347899
|
|
[FIX]crash when restarting for update [@ nsCSSStyleSheet::SetComplete]
|
Core
|
CSS Parsing and Comp
|
bzbarsky
|
RESO
|
FIXE
|
2011-06-09
|
335334
|
|
Fix string URI consumers to use CheckLoadURIStr
|
Firefox
|
General
|
gavin.sharp
|
RESO
|
FIXE
|
2006-10-11
|
350640
|
|
rsa signature verification ignores garbage bytes (CVE-2006-4340)
|
NSS
|
Libraries
|
kaie
|
RESO
|
FIXE
|
2010-06-17
|
347054
|
|
crashes finalizing plugin scriptability objects inside js_GC [@ _PR_MD_ATOMIC_DECREMENT] [@ _PR_DarwinPPC_AtomicDecrement()] [@ 0x6c707538]
|
Core
|
JavaScript Engine
|
mrbkap
|
RESO
|
FIXE
|
2011-06-09
|
351079
|
|
RSA signature DigestInfo not checked properly in NSS (CVE-2006-4340)
|
NSS
|
Libraries
|
nelson
|
RESO
|
FIXE
|
2009-07-25
|
351848
|
|
DecryptSigBlock does not check the message digest's length is correct
|
NSS
|
Libraries
|
nelson
|
RESO
|
FIXE
|
2010-06-17
|
27382
|
|
ownerDocument of orphan text and attr nodes is null
|
Core
|
DOM: Core & HTML
|
jonas
|
RESO
|
FIXE
|
2014-04-26
|
339246
|
|
Crash [@ nsIFrame::GetStyleData] called by nsTableRowFrame::CollapseRowIfNecessary
|
Core
|
Layout: Tables
|
bernd_mozilla
|
RESO
|
FIXE
|
2011-06-13
|
339315
|
|
Crash [@ nsCachedStyleData::GetStyleData] called within nsTableColFrame::GetStyleWidth
|
Core
|
Layout: Tables
|
bernd_mozilla
|
RESO
|
FIXE
|
2011-06-13
|
343087
|
|
multiple tfoot cellmap crash [@ nsCellMap::GetCellInfoAt]
|
Core
|
Layout: Tables
|
bernd_mozilla
|
RESO
|
FIXE
|
2011-06-13
|
343778
|
|
ASSERT: numColsInCache == numColsInMap, "cell map has too many cols"
|
Core
|
Layout: Tables
|
bernd_mozilla
|
RESO
|
FIXE
|
2006-09-07
|
344000
|
|
dom cellmap crash
|
Core
|
Layout: Tables
|
bernd_mozilla
|
RESO
|
FIXE
|
2009-04-24
|
347796
|
|
Borders disappear when collapsing files on Bugzilla's "diff" view
|
Core
|
Layout: Tables
|
bernd_mozilla
|
RESO
|
FIXE
|
2006-09-01
|
318006
|
|
DNS checks not being consistently applied to URLs when proxy configured
|
Core
|
Networking
|
darin.moz
|
RESO
|
FIXE
|
2006-09-13
|
336501
|
|
crash if update post containing file to upload [@ nsBufferedInputStream::Read]
|
Core
|
Networking
|
darin.moz
|
RESO
|
FIXE
|
2011-06-09
|
253479
|
|
position:fixed elements in XUL document crash/hang browser [@nsHTMLReflowState::CalculateHypotheticalBox]
|
Core
|
Layout: Positioned
|
dbaron
|
RESO
|
FIXE
|
2011-06-13
|
339518
|
|
Switching IMAP folders while "mark-as-spam" is running causes a crash [@ nsMsgDBView::DeleteMessages]
|
MailNews Core
|
Database
|
ispiked
|
RESO
|
FIXE
|
2011-06-09
|
343175
|
|
PopupBlocker XSS
|
Core
|
Security
|
jstenback+bmo
|
RESO
|
FIXE
|
2006-11-10
|
348062
|
|
Crash [@ nsArraySH::GetProperty] with stirtable and removestyles stuff and removing iframe
|
Core
|
DOM: Core & HTML
|
jstenback+bmo
|
RESO
|
FIXE
|
2019-03-13
|
271815
|
|
GTK2 IM over-the-spot doesn't work with Chinese IM because the editor doesn't return correct caret position
|
Core
|
DOM: Editor
|
masayuki
|
RESO
|
FIXE
|
2012-02-08
|
337419
|
|
[FIX] Crash with float, columns, and a feed [@ nsFontMetricsMac::Init] [@ nsUnicodeFontMappingMac::GetFontID] [@ nsIFrame::AddStateBits] [@ nsTextStyle::nsTextStyle]
|
Core
|
Layout
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2011-06-13
|
337883
|
|
This testcases causes nsBlockFrame::FindLineFor to look at a freed frame
