453222 cri -- Mac nobody@mozilla.org NEW nsCocoaWindow_NSWindow_sendEvent: changes exception behavior in code having nothing to do with core 459744 maj P2 All enndeakin@gmail.com ASSI Javascript can consume all keystrokes in content area, including tab and app menu shortcuts 389140 nor -- Mac alqahira@ardisson.org RESO FIXE Stop building in mozilla/themes 464542 nor -- All arjunaraoc@googlemail.com RESO FIXE [te] Backport about:rights to 3.0.5 426991 nor -- All dolske@mozilla.com RESO FIXE Form submission extremely slow on large forms (with form history turned on) 463154 nor -- All dolske@mozilla.com RESO FIXE Form history should record creation/usage timestamps. 483096 nor -- All dolske@mozilla.com RESO FIXE Backport formhistory timestamps to FF3.0.x 462739 nor -- All dtownsend@mozilla.com RESO FIXE Send cookies as appropriate with xpinstall requests 470578 nor -- All dwitte@stanford.edu RESO FIXE corrupt cookies.sqlite prevents db opening 478660 nor -- All filmil@gmail.com RESO FIXE [sr] Strings should have 3 forms in plural rule #7 471962 nor -- All gavin.sharp@gmail.com RESO FIXE When saving an inner frame as file only, the POST data of the outer page is sent to the address of the inner page 475971 nor -- All igor@mir2.org RESO FIXE js_CheckRedeclaration does not always unlock object on failures 481558 cri -- All jonas@sicking.cc RESO FIXE Loading an untrusted stylesheet should not allow that stylesheet to inject script using XBL 472998 nor -- All marcoos+bmo@marcoos.org RESO FIXE [pl] Reword issuerNotTrusted strings in cvs-trunk 456727 nor -- All matspal@gmail.com RESO FIXE document designMode on, replace/delete HTML tag, queryCommand*('backcolor'); causes NULL pointer 476823 nor -- All neil@httl.net RESO FIXE nsFileSystemDataSource doesn't implement nsISupports 479586 nor -- All nobody@mozilla.org RESO FIXE [et] Patch for changing title of Getting Started bookmark 435779 nor -- Linu Olli.Pettay@gmail.com RESO FIXE Crash [@ PostMessageEvent::Run()] 462517 cri -- All Olli.Pettay@gmail.com RESO FIXE nsAsyncInstantiateEvent::Run() uses pointer comparison to check if old frame == new frame 481624 maj -- Wind surkov.alexander@gmail.com RESO FIXE nsTextAccessibleWrap::get_fontFamily leaks 475334 nor -- All trev.moz@adblockplus.org RESO FIXE JavaScript debugger points to wrong script for calls of global functions 477185 min -- All unghost@mozilla-russia.org RESO FIXE [ru] 'Remove boormark'/'Number of downloads' translation may be misleading for 21 instances 477685 min -- All unghost@mozilla-russia.org RESO FIXE [ru] Wrong translate of "searchResultInstalled.label" in the "Get Add-ons" tab of "Add-ons" window 472064 nor P1 All dolske@mozilla.com RESO FIXE Satchel needs better upgrade/downgrade logic 484320 cri P1 All Olli.Pettay@gmail.com RESO FIXE XUL _moveToEdgeShift garbage-collection exploit (zdi-can-465) 416942 nor P2 Linu bzbarsky@mit.edu RESO FIXE [FIX]Give agent (and maybe user?) sheets the system principal 454276 cri P2 Wind dbaron@dbaron.org RESO FIXE Crash [@ nsStyleContext::Destroy()] with DOMAttrModified removing window, mathml:apply, iframe and window {display: none} style 473060 nor P2 All dtownsend@mozilla.com RESO FIXE Download error -228 if you leave the add-on's public page before download completion 479336 nor P2 All dveditz@mozilla.com RESO FIXE IDN blacklist needs to include box-drawing characters 475636 nor P2 All jonas@sicking.cc RESO FIXE Disallow refresh to javascript uris 483170 nor P2 All jonas@sicking.cc RESO FIXE Bogus security error when attaching a bindings with userContent.css 448329 cri P2 All matspal@gmail.com RESO FIXE Browser crashes after hitting the "tab" key within Smatermail webmail app [@ nsHTMLEditor::GetCSSBackgroundColorState] 477128 nor P2 Mac mrbkap@gmail.com RESO FIXE XPCNativeWrapper("foo") shouldn't throw 374820 nor P2 Mac robert.bugzilla@gmail.com RESO FIXE vertical scrollbars showing in the major update / EULA part of the software update UI 431341 nor P2 All roc@ocallahan.org RESO FIXE use of the :first-letter selector causes text-transform:capitalize