Firefox · DOM
CVE-2026-100815
Logic Error in DOM
Overview
Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/Document.cpp |
modified | |
NodeIteratordom/base/Document.h |
modified | |
ProcessingInstructiondom/base/Document.h |
modified | |
Promisedom/base/Document.h |
modified |
Files Changed
dom/base/Document.cppdom/base/Document.h
Patch
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index a2ffaef1cc4..bedfc0446b7 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -12530,9 +12530,7 @@ void Document::Destroy() {
return;
}
- if (RefPtr transition = mActiveViewTransition) {
- transition->SkipTransition(SkipTransitionReason::DocumentHidden);
- }
+ MaybeSkipActiveViewTransition(SkipTransitionReason::DocumentHidden);
RemoveCustomContentContainer();
@@ -12933,9 +12931,7 @@ void Document::OnPageHide(bool aPersisted, EventTarget* aDispatchStartTarget,
}
if (inFrameLoaderSwap) {
- if (RefPtr transition = mActiveViewTransition) {
- transition->SkipTransition(SkipTransitionReason::PageSwap);
- }
+ MaybeSkipActiveViewTransition(SkipTransitionReason::PageSwap);
} else {
if (aPersisted) {
// We do not stop the animations (bug 1024343) when the page is refreshing
@@ -13045,9 +13041,7 @@ void Document::WillRemoveRoot() {
// tree is attached to our root element. This is not in the spec (yet), but
// prevents the view transition pseudo tree from being in an inconsistent
// state. See https://github.com/w3c/csswg-drafts/issues/12149
- if (RefPtr transition = mActiveViewTransition) {
- transition->SkipTransition(SkipTransitionReason::RootRemoved);
- }
+ MaybeSkipActiveViewTransition(SkipTransitionReason::RootRemoved);
RemoveCustomContentContainer();
IncrementExpandoGeneration(*this);
@@ -17467,9 +17461,15 @@ bool Document::SetOrientationPendingPromise(Promise* aPromise) {
return true;
}
+void Document::MaybeSkipActiveViewTransition(SkipTransitionReason aReason) {
+ if (RefPtr transition = mActiveViewTransition) {
+ transition->SkipTransition(aReason);
+ }
+}
+
void Document::MaybeSkipTransitionAfterVisibilityChange() {
- if (Hidden() && mActiveViewTransition) {
- mActiveViewTransition->SkipTransition(SkipTransitionReason::DocumentHidden);
+ if (Hidden()) {
+ MaybeSkipActiveViewTransition(SkipTransitionReason::DocumentHidden);
}
}
@@ -19775,13 +19775,11 @@ already_AddRefed<ViewTransition> Document::StartViewTransition(
transition->SkipTransition(SkipTransitionReason::DocumentHidden);
return transition.forget();
}
- if (mActiveViewTransition) {
- // Step 5:
- // If document's active view transition is not null, then skip that view
- // transition with an "AbortError" DOMException in this's relevant Realm.
- mActiveViewTransition->SkipTransition(
- SkipTransitionReason::ClobberedActiveTransition);
- }
+ // Step 5:
+ // If document's active view transition is not null, then skip that view
+ // transition with an "AbortError" DOMException in this's relevant Realm.
+ MaybeSkipActiveViewTransition(
+ SkipTransitionReason::ClobberedActiveTransition);
// Step 6: Set document's active view transition to transition.
mActiveViewTransition = transition;
diff --git a/dom/base/Document.h b/dom/base/Document.h
index 916c0251938..db0cf403f9d 100644
--- a/dom/base/Document.h
+++ b/dom/base/Document.h
@@ -268,6 +268,7 @@ class NodeInfo;
class NodeIterator;
enum class OrientationType : uint8_t;
enum class PopoverAttributeState : uint8_t;
+enum class SkipTransitionReason : uint8_t;
class ProcessingInstruction;
class Promise;
struct PropertyDefinition;
@@ -4245,6 +4246,7 @@ class Document : public nsINode,
return mActiveViewTransition;
}
void ClearActiveViewTransition();
+ void MaybeSkipActiveViewTransition(SkipTransitionReason);
MOZ_CAN_RUN_SCRIPT void PerformPendingViewTransitionOperations();
void EnsureViewTransitionOperationsHappen();
void MaybeSkipTransitionAfterVisibilityChange();
Loading diff…
References
On This Page