|
Core
|
Layout
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2007-12-23
|
344557
|
|
[columns] Crash [@ nsLineBox::DeleteLineList] with moz-column-count and generated content
|
Core
|
Layout
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2013-01-26
|
348688
|
|
Crash/hang [@ nsLineBox::RemovePlaceholderDescendantsOf ][@ ntdll.dll] on avrev.com with Adblock Plus 0.7.1.1 enabled
|
Core
|
Layout
|
MatsPalmgren_bugz
|
RESO
|
FIXE
|
2011-06-13
|
335738
|
|
migration wizard does not appear after removing user's application support/firefox folder
|
Firefox
|
Migration
|
mwu.code
|
RESO
|
FIXE
|
2006-08-29
|
348511
|
|
XSLTProcessor.setParameter("","f3ck",array) causes heap trouble
|
Core
|
XSLT
|
peterv
|
RESO
|
FIXE
|
2008-10-17
|
307826
|
|
Crash when floated <html:div> is removed from <math:mi> parent [@ nsFrameManager::ReResolveStyleContext]
|
Core
|
MathML
|
rbs
|
RESO
|
FIXE
|
2007-12-17
|
344085
|
|
still content can implement tree views
|
Core
|
XUL
|
roc
|
RESO
|
FIXE
|
2008-07-31
|
184363
|
|
Crash with tooltip [@ nsXULTooltipListener::KillTooltipTimer] [@ nsXULTooltipListener::DestroyTooltip] [@ nsXULTooltipListener::HideTooltip]
|
Core
|
XUL
|
smaug
|
RESO
|
FIXE
|
2006-08-24
|
344959
|
|
Functions may lose part or all of their scope chain after an exception
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-10-30
|
346494
|
|
JS_ASSERT(JSVAL_IS_INT(rval)) - js1_5/Regress/regress-104077.js bug: none result: FAILED type: BROWSER|SHELL
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-09-04
|
350312
|
|
Accessing wrong stack slot with nested catch/finally
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-10-10
|
306940
|
|
crash involving -moz-popup [@ IncrementalReflow::AddCommand]
|
Core
|
Layout
|
bzbarsky
|
VERI
|
FIXE
|
2011-06-13
|
335333
|
|
[FIX]Relative, remote images which have a Content-Base fail to display.
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
VERI
|
FIXE
|
2008-07-31
|
344291
|
|
[FIX]Crash [@ nsIView::Destroy] on 1.8.0.5 and 1.8.1 branch
|
Core
|
Layout
|
bzbarsky
|
VERI
|
FIXE
|
2011-06-13
|
348049
|
|
[FIX]Frames not destroyed with this XBL + <td> testcase
|
Core
|
XBL
|
bzbarsky
|
VERI
|
FIXE
|
2007-12-18
|
348729
|
|
[FIX]Crash [@ nsRuleNode::GetParentData] with :first-letter anonymous content and removing styles
|
Core
|
Layout
|
bzbarsky
|
VERI
|
FIXE
|
2011-06-13
|
349695
|
|
login field does not appear (content of iframe is below visible area)
|
Core
|
Layout: Tables
|
bzbarsky
|
VERI
|
FIXE
|
2009-10-26
|
346090
|
|
crash with this javascript regexp [@ js_NewStringCopyN]
|
Core
|
JavaScript Engine
|
crowderbt
|
VERI
|
FIXE
|
2011-06-13
|
343713
|
|
JS_ASSERT(JSVAL_TO_OBJECT(v) == OBJ_GET_PARENT(cx, thisp));
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-08-20
|
344711
|
|
js engine crashes trying to report a syntax error, due to uninitialized field
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-09-13
|
346794
|
|
RegExp ending in '[\\' reads past end of string
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-10-10
|
343168
|
|
frame spoofing using document.open()
|
Core
|
Security
|
mrbkap
|
VERI
|
FIXE
|
2007-05-31
|
343283
|
|
SeaMonkey segfaults on FreeBSD when using PrefBar since version 3.3 (wrong handling of malloc?)
