445004
|
|
[FIX]Plugins embedded in generated file:// loaded pages don't appear and don't play.
|
Core
|
Security
|
bzbarsky
|
RESO
|
FIXE
|
2009-06-08
|
457166
|
|
Conversation links in GMail Inbox do not expose an action, cannot be activated by screen readers.
|
Core
|
Disability Access AP
|
surkov.alexander
|
RESO
|
FIXE
|
2009-02-11
|
451946
|
|
TM: js -j crashes with SIGSEGV (js_ExecuteTree) with SELinux execheap protection
|
Core
|
JavaScript Engine
|
dvander
|
RESO
|
FIXE
|
2009-03-16
|
459323
|
|
Drag and Drop in input controls is broken
|
Core
|
DOM: Copy & Paste an
|
asaf
|
VERI
|
FIXE
|
2013-07-28
|
327765
|
|
Mozilla's cache does not invalidate on non-GET requests
|
Core
|
Networking: Cache
|
bjarne
|
VERI
|
FIXE
|
2010-02-25
|
380418
|
|
XMLHttpRequest allows reading HTTPOnly cookies
|
Core
|
Networking: Cookies
|
bjarne
|
VERI
|
FIXE
|
2009-03-04
|
451884
|
|
Crash [@ QuoteString] on the nytimes.com site
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-06-09
|
451906
|
|
Regression: Array index has different results
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-15
|
453024
|
|
Mochitest Assertion failure: vp + 2 + argc <= (jsval *) cx->stackPool.current->avail, at jsinterp.cpp:1066
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-15
|
454576
|
|
TM: JIT content enabled - cannot load Gmail
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2010-12-17
|
456511
|
|
TM: Make conversion work on arbitrary JSObjects
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-03-02
|
456692
|
|
"Assertion failure: slot < fp2->script->nslots" with nested eval
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2013-08-25
|
456810
|
|
TM: Crash on digg.com with adblock plus [@ ReconstructPCStack]
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-06-09
|
457920
|
|
regexp-dna.js and generality want JSOP_GETELEM(dense array, "0")
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-04-08
|
458851
|
|
TM: for-in loops skip every other value in certain cases
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-15
|
463259
|
|
"Assertion failure: VALUE_IS_FUNCTION(cx, fval)"
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-15
|
463334
|
|
TM: Crash [@ isPromoteInt] with generator
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2011-06-09
|
464978
|
|
TM: hang with "[] + null"
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-16
|
465013
|
|
TM: General Error trying to play video on CNN
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2010-12-17
|
465220
|
|
nested imacro abort not cleanly handled (botches assertions)
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-16
|
465347
|
|
Patch for bug 465241 introduces buggy js_Int32ToId
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-16
|
431701
|
|
set characterSet of XML DOM document created with createDocument() to UTF-8 and not ISO-8859-1
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
VERI
|
FIXE
|
2019-03-13
|
440595
|
|
[FIX]Line numbers are incorrectly reported in onerror
|
Core
|
General
|
bzbarsky
|
VERI
|
FIXE
|
2009-02-17
|
453406
|
|
[FIX]"ASSERTION: Child not in controls" and other badness
|
Core
|
DOM: Core & HTML
|
bzbarsky
|
VERI
|
FIXE
|
2009-03-05
|
432225
|
|
Spell Checker does not always identify misspelled words
|
Core
|
Spelling checker
|
chris
|
VERI
|
FIXE
|
2009-06-10
|
451958
|
|
Implement same-origin check plus Access Controls for video
|
Core
|
Audio/Video
|
chris
|
VERI
|
FIXE
|
2022-06-23
|
456479
|
|
TM: correctness bug with undefined turning into NaN
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-03-02
|
456667
|
|
TM: crash logging into Zimbra with JITs on
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-01-14
|
457069
|
|
TM: crash logging into Zimbra with JITs on
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-04-08
|
457171
|
|
TM: mochitest test_Prototype.html fails
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-04-02
|
465135
|
|
TM: JIT affects value of (true << true)
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-01-15
|
465145
|
|
TM: Crash [@ js_FlushJITCache] or [@ TraceRecorder::popAbortStack]
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2011-06-13
|
465192
|
|
Crash [@TraceRecorder::wasDeepAborted] - js1_7/extensions/regress-455982-01.js | js1_8/extensions/regress-452476.js
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2011-06-09
|
465272
|
|
TM: subtraction is broken
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-01-16
|
465483
|
|
TM: Type instability leads to undefined being added as a string instead of as a number
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-01-16
|
455748
|
|
TM: Assertion failed: "Should not move data from GPR to XMM" with [1][-0]
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-15
|
456826
|
|
TM: fatal assert on OOM when running jit code
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-24
|
457335
|
|
TM: we fail dom/tests/mochitest/ajax/jquery/test_jQuery.html
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-04-02
|
457351
|
|
TM: Can't use JSVAL_IS_BOOLEAN on trace since boolean type contains undefined.
