High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionSandbox escape in the XUL component
ComponentLayout
Bug ClassLogic Error
Tracker2071068
Fix commit3cb72c0e3c5f (firefox) +7/-6
CISA KEVNot listed
CreditedMozilla
Disclosed2026-09-29

Changed Functions

FunctionChangeNotes
if
layout/xul/nsXULPopupManager.cpp
modified

Files Changed

  • layout/xul/nsXULPopupManager.cpp
diff --git a/layout/xul/nsXULPopupManager.cpp b/layout/xul/nsXULPopupManager.cpp
index 243b533d585..4d407d8c22c 100644
--- a/layout/xul/nsXULPopupManager.cpp
+++ b/layout/xul/nsXULPopupManager.cpp
@@ -1593,7 +1593,7 @@ void nsXULPopupManager::PaintPopups(nsRefreshDriver* aRefreshDriver) {
     return;
   }
 
-  AutoTArray<std::pair<RefPtr<nsIWidget>, WeakFrame>, 32> popupsToPaint;
+  SegmentedVector<std::pair<RefPtr<nsIWidget>, WeakFrame>> popupsToPaint;
   for (nsMenuChainItem* item = mPopups.get(); item; item = item->GetParent()) {
     nsMenuPopupFrame* frame = item->Frame();
     if (!frame->IsVisibleOrHiding()) {
@@ -1604,16 +1604,17 @@ void nsXULPopupManager::PaintPopups(nsRefreshDriver* aRefreshDriver) {
       continue;
     }
     if (nsIWidget* widget = frame->GetWidget()) {
-      popupsToPaint.AppendElement(std::make_pair(widget, frame));
+      // If we don't paint it, alas.
+      popupsToPaint.InfallibleAppend(std::make_pair(widget, frame));
     }
   }
 
-  for (const auto& popupToPaint : Reversed(popupsToPaint)) {
-    nsIWidget* widget = popupToPaint.first;
-    nsMenuPopupFrame* frame = do_QueryFrame(popupToPaint.second.GetFrame());
+  for (auto iter = popupsToPaint.IterFromLast(); !iter.Done(); iter.Prev()) {
+    nsMenuPopupFrame* frame = do_QueryFrame(iter.Get().second.GetFrame());
     if (!frame) {
       continue;
     }
+    nsIWidget* widget = iter.Get().first;
     if (frame->PendingWidgetMoveResize()) {
       frame->ClearPendingWidgetMoveResize();
 
@@ -1640,7 +1641,7 @@ void nsXULPopupManager::PaintPopups(nsRefreshDriver* aRefreshDriver) {
     if (!widget->IsVisible()) {
       widget->Show(true);
     }
-    if (!popupToPaint.second.IsAlive() || !widget->NeedsPaint()) {
+    if (!iter.Get().second.IsAlive() || !widget->NeedsPaint()) {
       continue;
     }
     nsAutoScriptBlocker scriptBlocker;
Loading diff…