|
Core
|
DOM: Core & HTML
|
mrbkap
|
VERI
|
FIXE
|
2019-03-13
|
348635
|
|
js1_5/Exceptions/regress-273931.js FAIL 1.8.0 branch only
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2006-08-19
|
336921
|
|
e4x: extra, undesired <br/> tags created
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2007-02-15
|
315859
|
|
Crash when using any arrow key on a radio input enclosed in a fieldset, and radio name is the same than fieldset id [@ nsHTMLFormElement::GetNextRadioButton]
|
Core
|
DOM: UI Events & Foc
|
alfred.peng
|
VERI
|
FIXE
|
2019-03-13
|
336999
|
|
Crash involving XUL menus, position: fixed, position: absolute [@ nsIFrame::GetNextSibling] [@ nsCSSFrameConstructor::FindFrameWithContent]
|
Core
|
XUL
|
alfred.peng
|
VERI
|
FIXE
|
2011-06-13
|
285727
|
|
remove crash prone form hack from frame construction
|
Core
|
Layout
|
bernd_mozilla
|
VERI
|
FIXE
|
2007-12-16
|
302911
|
|
crash when attempting to print the page [@ nsCachedStyleData::GetStyleData]
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2011-06-09
|
330998
|
|
Crash [@ nsLayoutUtils::GetFloatFromPlaceholder] involving tables, forms, and float
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2011-06-13
|
336291
|
|
Crash [@ nsTableFrame::GetRowGroupFrame]
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2011-06-09
|
339130
|
|
Crash in [@ nsVoidArray::Count] called by nsCellMap::RebuildConsideringRows
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2011-06-13
|
339170
|
|
Crash [@ nsTableColGroupFrame::GetStartColumnIndex]
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2011-06-13
|
342559
|
|
Crash [@ BasicTableLayoutStrategy::AssignNonPctColumnWidths] with display: table-header-group; and display: table-row;
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2011-06-09
|
344057
|
|
Crash [@ nsTableFrame::GetRowGroupFrame] on 1.8.1 branch
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2011-06-13
|
347725
|
|
Crash [@ nsTableRowFrame::CollapseRowIfNecessary]
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2011-06-09
|
343984
|
|
js1_5/Regress/regress-140852.js result: FAILED type: shell (DEBUG)
|
Core
|
JavaScript Engine
|
bob
|
VERI
|
FIXE
|
2007-02-15
|
350760
|
|
Fix jsemit.c to avoid assertbotching on the 1.8.0 branch
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2006-10-10
|
331825
|
|
Unable to do conditional gets via XMLHttpRequest with 1.5.0.1, works in 1.0.7
|
Core
|
Networking: HTTP
|
darin.moz
|
VERI
|
FIXE
|
2007-03-03
|
327738
|
|
Reset Camino doesn't reset minimized windows
|
Camino Graveyard
|
General
|
froodian
|
VERI
|
FIXE
|
2006-08-29
|
346782
|
|
Bookmark toggle behavior is broken
|
Camino Graveyard
|
Bookmarks
|
froodian
|
VERI
|
FIXE
|
2006-08-29
|
345967
|
|
Yet another unrooted atom in jsarray.c
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2006-10-10
|
348532
|
|
Integer overflow when constructing Error.stack
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2008-11-11
|
348986
|
|
Missed recursion check in Decompile from jsopcode.c
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2006-09-05
|
350837
|
|
cx->throwing is not cleared in finally
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2006-09-02