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-03-02
|
457456
|
|
TM: "Assertion failed: cond->isCond()" with "if(true <= true)"
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-14
|
457580
|
|
TM: Crash [@ js_ValueToStringId] with /x/[-4]
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2011-06-13
|
461974
|
|
TM: crash at pentestmonkey.net/jsbm/index.html with jit enabled [@ @0x6edc54 - js_Interpret]
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2011-06-09
|
463281
|
|
regex crashes on sunspider with new LIR code
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-04-02
|
464403
|
|
TM: "Assertion failure: tm->recorder != NULL" looping over array of prints
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-03-07
|
465136
|
|
TM: JIT affects truthiness of (false == "")
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-15
|
465234
|
|
TM: JIT affects truthiness of ("" <= null)
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
465239
|
|
TM: JIT affects ("1e+81" ^ 3)
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
465241
|
|
TM: Wrong value for ("0" in [3])
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
465262
|
|
TM: JIT affects truthiness of (3 > null)
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
465308
|
|
TM: Interpreter and JIT disagree on (0 | ((0x60000009) * 0x60000009))
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
465337
|
|
"Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" with (6 - ((void 0) ^ 0x80000005))
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
465366
|
|
TM: Can't make payment on Capital One credit card with jit on
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
465424
|
|
TM: issue with post-decrement operator
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
453397
|
|
TM: fatal assert: script->main <= target && target < script->code + script->length, at jsopcode.cpp:5182
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-03-02
|
455691
|
|
TM: test_empty_body.js httpd.js test fails under JIT
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-03-02
|
460875
|
|
Crash in [@ js_TraceObject] browsing around on Cars.com with |javascript.options.jit.content| set to true
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2011-06-09
|
462989
|
|
Assertion failed: "need a way to EOT now, since this is trace end"
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-01-14
|
463842
|
|
Browser eats up all my memory (and more?) on http://l10n.mozilla.org/dashboard/
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-01-22
|
464010
|
|
regexp.test doesn't work on 64 bit linux builds
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-01-16
|
464979
|
|
TM: Crash [@ js_AbortRecording(JSContext*, char const*)]
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2011-06-09
|
464645
|
|
endless loop in javascript for-in when compiling with Sun Studio 12 with -xO0 -g
|
Core
|
JavaScript Engine
|
ginnchen+exoracle
|
VERI
|
FIXE
|
2009-03-02
|
417131
|
|
JS Enumeration Allocation Consternation
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2009-01-16
|
452913
|
|
Crash [@ js_SetPropertyHelper]
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2011-06-13
|
453105
|
|
Error: setting a property that has only a getter on cars.com
|
Core
|
DOM: Core & HTML
|
jorendorff
|
VERI
|
FIXE
|
2019-03-13
|
455982
|
|
TM: "Assertion failure: JS_ON_TRACE(cx)" with generator as getter
|
Core
|
JavaScript Engine
|
jorendorff
|
VERI
|
FIXE
|
2009-03-12
|
456384
|
|
TM: v8-richards.js benchmark opens a print dialog in browser with JIT enabled
|
Core
|
JavaScript Engine
|
jorendorff
|
VERI
|
FIXE
|
2009-03-18
|
460117
|
|
TM: Inconsistent results from hasOwnProperty with JIT enabled
|
Core
|
JavaScript Engine
|
jorendorff
|
VERI
|
FIXE
|
2009-01-15
|
462060
|
|
TM: JIT: Initializing an array to a constant in a loop doesn't work for some constant values
|
Core
|
JavaScript Engine
|
jwalden
|
VERI
|
FIXE
|
2009-01-14
|
465137
|
|
TM: JIT thinks !NaN is false
|
Core
|
JavaScript Engine
|
jwalden
|
VERI
|
FIXE
|
2009-01-15
|
305284
|
|
Background images from http don't trigger broken lock icon (mixed content)
|
Core
|
Security
|
kaie
|
VERI
|
FIXE
|
2012-10-18
|
458068
|
|
SVG fill="none" is broken - behaves like fill="black"
|
Core
|
SVG
|
longsonr
|
VERI
|
FIXE
|
2009-01-14
|
364315
|
|
Speculatively load referenced files while "real" parsing is blocked on a <script src=> load
|
Core
|
DOM: HTML Parser
|
mrbkap
|
VERI
|
FIXE
|
2020-10-15
|
436722
|
|
Bank of America Online Banking: Online Banking Overview does not load fully
|
Core
|
DOM: HTML Parser
|
mrbkap
|
VERI
|
FIXE
|
2009-01-30
|
444075
|
|
XPCNativeWrapper pollution using chrome XBL
|
Core
|
XPConnect
|
mrbkap
|
VERI
|
FIXE
|
2009-02-05
|
453462
|
|
TM: FCKeditor initialization breaks with JIT enabled (in 20080903 nightly)
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2010-03-22
|
455971
|
|
Mozilla 1.9.1b1pre prototype chain behavior differs from Mozilla 1.9
|
Core
|
DOM: Core & HTML
|
mrbkap
|
VERI
|
FIXE
|
2019-03-13
|
458145
|
|
Crash [@ nsINode::AppendChildTo] with source, body and link
|
Core
|
DOM: HTML Parser
|
mrbkap
|
VERI
|
FIXE
|
2011-06-09
|
444375
|
|
Table cells not wrapping on web page
|
Core
|
Layout: Tables
|
roc
|
VERI
|
FIXE
|
2008-12-26
|
454959
|
|
Scrollbar in Mac toolbar customization panel no longer scrolls content
|
Core
|
Web Painting
|
roc
|
VERI
|
FIXE
|
2018-08-29
|
438241
|
|
Mousover and mouseout don't behave with nested elements.
