Firefox · Layout
CVE-2026-100787
Logic Error in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iflayout/xul/nsXULPopupManager.cpp |
modified |
Files Changed
layout/xul/nsXULPopupManager.cpp
Patch
diff --git a/layout/xul/nsXULPopupManager.cpp b/layout/xul/nsXULPopupManager.cpp
index 243b533d585..4d407d8c22c 100644
--- a/layout/xul/nsXULPopupManager.cpp
+++ b/layout/xul/nsXULPopupManager.cpp
@@ -1593,7 +1593,7 @@ void nsXULPopupManager::PaintPopups(nsRefreshDriver* aRefreshDriver) {
return;
}
- AutoTArray<std::pair<RefPtr<nsIWidget>, WeakFrame>, 32> popupsToPaint;
+ SegmentedVector<std::pair<RefPtr<nsIWidget>, WeakFrame>> popupsToPaint;
for (nsMenuChainItem* item = mPopups.get(); item; item = item->GetParent()) {
nsMenuPopupFrame* frame = item->Frame();
if (!frame->IsVisibleOrHiding()) {
@@ -1604,16 +1604,17 @@ void nsXULPopupManager::PaintPopups(nsRefreshDriver* aRefreshDriver) {
continue;
}
if (nsIWidget* widget = frame->GetWidget()) {
- popupsToPaint.AppendElement(std::make_pair(widget, frame));
+ // If we don't paint it, alas.
+ popupsToPaint.InfallibleAppend(std::make_pair(widget, frame));
}
}
- for (const auto& popupToPaint : Reversed(popupsToPaint)) {
- nsIWidget* widget = popupToPaint.first;
- nsMenuPopupFrame* frame = do_QueryFrame(popupToPaint.second.GetFrame());
+ for (auto iter = popupsToPaint.IterFromLast(); !iter.Done(); iter.Prev()) {
+ nsMenuPopupFrame* frame = do_QueryFrame(iter.Get().second.GetFrame());
if (!frame) {
continue;
}
+ nsIWidget* widget = iter.Get().first;
if (frame->PendingWidgetMoveResize()) {
frame->ClearPendingWidgetMoveResize();
@@ -1640,7 +1641,7 @@ void nsXULPopupManager::PaintPopups(nsRefreshDriver* aRefreshDriver) {
if (!widget->IsVisible()) {
widget->Show(true);
}
- if (!popupToPaint.second.IsAlive() || !widget->NeedsPaint()) {
+ if (!iter.Get().second.IsAlive() || !widget->NeedsPaint()) {
continue;
}
nsAutoScriptBlocker scriptBlocker;
Loading diff…
References
On This Page