High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionUse-after-free in the DOM: Core & HTML component
ComponentDOM
Bug ClassLogic Error
Tracker2068340
Fix commit4edd1f2de258 (firefox) +23/-10
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Files Changed

  • dom/xml/nsXMLContentSink.cpp
  • dom/xml/nsXMLContentSink.h
  • dom/xml/nsXMLFragmentContentSink.cpp
diff --git a/dom/xml/nsXMLContentSink.cpp b/dom/xml/nsXMLContentSink.cpp
index 77ec01bd946..a07667efd11 100644
--- a/dom/xml/nsXMLContentSink.cpp
+++ b/dom/xml/nsXMLContentSink.cpp
@@ -1021,12 +1021,12 @@ nsXMLContentSink::HandleStartElement(const char16_t* aName,
                                      uint32_t aAttsCount, uint32_t aLineNumber,
                                      uint32_t aColumnNumber) {
   return HandleStartElement(aName, aAtts, aAttsCount, aLineNumber,
-                            aColumnNumber, true);
+                            aColumnNumber, FROM_PARSER_NETWORK);
 }
 
 nsresult nsXMLContentSink::HandleStartElement(
     const char16_t* aName, const char16_t** aAtts, uint32_t aAttsCount,
-    uint32_t aLineNumber, uint32_t aColumnNumber, bool aInterruptable) {
+    uint32_t aLineNumber, uint32_t aColumnNumber, FromParser aFromParser) {
   MOZ_RELEASE_ASSERT(aAttsCount % 2 == 0, "incorrect aAttsCount");
   // Adjust aAttsCount so it's the actual number of attributes
   aAttsCount /= 2;
@@ -1059,9 +1059,9 @@ nsresult nsXMLContentSink::HandleStartElement(
   nodeInfo = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
                                            nsINode::ELEMENT_NODE);
 
-  result = CreateElement(aAtts, aAttsCount, nodeInfo, aLineNumber,
-                         aColumnNumber, getter_AddRefs(content), &appendContent,
-                         FROM_PARSER_NETWORK);
+  result =
+      CreateElement(aAtts, aAttsCount, nodeInfo, aLineNumber, aColumnNumber,
+                    getter_AddRefs(content), &appendContent, aFromParser);
   NS_ENSURE_SUCCESS(result, result);
 
   // Have to do this before we push the new content on the stack... and have to
@@ -1112,8 +1112,7 @@ nsresult nsXMLContentSink::HandleStartElement(
       nsContentUtils::AddScriptRunner(
           MakeAndAddRef<nsDocElementCreatedNotificationRunner>(mDocument));
 
-      if (aInterruptable && NS_SUCCEEDED(result) && mParser &&
-          !mParser->IsParserEnabled()) {
+      if (NS_SUCCEEDED(result) && mParser && !mParser->IsParserEnabled()) {
         return NS_ERROR_HTMLPARSER_BLOCK;
       }
     } else if (!mCurrentHead) {
@@ -1123,8 +1122,7 @@ nsresult nsXMLContentSink::HandleStartElement(
     }
   }
 
-  return aInterruptable && NS_SUCCEEDED(result) ? DidProcessATokenImpl()
-                                                : result;
+  return NS_SUCCEEDED(result) ? DidProcessATokenImpl() : result;
 }
 
 NS_IMETHODIMP
diff --git a/dom/xml/nsXMLContentSink.h b/dom/xml/nsXMLContentSink.h
index 20e4a706e34..e9d2c0b3520 100644
--- a/dom/xml/nsXMLContentSink.h
+++ b/dom/xml/nsXMLContentSink.h
@@ -178,7 +178,8 @@ class nsXMLContentSink : public nsContentSink,
 
   nsresult HandleStartElement(const char16_t* aName, const char16_t** aAtts,
                               uint32_t aAttsCount, uint32_t aLineNumber,
-                              uint32_t aColumnNumber, bool aInterruptable);
+                              uint32_t aColumnNumber,
+                              mozilla::dom::FromParser aFromParser);
   nsresult HandleEndElement(const char16_t* aName, bool aInterruptable);
   nsresult HandleCharacterData(const char16_t* aData, uint32_t aLength,
                                bool aInterruptable);
diff --git a/dom/xml/nsXMLFragmentContentSink.cpp b/dom/xml/nsXMLFragmentContentSink.cpp
index dea4e4e2d92..fc00573c2f0 100644
--- a/dom/xml/nsXMLFragmentContentSink.cpp
+++ b/dom/xml/nsXMLFragmentContentSink.cpp
@@ -39,6 +39,9 @@ class nsXMLFragmentContentSink : public nsXMLContentSink,
                                const nsAString& aSystemId,
                                const nsAString& aPublicId,
                                nsISupports* aCatalogData) override;
+  NS_IMETHOD HandleStartElement(const char16_t* aName, const char16_t** aAtts,
+                                uint32_t aAttsCount, uint32_t aLineNumber,
+                                uint32_t aColumnNumber) override;
   NS_IMETHOD HandleProcessingInstruction(const char16_t* aTarget,
                                          const char16_t* aData) override;
   NS_IMETHOD HandleXMLDeclaration(const char16_t* aVersion,
@@ -159,6 +162,17 @@ bool nsXMLFragmentContentSink::SetDocElement(int32_t aNameSpaceID,
   return false;
 }
 
+NS_IMETHODIMP
+nsXMLFragmentContentSink::HandleStartElement(const char16_t* aName,
+                                             const char16_t** aAtts,
+                                             uint32_t aAttsCount,
+                                             uint32_t aLineNumber,
+                                             uint32_t aColumnNumber) {
+  return nsXMLContentSink::HandleStartElement(aName, aAtts, aAttsCount,
+                                              aLineNumber, aColumnNumber,
+                                              FROM_PARSER_FRAGMENT);
+}
+
 nsresult nsXMLFragmentContentSink::CreateElement(
     const char16_t** aAtts, uint32_t aAttsCount,
     mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
Loading diff…