Moderate firefox Logic Error 🔧 Commit mapped

Overview

Moderate
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactmoderate
DescriptionIncorrect boundary conditions in the Layout component
ComponentDOM
Bug ClassLogic Error
Tracker2068441
Fix commita9b68b366716 (firefox) +47/-1
CISA KEVNot listed
CreditedMozilla
Disclosed2026-10-13

Files Changed

  • docshell/base/BrowsingContext.cpp
  • dom/base/crashtests/2068441.html
  • dom/base/crashtests/crashtests.list
diff --git a/docshell/base/BrowsingContext.cpp b/docshell/base/BrowsingContext.cpp
index bcfcb767e89..a0a7b8df9ce 100644
--- a/docshell/base/BrowsingContext.cpp
+++ b/docshell/base/BrowsingContext.cpp
@@ -1224,7 +1224,7 @@ void BrowsingContext::PrepareForProcessChange() {
 }
 
 bool BrowsingContext::IsTargetable() const {
-  return !GetClosed() && AncestorsAreCurrent();
+  return !GetClosed() && AncestorsAreCurrent() && !Top()->GetIsPrinting();
 }
 
 void BrowsingContext::SetOpener(BrowsingContext* aOpener) {
diff --git a/dom/base/crashtests/2068441.html b/dom/base/crashtests/2068441.html
new file mode 100644
index 00000000000..8784d54387c
--- /dev/null
+++ b/dom/base/crashtests/2068441.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+  canvas {
+    break-before: page;
+  }
+  .fl {
+    position: fixed;
+    top: 0px;
+    left: 0px;
+  }
+  .fl::first-letter {
+    font-size: 3em;
+  }
+</style>
+</head>
+<body>
+<iframe name="pf" srcdoc="<p>x</p>"></iframe>
+<p class="fl" id="fp">                                                          aaa</p>
+
+<canvas></canvas>
+<script>
+function cb(state) {
+  const orig = document.querySelector("iframe[name=pf]");
+  // Brush aside the live page's browsing context for the iframe.
+  orig.name = "renamed";
+  // Printing context is still named `pf`, look for it.
+  const w = window.open("", "pf");
+  try {
+    w.parent.document.getElementById("fp").firstChild.data = "X";
+  } finally {
+    // Clean up for testing purposes.
+    w.close();
+    state.done();
+  }
+}
+
+document.querySelector("canvas").mozPrintCallback = cb;
+window.onload = () => { SpecialPowers.wrap(window).printPreview()?.close(); }
+</script>
+</body>
+</html>
+
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index 57449dbfd3e..f91d9975d9a 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -298,3 +298,4 @@ load 2035756.html
 load 2042268.html
 load 2052570.html
 pref(dom.enable_container_timing,true) load 2068341.html
+load 2068441.html
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/dom/base/crashtests/2068441.html b/dom/base/crashtests/2068441.html
new file mode 100644
index 00000000000..8784d54387c
--- /dev/null
+++ b/dom/base/crashtests/2068441.html
@@ -0,0 +1,45 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<style>
+  canvas {
+    break-before: page;
+  }
+  .fl {
+    position: fixed;
+    top: 0px;
+    left: 0px;
+  }
+  .fl::first-letter {
+    font-size: 3em;
+  }
+</style>
+</head>
+<body>
+<iframe name="pf" srcdoc="<p>x</p>"></iframe>
+<p class="fl" id="fp">                                                          aaa</p>
+
+<canvas></canvas>
+<script>
+function cb(state) {
+  const orig = document.querySelector("iframe[name=pf]");
+  // Brush aside the live page's browsing context for the iframe.
+  orig.name = "renamed";
+  // Printing context is still named `pf`, look for it.
+  const w = window.open("", "pf");
+  try {
+    w.parent.document.getElementById("fp").firstChild.data = "X";
+  } finally {
+    // Clean up for testing purposes.
+    w.close();
+    state.done();
+  }
+}
+
+document.querySelector("canvas").mozPrintCallback = cb;
+window.onload = () => { SpecialPowers.wrap(window).printPreview()?.close(); }
+</script>
+</body>
+</html>
+
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index 57449dbfd3e..f91d9975d9a 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -298,3 +298,4 @@ load 2035756.html
 load 2042268.html
 load 2052570.html
 pref(dom.enable_container_timing,true) load 2068341.html
+load 2068441.html
Loading diff…