Firefox · Layout
CVE-2026-109726
Logic Error in Layout
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
iflayout/svg/SVGObserverUtils.cpp |
modified |
Files Changed
layout/svg/SVGObserverUtils.cpp
Patch
diff --git a/layout/svg/SVGObserverUtils.cpp b/layout/svg/SVGObserverUtils.cpp
index 190f5fc50e2..9075fa68fad 100644
--- a/layout/svg/SVGObserverUtils.cpp
+++ b/layout/svg/SVGObserverUtils.cpp
@@ -1330,6 +1330,7 @@ NS_DECLARE_FRAME_PROPERTY_RELEASABLE(OffsetPathProperty,
template <class T>
static T* GetEffectProperty(SVGReference* aReference, nsIFrame* aFrame,
const FramePropertyDescriptor<T>* aProperty) {
+ MOZ_ASSERT(!aFrame->GetPrevContinuation(), "Require first continuation");
if (!aReference) {
return nullptr;
}
@@ -1392,6 +1393,7 @@ static SVGFilterObserverListForCSSProp* GetOrCreateFilterObserverListForCSS(
nsIFrame* aFrame, bool aHasFilters,
FrameProperties::Descriptor<P> aProperty,
Span<const StyleFilter> aFilters) {
+ MOZ_ASSERT(!aFrame->GetPrevContinuation(), "Require first continuation");
if (!aHasFilters) {
return nullptr;
}
@@ -1729,6 +1731,9 @@ void SVGObserverUtils::RemoveTemplateObserver(nsIFrame* aFrame) {
Element* SVGObserverUtils::GetAndObserveBackgroundImage(nsIFrame* aFrame,
const nsAtom* aHref) {
+ // Continuations can come and go during reflow, and we don't need to observe
+ // the referenced element more than once for a given node.
+ aFrame = aFrame->FirstContinuation();
URIObserverHashtable* hashtable =
aFrame->GetOrCreateDeletableProperty(BackgroundImageProperty());
nsAutoString localRef = u"#"_ns + nsDependentAtomString(aHref);
@@ -1750,6 +1755,9 @@ Element* SVGObserverUtils::GetAndObserveBackgroundImage(nsIFrame* aFrame,
}
Element* SVGObserverUtils::GetAndObserveBackgroundClip(nsIFrame* aFrame) {
+ // Continuations can come and go during reflow, and we don't need to observe
+ // the referenced element more than once for a given node.
+ aFrame = aFrame->FirstContinuation();
BackgroundClipRenderingObserver* obs = aFrame->GetOrCreateReleasableProperty(
BackgroundClipObserverProperty(), aFrame);
return obs->GetAndObserveReferencedElement();
Loading diff…
References
On This Page