Firefox · Widget
CVE-2025-1020
Memory Corruption in Widget
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifwidget/cocoa/nsChildView.mm |
modified | |
ifwidget/nsBaseWidget.cpp |
modified |
Files Changed
widget/android/nsWindow.cppwidget/cocoa/nsChildView.mmwidget/gtk/nsWindow.cppwidget/nsBaseWidget.cppwidget/uikit/nsWindow.mm
Patch
diff --git a/widget/android/nsWindow.cpp b/widget/android/nsWindow.cpp
index c377529e589..b7211796e42 100644
--- a/widget/android/nsWindow.cpp
+++ b/widget/android/nsWindow.cpp
@@ -2252,8 +2252,6 @@ void nsWindow::Destroy() {
// Stuff below may release the last ref to this
nsCOMPtr<nsIWidget> kungFuDeathGrip(this);
- RemoveAllChildren();
-
// Ensure the compositor has been shutdown before this nsWindow is potentially
// deleted
nsBaseWidget::DestroyCompositor();
diff --git a/widget/cocoa/nsChildView.mm b/widget/cocoa/nsChildView.mm
index 5aeacfb2838..e8757f47bf7 100644
--- a/widget/cocoa/nsChildView.mm
+++ b/widget/cocoa/nsChildView.mm
@@ -359,7 +359,9 @@ nsCocoaWindow* nsChildView::GetAppWindowWidget() const {
void nsChildView::Destroy() {
NS_OBJC_BEGIN_TRY_IGNORE_BLOCK;
- if (mOnDestroyCalled) return;
+ if (mOnDestroyCalled) {
+ return;
+ }
mOnDestroyCalled = true;
// Stuff below may delete the last ref to this
diff --git a/widget/gtk/nsWindow.cpp b/widget/gtk/nsWindow.cpp
index 6ac27f3ba16..908e01b8c43 100644
--- a/widget/gtk/nsWindow.cpp
+++ b/widget/gtk/nsWindow.cpp
@@ -564,8 +564,6 @@ void nsWindow::OnDestroy(void) {
// Remove association between this object and its parent and siblings.
nsBaseWidget::Destroy();
- RemoveAllChildren();
-
NotifyWindowDestroyed();
}
diff --git a/widget/nsBaseWidget.cpp b/widget/nsBaseWidget.cpp
index 373f1b7a728..c7ec10d07fc 100644
--- a/widget/nsBaseWidget.cpp
+++ b/widget/nsBaseWidget.cpp
@@ -538,8 +538,10 @@ void nsBaseWidget::Destroy() {
// disconnect from the parent
if (mParent) {
mParent->RemoveFromChildList(this);
+ mParent = nullptr;
}
- mParent = nullptr;
+ // disconnect from the children
+ RemoveAllChildren();
}
nsIWidget* nsIWidget::GetTopLevelWidget() {
diff --git a/widget/uikit/nsWindow.mm b/widget/uikit/nsWindow.mm
index 9e0055c893e..a62653dc165 100644
--- a/widget/uikit/nsWindow.mm
+++ b/widget/uikit/nsWindow.mm
@@ -772,6 +772,8 @@ void nsWindow::Destroy() {
[mNativeView widgetDestroyed];
+ nsCOMPtr<nsIWidget> kungFuDeathGrip(this);
+
nsBaseWidget::Destroy();
// ReportDestroyEvent();
Loading diff…
References
On This Page