|
Core
|
DOM: Events
|
smaug
|
VERI
|
FIXE
|
2009-04-07
|
456271
|
|
Make it impossible to create script-exposed documents without script handling objects
|
Core
|
DOM: Core & HTML
|
smaug
|
VERI
|
FIXE
|
2019-03-13
|
460001
|
|
XSS by using two event listeners
|
Core
|
Security
|
smaug
|
VERI
|
FIXE
|
2012-08-07
|
444260
|
|
Wide <xul:button> causes nsNativeThemeCocoa::DrawCellWithScaling to autorelease a freed object
|
Core
|
Widget: Cocoa
|
smichaud
|
VERI
|
FIXE
|
2009-01-14
|
444864
|
|
Crash [@ nsNativeThemeCocoa::DrawCellWithScaling] with <html:input>, large letter-spacing
|
Core
|
Widget: Cocoa
|
smichaud
|
VERI
|
FIXE
|
2011-06-13
|
445531
|
|
[10.4] Esc key doesn't cancel out Ctrl+Tab panel
|
Core
|
Widget: Cocoa
|
smichaud
|
VERI
|
FIXE
|
2009-01-14
|
449111
|
|
Crash [@ nsNativeThemeCocoa::DrawPushButton] with huge word-spacing
|
Core
|
Widget: Cocoa
|
smichaud
|
VERI
|
FIXE
|
2011-06-13
|
444452
|
|
Crash with adding weird character into input
|
Core
|
Graphics
|
smontagu
|
VERI
|
FIXE
|
2008-12-30
|
458418
|
|
onclick event doesn't fire on empty fixed position elements
|
Core
|
DOM: Events
|
uriber
|
VERI
|
FIXE
|
2009-07-21
|
433917
|
|
Nested opacity causing painting errors, stuff not showing up
|
Core
|
Graphics
|
vladimir
|
VERI
|
FIXE
|
2009-04-15
|
443693
|
|
Integer overflow in info_callback() processing animated PNG
|
Core
|
Graphics: ImageLib
|
vladimir
|
VERI
|
FIXE
|
2009-02-17
|
458924
|
|
Changes to COLs in a COLGROUP are not reflected properly in a table with style table-layout:fixed
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2012-03-20
|
443071
|
|
Assertion failure with "for (;;[]=[])"
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-15
|
455973
|
|
TM: "Assertion failure: !cx->throwing" with getter that throws
|
Core
|
JavaScript Engine
|
brendan
|
VERI
|
FIXE
|
2009-01-16
|
437142
|
|
[FIX]Crash [@ nsStyleContext::Destroy] with image map, MathML
|
Core
|
Layout
|
bzbarsky
|
VERI
|
FIXE
|
2012-12-25
|
454578
|
|
Mozillazine forum pages load with large font when loaded in background
|
Core
|
Layout
|
bzbarsky
|
VERI
|
FIXE
|
2010-12-17
|
459439
|
|
Changing <audio> src can cause crashes
|
Core
|
Audio/Video
|
cajbir.bugzilla
|
VERI
|
FIXE
|
2009-08-08
|
450973
|
|
Login for Wells Fargo Bank fails (date portion of user agent string needs to be limited to 8 characters)
|
Core
|
Networking: HTTP
|
crowderbt
|
VERI
|
FIXE
|
2011-04-20
|
449647
|
|
After scrolling down and up again, the border-image parts haven't been repainted
|
Core
|
Layout
|
dbaron
|
VERI
|
FIXE
|
2009-04-15
|
454226
|
|
Media Queries: "all," should work
|
Core
|
CSS Parsing and Comp
|
dbaron
|
VERI
|
FIXE
|
2010-02-07
|
463687
|
|
"More info" on severity blocklist dialog doesnt do anything
|
Toolkit
|
Add-ons Manager
|
dtownsend
|
VERI
|
FIXE
|
2009-02-12
|
451322
|
|
TM: LirBufWriter does not NULL check
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2010-02-23
|
454315
|
|
TM: incorrect results for raytrace due to undefined passed for missing arguments
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-03-02
|
455547
|
|
TM: SCUMM interpreter (canvas + JS demo) crashes with JIT enabled
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-04-07
|
465756
|
|
Ignore browser.helperApps.deleteTempFileOnExit not being set in private browsing
|
Toolkit
|
Downloads API
|
ehsan.akhgari
|
VERI
|
FIXE
|
2008-12-29
|
457355
|
|
TM: Tell ins_choose to use cmov only if its available.
