High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the Graphics: Canvas2D component
ComponentGraphics
Bug ClassLogic Error
Tracker2075436
Fix commit5727a14a7868 (firefox) +5/-5
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-13

Changed Functions

FunctionChangeNotes
PathOps
gfx/2d/PathRecording.h
modified

Files Changed

  • gfx/2d/PathRecording.cpp
  • gfx/2d/PathRecording.h
diff --git a/gfx/2d/PathRecording.cpp b/gfx/2d/PathRecording.cpp
index 87f7ed2894e..2091f172b55 100644
--- a/gfx/2d/PathRecording.cpp
+++ b/gfx/2d/PathRecording.cpp
@@ -147,7 +147,7 @@ bool PathOps::CheckedStreamToSink(PathSink& aPathSink) const {
 
 void PathOps::TransformedCopyTo(const Matrix& aTransform,
                                 PathOps& aDest) const {
-  MOZ_ALWAYS_TRUE(
+  MOZ_RELEASE_ASSERT(
       aDest.mPathData.reserve(aDest.mPathData.length() + mPathData.length()));
   const uint8_t* nextByte = mPathData.begin();
   const uint8_t* end = mPathData.end();
diff --git a/gfx/2d/PathRecording.h b/gfx/2d/PathRecording.h
index 22686030ba7..fcf2686dc44 100644
--- a/gfx/2d/PathRecording.h
+++ b/gfx/2d/PathRecording.h
@@ -21,7 +21,7 @@ class PathOps {
   explicit PathOps(S& aStream);
 
   PathOps(const PathOps& aOther) {
-    MOZ_ALWAYS_TRUE(
+    MOZ_RELEASE_ASSERT(
         mPathData.append(aOther.mPathData.begin(), aOther.mPathData.length()));
   }
   PathOps& operator=(const PathOps&) = delete;  // assign using std::move()!
@@ -58,14 +58,14 @@ class PathOps {
 
   template <typename T>
   void AppendPathOp(const T& aOpData) {
-    MOZ_ALWAYS_TRUE(
+    MOZ_RELEASE_ASSERT(
         mPathData.append((const uint8_t*)(&aOpData), sizeof(aOpData)));
   }
 
   template <typename T>
   void AppendPathOp(const OpType& aOpType, const T& aOpParams) {
-    MOZ_ALWAYS_TRUE(mPathData.reserve(mPathData.length() + sizeof(aOpType) +
-                                      sizeof(aOpParams)));
+    MOZ_RELEASE_ASSERT(mPathData.reserve(mPathData.length() + sizeof(aOpType) +
+                                         sizeof(aOpParams)));
     mPathData.infallibleAppend((const uint8_t*)&aOpType, sizeof(aOpType));
     mPathData.infallibleAppend((const uint8_t*)&aOpParams, sizeof(aOpParams));
   }
Loading diff…