High firefox Logic Error 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Impacthigh
DescriptionIncorrect boundary conditions in the Layout: Tables component
ComponentLayout
Bug ClassLogic Error
Tracker2075432
Fix commit14ceedd5e0f1 (firefox) +42/-4
CISA KEVNot listed
CreditedAmy Burnett of OpenAI
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
layout/tables/nsTableFrame.cpp
modified
for
testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
modified

Files Changed

  • layout/tables/nsTableFrame.cpp
  • testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
diff --git a/layout/tables/nsTableFrame.cpp b/layout/tables/nsTableFrame.cpp
index 52a862bb55f..e7b9322bf90 100644
--- a/layout/tables/nsTableFrame.cpp
+++ b/layout/tables/nsTableFrame.cpp
@@ -168,10 +168,12 @@ void nsTableFrame::Init(nsIContent* aContent, nsContainerFrame* aParent,
   // Let the base class do its processing
   nsContainerFrame::Init(aContent, aParent, aPrevInFlow);
 
-  // see if border collapse is on, if so set it
-  const nsStyleTableBorder* tableStyle = StyleTableBorder();
-  bool borderCollapse =
-      (StyleBorderCollapse::Collapse == tableStyle->mBorderCollapse);
+  // Continuations share the first-in-flow's cell map and cell frame types.
+  // Keep their border model consistent even if their computed styles differ.
+  const bool borderCollapse =
+      aPrevInFlow ? static_cast<nsTableFrame*>(aPrevInFlow)->IsBorderCollapse()
+                  : StyleTableBorder()->mBorderCollapse ==
+                        StyleBorderCollapse::Collapse;
   SetBorderCollapse(borderCollapse);
   if (borderCollapse) {
     SetNeedToCalcHasBCBorders(true);
diff --git a/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html b/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
new file mode 100644
index 00000000000..1b4cec925b3
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
@@ -0,0 +1,36 @@
+<!doctype html>
+<meta charset="utf-8">
+<!--
+  This is really a crashtest, so we just ensure we don't render blank.
+-->
+<link rel="mismatch" href="/common/blank.html">
+<link rel="help" href="https://drafts.csswg.org/css-tables/">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2075432">
+<style>
+  * { margin: 0; padding: 0; }
+  #container { --border-model: separate; --border-color: blue; }
+  #container::first-line {
+    --border-model: collapse;
+    --border-color: red;
+  }
+  table { float: left; border-collapse: var(--border-model); }
+  td { border: 4px solid var(--border-color); }
+  tr { height: 30px; break-inside: avoid; }
+  @media print {
+    tr { border-top: 4px solid; }
+    col { border-right: 2px solid; }
+    #cell { container-type: inline-size; }
+  }
+  @page { size: 400px 220px; margin: 0; }
+</style>
+<div id="container"><span>Y<table cellspacing="3">
+  <col><col><col><col><col>
+  <thead><tr><td>Header<td>Header<td>Header<td>Header<td>Header</thead>
+  <tbody id="rows"></tbody>
+</table></span></div>
+<script>
+  for (let i = 0; i < 12; ++i) {
+    rows.insertAdjacentHTML("beforeend",
+      `<tr><td>A<td>B<td ${i === 9 ? 'id="cell"' : ''}>${i}<td>D<td>E</tr>`);
+  }
+</script>
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html b/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
new file mode 100644
index 00000000000..1b4cec925b3
--- /dev/null
+++ b/testing/web-platform/tests/css/css-tables/table-continuation-border-model-crash-print.html
@@ -0,0 +1,36 @@
+<!doctype html>
+<meta charset="utf-8">
+<!--
+  This is really a crashtest, so we just ensure we don't render blank.
+-->
+<link rel="mismatch" href="/common/blank.html">
+<link rel="help" href="https://drafts.csswg.org/css-tables/">
+<link rel="help" href="https://bugzilla.mozilla.org/show_bug.cgi?id=2075432">
+<style>
+  * { margin: 0; padding: 0; }
+  #container { --border-model: separate; --border-color: blue; }
+  #container::first-line {
+    --border-model: collapse;
+    --border-color: red;
+  }
+  table { float: left; border-collapse: var(--border-model); }
+  td { border: 4px solid var(--border-color); }
+  tr { height: 30px; break-inside: avoid; }
+  @media print {
+    tr { border-top: 4px solid; }
+    col { border-right: 2px solid; }
+    #cell { container-type: inline-size; }
+  }
+  @page { size: 400px 220px; margin: 0; }
+</style>
+<div id="container"><span>Y<table cellspacing="3">
+  <col><col><col><col><col>
+  <thead><tr><td>Header<td>Header<td>Header<td>Header<td>Header</thead>
+  <tbody id="rows"></tbody>
+</table></span></div>
+<script>
+  for (let i = 0; i < 12; ++i) {
+    rows.insertAdjacentHTML("beforeend",
+      `<tr><td>A<td>B<td ${i === 9 ? 'id="cell"' : ''}>${i}<td>D<td>E</tr>`);
+  }
+</script>
Loading diff…