Firefox · Layout
CVE-2025-14860
UAF in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iflayout/base/PresShell.cpp |
modified |
Files Changed
layout/base/PresShell.cpp
Patch
diff --git a/layout/base/PresShell.cpp b/layout/base/PresShell.cpp
index 64677bd5246..8596e4eef25 100644
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@@ -1114,18 +1114,6 @@ void PresShell::Destroy() {
mMVMContext = nullptr;
}
-#ifdef ACCESSIBILITY
- if (mDocAccessible) {
-# ifdef DEBUG
- if (a11y::logging::IsEnabled(a11y::logging::eDocDestroy))
- a11y::logging::DocDestroy("presshell destroyed", mDocument);
-# endif
-
- mDocAccessible->Shutdown();
- mDocAccessible = nullptr;
- }
-#endif // ACCESSIBILITY
-
MaybeReleaseCapturingContent();
EventHandler::OnPresShellDestroy(mDocument);
@@ -1184,6 +1172,18 @@ void PresShell::Destroy() {
mIsDestroying = true;
+#ifdef ACCESSIBILITY
+ if (mDocAccessible) {
+# ifdef DEBUG
+ if (a11y::logging::IsEnabled(a11y::logging::eDocDestroy))
+ a11y::logging::DocDestroy("presshell destroyed", mDocument);
+# endif
+
+ mDocAccessible->Shutdown();
+ mDocAccessible = nullptr;
+ }
+#endif // ACCESSIBILITY
+
// We can't release all the event content in
// mCurrentEventContentStack here since there might be code on the
// stack that will release the event content too. Double release
Loading diff…
References
On This Page