Firefox · DOM
CVE-2026-100831
Logic Error in DOM
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
ifdom/base/nsContentUtils.cpp |
modified |
Files Changed
dom/base/nsContentUtils.cppdom/script/ScriptLoader.cpp
Patch
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index ea54b389554..dac94ed968f 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -6552,9 +6552,10 @@ void nsContentUtils::RequestFrameFocus(Element& aFrameElement, bool aCanRaise,
RefPtr<Element> target = &aFrameElement;
bool defaultAction = true;
if (aCanRaise) {
- DispatchEventOnlyToChrome(target->OwnerDoc(), target,
- u"framefocusrequested"_ns, CanBubble::eYes,
- Cancelable::eYes, &defaultAction);
+ RefPtr<Document> doc = target->OwnerDoc();
+ DispatchEventOnlyToChrome(doc, target, u"framefocusrequested"_ns,
+ CanBubble::eYes, Cancelable::eYes,
+ &defaultAction);
}
if (!defaultAction) {
return;
diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
index 14c73204618..0d3fc3a683d 100644
--- a/dom/script/ScriptLoader.cpp
+++ b/dom/script/ScriptLoader.cpp
@@ -278,27 +278,27 @@ ScriptLoader::~ScriptLoader() {
FireScriptAvailable(NS_ERROR_ABORT, parserBlockRequest);
}
- for (ScriptLoadRequest* req = mXSLTRequests.getFirst(); req;
+ for (RefPtr<ScriptLoadRequest> req = mXSLTRequests.getFirst(); req;
req = req->getNext()) {
FireScriptAvailable(NS_ERROR_ABORT, req);
}
- for (ScriptLoadRequest* req = mDeferRequests.getFirst(); req;
+ for (RefPtr<ScriptLoadRequest> req = mDeferRequests.getFirst(); req;
req = req->getNext()) {
FireScriptAvailable(NS_ERROR_ABORT, req);
}
- for (ScriptLoadRequest* req = mLoadingAsyncRequests.getFirst(); req;
+ for (RefPtr<ScriptLoadRequest> req = mLoadingAsyncRequests.getFirst(); req;
req = req->getNext()) {
FireScriptAvailable(NS_ERROR_ABORT, req);
}
- for (ScriptLoadRequest* req = mLoadedAsyncRequests.getFirst(); req;
+ for (RefPtr<ScriptLoadRequest> req = mLoadedAsyncRequests.getFirst(); req;
req = req->getNext()) {
FireScriptAvailable(NS_ERROR_ABORT, req);
}
- for (ScriptLoadRequest* req =
+ for (RefPtr<ScriptLoadRequest> req =
mNonAsyncExternalScriptInsertedRequests.getFirst();
req; req = req->getNext()) {
FireScriptAvailable(NS_ERROR_ABORT, req);
Loading diff…
References
On This Page