[%- mypath = "${template.name}"|replace('[^\/]*$','') -%] [%- PROCESS "${mypath}/relnote.var" -%]

# Rough Changelog for [% rnote.name %]

This is a list of bugs pulled from Bugzilla. It's a "rough" list because I didn't verify each bug on the list as actually having been fixed in the [% rnote.version %] development cycle and I may have missed some that were; I just used the smartest Bugzilla queries I could devise. It's not perfect but if you're interested in what got fixed since [% rnote.relativeto.name %] this is probably the best place to start. -Robert

    476157 NSS_3_11_10_WITH_CKBI_1_67_RTM for 1.8 branch
    442012 Allocating more than 4GB using nsMemory::Alloc(size_t) succeeds but less memory is allocated
    461735 [FIX]Security: theft of strings cross-domain with redirect, <script src> and window.onerror
    363897 Don't give onerror handlers detailed information about syntax errors in off-site "scripts"
    481181 Update SeaMonkey version number on GECKO181_20090302_RELBRANCH
    365526 Security Error: Content at about: may not load or link to {xxx}.
    400822 Cert Viewer crashes when encountering improperly encoded GeneralNames (in AIA or CDP extensions) [@ ProcessGeneralName]
    470027 bug 461735 not fixed in 1.8.1.19 on Win32
    449006 [FIX] Crash [@ PlaceholderTxn::RedoTransaction] with redo, formatblock, DOMCharacterDataModified mutation listener
    472344 Regression - Crash [@ nsIFrame::GetView]  when using Silverlight
    472648 [FIX]XBL not working in signed jar
    479336 IDN blacklist needs to include box-drawing characters
    478901 Upgrade libpng to 1.2.35 (libpng-1.2.34 and earlier might free undefined pointers)
    475136 Crash [@ nsCSSStyleSheet::GetOwnerNode] after GC
    331088 crash with <input type=file> and events
    470461 [FIX]Create frames for XBL that's security-blocked (1.8 branch only).
    450876 Crash [@ nsEventStateManager::GetNextTabbableMapArea] with img usemap and tabindex
    454142 Crash [@ js_TraceScopeProperty] with gczeal, setter, watch
    473709 "Assertion failure: cursor == (uint8 *)copy->messageArgs[0] + argsCopySize, at jsexn.c" or "Assertion failure: cursor == (uint8 *)copy->messageArgs[0] + argsCopySize, at jsexn.cpp"
    380418 XMLHttpRequest allows reading HTTPOnly cookies
    414540 RDFXMLDataSource should reject cross-domain redirects
    437142 [FIX]Crash [@ nsStyleContext::Destroy] with image map, MathML
    401042 Crash [@ nsInlineFrame::ReflowFrames] with ::first-letter float, binding, pre and //