crash of bug 788436)
|
Core Graveyard
|
Plug-ins
|
smichaud
|
RESO
|
FIXE
|
2022-05-16
|
| 1820587
|
|
Crash in [@ gfxContext::GetAzureDeviceSpaceClipBounds]
|
Core
|
Graphics
|
tnikkel
|
RESO
|
FIXE
|
2024-01-03
|
| 1215944
|
|
crash in nsStandardURL::BuildNormalizedSpec
|
Core
|
Networking
|
valentin.gosu
|
RESO
|
FIXE
|
2015-11-03
|
| 1316697
|
|
crash at [@nsStandardURL::SegmentIs] with dom.url.encode_decode_hash=false
|
Core
|
Networking
|
valentin.gosu
|
RESO
|
DUPL
|
2020-08-08
|
| 779078
|
|
nsFrame::HandleRelease may cast aEvent to nsMouseEvent even if aEvent is a TouchEvent
|
Core
|
DOM: UI Events & Foc
|
wjohnston2000
|
RESO
|
FIXE
|
2019-03-13
|
| 1358159
|
|
Crash in GetLocaleInfoHelper() called from :intl::OSPreferences::ReadDateTimePattern
|
Core
|
Internationalization
|
zibi
|
RESO
|
FIXE
|
2017-08-28
|
| 1406772
|
|
Crash in mozilla::AudioChannelsDownMix<T>
|
Core
|
Audio/Video: cubeb
|
achronop
|
VERI
|
FIXE
|
2018-02-01
|
| 1454285
|
|
Crash [@ js::Shape::numFixedSlots] or [@ js::jit::BaselineCompiler::getEnvironmentCoordinateAddressFromObject]
|
Core
|
JavaScript Engine
|
arai.unmht
|
VERI
|
FIXE
|
2023-12-06
|
| 1495245
|
|
Crash in PLDHashTable::Iterator::Iterator | mozilla::plugins::PluginUtilsWin::AudioDeviceMessageRunnable::Run
|
Core
|
Security: Process Sa
|
davidp99
|
VERI
|
FIXE
|
2020-02-16
|
| 1490585
|
|
Startup crash in nsSSLStatus::~nsSSLStatus after downgrading profile
|
Core
|
Security: PSM
|
dkeeler
|
VERI
|
FIXE
|
2020-02-16
|
| 1536227
|
|
Crash in [@ nsTArray_Impl<T>::RemoveElement<T>(class `anonymous namespace'::ParentImpl*& const, const class nsDefaultComparator<T>& const) | mozilla::a11y::DocAccessibleParent::RecvHideEvent]
|
Core
|
Disability Access AP
|
jteh
|
VERI
|
FIXE
|
2020-06-05
|
| 1675755
|
|
Crash on GC after redeclare let or const on the web console [js::gc::Cell::runtimeFromAnyThread (this=0x4b4b4b4b4b4b4b4b)]
|
Core
|
JavaScript Engine
|
sphink
|
VERI
|
FIXE
|
2024-05-30
|
| 1624886
|
|
Crash in [@ js::wasm::WasmFrameIter::instance]
|
Core
|
JavaScript: WebAssem
|
rhunt
|
VERI
|
FIXE
|
2022-03-18
|
| 1412882
|
|
Crash in gfxFontUtils::MapCharToGlyphFormat4
|
Core
|
Graphics: Text
|
jfkthame
|
VERI
|
FIXE
|
2021-06-24
|
| 1318165
|
|
ASAN: about:memory->measure triggers a crash: attempting to call malloc_usable_size() for pointer which is not owned
|
Core
|
DOM: Core & HTML
|
amarchesini
|
VERI
|
FIXE
|
2024-05-30
|
| 926847
|
|
Assertion failure: hasSlot() && !hasMissingSlot(), at ../vm/Shape.h:1161 or Crash [@ PropertyReadNeedsTypeBarrier] (jit)
|
Core
|
JavaScript Engine: J
|
bhackett1024
|
VERI
|
FIXE
|
2015-02-25
|
| 950460
|
|
Crash [@ js::BarrieredValue::writeBarrierPre] or Crash [@ markIfUnmarked] or Assertion failure: addr % CellSize == 0, at gc/Heap.h:1081 or Crash [@ operator->()]
|
Core
|
JavaScript Engine
|
bhackett1024
|
VERI
|
FIXE
|
2015-05-18
|
| 1063180
|
|
Crash with glibc-detected free on invalid pointer [@ maybeAnalyze]
|
Core
|
JavaScript Engine
|
bhackett1024
|
VERI
|
FIXE
|
2015-05-18
|
| 1151333
|
|
Crash [@ ??] with SIMD swizzle
|
