Firefox · DOM
CVE-2026-117881
Logic Error in DOM
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
dom/base/NodeIterator.cppdom/base/NodeIterator.h
Patch
diff --git a/dom/base/NodeIterator.cpp b/dom/base/NodeIterator.cpp
index 2034517fbe7..7c5b5cccf5a 100644
--- a/dom/base/NodeIterator.cpp
+++ b/dom/base/NodeIterator.cpp
@@ -148,6 +148,8 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(NodeIterator)
NS_IMPL_CYCLE_COLLECTION_UNLINK_END
NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(NodeIterator)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRoot)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPointer.mNode)
+ NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mWorkingPointer.mNode)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFilter)
NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
diff --git a/dom/base/NodeIterator.h b/dom/base/NodeIterator.h
index 0e44f6d84ca..129d9aab1fd 100644
--- a/dom/base/NodeIterator.h
+++ b/dom/base/NodeIterator.h
@@ -64,7 +64,7 @@ class NodeIterator final : public nsStubMutationObserver, public nsTraversal {
void Clear() { mNode = nullptr; }
- nsINode* mNode;
+ nsCOMPtr<nsINode> mNode;
bool mBeforeNode;
};
Loading diff…
References
On This Page