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-04-21
|
464413
|
|
"Assertion failed: _stats.freePages == _stats.pages"
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-22
|
449308
|
|
Quitting doesn't work when onbeforeunload handler poses dialog
|
Toolkit
|
Startup and Profile
|
honzab.moz
|
VERI
|
FIXE
|
2009-04-15
|
455871
|
|
[mac] Regression: drag & drop is not working at all after some-time of browser usage
|
Core
|
DOM: Copy & Paste an
|
honzab.moz
|
VERI
|
FIXE
|
2010-08-06
|
440911
|
|
Add CF_HDROP support back into Windows drag and drop data object (dragging images to some applications, e.g. PhotoShop, fails)
|
Core
|
Widget: Win32
|
jmathies
|
VERI
|
FIXE
|
2013-10-19
|
425153
|
|
It's unsafe to use non-chrome scripts, overlays and bindings
|
Core
|
DOM: Core & HTML
|
jstenback+bmo
|
VERI
|
FIXE
|
2019-03-13
|
438288
|
|
URI.path one character short after redirect involving fragment
|
Core
|
Networking
|
MatsPalmgren_bugz
|
VERI
|
FIXE
|
2009-04-14
|
456027
|
|
window.Function is an outer window's Function
|
Core
|
Security
|
mrbkap
|
VERI
|
FIXE
|
2013-08-25
|
446647
|
|
Checkboxes and radio buttons no longer scale in HTML
|
Core
|
Widget: Cocoa
|
mstange.moz
|
VERI
|
FIXE
|
2009-04-16
|
464067
|
|
memory leak while running SVG reftests
|
Core
|
SVG
|
peterv
|
VERI
|
FIXE
|
2009-01-14
|
451256
|
|
Visiting page without title after visiting a page with a title keeps the title of the previous page
|
Core
|
DOM: Core & HTML
|
roc
|
VERI
|
FIXE
|
2009-02-01
|
454751
|
|
Crash [@ nsCSSFrameConstructor::ConstructXULFrame] with treecols, display:table
|
Core
|
XUL
|
roc
|
VERI
|
FIXE
|
2013-03-31
|
456330
|
|
Background image is distorted
|
Core
|
Layout: Images, Vide
|
roc
|
VERI
|
FIXE
|
2018-08-29
|
459968
|
|
gfxTextRun::GetAdjustedSpacingArray "Attempting to allocate excessively large array" with pre-line
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2014-10-20
|
460012
|
|
Firefox 3.1b1 :before and :after wackiness
|
Core
|
CSS Parsing and Comp
|
roc
|
VERI
|
FIXE
|
2009-04-10
|
462968
|
|
Crash [@ nsCSSFrameConstructor::FindPrimaryFrameFor] with -moz-column, clear, td, huge padding
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2014-10-20
|
463217
|
|
New Tab and Overflow Scroll buttons look like they're sitting on a pedestal
|
Core
|
Layout: Images, Vide
|
roc
|
VERI
|
FIXE
|
2018-08-29
|
463301
|
|
Crash in [@ fbFetchPixel_x8r8g8b8] [@ fbFetchPixel_a8r8g8b8] when loading sandisk.com using Vista Ultimate
|
Core
|
Graphics
|
roc
|
VERI
|
FIXE
|
2011-06-09
|
463952
|
|
Table row background repeat-x problem
|
Core
|
Layout: Images, Vide
|
roc
|
VERI
|
FIXE
|
2018-08-29
|
384068
|
|
[10.5] Firefox should download files to Leopard's Download Stack by default
|
Toolkit
|
Downloads API
|
sdwilsh
|
VERI
|
FIXE
|
2009-06-23
|
314160
|
|
Typing focus lost when using any Midas buttons/selects except text color/hightlight color
|
Core
|
Widget: Cocoa
|
smichaud
|
VERI
|
FIXE
|
2009-03-05
|
453468
|
|
<textarea wrap="off"> no longer works
|
Core
|
DOM: Editor
|
smontagu
|
VERI
|
FIXE
|
2009-04-07
|
448104
|
|
Firefox crashing on shutdown - memory could not be read [@ nsAppShell:EventWindow]
|
Core
|
Widget: Win32
|
tellrob
|
VERI
|
FIXE
|
2011-06-09
|
451170
|
|
Hang with generated content and table display types
|
Core
|
Layout
|
bernd_mozilla
|
VERI
|
FIXE
|
2013-05-13
|
456008
|
|
[FIX]Dynamically loaded flash does not render in XHTML.
|
Core
|
XML
|
bzbarsky
|
VERI
|
FIXE
|
2009-01-14
|
450191
|
|
"ASSERTION: too late to set quirks style sheet" with document.write
|
Core
|
CSS Parsing and Comp
|
dbaron
|
VERI
|
FIXE
|
2011-11-30
|
453896
|
|
need to flush delayed resizes during layout flushes
|
Core
|
Layout
|
dbaron
|
VERI
|
FIXE
|
2016-02-08
|
455171
|
|
Crash [@ nsIFrame::GetPositionIgnoringScrolling] with moz-transform and generated content, position: fixed
|
Core
|
Layout
|
dbaron
|
VERI
|
FIXE
|
2011-06-09
|
457821
|
|
need to rebuild user font set objects when style sheets are disabled/enabled or rules are modified/added/removed
|
Core
|
CSS Parsing and Comp
|
dbaron
|
VERI
|
FIXE
|
2010-12-31
|
462844
|
|
Submenu appears at the bottom of the menu and can't be clicked
|
Core
|
CSS Parsing and Comp
|
dbaron
|
VERI
|
FIXE
|
2009-06-18
|
452157
|
|
Crash [@ nsFrameManager::CaptureFrameStateFor] with -moz-column, float
|
Core
|
Layout
|
dholbert
|
VERI
|
FIXE
|
2011-06-13
|
463819
|
|
Blocklisted add-ons with a compatibility update say they are incompatible rather than blocklisted
|
Toolkit
|
Add-ons Manager
|
dtownsend
|
VERI
|
FIXE
|
2009-04-14
|
420363
|
|
Scrollbars missing due to <meta http-equiv="MSThemeCompatible" content="no">
|
Core
|
Widget: Cocoa
|
jaas
|
VERI
|
FIXE
|
2014-01-31
|
393936
|
|
[PATCH] Crash [@ nsCellMapColumnIterator::GetNextFrame] with display: table-footer-group, binding, contenteditable and image
|
Core
|
Graphics: ImageLib
|
joe
|
VERI
|
FIXE
|
2011-06-09
|
441563
|
|
Crash [@imgRequest::NotifyProxyListener(imgRequestProxy*)] at tokyomango.com
|
Core
|
Graphics: ImageLib
|
joe
|
VERI
|
FIXE
|
2011-06-09
|
451636
|
|
Painting issue with Google reader
|
Core
|
Widget: Gtk
|
MatsPalmgren_bugz
|
VERI
|
FIXE
|
2009-02-26
|
370461
|
|
__proto__ of a function returned by Components.lookupMethod() comes from content
|
Core
|
XPConnect
|
mrbkap
|
VERI
|
FIXE
|
2013-08-25
|
451117
|
|
"ASSERTION: Reframes of this letter frame will mess with the root of a native anonymous content subtree!"