Core
|
JavaScript Engine
|
bugzilla
|
VERI
|
FIXE
|
2015-05-18
|
| 1499198
|
|
Crash in js::wasm::Instance::callExport
|
Core
|
JavaScript: WebAssem
|
bugzilla
|
VERI
|
FIXE
|
2020-02-16
|
| 1328861
|
|
Crash in arena_dalloc | mozilla::binding_danger::TErrorResult<T>::ClearDOMExceptionInfo
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
VERI
|
FIXE
|
2019-03-13
|
| 1181011
|
|
Heap-use-after-free in nsFrame::DidSetStyleContext
|
Core
|
CSS Parsing and Comp
|
cam
|
VERI
|
FIXE
|
2024-05-30
|
| 1840088
|
|
AddressSanitizer: heap-buffer-overflow [@ GetIntegerValue] with READ of size 4
|
Core
|
DOM: Core & HTML
|
continuation
|
VERI
|
FIXE
|
2023-12-06
|
| 841462
|
|
IonMonkey: Assertion failure: isObject(), at ./dist/include/js/Value.h:1111 or Crash on Heap with invalid read
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2013-03-31
|
| 799803
|
|
IonMonkey: Crash [@ JSString::isAtom] with invalid read
|
Core
|
JavaScript Engine
|
efaustbmo
|
VERI
|
FIXE
|
2013-11-25
|
| 905999
|
|
Crash [@ check] with GC and typeof
|
Core
|
JavaScript Engine
|
efaustbmo
|
VERI
|
FIXE
|
2015-02-25
|
| 1398581
|
|
heap-use-after-free in nsFirstLetterFrame::CreateContinuationForFloatingParent (Stylo)
|
Core
|
Layout: Floats
|
emilio
|
VERI
|
FIXE
|
2024-05-30
|
| 1723468
|
|
Crash in [@ gfxFontGroup::FindFontForChar]
|
Core
|
Layout: Text and Fon
|
emilio
|
VERI
|
FIXE
|
2021-11-03
|
| 1850191
|
|
crash at [@ServoComputedData::StyleDisplay]
|
Core
|
Disability Access AP
|
emilio
|
VERI
|
FIXE
|
2024-04-28
|
| 792944
|
|
IonMonkey: Assertion failure: Crash at heap with RegExp and GC
|
Core
|
JavaScript Engine
|
jdemooij
|
VERI
|
FIXE
|
2013-04-18
|
| 866611
|
|
Assertion failure: length <= MAX_LENGTH, at vm/String.h
|
Core
|
JavaScript Engine
|
jdemooij
|
VERI
|
FIXE
|
2014-05-05
|
| 874974
|
|
Crash [@ setStringThis] with controllable invalid read
|
Core
|
JavaScript Engine
|
jdemooij
|
VERI
|
FIXE
|
2014-11-19
|
| 1365518
|
|
Assertion failure: exprStackSlots == expectedDepth, at BaselineBailouts.cpp:1058
|
Core
|
JavaScript Engine: J
|
jdemooij
|
VERI
|
FIXE
|
2017-08-28
|
| 1776658
|
|
Crash [@ std::__atomic_base<unsigned long>::load] through [@ JSObject::shape]
|
Core
|
XPConnect
|
kmaglione+bmo
|
VERI
|
FIXE
|
2023-02-28
|
| 1033115
|
|
Crash [@ js::jit::AssertValidObjectPtr] or Assertion failure: obj->compartment() == cx->compartment(), at jit/VMFunctions.cpp
|
Core
|
JavaScript Engine: J
|
lhansen
|
VERI
|
FIXE
|
2014-09-28
|
| 892426
|
|
Crash [@ compartment] or Opt-Crash [@ getGeneric] involving array_toSource and invalid read
|
Core
|
JavaScript Engine
|
nicolas.b.pierron
|
VERI
|
FIXE
|
2014-05-05
|
| 930974
|
|
Assertion failure: args[0].isObject(), at builtin/TypedObject.cpp:2401 or Crash [@ js::ObjectIsTypedHandle]
|
Core
|
JavaScript Engine
|
nmatsakis
|
VERI
|
FIXE
|
2015-02-25
|
| 1827340
|
|
crash in [@ blendTextureNearestFast]
|
Core
|
Graphics: WebRender
|
nobody
|
VERI
|
FIXE
|
2023-12-06
|
| 787493
|
|
Crash with ASSERTION: insPos too small
|
Core
|
DOM: Core & HTML
|
smaug
|
VERI
|
FIXE
|
2024-05-30
|