|
346233
|
|
hang [@ nsRange::PopRanges]
|
Core
|
DOM: Core & HTML
|
jonas
|
VERI
|
FIXE
|
2013-04-04
|
321299
|
|
Crash [@ XPCNativeInterface::GetName] involving frames
|
Core
|
DOM: Core & HTML
|
jstenback+bmo
|
VERI
|
FIXE
|
2019-03-13
|
343611
|
|
Firefox crash when print the "Server not found" error page [@ nsNativeThemeGTK::DrawWidgetBackground]
|
Core
|
Widget: Gtk
|
leon.sha
|
VERI
|
FIXE
|
2011-06-09
|
345649
|
|
1.5.0.x getMoreThemes and getMoreExtensions link don't work after Mozilla servers move to new colocation
|
Mozilla Localization
|
pl / Polish
|
marcoos+bmo
|
VERI
|
FIXE
|
2006-08-30
|
345155
|
|
crash [@ nsEventStateManager::GetDocSelectionLocation]
|
Core
|
DOM: UI Events & Foc
|
MatsPalmgren_bugz
|
VERI
|
FIXE
|
2019-03-13
|
348887
|
|
Crash [@ nsFrameList::DestroyFrames] on reload with -moz-column-count, -moz-inline-block and blockquote::first-letter
|
Core
|
Layout
|
MatsPalmgren_bugz
|
VERI
|
FIXE
|
2011-06-13
|
346288
|
|
croczilla sample makes latest firefox security release (1.5.0.5) unresponsive
|
Core
|
SVG
|
neil
|
VERI
|
FIXE
|
2006-08-29
|
331284
|
|
Crash with animated GIF, XUL, and float: right
|
Core
|
Layout
|
nobody
|
VERI
|
FIXE
|
2007-12-15
|
331446
|
|
Crash [@ nsFrameManager::ReResolveStyleContext] involving columns, tables, positioning
|
Core
|
Layout
|
nobody
|
VERI
|
FIXE
|
2011-06-13
|
350633
|
|
Talkback is not present in 1.5.0.7 candidate builds
|
Firefox Build System
|
General
|
nobody
|
VERI
|
FIXE
|
2018-11-26
|
347355
|
|
Frames not destroyed (involves <mtable> and <mtd>)
|
Core
|
MathML
|
rbs
|
VERI
|
FIXE
|
2009-04-24
|
338770
|
|
text overwrites table in moz-column when height is set
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2006-12-03
|
345071
|
|
Crash [@ nsTextFrame::PrepareUnicodeText]
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2011-06-13
|
346431
|
|
reproducable crash [@ nsFrame::DisplaySelection]
|
Core
|
DOM: UI Events & Foc
|
roc
|
VERI
|
FIXE
|
2019-03-13
|
205735
|
|
Browser freeze/crash on this page after few clicks, xbl implementation issue - M17x FF10 [@ nsXBLPrototypeHandler::GetEventName] [@ nsXBLInsertionPoint::GetDefaultContent]
|
Core
|
XBL
|
smaug
|
VERI
|
FIXE
|
2012-04-19
|
231830
|
|
crash on style.display = 'none' for select element when event onchange occurs [@ nsStyleContext::GetRuleNode ][@ nsIFrame::Invalidate ]
|
Core
|
Layout
|
smaug
|
VERI
|
FIXE
|
2011-06-09
|
336592
|
|
Crash when window gets destroyed during selection event
|
Core
|
DOM: UI Events & Foc
|
smaug
|
VERI
|
FIXE
|
2019-03-13
|
337436
|
|
Crash [@ nsGlobalWindow::Blur] when window gets destroyed during blur event
|
Core
|
DOM: UI Events & Foc
|
smaug
|
VERI
|
FIXE
|
2019-03-13
|
343457
|
|
Crash when closing window while tooltip is about the be shown or hidden
|
Core
|
Layout
|
smaug
|
VERI
|
FIXE
|
2007-01-22
|
346054
|
|
Crash when removing <tooltip> before showing it
|
Core
|
Layout
|
smaug
|
VERI
|
FIXE
|
2006-08-15
|
349201
|
|
Crash [@ XULPopupListenerImpl::ClosePopup]
|
Core
|
XUL
|
smaug
|
VERI
|
FIXE
|
2011-06-13
|
346673
|
|
firefox crashes on svg file [@ nsSVGCairoRectRegion::Combine]
|
Core
|
SVG
|
tor
|
VERI
|
FIXE
|
2006-08-22
|