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2009-04-03
|
457398
|
|
ASSERTION: First-continuation first-letter should have first-letter style enabled in nsLineLayout
|
Core
|
Layout: Block and In
|
roc
|
VERI
|
FIXE
|
2009-06-09
|
462065
|
|
Bad scroll performance on http://en.wikipedia.org/wiki/Main_Page
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2009-07-23
|
463292
|
|
overflowing text-shadow in XUL labels not fully repainted
|
Toolkit
|
UI Widgets
|
roc
|
VERI
|
FIXE
|
2010-06-24
|
430394
|
|
Crash [@ nsTreeBodyFrame::SetView] with onoverflow doing stuff and tree and treechildren
|
Core
|
XUL
|
smaug
|
VERI
|
FIXE
|
2011-06-13
|
428070
|
|
Extremely slow scrolling on OS X with CSS "overflow: auto" and large HTML page
|
Core
|
Widget: Cocoa
|
smichaud
|
VERI
|
FIXE
|
2010-01-05
|
405740
|
|
Very slow scrolling on wikipedia pages
|
Core
|
Graphics
|
vladimir
|
VERI
|
FIXE
|
2009-05-07
|
448193
|
|
with border inset/outset, 1px, and -moz-border-radius, bottom and right sides are drawn in wrong color
|
Core
|
Layout
|
vladimir
|
VERI
|
FIXE
|
2012-09-09
|
458331
|
|
[Mac] 308917-1.svg triggers UMR [@ SurfacePatternDrawFunc]
|
Core
|
Graphics
|
vladimir
|
VERI
|
FIXE
|
2009-01-14
|
228856
|
|
[FIX] \0 in CSS is ignored
|
Core
|
CSS Parsing and Comp
|
zack+mozbugs
|
VERI
|
FIXE
|
2013-06-02
|
426629
|
|
"table-layout: fixed" is not invoked if width changes from auto to fixed dynamically
|
Core
|
Layout: Tables
|
bernd_mozilla
|
VERI
|
FIXE
|
2009-04-07
|
446328
|
|
Crash [@ nsImageLoader::RedrawDirtyFrame] with document that has -moz-border-image and gets display: none
|
Core
|
Layout
|
dbaron
|
VERI
|
FIXE
|
2011-06-13
|
391714
|
|
Notify user when plugin is blocklisted
|
Toolkit
|
Add-ons Manager
|
dtownsend
|
VERI
|
FIXE
|
2009-01-22
|
459790
|
|
Following Error console link causes uncaught exception ( 0x80004002 (NS_NOINTERFACE) [nsISupports.QueryInterface] )
|
Core
|
XPConnect
|
bent.mozilla
|
VERI
|
FIXE
|
2010-12-17
|
447579
|
|
[FIX]file: URIs inherit chrome privs if opened from chrome
|
Core
|
Security: CAPS
|
bzbarsky
|
VERI
|
FIXE
|
2009-01-14
|
448161
|
|
[FIX]"ASSERTION: Must have document!" and crash [@ nsStyleUtil::IsHTMLLink]
|
Core
|
CSS Parsing and Comp
|
bzbarsky
|
VERI
|
FIXE
|
2011-06-09
|
452964
|
|
[FIX]:before for element with {table-layout: fixed} and {display:table} causes gaps between table cells
|
Core
|
Layout: Tables
|
bzbarsky
|
VERI
|
FIXE
|
2009-04-02
|
460425
|
|
[FIX].desktop allows remotely loading "about:config" & "about:plugins" with little user interaction
|
Core
|
Networking: File
|
bzbarsky
|
VERI
|
FIXE
|
2009-03-04
|
465752
|
|
[FIX]###!!! ASSERTION: Sheet URI does not match passed URI: 'NS_SUCCEEDED(aSheetURI->Equals(uri, &equal)) && equal'
|
Core
|
CSS Parsing and Comp
|
bzbarsky
|
VERI
|
FIXE
|
2009-07-06
|
448680
|
|
Starting <video> playback causes master volume to jump to max
|
Core
|
Audio/Video
|
cajbir.bugzilla
|
VERI
|
FIXE
|
2014-08-06
|
449307
|
|
duration not supported for <video>
|
Core
|
Audio/Video
|
cajbir.bugzilla
|
VERI
|
FIXE
|
2008-12-12
|
450365
|
|
media/liboggplay needs COPYING file containing appropriate license
|
Core
|
Audio/Video
|
cajbir.bugzilla
|
VERI
|
FIXE
|
2009-04-02
|
430740
|
|
BOM characters are stripped from javascript before execution
|
Core
|
JavaScript Engine
|
crowderbt
|
VERI
|
FIXE
|
2009-03-02
|
453915
|
|
XML injection possible in E4X parsing via "default xml namespace"
|