to capitalize the second letter too 455826 nor P2 All roc@ocallahan.org RESO FIXE Incorrect line wrap at wikipedia 468543 tri -- All gavin.sharp@gmail.com VERI FIXE form autocomplete (and Firefox search bar) items are sorted case sensitively (A-Za-z) 355829 cri -- Mac igor@mir2.org VERI FIXE "Assertion failure: !argc || JSVAL_IS_NULL(argv[0]) || JSVAL_IS_VOID(argv[0])" 461158 nor -- All igor@mir2.org VERI FIXE js1_6/extensions/regress-456826.js: (Math|Date) is not defined 401300 min -- All jorendorff@mozilla.com VERI FIXE jsapi.h now depends on unpublished header jsutil.h 480016 nor -- All jorendorff@mozilla.com VERI FIXE js/tests/js1_8_1/extensions/regress-477187.js uses timeout() but doesn't expectExitCode(6) 450876 cri -- Wind martijn.martijn@gmail.com VERI FIXE Crash [@ nsEventStateManager::GetNextTabbableMapArea] with img usemap and tabindex 477928 nor -- All matspal@gmail.com VERI FIXE "ASSERTION: wrong InlinePrefWidthData container for first continuation" with -moz-column 400822 cri -- All mozbugzilla@velox.ch VERI FIXE Cert Viewer crashes when encountering improperly encoded GeneralNames (in AIA or CDP extensions) [@ ProcessGeneralName] 480096 nor -- Wind mrbkap@gmail.com VERI FIXE mozillas implementation of [Array.lastIndexOf] handling [Undefined] types in comparison to its native [Array.prototype.lastIndexOf] 485286 nor -- All mrbkap@gmail.com VERI FIXE XSLT should heap allocate all evalContexts 461053 cri -- All Olli.Pettay@gmail.com VERI FIXE [FIX] Crash [@ nsXULDocument::SynchronizeBroadcastListener] with command 473284 cri -- Mac Olli.Pettay@gmail.com VERI FIXE Crash when calling advanceFocusIntoSubtree({}) 477237 cri -- Wind Olli.Pettay@gmail.com VERI FIXE Crash [@ nsXULTemplateQueryProcessorXML::GetDatasource] with DOMAttrModified removing window, observes and datasources 453736 cri P1 All bzbarsky@mit.edu VERI FIXE [FIX]Crash under nsSVGElement::BindToTree with , 482659 maj P1 All bzbarsky@mit.edu VERI FIXE [FIX]AOL.com/AIM.com inline/attached images don't display 476049 cri P1 All igor@mir2.org VERI FIXE JSOP_DEFVAR enables gvar optimization for non-permanent properties 485217 nor P1 All mrbkap@gmail.com VERI FIXE Exploitable crash in [@txMozillaXSLTProcessor::TransformToDoc ] 483086 nor P1 All rflint@mozilla.com VERI FIXE non-http[s] SearchForm URIs should be ignored (possible XSS if a malicious search plugin is installed) 453955 cri P2 All brendan@mozilla.org VERI FIXE "Assertion failure: sprop->setter != js_watch_set || pobj != obj, at jsdbgapi.c" 467881 cri P2 All dbaron@dbaron.org VERI FIXE Crash [@ IsBindingAncestor] with frameset, iframe, {ib} 477775 cri P2 All dbaron@dbaron.org VERI FIXE Crash with iExploder test 2203 [@ nsComputedDOMStyle::GetWidth] 446568 maj P2 All gavin.sharp@gmail.com VERI FIXE New window losing focus in 3.0.1 478901 cri P2 All glennrp@gmail.com VERI FIXE Upgrade libpng to 1.2.35 (libpng-1.2.34 and earlier might free undefined pointers) 474536 nor P2 All jduell.mcbugs@gmail.com VERI FIXE The jar: scheme ignores the content-disposition: header on the inner URI 487345 cri P2 All Olli.Pettay@gmail.com VERI FIXE Crash [@ nsObjectLoadingContent::Instantiate] when enabling Flashblock after visiting this URL 483444 cri P2 All peterv@propagandism.org VERI FIXE XSLT stylesheet compiler crashes 317216 nor P2 Linu smontagu@smontagu.org VERI FIXE UTF16 and UTF32 decoders allow invalid UTF16 into the core 432114 cri P3 Wind chris@pearce.org.nz VERI FIXE Crash [@ PL_DHashTableOperate][@ nsEditor::EndUpdateViewBatch] with DOMNodeInserted event listener removing window and frameset contenteditable 421203 cri P3 All dbaron@dbaron.org VERI FIXE Crash [@ InlineBackgroundData::GetContinuousRect] with XUL, rtl, background image 431260 cri P3 All dholbert@mozilla.com VERI FIXE Crash [@ gfxSkipCharsIterator::SetOffsets] with ::first-letter, position: absolute and setting innerHTML on root 461935 nor P3 All glennrp@gmail.com VERI FIXE Update libpng to 1.2.34 444027 cri P3 All matspal@gmail.com VERI FIXE Crash with iExploder test 40129979 [@ BuildTextRunsScanner::FindBoundaries]