Core
|
JavaScript Engine
|
crowderbt
|
VERI
|
FIXE
|
2009-01-14
|
463212
|
|
menupopups shouldn't inherit text-shadow
|
Toolkit
|
UI Widgets
|
dao+bmo
|
VERI
|
FIXE
|
2008-12-13
|
448281
|
|
font-size sometimes gets calculated wrong
|
Core
|
CSS Parsing and Comp
|
dbaron
|
VERI
|
FIXE
|
2014-10-11
|
453759
|
|
update media queries implementation to match recent spec changes
|
Core
|
CSS Parsing and Comp
|
dbaron
|
VERI
|
FIXE
|
2009-04-17
|
454227
|
|
Media Queries: incorrect EOF handling
|
Core
|
CSS Parsing and Comp
|
dbaron
|
VERI
|
FIXE
|
2009-04-17
|
462392
|
|
RebuildAllStyleData on iframe can crash-on-unwind after flushing parent and destroying iframe
|
Core
|
Layout
|
dbaron
|
VERI
|
FIXE
|
2013-05-13
|
420697
|
|
Crash [@ nsAttributeTextNode::~nsAttributeTextNode()] with text and stroke-dasharray and stroke-dashoffset
|
Core
|
SVG
|
dholbert
|
VERI
|
FIXE
|
2011-06-13
|
463789
|
|
TM: Crash [@ nanojit::LirBuffer::validate()] - js1_5/Regress/regress-280769-[15].js - FAIL
|
Core
|
JavaScript Engine
|
dmandelin
|
VERI
|
FIXE
|
2009-01-16
|
463803
|
|
Crash [@ memcpy] [@ js_NewStringCopyN]
|
Core
|
JavaScript Engine
|
dmandelin
|
VERI
|
FIXE
|
2011-06-09
|
455906
|
|
Support severities for blocklist entries
|
Toolkit
|
Add-ons Manager
|
dtownsend
|
VERI
|
FIXE
|
2010-04-16
|
452721
|
|
TM: Mismatched free() / delete / delete []
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-01-23
|
455173
|
|
TM: Crash on Accessing Adblock Plus Preferences
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-01-22
|
457795
|
|
TM: when charCodeAt returns a NaN, recording asserts
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-03-02
|
462826
|
|
memory leaks from tracemonkey merge Mon Oct 27 20:18:42 2008 -0700
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-01-14
|
463490
|
|
TM: Fatal assert on JS raytracer testcase: Assertion failure: !ti->stackTypeMap.matches(ti_other->stackTypeMap), at ../jstracer.cpp:2797
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-03-02
|
463829
|
|
Crash on Google Reader When Attempting To Open Feed With It's All Text! Extension [@ js_BlacklistPC(nanojit::Fragmento*, nanojit::Fragment*) ]
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2011-06-09
|
465580
|
|
TM: Crash when selecting "options" in new Yahoo Mail
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2010-12-17
|
465688
|
|
TM: "Assertion failure: (m != JSVAL_INT) || isInt32(*vp)" with (-0x80000000)
|
Core
|
JavaScript Engine
|
dvander
|
VERI
|
FIXE
|
2009-01-16
|
463885
|
|
Entering the Private Browsing mode may not always empty the download manager list
|
Toolkit
|
Downloads API
|
ehsan.akhgari
|
VERI
|
FIXE
|
2009-01-06
|
452083
|
|
Drag and Drop not working
|
Core
|
DOM: Copy & Paste an
|
enndeakin
|
VERI
|
FIXE
|
2010-12-17
|
453520
|
|
a link inside a <fieldset> cannot be dragged
|
Core
|
DOM: Copy & Paste an
|
enndeakin
|
VERI
|
FIXE
|
2009-04-16
|
454986
|
|
Drag and Drop of images is broken in designmode
|
Core
|
DOM: Editor
|
enndeakin
|
VERI
|
FIXE
|
2009-04-22
|
455215
|
|
[regression] drag and drop inside text input fields fails
|
Core
|
DOM: Copy & Paste an
|
enndeakin
|
VERI
|
FIXE
|
2009-01-22
|
422301
|
|
Crash [@ nsOverflowContinuationTracker::Insert] with -moz-column, padding, margin
|
Core
|
Layout
|
fantasai.bugs
|
VERI
|
FIXE
|
2011-06-13
|
456431
|
|
TM: Support thin loops (iteration < 2) by closing the loop even if we are on the last iteration.
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-03-02
|
464418
|
|
TM: "Assertion failure: fp->slots + fp->script->nfixed + js_ReconstructStackDepth(cx, fp->script, fp->regs->pc) == fp->regs->sp" with regexp match, gczeal
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-16
|
465133
|
|
TM: JIT affects object inequality
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-15
|
465276
|
|
TM: bizarre results for ((1 * (1)) | "")
|
Core
|
JavaScript Engine
|
gal
|
VERI
|
FIXE
|
2009-01-15
|
454324
|
|
Crash when selection-less items are dragged [@ nsINode::GetCurrentDoc() ]
|
Core
|
DOM: Copy & Paste an
|
gavin.sharp
|
VERI
|
FIXE
|
2020-05-07
|
450848
|
|
TM: js debug shell build failures on Windows XP
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-04-07
|
457979
|
|
TM: Random failures on Windows
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-04-03
|
460024
|
|
labels for multiple search results on Google Maps don't show up or re-position map
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2010-12-17
|
461915
|
|
Crash [@ NativeToValue] with gc and generator as getters
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2013-08-25
|
463956
|
|
TM: JIT: ecma/GlobalObject/15.1.2.4.js FAIL
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-01-16
|
464482
|
|
TM: Firefox freezes and crashes on Hitta.se
|
Core
|
JavaScript Engine
|
general
|
VERI
|
FIXE
|
2009-01-22
|
432467
|
|
firefox segfaults in plone kupu editor [@ nsDocAccessible::FlushPendingEvents], on Tablet PC [@arena_dalloc_small] (steps to reproduce in comment #26)
|
Core
|
Disability Access AP
|
ginnchen+exoracle
|
VERI
|
FIXE
|
2011-06-13
|
436870
|
|
FF3 RC1 loses SSL certificate exceptions
|
Core
|
Security: PSM
|
honzab.moz
|
VERI
|
FIXE
|
2009-01-14
|
444608
|
|
SM: jsxml.c assumes that Namespace and QName are read-only
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2009-03-02
|
457521
|
|
Crash [@ js_DecompileValueGenerator]
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2011-06-13
|
461158
|
|
js1_6/extensions/regress-456826.js: (Math|Date) is not defined
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2009-04-21
|
464334
|
|
Assertion failure: (size_t) (fp->regs->sp - fp->slots) <= fp->script->nslots, at /home/smaug/mozilla/mozilla_cvs/hg/mozilla/js/src/jsgc.cpp:2800
|
Core
|
JavaScript Engine
|
igor
|
VERI
|
FIXE
|
2009-01-15
|
448087
|
|
AppleScript curl/pTit: non-ASCII character in title comes through incorrectly
|
Core
|
Widget: Cocoa
|
jaas
|
VERI
|
FIXE
|
2009-04-02
|
451709
|
|
include obj-c exception info in crash reports
|
Core
|
General
|
jaas
|
VERI
|
FIXE
|
2008-12-13
|
448909
|
|
Need more controls WHATWG Video tag
|
Toolkit
|
Video/Audio Controls
|
jdinbox
|
VERI
|
FIXE
|
2015-12-01
|
463929
|
|
Wave backend for <audio> can't play back 8-bit samples
|
Core
|
Audio/Video
|
kinetik
|
VERI
|
FIXE
|
2008-12-25
|
403458
|
|
Incorrect display of right-to-left menus in Vista
|
Core
|
Widget: Win32
|
kliu
|
VERI
|
FIXE
|
2009-01-14
|
461283
|
|
Crash [@ fastcopy_I ] - printing broken
|
Core
|
Widget: Win32
|
lassey
|
VERI
|
FIXE
|
2011-06-09
|
459759
|
|
Crash [@ nsSVGMarkerFrame::GetCanvasTM]
|
Core
|
SVG
|
longsonr
|
VERI
|
FIXE
|
2011-06-09
|
459883
|
|
Crash [@ nsSVGFilterProperty::GetFilterFrame] with filter, MathML
|
Core
|
Layout
|
longsonr
|
VERI
|
FIXE
|
2014-10-20
|
441087
|
|
NS_ERROR_XPC_SECURITY_MANAGER_VETO in Greasemonkey JavaScript eval containing object.property
|
Core
|
Security
|
mrbkap
|
VERI
|
FIXE
|
2009-02-05
|
454142
|
|
Crash [@ js_TraceScopeProperty] with gczeal, setter, watch
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2012-04-18
|
456284
|
|
Null derefs in js_Interpret with split objects
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2009-01-22
|
460886
|
|
TM: "Assertion failure: end >= begin" with .substring()
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2010-02-22
|
465705
|
|
Valgrind - invalid read of size 1 in js_PCToLineNumber - js1_5/extensions/regress-454040.js
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2009-06-04
|
465901
|
|
DVG confused by |let|
|
Core
|
JavaScript Engine
|
mrbkap
|
VERI
|
FIXE
|
2013-08-25
|
462621
|
|
test_retention_is_0_closes.xul times out and leaks, on my computer
|
Toolkit
|
Downloads API
|
neil
|
VERI
|
FIXE
|
2008-12-10
|
452184
|
|
Debug Builds hang on exit on the Video Test Page
|
Core
|
Audio/Video
|
nobody
|
VERI
|
FIXE
|
2009-04-03
|
457533
|
|
In-page select boxes appear empty
|
Core
|
Layout: Form Control
|
nobody
|
VERI
|
FIXE
|
2009-04-03
|
458048
|
|
Drag & Drop of tabs crashing browser with new API [@ nsINode::GetCurrentDoc() ] [@ PresShell::CreateRangePaintInfo]
|
Core
|
DOM: Copy & Paste an
|
nobody
|
VERI
|
FIXE
|
2011-06-09
|
324121
|
|
Extensions with available updates for the next version of the app should not be listed in app update extension will be disabled warning
|
Toolkit
|
Application Update
|
robert.strong.bugs
|
VERI
|
FIXE
|
2012-06-09
|
464765
|
|
Update wizard back button displayed on Linux when it shouldn't
|
Toolkit
|
Application Update
|
robert.strong.bugs
|
VERI
|
FIXE
|
2009-04-26
|
419285
|
|
::first-letter applies to entire line following <br> at start of block
|
Core
|
Layout: Block and In
|
roc
|
VERI
|
FIXE
|
2009-04-13
|
422283
|
|
Crash [@ nsContainerFrame::ReflowOverflowContainerChildren] with -moz-column
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2011-06-13
|
423823
|
|
Overflowing tbody rows render background color for overflowing rows
|
Core
|
Layout: Tables
|
roc
|
VERI
|
FIXE
|
2009-07-21
|
450670
|
|
<br> tag fails to render? when it is before a <table> inside a <div> with text-align: justify
|
Core
|
Layout: Block and In
|
roc
|
VERI
|
FIXE
|
2009-04-16
|
451168
|
|
Borders around folder icons in directory listings (e.g. when viewing FTP sites)
|
Core
|
CSS Parsing and Comp
|
roc
|
VERI
|
FIXE
|
2009-01-14
|
460240
|
|
dynamic changes to box-shadow not invalidated correctly
|
Core
|
Layout
|
roc
|
VERI
|
FIXE
|
2009-07-09
|
463204
|
|
Emoticons are clipped after checkin for Bug 458487
|
Core
|
Layout: Images, Vide
|
roc
|
VERI
|
FIXE
|
2018-08-29
|
459293
|
|
Sites not loading - redeclaration const JSON error on console -
|
Core
|
JavaScript Engine
|
sayrer
|
VERI
|
FIXE
|
2010-12-17
|
462778
|
|
top crash [@ 0x20202020][@ xpsp2res.dll@0x202113][@ js_ConsumeJSONText]
|
Core
|
JavaScript Engine
|
sayrer
|
VERI
|
FIXE
|
2011-06-09
|
437415
|
|
Entering offline mode should pause active downloads
|
Toolkit
|
Downloads API
|
sdwilsh
|
VERI
|
FIXE
|
2008-12-17
|
449443
|
|
Upgrade to SQLite 3.6.4
|
Toolkit
|
Storage
|
sdwilsh
|
VERI
|
FIXE
|
2009-04-08
|
457743
|
|
Automatic wrapper creates cycles, and thus leaks
|
Toolkit
|
Storage
|
sdwilsh
|
VERI
|
FIXE
|
2009-01-14
|
464202
|
|
nsGlobalWindow leak running browser-chrome Mochitests
|
Toolkit
|
Storage
|
sdwilsh
|
VERI
|
FIXE
|
2008-12-10
|
443556
|
|
Crash [@ nsNodeUtils::LastRelease] with dynamic <svg:use> testcase
|
Core
|
SVG
|
smaug
|
VERI
|
FIXE
|
2013-08-25
|
464197
|
|
[FIX] Crash [@ nsMediaDecoder::Progress]
|
Core
|
Audio/Video
|
smaug
|
VERI
|
FIXE
|
2011-06-13
|
458961
|
|
[10.4] top crash [@ 0xfffeff20][@ libobjc.A.dylib@0x24c7][@ objc_msgSend][@ nsObjCExceptionLogAbort][@ nsNativeThemeCocoa::DrawCellWithScaling]
|
Core
|
Widget: Cocoa
|
smichaud
|
VERI
|
FIXE
|
2011-06-09
|
463285
|
|
After closing the search fields context menu the ctrl-tab panel cannot be closed anymore and results in crash [@ ensureCorrectMouseEventTarget]
|
Core
|
Widget: Cocoa
|
smichaud
|
VERI
|
FIXE
|
2011-06-09
|
445711
|
|
Firefox crashes when it meets over 25 "ௌ". (U+0BCC TAMIL VOWEL SIGN AU)
|
Core
|
Layout: Text and Fon
|
smontagu
|
VERI
|
FIXE
|
2009-04-02
|
444237
|
|
Crash [@ nsCSSValueList::`scalar deleting destructor'] with -moz-box-shadow: -moz-initial on input
|
Core
|
CSS Parsing and Comp
|
ventnor.bugzilla
|
VERI
|
FIXE
|
2011-06-09
|
446273
|
|
Column rule does not always stretch the full height of the column box.
|
Core
|
Layout
|
ventnor.bugzilla
|
VERI
|
FIXE
|
2009-01-14
|
461813
|
|
crash in [@ nsFrameSelection::HandleDrag]
|
Core
|
DOM: Selection
|
vladimir
|
VERI
|
FIXE
|
2011-06-09
|
461743
|
|
A chrome function runs on content can cause arbitrary code execution hole
|
Core
|
Security
|
zeniko
|
VERI
|
FIXE
|
2010-02-13
|
462774
|
|
drop JSON.jsm
|
Core
|
General
|
zeniko
|
VERI
|
FIXE
|
2009-02-11
|